Method and device for controlling at least one on-board device located in an aircraft

Abstract

The present invention relates to a device (APP) for controlling at least one on-board device (ACT) located in an aircraft (AC) on the basis of flight data (NAV_DATA) delivered by at least one source device (NAV), said control device (APP) comprising a multi-core processor (PROC) comprising: a first core (COR1); a second core (COR2); and an inter-core communication interface (ICC), the second core (COR2) being isolated from said at least one on-board device (ACT) and from said at least one source device (NAV), and the first core (COR1) being configured to: deliver (S130), via said interface (ICC), input data (IN_CLT) obtained from the flight data (NAV_DATA); obtain (S150), via said interface (ICC), output data (OUT_CLT); and deliver (S160) control data (ACT_CMD) obtained from the output data (OUT_CLT).

Description

Description Title: Method and device for controlling at least one device on board an aircraft Technical field

[0001] The present invention relates to the fields of control devices and on-board systems. More particularly, the present invention relates to a device for controlling at least one device on board an aircraft, and an aircraft, a control method, an application method, a set of computer programs and an associated information medium. The present invention finds a particularly advantageous, although in no way limiting, application for the implementation of devices for controlling electric motors for actuating flight controls. Prior art

[0002] The invention is placed, by way of non-limiting example, in a context in which the flight controls of an aircraft are carried out by electric actuating motors. In this particular context, a control device (e.g. a computer) takes as input piloting commands (e.g. provided by a stick, or an autopilot) and data from sensors (e.g. an inertial unit, a Pitot probe), and provides as output control signals for the actuating motors (e.g. an actuator of an aileron).

[0003] Typically, such a control device uses several software components (i.e. several computer programs) to determine the control signals from the pilot commands and the measured data. These software components, respectively implementing specific functions necessary for the control, can be produced by different suppliers. However, the operation of several programs on the same control device requires solving problems of integration and management of the executions of these different programs.

[0004] In the current state of the art, one solution is to integrate several software components into a single program and to execute this program on a dedicated processor, such as a DSP (acronym for the English expression "Digital Signal Processor"). Such a solution makes it possible to achieve high processing speed while maintaining low complexity of the control device. These advantages are nevertheless offset by a certain number of disadvantages.

[0005] Indeed, with each new version of one of the software components, the common and complex integration of the software components within the same program must be systematically redone and certified again. Moreover, by using such a common integration, an execution error of one of the software components can lead to a general malfunction of the control device, a situation that must be absolutely avoided for critical applications, such as aeronautics.

[0006] There is therefore a need for a fast and low-complexity control device that can separate the execution of several programs. Statement of the invention

[0007] The present invention aims to remedy all or part of the drawbacks of the prior art, in particular those set out above.

[0008] According to one aspect of the invention, there is provided a device for controlling at least one device on board an aircraft from flight data provided by at least one source device, said control device comprising a multi-core processor comprising: a first core; a second core (distinct from the first core); and an inter-core communication interface, the second core being isolated from said at least one on-board device and from said at least one source device, and the first core being configured to: provide, via the inter-core communication interface, input data obtained from the flight data; obtain, via the inter-core communication interface, output data; and provide, to said at least one on-board device, control data obtained from the output data.

[0009] By "multi-core processor" we mean here a processor (e.g. a microprocessor integrated on a single circuit) comprising several processing units (called cores) physically separated and executing computer program instructions. Correlatively, a "core" designates a processing unit (i.e. a set of circuits within a processor) capable of executing computer program instructions.

[0010] In the context of the invention, the term "flight data" designates data characterizing a flight of the aircraft (i.e. including the different phases of flight such as taxiing, takeoff, cruising, landing, etc.). For information purposes, the flight data may include control data provided by a piloting device (e.g. manual or automatic) and / or data measured by one or more aircraft sensors (e.g. an inertial unit, a Pitot probe, a temperature sensor).

[0011] Furthermore, it is important to note that the second core is isolated from the onboard devices to be controlled and the source devices producing the flight data and cannot communicate with these devices. In other words, the second core does not have an active external communication interface to the processor.

[0012] Thus, the present invention proposes a control device (i.e. a platform) making it possible to execute on the second core a computer program (for example, a software component provided by a third-party entity) in a manner that is materially and temporally isolated from a program executed on the first core.

[0013] Indeed, the proposed control device makes it possible to execute: on the first core, a program implementing the control function of the embedded devices; and on the second core, a program implementing a specific algorithm necessary for the control function. In this sense, the present invention makes it possible to exploit the hardware characteristics of a multi-core processor to physically and temporally separate the executions of several programs within a control device.

[0014] Thanks to the proposed solution, an execution error of a program executed on the second core does not necessarily lead to a malfunction of the control device, the first core still being able to implement the control function. Therefore, compared to existing solutions, the present invention makes it possible to improve the operational safety of the control device.

[0015] Furthermore, the proposed control device allows to execute on each of the cores a program with its own time constraints (i.e. time isolation between a program executed on the first core and a program executed on the second core).

