Rockwell Collins, Inc.

Jason R Owen

Matthew P Corbett

Nicholas H Bloom

Brent James Nelson

Russ D Uthe

Eric N Anderson

James Matthew Zaehring

Timothy R Fannin

Angelo J Joseph

Daniel J Kaplan

Christopher A Hohensee

Yeshani D WijesekaraGamachchige

Andrea P Gonzalez

Nels Waineo

Christopher Kistler

Yeshani D Wijesekara Gamachchige

Andrea Gonzalez

A system-on-chip may include application processing cores which execute safety critical applications and an integrity application. The system-on-chip may also include integrity processing cores which execute an integrity monitor. The integrity monitor may compare integrity application outputs and integrity monitor outputs to detect if the processing cores have experienced a common mode fault. The integrity processing cores may perform temporal monitoring to accommodate time-asynchronization's between the application processing cores and the integrity processing cores.

Temporal buffering of integrity comparison data

A system and method for integrity monitoring on a heterogeneous system-on-a-chip (SoC) processing environment provides sets of dynamic input data to integrity applications running on one or more application cores (e.g., where safety critical applications are hosted) which generate an integrity output according to function/instruction sets. The dynamic input data is also provided to an integrity monitor running on a dissimilar integrity core (e.g., different architecture and/or other core type than the application cores) which receives the integrity output from the application cores and generates its own integrity result based on the same function sets and the same dynamic input data. The integrity monitor compares the local integrity result to the integrity outputs received from the application cores. If the integrity outputs deviate from the integrity result, the integrity core initiates a fault response, which may include resetting the deviant application core, all application cores, or the full SoC environment.

System and method for integrity monitoring of heterogeneous system-on-a-chip (SoC) based systems

A system for time synchronization over redundant switch-based avionics networks is disclosed. The system includes a master or source clock for determining precise UTC timing information from received satellite signals and generating time marks based on the timing information. The source clock generates network-compatible timing messages and forwards the timing messages to network switches within the switch-based avionics networks. The network switches modify the timing information to account for switch-based delays and forward the modified timing messages to destination clocks in aircraft end systems. The end systems relay timing messages back to the source clock via the network switches, the timing information again modified by the network switches according to switch-based delays, and based on the precise timing information exchanged destination clocks in end systems throughout the switched network can precisely synchronize to the source clock.

Time synchronization over redundant and deterministic switch-based avionics networks

A system for an airborne platform includes a network controller, a first subsystem having a number of devices configured to communicate a first data type, and a second subsystem having a number of devices configured to communicate a second data type. The network controller includes a processing circuit and is communicably coupled to the first subsystem and to the second subsystem. The processing circuit is configured to receive data relating to the first data type over a first plurality of communication channels and data relating to the second data type over a second plurality of communication channels. The processing circuit is further configured to multiplex the data relating to the first data type and the second data type to a multiplexed data stream configured for communication over a single communication channel. The processing circuit is further configured to transmit the multiplexed data stream over a data transmission line.

Shared networking infrastructure with multi-link channel bonding

A system and method for granular redundant multithreading in a high integrity multicore processing environment (MCPE) generates redundant critical application threads incorporating executable instructions and input data relevant to a critical process when a user application running on a homogenous core of the MCPE encounters the critical process and issues a system call. The critical application threads are forked to different processing cores environments for execution, and the result sets of each executed critical application threads are forked to different cores for cross-comparison (different from the cores on which the result sets were generated). The result sets are cross-checked to the desired degree of integrity (e.g., consensus agreement or majority vote of all comparing cores) and the hypervisor returns the execution returned to the calling user application with the final result set (or with a fault, if the evaluation was unsuccessful and the desired level of agreement not reached).

High integrity multicore computing environment with granular redundant multi-threading

An improved AFDX switch, as described herein, can include an embedded integrity monitoring module that is functionally fault-independent of the switching module or other components of the AFDX switch. The integrity monitoring module can include a delay monitoring module for monitoring delays of data packets within the AFDX switch and/or a routing module for monitoring or detecting data packets routing errors or failures. The delay monitoring module can assign a timestamp to a data frame at arrival to the AFDX switch, determine a time delay of the data frame within the AFDX switch based on the timestamp, and compare the time delay to a threshold value to detect erroneous time delays. The routing monitoring module can compare the input port and/or the output port at which the data frame arrives while in the AFDX switch to the corresponding preassigned input port or output port to detect routing failures.

High integrity AFDX switches

Transparently executing applications among cores in a multi-processor system includes monitoring elements associated with each processor which align execution of threads within corresponding cores of the processors. Alignment is accomplished by monitoring system resource utilization by each core, comparing process counters associated with corresponding cores, and comparing data sets in and out during application frame switching. In a further aspect, inputs are coordinated by a synchronization element. Likewise, outputs for corresponding cores are compared to ensure no corrupted data is propagated.

High integrity multi-core processing

A high-integrity multi-core heterogeneous processing environment and methods for high integrity computing on multi-core heterogeneous processing environments are disclosed. A multi-core heterogeneous processing environment may include an application processor with one or more processing cores and an integrity tester for executing integrity kernels on the application processor. The multi-core heterogeneous processing environment may further include an integrity processor having a different architecture than the application processor and an integrity manager operating on the integrity processor. The integrity manager may dynamically generate integrity kernels to test the functionality of the application processor prior to and/or subsequent to the execution of critical programs on the application processor. The integrity manager may identify one or more faults based on a result of the integrity kernel executed on the application processor and may further take corrective action based on identified faults such that an undetected fault rate remains below a selected integrity specification.

High-integrity multi-core heterogeneous processing environments

A system and related method for I/O synchronization in a high integrity multi-core processing environment (MCPE) incorporates logical computing units (LCU) of two or more homogeneous processing cores, each core running a guest operating system (GOS) and user applications such that the homogeneous cores concurrently generate the same output data (which the GOS loads to an I/O synchronization engine (IOSE)) or receive the same output data from the IOSE. The IOSE verifies data integrity by comparing the concurrently received datasets and selects a verified dataset for routing to other cores or externally to the MCPE. The IOSE receives and atomically replicates input data for synchronous transfer to, and consumption by, the user applications running on the cores of the LCU.

Growing community of inventors

Marion, IA, United States of America

Jason R Owen