Triple register with a safety device

Description

[0001] The invention lies in the field of protection and security of electronic registers on board aircraft intended to operate at air navigation altitudes.

[0002] At high altitudes, electronic components are exposed to high-energy particles. These particles are typically neutrons. These particles can affect the operation of electronic circuits. For example, these particles can change the state of a flip-flop or register.

[0003] In the aeronautical field, the proper functioning of electronic equipment is essential to ensure the safety of the aircraft, its crew, and its passengers. However, the evolution of electronic technologies, which tends towards greater miniaturization of electronic components, makes them increasingly sensitive to this type of disturbance.

[0004] To overcome this significant drawback, technical solutions have been implemented to protect the most critical components. For example, the most critical registers of programmable logic circuits, known by the acronym "PLD", meaning "Programmable Logic Device", are protected by mechanisms that make them robust to alterations by these particles.

[0005] Conventionally, it is considered that a single particle can only alter a single flip-flop of a PLD, unlike “RAM” type memories where a single particle can possibly alter several bits.

[0006] Based on this assumption, a very common method for protecting a register is triplication. It is described in the figures 1 et 2 . There figure 1 represents the principle of majority voting, the figure 2 represents the complete operation of the registers.

[0007] Its principle is as follows. The same information is stored in three different registers which are noted REG. 1, REG. 2 and REG. 3 on the figures 1 et 2 These registers are only accessible for writing.

[0008] A "majority vote" type equation makes it possible to reconstruct the correct information if one and only one of the three registers is altered, which is the most likely case. The probability of two registers being altered simultaneously is very low, even with regard to aeronautical standards. Thus, if the first two registers have the same value and the third register a different value, the majority vote automatically retains the common value of the first two registers.

[0009] A self-correction loop periodically and automatically updates the three registers with the result of the majority vote in order to avoid the accumulation of alterations over time. The rate of this loop is imposed by a clock not shown in the figures. If a flip-flop is altered at a given time, the result of the majority vote remains unchanged and therefore correct and at the next clock edge, the altered flip-flop is corrected. This loop corresponds to the arrow BAC on the figures 1 et 2 .

[0010] Triplication works bit by bit. If, for example, the register has 16 bits, the device has 16 independent triplication mechanisms as described by the figures 1 et 2 .

[0011] Registers REG. 1, REG. 2, and REG. 3 contain one or more bits. All bits are treated individually, independently, and in the same way.

[0012] The major advantage of triplication is that this principle guarantees that there is never any erroneous data output from the register, even transiently.

[0013] The self-correction mechanism coexists with the path that allows writing the functional value VF of the register as seen in the figure 2 An internal signal allows you to choose between this functional writing and self-correction.

[0014] Typically, functional writing is a sporadic event, and the rest of the time it is self-correction that writes to the registers.

[0015] When a functional write occurs, the functional data is written simultaneously to all three registers. The rest of the time, the majority vote output is written continuously, at each clock edge, to all three registers simultaneously by self-correction feedback.

[0016] US 2004 / 124876 A1 discloses a known triplication register.

[0017] On the figure 2 , the multiplexers are always all three in the same state, that is, all three are configured to perform functional writing or to take into account self-correction.

[0018] This type of device can be implemented in an "FPGA" type component, meaning "Field-Programmable Gate Array" or "Programmable Gate Array". The design of this system, for the sake of simplicity of implementation in an FPGA for example, is based on the fact that the registers REG 1, REG 2 and REG 3 are only accessible in writing. Only the corrected value, after the majority vote, is accessible in reading. Reading access to each register would drastically increase their complexity.

[0019] Therefore, this system is already secure. The object of the invention is to further strengthen security by providing this system with testing capabilities capable of checking the correct operation of writing to the registers, the majority voting system as well as self-correction without needing to read each register.

[0020] An object of the invention is therefore a so-called triplication register device comprising a first register, a second register and a third register, the three registers being identical and comprising the same information in current use, a majority voting device and a self-correction device, the correction being a function of the result of the majority voting device, each register being controlled by the output of a two-input multiplexer, the first input corresponding to a functional write, the second input corresponding to the result of the majority vote, characterized in that the triplication device comprises a test device whose function is to inhibit on command and independently either the functional write in the first register, or the functional write in the second register, or the functional write in the third register, or the self-correction.