[0016] Furthermore, the use of a multi-core processor as proposed makes it possible to achieve a high processing speed (i.e., calculation frequency) while maintaining low complexity. In particular, the proximity between the processor cores makes it possible to quickly exchange data between several programs via the inter-core communication interface (e.g., including high-frequency RAM). The control device can thus operate at a high working frequency.

[0017] For these reasons, the present invention provides a fast and low-complexity control device for separating the executions of several programs in hardware and time. Thus, the proposed control device makes it possible to meet the constraints specific to embedded systems in terms of complexity, processing speed, size and operational safety.

[0018] According to one embodiment, the first core is configured to execute a so-called control program obtaining the flight data (from said at least one source device) and providing the control data (to said at least one on-board device). And, according to this embodiment, the second core is configured to execute a so-called application program obtaining the input data (from the first core) and providing the output data (to the first core).

[0019] The term "program" herein refers to a computer program comprising instructions executable by at least one core, processor, or computer.

[0020] According to this embodiment, the control program (e.g. produced by a supplier) implements the control function and thus ensures the interface with the source devices providing the flight data and with the on-board devices to be controlled. And, the application program (e.g. produced by another supplier) implements a specific algorithm necessary for the control function (e.g. a force law algorithm).

[0021] Generally speaking, this embodiment makes it possible to physically and temporally separate the executions of the control program and the application program.

[0022] In particular, an application program execution error does not lead to an execution error in the control program. The two programs can be executed at the same time without mutual blocking (i.e. no corruption between these programs), which contributes to improving the operational safety of the control device.

[0023] Furthermore, the application program does not have an external communication interface and cannot communicate with the source devices producing the flight data and the on-board devices to be controlled. In other words, all the data exchanged by the application program is communicated via the inter-core communication interface with the control program.

[0024] This embodiment advantageously allows the control program and the application program to be independently certified, with the exchanges between these programs being able to be considered as predefined interfaces. Also, the respective developments of these programs are made independent.

[0025] Furthermore, this embodiment allows the respective suppliers of the control program and the application program to be guaranteed the confidentiality of their programs. Thanks to the proposed solution, it is not necessary to have access to the source code of the program application to control embedded devices. The application program can thus be provided in binary form for example.

[0026] According to one embodiment, the multi-core processor of the control device is a dual-core digital signal microprocessor comprising the first and second cores.

[0027] By "digital signal microprocessor" we mean here a processor whose components are all implemented on a single integrated circuit and whose architecture is dedicated to (optimized for) the implementation of digital signal processing functions, more commonly referred to by the acronym DSP.

[0028] By exploiting a dual-core DSP optimized for digital signal processing, this embodiment advantageously makes it possible to achieve high processing speed while maintaining low complexity. This results in an improvement in the performance of the proposed control device in terms of cost, size, and energy consumption.

[0029] According to one embodiment, the inter-core communication interface comprises: two unidirectional exchange memories; or a bidirectional exchange memory.

[0030] For information, the exchange memory(s) of the inter-core communication interface may be high-frequency RAM.

[0031] This embodiment allows data to be exchanged quickly between the processor cores, and thus between programs running on these cores respectively. In this way, this embodiment contributes to providing a control device with high processing speed.

[0032] According to one embodiment, the inter-core communication interface comprises means for transmitting (e.g. a communication bus) trigger signals (also called “events”) between the first core and the second core.

[0033] This embodiment allows one of the processor cores to trigger the execution of one or more steps on another processor core. This embodiment thus makes it possible to coordinate the execution of different programs executed respectively on different cores.

[0034] In particular, according to one embodiment, the first and second cores communicate via the inter-core communication interface using only the exchange memory(s) and the trigger signal transmission means. More specifically, the second core does not comprise, according to one embodiment, any active communication interface external to the processor.

[0035] According to another aspect of the invention, there is provided an aircraft comprising: a control device according to the invention; at least one source device; and at least one on-board device.

[0036] In particular, said at least one source device provides flight data and said at least one on-board device is controlled by the control device from the flight data.

[0037] The proposed aircraft has the advantages described above in connection with the control device according to the invention.

[0038] According to one embodiment, said at least one on-board device comprises an electric actuator of a control surface of the aircraft.

[0039] This embodiment, thanks to the use of the proposed control device, makes it possible to implement the flight controls of an aircraft reliably and quickly.

[0040] Within the scope of the invention, other embodiments could also be envisaged in which said at least one on-board device comprises a digitally controlled inverter.

[0041] According to another aspect of the invention, there is provided a method for controlling at least one device on board an aircraft from flight data provided by at least one source device, the control method comprising steps, implemented by a first core of a multi-core processor, of: providing, via an inter-core communication interface of the multi-core processor, input data obtained from the flight data; obtaining, via the inter-core communication interface, output data; and providing, to said at least one on-board device, control data obtained from the output data.

[0042] The proposed control method has the advantages described above in connection with the control device according to the invention.

[0043] According to one embodiment, the control method is implemented by the control device according to the invention.

[0044] We recall here that the proposed control device makes it possible to execute, separately in time and material: on the first core, a control program implementing the control function of the embedded devices; and on the second core, an application program implementing an algorithm necessary for the control function.

