SECURE DIGITAL AIRCRAFT DATA TRANSFER SYSTEM COMPRISING REDUNDANT DATA PRODUCING SYSTEMS, ASSOCIATED ASSEMBLY AND METHOD
Patent Information
- Application Number
- FR2021000286
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2021-01-13
- Publication Date
- 2025-03-07
- Estimated Expiration
- 2041-01-13
Smart Images
Figure 00000028_0000 
Figure 00000029_0000 
Figure 00000030_0000
Abstract
Description
Title of the invention: Secure aircraft digital data transfer system comprising redundant data producing systems, associated assembly and method
[0001] The present invention relates to an aircraft data transfer system, comprising:
[0002] - a first data producing system, capable of producing, at times successive, first data;
[0003] - a second data producing system, redundant and preferably synchronous of the first data producing system, the second data producing system being capable of advantageously producing at successive times, second data, intended to be identical to the first data;
[0004] - at least one data consuming system, capable of receiving and using the first data;
[0005] at least one of the first data producing system, the second data producing system and the or each data consuming system being on board an aircraft;
[0006] - a data transfer link between the first data producing system and the or each data consuming system, the first data producing system being capable of transferring the first data to the or each data consuming system via the data transfer link.
[0007] The data transfer system is intended to ensure a secure transfer of digital data within an aircraft, from the aircraft to at least one data consuming system external to the aircraft (such as at least one other aircraft, a ground control station in the case of a drone, etc.), and / or from a data producing system external to the aircraft (for example another aircraft, a mission preparation system, a data downloading system, etc.) to the aircraft.
[0008] It is intended to be used in particular between data-producing systems and one or more data-consuming systems located at a distance from each other. The data transfer system can also be used within the same aircraft system, in particular between different computers of the same aircraft system, between a producing application of equipment (for example a sensor) and one or more computers, between several application layers of the same computer, or even between different cores of the same processor.
[0009] The transfer system is intended to be implemented independently of the number of digital data transfer links between each data producing system and each data consuming system and independently of the nature of these at the level of the overall data transmission architecture.
[0010] In an aircraft, many aircraft systems are capable of generating functional data. This is the case, for example, of sensor systems for measuring parameters, the parameters being internal or external to the aircraft, or of avionics systems, in particular systems for piloting, controlling or guiding the aircraft.
[0011] The functional data are, for example, measurements of aircraft parameters, commands for aircraft systems, or monitoring data for aircraft systems.
[0012] Functional data is often used by other aircraft systems, or by other application layers of the same aircraft system. It is therefore transferred between a data producing system and at least one data consuming system which may be located remotely, or even outside the aircraft or in other application layers.
[0013] Digital data transfer protocols are widely used within aircraft.
[0014] Some "low-level" protocols transmit digital data in the form of data words, each of which contains protocol management information and functional information. This is the case, for example, with the ARINC 429 protocol.
[0015] More advanced protocols, such as the GAM-T-101 protocol (Digibus), the MIL-STD-1553B protocol, or the Ethernet protocol and its so-called deterministic derivatives (ARINC664 Part 7 or SAE AS6802 or TSN), implement messages which allow the atomic transmission of several data words, some containing exclusively protocol management information and the others exclusively functional information.
[0016] In any case, it is essential in the aeronautical field to ensure the integrity of the transmitted data.
[0017] In the example of the ARINC 429 protocol, the functional data is transmitted in the form of a sequence of bits via ARINC429 words, the size of which is limited to 32 bits.
[0018] Each ARINC 429 word includes a data identifier (ID) called a label, an identifier of the source having emitted the data (SDI), the functional data (D), and an identifier of validity of the data emitted by the producing system (SSM).
[0019] The ARINC 429 protocol allows the transmission of so-called functional data in the form of “label-data” patterns and in the following, as commonly used, “label” may designate the complete ARINC 429 word.
[0020] To verify the integrity of the functional data after their transmission, each ARINC 429 word also includes a parity check bit (P), resulting from the binary sum of the bits of the functional data. The parity bit is calculated when encoding the data into ARINC 429 words in the data transmission layer.
[0021] When recovering the data contained within an ARINC 429 word, the consumer system is able to recalculate the parity of the functional data that it receives and to verify that it is identical to that of the parity bit contained in the ARINC 429 word.
