Abstract:
An example method for uninterrupted execution of control software in an aircraft control system includes creating a plurality of static data copies. A first parity bit is determined for each of the plurality of static data copies. A second parity bit is determined for a first static data copy. A parity fault is detected in the first static data copy if the first parity bit does not match the second parity bit. The system switches to read a second static data copy in response to detecting a parity fault in the first static data copy.

Description:
BACKGROUND 
       [0001]    This disclosure is directed towards a control system for use with avionic hardware, and more specifically to uninterrupted execution of control software in the control system when faults are detected. 
         [0002]    Control systems used with avionic hardware can be subject to single event upset (SEU) occurrences during operation. An SEU can occur when the control system is exposed to ions or electromagnetic radiation. The ions or electromagnetic radiation can cause data within a random access memory (RAM) to change, or be altered. Data may be stored as bytes of memory, each byte including 8 bits. When the control system relies on altered bytes of data, an SEU can occur because the control system is relying on a byte of data having an incorrect value. 
         [0003]    Previously, when a fault was detected that could result in an SEU, the control software would reset the system to clear out the fault. However, resetting the system results in time delays from the system being reset and the software receiving a power up sequence to begin running the control system under normal circumstances. 
       SUMMARY 
       [0004]    An example method for uninterrupted execution of control software in an aircraft control system includes creating a plurality of static data copies. A first parity bit is determined for each of the plurality of static data copies. A second parity bit is determined from reading the static data copy. A parity fault is detected in the first static data copy if the first parity bit does not match the second parity bit. The system switches to read a second static data copy in response to detecting a parity fault in the first static data copy. 
         [0005]    An example method of data fault correction in a control system during operation in an aircraft includes reading a plurality of static data copies from a random access memory (RAM) and comparing each of the plurality of static data copies to each other. A corrupted static data copy is determined to have a parity fault indicating that least one bit does not match a corresponding bit in the remaining static data copies amongst the plurality of static data copies. The corrupted static data copy is overwritten with a second data copy to remove the parity fault. Each of the plurality of static data copies is written into the RAM. 
         [0006]    An example aircraft control system for continual execution of control software during fault detection includes a random access memory (RAM) configured to store a plurality of static data copies and a processor configured to access a current static data copy for use during operation. The system also includes a parity generator configured to generate a first parity bit for each of the plurality of static data copies when the processor writes data to the RAM. The first parity bit is sent to the RAM for storage with the corresponding static data copy. The parity generator is configured to generate a second parity bit for each of the plurality of static data copies when each of the plurality of static data copy is read by the processor. The system also includes a parity checker configured to compare the first parity bit and the second parity bit for each static data copy being read. The parity checker is configured to notify the processor when the first parity bit and second parity bit are not matching, thus indicating a parity fault. The processor is reconfigured to access a new static data copy from the plurality of static data copies in response to the parity fault. 
         [0007]    These and other features of the present disclosure can be best understood from the following specification and drawings, the following of which is a brief description. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0008]      FIG. 1  schematically shows an airplane having a control system. 
           [0009]      FIG. 2  schematically shows an example control system. 
           [0010]      FIG. 3A  schematically shows portions of the control system of  FIG. 2  with data mapping. 
           [0011]      FIG. 3B  schematically shows portions of the control system of  FIG. 2  with reconfigured data address mapping. 
           [0012]      FIG. 3C  schematically shows the control system of  FIG. 2  with another reconfigured data address mapping. 
           [0013]      FIG. 4  is a flow chart of an overwrite task of the control system. 
       