[0045] According to one embodiment, the control method comprises a step of sending, by the first core to a second core of the processor, a signal for triggering a supply by an application program (executed on the second core) of said output data obtained from said input data. More precisely, this trigger signal is sent via an inter-core communication interface of the multi-core processor.

[0046] According to this embodiment, the first core triggers, when necessary, the implementation by the second core of a specific algorithm necessary for the control function (e.g. a force law algorithm implemented by the application program). Thus, this embodiment makes it possible to optimize the use of computing resources (i.e. processor cores) and the energy consumption of the control device.

[0047] More generally, this embodiment makes it possible to coordinate the executions of different programs executed respectively on different cores of the processor (eg the control program executed on the first core and the application program executed on the second core).

[0048] According to one embodiment, the control method comprises a step of sending, by the first core to the second core, a signal for triggering a start of the application program. In particular, this trigger signal is sent via the inter-core communication interface of the multi-core processor.

[0049] This embodiment allows the first core to start the execution by the second core of the application program.

[0050] According to one embodiment, the control method comprises steps, implemented by the second core to start the application program, of: if the application program is loaded onto the second core (i.e. onto a memory of the second core), initialization of configuration data of the application program and triggering of an execution by the second core of the application program; and otherwise, loading onto the second core (i.e. onto a memory of the second core) of the application program and triggering of a start of the application program.

[0051] It should be noted that the implementation by the second core of the steps described above to start the application program is triggered by the reception from the first core of a signal triggering a start of the application program.

[0052] This embodiment allows, without blocking the execution of the control program on the first core, to load (or update) the application program on the second core and to launch its execution.

[0053] According to one embodiment, the control method comprises a verification step, implemented by the second core, of a digital signature associated with the application program.

[0054] This embodiment allows the integrity of the application program to be verified and the provider of the application program to be authenticated. We describe in more detail below how the signature can be generated and verified.

[0055] More generally, this embodiment makes it possible to guarantee the security of the control device and to protect it from potential computer attacks (e.g. modification of the application program for malicious purposes).

[0056] According to one embodiment, the control method comprises a step of stopping or resetting the second core, implemented by the second core and triggered by an execution error of the application program.

[0057] This embodiment makes it possible to process an application program execution error and thus contributes to improving the operational safety of the control device.

[0058] According to one aspect of the invention, a computer program, called a control program, is proposed, comprising instructions for executing the steps, implemented by a first core of a multi-core processor, of a control method according to the invention, when said control program is executed by the first core.

[0059] In particular, the control program is executed by the first core of the multi-core processor of a control device according to the invention.

[0060] According to one aspect of the invention, there is provided a set of computer programs comprising: a control program according to the invention; and at least one other program. Said at least one other program comprises instructions for executing the steps, implemented by a second core of a multi-core processor, of a control method according to the invention, when said at least one other program is executed by the second core.

[0061] In particular, said at least one other program is executed by the second core of the multi-core processor of a control device according to the invention.

[0062] According to another aspect of the invention, there is provided an application method implemented by a second core of a multi-core processor, the second core being isolated in that it communicates only with a first core of the multi-core processor and via an inter-core communication interface, said application method comprising steps of: obtaining, via the inter-core communication interface, input data; obtaining output data from the input data; and providing, via the inter-core communication interface, the output data.

[0063] According to another aspect of the invention, there is provided a computer program, called an application program, comprising instructions for implementing the steps of an application method in accordance with the invention, when the application program is executed by a second core of a multi-core processor.

[0064] The application program is notably executed by the second core of the multi-core processor of a control device according to the invention.

[0065] According to one aspect of the invention, there is provided a computer-readable information medium comprising: a control program according to the invention; and / or a set of computer programs according to the invention; and / or an application program according to the invention.

[0066] In the context of the invention, a computer program may be formed of one or more sub-parts stored in the same memory or in separate memories. The program may use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0067] Furthermore, an information carrier may be any entity or device capable of storing the program. For example, the carrier may comprise a storage means, such as a non-volatile memory or ROM, for example a CD-ROM or a microelectronic circuit ROM, or a magnetic recording means, for example a floppy disk or a hard disk. Furthermore, the storage medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by a telecommunications network or by a computer network or by other means. The program according to the invention may in particular be downloaded onto a computer network. Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the method in question. Brief description of the drawings

[0068] Other characteristics and advantages of the present invention will emerge from the description provided below, illustrating embodiments of the invention given by way of example and without any limiting character, with reference to the attached drawings:

[0069] Figure 1 represents an example of software and hardware architecture of an aircraft according to an embodiment of the invention;

[0070] Figure 2 represents an example of software and hardware architecture of a control device according to an embodiment of the invention;

[0071] Figure 3A and Figure 3B respectively represent an example of software and hardware architecture of an aircraft and steps of a control method according to an embodiment of the invention; and

[0072] Figure 4A and Figure 4B respectively represent an example of software and hardware architecture of an aircraft and steps of a control method according to an embodiment of the invention. Description of the embodiments

[0073] Figure 1 represents an example of software and hardware architecture of an aircraft according to an embodiment of the invention. In particular, Figure 1 is described below to introduce the present invention and to exemplify a particular context of application thereof.