[0022] However, this integrity test is often an insufficient indicator to detect a loss of integrity of the functional data packet during the transfer.
[0023] Thus, if two bits of the functional data packet are erroneous, the sum can give a parity corresponding to that of the verification bit, while the functional data packet has been doubly corrupted.
[0024] Such a protocol can therefore be used when the data transmitted is of lesser importance, or is not critical for the safety and operation of the aircraft.
[0025] If the data is important or critical, it is necessary to use redundant producer systems, which process data in parallel and transmit it in parallel to one or more consumer systems. The consumer system(s) receive the data from the different producer systems and apply selection or voting strategies to ensure that the data is intact. Such a solution is secure, but increases the cost and complexity of the aircraft.
[0026] Indeed, the presence of at least two redundant producer systems, associated with at least two redundant transfer links, increases the infrastructure required within the aircraft, and therefore the mass and the cost.
[0027] In the absence of redundancy, the transfer system would be simplified and less expensive, but the data integrity requirement would not be met.
[0028] An object of the invention is to provide an aircraft data transfer system, which is of simplified structure and reduced cost, while guaranteeing the integrity of the data in the event that the error of this data can have catastrophic consequences.
[0029] To this end, the invention relates to a data transfer system as defined above, characterized in that the second data-producing system is capable of producing an integrity check result relating at least to the second data, the integrity check result being intended to be transmitted to the or each data-consuming system,
[0030] the or each data consuming system being capable of recovering the first data transferred from the first data producing system and the integrity check result produced by the second producing system, the or each data consuming system being able to check the integrity of the first data, by establishing a new integrity check result from the first data and by comparing the new integrity check result with the integrity check result produced by the second data producing system.
[0031] The system according to the invention may comprise one or more of the following characteristics, taken in isolation or in any technically possible combination:
[0032] - the data capsule is in an intact state when the new result of integrity check corresponds to the integrity check result produced by the second data producing system and retrieved from the data capsule;
[0033] - the first data are functional data, the second data being functional data;
[0034] - the second data producing system is unable to directly transfer the second data to the or each data consuming system;
[0035] - the second data producing system is capable of transmitting the result of integrity check on the second data at the first data producing system;
[0036] - the first data producing system is capable of transferring the result of integrity check from the second data producing system through the data transfer link;
[0037] - the data transfer link exclusively connects the first system data producer to the or each data consumer system, with no data transfer link connecting the second data producer system to the or each data consumer system;
[0038] - the second data producing system is unable to directly transfer the second data to the or each data consuming system without passing through the first data producing system;
[0039] - the first data producing system is capable of generating, at each ela data incorporation, a data capsule, each data capsule comprising:
[0040] - an identifier of the data producer, a refresh indicator set to day at each data elaboration, possibly a package of first functional data, elaborated by the first data producing system; and
[0041] - the result of the integrity check of the data processed by the second system data producer,
[0042] the or each data consuming system being capable of recovering each data capsule to extract the identifier, the refresh indicator, possibly the packet of first functional data, produced by the first data producing system and the integrity check result generated by the second data producing system;
[0043] - the second data producing system is capable of generating, at each ela data generation, a data producer identifier intended to be identical to the identifier produced by the first data producer system, a refresh indicator, varying with each data generation, intended to be identical to the refresh indicator produced by the first data producer system, the integrity check result being calculated from the data producer identifier, the refresh indicator and possibly second functional data, produced by the second data producer system;
[0044] - the transfer link implements a transfer protocol generating words, each data capsule being emitted using a plurality of words;
[0045] - the plurality of words comprises: at least one identification word comprising the identifier and / or the refresh indicator, possibly at least one functional data word containing first functional data of the functional data packet, and at least one integrity check word, containing the integrity check result produced by the second data producing system;
[0046] - the second data producing system is capable of producing the result of integrity control by adopting a memory representation from the data to be distributed in the words intended to transfer the data capsule, the or each data consuming system being able to reconstitute the memory representation developed by the data producing system from the data recovered from the words of the data capsule; and
[0047] - the integrity check result is a checksum or a re code cyclical frequency.
