Patent Description:
A control system of a gas turbine engine uses multiple configuration control items, such as control software, data, trim updatable values, and the like to control operation of the gas turbine engine and monitor performance of the gas turbine engine. Once a gas turbine engine is deployed in the field, it can be difficult to access data captured and/or computed by the control system and to make updates to the configuration control items. A gas turbine engine can be deployed in the field for an extended service life, such as a period of decades. Computer system technology and communication technology can evolve at a rapid pace adding to the challenges of interfacing with offboard systems as the offboard technology continues to advance during the lifespan of the engine.

As components are replaced on an engine, a configuration history can be tracked in various locations. If configuration history data is maintained within an engine control, the configuration history data may be lost if the engine control is swapped out.

<CIT> discloses a method and system for transmitting engine control data to or from the engine control unit of an engine.

<CIT> discloses an integrated system for monitoring and gathering data about a deployed product on a movable platform.

<CIT> discloses a gas turbine engine with a supervision circuit and an interface compatible with a data connection of the engine.

According to one embodiment, an engine gateway of a gas turbine engine of an aircraft includes a communication interface configured to wirelessly communicate with an offboard system through one or more antennas and to communicate with an engine control of the gas turbine engine using both a first communication bus and a second communication bus, a memory system, a data storage system isolated from the memory system, and processing circuitry. The processing circuitry is configured to establish communication with the engine control on the first communication bus using system credential authentication, establish communication between the engine control and the data storage system on the second communication bus, and establish wireless communication with the offboard system using system credential authentication, wherein the one or more updates of the data storage system are wirelessly transmitted upon service credential authorization from the offboard system to the engine gateway, communicated from the engine gateway to the engine control on the first communication bus, and communicated from the engine control to the data storage system on the second communication bus. Service credential authentication is used to verify a level of access granted to update specific portions of the memory system of the engine control and the data storage system. Configuration data stored in the data storage system is available to the replacement version of the engine control.

The second communication bus may provide electrical power from the engine control to the data storage system.

The data storage system may include a controller and one or more non-volatile memory devices.

The controller may be configured to manage the one or more updates using a buffer that enables reversion to a previous state of one or more data records based on detecting an error condition.

The processing circuitry may be further configured to communicate with the controller in a maintenance mode based on determining that the engine control is disconnected from the engine gateway, where the maintenance mode is enabled based on one or more of: a discrete input, a keycode, and a connection between the first communication bus and the second communication bus.

User credential authentication may be performed in combination with system credential authentication and service credential authentication.

The engine gateway may be mounted on a fan case of the gas turbine engine, and the engine gateway may be physically separated from the engine control.

According to an embodiment, a method includes establishing communication between an engine control of a gas turbine engine of an aircraft and an engine gateway on a first communication bus using system credential authentication, establishing communication between the engine control and a data storage system of the engine gateway on a second communication bus, where the data storage system is isolated from a memory system of the engine gateway, and establishing wireless communication between the engine gateway and an offboard system through one or more antennas using system credential authentication. The one or more updates of the data storage system are wirelessly transmitted upon service credential authorization from the offboard system to the engine gateway, communicated from the engine gateway to the engine control on the first communication bus, and communicated from the engine control to the data storage system on the second communication bus. Service credential authentication is used to verify a level of access granted to update specific portions of the memory system of the engine control and the data storage system. Configuration data stored in the data storage system is available to the replacement version of the engine control. The method may include receiving electrical power on the second communication bus at the data storage system from the engine control.

The data storage system may comprise a controller and one or more non-volatile memory devices.

The method may include managing, by the controller, the one or more updates using a buffer that enables reversion to a previous state of one or more data records based on detecting an error condition.

The method may include communicating between the engine gateway and the controller in a maintenance mode based on determining that the engine control is disconnected from the engine gateway, where the maintenance mode is enabled based on one or more of: a discrete input, a keycode, and a connection between the first communication bus and the second communication bus.

