Patent Publication Number: US-9891978-B1

Title: Fault detection in a multi-core safety-critical avionics system

Description:
BACKGROUND 
     Contemporary processing units are often multi-core processors (MCP) with increasing levels of system-on-a-chip (SoC) capability. Regulatory agencies have yet to identify an acceptable approach to certifying the use of MCPs for handling safety-critical applications in an airborne system. For example, aircraft display systems may incorporate safety-critical applications for compiling critical data parameters and forwarding those parameters to a graphics engine for generating cockpit displays. If such a safety-critical application were to fail, the result would be catastrophic (e.g., probable loss of the aircraft as well as its crew or passengers). Accordingly, architectural mitigations (i.e., fault detection and response) must provide assurance that safety-critical application failures will be extremely improbable (e.g. 10e −9  probability per flight hour). The Certification Authorities Software Team, in its May 2014 position paper “Multi-core Processors” which is herein incorporated in its entirety, identified various challenges and hurdles which preclude the certification of MCP use. For example, the existence of coherency fabrics, interference channels, or the dynamic reallocation of shared system resources may lead to non-deterministic results which preclude the successful execution of safety-critical applications. 
     SUMMARY 
     Embodiments of the inventive concepts disclosed herein are directed to a system and related method for providing certified operation of safety-critical avionics applications via a multi-core avionics processor. Fault detection is provided by system monitors external to the active processing cores on which the safety-critical applications are configured to execute. The individual fault history of each pach processing core is constructed over time, and may be monitored and analyzed to determine fault trending and the optimal assignments of safety-critical applications to processing cores and processing units, selecting away from fault-prone cores and flagging processing units displaying high or atypical fault trends for further analysis or diagnosis. 
     In a first aspect, embodiments of the inventive concepts disclosed herein are directed to a system for certified safety-critical avionics operation aboard an aircraft. The system may include one or more redundant processing elements (RPE). The system may include a multi-core processor (MCP) having one or more processing cores distributed among at least one processing unit. The system may assign each RPE to a processing core; each RPE may include safety-critical applications configured to execute on the associated processing core. A safety-critical application may receive a critical data parameter and generate a critical result associated with the critical data parameter, sending the critical data parameter and critical result to an external system monitor. The system monitor may detect a fault associated with the safety-critical application based on the received critical result and the received critical data parameter, and notify the safety-critical application of the detected fault. The associated safety-critical application may process the detected fault. 
     In a further aspect, the inventive concepts disclosed herein are directed to a system wherein the processing unit includes at least one of a single-core processor, a dual-core processor, and a multi-core (i.e., having three or more cores) processor. 
     In a further aspect, the inventive concepts disclosed herein are directed to a system wherein the critical data parameter includes at least one parameter sensed by an associated sensor of the aircraft. 
     In a further aspect, the inventive concepts disclosed herein are directed to a system wherein the system monitor is configured to detect a fault by comparing the critical data parameter and a generated critical result. 
     In a further aspect, the inventive concepts disclosed herein are directed to a system wherein the safety-critical application is configured to generate the critical result by encrypting the critical data parameter. 
     In a further aspect, the inventive concepts disclosed herein are directed to a system further including at least one fault log of the MCP, the fault log including a fault history associated with each processing core of the MCP, and at least one warning device coupled to the MCP. 
     In a further aspect, the inventive concepts disclosed herein are directed to a system wherein the system monitor is configured to process a detected fault by at least one of: logging at least one of the safety-critical application associated with the detected fault, the RPE associated with the safety-critical application, and the processing core to which the RPE is assigned and on which the safety-critical application executes. 
     In a further aspect, the inventive concepts disclosed herein are directed to a system wherein the associated safety-critical application is configured to generate an alert associated with a detected fault, and deliver the alert to a crewmember of the aircraft via the warning device. 
     In a further aspect, the inventive concepts disclosed herein are directed to a system wherein the warning device includes at least one of a flight deck annunciator or other auditory warning device, a visual display system, and a stick-shaker or other tactile warning device. 
     In a further aspect, the inventive concepts disclosed herein are directed to a system wherein at least one RPE is assigned to an associated processing core based on the fault history associated with the processing core. 
     In a still further aspect, the inventive concepts disclosed herein are directed to a method for certified operation of a safety-critical avionics system aboard an aircraft. The method may include assigning at least one redundant processing element (RPE) to a processing core of a multi-core processor (MCP) of the system, the MCP including two or more processing cores distributed among at least one processing unit and the RPE including at least one safety-critical application configured to execute on the associated processing core. The method may include receiving a critical data parameter via the safety-critical application. The method may include generating a critical result based on the critical data parameter via the safety-critical application and sending the critical data parameter and the critical result to an external system monitor. The method may include detecting a fault associated with the safety-critical application via the system monitor by based on the received critical data parameter and the received critical result, and notifying the associated safety-critical application of the detected fault. The method may include processing the at least one detected fault via the associated safety-critical application. 