    
    
     DETAILED DESCRIPTION 
       [0014]    Referring to  FIG. 1 , an example airplane  100  includes gas turbine engines  110 . Each of the gas turbine engines  110  drive a generator  120 , shown schematically. A control system  130  communicates to control the generator  120 . In this example, the control system  130  is a generator control unit. However, other control systems  130 , which control various avionic hardware and systems throughout the airplane  100 , are contemplated to include the method and software disclosed. 
         [0015]    Referring to  FIG. 2 , the example control system  130 , shown schematically, includes a microprocessor  132 , an Read Only Memory (ROM)  134 , a data bus  136 , an address bus  138 , a parity protected random access memory (PPRAM)  140 , a parity generator  142 , and a parity checker  144 . The microprocessor  132  includes a memory management unit (MMU)  146  and cache  170 . The ROM  134  is in communication with the microprocessor  132  such that the microprocessor  132  moves the compressed static data from ROM  134  into PPRAM  140  as multiple copies  154 A- 154 C of bytes of static data. Static data is data that is not deleted or modified once created. The bytes of data received from the ROM  134  are unzipped, or uncompressed, and written into the PPRAM  140  by the microprocessor  132  for storage and use by the control system  130 , creating static data copies  154 A- 154 C as will be described in further detail below. The microprocessor  132  writes the static data copies  154 A- 154 C to the PPRAM  140  through data bus  136  while retaining and assigning the address of the static data copies  154 A- 154 C stored in the PPRAM  140  through address bus  138 . The static data copies  154 A- 154 C are utilized when the first static data copy is determined to be corrupted. Due to memory size constraints and SEU protection requirements, static data copies  154 A- 154 C are stored on the PPRAM  140  for access, as opposed to the ROM  134  so that corrupted static data copies  154 A- 154 C can be overwritten and corrected. 
         [0016]    The data bus  136  is configured to allow the microprocessor  132  to write data to the PPRAM  140  and read data from PPRAM  140 . When the data bus  136  is writing static data copies  154 A- 154 C, the data is being sent to and stored in the PPRAM  140 . When the microprocessor  132  reads data through the data bus  136 , the stored data copies  154 A- 154 C in the PPRAM  140  are being accessed for use by the control system  130 . The MMU  146  maps each of static data copy  154 A- 154 C address locations at startup. The cache  170  is disabled at startup for the static data copies  154 A- 154 C. The address bus  138  contains the requested address location of the microprocessor  132  program to access a given memory location in the PPRAM  140 . The microprocessor  132  is able to access multiple static data copies  154 A- 154 C stored in the PPRAM  140  by using the MMU  146  to point to the address of a particular static data copy  154 A- 154 C and reading the static data copy  154 A- 154 C using the data bus  136 . 
         [0017]    When the data bus  136  operates to either write data or read data for the microprocessor  132 , the static data copy  154 A- 154 C being written or read is also sent to the parity generator  142 . The parity generator  142  takes each static data copy  154 A- 154 C and creates a parity bit  155 A- 155 C for each byte. Alternatively, parity may be determined on a different number of bits, such 4, 16, 32, 64, or other numbers of bits. The parity bit  155 A- 155 C will be either a one or a zero, depending on whether odd parity checking or even parity checking is being employed, and will be stored in the PPRAM  140  with the corresponding static data copy  154 A- 154 C. 
         [0018]    In one example, the control system  130  employs odd parity checking, as shown by example in Table 1 below. In this example, the parity generator  142  will count the number of ones in each byte of data and determine the parity bit  155 A- 155 C to be created and added to each byte such that the nine bits will have an odd number of ones. If there is an even number of bits with the value 1, the parity bit  155 A- 155 C will be assigned the value 1 and if there are an odd number of bits with the value 1, the parity bit  155 A- 155 C will assigned a value 0. 
         [0000]    
       
         
               
               
               
               
               
             
           
               
                   
                 TABLE 1 
               
               
                   
                   
               
               
                   
                   
                   
                   
                 Number of 
               
               
                   
                   
                 Number of 
                   
                 Ones 
               
               
                   
                 Sample Data 
                 Ones in Data 
                   
                 Including 
               
               
                   
                 Bits in a Byte 
                 Byte 
                 Parity Bit 
                 Parity Bit 
               
               
                   
                   
               
             
             
               
                   
                 00000000 
                 0 
                 1 
                 1 
               
               
                   
                 10110011 
                 5 
                 0 
                 5 
               
               
                   
                 10010100 
                 3 
                 0 
                 3 
               
               
                   
                 11111111 
                 8 
                 1 
                 9 
               
               
                   
                   
               
             
          
