Abstract: Systems and methods for safety-enabled control. Input values provided to a control system can be validated. Command gating can be performed for control values provided by the control system. Validation of input values and command gating for control values can be performed in accordance with respective validation windows. Validation windows can be dynamically adjusted based on data received via a sensor or interface.

Abstract: Systems and methods for safety-enabled control by: establishing a wireless communication channel with a plurality of remote control units via the wireless interface device; in response to establishing the wireless communication channels, operating a system-under-control in a supervised mode based on input received from at least one of the plurality of remote control units; in response to a mode switch command received from a first remote control unit of the plurality of remote control units, providing the other remote control units with a request for a mode switch confirmation; and, in response to confirming receipt of a safety-rated input from an autonomous control system and receipt of a mode switch confirmation from each of the other remote control units, operating the system-under-control in an autonomous mode based on input received from the autonomous control system.

Abstract: A method includes: receiving a message, via a communication link, including sensor data in a data stream from a sensor device and first reference data based on a deterministic function and a seed value; extracting the first reference data from the message; generating second reference data based on the deterministic function and the seed value; calculating a first quantity of bit errors in the first reference data based on the second reference data; calculating a bit error rate of the communication link based on the first quantity of bit errors; in response to the bit error rate exceeding a bit error rate threshold for the data stream, generating a second message representing a fault; and transmitting the second message to a second device.

Abstract: A system generates, by a first source microcontroller, a first data packet comprising a payload and a first error code, the payload indicating a safety state of a robot. The first source microcontroller transmits the data packet from the first source microcontroller to a second source microcontroller. The second source microcontroller generates a second data packet that includes the payload, the first error code and a second error code. The second source microcontroller transmits the second data packet to a sink microcontroller, wherein the sink microcontroller recovers the payload based on at least one of the first error code and the second error code.

Abstract: A feedback-diverse, dual-controller-architecture functional safety system includes: a first module; a second module; and an inter-module logic.

Abstract: A method includes: accessing first data in a data stream, the first data including an encoded value representing a safety state of an emergency stop device; classifying the data stream into a first data class based on the encoded value; accessing a policy, associated with the first data class, defining first target conditions; selecting a first communication link as a first active communication link for the data stream, the first communication link exhibiting first conditions corresponding to the first target conditions; transmitting the first data via the first communication link; in response to detecting a difference between the first conditions and the first target conditions, selecting a second communication link as a second active communication link for the first data stream, the second communication link exhibiting second conditions corresponding to the first target conditions; and transmitting second data in the data stream via the second communication link.

Abstract: A method includes, at a security agent executing on a computing platform including a set of resources and a first application: authenticating the security agent with a security device; accessing a configuration profile, from the security device, defining identity information associated with the first application and a first security policy defining a subset of resources, in the set of resources, to which the first application is permitted access; authenticating the first application based on the identity information; monitoring the set of resources responsive to execution of the first application on the computing platform; and issuing a command to cause the computing platform to enter a safe state in response to detecting an access by the first application to a first resource in the set of resources, the first resource excluded from the subset of resources.

Abstract: A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional timeout state of a second controller; a first valid fault codeword representing a fault timeout state of the second controller and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a system; and a second valid fault codeword representing a fault state of the system; in response to detecting receipt of a safety message from the second controller within a predefined time quantum, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

Abstract: A method comprising: accessing a response mapping defining a set of safety-critical functions associated with a safety-critical latency threshold and a set of safety responses, each safety response corresponding to a safety-critical function; executing a time-synchronization protocol with a transmitting system to calculate a clock reference; accessing a safety message schedule indicating an expected arrival time for each safety message in a series of safety messages based on the clock reference; for each safety message in the series of safety messages, calculating a latency of the safety message based on an arrival time of the safety message and the expected arrival time; and in response to a latency of a current safety message in the series of safety messages exceeding the safety-critical latency threshold, initiating the safety response corresponding to the safety-critical function for each safety-critical function in the set of safety-critical functions.

