Fort Robotics, Inc.

A method includes, storing a set of valid codewords including: a first valid functional codeword representing a functional state of a controller subsystem; a first valid fault codeword representing a fault state of the controller subsystem and characterized by a minimum hamming distance from the first valid functional codeword; a second valid functional codeword representing a functional state of a controller; and a second valid fault codeword representing a fault state of the controller; in response to detecting functional operation of the controller subsystem, storing the first valid functional codeword in a first memory; in response to detecting a match between contents of the first memory and the first valid functional codeword, outputting the second valid functional codeword; in response to detecting a mismatch between contents of the first memory and every codeword in the first set of valid codewords, outputting the second valid fault codeword.

A safety module having a plurality of microcontrollers receives an analog input and determines a value of the analog input. The microcontrollers each determine a respective ternary state of the device by identifying, from three candidate ranges of values, a range of values in which the value falls, wherein at least two of the plurality of microcontrollers uses different candidate ranges of values, determining, based on the identified range, a ternary state corresponding to the range, and assigning the determined ternary state as the respective ternary state. The safety module determines whether the ternary states from the two microcontrollers map to a fault state, and, where they do, cause a command a command to be output to the device to enter a safe state.

A method includes: accessing first data in a data stream, the first data including an encoded value representing a safety state of an emergency stop device; classifying the data stream into a first data class based on the encoded value; accessing a policy, associated with the first data class, defining first target conditions; selecting a first communication link as a first active communication link for the data stream, the first communication link exhibiting first conditions corresponding to the first target conditions; transmitting the first data via the first communication link; in response to detecting a difference between the first conditions and the first target conditions, selecting a second communication link as a second active communication link for the first data stream, the second communication link exhibiting second conditions corresponding to the first target conditions; and transmitting second data in the data stream via the second communication link.

A safety module having a plurality of microcontrollers receives an analog input and determines a value of the analog input. The microcontrollers each determine a respective ternary state of the device by identifying, from three candidate ranges of values, a range of values in which the value falls, wherein at least two of the plurality of microcontrollers uses different candidate ranges of values, determining, based on the identified range, a ternary state corresponding to the range, and assigning the determined ternary state as the respective ternary state. The safety module determines whether the ternary states from the two microcontrollers map to a fault state, and, where they do, cause a command a command to be output to the device to enter a safe state.

A method includes, at a first communication module: receiving a first message from a second communication module, the first message including a set of data in a first data stream from a first device; accessing a first configuration profile, in a set of configuration profiles, for the first data stream based on the first data stream identifier; generating a set of metrics for the first message; calculating a set of trust scores for the first message based on the set of metrics and the first configuration profile; generating a second message including the set of data and the set of trust scores; and transmitting the second message to a second device.

A method includes, at a security agent executing on a computing platform including a set of resources and a first application: authenticating the security agent with a security device; accessing a configuration profile, from the security device, defining identity information associated with the first application and a first security policy defining a subset of resources, in the set of resources, to which the first application is permitted access; authenticating the first application based on the identity information; monitoring the set of resources responsive to execution of the first application on the computing platform; and issuing a command to cause the computing platform to enter a safe state in response to detecting an access by the first application to a first resource in the set of resources, the first resource excluded from the subset of resources.

A method includes: accessing message including a frame captured by a fixed sensor in an operating field; detecting an object in the frame; calculating a first position of the object, in a reference coordinate system, within the operating field; calculating a trust score for the object based on a set of characteristics of the message; accessing a second position of a machine in the reference coordinate system; defining a controlled zone, in the reference coordinate system, encompassing the second position occupied by the machine based on the trust score; in response to detecting the first position of the first object intersecting the controlled zone, generating a command that transitions the machine from a nominal operating mode to a reduced performance operating mode; and transmitting the command to the machine.

A method includes, at a security agent executing on a computing platform including a set of resources and a first application: authenticating the security agent with a security device; accessing a configuration profile, from the security device, defining identity information associated with the first application and a first security policy defining a subset of resources, in the set of resources, to which the first application is permitted access; authenticating the first application based on the identity information; monitoring the set of resources responsive to execution of the first application on the computing platform; and issuing a command to cause the computing platform to enter a safe state in response to detecting an access by the first application to a first resource in the set of resources, the first resource excluded from the subset of resources.

A method includes, by a key server: identifying a group of devices; accessing secret values pre-provisioned to devices in the group of devices; accessing prime numbers pre-provisioned to devices in the group of devices; generating a cryptographic key for communication among the group of devices; generating a message based on the secret values, the prime numbers, and the cryptographic key; and transmitting the message to a device in the group of devices. The method also includes, by a first device in the group of devices: in response to receiving the message, deriving the cryptographic key from the message based on a first secret value, pre-provisioned to the first device, and a first prime number pre-provisioned to the first device; and associating the cryptographic key with communication among the group of devices.

Systems and methods for safety-enabled control by: establishing a wireless communication channel with a plurality of remote control units via the wireless interface device; in response to establishing the wireless communication channels, operating a system-under-control in a supervised mode based on input received from at least one of the plurality of remote control units; in response to a mode switch command received from a first remote control unit of the plurality of remote control units, providing the other remote control units with a request for a mode switch confirmation; and, in response to confirming receipt of a safety-rated input from an autonomous control system and receipt of a mode switch confirmation from each of the other remote control units, operating the system-under-control in an autonomous mode based on input received from the autonomous control system.