     In a further aspect, embodiments of the inventive concepts disclosed herein are directed to a method further including receiving a critical data parameter sensed by a sensor of the aircraft via the safety-critical application. 
     In a further aspect, embodiments of the inventive concepts disclosed herein are directed to a method further including resetting the sensor associated with the safety-critical application. 
     In a further aspect, embodiments of the inventive concepts disclosed herein are directed to a method further including logging at least one of the safety-critical application associated with the detected fault, the RPE associated with the critical application, and the processing core to which the RPE is assigned to a fault log associated with the processing core. 
     In a further aspect, embodiments of the inventive concepts disclosed herein are directed to a method further including assigning an RPE to a processor core of the MCP based on a fault log associated with the processing core. 
     In a further aspect, embodiments of the inventive concepts disclosed herein are directed to a method further including generating an alert associated with the detected fault via the associated safety-critical application and delivering the alert to a crewmember of the aircraft via a warning device of the aircraft. 
     In a further aspect, embodiments of the inventive concepts disclosed herein are directed to a method further including generating a critical result by encrypting a received critical data parameter via the safety-critical application. 
     In a further aspect, embodiments of the inventive concepts disclosed herein are directed to a method further including detecting a fault associated with the safety-critical application by comparing a received critical data parameter and a generated critical result. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The inventive concepts disclosed herein may be better understood by those skilled in the art by reference to the accompanying figures in which: 
         FIG. 1  is a block diagram illustrating a system according to embodiments of the inventive concepts disclosed herein; and 
         FIG. 2  is a process flow diagram illustrating a method according to embodiments of the inventive concepts disclosed herein. 
     
    
    
     DETAILED DESCRIPTION 
     Features of the inventive concepts disclosed herein in their various embodiments are exemplified by the following descriptions with reference to the accompanying drawings, which describe the inventive concepts with further detail. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not necessarily restrictive of the inventive concepts disclosed and claimed herein. These drawings depict only exemplary embodiments of the inventive concepts, and should not be considered to limit their scope in any way. 
     Embodiments of the inventive concepts disclosed herein are directed to a system and related method for certified safety-critical avionics operations aboard an aircraft. The proposed system incorporates multi-core processing compliant with current regulatory requirements for safe execution by running safety-critical applications for each of multiple positions aboard the aircraft (e.g., the location of each redundant processing element, or RPE) in a separate core. By incorporating external architectural mitigation for each core, the system ensures external fault detection, processing, and analysis, generating in-service data about the performance of each core which populates a comprehensive service record demonstrating the equivalence of multi-core processing to current approaches. Generated in-service data may also enhance system maintenance reporting by providing a baseline for assessing the operational health of specific cores within a dual-core or multi-core processing unit, or for assigning and de-assigning RPEs and their related safety-critical applications to or from a particular processing core based on the core&#39;s fault history. For example, processing cores displaying consistently high fault trends may be selected away from, or processing units whose cores display atypical fault distributions may be flagged for further or special analysis pursuant to regular maintenance. 
     Referring to  FIG. 1 , a system  100  for certified safety-critical avionics operations aboard an aircraft according to embodiments of the inventive concepts disclosed herein may incorporate a multi-core processor (MCP)  102  including several processing cores  104   a - d . The system  100  may include any number of processing cores  104   a - d  distributed among any combination of single-core, dual-core, and multi-core processing units (not shown). The system  100  may include a group of redundant processing elements (RPE)  106   a, b , each RPE  106   a,b  corresponding to a particular position in the chipset of the MCP  102  and assigned to an associated processing core  104   b ,  104   d  of the MCP  102 . For example, in an implementation of the system  100  as shown by  FIG. 1 , wherein the system  100  includes two RPEs  106   a ,  106   b  and the MCP  102  includes four processing cores  104   a - d , the RPE  106   a  may be a primary (e.g., captain&#39;s, pilot&#39;s) graphics generation module (GGM) and the RPE  106   b  a secondary (e.g., XO&#39;s, co-pilot&#39;s) GGM. The primary and secondary RPEs  106   a,b  may be assigned to specific processing cores  104   b ,  104   d  based on, e.g., the previous fault histories of each processing core  104   a - d  or the collective fault history of one or more processing units (not shown) of the MCP  102 . Whether or not a particular processing core  104   a - d  is a default core (e.g., CPU  0 ) of the MCP  102  is of no consequence. Some processing cores  104   a - d  of the MCP  102  may be inactive processing cores  104   a,c  not currently associated with an RPE  106   a,b  or a safety-critical application  108   a,b.    
