DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-5, 8-9, 12-16, and 19-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Fujimura et al. (US20210356925A1 -hereinafter Fujimura) in view of Tate et al. (JP2023019606A -hereinafter Tate -Note: As the machine translation attached).
Regarding Claim 1, Fujimura teaches a method for transferring data between safety controllers during qualification (see [0121]; Fujimura: “FIG. 5 exemplifies a configuration in which the two processors 312 and 314 execute control calculation for different purposes to improve reliability, but the present invention is not limited thereto, and any configuration may be employed as long as the configuration can realize the required safety function 250. For example, in a case where a single processor includes a plurality of cores, control calculation corresponding to each of the processors 312 and 314 may be executed.” See [0137]: “The safety driver setting information 5116 including the SRA parameter 60 is transmitted to the safety driver 300 and is stored as the setting information 3206 (refer to FIG. 5).”), the method comprising the steps of:
disabling a safety operation in a first safety controller; (see [0205]; Fujimura: “In a case where the SRA parameter 60 has not been received (NO in S302), the safety driver 300 maintains enable/disable setting of all of the motion safety functions 360 according to the designation information in the safety status 70 in a default state (S304).”)
storing the safety data in a safety memory present on the second safety controller with the second safety core; and (see [0120]; Fujimura: “The storage 320 stores a servo control program 3202 for realizing servo control 350 that will be described later, a motion safety program 3204 for realizing the motion safety function 360 that will be described later, and setting information 3206 for setting a variable or the like that is open to other devices. The safety status 70 for managing enable/disable setting of the motion safety function 360 is stored in the setting information 3206.”)
However, Fujimura does not explicitly teach:
transferring safety data from a first safety core executing in the first safety controller to a second safety core executing in a second safety controller;
verifying correct transfer of the safety data with the second safety core;
enabling the safety operation in the first safety controller and the second safety controller in tandem when the safety data is present on the second safety controller.
Tate from the same or similar field of endeavor teaches:
transferring safety data from a first safety core executing in the first safety controller to a second safety core executing in a second safety controller; (see Abstract; Tate: “The electronic control device comprises a multi-core microcomputer including at least a first core responsible for low safety level functions, a second core responsible for high safety level functions, and a peripheral function for transferring data, The first core periodically transmits a first data transfer instruction to the peripheral function, and the peripheral function transfers data to the second core according to the first data transfer instruction.”)
verifying correct transfer of the safety data with the second safety core; (see page 2, paragraph 4; Tate: “One core periodically transmits a first data transfer instruction to the peripheral function, and the peripheral function transfers data to the second core according to the first data transfer instruction, and notifies completion of data transfer to the 2 cores.” See page 7, second paragraph: “The first core-side buffer 112 and the second core-side buffer 122 are created by the data transfer source side and used to store the updated information, and for the data transfer destination side to verify the correctness of the data body part 311. includes a data verification unit 312 in which information of is stored.”)
enabling the safety operation in the first safety controller and the second safety controller in tandem when the safety data is present on the second safety controller. (see page 9, paragraph 8; Tate: “High-level data transfer instructions 905 are the same as high-level data transfer instructions 603 , and high-level function data processing execution notifications 906 are the same as high-level function data processing execution notifications 604. As described above, in the multi-core microcomputer 100 according to the embodiment of the present invention, data transfer and data processing can be synchronized.”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the teaching of Fujimura to include Tate’s features of transferring safety data from a first safety core executing in the first safety controller to a second safety core executing in a second safety controller; and verifying correct transfer of the safety data with the second safety core, and enabling the safety operation in the first safety controller and the second safety controller in tandem when the safety data is present on the second safety controller. Doing so would achieve functional safety and reduce malfunctions. (Tate, page 5, paragraphs 3 and page 6 paragraph 8)
Regarding Claim 2, the combination of Fujimura and Tate teaches all the limitations of claim 1 above, Fujimura further teaches further comprising the steps of:
establishing a connection between a first communication core executing in the first safety controller and a second communication core executing in the second safety controller; and (see [0066]; Fujimura: “In the field network 2 of the control system 1, process data communication is performed, and a communication frame 600 is circulated in a cyclic manner (for example, every several to several tens of msec) among devices with the standard controller 100 as a communication master.”)
transferring the safety data between the first safety core and the second safety core via the connection and without passing the safety data through the first communication core or the second communication core. (see [0069]; Fujimura: “In the present embodiment, a logical connection 4 is formed between the safety controller 200 and each safety driver 300 by using the process data communication.”)
