Electronic computers and related electronic devices for realizing at least one key function

Abstract

The present invention relates to an electronic computer (11), which is configured to implement at least one key function and output associated output data items, and comprises: at least one control module (24), which is configured to implement the corresponding key function and transmit at least one associated output data item; at least one monitoring module (26) of the control module (24) of another electronic computer (11), which is configured to implement the corresponding key function that is the same as the corresponding key function implemented by the monitored control module (24), wherein each module (24, 26) is configured to receive the implementation result of the corresponding key function from the associated module (24, 26), and when an inconsistency is detected, prohibit the transmission of at least one associated output data item.

Description

Technical Field

[0001] The present invention relates to an electronic computer configured to implement at least one key function.

[0002] The invention also relates to an electronic device comprising a plurality of such electronic computers.

[0003] The invention also relates to a method for implementing at least one key function, wherein the method is implemented by such an electronic computer.

[0004] The invention also relates to a computer-readable medium comprising a computer program comprising software instructions for implementing such a method when executed by a computer.

[0005] The invention relates to the safety of an installation or device comprising at least one electronic system, wherein the device is preferably a vehicle, for example an air vehicle, in particular an aircraft, a railway vehicle or a motor vehicle. Alternatively, the installation may be a chemical plant or a power plant.

[0006] In particular, the invention relates to the implementation of critical functions, ie functions that are essential for the safety of an installation or facility. Examples of such critical functions are vehicle control commands, such as aircraft flight control, vehicle braking systems, emergency shutdown of a chemical plant or power plant. Background Art

[0007] "Electronic computer" refers to a computing entity including its own resources. An electronic computer may be provided in a separate housing or on a module mounted in a rack or on an electronic card provided in a housing together with other components.

[0008] "Critical functions" are functions whose implementation must be monitored to ensure the safe operation of a device or system. Such critical functions usually also require redundancy in the critical function implementation chain and the critical function monitoring chain to ensure the detection of defects or errors and the availability of the function.

[0009] "Implementation of a key function" means performing one or more calculations to generate at least one output data item associated with the key function from at least one input data item. Then, those skilled in the art will understand that the nature and number of output data items and the calculations performed characterize the key function.

[0010] In the field of avionics, key functions are defined, for example, by the ARP-4754A (Aerospace Recommended Practice) standard.

[0011] An electronic system is known that comprises a control computer called "COM" (from the word Command) composed of an electronic computer intended to provide at least one command and a monitoring computer called "MON" (from the word Monitor) composed of an electronic computer for monitoring the commands to detect any inconsistencies and thus ensure the integrity of the commands. In the event of an inconsistency detected during monitoring, the two electronic computers are taken out of service without finding the source of the defect, in order to ensure the integrity of the system. This system is called a COM / MON pair.

[0012] A system comprising at least one COM / MON pair has the capability to detect at least one anomaly on one of the electronic computers. The system is then called a FAIL SAFE system.

[0013] In order to obtain a system that can continue to operate with a sufficient level of integrity (at least FAIL SAFE) after detecting an anomaly on one of the electronic computers, it is necessary to have at least two parallel COM / MON pairs. This system is then called a FAIL OPERATIONAL system.

[0014] Such systems therefore require a large number of computers to ensure a satisfactory level of integrity, but this involves a large amount of floor space and mass. Summary of the invention

[0015] The object of the present invention is to provide an electronic computer which offers improved operational availability while requiring reduced floor space and mass.

[0016] To this end, the object of the present invention is an electronic computer configured to implement at least one key function, wherein the electronic computer is capable of transmitting at least one output data item associated with each key function, wherein the electronic computer comprises:

[0017] at least one control module, wherein each control module is configured to implement a corresponding key function and transmit at least one output data item associated with the key function;

[0018] at least one monitoring module of a control module of another electronic computer, wherein each monitoring module is configured to implement a corresponding key function that is the same as a corresponding key function implemented by the monitored control module;

[0019] Each control module is configured to receive a result of implementing a corresponding key function from an associated monitoring module of another electronic computer, and to prohibit transmission of the at least one associated output data item upon detecting that the result of implementing the corresponding key function thereof is inconsistent with the result received from the monitoring module of another electronic computer;

[0020] Each monitoring module is configured to receive a result of implementing a corresponding key function from an associated control module of another electronic computer, and to prohibit the control module from transmitting the at least one associated output data item if it detects that the result of implementing the corresponding key function is inconsistent with the result received from the control module of another electronic computer.