According to an embodiment, a gas turbine engine of an aircraft includes a fan section with a fan case, an engine control mounted on the fan case, and an engine gateway mounted on the fan case. The engine control is configured to monitor and control operation of the gas turbine engine in real-time. The engine gateway includes a data storage system isolated from a memory system of the engine gateway and processing circuitry configured to establish communication with the engine control on a first communication bus, establish communication between the engine control and the data storage system on a second communication bus, establish wireless communication with the offboard system using system credential authentication, wherein the one or more updates of the data storage system are wirelessly transmitted upon service credential authorization from the offboard system to the engine gateway, communicated from the engine gateway to the engine control on the first communication bus, and communicated from the engine control to the data storage system on the second communication bus.

The processing circuitry may be further configured to: communicate with the controller in a maintenance mode based on determining that the engine control is disconnected from the engine gateway, wherein the maintenance mode is enabled based on one or more of: a discrete input, a keycode, and a connection between the first communication bus and the second communication bus.

A technical effect of the apparatus, systems and methods is achieved by incorporating communication features to provide an engine gateway with wireless communication and engine data storage as described herein.

Referring now to the drawings, <FIG> illustrates a system <NUM> supporting wireless communication between an engine gateway <NUM> of a gas turbine engine <NUM> and a plurality of offboard systems <NUM>. The gas turbine engine <NUM> can be coupled to an aircraft <NUM>, where the aircraft <NUM> can include multiple instances of the gas turbine engine <NUM>. The gas turbine engine <NUM> can include a fan section <NUM>, a compressor section <NUM>, a combustor section <NUM>, and a turbine section <NUM>. The fan section <NUM> drives air along a bypass flow path, while the compressor section <NUM> drives air along a core flow path for compression and flow into the combustor section <NUM> then expansion through the turbine section <NUM>. A fan case <NUM> of the fan section <NUM> can be covered by a cowling <NUM> and may provide an installation surface that is cooler than other sections <NUM>-<NUM> of the gas turbine engine <NUM>.

An engine control <NUM> can be mounted on the fan case <NUM> and covered by the cowling <NUM>. The engine control <NUM> is configured to monitor and control operation of the gas turbine engine <NUM> in real-time. In order to transfer configuration items, such as programs and data to and from the engine control <NUM>, contemporary systems typically require that the cowling <NUM> is opened and multiple cables of bundled wires are coupled to the engine control <NUM>. Such a process can ensure deliberate actions are taken in extracting data and performing updates to the engine control <NUM>; however, the process can be slow and require large lengths of customized cables. In embodiments, the engine gateway <NUM>, also referred to as a gas turbine engine communication gateway, is configured to establish communication with the engine control <NUM> and wireless communication with one or more offboard systems <NUM> external to the aircraft <NUM>. Similar to the engine control <NUM>, the engine gateway <NUM> can be mounted on the fan case <NUM> and covered by the cowling <NUM> of the gas turbine engine <NUM>. Wireless communication can alleviate the need for customized cables or physically opening the cowling <NUM> to establish communication with the offboard systems <NUM>.

The offboard systems <NUM> can include, for example, a ground station <NUM>, a near-wing maintenance computer <NUM>, an access portal <NUM>, and/or other devices (not depicted) that may establish one-way or two-way wireless communication with the engine gateway <NUM>. For example, a global positioning system (GPS) can provide one-way wireless signaling to the engine gateway <NUM> to assist in confirming a geographic location of the gas turbine engine <NUM> while the engine gateway <NUM> is coupled to the gas turbine engine <NUM>. Wireless communication performed by the engine gateway <NUM> can be through a variety of technologies with different ranges supported. As one example, the engine gateway <NUM> can support Wi-Fi (e.g., radio wireless local area networking based on IEEE <NUM> or other applicable standards), GPS, cellular networks, satellite communication, and/or other wireless communication technologies known in the art. Wireless communication between the engine gateway <NUM> and the offboard systems <NUM> can be direct or indirect. For instance, wireless communication between the engine gateway <NUM> and ground station <NUM> may pass through one or more network interface components <NUM>, such as a repeater, while wireless communication between the engine gateway <NUM> and the near-wing maintenance computer <NUM> may be direct wireless communication without any relay components.