[0021] Advantageously, the test device comprises a control register comprising at least four control bits, the first bit controlling the inhibition of functional writing in the first register, the second bit controlling the inhibition of functional writing in the second register, the third bit controlling the inhibition of functional writing in the third register and the fourth bit controlling the inhibition of self-correction.

[0022] Advantageously, each control bit of the control register inhibits all the bits of the register associated with said control bit.

[0023] Advantageously, a first test configuration consists of inhibiting only the self-correction in order to verify that the three registers operate nominally.

[0024] Advantageously, a second test configuration consists of inhibiting only writing to the first register and the second register or writing to the first register and the third register or writing to the second register and the third register so as to verify that the majority voting device is operating nominally.

[0025] Advantageously, a test comprises a succession of first, second or third configurations taken in this order or in a different order.

[0026] Advantageously, the control register comprises sixteen bits and the test device comprises a set of four secondary majority voting devices: the first twelve bits being organized into three groups of four identical control bits, each secondary majority voting device being driven by three control bits belonging respectively to the first group, the second group and the third group, each bit inhibiting the same function, either functional writing or self-correction, the result of the majority vote inhibiting said function, the last four bits being used to reread the four results of the four secondary majority voting devices.

[0027] The invention also relates to an electronic system on board an aircraft subjected to high-altitude flight conditions comprising at least one so-called triplication register device as described above.

[0028] Other characteristics, details and advantages of the invention will emerge from reading the description given with reference to the appended drawings given by way of example and which represent, respectively: Figure 1 an illustration of the principle of a majority vote triplication register according to the prior art; Figure 2 an illustration of the principle of a prior art majority vote triplication register comprising multiplexing with functional writing of the registers; Figure 3 an illustration of the principle of a majority vote triplication register according to the invention; Figure 4 an illustration of the functional mode configuration of the triplication register according to the invention; Figure 5 an illustration of a first test configuration of the triplication register according to the invention; Figure 6 an illustration of a second test configuration of the triplication register according to the invention; Figure 7 an illustration of a third test configuration of the triplication register according to the invention; Figure 8 an illustration of a control register of the test device according to the invention comprising a set of four secondary majority voting devices.

[0029] The objective of the invention, in relation to the current operation of a triplication register, is to be able to verify the correct operation of all the elements of the majority vote triplication mechanism so as to detect that no latent failure renders the triplication inoperative. The faults detected by the test device according to the invention are as follows: one of the three registers is stuck at a constant value or is unable to perform a functional write when one occurs; self-correction does not work; the majority vote is wrong for one or more combinations of the values ​​of the three registers.

[0030] In aeronautics, electronic equipment must meet strict safety and reliability requirements. These requirements are governed by a standard called RTCA DO-254 / Eurocae ED-80 entitled "Design Assurance Guidance for Airborne Electronic Hardware". This standard defines five levels of criticality, known as "DAL" levels, an acronym for "Design Assurance Level". The most severe is level A, which defines the defects in a system likely to cause a catastrophic problem: flight safety or compromised landing or aircraft crash. The device according to the invention is compatible with level "DAL A".

[0031] The principle of the invention is based on two distinct elements: The possibility of individually inhibiting the writings in each register during functional writing in order to be able to voluntarily inject a different value into each register and to verify the operation of the majority vote and the self-correction mechanism. This inhibition process is represented on the figure 3 which represents a majority vote triplication register comprising three registers REG. 1, REG. 2 and REG. 3. It is represented by three double arrows IN 1, IN 2 and IN 3, each arrow inhibiting one of the three registers. This representation is purely symbolic.

[0032] The possibility of inhibiting self-correction, which leaves the possibility of observing the result of the majority vote with different values ​​in the three registers.