         
       
     
         [0019]    In another example, the control system  130  employs even parity checking, as shown by example in Table 2. In this example, the parity generator  142  will generate a parity bit  155 A- 155 C such that the number of ones in the byte will always be even. If there is an even number of bits with the value 1, the parity bit  155 A- 155 C is assigned the value of 0 and if there are an odd number of bits with the value 1, the parity bit  155 A- 155 C will assigned a value of 1. After the parity generator  142  has created the correct parity bit  155 A- 155 C, the parity bit  155 A- 155 C is sent to the PPRAM  140  to be added and stored with the corresponding static data copy  154 A- 154 C it was generated from. 
         [0000]    
       
         
               
               
               
               
               
             
           
               
                   
                 TABLE 2 
               
               
                   
                   
               
               
                   
                   
                   
                   
                 Number of 
               
               
                   
                   
                 Number of 
                   
                 Ones 
               
               
                   
                 Sample Data 
                 Ones in 
                 Parity 
                 Including 
               
               
                   
                 Bits in a Byte 
                 Data Byte 
                 Bit 
                 Parity Bit 
               
               
                   
                   
               
             
             
               
                   
                 00000000 
                 0 
                 0 
                 0 
               
               
                   
                 10110011 
                 5 
                 1 
                 6 
               
               
                   
                 10010100 
                 3 
                 1 
                 4 
               
               
                   
                 11111111 
                 8 
                 0 
                 8 
               
               
                   
                   
               
             
          
         
       