[0021] According to other advantageous aspects of the invention, the electronic computer comprises one or more of the following features, taken alone or in any technically feasible combination:

[0022] Each of the at least one control module and the at least one monitoring module is installed in a corresponding partition;

[0023] The electronic computer includes its own power supply and its own computer unit;

[0024] The key functions are avionics functions;

[0025] The electronic computer complies with the ARINC 653 standard; and

[0026] The electronic computer complies with DO297 standard.

[0027] The present invention also relates to an electronic device comprising N electronic computers, wherein N is an integer greater than or equal to 2, and wherein each electronic computer is defined as above.

[0028] According to other advantageous aspects of the invention, the electronic device comprises one or more of the following features taken alone or in any technically feasible combination:

[0029] For each electronic computer, the set of electronic computers comprises a control module monitored by a monitoring module of the electronic computer, and all electronic computers comprising a monitoring module monitoring the control module of the electronic computer are independent;

[0030] The number N of electronic computers is an even number, and for a given key function, (N / 2) electronic computers include (N / 2-1) control modules and (N / 2) monitoring modules, wherein (N / 2) other electronic computers include (N / 2-1) monitoring modules;

[0031] The number N of electronic computers is an odd number, and for a given key function, each electronic computer includes ((N-1) / 2) control modules and ((N-1) / 2) monitoring modules;

[0032] Each electronic computer contains at most (N-1) modules for each key function;

[0033] At least three control modules are associated with the same key function.

[0034] The present invention also relates to a method for implementing at least one key function, wherein the method is implemented by an electronic computer and comprises the following steps:

[0035] performing a first implementation of at least one critical function and transmitting at least one output data item associated with the critical function;

[0036] performing a second implementation of at least one key function that is the same as a key function implemented by another electronic computer;

[0037] first receiving from another electronic computer a result of the implementation of a critical function corresponding to the first implementation, and prohibiting transmission of the at least one associated output data item when it is detected that the result of the first implementation of the critical function corresponding to the first implementation is inconsistent with the result received from the other electronic computer;

[0038] A second reception is performed from another electronic computer of a result of the implementation of the key function corresponding to the second implementation, and when it is detected that the result of the second implementation of the corresponding key function is inconsistent with the result received from the other electronic computer, transmission of at least one associated output data item by the other electronic computer is prohibited.

[0039] The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] These features and advantages of the present invention will become more apparent on reading the following description, given by way of non-limiting example only and with reference to the accompanying drawings, in which:

[0041] Figure 1 A schematic diagram of an electronic computer according to the present invention is shown;

[0042] Figure 2 A schematic diagram of an electronic device according to a first embodiment of the present invention is shown, which implements key functions and includes Figure 1 two electronic computers;

[0043] Figure 3A schematic diagram of an electronic device according to a second embodiment of the present invention is shown, which implements key functions and includes Figure 1 Three electronic computers;

[0044] Figure 4 A schematic diagram of an electronic device according to a third embodiment of the present invention is shown, which implements key functions and includes Figure 1 Four electronic computers;

[0045] Figure 5 A schematic diagram of an electronic device according to a fourth embodiment of the present invention is shown, which implements two key functions and includes Figure 1 Three electronic computers;

[0046] Figure 6 A flow chart of a method for implementing key functions according to the present invention is shown. DETAILED DESCRIPTION

[0047] Figures 2 to 5 Various embodiments of an electronic device 10 according to the present invention are shown, which is configured to implement at least one key function and includes a plurality of electronic computers 11 .

[0048] exist Figure 1 Each electronic computer 11 visible in the figure is capable of receiving at least one input data item, implementing at least one key function according to the at least one input data item, and outputting at least one output data item associated with each key function.

[0049] The electronic computer 11 is, for example, an avionics computer. The electronic computer 11 is then carried on an air vehicle, in particular an aircraft. Then, the key functions implemented by the electronic computer 11 are avionics key functions, such as flight control functions or braking functions of the aircraft. Then, the electronic computer 11 preferably complies with the DO297 standard (Integrated Modular Avionics Device Development Guidelines and Certification Considerations).