[0074] As illustrated in Figure 1, the aircraft AC comprises: a control device APP; at least one NAV source device; and at least one onboard device ACT. More specifically, the control device APP is configured to: take as input flight data NAV_DATA produced by said at least one NAV source device; and provide as output control data ACT_CMD to control said at least one onboard device ACT.

[0075] The flight data NAV_DATA may include command data NAV_CMD from a piloting device (automatic or manual) of the aircraft AC. Also, the flight data may include data measured by one or more sensors of the aircraft AC, such as an inertial unit, a Pitot probe, a temperature sensor, etc.

[0076] The present invention applies, in particular, to the control of electric motors for actuating flight control of an aircraft. The following description of the present invention refers to this particular context, given as an illustrative example and without any limiting character. In particular, embodiments could be envisaged in which the on-board devices ACT to be controlled comprise one or more digitally controlled inverters.

[0077] Thus, according to one embodiment, said at least one on-board device ACT to be controlled comprises one or more actuators (eg electric) for the control of the aircraft AC. By for example, based on pilot commands and / or data from sensors, the APP control device controls one or more ACT actuators of the aircraft AC.

[0078] It should be noted that, in the context of the invention, the APP control device requires the execution of several computer programs (in particular produced by different suppliers) to control the ACT on-board devices.

[0079] As illustrated in Figure 1, the APP control device requires the execution of a PLT_SW control program and a CLT_SW application program. More specifically, the PLT_SW control program implements the control function and provides the interface with the NAV source devices and with the ACT onboard devices; and the CLT_SW application program implements a specific algorithm necessary for controlling these ACT devices. For example, the CLT_SW application program can implement a force law algorithm making it possible to determine the instructions to be applied to a control surface of the AC aircraft.

[0080] We describe this last example in more detail here in order to illustrate an application of the invention. The PLT_SW control program obtains, from the NAV source devices, data from an inertial unit and a desired attitude of the aircraft AC. From the inertial data, it determines a current attitude and a speed of the aircraft AC. Then, the PLT_SW control program provides the CLT_SW application program with: the current attitude; the speed; and the desired attitude. Using a force law, the CLT_SW application program determines a degree of inclination to be applied to an aileron to achieve the desired attitude as a function of the current attitude and the speed of the aircraft AC. The CLT_SW application program provides the calculated degree of inclination to the PLT_SW control program which then determines an activation time for a control surface actuator to achieve this degree of inclination.

[0081] As mentioned previously, the present invention provides an APP control device (i.e. a platform) making it possible to execute any CLT_SW application program in a hardware and time-isolated manner.

[0082] The CLT_SW application program can be any and is typically provided by a third party entity (e.g., delivered by a supplier to the equipment manufacturer implementing the control device). Also, the architecture of the proposed APP control device is independent of the CLT_SW application program.

[0083] For this reason, we first describe the architecture of the proposed APP control device with reference to Figure 2, and then the operation of the proposed APP control device with reference to the following figures.

[0084] Figure 2 represents an example of software and hardware architecture of a control device according to embodiments of the invention. This figure details the architecture of the APP control device presented with reference to Figure 1.

[0085] As illustrated in Figure 2, the proposed APP control device comprises a multi-core processor PROC. Furthermore, the APP control device may comprise any type of components necessary for its operation, such as a power source, connection ports, communication modules, memories, etc.

[0086] The processor PROC comprises: at least a first core COR1 and a second core COR2; and an inter-core communication interface ICC.

[0087] Note that each of the COR1-COR2 cores of the PROC multi-core processor can autonomously execute computer program instructions. As such, each of the COR1-COR2 cores can respectively comprise at least one element among: one or more cache memories, an ordinal counter, one or more registers, and one or more calculation units.

[0088] According to one embodiment, the processor PROC comprises only two cores COR1-COR2. However, within the scope of the invention, other embodiments could be envisaged in which the processor PROC comprises more than two cores.

[0089] According to one embodiment, the PROC processor is a microprocessor (i.e. a processor all of whose components are integrated on a single circuit). More particularly, the PROC processor is a multi-core DSP according to one embodiment. Such a processor has an architecture optimized to implement digital signal processing functions as quickly as possible. The use of a DSP advantageously results in an improvement in the performance of the APP control device in terms of complexity, size, and energy consumption.

[0090] Thus, according to one embodiment, the PROC processor is a dual-core DSP.

[0091] The ICC inter-core communication interface includes: two unidirectional exchange memories MEM1 and MEM2 (e.g. high-frequency RAM); and EVT_BUS transmission means (e.g. a communication bus) of trigger signals (also called “events”).

[0092] The memory MEM1 is used to exchange data from the first core COR1 to the second core COR2, i.e. data written by the first core COR1 to the memory MEM1 and read by the second core COR2. Similarly, the memory MEM2 is used to exchange data from the second core COR2 to destination of the first core COR1, i.e. data written by the second core COR2 on the memory MEM1 and read by the first core COR1.