[0048] The invention also relates to a set of aircraft data producing systems comprising:
[0049] - a first data producing system, capable of producing, at times successive, first data;
[0050] - a second data producing system, redundant and preferably synchronous of the first data producing system, the second data producing system being capable of advantageously producing at successive times, second data, intended to be identical to the first data,
[0051] the first data producing system being capable of transferring the first data to at least one data consuming system via a data transfer link;
[0052] characterized in that the second data producing system is suitable for developing an integrity check result relating to the second data, the integrity check result being intended to be transmitted to the or each data consuming system, and the second data producing system being advantageously capable of transmitting the integrity check result to the first data producing system.
[0053] The invention also relates to a data consuming system, intended to be used in an aircraft data transfer system, the data transfer system comprising a first data producing system, capable of producing, at successive times, first data and a second data producing system, redundant and preferably synchronous with the first data producing system, the second data producing system being capable of advantageously producing, at successive times, second data, intended to be identical to the first data,
[0054] the or each data consuming system being capable of recovering the first data transferred from the first data producing system and an integrity check result produced by the second producing system relating to the second data, the or each data consuming system being capable of checking the integrity of the first data, by establishing a new integrity check result from at least the first data and by comparing the new integrity check result with the integrity check result produced by the second data producing system.
[0055] The invention also relates to a method for transferring aircraft data comprising the following steps:
[0056] - development, at successive times, of first data by a first system data producer;
[0057] - development, advantageously at successive times, of second data, intended to be identical to the first data by a second data producing system, redundant and preferably synchronous with the first data producing system;
[0058] - transfer of the first data via a data transfer link between the first data producing system and the or each data consuming system;
[0059] - reception and use of the first data by at least one system data consumer;
[0060] at least one of the first data producing system, the second data producing system and the or each data consuming system being on board an aircraft;
[0061] characterized by the following steps:
[0062] - development by the second data producing system of a result of integrity check on the second data;
[0063] - transfer of the integrity check result to the or each consumer system of data;
[0064] - recovery by the or each data consuming system of the first data transferred from the first data producing system and the integrity check result produced by the second producing system;
[0065] - integrity check of the first data by the or each consumer system of data, by establishing a new integrity check result from at least the first data and by comparing the new integrity check result with the integrity check result produced by the second data producing system.
[0066] The method according to the invention may comprise one or more of the following characteristics, taken in isolation or in any technically possible combination:
[0067] - the first data produced by the first data producing system and the integrity check result produced by the second data producing system are transmitted through the data transfer link, the second data produced by the second data producing system not being transmitted directly to the or each data consuming system without passing through the first data producing system;
[0068] - the first data producing system generates, at each elaboration of data, a data capsule,
[0069] each data capsule comprising:
[0070] - an identifier of the data producer, a refresh indicator set to day at each data elaboration, possibly a package of first functional data, elaborated by the first data producing system; and
[0071] - the data integrity check result produced by the second system data producer,
[0072] the method comprising the recovery, by the or each data consuming system of each data capsule to extract the identifier, the refresh indicator, possibly the packet of first functional data, produced by the first data producing system and the integrity check result produced by the second data producing system.
[0073] The invention will be better understood on reading the following description, given solely by way of example, and made with reference to the appended drawings, in which:
[0074] - [Fig.l] [Fig.l] is a schematic representation of a transfer system of aircraft data according to the invention;
[0075] - [Fig.2] [Fig.2] is a schematic representation of the contents of a capsule used to transfer data within the transfer system of [Fig.l];
[0076] - [Fig.3] [Fig.3] is a schematic representation illustrating the structure of a capsule emitted via a transmission protocol using words, in an example where the identifier and the refresh indicator are placed in the same word;
[0077] - [Fig.4] [Fig.4] is a detailed view of the representation of a word of the protocol ARINC 429;
[0078] - [Fig.5] [Fig.5] is a view of a memory representation of a sequence of words forming a capsule, with a view to implementing an integrity test;
[0079] A first data transfer system 10 according to the invention within an aircraft 12 is illustrated schematically by [Fig.l].
[0080] The aircraft 12 is for example a business aircraft, a military aircraft, a passenger or cargo transport aircraft, or the aerial vehicle of a drone.
[0081] The data transferred by the system 10 are functional data produced or received in the aircraft, for example results of physical measurements of sensors of the aircraft, data of command orders of systems of the aircraft, data of monitoring of states of systems of the aircraft, avionics data.
[0082] This functional data is transported and encoded in binary in the form of bit strings.