Regarding Claim 3, the combination of Fujimura and Tate teaches all the limitations of claim 2 above, Tate further teaches wherein: the first safety core and the first communication core are each a unique processing core of a processor in the first safety controller (see page 6, paragraph 6; Tate: “first core 110 responsible for functions with a low safety level.” See page 6, paragraph 7: “The first core-side buffer 112 is an area for storing data transmitted and received by the communication controller 130”), and the second safety core and the second communication core are each a unique processing core of a processor in the second safety controller. (see page 6, paragraph 6; Tate: “second core 120 responsible for functions with a high safety level.” See page 6, paragraph 7: “A second core side buffer 122 is provided in the second core RAM 121”)
The same motivation to combine Fujimura and Tate a set forth for Claim 1 equally applies to Claim 3.
Regarding Claim 4, the combination of Fujimura and Tate teaches all the limitations of claim 1 above, Tate further teaches wherein the step of storing the safety data in the safety memory present on the second safety controller with the second safety core further comprises the steps of:
storing the safety data received from the first safety controller in a first location in the safety memory; (see page 6, paragraph 7; Tate: “The first core 110 can access the first core RAM 111 (Random Access Memory) via the internal bus 160. A first core side buffer 112 is provided in the first core RAM 111. The first core-side buffer 112 is an area for storing data transmitted and received by the communication controller 130.”)
inverting the safety data received from the first safety controller with the second safety core; and (see page 6, last paragraph; Tate: “When transferring data from the first core-side buffer 112 to the second core-side buffer 122, the high-level function operating in the second core 120 stores the data transfer destination address, data transfer size, and data transfer completion operation in the peripheral function register 141.”)
storing inverted safety data in a second location in the safety memory. (see page 6, paragraph 7; Tate: “A second core side buffer 122 is provided in the second core RAM 121 and stores a second core processing verification value 123.”)
Regarding Claim 5, the combination of Fujimura and Tate teaches all the limitations of claim 1 above, Fujimura further teaches wherein the step of disabling the safety operation in the first safety controller further comprises the step of freezing a present value of the safety data in a safety memory present on the first safety controller. (see [0025]; Fujimura: “a disabling part that disables a specific safety function that is designated to be disabled by the designation information included in the parameter among the at least one or more safety functions.”)
Regarding Claim 8, the limitations in this claim is taught by the combination of Fujimura and Tate as discussed connection with claim 1.
Regarding Claim 9, the limitations in this claim is taught by the combination of Fujimura and Tate as discussed connection with claim 2.
Regarding Claim 12, the limitations in this claim is taught by the combination of Fujimura and Tate as discussed connection with claim 4.
Regarding Claim 13, the limitations in this claim is taught by the combination of Fujimura and Tate as discussed connection with claim 5.
Regarding Claim 14, the limitations in this claim is taught by the combination of Fujimura and Tate as discussed connection with claim 1.
Regarding Claim 15, the limitations in this claim is taught by the combination of Fujimura and Tate as discussed connection with claim 3.
Regarding Claim 16, the combination of Fujimura and Tate teaches all the limitations of claim 14 above, Fujimura further teaches wherein the step of preparing safety data for transfer from the first safety controller to the second safety controller further comprises:
disabling a safety task executing in the first safety core; and (see [0205]; Fujimura: “In a case where the SRA parameter 60 has not been received (NO in S302), the safety driver 300 maintains enable/disable setting of all of the motion safety functions 360 according to the designation information in the safety status 70 in a default state (S304).”)
freezing the safety data at a present value when the safety task is disabled. (see [0025]; Fujimura: “a disabling part that disables a specific safety function that is designated to be disabled by the designation information included in the parameter among the at least one or more safety functions.”)