[0033] A simple way to implement the test device is to implement a dedicated control or test register whose function is to position the internal signals that will activate the triplication test modes. Conventionally, this test control register can be controlled by the system software that controls the triplicate register. But it can also be controlled by a hardware PLC responsible for performing the integrated test of the equipment, known by the acronym "BITE" meaning "Built-In Test Equipment".

[0034] In its basic version, the test register contains 4 control bits: three bits marked EN_1, EN_2, EN_3 and one bit marked EN_AUTOCORRECT, whose effects are as follows: If the EN_1 bit is set to 1, then the functional write writes to the REG 1 register. This is equivalent to maintaining the normal operation of the register. If the EN_1 bit is set to 0, then the functional write does not write to REG 1, i.e., the register remains unchanged. The register is in test mode. The EN_2 and EN_3 bits have the same operation with respect to the two registers REG 2 and REG 3 respectively. If the EN_AUTOCORRECT bit is set to 1, then autocorrection takes place normally on the three registers. If the EN_AUTOCORRECT bit is set to 0, then autocorrection is inhibited on the three registers, i.e., only the functional write can modify the three registers.

[0035] It should be noted that the choice of “1” or “0” to inhibit or not the functions is purely arbitrary.

[0036] The four bits and their actions are completely independent. Each bit in the control register acts collectively on all the bits in registers REG 1, REG 2, and REG 3. For example, if REG 1, REG 2, and REG 3 are 16-bit registers, there is only one bit EN_1 in the control register, and it acts collectively and equally on all 16 bits of REG 1.

[0037] To fully understand the action of the control register, the figures 4 , 5 , 6 And 7 represent different configurations in functional mode and in test mode of the triplicate register with, in a cartridge, the indication of the value of the four bits of the control register.

[0038] In the normal operating configuration shown in figure 4 , all four bits of the test register are set to 1. Functional writing normally occurs in all three registers, and outside of functional writing, self-correction continuously writes to all three registers.

[0039] In the first test configuration shown in figure 5 , the EN_AUTOCORRECT bit is set to 0, the other three bits are set to 1. Functional writing takes place normally in the three registers, but outside of functional writing, the registers remain unchanged because self-correction is inhibited. This case allows us to verify that the result of the vote is consistent with the functional writing chain.

[0040] In the second test configuration shown in figure 6 , bit EN_1 is at 1, the other three bits are at 0. Functional writing takes place normally but only in register REG 1, and outside of functional writing, register REG 1 remains unchanged. Registers REG 2 and REG 3 are no longer addressed and always remain unchanged. This case makes it possible to verify the correct operation of the majority vote by modifying the value of a single register.

[0041] By alternating the values ​​of the bits of EN_1, EN_2 and EN_3, we write each register individually and test the majority vote with all its input combinations. At the same time, we check that the writing to each of the registers is happening correctly, that is, that none of the three registers is stuck at a constant value.

[0042] In the third test configuration shown in figure 7 , all four bits of the test register are set to 1. Functional writing is normally possible but is not used. The three registers are written continuously by self-correction. This case allows us to verify the correct operation of self-correction when it is applied after writing different values ​​to the three registers.

[0043] It is, of course, possible to combine the previous configurations. As a first example, if after using three second configurations to place different values ​​in the three registers, we position the third configuration, then the three registers become identical, taking into account the majority vote which necessarily leads to identical values.

[0044] A second, more complex example of combinations allows for more sophisticated testing. For clarity, this example is broken down into two successive steps.

[0045] In a first step, by using the first configuration three times to write the combination "0, 0, 1" in the registers REG 1, REG 2 and REG 3, the rereading of the majority vote gives 0. We then write 1 in REG 2, which gives the combination "0, 1, 1", the rereading of the majority vote then gives 1.

[0046] In a second step, using the first configuration three times to write the combination "0, 0, 1" in the registers REG 1, REG 2 and REG 3, the majority vote reread gives 0. We then use the second configuration. If the self-correction works correctly, we move on to the combination "0, 0, 0". We use the first configuration again. We write 1 in REG 2, which this time gives the combination "0, 1, 0", the majority vote reread gives 0 this time.