[0050] exist Figure 1 In the embodiment, the electronic computer 11 includes: a memory 12, which is capable of storing at least one software application associated with each key function; a computer unit 14, which is capable of executing each software application to implement each key function, wherein the computer unit 14 includes resources 16 and hosts a task manager 18; a power supply 20; and at least one output port 22, which is configured to output at least one output data item associated with each key function.

[0051] The electronic computer 11 advantageously comprises its own computing unit 14 and its own power supply 20. The electronic computer 11 is, for example, in the form of an electronic module independent of the other electronic modules and configured to be installed in a rack (not shown), or in the form of an electronic card independent of the other electronic cards and configured to be installed in an electronic housing. Alternatively, the electronic computer 11 may have its own electronic housing and be the only computer located in a protective housing associated with the box.

[0052] According to the present invention, the electronic computer 11 further comprises at least one control module 24 and at least one monitoring module 26 of the control module 24 of another electronic computer 11 , wherein the control module 24 is configured to implement corresponding key functions.

[0053] The term "control module of another electronic computer" is understood to mean that the control module is installed on another electronic computer.

[0054] The electronic computer 11 preferably complies with the ARINC 653 standard and / or the DO297 standard, allowing temporal and spatial division of resources 16 while ensuring independence of software applications with respect to the control unit 14. Partitioning allows several different critical functions to coexist on the same electronic computer 11.

[0055] Therefore, the electronic computer 11 includes several independent computer partitions 27, and each of the at least one control module 24 and the at least one monitoring module 26 is installed in a corresponding partition 27. In particular, the electronic computer 11 includes a different partition 27 for each key function implemented.

[0056] exist Figure 1 In the example of FIG. 1 , a single control module 24 and a single monitoring module 26 are shown. However, those skilled in the art will appreciate that in certain embodiments of the present invention, the electronic computer 11 includes a plurality of control modules 24 and / or a plurality of monitoring modules 26, which will be described later.

[0057] exist Figure 2 In the example of FIG. 1 , the monitoring module 26 of the first electronic computer 11 is configured to monitor the control module 24 of the second electronic computer 11, and the monitoring module 26 of the second electronic computer 11 is configured to monitor the control module 24 of the first electronic computer 11. The term "first electronic computer" is understood to be represented at the top of the figure, and the "second electronic computer" is understood to be represented below the "first electronic computer" in the figure.

[0058] Each software application is intended to be executed by the computer unit 14 in order to implement an associated key function and to provide at least one output data item associated with the key function. Each software application is then configured to use the resources 16 of the computer unit 14.

[0059] Resources 16 of computer unit 14 are physical or logical elements that are available to software applications.

[0060] The resources 16 are, for example, processing type resources, input and output resources, resources dedicated to avionics networks (for example, communication routers of an ARINC 664 network), graphic type resources, mass storage type resources or logic outputs.

[0061] The task manager 18 is preferably a real-time monitor for sequencing different application programs, ensuring proper isolation by implementing computer partitions 27 to meet security objectives.

[0062] Alternatively, the task manager 18 may be an operating system. Each software application is then configured to issue one or more calls to the operating system 18 hosted by the computer unit 14. The operating system 18 may be, for example, an operating system compliant with the ARINC 653 standard or a POSIX operating system or a hypervisor or middleware. Those skilled in the art will appreciate that the operating system 18 is broadly defined and, more generally, is a collection of at least one basic software configured to provide different types of services to each application. Thus, a service is a function of basic software that can be used by a software application and can be reached by a call (also referred to as a call to a service (of the OS)) or a system call. An example of basic software is an ARINC 653 or POSIX OS that provides such services.

[0063] The power supply 20 is capable of receiving electrical power and providing current to the electronic computer 11 and its various components.

[0064] The control module 24 is configured to receive at least one input data item, implement a corresponding key function from the at least one input data item, and is capable of transmitting at least one output data item corresponding to the key function.

