Rockwell Collins, Inc.

Matthew P Corbett

Jason R Owen

Eric N Anderson

Nicholas H Bloom

Brent James Nelson

Timothy R Fannin

Russ D Uthe

James Matthew Zaehring

Daniel E Mazuk

Keith A Stover

Clifford R Klein

Rachel D Sparks

Anthony J Kriege

Sara A Murphy

A system-on-chip may include application processing cores which execute safety critical applications and an integrity application. The system-on-chip may also include integrity processing cores which execute an integrity monitor. The integrity monitor may compare integrity application outputs and integrity monitor outputs to detect if the processing cores have experienced a common mode fault. The integrity processing cores may perform temporal monitoring to accommodate time-asynchronization's between the application processing cores and the integrity processing cores.

Temporal buffering of integrity comparison data

A system and method for integrity monitoring on a heterogeneous system-on-a-chip (SoC) processing environment provides sets of dynamic input data to integrity applications running on one or more application cores (e.g., where safety critical applications are hosted) which generate an integrity output according to function/instruction sets. The dynamic input data is also provided to an integrity monitor running on a dissimilar integrity core (e.g., different architecture and/or other core type than the application cores) which receives the integrity output from the application cores and generates its own integrity result based on the same function sets and the same dynamic input data. The integrity monitor compares the local integrity result to the integrity outputs received from the application cores. If the integrity outputs deviate from the integrity result, the integrity core initiates a fault response, which may include resetting the deviant application core, all application cores, or the full SoC environment.

System and method for integrity monitoring of heterogeneous system-on-a-chip (SoC) based systems

A system for an airborne platform includes a network controller, a first subsystem having a number of devices configured to communicate a first data type, and a second subsystem having a number of devices configured to communicate a second data type. The network controller includes a processing circuit and is communicably coupled to the first subsystem and to the second subsystem. The processing circuit is configured to receive data relating to the first data type over a first plurality of communication channels and data relating to the second data type over a second plurality of communication channels. The processing circuit is further configured to multiplex the data relating to the first data type and the second data type to a multiplexed data stream configured for communication over a single communication channel. The processing circuit is further configured to transmit the multiplexed data stream over a data transmission line.

Shared networking infrastructure with multi-link channel bonding

A federated display system includes multiple head down displays (HDD) driven by two or more display processing computers (DPC). Each DPC includes two or more display nodes independently managing display processing, graphics generation, and I/O functionality (either within a single processing unit or a multiprocessor environment). Each display node is linked to a mezzanine control plane (MCP) independent of the display nodes, which MCP includes dedicated optical channels to each member HDD of the system and a switching fabric to control the routing of graphical signals from the graphics generators of each node to the optical channel connected to the desired target HDD. The switching fabric includes a master selector for designating any node of a DPC as a master node capable of controlling the switching fabric via its processing control or graphics generation functions.

Eliminating redundant fibers in a federated large display system

A system and method for granular redundant multithreading in a high integrity multicore processing environment (MCPE) generates redundant critical application threads incorporating executable instructions and input data relevant to a critical process when a user application running on a homogenous core of the MCPE encounters the critical process and issues a system call. The critical application threads are forked to different processing cores environments for execution, and the result sets of each executed critical application threads are forked to different cores for cross-comparison (different from the cores on which the result sets were generated). The result sets are cross-checked to the desired degree of integrity (e.g., consensus agreement or majority vote of all comparing cores) and the hypervisor returns the execution returned to the calling user application with the final result set (or with a fault, if the evaluation was unsuccessful and the desired level of agreement not reached).

High integrity multicore computing environment with granular redundant multi-threading

An improved AFDX switch, as described herein, can include an embedded integrity monitoring module that is functionally fault-independent of the switching module or other components of the AFDX switch. The integrity monitoring module can include a delay monitoring module for monitoring delays of data packets within the AFDX switch and/or a routing module for monitoring or detecting data packets routing errors or failures. The delay monitoring module can assign a timestamp to a data frame at arrival to the AFDX switch, determine a time delay of the data frame within the AFDX switch based on the timestamp, and compare the time delay to a threshold value to detect erroneous time delays. The routing monitoring module can compare the input port and/or the output port at which the data frame arrives while in the AFDX switch to the corresponding preassigned input port or output port to detect routing failures.

High integrity AFDX switches

An aircraft computer system includes segregated processing elements, each executing an autonomous agent. Each autonomous agent receives a set of data pertaining to aircraft events and processes the data to identify a set of instructions for resolving the event. Each autonomous agent then compares all competing solutions to determine if each autonomous agent agrees; if so, the solution is implemented, if not, the disparity is resolved either automatically via a voting algorithm or with the intervention of a human decision maker.

