Patent Description:
High integrity processing systems, typically, utilize two or more processing lanes within a computer to cross check calculated results and associated output commands prior to sending those output commands to the output hardware in the system. However, when two or more computing lanes have cross checked output commands, an issue can arise based on the susceptibility of the computer system when transferring the output command from the processors to an output hardware. Verifying that the cross checked output commands are transferred to the output hardware correctly requires an independent output vote function. Some verification operations include the performance of bit-wise comparison of the output commands on the two or more processing lanes for a fixed set of interfaces in an output hardware's memory space. <CIT> relates to error correction in multi-processor systems.

Disclosed is a system, as defined by claim <NUM>.

Also disclosed is a method, as defined by claim <NUM>.

Referring to <FIG>, there is shown an embodiment of a processing system <NUM> for implementing the teachings herein. In this embodiment, the system <NUM> has one or more central processing units (processors) 21a, 21b, 21c, etc. (collectively or generically referred to as processor(s) <NUM>). In one or more embodiments, each processor <NUM> may include a reduced instruction set computer (RISC) microprocessor. Processors <NUM> are coupled to system memory <NUM> (RAM) and various other components via a system bus <NUM>. Read only memory (ROM) <NUM> is coupled to the system bus <NUM> and may include a basic input/output system (BIOS), which controls certain basic functions of system <NUM>.

<FIG> further depicts an input/output (I/O) adapter <NUM> and a network adapter <NUM> coupled to the system bus <NUM>. I/O adapter <NUM> may be a small computer system interface (SCSI) adapter that communicates with a hard disk <NUM> and/or tape storage drive <NUM> or any other similar component. I/O adapter <NUM>, hard disk <NUM>, and tape storage device <NUM> are collectively referred to herein as mass storage <NUM>. Operating system <NUM> for execution on the processing system <NUM> may be stored in mass storage <NUM>. A network communications adapter <NUM> interconnects bus <NUM> with an outside network <NUM> enabling data processing system <NUM> to communicate with other such systems. A screen (e.g., a display monitor) <NUM> is connected to system bus <NUM> by display adaptor <NUM>, which may include a graphics adapter to improve the performance of graphics intensive applications and a video controller. In one embodiment, adapters <NUM>, <NUM>, and <NUM> may be connected to one or more I/O busses that are connected to system bus <NUM> via an intermediate bus bridge (not shown). Suitable I/O buses for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include common protocols, such as the Peripheral Component Interconnect (PCI). Additional input/output devices are shown as connected to system bus <NUM> via user interface adapter <NUM> and display adapter <NUM>. A keyboard <NUM>, mouse <NUM>, and speaker <NUM> all interconnected to bus <NUM> via user interface adapter <NUM>, which may include, for example, a Super I/O chip integrating multiple device adapters into a single integrated circuit.

In exemplary embodiments, the processing system <NUM> includes a graphics processing unit <NUM>. Graphics processing unit <NUM> is a specialized electronic circuit designed to manipulate and alter memory to accelerate the creation of images in a frame buffer intended for output to a display. In general, graphics processing unit <NUM> is very efficient at manipulating computer graphics and image processing and has a highly parallel structure that makes it more effective than general-purpose CPUs for algorithms where processing of large blocks of data is done in parallel. The processing system <NUM> described herein is merely exemplary and not intended to limit the application, uses, and/or technical scope of the present disclosure, which can be embodied in various forms known in the art.

Thus, as configured in <FIG>, the system <NUM> includes processing capability in the form of processors <NUM>, storage capability including system memory <NUM> and mass storage <NUM>, input means such as keyboard <NUM> and mouse <NUM>, and output capability including speaker <NUM> and display <NUM>. In one embodiment, a portion of system memory <NUM> and mass storage <NUM> collectively store an operating system coordinate the functions of the various components shown in <FIG> is merely a non-limiting example presented for illustrative and explanatory purposes.