[0065] In particular, the control module 24 is configured to communicate with the computer unit 14. The control module 24 is capable of sending an execution command to the computer unit 14 so that the computer unit 14 executes a software application associated with a key function associated with the control module 24. The control module 24 is configured to receive at least one output data item associated with the key function. The control module 24 is capable of transmitting the at least one output data item via the output port 22.

[0066] The control module 24 is monitored by a monitoring module 26 of another electronic computer 11 and is then configured to send the achievement results of the key functions to the associated monitoring module 26 .

[0067] The control module 24 is configured to, in the event of a detection of an inconsistency between the result of its implementation of the respective key function and the result received from the module, prohibit the transmission of at least one associated output data item. Another inconsistency is detected by comparison between the two results and, for example, by detecting a difference greater than a predetermined threshold. Figures 2 to 5 The control module 24 inhibits the output data item as shown by the solid arrow pointing to the switch 28. In fact, each electronic computer 11 may encounter a material failure due to at least one failure of a hardware component of the electronic computer 11 and / or a software anomaly due to an error in the software application, and the corresponding critical function must be inhibited. In the absence of hardware and software anomalies, the electronic computer 11 is able to satisfactorily implement at least one critical function and is in a so-called functional state.

[0068] The monitoring module 26 is configured to receive at least one input data item and implement the same key function as the key function implemented by the monitoring control module 24. The monitoring module 26 is configured to send the implementation result of the key function to the associated control module 24.

[0069] The control module 24 is further configured to receive the implementation results of the corresponding key functions from the associated monitoring module 26 .

[0070] If the electronic computer 11 including the control module 24 and the other electronic computer 11 including the monitoring module 26 are both in a functional state, each module 24, 26 can satisfactorily implement the associated key functions, and the control module 24 does not detect inconsistencies between the implementation results of the key functions.

[0071] In the case of a hardware failure of the electronic computer 11, the modules 24, 26 included in the electronic computer 11 cannot realize the key functions in a satisfactory manner, and the electronic computer 11 is in a state called dysfunctional, which may be detected by the monitoring module 26 of another electronic computer 11 associated with the control module 24 of the electronic computer 11. If the electronic computer 11 including the control module 24 is in a functional state, and the other electronic computer 11 including the monitoring module 26 is in a dysfunctional state, the monitoring module 26 cannot realize the key functions in a satisfactory manner, and then the control module 24 is able to detect the inconsistency by comparing the realization results of the key functions.

[0072] In the case of a software failure, the electronic computer 11 cannot satisfactorily implement the critical functions associated with the faulty software application. However, the electronic computer 11 is able to implement any other critical functions associated with the non-faulty software application. Then, the electronic computer 11 is in a degraded state. If the electronic computer 11 including the control module 24 is in a functional state, and the other electronic computer 11 including the monitoring module 26 is in a degraded state, and if the corresponding critical functions of the modules 24, 26 are associated with the faulty software application, the monitoring module 26 cannot satisfactorily implement the critical functions, then the control module 24 can detect the inconsistency by comparing the implementation results of the critical functions.

[0073] The monitoring module 26 is configured to receive the implementation result of the corresponding key function from the associated control module 24. The monitoring module 26 is configured to prohibit the control module 24 of another electronic computer 11 from transmitting at least one associated output data item when detecting that the implementation result of the corresponding key function is inconsistent with the result received from the control module 24 of another electronic computer 11. Figures 2 to 5 The prohibition of the output data item by the monitoring module 26 is shown in FIG by a dashed arrow pointing to another switch 29. The inconsistency detected by the monitoring module 26 may be due to a hardware fault and / or a software error.

[0074] Therefore, output data items transmitted by the output ports 22 are configured to be inhibited by the corresponding control module 24 and / or the monitoring module 26 associated with the control module 24 .

[0075] The implementation of such a system is therefore simple since, unlike existing systems based on voting between several units, there is no need to localize the source of hardware failures or software errors.

[0076] Furthermore, the pair is made up of a control module 24 and a monitoring module 26 associated with the ability to detect at least one anomaly on one electronic computer 11 and is therefore FAIL SAFE.

[0077] exist Figure 2 In the embodiment, the electronic device 10 according to the first embodiment is configured to implement a given key function, including two electronic computers 11 and an output terminal 30 as described above, wherein the output terminal 30 is capable of providing at least one output data item associated with the key function outside the electronic device 10.