[0083] With reference to [Fig.l], the transfer system 10 comprises a first data producing system 14, a second data producing system 15, redundant to the first data producing system 14, and at least one data consuming system 16.
[0084] The transfer system 10 further comprises a data transfer link 18 between the producer system 14 and the or each consumer system 16. It also comprises a secondary link 19 between the first data producer system 14 and the second data producer system 15, this link being for example a data transfer link between the first data producer system 14 and the second data producer system 15 or a data reading link from the second data producer system 15 by the first data producer system 14.
[0085] The data producing systems 14, 15 and the consumer system 16 are for example respectively present in two separate aircraft systems of the aircraft 12. The data transfer link 18 is then a transmission link present in the aircraft 12, such as a physical data transmission link through a cable network.
[0086] Alternatively, at least one data consuming system 16 is external to the aircraft 12. It is for example located in another aircraft, a ground control station in the case of a drone, etc.
[0087] As a further variant, at least one data producing system 14, 15 is external to the aircraft 12. It is for example located in another aircraft, in a pre- mission preparation, in a data download system.
[0088] In these last two cases, the data transfer link 18 comprises at least one wireless data transmission link from the aircraft 12 and / or to the aircraft 12.
[0089] The data producing systems 14, 15 and the data consuming system 16 then each comprise at least one computing resource comprising a processor and a memory containing software modules suitable for being executed by the processor.
[0090] Alternatively, the systems 14, 15, 16 are produced at least partially in the form of programmable logic components, or in the form of dedicated integrated circuits.
[0091] In a variant (not shown), the data producing systems 14, 15 and the data consuming system 16 are located within the same aircraft system, or even the data producing systems 14 and 15 are co-located in the same computing resource of the aircraft system, for example at the level of two distinct application layers of the same aircraft computing resource or in two different cores of the same processor.
[0092] The first data producing system 14 is capable of producing first functional data at successive times, by generating them itself or by receiving them from one or more functional data sources. It is thus capable of forming, at each successive data production time, a packet of first functional data 46.
[0093] The first data producing system 14 is furthermore capable of producing a data capsule identifier 42 and a refresh indicator 44, updated by the data producing system 14 each time first functional data is produced, independently of the frequency of transmission of the data in the transfer link 18.
[0094] The second data producing system 15 is redundant and preferably synchronous with the first data producing system 14. It is capable of producing second functional data at the same successive times as the first functional data, by generating them itself, or by receiving them from the same source(s) of functional data as that(s) connected to the first data producing system 14. It is thus capable of forming, at each successive time of data production, a second packet 46A of functional data, intended to be identical to the first packet of functional data 46, in normal operation.
[0095] The second data producing system 15 is furthermore capable of producing a capsule identifier 42A intended to be identical to the capsule identifier 42 produced by the first data producing system 14, and a refresh indicator 44A, intended to be identical to the refresh indicator 44 produced by the first data producing system 14 each time first functional data is produced.
[0096] Furthermore, the second data producing system 15 is capable of producing an integrity check result, calculated from the identifier 42A and the refresh indicator 44A that it has produced, and from the packet 46A of second functional data.
[0097] In the example shown in [Fig.l], the integrity check result 48A produced by the second data producer system 15 is transferred from the second data producer 15 to the first data producer system 14 through the secondary transfer link 19.
[0098] The first data producer system 14 is then able to transmit the data produced to the data consumer system 16 via the transfer link 18, by encapsulating the first functional data 46 produced at successive times in successive capsules 40, the content and structure of which are illustrated respectively by FIGS. 1 to 3.
[0099] As illustrated by [Fig.2], each capsule 40 comprises the capsule identifier 42 produced by the first data producing system 14, a refresh indicator 44, updated by the first data producing system 14 at each production of functional data, independently of the frequency of transmission of the data in the transfer link 18, and a packet 46 of first functional data produced by the first data producing system 14 during a functional production of data.
[0100] According to the invention, each capsule 40 further comprises an integrity check result 48A, calculated by the second data producing system 15 from the identifier 42A produced by the second data producing system 15, from the refresh indicator 44A produced by the second data producing system 15 and from the packet of second functional data 46A produced by the second data producing system 15 simultaneously with the packet of first functional data 46.