Turning now to an overview of technologies that are more specifically relevant to aspects of the disclosure, high integrity processing systems, typically, utilize two or more processing lanes within a computer to cross check calculated results and associated output commands prior to sending those output commands to the output hardware in the system. However, when two or more computing lanes have cross checked output commands, an issue can arise based on the susceptibility of the computer system when transferring the output command from the processors to an output hardware. Verifying that the cross checked output commands are transferred to the output hardware correctly requires an independent output vote function and accompanying circuitry. Some verification operations include the performance of bit-wise comparison of the output commands on the two or more processing lanes for a fixed set of interfaces in an output hardware's memory space. A need exists for an efficient process for verifying the output commands transmitted on two or more processing lanes.

Turning now to an overview of the aspects of the disclosure, one or more embodiments address the above-described shortcomings of the prior art by providing a command line voting function using cryptographic hashing. The voting function treats a block of output commands as a message block containing a set of output identifier and output command pairs written to a processor specific buffer in a system output control hardware. As described above, the voting function is receiving a cross checked calculated result (e.g., output command) from processing devices using two or more processing lanes. Each processing lane writes an identical output message block (e.g., a block of output commands) based on previous cross processing lane comparisons. A hardware device generates a cryptographic hash value (e.g., SHA256) for each output message block and compares the hash value for each processor output buffer. If all hash values are the same, this is interpreted by the voting function as an indication that voted output command buffer has been correctly transferred by each processing lane and the data is valid to output to the output hardware. If only a certain number of output command buffers match based on the hash comparison, the hardware device utilizes a voting algorithm to select an appropriate output command buffer for use with the external devices connected with the system.

Turning now to a more detailed description of aspects of the present invention, <FIG> depicts a system <NUM> for command line voting utilizing a cryptographic hash according to one or more embodiments. The system <NUM> includes one or more processing circuits 202a, 202b. 202N (where N is an integer value greater than <NUM>). In one or more embodiments, the processing circuits <NUM> receive sensor data <NUM> from one or more sensors and utilize this sensor data to determine an output command to be transmitted to an output hardware <NUM>. For example, the sensor data <NUM> can be reading taken from any type of sensor including, but not limited to, temperature sensors, position sensors, and the like. These sensors are utilized for providing commands to output hardware <NUM> that will operated based on this sensor data <NUM>. For example, a thermostat may operate a compressor based on a temperature reading. The temperature reading is analyzed by the processing circuits <NUM>, for example, and an output command is sent to the compressor to initiate the action (e.g., engage the compressor). In highly critical systems, the output commands from the processing circuits <NUM> are initially cross checked between processing circuits <NUM>. Once cross checked and an agreed upon output command is generated, each processing circuit <NUM> outputs the agreed upon output command. The output command is subjected to a voting algorithm to verify the output command before being passed along to the output hardware <NUM>. As described above, typical systems compare each and every output command before passing the verified output command to the output hardware <NUM>. In one or more embodiments, the output hardware <NUM> includes any number or types of electrical or mechanical system components. If the output commands do not match, a voting algorithm will select a majority output command (e.g., <NUM> out of <NUM> match) to utilize as the output command forwarded to the output hardware <NUM>.

In one or more embodiments, the processing circuits <NUM>, FPGA <NUM>, and output hardware <NUM> and any other component of <FIG> can be implemented using any of the components of the processing system <NUM> found in <FIG>.