[0078] Each electronic computer 11 further comprises two independent computer partitions 27 , wherein each module 24 , 26 is installed on a corresponding computer partition 27 .

[0079] According to this first embodiment, the monitoring module 26 of the first electronic computer 11 is configured to monitor the control module 24 of the second electronic computer 11, while the monitoring module 26 of the second electronic computer 11 is configured to monitor the control module 24 of the first electronic computer 11. Each control module 24 is configured to communicate with the monitoring module 26 associated with the implementation result of the critical function in order to detect possible inconsistencies and prohibit the transmission of at least one associated output data item.

[0080] like Figure 2 As shown, the electronic device 10 according to the first embodiment is capable of detecting a hardware failure on one of the two electronic computers 11, prohibiting the transmission of output data transmitted by the faulty electronic computer 11, and transmitting output data items of the other electronic computer 11. In addition, the electronic device 10 is capable of detecting software errors on the modules 24, 26, and prohibiting the transmission of output data items associated with the module pair 24, 26 including the defective modules 24, 26. Then, the electronic device 10 is still capable of transmitting the output data, and in addition, is capable of detecting a hardware failure or an additional software error on the pair of operating modules 24, 26. Figure 2 As shown, the electronic device 10 according to the first embodiment is then FAIL OPERATIONAL for the software error.

[0081] Therefore, although the prior art COM / MON system requires two pairs of electronic computers, the electronic device 10 according to the first embodiment only includes two electronic computers 11 to implement key functions with the same security level. Then, the electronic device 10 according to the present invention can reduce the number of electronic computers 11, resulting in smaller size and mass.

[0082] exist Figure 3 , the electronic device 10 according to the second embodiment is configured to realize given key functions, and includes the three electronic computers 11 as described above.

[0083] Each electronic computer 11 further comprises two independent computer partitions 27 , wherein each module 24 , 26 is installed on a corresponding computer partition 27 .

[0084] The monitoring module 26 of the first electronic computer 11 is configured to monitor the control module 24 of the second electronic computer 11 , wherein the monitoring module 26 of the second electronic computer 11 is configured to monitor the control module 24 of the third electronic computer 11 , and the monitoring module 26 of the third electronic computer 11 is configured to monitor the control module 24 of the first electronic computer 11 .

[0085] Each control module 24 is configured to communicate the results of the implementation of the critical functions together with the associated monitoring module 26 in order to detect possible inconsistencies and to inhibit the transmission of at least one associated output data item.

[0086] Figure 3 The electronic device 10 according to the second embodiment shown can detect Figure 2 The electronic device 10 according to the first embodiment shown in the figure has more hardware failures or software errors. While the COM / MON system of the prior art requires two pairs of electronic computers to implement key functions and detect hardware failures or software errors, the electronic device 10 according to the second embodiment only includes three electronic computers 11 to implement key functions and detect hardware failures or two software errors. Therefore, the electronic device 10 according to the second embodiment can reduce the number of necessary computers while allowing detection of another software error.

[0087] exist Figure 4 In the embodiment, the electronic device 10 according to the third embodiment and configured to implement a given key function includes four electronic computers 11 as described above.

[0088] Each electronic computer 11 further comprises three independent computer partitions 27 , wherein each module 24 , 26 is installed on a corresponding computer partition 27 .

[0089] Each electronic computer 11 includes three modules 24 , 26 . In particular, the first two electronic computers 11 include two control modules 24 and a monitoring module 26 , while the last two electronic computers 11 include a control module 24 and two monitoring modules 26 .

[0090] like Figure 4 As shown, the monitoring module 26 of the first electronic computer 11 is configured to monitor the first control module 24 of the second electronic computer 11; the monitoring module 26 of the second electronic computer 11 is configured to monitor the control module 24 of the third electronic computer 11; and the first monitoring module 26 of the third electronic computer 11 is configured to monitor the first control module 24 of the first electronic computer 11.

[0091] The second monitoring module 26 of the third electronic computer 11 is configured to monitor the control module 24 of the fourth electronic computer 11; the first monitoring module 26 of the fourth electronic computer 11 is configured to monitor the second control module 24 of the first electronic computer 11; and the second monitoring module 26 of the fourth electronic computer 11 is configured to monitor the second control module 24 of the second electronic computer 11.