[0047] Thus, at the end of the second stage, the result of the majority vote is different from what it is at the end of the first stage. We thus verify that the self-correction worked in the REG 3 register for the transition from 1 to 0.

[0048] By repeating the second step with different possible combinations, we verify that the self-correction works for the three registers with the two transitions 1 to 0 and 0 to 1.

[0049] As we have just seen, the inhibition test device according to the invention makes it possible to simply verify that all the write, majority vote and self-correction operations are functioning correctly. However, it is possible to further increase the security of the triplication register by securing the control and test register.

[0050] For this purpose, triplication is also used, but this time applied to the control register itself. This secure control register is represented in figure 8 It has 16 bits numbered from 0 to 15 and distributed as follows.

[0051] The four control bits EN_1, EN_2, EN_3, and EN_AUTOCORRECT are triplicated, making a total of 12 bits. They correspond to the bits numbered 0 to 11 on the figure 8 . The three instances of the four bits are written individually to the control register. Unlike the tested registers REG 1, REG 2 and REG 3, for testing purposes, this control register is accessible for reading and writing by the system software that controls the triplicate register or by dedicated software. On the figure 8 , reading-writing of bits is symbolized by a double arrow and simple reading of bits by a one-way arrow.

[0052] The test device comprises a set of four secondary majority voting devices denoted VM1, VM2, VM3 and VM4 on the figure 8 Each secondary majority voting device is driven by three replicated control bits, i.e. supposed to contain the same control information.

[0053] The results of the four majority votes control the triplication register and are also stored in the control register. Four additional bits are therefore required. These are the bits numbered 12 to 15 on the figure 8 These bits are read-only. In total, 16 bits are therefore required to achieve control register triplication.

[0054] In principle, a single control register can be associated with several triplicate functional registers, without limitation of the number of registers to be controlled.

[0055] The triplicate control register does not have self-correction, which makes it much easier to test. The lack of self-correction of the self-correcting register has no significant effect for the two reasons detailed below.

[0056] The first reason is that it is necessary to have two well-placed accidentals for a control to be altered, which is an exceptionally rare event.

[0057] The second reason is that altering a control bit has no immediate impact; the functional register must then also be altered after the control register for there to be a functional impact. Again, these can only be very exceptional events.

[0058] If the self-correction control bit is altered, then it is necessary that two well-placed bits in the functional register be altered after the control register is altered. This could be, for example, two of the three triplication registers associated with the same functional bit.

[0059] If a functional control bit of type "EN" is altered, the functional write is degraded because one of the three bits is potentially written as a false bit, but the majority vote nevertheless gives the correct value, and it is necessary that a bit of the functional register is also altered for there to be an impact. This situation only has an impact if the events occur in the following order: double alteration of the control then functional write with a value different from the previous value on the bit concerned, then double alteration on the triplicate registers of this bit. This situation is highly unlikely.

[0060] Therefore, the absence of self-correction on the control register does not entail any significant risk.

[0061] A first example of event chains that would likely cause significant registry corruption is described below: First event: Bit EN0_0 is corrupted. Due to majority voting, there is no impact.

[0062] Second event: one of the two bits EN0_1 or EN0_2 is also corrupted. Register REG 1 will not be updated during the next write. But the current value of REG 1 is not modified so there is no functional impact. Then, during the next functional write, register REG 1 is not written and it is therefore potentially different from Reg 2 and Reg 3. But thanks to the majority vote, there is still no functional impact. On the next clock cycle, self-correction will update register REG 1 with the correct value. The correct written value appears in REG 1 with just a one-clock period delay.

[0063] Third event: One of the registers REG 2 or REG 3 is altered exactly during the clock period following the functional write. This results in a functional impact.

[0064] It is understood that the cascade of the three events is highly improbable and can be neglected. The absence of self-correction on the EN bits therefore does not constitute a risk.

[0065] A second example of event chains that would likely cause significant registry corruption is described below: First event: The AUTOCORRECT_0 bit is corrupted. Due to majority voting, there is no impact.