[0101] The capsule identifier 42, 42A is for example a bit string making it possible to identify the system producing the data 14, 15 and / or an entity having produced the functional data within the data producing system 14, 15. The capsule identifier 42, 42A notably allows the or each data consuming system 16, from a predefined semantics and / or a correspondence table, to identify the producer of the data and the functional content of the data packet and thus to implement an authentication check to ensure that the data has indeed been produced by the expected data producing system 14, 15.
[0102] The capsule identifier 42 makes it possible to associate the capsule 40 bijectively with a transfer system 10 considered (implemented in an aircraft 12, several aircraft, one or more aircraft and means external to the aircraft 12), independently of the number of transfer links 18 and the nature of these at the level of the overall transmission architecture.
[0103] Thus, from the capsule identifier 42 associated with the capsule 40, it is possible, from a predefined semantics and / or a correspondence table, to assign the capsule 40 to a given transfer system 10 including data producer systems 14, 15 and at least one data consumer system 16.
[0104] Furthermore, if the capsules 40 generated by the data producing system 14, 15 and / or by an entity within the data producing system 14, 15 are all of identical structures, the data consuming system 16 is able to identify the position of the data packet 46 in the capsule 40, the length of the data packet 46 and the position of the integrity check result 48A, from the capsule identifier 42.
[0105] The refresh indicator 44, 44A is a bit string encoding a sequence number for producing the functional data at each production of functional data. The refresh indicator 44, 44A is, for example, a counter or a downcounter generally updated individually at each production of functional data. It makes it possible to associate, with each capsule 40 transmitted, a data refresh measurement. This measurement makes it possible to ensure that the functional data recovered by the data consuming system 16 have indeed been refreshed by the data producing system 14, 15 constituting a refresh control.
[0106] The data packet 46, 46A is a bit string encoding the functional data generated during the development of functional data associated with the number of the refresh indicator 44, 44A.
[0107] The integrity check result 48A is a bit string encoding a check number calculated by mathematical processing, from a functional representation integrating the identifier 42A, the refresh indicator 44A, and the second functional data 46A produced by the second data producing system 15.
[0108] Preferably, the integrity check result 48A is the result of a checksum, or a cyclic redundancy code (CRC). The mathematical processing is for example an algorithm chosen according to the security objectives to be achieved, the minimum / maximum length of the data packet 46A, the identifier 42A, the refresh indicator 44A, and the reliability of the data link, in terms of bit error rate (BER). Examples The algorithms used are described in the United States Federal Aviation Administration document DOT / FA / TC-14 / 49, March 2015.
[0109] In the example shown in [Fig.l], the data transfer link 18 is a link implementing a data transfer protocol using words 50 containing management information of the transmission protocol and functional information, seen from this protocol.
[0110] In a variant, which will be described below, the data transfer link 18 is a link implementing a data transfer protocol using messages which allow the atomic transmission of several words 50, some containing exclusively management information of the transmission protocol and the others exclusively functional information, seen from this protocol.
[0111] An example of a data transfer protocol using 50 words is shown in [Fig.4]. This protocol is advantageously implemented in an ARINC 429 link.
[0112] Each word 50 is defined by a sequence of bits forming a word, having a predefined number of bits. Word 50 for ARINC 429, has thirty-two bits.
[0113] As explained above, it is commonly referred to by the term “ARINC 429 word”, or even “label”.
[0114] The word 50 is divided into separate fields. In the example shown in [Fig.4], the word 50 includes a field 52 for identifying the word (ID), and advantageously, a field 54 for identifying the receiver and / or the subsystem having transmitted the data (optional SDI field in the ARINC 429 standard). The word 50 further includes a field 56 containing the data (D) transported by the word, a field 58 for data validity (SSM) or sign / direction (e.g. + / - or North / South, East / West), and a parity field (P) 60.
[0115] Field 52 contains an identification of the word, with standardized semantics defined when the word was developed.
[0116] Field 54 (optional) is generally intended to define which receiver of the data the word is intended for, or which subsystem of the transmitter transmitted the data.
[0117] Field 56 contains the data to be transmitted by word 50. In this example it has nineteen bits.
[0118] Field 58 contains an identifier that can possibly serve as data validity, generated by the data producing system 14, making it possible to identify whether the data producing system 14 considers that the data is valid or whether, on the contrary, it considers that it is no longer valid.