The ground station <NUM> can enable communication with a variety of support systems, such as an access portal <NUM> that enables authorized users to access data, initiate tests, configure software, and perform other actions with respect to the engine control <NUM>, where the engine gateway <NUM> acts as a secure gateway to limit access and interactions with the engine control <NUM>. As another example, the ground station <NUM> can communicate with a notification system <NUM>, which may trigger alerts, text messages, e-mails, and the like to authorized recipients regarding operational status of the gas turbine engine <NUM>. The near-wing maintenance computer <NUM> may provide an authorized user with limited authority a capability to query the engine gateway <NUM> for fault data, test parameters, and other such information. In some embodiments, the near-wing maintenance computer <NUM> can be authorized with limited authority to make updates to select configuration parameters, software executable or data collection parameters of the engine gateway <NUM>.

<FIG> is a block diagram illustrating further details of the system <NUM> of <FIG>, in accordance with an embodiment of the disclosure. The engine control <NUM> can control effectors <NUM> of the gas turbine engine <NUM> by generating one or more effector commands <NUM>. Examples of effectors <NUM> can include one or more motors, solenoids, valves, relays, pumps, heaters, and/or other such actuation control components. A plurality of sensors <NUM> can capture state data associated with the gas turbine engine <NUM> and provide sensed values <NUM> as feedback to the engine control <NUM> to enable closed-loop control of the gas turbine engine <NUM> according to one or more control laws. Examples of the sensors <NUM> can include one or more temperature sensors, pressure sensors, strain gauges, speed sensors, accelerometers, lube sensors, and the like.

The engine control <NUM> can be a full authority digital engine control that includes processing circuitry <NUM> and a memory system <NUM> configured to store a plurality of configuration items, where at least one of the configuration items includes a sequence of the computer executable instructions for execution by the processing circuitry <NUM>. Other types of configuration items can include but are not limited to data, such as constants, configurable data, and/or fault data. Examples of computer executable instructions can include boot software, operating system software, and/or application software. The executable instructions may be stored or organized in any manner and at any level of abstraction, such as in connection with controlling and/or monitoring operation of the gas turbine engine <NUM>. The processing circuitry <NUM> can be any type or combination of central processing unit (CPU), including one or more of: a microprocessor, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like. Also, in embodiments, the memory system <NUM> may include volatile memory, such as random access memory (RAM), and non-volatile memory, such as Flash memory, read only memory (ROM), and/or other electronic, optical, magnetic, or any other computer readable medium onto which is stored data and algorithms in a non-transitory form.

The engine control <NUM> can also include one or more of an input/output interface <NUM>, a communication interface <NUM>, and/or other elements (not depicted). The input/output interface <NUM> can include support circuitry for interfacing with the effectors <NUM> and sensors <NUM>, such as filters, amplifiers, digital-to-analog converters, analog-to-digital converters, and other such circuits to support digital and/or analog interfaces. Further, the input/output interface <NUM> can receive or output signals to/from other sources. The communication interface <NUM> can be communicatively coupled to the engine gateway <NUM>. The communication interface <NUM> may also communicate with an aircraft bus <NUM> of the aircraft <NUM> of <FIG>. The aircraft bus <NUM> may provide aircraft-level parameters and commands that are used by the engine control <NUM> to control the gas turbine engine <NUM> in real-time.

Similar to the engine control <NUM>, the engine gateway <NUM> can include processing circuitry <NUM>, a memory system <NUM>, an input/output interface <NUM>, and a communication interface <NUM>. The processing circuitry <NUM> can be any type or combination of central processing unit (CPU), including one or more of: a microprocessor, a digital signal processor (DSP), a microcontroller, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or the like. Also, in embodiments, the memory system <NUM> may include volatile memory, such as random access memory (RAM), and non-volatile memory, such as Flash memory, read only memory (ROM), a hard disk drive, and/or other electronic, optical, magnetic, or any other computer readable medium onto which is stored data and algorithms in a non-transitory form. The engine gateway <NUM> can also include an internal sensor system <NUM>. The internal sensor system <NUM> can include, for example, one or more accelerometers, gyroscopes, barometers, a magnetometer (e.g., a compass), and other such sensors. Further, the engine gateway <NUM> can include other devices, such as a GPS receiver <NUM>. The input/output interface <NUM> can process data collected from the internal sensors <NUM> and condition the data in a format usable by the processing circuitry <NUM>. The communication interface <NUM> can interface with one or more antennas <NUM>, which may be integrated with the engine gateway <NUM> or located remotely from the engine gateway <NUM>, e.g., a shark-fin antenna mounted under or on the cowling <NUM> of <FIG>. Although depicted separately in <FIG> and <FIG>, in some embodiments the engine control <NUM> and communication adapter <NUM> can be combined, for instance, where the communication adapter <NUM> is a module or processing core within the engine control <NUM>.