Regarding Claim 19, the limitations in this claim is taught by the combination of Fujimura and Tate as discussed connection with claim 4.
Regarding Claim 20, the combination of Fujimura and Tate teaches all the limitations of claim 14 above, Tate further teaches wherein the step of verifying the safety data received at the second safety controller with the second safety core further comprises comparing the safety data to the inverted safety data to verify the inverted safety data matches the safety data. (see page 2, paragraph 4; Tate: “One core periodically transmits a first data transfer instruction to the peripheral function, and the peripheral function transfers data to the second core according to the first data transfer instruction, and notifies completion of data transfer to the 2 cores.” See page 7, second paragraph: “The first core-side buffer 112 and the second core-side buffer 122 are created by the data transfer source side and used to store the updated information, and for the data transfer destination side to verify the correctness of the data body part 311. includes a data verification unit 312 in which information of is stored.”)
The same motivation to combine Fujimura and Tate a set forth for Claim 14 equally applies to Claim 20.
Claim(s) 6-7, 10-11, and 17-18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Fujimura in view of Tate in view of Gibart et al. (US20050091410A1 -hereinafter Gibart).
Regarding Claim 6, the combination of Fujimura and Tate teaches all the limitations of claim 1 above; however, it does not explicitly teach wherein the step of verifying correct transfer of the safety data with the second core further comprises the steps of:
generating a checksum with the first safety controller, wherein the checksum is a function of the safety data;
transmitting the checksum to the second safety controller with the safety data;
generating a second checksum with the second safety controller, wherein the second checksum is generated as a function of the safety data; and
comparing the second checksum with the checksum received from the first safety controller.
Gibart from the same or similar field of endeavor teaches wherein the step of verifying correct transfer of the safety data with the second core further comprises the steps of:
generating a checksum with the first safety controller, wherein the checksum is a function of the safety data; (see [0069]; Gibart: “The operating system 73 a and 73 b then proceed to succeeding process blocks 128 and 130, respectively, where the registers 82 of the MPUs 81 for the memory region 84 b holding the tasks 72 b and its variables 76 are checked to ensure that these regions 84 b are correctly in read only mode.” See [0074]: “Referring again to FIG. 7, upon completion of the synchronization of inputs, as indicated by process blocks 146 and 148, the operating systems 73 a and 73 b execute the safety tasks 72 b independently in the primary controller 18 a and partner controller 18 b, respectively, without further synchronization.”)
transmitting the checksum to the second safety controller with the safety data; (see [0075]; Gibart: “At succeeding process blocks 150 and 152, in the primary controller 18 a and partner controller 18 b, respectively, primary controller 18 a sends its output variables to partner controller 18 b and partner controller 18 b sends its output variables to primary controller 18 a in a cross-checking process.”)
generating a second checksum with the second safety controller, wherein the second checksum is generated as a function of the safety data; and (see [0069]; Gibart: “The operating system 73 a and 73 b then proceed to succeeding process blocks 128 and 130, respectively, where the registers 82 of the MPUs 81 for the memory region 84 b holding the tasks 72 b and its variables 76 are checked to ensure that these regions 84 b are correctly in read only mode.” See [0074]: “Referring again to FIG. 7, upon completion of the synchronization of inputs, as indicated by process blocks 146 and 148, the operating systems 73 a and 73 b execute the safety tasks 72 b independently in the primary controller 18 a and partner controller 18 b, respectively, without further synchronization.”)