     
         [0020]    Although Tables 1 and 2 show example parity bits  155 A- 155 C assigned for data bits in example data bytes, any data bytes and corresponding parity bits  155 A- 155 C can be used. 
         [0021]    Each time the microprocessor  132  reads static data copies  154 A- 154 C through the data bus  136 , the static data copy  154 A- 154 C being read is also sent to the parity generator  142 . The parity generator  142  will create a new parity bit  157  for the static data copy  154 A- 154 C being read. The parity generator  142  sends this new parity bit  157  to the parity checker  144 . At the same time, the PPRAM  140  sends the parity bit  155 A- 155 C stored for the same static data copy  154 A- 154 C being read to the parity checker  144 . The control system  130  is able to compare the original parity bit  155 A- 155 C with the new parity bit  157 . 
         [0022]    The parity checker  144  will compare the two parity bits  155 A- 155 C,  157  to determine if they match. If a bit changes from a zero to a one or a one to a zero, the parity bit  157  which is output by the parity generator  142  will also change. If the parity checker  144  determines that the parity bits  155 A- 155 C,  157  do not match, then a bit in the static data copy  154 A- 154 C has changed and the static data copy  154 A- 154 C has a parity fault indicating an error. The control system  130  could suffer an SEU by using a static data copy  154 A- 154 C having a parity fault. When the comparison of parity bits  155 A- 155 C,  157  indicates that a fault has occurred, the parity checker  144  signals the microprocessor  132  that a fault has occurred. 
         [0023]    In this example, only the PPRAM  140  is subject to having static data copies  154 A- 154 C suffer a bit value change that can cause SEU. The ROM  134  does not need to be protected from a bit value change because the ROM  134  cannot be overwritten. Because the software run within control system  130  requires more memory than can be offered by the ROM  134 , the PPRAM  140  is used to store static data copies  154 A- 154 C during software execution. By employing the parity bit checking, the control system  130  is able to detect any errors created in the static data copies  154 A- 154 C which could cause an SEU. 
         [0024]    In the example control system  130 , the data bus  136  and address bus  138  are both 32-bit busses. However, a larger or smaller data buss  136  and address buss  138  may be used depending on control system  130  requirements. 
         [0025]    Referring to  FIG. 3A , with continued reference to  FIG. 2 , when the microprocessor  132  sends the static data copies  154 A- 154 C provided from the ROM  134  to the PPRAM  140 , the memory addresses for each static data copies  154 A- 154 C are provided to the MMU  146  by address bus  138 . The MMU  146  includes a MMU table  148  having logical pages  150 A- 150 C and physical pages  152 A- 152 C for each static data copy  154 A- 154 C sent to the PPRAM  140 . Each logical page  150 A- 150 C includes a logical address which points to a physical page  152 A- 152 C. Each physical page  152 A- 152 C includes a physical address for each copy of static data  154 A- 154 C sent to the PPRAM  140 . The logical address for each static data copy  154 A- 154 C is where the static data copies  154 A- 154 C are assumed to reside when the control system  130  is reading the static data copies  154 A- 154 C. The physical address indicates the address where the static data  154 A- 154 C is actually located in the PPRAM  140 . 
         [0026]    During operation of the control system  130 , each static data copy  154 A- 154 C is mapped to a physical address stored in corresponding physical page  152 A- 152 C. The physical address stored in physical page  152 A points to corresponding static data copy  154 A as indicated by arrow  156 A. The physical address stored in physical page  152 B points to static data copy  154 B. The physical address stored in physical page  152 C points to static data copy  154 C. Similarly, the logical address stored in each logical pages  150 A- 150 C will point to a corresponding physical address stored in physical pages  152 A- 152 C. Therefore, initially the logical address of logical page  150 A will point to the physical address of the physical page  152 A, the logical address of logical page  150 B will point to the physical address of physical page  152 B and the logical address of logical page  150 C will point to the physical address of physical page  152 C. 
         [0027]    In this example, when the microprocessor  132  has the data bus  136  read data, the data bus  136  and address bus  138  will always refer to the logical address in logical page  150 A to retrieve the appropriate static data copy  154 A- 154 C. However, the data bus  136  and address bus  138  may also use the logical address stored in logical page  150 B or logical page  150 C. 
         [0028]    In this example, during operation the microprocessor  132 , data bus  136 , and address bus  138  will always determine the static data copy  154 A- 154 C to use by using the same logical page  150 A. Although only three static data copies  154 A- 154 C, with associated logical pages  150 A- 150 C and physical pages  152 A- 152 C are shown, any number of logical pages  150 , physical pages  152 , and corresponding static data copies  154  are within the contemplation of this disclosure. 
         [0029]    Referring to  FIG. 3B , when the parity checker  144  has detected a parity fault in static data copy  154 A, it notifies the microprocessor  132 . The microprocessor  132  reconfigures the MMU table  148 . Logical page  150 A, which is being used by the data bus  136  and address bus  138  to determine which static data copy  154 A- 154 C to access, is reconfigured to point to the physical address stored in physical page  152 B. The control system  130  thus avoids reliance on the static data copy  154 A, which has a parity fault as indicated by the parity checker  144 . By reconfiguring logical page  150 A, the control system  130  can continue normal operation without any interruption, such as rebooting the control system  130 . 