     Each RPE  106   a,b  of the system  100  may include one or more safety-critical applications  108   a, b  associated with the processing core  104   b,d  to which its associated RPE  106   a,b  is assigned, and configured to execute on the associated core  104   b,d . For example, the safety-critical application  108   a  of the RPE  106   a  configured to execute on the processing core  104   b  may include a graphics generation application configured to receive a critical data parameter  110   a  from a sensor  112   a  of the aircraft. The safety-critical application  108   a  may generate a critical result  114   a  by processing the critical data parameter  110   a , and a primary (e.g., captain&#39;s, pilot&#39;s) display unit  116   a  of the aircraft may continually generate a visual display of critical information (e.g., by drawing) based on the critical data parameter  110   a  or the generated critical result  114   a . For example, a safety-critical application  108   a,b  may generate a critical result  114   a,b  by encrypting or otherwise processing the received critical data parameters  110   a,b . In an implementation of the system  100  wherein the RPEs  106   a,b  include graphics generation modules, critical data parameters  110   a,b  sensed by a sensor  112   a,b  may be associated with the altitude (or radio altitude), attitude, airspeed, heading, glideslope (or localizer), engine data, or fuel quantity of the aircraft at any given point in time. The misleading or inaccurate display of such critical data parameters  110   a,b  or associated critical information (including critical results  114   a,b ) may result in hazardous or catastrophic failure. A sensor  112   a,b  may include an air data inertial reference unit (ADIRU), air data module (ADM), or other line replaceable unit (LRU). An RPE  106   a  may additionally include one or more non-critical applications  118 , such as a synthetic vision system, configured to execute on unused portions of the associated processing core  104   b  in such a way that the operation of the non-critical application  118  does not interfere with or hinder that of a safety-critical application  108   a  executing on the same processing core  104   b.    
     External fault detection and processing of safety-critical applications  108   a,b  executing on the processing cores  104   b,d  of the MCP  102  may be provided by one or more system monitors  120   a,b . The system monitors  120   a,b  may detect a fault associated with a safety-critical application  108   a,b  (executing on a processing core  104   b,d  of the MCP  102 ) based on the critical data parameters  110   a,b  received from the safety-critical applications  108   a,b  assigned to the processing cores  104   b,d  and the critical results  114   a,b  generated by the safety-critical applications  108   a,b . For example, the system monitors  120   a,b  may detect a fault by encrypting or otherwise processing the received critical data parameter  110   a,b  to generate an expected result, and comparing the expected result to the received critical result  114   a,b  generated by the safety-critical applications  108   a,b . The system monitors  120   a,b  may detect a fault if a critical data parameter  110   a  is received by the system monitors  120   a,b  from a safety-critical application  108   a,b  but no corresponding critical result  114   a,b  is received from the safety-critical application  108   a,b , or if a critical result  114   a,b  is received from the safety-critical application  108   a,b  that does not correspond to any received critical data parameter  110   a,b.    
     A fault associated with a safety-critical application  108   a,b  and detected by the system monitors  120   a,b  of the system  100  may be logged or processed by the originating safety-critical application  108   a,b . For example, upon detecting a fault associated with a safety-critical application  108   a,b  of the RPE  106   a,b  and executing on the processing core  104   b,d  of the MCP  102 , the system monitor  120   a,b  may send a notification of the detected fault to the originating safety-critical application  108   a,b . The safety-critical application  108   a,b  may generate an alert associated with the detected fault, alerting the pilot, captain, or crew of the aircraft via the display system  116   a,b  of the aircraft or via another warning device  122   a,b . The warning device  122   a,b  may include a flight deck annunciator or other auditory warning device, or a tactile warning device such as a stick-shaker coupled to the captain&#39;s or first officer&#39;s flight controls. The safety-critical application  108   a,b  may reset the sensor  112   a,b  or LRU with which the safety-critical application  108   a,b  is associated. 
     The safety-critical application  108   a,b  may respond to a received notification of a detected fault by logging the fault to a fault log (fault history)  124   a,b  associated with the specific core  104   b,d  on which the safety-critical application  108   a,b  is executing. For example, the fault logs  124   a,b  for each processing core  104   b,d  may be maintained by a health monitor (HM)  126  of the MCP  102 ; the HM  126  may maintain additional fault logs (not shown) for currently inactive processor cores  104   a,c . Entries in a fault log  124   a,b  may include the safety-critical application  108   a,b  associated with the detected fault, the processing core  104   b,d  on which the safety-critical application  108   a,b  is currently executing, or the RPE  106   a,b  including the safety-critical application  108   a,b  and assigned to the processing core  104   b,d . As the system  100  builds a fault history for each processing core  104   a - b  of the MCP  102 , each fault log  124   a,b  may be analyzed for optimal maintenance and certified operation of the MCP  102 . For example, if the fault log  124   b  associated with the processing core  104   d , to which the RPE  106   b  is currently assigned, indicates consistently higher than normal fault trends, the RPE  106   b  (and the safety-critical application  108   b  executing on the processing core  104   d ) may be reassigned to a currently inactive processing core  104   a ,  104   c  of the MCP  102 . If the processing cores  104   c  and  104   d  are housed on a single processing unit (not shown) and both processing cores  104   c,d  indicate consistently high or atypical fault distributions, the RPE  106   d  may be reassigned to the currently inactive processing core  104   a  and the processing unit housing the processing cores  104   c,d  may be replaced or analyzed to address the high/atypical fault distributions. 