[0119] The parity field 60 is a calculation of the binary sum of all the bits of fields 52, 54, 56 and 58 to determine the parity of the sum.
[0120] In the case where the transfer link 18 is a link implementing words 50, the capsule size 40 is generally larger than the size of field 56 of the data carried by a word 50.
[0121] As illustrated by [Fig.3], the capsule 40 is thus emitted on a plurality of distinct words 50A to 50F by distributing the identifier 42, the refresh indicator 44, the functional data 46 and the integrity check result 48A in the fields 56 of several words 50A to 50F.
[0122] Preferably, at least a first identification word 50A contains the identifier 42 of the capsule 40 and / or the refresh indicator 44. Advantageously, the word 50A contains both the identifier 42 of the capsule 40, and the refresh indicator 44.
[0123] Preferably, to limit the bandwidth consumed, the identifier 42 of the capsule 40 is formed by the identification field 52 of the word 50A, and by the identification field 54 of the receiver and / or the subsystem having transmitted the data. This is possible by establishing a correspondence table between each capsule 40 and the successive identifiers of the words 50A to 50F used to transmit the capsule 40.
[0124] For example, if each capsule 40 corresponding to a functional data elaboration is emitted on N words 50, the N successive identifiers of the N words 50 are associated with the capsule 40.
[0125] The refresh indicator 40 is coded in binary form in field 56 of word 50A, for example using 16 of the 19 bits available in field 56.
[0126] In a variant (not shown), the word 50A contains the identifier 42 of the capsule 40, for example in the field 56 and another identification word (not shown) distinct from the word 50A contains the refresh indicator 44 in the field 56.
[0127] Depending on the size of the functional data packet 46 produced at each functional data generation, the functional data packet 46 is transmitted on at least one functional data word 50B to 50D, generally on several functional data words 50B to 50D.
[0128] The data of the functional data packet 46 are distributed over the fields 56 of the word(s) 50B to 50D which contain only functional data.
[0129] The functional data words 50B to 50D do not contain the refresh indicator 44 or the result of the integrity test 48A. The identifier of each word 50B to 50D makes it possible to identify to which capsule 40 the functional data contained in the field 56 of the word 50B to 50D belong.
[0130] The integrity check result 48A of each capsule 40 is transmitted on at least one integrity check word 50E, 50F, advantageously on two integrity check words 50E, 50F, when it comprises thirty-two bits, whereas the field 56 of each word 50E, 50F contains only 19 bits.
[0131] The capsule 40 thus created is then transferred via the transfer link 18 by distributing it over several words 50A to 50F, to adapt to the transfer protocol present in the aircraft 12.
[0132] For this purpose, with reference to [Fig. 1], the first data producing system 14 comprises a module 70 for producing functional data 46 and associating it with an identifier 42 of a capsule 40 and with a refresh indicator 44, and a formatting module 74 for transferring data via the transfer link 18.
[0133] The second data producing system 15 comprises a module 70A for producing second functional data 46A and associating it with an identifier 42A and with a refresh indicator 44A, the second functional data 46A, the identifier 42A and the refresh indicator 44A produced by the second data producing system 15 being intended to be identical respectively to the first functional data 46, to the identifier 42 and to the refresh indicator 44 produced by the first data producing system 14 at each production of data.
[0134] The second data producing system 15 further comprises a module 72A for calculating an integrity check result 48A, established on the identifier 42A, the refresh indicator 44A, and the data packet 46A, at each production of functional data, and a formatting module 74A for transferring the integrity check result 48A via the secondary transfer link 19.
[0135] The data processing module 70, 70A is capable of generating functional data as defined above, or of retrieving application functional data from other aircraft systems, via an application layer. The functional data are processed at successive times, on request or at a predefined functional data processing frequency.
[0136] The functional data are distinct from the transport data (e.g. word identifier) necessary to implement the transfer link 18.
[0137] The data processing module 70, 70A is thus capable of creating a functional data packet 46, 46A for each data processing, of generally identical size for each data processing. It is capable of associating with each functional data packet 46, 46A processed, an identifier 42, 42A making it possible to identify the functional content of the functional data packet 46, 46A, its producer, and the belonging of the functional data packet 46, 46A to a capsule 40, using a correspondence table.