[0093] The MEM1-MEM2 memories allow data to be exchanged between the COR1-COR2 cores. The proximity between the COR1-COR2 cores allows data to be exchanged with a high communication rate between programs running on these cores, which thus contributes to providing a fast APP control device.

[0094] The EVT_BUS transmission means allow trigger signals to be exchanged between the COR1-COR2 cores. Such signals are used to trigger from one of the COR1-COR2 cores the execution of one or more steps on another COR1-COR2 core, which allows program executions on the COR1-COR2 cores to be coordinated.

[0095] The first core COR1 is configured to execute the PLT_SW control program. As illustrated in Figure 2, the PLT_SW control program provides the interface with the NAV source devices and the ACT onboard devices to be controlled. More generally, the PLT_SW control program implements the control function (i.e. management of hardware, interfaces, control sequencing of the onboard devices).

[0096] The first core COR1 can exchange data with a program executed on the second core COR2 using the memories MEM1-MEM2 of the ICC interface. Also, the first core COR1 can trigger the execution of one or more steps by a program executed on the second core COR2 by sending trigger signals via the transmission means EVT_BUS of the ICC interface. More generally, the first core COR1 is the master of data exchanges and events.

[0097] The second COR2 core is configured to communicate only with the first COR1 core via the ICC interface. In other words, the second COR2 core is configured in such a way that it does not have an active external communication interface to the PROC processor. In this sense, the second COR2 core is isolated from the NAV source devices and the ACT on-board devices to be controlled.

[0098] Thus, the proposed APP control device makes it possible to execute on the second core COR2 any program in a materially and temporally isolated manner from the PLT_SW control program executed on the first core COR1.

[0099] The advantages of the proposed APP control device result, as previously described, from the physical and temporal separation of the executions of several programs.

[0100] In particular, the proposed APP control device makes it possible to execute on each of the COR1-COR2 cores a program with its own time constraints (i.e. time isolation). In other words, the APP control device allows the use of different frequency plans between the PLT_SW control program executed on the first core COR1 and a program executed on the second core COR2.

[0101] Furthermore, an execution error of a program executed on the second COR2 core does not lead to a malfunction of the APP control device. The APP control device also makes it possible to guarantee the confidentiality of a program executed on the second COR2 core. Advantageously, it is possible to certify the APP control device (with the PLT_SW control program) and independently of a program executed on the second COR2 core, which significantly simplifies certification compared to existing solutions.

[0102] Furthermore, the APP control device makes it possible to achieve a high processing speed (i.e. a calculation frequency) while maintaining low complexity. More generally, the APP control device makes it possible to meet the specific constraints of embedded systems in terms of complexity, processing speed, size and reliability.

[0103] Having introduced the architecture of the APP control device, we describe its operation below with reference to the following figures.

[0104] Figure 3A and Figure 3B respectively represent an example of software and hardware architecture of an aircraft and steps of a control method according to an embodiment of the invention. Figure 3B illustrates a control method according to an embodiment of the invention implemented by the APP control device of Figure 3A.

[0105] As illustrated in Figure 3A, according to this embodiment, the first core COR1 of the APP control device is configured to execute the control program PLT_SW and the second core COR2 of the APP control device is configured to execute the application program CLT_SW.

[0106] As illustrated in Figure 3B, according to this embodiment, the control method comprises at least one of the steps described below. Note that the steps of the proposed control method implemented by the first core COR1 are denoted by S1XX and that the steps implemented by the second core COR2 are denoted by S2XX.

[0107] In step S100, the first core COR1 executes the control program PLT_SW comprising instructions for implementing steps S120 to S160 described below.

[0108] More generally, the control program PLT_SW may comprise instructions for carrying out each of the steps S1XX of the control method according to the invention and implemented by the first core COR1, when these instructions are executed by the first core COR1.

[0109] In step S240, the second core COR2 executes the application program CLT_SW comprising instructions for implementing steps S241 to S243 described below. In particular, we designate by “application method” the set of steps S241 to S243 implemented by the second core COR2, when it executes the application program CLT_SW.

[0110] It should be noted that the control program PLT_SW and the application program CLT_SW are executed concurrently, i.e. during overlapping time periods. In other words, steps S100 and S240 are performed concomitantly.

[0111] The management of the execution of the CLT_SW application program by the second core COR2 (i.e. loading, launching, execution error) is more fully described below with reference to figures 4A and 4B.

[0112] In step S120, the first core COR1 (i.e. the control program PLT_SW) obtains the flight data NAV_DATA from the NAV source devices. For example, the first core COR1 obtains in this step: data from an inertial unit; and a pilot command such as a desired attitude of the aircraft AC.

[0113] In step S130, the first core COR1 (i.e. the control program PLT_SW) provides input data IN_CLT to the second core COR2 (i.e. the application program CLT_SW) via the ICC interface. In particular, the first core COR1 writes in step S130 the input data IN_CLT to the memory MEM1 of the ICC interface, the input data IN_CLT being obtained from the flight data NAV_DATA.

[0114] For example, the control program PLT_SW may determine a current attitude and a speed of the aircraft AC from the inertial data. Thus, according to this example, the input data IN_CLT provided to the application program CLT_SW may include a current attitude, a speed of the aircraft AC and a desired attitude.