     Referring to  FIG. 2 , a method  200  for certified operation of a safety-critical avionics system incorporating a multi-core processor (MCP) architecture aboard an aircraft, the MCP architecture including one or more processing cores  104   a - d  distributed among at least one processing unit, is shown. 
     At a step  202 , the method  200  assigns at least one redundant processing element (RPE)  106   a,b  to a processing core  104   b,d  of a multi-core processor (MCP)  102  of the system  100 , the MCP  102  including two or more processing cores  104   a - d  distributed among at least one processing unit, the at least one RPE  106   a,b  including at least one safety-critical application  108   a,b  configured to execute on the associated processing core  104   b,d . For example, an RPE  106   a,b  may be assigned to a processing core  104   b,d  based on a fault log  124   a,b  associated with the processing core  104   b,d.    
     At a step  204 , the method  200  receives at least one critical data parameter  110   a,b  via the at least one safety-critical application  108   a,b . For example, the safety-critical application  108   a,b  may receive a critical data parameter  110   a,b  sensed by a sensor  108   a,b  of the aircraft. 
     At a step  206 , the method  200  generates at least one critical result  114   a,b  associated with the at least one critical data parameter  110   a,b  via the safety-critical application  108   a,b . For example, the safety-critical application  108   a,b  may generate a critical result  114   a,b  by encrypting a critical data parameter  110   a,b.    
     At a step  208 , the method  200  sends one or more of the critical data parameter  110   a,b  and the generated critical result  114   a,b  to at least one system monitor  120   a,b  of the system  100 . 
     At a step  210 , the method  200  detects at least one fault associated with the safety-critical application  108   a,b  via the system monitor  120   a,b  based on one or more of the at least one critical data parameter  110   a,b  and the at least one generated critical result  114   a,b . For example, the system monitor  120   a,b  may compare at least one of a critical data parameter  110   a,b  and a critical result  114   a,b.    
     At a step  212 , the method  200  notifies the associated safety-critical application  108   a,b  of the detected fault via the system monitor  120   a,b.    
     At a step  214 , the method  200  processes the at least one detected fault via the at least one associated safety-critical application  108   a,b . For example, the safety-critical application  108   a,b  may log the detected fault to a fault log  124   a,b  of a health monitor  126  of the MCP  102  (the fault log  124   a,b  associated with the processing core  104   b,d ) along with the associated safety-critical application  108   a,b , the associated RPE  106   a,b  or the associated processing core  104   b,d . The associated safety-critical application  108   a,b  may generate an alert associated with the detected fault and deliver the alert to a crewmember of the aircraft via a display system  116   a,b  or a warning device  122   a,b  of the aircraft. The associated safety-critical application  108   a,b  may reset the associated sensor  112   a,b  or LRU. 
     CONCLUSION 
     Specific blocks, sections, devices, functions, processes, and modules may have been set forth. However, a skilled technologist will realize that there are many ways to partition the system, and that there are many parts, components, processes, modules or functions that may be substituted for those listed above. 
     Those having skill in the art will recognize that the state of the art has progressed to the point where there may be little distinction left between hardware, software, and/or firmware implementations of aspects of systems; the use of hardware, software, and/or firmware is generally (but not always, in that in certain contexts the choice between hardware and software can become significant) a design choice representing cost vs. efficiency tradeoffs. 
     Additionally, implementations of embodiments disclosed herein may include executing a special-purpose instruction sequence or invoking circuitry for enabling, triggering, coordinating, requesting, or otherwise causing one or more occurrences of virtually any functional operations described herein. 
     While particular aspects of the inventive concepts disclosed herein have been shown and described, it will be apparent to those skilled in the art that, based upon the teachings herein, changes and modifications may be made without departing from the inventive concepts described herein and their broader aspects and, therefore, the appended claims are to encompass within their scope all such changes and modifications as are within the broad scope of the inventive concepts described herein. 
     With respect to the appended claims, those skilled in the art will appreciate that recited operations therein may generally be performed in any order. Also, although various operational flows are presented in a sequence(s), it should be understood that the various operations may be performed in other orders than those which are illustrated, or may be performed concurrently.