The engine gateway <NUM> can act as a secure communication gateway with respect to the offboard systems <NUM>. For example, the offboard systems <NUM> can request to load new/updated configuration items to the memory system <NUM> of the engine control <NUM> through the engine gateway <NUM>. The communication interface <NUM> of the engine control <NUM> can interface to the communication interface <NUM> of the engine gateway <NUM> through a wired, optical, or magnetic coupling. The communication interface <NUM> communicates wirelessly through one or more antennas <NUM> to the offboard systems <NUM>. The communication interface <NUM> may also have access to receive data directly from the aircraft bus <NUM> in some embodiments. In alternate embodiments, the engine gateway <NUM> can send a request to the engine control <NUM> to provide aircraft parameters received via the aircraft bus <NUM> and/or engine parameters computed by the engine control <NUM>.

Communication between the engine control <NUM> and the engine gateway <NUM> can be divided between multiple busses. For example, a first communication bus <NUM> can enable secure data exchange between the engine control <NUM> and the engine gateway <NUM> to support updates/inspection of the contents of the memory system <NUM>, parameter monitoring, and other such communication. A second communication bus <NUM> can support interfacing the engine control <NUM> with a data storage system <NUM> of the engine gateway <NUM>. The data storage system <NUM> can be isolated (e.g., physically and electrically) from the memory system <NUM> of the engine gateway <NUM>. The data storage system <NUM> can include a controller <NUM> (e.g., a microcontroller) and one or more non-volatile memory devices <NUM>. Separating the data storage system <NUM> physically from the engine control <NUM> can provide an ability to store configuration data on the gas turbine engine <NUM> including, for instance, a list of maintenance bulletins implemented on the specific instance of the gas turbine engine <NUM> to which the engine gateway <NUM> is attached. If the engine control <NUM> needs to be upgraded or replaced, the configuration data stored in the data storage system <NUM> remains available to the replacement version of the engine control <NUM>. Further, data captured in the data storage system <NUM> can be periodically synchronized with one or more offboard systems <NUM>.

In the example of <FIG>, the data storage system <NUM> can act as an extension of the memory system <NUM> of the engine control <NUM>. The non-volatile memory devices <NUM> may store fault data, trim values, service records, and other types of records associated with the configuration and operation of the gas turbine engine <NUM>. Keeping the data storage system <NUM> isolated from the memory system <NUM> and processing circuitry <NUM> of the engine gateway <NUM> can prevent a risk of instructions executing on the engine gateway <NUM> from corrupting the contents of the data storage system <NUM>. Thus, software developed for execution on the processing circuitry <NUM> may be of a lower level of criticality, requiring less development burden than software executed on the processing circuitry <NUM> of the engine control <NUM> and the controller <NUM>. To enhance isolation, the second communication bus <NUM> can include electric power provided by the engine control <NUM>. Thus, the data storage system <NUM> is not influenced by power interruptions within the engine gateway <NUM>. Further, elements of the engine gateway <NUM> may be depowered during certain operating modes, for instance, to limit the use of wireless communication, while the data storage system <NUM> can remain separately powered by the engine control <NUM>.

In some embodiments, there may be operating modes, such as a maintenance mode, where the data storage system <NUM> is accessible by the processing circuitry <NUM>. Such operating modes can be limited, for instance, to conditions where the engine control <NUM> is not connected to the engine gateway <NUM>. As one example, a portion of the first communication bus <NUM> can be looped back to the second communication bus <NUM> when the engine control <NUM> is disconnected. Other approaches to maintenance mode can include the use of discrete input to the engine gateway <NUM>, keycodes (e.g., predetermined authorization codes) which may be written to particular addresses in the engine gateway <NUM>, and/or other techniques. The maintenance mode may limit access to the non-volatile memory devices <NUM> as read-only or require particular conditions and/or credential verification to authorize write updates to the non-volatile memory devices <NUM>.

