Abstract:
A communications method useable to safely communicate a message or a signal from a first safety approved entity ( 210 ) to a second safety approved entity ( 230 ) via a third, non-safety approved entity ( 220 ) comprising that each command is sent with the aid of a command message from the first to the second entity, an acknowledge message from the second to the first entity, and a go-ahead message from the first to the second entity.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention refers to methods and devices within electronic systems for transferring information signals in a safe manner. In particular it refers to such methods and devices to safely communicate a message from one safety approved entity to another safety approved entity via non-safety approved entity. 
       BACKGROUND 
       [0002]    When developing airborne systems equipment software, it is common to practise a standard known as RTCA/DO-178B. The standard requires systems to be classified as to criticality level. The standard requires that a system that may cause or contribute to a malfunction of a certain degree of seriousness must be developed according to certain rules. Software is classified in 5 levels, A to E, where A corresponds the most critical one, and E the least critical level. Cost for developing A and B-class software is approximately three times the cost for developing D class software. There are no requirements in RTCA/DO-178B on E-class software, so it is hard to compare costs. Software must be developed according to class A if a software error may lead to a crash with casualties, to class B if the error may lead to extensive personal injuries or severely reduced safety levels, and further levels C, D, E corresponding to less severe effects of an error. 
         [0003]    In many applications, erroneous information may lead to very serious consequences (in these applications, class A software would be applicable). As an example, consider a case where erroneous information is sent to a weapons system, leading to erroneous firing. 
         [0004]    Software classified as type A or B is expensive to develop and is in principle not allowed to be integrated or executed on a commercial computer using commercial-off-the-shelf software (COTS software) such as Windows or Linux operating system. Traditionally, all systems within an information chain has therefore been developed to class A or B, for the kind of functions mentioned above. 
         [0005]    In connection with the introduction of Unmanned Aerial Vehicles (UAVs) there is a need to safely control these vehicles using principally COTS-products. This is not an alternative if the traditional method, cf. above, is to be used to achieve a safe flow of information. Also in other applications, the traditional method results in higher economical costs than would be the case if products have a lower class of criticality than A or B, or what would be the case if COTS products could be used both for hardware and software. 
         [0006]    A typical application for the invention is to make it possible to remotely control an UAV using (in part) low cost COTS computer and software products, still fulfilling the requirements of applicable safety standards such as RTCA/DO-178B. 
         [0007]    An object of the present invention is to provide a method for communication in safety critical systems without having to use safety approved equipment in all the communication chain, while still being able to fulfil applicable safety standards, such as RTCA/DO-178B. 
       SUMMARY OF THE INVENTION 
       [0008]    The above object is solved by a communications method according to claim  1 . The method comprises the following steps:
       Sending a message from a first entity to a second entity via a third entity;   Returning, from the second entity to the first entity, an acknowledgement message of the first message comprising a safety code;   Checking, by the first entity, that the returned acknowledgement message corresponds to the originally sent message;   If so, returning the safety code from the first entity to the second entity via the third entity;   In the second entity, deciding, if the received safety code is correct. If the safety code is correct, commands according to the message originally sent from the first entity is executed.       
 
         [0014]    In a further embodiment the method further comprises the following steps for detecting communications loss:
       Continuously, from the second entity, sending unique codes.   Continuously, in the first entity, calculating and sending return values for each unique code based on a certain algorithm.   Continuously, in the second entity, verifying that the calculated return value from the first entity is correct. If not so, the second entity is to perform predetermined actions due to communications loss with first entity.   If, during transmission of messages from the first entity to the second entity, the first entity finds that the return acknowledgment message does not correspond to the sent message, the first entity will discontinue the calculation of a return value, thus forcing the second entity to take predetermined actions due to communication loss.       
 
         [0019]    In another preferred embodiment the message is a command selected from a limited set of commands. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS  
         [0020]    These and other features, aspects and advantages of the present invention will become better understood with reference to the following description, appended claims, and accompanying drawings where 
           [0021]      FIG. 1  is a block diagram showing the three principal entities involved when using a method according to the invention. 
           [0022]      FIG. 2  is a block diagram showing entities of  FIG. 1  for a preferred embodiment of the invention. 
           [0023]      FIG. 3   a  and  b  is a flowchart for a method according to a preferred embodiment of the invention. 
       
    
    
     DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
       [0024]    When it comes to safe transferring of control commands, two failure modes can be identified. The first failure mode is if the command is lost or if it is erroneous but this is known. The second failure mode is when the command is erroneous but this is NOT known. 
         [0025]    From a general point of view the second failure mode is worse than the first one. The technical solution of embodiments of the present invention handles safety aspects of the second failure mode. 
         [0026]    Referring to  FIG. 1  case two above can be generalized as follows. A sender  110  sends a command to a receiver  130 . Both the sender  110  and the receiver  130  is of high criticality, i.e., they are considered, per definition, to be able to handle commands in a safe manner. Commands are sent via a transferring entity  120  of low criticality, which potentially may distort or corrupt data. If the command is designed in such a way that the receiver  130  can detect, with a high probability, that the command has been distorted (or is missing) and the receiver is provided with the capability to handle that situation, the total system i.e., the sender  110 , the transferring entity  120  and the receiver  130 , can be regarded as a safe system. 
         [0027]    When judging the safety of a system according to the above, it is necessary to bear in mind all possible errors that may be induced by the transmitting entity  120 . The system must in principle have such a high safety level that even if the transferring entity  120  was designed to inflict maximum damage, the system shall be able to handle this in a safe manner. The following design is devised to handle such cases of a maximum damage-inflicting transferring entity  120 , and should be able to meet demands raised by airworthiness authorities. 
         [0028]      FIG. 2  shows a block diagram of a system according to a preferred embodiment of the invention. A controlled system  230  of high criticality sends all critical data to the operator  210  in such a way that any corruption of that data will be detected by the operator  210 . For example, a checksum procedure may be used or the information may be sent as a picture. A method for the operator to issue a command to the controlled system  230  involves the following steps:
       The operator  210  sends a command to the controlled system  230 . This may be in an arbitrary way, e.g as a 18 bit code.   The controlled system sends an acknowledge message of the command to the operator  210  via the safe communication link  240  together with a safety code, which may be a random number. The safety code is sent in such a way that the transferring entity  220  is considered not to have gained access to the safety code. The code may be sent as a picture or it may be encrypted.   The operator  210  checks that the controlled system has apprehended the correct command, i.e., that the transferring entity hasn&#39;t distorted data.   If the operator is of the opinion that the controlled system  230  has apprehended the correct command, the operator  210  sends in reply a go-ahead message comprising the safety code to the controlled system  230  via the transmission entity  220 . Since the transferring entity  220  has no knowledge of the code, it can be argued that the transferring entity can not generate a correct code on its own.       
 
         [0033]    In one embodiment, where the code was sent as a picture, the code itself is returned; this is possible because the transferring entity cannot reasonably be expected to be aware of the code itself because it was sent from the controlled system to the operator as a picture. In an alternative embodiment the operator  210 , with the aid of some equipment (not shown) deciphering of an encrypted code and returns the deciphered code. Because the transferring entity  220  is not aware of the key, the transferring entity  220  cannot gain access to the code because it was sent encrypted from the controlled system  230  to the transferring entity  220 .
       When the controlled system  230  has received a correct code, it executes the command.       
 
         [0035]    The controlled system  230  is devised such that it only accepts a certain number of sent codes per unit time. It is also devised to not accept codes received after a maximum time limit after the command was received. If too many codes are received per unit time or codes are received too late, the system  230  takes a predetermined action, such as disregarding the command and/or alerting the operator  210 . 
         [0036]    If the operator&#39;s command is distorted by the transferring entity, the operator will discover this when the system returns an acknowledgement of the command. The operator can then break off the connection, where after the controlled system  230  takes appropriate action. 
         [0037]      FIG. 3  shows a flowchart of a method for safe communication in the system of  FIG. 2 . The operator initiates  310  a command, by for example typing it in. The operator sends  315  a command message A to the controlled system via transferring entity. The controlled system receives  320  from the transferring system a command message A′ which may be identical to the sent message A or distorted or corrupted in some way. Whether the transferred command message A′ is distorted or corrupted or not is not decided at this point. Controlled system subsequently creates  325  a safety code SC and an acknowledgement message ACK. SC is encrypted forming an encrypted safety code ESC. ACK is formed by concatenating A′ and the encrypted safety code ESC. The controlled system returns  330  acknowledgement message ACK via transferring entity. Subsequently, operator receives  340  transferred acknowledgement message ACK′ which may be identical to sent acknowledgement message ACK or distorted or corrupted in some way. Operator takes ACK′ and separates out  345  command message portion A″ and transferred encrypted safety code portion ESC′. Operator deciphers  350  ESC′ and gets deciphered ESC′, here called DESC′. 
         [0038]    By checking  355  if command message portion A″ is identical to originally sent command message A, there can be decided if message is corrupted or not. If command message portion A″ is identical to originally sent command message A, command message is said to be safe, i.e. correctly received by controlled system, and a go-ahead message is sent to the controlled system in the form of the deciphered ESC′ DESC′. 
         [0039]    Subsequently controlled system receives  365  the transferred DESC′, i.e DESC″, which may be identical to SC or corrupted in some way. Controlled system checks  370  if DESC″ is identical to SC, and if so, decides that a command is safely received and executes  375  said command A. 
         [0040]    If, when the operator checks  355  if A″ is identical to A, this is not the case, the operator decides that there is not a safe transmission and therefore preferably terminates  380  data link to the controlled system. The controlled system detects this loss of data link and enters  382  an autonomous mode. 
         [0041]    If, when the controlled system checks  370  if DESC″ is identical to SC, this is not the case, the controlled system sends  385  an error message to the operator. The controlled system does not execute  387  the corresponding command A. The controlled system continuously keeps track of number of erroneous codes that have been received during a time period covering e.g the last ten seconds. If this number becomes larger  390  than a predefined limit the controlled system determines that the data link is unsafe and enters  392  an autonomous mode. 
         [0042]    By “autonomous mode” is for the purpose of the present application meant a mode where the controlled system, which may be an UAV, enters into a self control mode and performs a number of predetermined safe actions. Said actions may include climbing to a predetermined altitude, flying to a predetermined location, and landing there. 
         [0043]    Returning to  FIG. 2 , in a further embodiment, the controlled system is provided with a periodic code transmitter, which periodically sends a code to the operator  210 , who, based on the code, sends a predetermined answer. This may be implemented as an algorithm or as a large set of predetermined code-answer pairs. The operator is provided with equipment which automatically performs the answering-operation but which the operator always can shut off in a safe way.