[0092] Figure 4 The electronic device 10 according to the third embodiment shown can detect Figure 3The electronic device 10 according to the second embodiment shown has more hardware failures or software errors.

[0093] exist Figure 5 In the fourth embodiment, the electronic device 10 is configured to realize two key functions, namely, a first key function and a second key function. It includes three electronic computers 11 as described above and two output terminals 30, wherein each output terminal 30 is capable of providing at least one output data item associated with one of the two key functions outside the electronic device 10.

[0094] Each electronic computer 11 includes two control modules 24 and two monitoring modules 26 .

[0095] exist Figure 5 In the example shown, each electronic computer 11 further includes four independent computer partitions 27 , wherein each module 24 , 26 is installed on a corresponding computer partition 27 .

[0096] The two control modules 24 of the first electronic computer 11 can realize the first key function. The two control modules 24 of the second electronic computer 11 can realize the second key function. Each control module 24 of the third electronic computer 11 can realize a different key function in the first and second key functions.

[0097] like Figure 5 As shown, the first monitoring module 26 of the first electronic computer 11 is configured to monitor the second control module 24 of the third electronic computer 11; the second monitoring module 26 of the first electronic computer 11 is configured to monitor the first control module 24 of the second electronic computer 11; and the first monitoring module 26 of the second electronic computer 11 is configured to monitor the second control module 24 of the first electronic computer 11.

[0098] The second monitoring module 26 of the second electronic computer 11 is configured to monitor the first control module 24 of the third electronic computer 11; the first monitoring module 26 of the third electronic computer 11 is configured to monitor the first control module 24 of the first electronic computer 11; and the second monitoring module 26 of the third electronic computer 11 is configured to monitor the second control module 24 of the second electronic computer 11.

[0099] In view of the various examples described above, those skilled in the art will appreciate that the present invention can be generalized to an electronic device 10 including N electronic computers 11 , where N is an integer greater than or equal to 2.

[0100] Preferably, when the number N of electronic computers 11 is an even number, and for a given key function, (N / 2) electronic computers 11 include (N / 2-1) control modules 24 and (N / 2) monitoring modules 26, the (N / 2) other electronic computers 11 each include (N / 2) control modules 24 and (N / 2-1) monitoring modules 26.

[0101] Preferably, when the number N of electronic computers 11 is an odd number, for a given key function, each electronic computer 11 includes ((N-1) / 2) control modules 24 and ((N-1) / 2) monitoring modules 26.

[0102] The electronic device 10 is then able to use a smaller number of electronic computers 11 to implement at least one critical function with the required safety and redundancy levels.

[0103] According to a preferred embodiment of the present invention, for each electronic computer 11, a group of electronic computers 11 including a control module 24 monitored by a monitoring module 26 of the electronic computer 11 and a group of electronic computers 11 including a monitoring module 26 that monitors the control module 24 of the electronic computer 11 are independent.

[0104] For example, in the electronic device 10 according to the third embodiment, as Figure 4 As shown, the control module 24 of the first electronic computer 11 is monitored by the monitoring modules 26 of the third and fourth electronic computers 11 , while the module 26 of the first electronic computer 11 monitors the control module 24 of the second electronic computer 11 .

[0105] This architecture of the electronic device 10 provides better redundancy and ensures better operational availability. In fact, each electronic computer 11 is therefore dependent on several other electronic computers 11 and is therefore less affected in the event of an anomaly of an electronic computer 11 .

[0106] According to a supplementary aspect of the present invention, each electronic computer 11 is physically different from the other electronic computer 11 and is made in a different form from a material point of view, for example, a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC) for another electronic computer 11. Therefore, if a general failure occurs on a certain type of structure, not all electronic computers 11 become defective at the same time, and the integrity of the electronic device 10 is maintained. Due to this material difference as an optional supplement, the implementation of key functions is safer.

[0107] Alternatively or in addition to the above-mentioned supplementary aspects, each of the modules 24, 26 associated with the critical functions is different from the other modules 24, 26 from the software point of view and is made in a different form from the software point of view, for example, by using different programming languages. Therefore, if a software error occurs in a certain type of software, all modules 24, 26 associated with the same critical function will not have defects at the same time. Due to this optional software difference, the implementation of the critical functions is safer.