The engine gateway <NUM> can manage credentials and user authentication to limit access of the memory system <NUM> of the engine control <NUM>. User authentication can be defined for particular users or classes of users, such as equipment-owner users, maintenance technicians, engineering users, and the like. For example, a maintenance technician may have authority to adjust trimmable constants or reprogram certain regions of the memory system <NUM>. An engineering user may have authority to reprogram an operating system, boot program code, or application software in the memory system <NUM>, in addition to having permissions of the maintenance technician and the equipment-owner user. If user authentication fails, for instance, by user credentials not being recognized with respect to user authentication data, then the engine gateway <NUM> can block access of the offboard systems <NUM> from reading from or writing to the memory system <NUM>.

Configuration items received for the engine control <NUM> and/or the engine gateway <NUM> may be encrypted using various cryptographic methods to further enhance security. For example, the engine gateway <NUM> can apply a cryptographic algorithm using one or more parameters received and cryptographic information to decrypt an encrypted configuration item. A combination of transmitted and stored cryptographic information can be used together for decryption based on 'shared secrets' such that not all of the information is sent from the offboard systems <NUM> nor stored completely within the engine gateway <NUM>. After decryption, authenticity of the configuration item can be verified using, for example, a digital signature of the configuration item. The resulting file can be a decrypted and authenticated configuration item, which may be temporarily stored in memory system <NUM> or otherwise buffered during authentication and passed to the engine control <NUM> upon authentication. Updates targeted for the data storage system <NUM> can be wirelessly transmitted upon credential authorization from the offboard system <NUM> to the engine gateway <NUM>, communicated from the engine gateway <NUM> to the engine control <NUM> on the first communication bus <NUM>, and communicated from the engine control <NUM> to the data storage system <NUM> on the second communication bus <NUM>. The engine control <NUM> may also perform a credential authorization check prior to allowing update requests to flow from the engine control <NUM> to the data storage system <NUM>.

Separating the engine gateway <NUM> from the engine control <NUM> can enable the engine gateway <NUM> and the engine control <NUM> to have different expected service life durations. For example, to stay compatible with changes in wireless communication technologies used by the offboard systems <NUM>, the engine gateway <NUM> may be upgraded at a faster interval than the engine control <NUM>. The engine gateway <NUM> can have a lower processing and storage capacity than the engine control <NUM> to reduce power requirements, weight, and other costs associated with the engine gateway <NUM>. Since the engine gateway <NUM> does not actively control the gas turbine engine <NUM>, development cycles may be reduced as compared to implementing flight critical control algorithms and hardware of the engine control <NUM>. The data storage system <NUM> can be modularized (e.g., a board, card, etc.) within a housing of the engine gateway <NUM> to enable swapping out or upgrading of the data storage system <NUM> separately from other components of the engine gateway <NUM>.

<FIG> is a block diagram of configuration items <NUM> of the engine control <NUM> of <FIG>, in accordance with an embodiment of the disclosure. The configuration items <NUM> can include one or more of a boot control <NUM>, identification data <NUM>, an operating system <NUM>, an application <NUM>, constant data <NUM>, and/or configurable data <NUM>. Further, there can be multiple instances of the configuration items <NUM>, such as multiple instances of the application <NUM>, constant data <NUM>, configurable data <NUM>, and/or other items. The configuration items <NUM> can have different levels of criticality and authentication required. The boot control <NUM> can manage the loading and/or initialization of other configuration items <NUM>. The identification data <NUM> can define a number of configuration identifiers to confirm items such as an engine serial number <NUM>, an engine control serial number <NUM>, an engine control configuration version <NUM>, and other such identifiers. The operating system <NUM> can provide scheduling and support for one or more applications <NUM> to interface with various hardware elements of the engine control <NUM> of <FIG>. One or more applications <NUM> that use constant data <NUM> and/or configurable data <NUM> can be invoked by the operating system <NUM>. The application <NUM> can be, for example, configured to control operation of the gas turbine engine <NUM> of <FIG>. The configurable data <NUM> can include adjustable parameters to tune monitoring performance and control performance of the engine control <NUM>, such as engine control trim data <NUM>, fault limit data <NUM>, engine configuration data <NUM> and other such configurable data. In embodiments, a subset of the configuration items <NUM> can be stored in memory devices of the memory system <NUM> of <FIG> that are internal or external to the engine control <NUM>. For example, the memory system <NUM> can include supplemental data storage, such as a data storage unit or programming plug to store configuration information, such as the identification data <NUM> and/or the configurable data <NUM>. Supplemental data storage can be accessed through an alternate memory interface, such as a serial interface of the engine control <NUM> rather than a primary memory bus of the engine control <NUM> that may be used to access executable instructions of the configuration items <NUM> and/or various types of data.