comparing the second checksum with the checksum received from the first safety controller. (see [0075]; Gibart: “Each of the primary controller 18 a and partner controller 18 b then compares its own output values to those computed by the other controller.”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the teaching of Fujimura and Tate to include Gibart’s features of generating a checksum with the first safety controller, wherein the checksum is a function of the safety data; transmitting the checksum to the second safety controller with the safety data; generating a second checksum with the second safety controller, wherein the second checksum is generated as a function of the safety data; and comparing the second checksum with the checksum received from the first safety controller. Doing so would detect faults and provide an improved interface for a dual controller safety system. (Gibart, [0006] and [0008])
Regarding Claim 7, the combination of Fujimura, Tate, and Gibart teaches all the limitations of claim 6 above, Tate further teaches wherein the step of generating the checksum further comprises the step of generating the checksum with the first safety controller as the first safety controller transfers the safety data from the first safety core to the second safety core. (see page 7, second paragraph; Tate: “The first core-side buffer 112 and the second core-side buffer 122 are created by the data transfer source side and used to store the updated information, and for the data transfer destination side to verify the correctness of the data body part 311. includes a data verification unit 312 in which information of is stored. The information for verifying correctness is, for example, a serial number that is updated each time data is updated or created, and a checksum of the data body part 311.”)
The same motivation to combine Fujimura and Tate a set forth for Claim 1 equally applies to Claim 7.
Regarding Claim 10, the combination of Fujimura and Tate teaches all the limitations of claim 8 above, Tate further teaches wherein:
the safety data is transmitted from the memory of the first safety controller to the second safety controller in a plurality of data packets; (see page 6, paragraph 7; Tate: “The first core 110 can access the first core RAM 111 (Random Access Memory) via the internal bus 160. A first core side buffer 112 is provided in the first core RAM 111. The first core-side buffer 112 is an area for storing data transmitted and received by the communication controller 130.”)
The same motivation to combine Fujimura and Tate a set forth for Claim 1 equally applies to Claim 10.
However, it does not explicitly teach:
the qualification function maintains a rolling value of a checksum for the safety data as the data is transmitted; and
the first safety controller is further operative to transmit the rolling value of the checksum to the second safety controller with the qualification function when the checksum has been determined for all of the safety data to be transmitted.
Gibart from the same or similar field of endeavor teaches:
the qualification function maintains a rolling value of a checksum for the safety data as the data is transmitted; and (see [0075]; Gibart: “Each of the primary controller 18 a and partner controller 18 b then compares its own output values to those computed by the other controller.”)
the first safety controller is further operative to transmit the rolling value of the checksum to the second safety controller with the qualification function when the checksum has been determined for all of the safety data to be transmitted. (see [0075]; Gibart: “If there is an error, a safety state is entered, otherwise each primary controller 18 a and partner controller 18 b proceeds to respective process blocks 154 and 156 where they generate a combined output value set for transmission over the network 134 or backplane 26 according to a high reliability protocol. The safety state, as is understood in the art, invokes a set of predefined output values and ceases operation of the control process notifying the operator of an error.”)
The same motivation to combine Fujimura, Tate, and Gibart a set forth for Claim 6 equally applies to Claim 10.
Regarding Claim 11, the limitations in this claim is taught by the combination of Fujimura, Tate, and Gibart as discussed connection with claim 6.
Regarding Claim 17, the limitations in this claim is taught by the combination of Fujimura, Tate, and Gibart as discussed connection with claim 10.
Regarding Claim 18, the limitations in this claim is taught by the combination of Fujimura, Tate, and Gibart as discussed connection with claim 6.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
G (US20220342749A1) discloses comparing the first checksum to the second checksum to determine a comparison result, and determining a data integrity validation result based on the comparison result.
Izzo (US10520928B2) discloses if this comparison at process block indicates a discrepancy between the values from the safety controllers, then the controllers revert to a safe state failure mode providing predetermined safe state outputs.
Jones (US8693159B2) discloses diagnostic coverage of safety components monitors the state of a safety chain and each of the safety devices in the chain.
Lo (US20190381666A1) discloses the first safety controller and the second safety controller are respectively connected to a safety actuating system.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VI N TRAN whose telephone number is (571)272-1108. The examiner can normally be reached Mon-Fri 9:00-5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, ROBERT FENNEMA can be reached at (571) 272-2748. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/V.N.T./Examiner, Art Unit 2117
/ROBERT E FENNEMA/Supervisory Patent Examiner, Art Unit 2117