[0108] According to another complementary aspect of the present invention, the role of each module 24, 26 of the electronic computer 11 is configured to be modified during the operation of the electronic computer 11. For example, the control module 24 can become the monitoring module 26, or the control module 24 that implements the first critical function can become the control module 24 that implements the second critical function different from the first critical function. In other words, each electronic computer 11 is dynamically reconfigurable. Therefore, in the event of a hardware failure or software error affecting one or more electronic computers 11, the electronic device 10 is configured to be dynamically reconfigured so as to implement the critical functions with the desired security level.

[0109] Now we will use Figure 6 Explain the operation of the electronic computer 11 according to the present invention, Figure 6 The flowchart of the method for realizing key functions according to the present invention is shown, wherein the method is realized by the electronic computer 11 in the electronic device 10 .

[0110] The above method is implemented in the form of one or more software programs, that is, in the form of a computer program, which can also be recorded on a medium (not shown) that can be read by a computer. A computer-readable medium is, for example, a medium suitable for storing electronic instructions and capable of being coupled to a bus of a computer system. For example, the readable medium can be a magnetic disk or a floppy disk, an optical disk, a CDROM, a magneto-optical disk, a ROM memory, a RAM memory, any type of non-volatile memory (e.g., EPROM, EEPROM, FLASH, NVRAM), a magnetic card or an optical card. The computer program including the software instructions is then stored on a readable medium.

[0111] To simplify the description, the method will be described with respect to an electronic device 10 according to a first embodiment, which includes two electronic computers 11 and implements given key functions, such as Figure 2 shown.

[0112] Those skilled in the art will appreciate that the method is applicable to any type of electronic device 10 according to the present invention, and in particular, to the second, third and fourth embodiments, similar to the first embodiment described below.

[0113] During step 100, a first implementation of a critical function is performed by each control module 24. The control module 24 then transmits output data items associated with the critical function to the associated monitoring module 26 and transmits the output data through the output port 22.

[0114] In step 110, a second implementation of the critical function is performed by each monitoring module 26. Next, the monitoring module 26 transmits output data associated with the critical function to the associated control module 24.

[0115] The terms "first implementation" and "second implementation" are used as simple terms, but do not imply any temporal relationship between the method steps. The first implementation can be performed before, at the same time, or after the second implementation.

[0116] In step 120, each control module 24 receives the results of the implementation of the critical function corresponding to the second implementation from the associated monitoring module 26. In the event that the results of the first implementation of the corresponding critical function are detected to be inconsistent with the results received from the associated monitoring module 26, then the transmission of the associated output data item represented by the switch 28 is prohibited.

[0117] In step 130, each monitoring module 26 receives the results of the implementation of the critical function corresponding to the first implementation from the associated control module 24. In the event of a detected inconsistency between the results of the second implementation of the corresponding critical function and the results received from the associated control module 24, the transmission of the associated output data item represented by the switch 29 is prohibited.

[0118] If no inconsistency is detected by the control module 24 and the monitoring module 26 , then in step 140 , only output data associated with the critical functions is transmitted by each control module 24 .

[0119] During optional step 150, each pair of modules 24, 26 sends to the other pair of modules 24, 26 information indicating whether the electronic computer 11 on which the modules 24, 26 are installed is in a functional, degraded or dysfunctional state. In addition, each pair of modules 24, 26 sends to the other pair of modules 24, 26 information indicating whether the transmission of the associated output data item is prohibited.

[0120] Those skilled in the art will appreciate that step 150 is a step that is advantageously implemented in the event of a software failure, but is not essential in order to obtain an electronic computer that provides better operational availability while providing an overall reduced size and mass.

[0121] As an optional supplement, in the module pairs 24, 26 installed on the electronic computer 11 in a functional or degraded state but without defects in their associated software applications and on the electronic computer 11 which is not inhibited from transmitting output data, an index can be assigned to each pair of modules 24, 26.

[0122] The output data items outputted only from the pair of modules 24, 26 having the lower index are provided as final output data items outside the electronic device 10 through the output terminal 30. The pair of modules 24, 26 having the lowest index is said to be joined.