Portions of the configuration items <NUM> may be stored within the data storage system <NUM> of <FIG>. For example, identification data <NUM> and configurable data <NUM> may be stored in the data storage system <NUM> along with other types of records. The boot control <NUM> and/or operating system <NUM> can establish security protocols to reduce the risk of external threats from making unauthorized accesses or updates to the configuration items <NUM> and/or other items.

<FIG> is a block diagram of a configuration management database <NUM> of an offboard system <NUM> of <FIG> to track multiple engine configurations, in accordance with an embodiment of the disclosure. For example, the configuration management database <NUM> can be stored at or accessible by the ground station <NUM> of <FIG> to track and verify the configuration of multiple instances of the gas turbine engine <NUM> of <FIG> and/or changes to a specific instance of the gas turbine engine <NUM> over a period of time. The configuration management database <NUM> can include, for example, a plurality of configuration records <NUM> that correlate data such as engine build identifier <NUM>, configuration data <NUM>, and log filed <NUM>. The engine build identifier <NUM> can identify specific engine configurations and the configuration data <NUM> can include detailed data and software configuration items. For instance, the configuration data <NUM> may include copies or links to one or more of the configuration items <NUM> of <FIG> associated with an instance or group of gas turbine engines <NUM>. The log files <NUM> can include data extracted from the engine gateway <NUM> of <FIG>, which may include data locally collected by the engine gateway <NUM>, the engine control <NUM> of <FIG>, the data storage system <NUM>, and/or the aircraft bus <NUM> of <FIG>. The configuration data <NUM> and log files <NUM> may be access restricted and incorporate various security features, such as authentication requirements, encryption, digital signatures, and the like.

<FIG> is a block diagram of a configuration of a buffer <NUM> that can be used to manage updates to the non-volatile memory devices <NUM> of the data storage system <NUM> of <FIG>. The buffer <NUM> can be implemented as a ping-pong buffer within the non-volatile memory devices <NUM> to store both existing data records <NUM> and data record updates <NUM>. Thus, if an error occurs during an update sequence of a plurality of records, the data storage system <NUM> is not left in a corrupted state. The existing data records <NUM> enable reversion to a previous state of one or more data records based on detecting an error condition during a writing process of the data record updates <NUM>.

Referring now to <FIG> with continued reference to <FIG>, <FIG> is a flow chart illustrating a method <NUM> for using the engine gateway <NUM> of <FIG>, in accordance with an embodiment. The method <NUM> may be performed, for example, by the engine gateway <NUM> in conjunction with the engine control <NUM> of <FIG> and at least one of the offboard systems <NUM> of <FIG>.

At block <NUM>, the engine gateway <NUM> can establish communication with the engine control <NUM> on a first communication bus <NUM> using system credential authentication. At block <NUM>, the engine gateway <NUM> can establish communication between the engine control <NUM> and the data storage system <NUM> on a second communication bus <NUM>. The second communication bus <NUM> can provide electrical power from the engine control <NUM> to the data storage system <NUM>. The engine gateway <NUM> can be mounted on a fan case <NUM> of the gas turbine engine <NUM>, and the engine gateway <NUM> can be physically separated from the engine control <NUM>. The length of physical separation can impact the types of communication buses that work in a potentially high-noise environment. For example, an inter-integrated circuit (I<NUM>C) bus may not be a viable option due to the physical separation and potential induced noise on signals between the engine gateway <NUM> and the engine control <NUM>. Examples of bus variations can include Ethernet, CAN, and/or other standard or custom solutions.