[0115] In step S140, the first core COR1 (i.e. the control program PLT_SW) triggers a supply by the second core COR2 (i.e. by the application program CLT_SW) of output data OUT_CLT. More precisely, the first core COR1 sends in step S140 a trigger signal EVT_TRIG to the second core COR2 via the transmission means EVT_BUS (not shown in FIG. 3A) of the ICC interface. The signal EVT_TRIG triggers the implementation of steps S241 to S243 by the second core COR2.

[0116] In step S241, the second core COR2 (i.e. the application program CLT_SW) obtains the input data IN_CLT from the first core COR1 (i.e. from the control program PLT_SW). In fact, the second core COR2 reads in step S241 the input data IN_CLT from the memory MEM1 of the ICC interface.

[0117] In step S242, the second core COR2 (the application program CLT_SW) obtains the output data OUT_CLT from the input data IN_CLT.

[0118] Using the example above, the CLT_SW application program can determine, using a force law, a degree of inclination to be applied to an aileron to achieve a desired attitude of the aircraft AC as a function of its current attitude and its speed.

[0119] In step S243, the second core COR2 (i.e. the application program CLT_SW) provides the output data OUT_CLT to the first core COR1 (i.e. the control program PLT_SW) via the ICC interface. The second core COR2 writes in step S243 the output data OUT_CLT to the memory MEM2 of the ICC interface.

[0120] In step S150, the first core COR1 (i.e., the control program PLT_SW) obtains the output data OUT_CLT from the second core COR2 (i.e., from the application program CLT_SW) via the ICC interface. In step S150, the first core COR1 reads the output data OUT_CLT from the memory MEM2 of the ICC interface.

[0121] In step S160, the first core COR1 (i.e. the control program PLT_SW) provides, to the on-board devices ACT, the control data ACT_CMD obtained from the output data OUT_CLT.

[0122] Considering the example above, the control program PLT_SW can determine an activation time of a control surface actuator to reach the degree of inclination calculated by the application program CLT_SW.

[0123] It should be noted that the application program CLT_SW may comprise at least one initialization service and one periodic service, these services being respectively triggered by trigger signals. Thus, the implementation of steps S241 to S243 may correspond to the performance of the initialization service or the periodic service of the application program CLT_SW.

[0124] The periodic service of the application program CLT_SW can be triggered, repeatedly over time, by the control program PLT_SW to obtain output data OUT_CLT. Also, the control method can comprise a plurality of iterations of steps S120 to S160 and, correlatively, the application method can comprise a plurality of iterations of steps S241 to S243.

[0125] Figure 4A and Figure 4B respectively represent an example of software and hardware architecture of an aircraft and steps of a control method according to embodiments of the invention. Specifically, these figures are described below to detail the management of the execution of the CLT_SW application program by the APP control device presented with reference to Figures 3A and 3B.

[0126] As illustrated in Figure 4A, according to one embodiment, the second core COR2 is configured to execute at least one of the following programs: a startup program BOOT; a loading program LDR; an initialization program PRE_LDR; and an interrupt handling program INTRPT (also called interrupt vector). The respective functions of these programs are described below with reference to the steps of Figure 4B.

[0127] In step S100, and as previously described, the first core COR1 executes the control program PLT_SW comprising instructions for implementing steps S120 to S160. According to the embodiment illustrated by FIGS. 4A and 4B, the control program PLT_SW further comprises instructions for carrying out step S110.

[0128] In step S110, the first core COR1 (i.e. the control program PLT_CW) triggers a start of the application program CLT_SW. To do this, the first core COR1 sends a trigger signal EVT_BOOT to the second core COR2 via the transmission means EVT_BUS (not shown in FIG. 3A) of the ICC interface. The signal EVT_BOOT triggers the implementation of step S210 by the second core COR2.

[0129] Following step S110, the first core COR1 implements steps S120 to S160 as previously described with reference to FIGS. 3A and 3B.

[0130] In step S210, triggered by the reception of the EVT_BOOT signal, the second core COR2 executes the BOOT boot program comprising instructions for implementing steps S211 and S212.

[0131] In step S211, the second core COR2 (i.e. the boot program BOOT) starts and / or initializes the second core COR2.

[0132] In step S212, the second core COR2 (i.e. the startup program BOOT) selects to trigger the execution of the loading program LDR or the initialization program PRE_LDR depending on the presence of the application program CLT_SW on a memory of the second core COR2.

[0133] If (and only if) the application program CLT_SW is loaded (i.e. recorded, stored) on a memory of the second core COR2, the second core COR2 (i.e. the startup program BOOT) triggers in step S212 an execution of the initialization program PRE_LDR. In this case, the control method continues in step S230.

[0134] Otherwise, if the application program CLT_SW is not loaded onto a memory of the second core COR2, the second core COR2 (i.e. the startup program BOOT) triggers in step S212 an execution of the loading program LDR. In this case, the control method continues in step S220.