         [0030]    As a result of the MMU table  148  reconfiguration, logical page  150 B will now point to the physical address stored in physical page  152 A and logical page  150 C will point to the physical address stored in physical page  152 C. However, the physical address stored in physical pages  152 A- 152 C does not change. Therefore, the MMU  146  is able to point to a different copy of static data  154 A- 154 C that does not have an error. 
         [0031]    Referring to  FIG. 3C , when the parity checker  144  has detected a parity fault in static data copy  154 B, it notifies the microprocessor  132 . The microprocessor  132  reconfigures the MMU table  148 . Logical page  150 A, which is being used by the data bus  136  and address bus  138  to determine which static data copy  154 A- 154 C to access, is reconfigured to point to the physical address stored in physical page  152 C. The control system  130  thus avoids reliance on the static data copy  154 B, which has a parity fault as indicated by the parity checker  144 . By reconfiguring logical page  150 A, the control system  130  can continue normal operation without interruption. 
         [0032]    As a result of the MMU table  148  reconfiguration, logical page  150 B will now point to the physical address stored in physical page  152 B and logical page  150 C will point to the physical address stored in physical page  152 A. However, the physical address stored in physical pages  152 A- 152 C does not change. Therefore, the MMU  146  is able to point to a different copy of static data  154 A- 154 C that does not have an error. 
         [0033]    In this example, if the final physical page  152 C is reached and the parity checker  144  detects a parity fault in static data copy  154 C, wrap around will occur. When this parity fault is detected, the logical page  150 A will wrap around to again point to physical address stored in physical page  152 A, as shown in  FIG. 3A . Therefore, the software being run in the control system  130  is never interrupted. 
         [0034]    Referring to  FIG. 4 , with continued reference to  FIG. 2 , corrupted static data copies  154 A- 154 C, which are static data copies  154 A- 154 C suffering from an error due to bit value change, need to be corrected due to the wrap around reconfiguration which the MMU  146  employs due to parity faults. When a parity fault is detected on a static data copy  154 A- 154 C, that static data copy  154 A- 154 C is overwritten with the correct copy of the static data. Microprocessor  132  conducts an overwrite task, shown by flow chart  200 , to check, overwrite and replace corrupted static data copies  154 A- 154 C. The overwrite task may be performed as a background process when the microprocessor  132  is not otherwise occupied with a more time or event sensitive foreground process. Repair of corrupted data can be delayed since one or more non-corrupted and uncompressed copies of the data are readily available in the PPRAM  140 . The overwrite task is conducted by the microprocessor  132 , both when the microprocessor  132  is notified of a parity fault as well as when the microprocessor  132  is not notified of a parity fault. The control system  130  can thus correct any errors in the static data copies  154 A- 154 C that occur during use of a particular static data copy  154 A- 154 C, as well as correct any errors in a static data copy  154 A- 154 C before that static data copy  154 A- 154 C is used by the control system  130 . 
         [0035]    During operation, the overwrite task will read data from the PPRAM  140  (Step  202 ). The overwrite task compares each static data copy  154 A- 154 C from the PPRAM  140  to each other to check whether any static data copy  154 A- 154 C does not match and is therefore corrupted (Step  204 ). If all static data copies  154 A- 154 C are identical (Step  206 ) the overwrite task will continue comparing data during data read ( 212 ), and restart the checking process. (Step  202 ). If all static data copies  154 A- 154 C are not identical (Step  206 ), the overwrite task will refresh the corrupted static data copy  154 A- 154 C (Step  208 ) by overwriting the corrupted static data copy  154 A- 154 C with a correct static data copy  154 A- 154 C. The overwrite task will then continue the checking process ( 202 ). 
         [0036]    In one example, the overwrite task refreshes the corrupted static data copy  154 A by overwriting with data from one of the uncorrupted static data copies  154 B, 154 C. Alternatively, the microprocessor  132  can request a fresh static data copy  154 A- 154 C from the ROM  134  to overwrite the corrupted data static data copy  154 A. After the corrupted data copy  154 A is overwritten, the static data copies  154 A- 154 C are written back into the PPRAM  140  (Step  210 ). 
         [0037]    Although described using an example corrupted static data copy  154 A, the overwrite task is applied to any static data copy  154 A- 154 C which becomes corrupted. 
         [0038]    In operation, the ROM  134  provides the static data copies  154 A- 154 C to the microprocessor  132  which unzips or decompresses the copies and writes them into the PPRAM  140 . The parity generator  142  assigns each static data copy  154 A- 154 C a parity bit  155 A- 155 C. When data is read from the PPRAM  140  by the microprocessor  132 , the stored parity bit  155 A- 155 C in the PPRAM  140  and the parity bit  157  generated from the read static data copy  154 A- 154 C are compared by the parity checker  144 . If a parity fault is detected, the parity checker  144  notifies the microprocessor  132 , which instructs the MMU  146  to switch the static data copy  154 A- 154 C that is being used. During operation, the microprocessor  132  also runs the overwrite task to continually refresh the static data copies  154 A- 154 C. In this way, the control system  130  is able to detect a bit change which could cause an SEU before the static data copy  154 A- 154 C is being used, as well as after a parity fault is identified, but without interrupting control system  130  operations and software execution. 
         [0039]    Although, example embodiments have been disclosed, a worker of ordinary skill in this art would recognize that certain modifications would come within the scope of the claims. For that reason, the following claims should be studied to determine the true scope and content.