At block <NUM>, the engine gateway <NUM> can establish wireless communication with one of the offboard systems <NUM> using system credential authentication. There can be multiple levels of credential authentication to verify that a user or system is authorized to establish communication and access. Authentication may include verifying a shared secret or other credential between the offboard system <NUM>, the engine gateway <NUM>, and/or the engine control <NUM>. Further, service credential authentication is used to verify a level of access granted to update specific portions of the memory system <NUM> of the engine control <NUM> and the data storage system <NUM>. Service credential authorization can ensure that only authorized services such as inspection/monitoring or loading/modifying are allowed. Thus, in a tiered authorization approach, a user credential authorization can be combined with a system credential authorization and a service credential authorization as a type of "combination lock" access constraint for enhanced security.

At block <NUM>, the engine gateway <NUM> can provide access from the offboard system <NUM> through the engine gateway <NUM>, from the engine gateway <NUM> through the engine control <NUM>, and from the engine control <NUM> to the data storage system <NUM> to enable one or more updates of the data storage system <NUM> by the offboard system based on service credential authentication. The controller <NUM> of the data storage system <NUM> can be configured to manage the one or more updates using a buffer <NUM> that enables reversion to a previous state of one or more data records based on detecting an error condition.

The processing circuitry <NUM> of the engine gateway <NUM> can be configured to communicate with the controller <NUM> in a maintenance mode based on determining that the engine control <NUM> is disconnected from the engine gateway <NUM>. The maintenance mode can be enabled based on one or more of: a discrete input, a keycode, and a connection between the first communication bus <NUM> and the second communication bus <NUM>.

In some embodiments, the engine gateway <NUM> can transmit an update completion confirmation of the engine control <NUM> and/or the data storage system <NUM> from the engine gateway <NUM> to the offboard system <NUM> based on a confirmation message from the engine control <NUM>. The confirmation message from the engine control <NUM> can be sent based on validation of at least one digital signature associated with the configuration items <NUM> prior to updating the engine control <NUM>. For instance, the configuration items <NUM> to be updated may be digitally signed at the offboard system <NUM> and the digitally-signed configuration items <NUM> can pass through the engine gateway <NUM> after authentication to the engine control <NUM> for validation. Processing circuitry <NUM> of the engine gateway <NUM> can be further configured to transmit a data state of the engine control <NUM> and a configuration of the engine control <NUM> to the offboard system <NUM> with the update completion confirmation. Confirmations may include a success or failure status to assist in troubleshooting unsuccessful upload attempts. The offboard system <NUM> can store results and state data, such as a load state and configuration, into the configuration management database <NUM> (e.g., as part of the configuration data <NUM> and/or log files <NUM> associated with an engine build identifier <NUM>).

While the present disclosure has been described with reference to an exemplary embodiment or embodiments, it will be understood by those skilled in the art that various changes may be made and equivalents may be substituted for elements thereof without departing from the scope of the present invention defined by the appended claims. In addition, many modifications may be made to adapt a particular situation or material to the teachings of the present disclosure without departing from the scope of the present invention defined by the appended claims.

Claim 1:
An engine gateway (<NUM>) for a gas turbine engine (<NUM>) of an aircraft (<NUM>), the engine gateway comprising:
a communication interface (<NUM>) configured to wirelessly communicate with an offboard system (<NUM>) through one or more antennas (<NUM>) and to communicate with an engine control (<NUM>) of the gas turbine engine using both a first communication bus (<NUM>) and a second communication bus (<NUM>);
a memory system (<NUM>);
a data storage system (<NUM>) isolated from the memory system; and
processing circuitry (<NUM>) configured to:
establish communication with the engine control on the first communication bus (<NUM>) using system credential authentication;
establish communication between the engine control and the data storage system on the second communication bus (<NUM>); and
establish wireless communication with the offboard system using system credential authentication;
wherein one or more updates of the data storage system (<NUM>) are wirelessly transmitted upon service credential authorization from the offboard system (<NUM>) to the engine gateway (<NUM>), communicated from the engine gateway to the engine control (<NUM>) on the first communication bus (<NUM>), and communicated from the engine control (<NUM>) to the data storage system (<NUM>) on the second communication bus (<NUM>), and wherein service credential authentication is used to verify a level of access granted to update specific portions of the memory system (<NUM>) of the engine control (<NUM>) and the data storage system (<NUM>); and
wherein configuration data stored in the data storage system (<NUM>) is available to the replacement version of the engine control (<NUM>).