Abstract: A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional state of a controller subsystem; a first valid fault codeword representing a fault state of the controller subsystem and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a controller; and a second valid fault codeword representing a fault state of the controller; in response to detecting functional operation of the controller subsystem, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

Abstract: A method includes, at a first communication module: receiving a first message from a second communication module, the first message including a set of data in a first data stream from a first device; accessing a first configuration profile, in a set of configuration profiles, for the first data stream based on the first data stream identifier; generating a set of metrics for the first message; calculating a set of trust scores for the first message based on the set of metrics and the first configuration profile; generating a second message including the set of data and the set of trust scores; and transmitting the second message to a second device.

Abstract: A method comprising: accessing a response mapping defining a set of safety-critical functions associated with a safety-critical latency threshold and a set of safety responses, each safety response corresponding to a safety-critical function; executing a time-synchronization protocol with a transmitting system to calculate a clock reference; accessing a safety message schedule indicating an expected arrival time for each safety message in a series of safety messages based on the clock reference; for each safety message in the series of safety messages, calculating a latency of the safety message based on an arrival time of the safety message and the expected arrival time; and in response to a latency of a current safety message in the series of safety messages exceeding the safety-critical latency threshold, initiating the safety response corresponding to the safety-critical function for each safety-critical function in the set of safety-critical functions.

Abstract: A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional state of a controller subsystem; a first valid fault codeword representing a fault state of the controller subsystem and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a controller; and a second valid fault codeword representing a fault state of the controller; in response to detecting functional operation of the controller subsystem, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

Abstract: A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional state of a controller subsystem; a first valid fault codeword representing a fault state of the controller subsystem and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a controller; and a second valid fault codeword representing a fault state of the controller; in response to detecting functional operation of the controller subsystem, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

Abstract: A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional timeout state of a second controller; a first valid fault codeword representing a fault timeout state of the second controller and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a system; and a second valid fault codeword representing a fault state of the system; in response to detecting receipt of a safety message from the second controller within a predefined time quantum, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

Abstract: A method comprising: accessing a response mapping defining a set of safety-critical functions associated with a safety-critical latency threshold and a set of safety responses, each safety response corresponding to a safety-critical function; executing a time-synchronization protocol with a transmitting system to calculate a clock reference; accessing a safety message schedule indicating an expected arrival time for each safety message in a series of safety messages based on the clock reference; for each safety message in the series of safety messages, calculating a latency of the safety message based on an arrival time of the safety message and the expected arrival time; and in response to a latency of a current safety message in the series of safety messages exceeding the safety-critical latency threshold, initiating the safety response corresponding to the safety-critical function for each safety-critical function in the set of safety-critical functions.

Abstract: Systems and methods for safety-enabled control by: establishing a wireless communication channel with a plurality of remote control units via the wireless interface device; in response to establishing the wireless communication channels, operating a system-under-control in a supervised mode based on input received from at least one of the plurality of remote control units; in response to a mode switch command received from a first remote control unit of the plurality of remote control units, providing the other remote control units with a request for a mode switch confirmation; and, in response to confirming receipt of a safety-rated input from an autonomous control system and receipt of a mode switch confirmation from each of the other remote control units, operating the system-under-control in an autonomous mode based on input received from the autonomous control system.

Abstract: A dynamic multihoming management system for reliable data transmission in a robotic system. The system maintains links for data transmission between nodes. Data is categorized into different classes each associated with a set of requirements for data transmission. A first data class is functional safety data associated with a first set of requirements including a latency level below a first threshold. A second data class is associated with a second set of requirements. The system determines a set of links that satisfy the first set and the second set of requirements and selects a link as an active link to transmit data. The system monitors link status by calculating fitness metrics using different combination of factors for each class of data. Responsive to detecting a degradation in quality of the active link, the system determines to select a new active link for transmitting the safety data based on fitness metrics.

Abstract: Systems and methods for safety-enabled control.

Abstract: A system generates, by a first source microcontroller, a first data packet comprising a payload and a first error code, the payload indicating a safety state of a robot. The first source microcontroller transmits the data packet from the first source microcontroller to a second source microcontroller. The second source microcontroller generates a second data packet that includes the payload, the first error code and a second error code. The second source microcontroller transmits the second data packet to a sink microcontroller, wherein the sink microcontroller recovers the payload based on at least one of the first error code and the second error code.