In one or more embodiments, the system <NUM> includes a plurality buffers 204a, 204b. 204N (where N is an integer value greater than <NUM>) and a plurality of processing circuit 202a, 202b. The system <NUM> also includes a cryptographic hash <NUM> and a field programmable gate array (FPGA) <NUM> that is utilized for output command voting before being sent to the output hardware <NUM>. In one or more embodiments, the plurality of buffers 204a, 204b. 204N are contained within the FPGA <NUM>. The buffers <NUM> includes an address that can have an associated hash value stored. When the processing circuits <NUM> generate an output command, the output command is stored in the output command buffer <NUM>. In one or more embodiments, after a specified number of output commands are written to the buffer <NUM>, the entire buffer or portions of the buffer <NUM> can be fed through a cryptographic hashing function to generate a hash <NUM> value for the buffer <NUM>. The FPGA <NUM> can then compare the hash <NUM> values for each buffer <NUM> and if all the hash <NUM> values match, the FPGA can utilize any one of the buffers 204a, 204b. 204N as the output commands. With this process, the FPGA <NUM> performs one comparison operation on all the output commands in the buffer <NUM> instead of doing a comparison operation each time there is an output command generated by the processing circuit <NUM>. In one or more embodiments, the number of output commands in the buffers <NUM> can match the number of FPGA outputs to the output hardware <NUM>. In one or more embodiments, the processing circuits <NUM> can fill the buffer <NUM> with a set of data and then write the count to another register within the FPGA as a signal to the FPGA <NUM> that the buffer <NUM> is filled with "N" sets of data and ready to be processed. In this case, each processing circuit <NUM> would have its own "buffer count" register that is updated after the buffer <NUM> is filled to tell the FPGA <NUM> how much data is in that buffer <NUM>. While the additional register is not shown in the illustrated embodiment, multiple registers and/or buffers can included in the circuitry of the FPGA <NUM>. The FPGA can provide status related to processing the output buffers <NUM> to indicate a successful update or the detection of dissimilar data among the buffers <NUM>. As part of the FPGA processing, the source data to be output is copied to an internal buffer within the FPGA for actual output processing. This double buffering mechanism prevents a race condition between the CPUs update of the <NUM> buffers with a new set of outputs and the FPGA processing the current set of outputs.

In one or more embodiments, the hash <NUM> is generated by a cryptographic hash function such as, for example, secure hash algorithm <NUM> (SHA-<NUM>).

<FIG> depicts a flow diagram of a method for command line voting utilizing hashing according to one or more embodiments. The method <NUM> begins at process step <NUM> which is obtaining, by an output logic device, a plurality of memory blocks from a plurality of buffers, each of the plurality of memory blocks comprising two or more output commands generated from a processing circuit based on a sensor data input. The commands are generated based on the sensor data taken from an accompanying sensor. For example, in a control system, the sensor data is utilized to adjust components in an electrical-mechanical system, such as an aircraft. If a temperature sensor reads a certain temperature, the control system will need to adjust a fan or air flow within the electrical-mechanical system which is done by transmitting an output command to the output hardware controlling the various components. For high criticality systems, fault tolerance is utilized to continue working in the presence of potential errors. At process step <NUM>, the method <NUM> includes generating, by a hash function, a hash value for each of the plurality of memory blocks. The hash value is utilized to map data of a certain size (e.g., the two or more output commands in the memory blocks) to a fixed size value. At process step <NUM>, the method <NUM> includes comparing the hash value for each of the plurality of memory blocks to determine an output memory block from the plurality of memory blocks. Here the hash value is a mapped value of all the output commands stored in the memory blocks. So, instead of comparing each and every output command for error checking, embodiments provide for the comparing of the hash value for a block of output command thus reducing the number of comparisons. At block <NUM>, the method <NUM> then includes outputting, to an output hardware, the two more output commands from the output memory block.

Additional processes may also be included. It should be understood that the processes depicted in <FIG> represent illustrations and that other processes may be added or existing processes may be removed, modified, or rearranged without departing from the scope of the appended claims.

To ensure that the output data from the CPUs <NUM> arrives in a synchronized fashion, the FPGA <NUM> can set a timer to ensure that the time between the first buffer 204a being updated and the last buffer 204N being updated is within some tolerance (i.e. the tolerance allowed between the multiple CPU lanes being synchronized. This also prevents the system <NUM> from hanging by waiting for the last CPU to update.

Claim 1:
A method for command line voting, the method comprising:
obtaining, by an output logic device, a plurality of memory blocks from a plurality of buffers, each of the plurality of memory blocks comprising two or more output commands generated from a processing circuit based on a sensor data input;
generating, by a hash function, a hash value that represents all the output commands of the two or more output commands for each memory block in the plurality of memory blocks;
comparing the hash value for each memory block of the plurality of memory blocks to determine an output memory block from the plurality of memory blocks, wherein comparing to determine the output memory block comprises:
comparing the hash value for each memory block in the plurality of memory blocks; and
designating any of the plurality of memory blocks having matching values as the hash value as the output memory block based on the hash value for each of the plurality of memory blocks having a majority matching value; and
outputting, to an output hardware, the two or more output commands from the output memory block.