[0123] The index of each pair of modules 24, 26 is changed regularly to avoid undetected or so-called dormant faults, and then a token is formed.

[0124] Therefore, unlike some methods of the prior art, the method according to the invention does not implement a voting algorithm between different pairs of modules 24 , 26 .

Claims

1. An electronic computer (11), the electronic computer being configured to implement at least one key function, wherein: The electronic computer (11) is capable of transmitting at least one output data item associated with each key function, and wherein the electronic computer (11) comprises: at least one control module (24), wherein each control module (24) is configured to implement a corresponding key function and is capable of transmitting at least one output data item associated with the key function; at least one monitoring module (26), wherein each monitoring module (26) is configured to monitor a control module (24) of another electronic computer (11), and each monitoring module (26) is configured to implement a corresponding key function that is the same as a corresponding key function implemented by the monitored control module (24); wherein each control module (24) is configured to receive a result of implementing a corresponding key function from an associated monitoring module (26) of the other electronic computer (11), and prohibit transmission of the at least one associated output data item when detecting that the result of implementing the corresponding key function by each control module (24) is inconsistent with the result received from the monitoring module (26) of the other electronic computer (11), Each monitoring module (26) is configured to receive a result of implementing a corresponding key function from an associated control module (24) of the other electronic computer (11), and to prohibit the control module (24) from transmitting the at least one associated output data item when it is detected that the result of implementing the corresponding key function by each monitoring module (26) is inconsistent with the result received from the control module (24) of the other electronic computer (11).

2. The electronic computer (11) according to claim 1, wherein: The electronic computer (11) includes a plurality of independent computer partitions (27), and each of the at least one control module (24) and the at least one monitoring module (26) is installed in a corresponding partition (27).

3. The electronic computer (11) according to claim 1 or 2, wherein: The electronic computer (11) comprises its own power supply (20) and its own computer unit (14).

4. The electronic computer (11) according to claim 1 or 2, wherein: The critical functions are avionics functions.

5. An electronic device (10), comprising N electronic computers (11), wherein: N is an integer greater than or equal to 2, and each electronic computer (11) is an electronic computer according to claim 1 or 2.

6. The electronic device (10) according to claim 5, wherein: For each electronic computer (11), a group of electronic computers (11) including a control module (24) monitored by a monitoring module (26) of the electronic computer (11) is independent of all electronic computers (11) including a monitoring module (26) monitoring the control module (24) of the electronic computer (11).

7. The electronic device (10) according to claim 5 or 6, wherein: The number N of electronic computers (11) is an even number, and for a given key function, (N / 2) electronic computers (11) include (N / 2-1) control modules (24) and (N / 2) monitoring modules (26), while (N / 2) other electronic computers (11) include (N / 2) control modules (24) and (N / 2-1) monitoring modules (26).

8. The electronic device (10) according to claim 5 or 6, wherein: The number N of electronic computers (11) is an odd number, and for a given key function, each electronic computer (11) includes ((N-1) / 2) control modules (24) and ((N-1) / 2) monitoring modules (26).

9. A method for implementing at least one key function, wherein: The method is implemented by an electronic computer (11), the electronic computer (11) comprising at least one control module (24) and at least one monitoring module (26), and the method comprises the following steps: Each control module (24) performs a first implementation (100) of at least one key function and transmits at least one output data item associated with the key function; Each monitoring module (26) performs a second implementation (110) of at least one key function that is the same as a key function implemented by another electronic computer; Each control module (24) first receives (120) from the other electronic computer (11) a result of implementation of a key function corresponding to the first implementation, and prohibits transmission of the at least one associated output data item when detecting that the result of the first implementation of the corresponding key function is inconsistent with the result received from the other electronic computer (11); Each monitoring module (26) receives (130) a second implementation result of a key function corresponding to the second implementation from the other electronic computer (11), and prohibits the other electronic computer (11) from transmitting at least one associated output data item when detecting that the result of the second implementation of the corresponding key function is inconsistent with the result received from the other electronic computer (11).

10. A computer readable medium comprising a computer program, the computer program comprising software instructions which, when executed by a computer, implement the method according to claim 9.

Images