Abstract: A method includes, by a key server: identifying a group of devices; accessing secret values pre-provisioned to devices in the group of devices; accessing prime numbers pre-provisioned to devices in the group of devices; generating a cryptographic key for communication among the group of devices; generating a message based on the secret values, the prime numbers, and the cryptographic key; and transmitting the message to a device in the group of devices. The method also includes, by a first device in the group of devices: in response to receiving the message, deriving the cryptographic key from the message based on a first secret value, pre-provisioned to the first device, and a first prime number pre-provisioned to the first device; and associating the cryptographic key with communication among the group of devices.

Abstract: Systems and methods for safety-enabled control by: establishing a wireless communication channel with a plurality of remote control units via the wireless interface device; in response to establishing the wireless communication channels, operating a system-under-control in a supervised mode based on input received from at least one of the plurality of remote control units; in response to a mode switch command received from a first remote control unit of the plurality of remote control units, providing the other remote control units with a request for a mode switch confirmation; and, in response to confirming receipt of a safety-rated input from an autonomous control system and receipt of a mode switch confirmation from each of the other remote control units, operating the system-under-control in an autonomous mode based on input received from the autonomous control system.

Abstract: An application processor receives first and safety state information from first and second microcontrollers, and respective first and second sets of bytes forming a first identifier of the first microcontroller and a second identifier of the second microcontroller. The processor concatenates a safety message including the first and second safety state information, the safety message including the first set of bytes and the second set of bytes. The processor transmits the safety message to a second application processor of a safety controller, which separates, the first set of bytes and the second set of bytes, compares at least one of the first set of bytes and the second set of bytes to a data structure of known microcontroller identifiers, and verifies the safety state information based on identifying a match.

Abstract: Systems and methods for safety-enabled control. Input values provided to a control system can be validated. Command gating can be performed for control values provided by the control system. Validation of input values and command gating for control values can be performed in accordance with respective validation windows. Validation windows can be dynamically adjusted based on data received via a sensor or interface.

Abstract: A method comprising: accessing a response mapping defining a set of safety-critical functions associated with a safety-critical latency threshold and a set of safety responses, each safety response corresponding to a safety-critical function; executing a time-synchronization protocol with a transmitting system to calculate a clock reference; accessing a safety message schedule indicating an expected arrival time for each safety message in a series of safety messages based on the clock reference; for each safety message in the series of safety messages, calculating a latency of the safety message based on an arrival time of the safety message and the expected arrival time; and in response to a latency of a current safety message in the series of safety messages exceeding the safety-critical latency threshold, initiating the safety response corresponding to the safety-critical function for each safety-critical function in the set of safety-critical functions.

Abstract: A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional state of a controller subsystem; a first valid fault codeword representing a fault state of the controller subsystem and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a controller; and a second valid fault codeword representing a fault state of the controller; in response to detecting functional operation of the controller subsystem, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

Abstract: A method includes: receiving a message, via a communication link, including sensor data in a data stream from a sensor device and first reference data based on a deterministic function and a seed value; extracting the first reference data from the message; generating second reference data based on the deterministic function and the seed value; calculating a first quantity of bit errors in the first reference data based on the second reference data; calculating a bit error rate of the communication link based on the first quantity of bit errors; in response to the bit error rate exceeding a bit error rate threshold for the data stream, generating a second message representing a fault; and transmitting the second message to a second device.

Abstract: A feedback-diverse, dual-controller-architecture functional safety system includes: a first module; a second module; and an inter-module logic.

Abstract: A method includes, at a security agent executing on a computing platform including a set of resources and a first application: authenticating the security agent with a security device; accessing a configuration profile, from the security device, defining identity information associated with the first application and a first security policy defining a subset of resources, in the set of resources, to which the first application is permitted access; authenticating the first application based on the identity information; monitoring the set of resources responsive to execution of the first application on the computing platform; and issuing a command to cause the computing platform to enter a safe state in response to detecting an access by the first application to a first resource in the set of resources, the first resource excluded from the subset of resources.

Abstract: Systems and methods for safety-enabled control. Input values provided to a control system can be validated. Command gating can be performed for control values provided by the control system. Validation of input values and command gating for control values can be performed in accordance with respective validation windows. Validation windows can be dynamically adjusted based on data received via a sensor or interface.

Abstract: A safety module having a plurality of microcontrollers receives an analog input and determines a value of the analog input. The microcontrollers each determine a respective ternary state of the device by identifying, from three candidate ranges of values, a range of values in which the value falls, wherein at least two of the plurality of microcontrollers uses different candidate ranges of values, determining, based on the identified range, a ternary state corresponding to the range, and assigning the determined ternary state as the respective ternary state. The safety module determines whether the ternary states from the two microcontrollers map to a fault state, and, where they do, cause a command a command to be output to the device to enter a safe state.

Abstract: Systems and methods for safety-enabled control by: establishing a wireless communication channel with a plurality of remote control units via the wireless interface device; in response to establishing the wireless communication channels, operating a system-under-control in a supervised mode based on input received from at least one of the plurality of remote control units; in response to a mode switch command received from a first remote control unit of the plurality of remote control units, providing the other remote control units with a request for a mode switch confirmation; and, in response to confirming receipt of a safety-rated input from an autonomous control system and receipt of a mode switch confirmation from each of the other remote control units, operating the system-under-control in an autonomous mode based on input received from the autonomous control system.

Abstract: A system generates, by a first source microcontroller, a first data packet comprising a payload and a first error code, the payload indicating a safety state of a robot. The first source microcontroller transmits the data packet from the first source microcontroller to a second source microcontroller. The second source microcontroller generates a second data packet that includes the payload, the first error code and a second error code. The second source microcontroller transmits the second data packet to a sink microcontroller, wherein the sink microcontroller recovers the payload based on at least one of the first error code and the second error code.

Abstract: A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional timeout state of a second controller; a first valid fault codeword representing a fault timeout state of the second controller and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a system; and a second valid fault codeword representing a fault state of the system; in response to detecting receipt of a safety message from the second controller within a predefined time quantum, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

Abstract: A method comprising: accessing a response mapping defining a set of safety-critical functions associated with a safety-critical latency threshold and a set of safety responses, each safety response corresponding to a safety-critical function; executing a time-synchronization protocol with a transmitting system to calculate a clock reference; accessing a safety message schedule indicating an expected arrival time for each safety message in a series of safety messages based on the clock reference; for each safety message in the series of safety messages, calculating a latency of the safety message based on an arrival time of the safety message and the expected arrival time; and in response to a latency of a current safety message in the series of safety messages exceeding the safety-critical latency threshold, initiating the safety response corresponding to the safety-critical function for each safety-critical function in the set of safety-critical functions.

Abstract: A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional state of a controller subsystem; a first valid fault codeword representing a fault state of the controller subsystem and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a controller; and a second valid fault codeword representing a fault state of the controller; in response to detecting functional operation of the controller subsystem, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

Abstract: A safety module having a plurality of microcontrollers receives an analog input and determines a value of the analog input. The microcontrollers each determine a respective ternary state of the device by identifying, from three candidate ranges of values, a range of values in which the value falls, wherein at least two of the plurality of microcontrollers uses different candidate ranges of values, determining, based on the identified range, a ternary state corresponding to the range, and assigning the determined ternary state as the respective ternary state. The safety module determines whether the ternary states from the two microcontrollers map to a fault state, and, where they do, cause a command a command to be output to the device to enter a safe state.

Abstract: Systems and methods for safety-enabled control.