Dual independent autonomous agent architecture for aircraft

Improved AFDX switches can handle various types of data traffics beyond a predefined AFDX related communication protocol. An AFDX switch can determine a mismatch between a MAC address of a received data frame and a MAC address constant specific to the predefined AFDX related protocol. In response to the mismatch, the AFDX switch can determine a data traffic type associated with the data frame based on a first portion of a header of the data frame. The AFDX switch can compare, responsive to determining a data traffic type associated with the data frame, a second portion of the header of the data frame to identifiers of a plurality of communication flows. Responsive to identifying a communication flow with a matching identifier, the AFDX switch can route the data frame based on communication flow parameters of the identified communication flow.

AFDX switch supporting multiple types of data traffic

Transparently executing applications among cores in a multi-processor system includes monitoring elements associated with each processor which align execution of threads within corresponding cores of the processors. Alignment is accomplished by monitoring system resource utilization by each core, comparing process counters associated with corresponding cores, and comparing data sets in and out during application frame switching. In a further aspect, inputs are coordinated by a synchronization element. Likewise, outputs for corresponding cores are compared to ensure no corrupted data is propagated.

High integrity multi-core processing

A decentralized Integrated Modular Avionics (IMA) architecture configured for onboard avionics processing eliminates centralized computing cabinets and distributes avionics processing capabilities to a network of smart switching devices positioned throughout the aircraft, each smart switch including a multicore processing environment (MCPE) for generalized application hosting in addition to the switching elements. The smart switching network can be scaled up or down for smaller or larger aircraft, or organically grown by adding more processing components. Additional real-time multicore processors may be located in smart remote data concentrators (RDC) for handling I/O and routing of network data between external remote units and aircraft systems and the hosted applications on the smart switches. The real-time environments executing on the smart RDCs may be reserved for low-latency closed-loop functions, or may host additional general-purpose avionics processing.

Decentralized integrated modular avionics (IMA) processing

Embodiments of the inventive concepts disclosed herein are directed to systems and methods for providing secured communications via an avionics power bus network. The power bus network can have a plurality of power bus domains, for providing power to at least two endpoint systems. The avionics power bus network can incorporate a plurality of network access interfaces, and each of the network access interfaces may provide power bus isolation between at least two of the power bus domains, and/or network communications isolation across at least two power bus domains. A network gateway may configure communications between the two endpoint systems through one or more of the network access interfaces, and for validating credentials to permit the communications to be transmitted through some of the power bus domains. The network gateway can be accessed via a network access point to configure the communications.

Secured communications using avionics power bus network

A high-integrity multi-core heterogeneous processing environment and methods for high integrity computing on multi-core heterogeneous processing environments are disclosed. A multi-core heterogeneous processing environment may include an application processor with one or more processing cores and an integrity tester for executing integrity kernels on the application processor. The multi-core heterogeneous processing environment may further include an integrity processor having a different architecture than the application processor and an integrity manager operating on the integrity processor. The integrity manager may dynamically generate integrity kernels to test the functionality of the application processor prior to and/or subsequent to the execution of critical programs on the application processor. The integrity manager may identify one or more faults based on a result of the integrity kernel executed on the application processor and may further take corrective action based on identified faults such that an undetected fault rate remains below a selected integrity specification.

High-integrity multi-core heterogeneous processing environments

A system and related method for I/O synchronization in a high integrity multi-core processing environment (MCPE) incorporates logical computing units (LCU) of two or more homogeneous processing cores, each core running a guest operating system (GOS) and user applications such that the homogeneous cores concurrently generate the same output data (which the GOS loads to an I/O synchronization engine (IOSE)) or receive the same output data from the IOSE. The IOSE verifies data integrity by comparing the concurrently received datasets and selects a verified dataset for routing to other cores or externally to the MCPE. The IOSE receives and atomically replicates input data for synchronous transfer to, and consumption by, the user applications running on the cores of the LCU.

I/O synchronization for high integrity multicore processing

A system and method is disclosed for identification and response to an unauthorized transmission to a networked critical system. The invention employs a pre-defined parameter which matches trusted sources with defined destinations to enable secure access to the networked critical system. Once the method receives a transmission to the destination, it filters the transmissions based on specific architecture constraints. Should the transmission survive, the method continues with a plurality of layers of system level checks to verify the source matches the pre-defined parameter of a trusted source. Should the transmission fail any of the layers of system level checks, the method provides an appropriate response. Once the transmission survives, the method continuously monitors the data stream for possible threats and allows access the transmission to reach the destination and the networked critical system.

Network security for avionics with ethernet connections system and related method

A high integrity, high availability avionics display architecture for an avionics display system. The architecture includes a plurality of display processing computers (DPC) and a plurality of display integrity feedback interfaces. Each DPC includes at least two independent processing channels. Each independent processing channel includes at least two independent lanes. Each independent lane includes an I/O section and a processor section. Furthermore, each independent processing channel comprises an operative graphics section. At least one of the independent lanes provides a critical display function that provides commands to the graphics section to drive a display signal to displays of the avionics system. A number of display integrity feedback interfaces from the displays of the avionics display system provide integrity by allowing the integrity monitor functions to detect faults within the display signals and/or originating from the displays.

Growing community of inventors

Mount Vernon, IA, United States of America

Matthew P Corbett