[0066] Second event: One of the two bits AUTOCORRECT_1 or AUTOCORRECT_2 is corrupted. The autocorrection of registers REG 1, REG 2 and REG 3 is inhibited, but the current value of the registers is not modified. There is no functional impact.

[0067] Third event: One of the three registers REG1, REG2 or REG3 is altered. Thanks to the majority vote, there is still no functional impact.

[0068] Fourth event: Another of the three registers REG1, REG 2 or REG 3 is in turn altered. A functional impact appears.

[0069] We therefore see that even if two bits of the three bits AUTOCORRECT 0, AUTOCORRECT 1 or AUTOCORRECT 2 are altered, the probability that there is a functional consequence is extremely low and requires the appearance of four successive events, themselves having a low probability.

[0070] The lack of autocorrection on AUTOCORRECT bits therefore does not constitute a risk.

[0071] To test that the control bit triplication and majority voting are working correctly, simply write all combinations of the twelve control bits and each time read back the four majority vote bits. This procedure covers both the majority vote and the control bits themselves. This test can detect that one of the bits is frozen at 0 or 1 due to an electronics failure.

[0072] The so-called triplication register device according to the invention has a sufficient level of security for a DAL A certified avionics system. It has the following advantages.

[0073] The device allows 100% testing of the error or fault correction mechanism. The test coverage of the correction mechanism is completely exhaustive.

[0074] A single failure or tampering with the test device does not cause erroneous functional data. Such a single failure of the test device can be detected before a multiple failure occurs.

[0075] The test device has no impact on the operational performance of the register under test.

[0076] The test device associated with each functional register is very simple to implement, therefore does not degrade reliability and consumes few resources of the electronic component which carries it.

[0077] The control register according to the invention can be shared with as many functional registers as desired, which minimizes the number of control registers.

Claims

1. A triplication register device comprising a first register (REG. 1), a second register (REG. 2) and a third register (REG. 3), the three registers being identical and containing the same information in common use, a majority vote device and a self-correction device (BAC), the correction being dependent on the result from the majority vote device, each register being controlled by the output of a dual-input multiplexer (mux), the first input corresponding to a functional write operation, the second input corresponding to the result of the majority vote, the triplication device contains a test device and is characterised in that the function of the test device is to block, on command and independently, either the functional write operation to the first register, or the functional write operation to the second register, or the functional write operation to the third register, or the self-correction.

2. The triplication register device according to claim 1, characterised in that the test device contains a control register containing at least four control bits (EN_1, EN_2, EN_3, EN_A), the first bit controlling the blocking of the functional write operation to the first register, the second bit controlling the blocking of the functional write operation to the second register, the third bit controlling the blocking of the functional write operation to the third register and the fourth bit controlling the blocking of the self-correction.

3. The triplication register device according to claim 2, characterised in that each control bit of the control register blocks all of the bits of the register associated with said control bit.

4. The triplication register device according to claim 3, characterised in that a first test configuration consists in blocking only the self-correction so as to check that the three registers are operating in a nominal manner.

5. The triplication register device according to claim 3, characterised in that a second test configuration consists in blocking only the write operation to the first register and the second register or the write operation to the first register and the third register or the write operation to the second register and the third register so as to check that the majority vote device is operating in a nominal manner.

6. The triplication register device according to one of claims 2 to 5, characterised in that a test contains a sequence of first, second or third configurations taken in this order or in a different order.

7. The triplication register device according to one of claims 2 to 6, characterised in that the control register contains sixteen bits and that the test device further contains a set of four secondary majority vote devices (VM1, VM2, VM3, VM4), the first twelve bits being organised into three groups of four identical control bits, each secondary majority vote device being driven by three control bits belonging respectively to the first group, to the second group and to the third group, each bit blocking the same function, either the functional write operation or the self-correction, the result of the majority vote blocking said function, the last four bits being used to reread the four results from the four secondary majority vote devices.

8. An electronic system on board an aircraft subject to high-altitude flight conditions, containing at least a triplication register device, characterised in that said triplication device is in accordance with one of the preceding claims.