[0135] It should be noted here that the selection made in step S212 can also be made according to the version of the application program CLT_SW. According to such an embodiment, if the application program CLT_SW loaded on a memory of the second core COR2 corresponds to an obsolete or earlier version of this program, then the second core COR2 (i.e. the startup program BOOT) triggers in step S212 an execution of the loading program LDR to load an updated version of the application program CLT_SW.

[0136] In step S220, the second core COR2 executes the LDR load program comprising instructions to perform at least steps S221 and S223.

[0137] In step S221, the second core COR2 (i.e. the LDR loading program) loads or updates the application program CLT_SW onto a memory of the second core COR2.

[0138] More precisely, the second core COR2 obtains the instructions INS_CLT_SW (e.g. the binary code) of the application program CLT_SW from the first core COR1 via the ICC interface. Thus, according to one embodiment, the first core COR1 writes the instructions of the application program CLT_SW into the exchange memory MEM1 of the ICC interface; and the second core COR2 reads the instructions of the application program CLT_SW from the exchange memory MEM1.

[0139] According to one embodiment, the LDR loading program further comprises instructions for performing step S222.

[0140] In step S222, the second core COR2 (i.e. the LDR loading program) verifies a digital signature associated with the application program CLT_SW.

[0141] For example, the signature of the CLT_SW application program can be generated as follows. The provider of the CLT_SW application program has a private / public key pair and a certificate associating the public key with the provider. The provider applies a hash function to the CLT_SW application program code to obtain a fingerprint, then encrypts this fingerprint with its private key to obtain the signature. The provider provides the APP control device with: the CLT_SW application program code; the associated signature; and its certificate.

[0142] According to this example, the APP control device can verify the signature of the application program CLT_SW as follows. The APP control device, on the one hand, determines a fingerprint of the CLT_SW application program code and, on the other hand, decrypts the digital signature using the public key of the provider's certificate, then compares the results of these two operations. If the fingerprint calculated by the APP control device matches the decrypted signature, then the signature of the CLT_SW application program is valid.

[0143] If (and only if) the result of the verification step S222 is positive (i.e. valid signature), the control process continues to step S223. Otherwise (i.e. invalid signature), the second core COR2 is inhibited and will not execute the application program CLT_SW. Indeed, the authentication of the application program CLT_SW fails, this may mean that the application program CLT_SW has been modified by a malicious entity.

[0144] Thus, by verifying the signature of the CLT_SW application program, the APP control device verifies the integrity of the CLT_SW application program and authenticates (i.e. verifies the identity of) the provider of this program. This advantageously improves the security of the APP control device and protects it from possible computer attacks.

[0145] In step S223, the second core COR2 (i.e. the LDR loading program) triggers a start of the application program. The control method thus continues in step S210.

[0146] In step S230, the second core COR2 executes the initialization program PRE_LDR comprising instructions for implementing at least steps S232 and S233.

[0147] According to one embodiment, the initialization program PRE_LDR further comprises instructions for carrying out step S231.

[0148] In step S231, the second core COR2 (i.e. the initialization program PRE_LDR) verifies a digital signature associated with the application program CLT_SW. Step S231 may, for example, be implemented in a similar manner to step S221 described above.

[0149] In step S232, the second core COR2 (i.e. the initialization program PRE_LDR) initializes configuration data (e.g. a configuration table) of the application program CLT_SW.

[0150] In step S233, the second core COR2 (i.e. the initialization program PRE_LDR) triggers an execution of the application program CLT_SW by the second core COR2.

[0151] In step S240, triggered by step S233, the second core COR2 executes the application program CLT_SW and thus implements steps S241 to S243 as described with reference to FIGS. 3A and 3B.

[0152] However, if an application program execution error CLT_SW occurs, then the second core COR2 triggers the execution of the interrupt handling program INTRPT (i.e. an interrupt vector).

[0153] In step S250, triggered by an execution error of the application program CLT_SW, the second core COR2 executes the interrupt handling program INTRPT comprising instructions to stop and / or reset the second core COR2.

[0154] The proposed solution, by exploiting the hardware architecture of the multi-core processor PROC, advantageously makes it possible to dissociate the executions of the control program PLT_SW and the application program CLT_SW. Thus, an execution error of the application program CLT_SW does not lead to an execution error of the control program PLT_SW and to a failure of the control device APP. Indeed, the control program PLT_SW can, despite an execution error of the application program CLT_SW, continue to ensure the control function of the embedded devices ACT. To do this, the control program PLT_SW can, for example, use a degraded operating mode not requiring the use of the application program CLT_SW, or even trigger a new execution of the application program CLT_SW once the second core COR2 has been reset.

[0155] It should be noted that the order in which the steps of a method according to the invention are carried out, in particular with reference to the attached drawings, constitutes only an example of embodiment without any limiting character, variants being possible. In particular, a method according to the invention may comprise one or more iterations of the steps described above, in particular with reference to the attached drawings.

[0156] Furthermore, the reference signs do not limit the scope of protection, their sole function being to facilitate the understanding of the claims.

[0157] A person skilled in the art will understand that the embodiments and variants described above constitute only non-limiting examples of implementation of the invention. In particular, a person skilled in the art may envisage any adaptation or combination of the embodiments and variants described above in order to meet a very specific need.

Claims

Claims Control device (APP) of at least one on-board device (ACT) in an aircraft (AC) from flight data (NAV_DATA) provided by at least one source device (NAV), said control device (APP) comprising a multi-core processor (PROC) comprising: a first core (COR1); a second core (COR2);and an inter-core communication interface (ICC), the second core (COR2) being isolated from said at least one on-board device (ACT) and said at least one source device (NAV) in that it is configured to communicate only with the first core (COR1) and via the inter-core communication interface (ICC), the first core (COR1) being configured to execute a control program (PLT_SW) implementing the control function of said at least one on-board device (ACT) and comprising instructions for: providing (S130), via the inter-core communication interface (ICC), input data (IN_CLT) obtained from the flight data (NAV_DATA); obtaining (S150), via the inter-core communication interface (ICC), output data (OUT_CLT);and providing (S160), to said at least one embedded device (ACT), control data (ACT_CMD) obtained from the output data (OUT_CLT), and the second core (COR2) being configured to execute an application program (CLT_SW) comprising instructions for: obtaining (S241), via the inter-core communication interface (ICC), the input data (IN_CLT); obtaining (S242) the output data (OUT_CLT) from the input data (IN_CLT); and providing (S243), via the inter-core communication interface (ICC), the output data (OUT_CLT). Control device (APP) according to claim 1, wherein the processor (PROC) is a dual-core digital signal microprocessor comprising the first core (COR1) and the second core (COR2). Control device (APP) according to one of claims 1 to 2, in which the inter-core communication interface (ICC) comprises: two unidirectional exchange memories (MEM1, MEM2);or a bidirectional exchange memory.; 4. Control device (APP) according to one of claims 1 to 3, in which the inter-core communication interface (ICC) comprises means for transmitting (EVT_BUS) trigger signals (EVT_BOOT, EVT_TRIG) between the first (COR1) and the second core (COR2).

5. Aircraft (AC) comprising: a control device (APP) according to one of claims 1 to 4; at least one source device (NAV) providing flight data (NAV_DATA); and at least one on-board device (ACT) controlled by the control device (APP) from the flight data (NAV_DATA).

6. Aircraft (AC) according to claim 5, wherein said at least one on-board device (ACT) comprises an electric actuator of a control surface of the aircraft (AC).

7. Method for controlling at least one on-board device (ACT) in an aircraft (AC) from flight data (NAV_DATA) provided by at least one source device (NAV), the control method being implemented by a control device (APP) according to one of claims 1 to 4, and the control method comprising steps, implemented by the first core (COR1) of the multi-core processor (PROC) of the control device (APP), of: providing (S130), via the inter-core communication interface (ICC) of the processor (PROC), input data (IN_CLT) obtained from the flight data (NAV_DATA); obtaining (S150), via the inter-core communication interface (ICC), output data (OUT_CLT); and providing (S160), to at least one on-board device (ACT), control data (ACT_CMD) obtained from the output data (OUT_CLT).

8. Control method according to claim 7, comprising a step of sending (S140), by the first core (COR1) to the second core (COR2) of the processor (PROC), a trigger signal (EVT_TRIG) for a supply by the application program (CLT_SW) of said output data (OUT_CLT) obtained from said input data (IN_CLT).

9. Control method according to claim 8, comprising a step of sending (SI 10), by the first core (COR1) to the second core (COR2), a trigger signal (EVT_BOOT) for starting the application program (CLT_SW).

10. Control method according to claim 9, comprising steps, implemented by the second core (COR2) to start the application program (CLT_SW), of: if the application program (CLT_SW) is loaded on the second core (COR2), initialization (S232) of configuration data of the application program (CLT_SW) and triggering (S233) of an execution by the second core (COR2) of the application program (CLT_SW); and otherwise, loading (S221) on the second core (COR2) of the application program (CLT_SW) and triggering (S223) of a start of the application program (CLT_SW). Control method according to one of claims 8 to 10, comprising a verification step (S222, S231), implemented by the second core (COR2), of a digital signature associated with the application program (CLT_SW).Computer program (PLT_SW), called control program, comprising instructions for executing the steps, implemented by the first core (COR1) of the multi-core processor (PROC) of a control device (APP) according to one of claims 1 to 4, of a control method according to one of claims 7 to 11, when said control program (PLT_SW) is executed by the first core (COR1).Application method implemented by the second core (COR2) of the multi-core processor (PROC) of a control device (APP) according to one of claims 1 to 4, the second core (COR2) being isolated in that it communicates only with the first core (COR1) of the processor (PROC) and via the inter-core communication interface (ICC), said application method comprising steps of: obtaining (S241), via the inter-core communication interface (ICC), input data (IN_CLT); obtaining (S242) output data (OUT_CLT) from the input data (IN_CLT); and providing (S243), via the inter-core communication interface (ICC), the output data (OUT_CLT).Computer program (CLT_SW), called application, comprising instructions for implementing the steps of an application method according to claim 13, when the application program (CLT_SW) is executed by the second core (COR2) of the multi-core processor (PROC) of a control device (APP) according to one of claims 1 to 4.

Images