[0138] As indicated above, the identifier 42, 42A further advantageously defines the size of the capsule 40, the size of the data packet 46, 46A and the position of the integrity checksum 48A, using the correspondence table.
[0139] The data processing module 70 is furthermore capable of associating, with each ela functional data processing, independently of the transmission frequency via the link 18, a refresh indicator 44, 44A. The refresh indicator 44, 44A guarantees that the data transmitted via the transfer link 18 are indeed valid data having been refreshed. The refresh indicator 44, 44A is coded on a determined number of bits, for example between 1 and 32.
[0140] In the case of an incremented counter, the refresh indicator 44, 44A is capable of resetting to zero when the maximum of the refresh indicator has been reached.
[0141] The module for calculating an integrity check result 72A is capable of developing a memory representation 80 of the identifier 42A, the refresh indicator 44A and the data packet 46A at the application layer level, independently of the transport layers. An example of memory representation 80 is illustrated in [Fig.5]. This memory representation corresponds to a transport in the form of words 50.
[0142] With reference to [Fig. 5], the bits intended for the identifier and / or refresh indicator word 50A and for the data words 50B to 50D on which the capsule 40 is transmitted are distributed in the form of lines, each line corresponding to a word (ARINC 429 word for example in the case of an ARINC 429 link) in a table having a number of columns corresponding to the number of bits in each word.
[0143] The bits specific to the transmission protocol in each word 50A to 50D are voluntarily forced in the memory representation 80 to a chosen bit, for example to a zero bit.
[0144] For example, on the first line 82A of the table of the memory representation 80 corresponding to the identifier and / or refresh indicator word 50A, only the bits of the identifier 42A and the refresh indicator 44A are kept at their value. The same applies to each functional data transport word 50B to 50D, corresponding to the lines 82B to 82D, in which the bits corresponding to the word identifier, to the SDI field, and to the parity calculation, are voluntarily forced to a chosen bit, here a zero bit.
[0145] Only the functional data 46A, the identifier 42A and the refresh indicator 44A are kept in the memory representation 80.
[0146] Thus, the memory representation 80 makes it possible to test the integrity of the identifier 42, and of the refresh indicator 44, coming from the first data producer system 14 and received by the data consumer system 16, thanks to the first line 82A of the representation, which is representative of the identifier 42A and of the refresh indicator 44A generated by the second data producer system. The memory representation 80 also makes it possible to test the integrity of the functional data packet 46, coming from the first data producer system data 14 and received by the data consumer system 16, thanks to the distribution of the second functional data packet 46A on the lines 82B to 82D, integrating the data validity fields 58.
[0147] Once this memory representation 80 has been constructed, the integrity result calculation module 72A is able to implement a calculation of checksum, and / or cyclic redundancy code as defined above.
[0148] For example, to ensure good reliability of the integrity check, the integrity calculation result 48A is obtained by a MIL-STD-1760 checksum, or by a CRC-32K / 6.4 cyclic redundancy code. The check result is coded, in this example, on thirty-two bits.
[0149] The formatting module 74A of the second data producing system 15 is then capable of transmitting the integrity check result 48A to the first data producing system 14, advantageously in the form of a plurality of words 50, as described previously, but not necessarily.
[0150] The formatting module 74 of the first data producing system 14 is then capable of transmitting each capsule 40 corresponding to a production of functional data, in the form of a plurality of words 50A to 50F, as described previously.
[0151] In the case in particular of an ARINC 429 type link, the identifiers of the words 50A to 50F corresponding to a given capsule 40 are advantageously generated according to a predefined semantics, so that if the words 50A to 50F are sent out of order, or if other words 50G not belonging to the capsule 40 are interposed between the words 50A to 50F of the capsule 40 in a discontinuous manner, the capsule 40 can be reconstituted by the data consuming system 16 based on the predefined semantics.
[0152] The data consuming system 16 comprises a module 90 for receiving and processing each capsule 40, a module 92 for verifying the integrity of the capsule 40 and a module 94 for verifying the validity of the data in the capsule 40.
[0153] The capsule reception module 90 is capable of reconstituting each capsule 40, in particular by identifying the different words 50A to 50F of the capsule 40 received via the transfer link 18 via their identification field 52.
[0154] Once the capsule 40 has been reconstituted, it is capable of extracting the identifier 42, the refresh indicator 44 and the data packet 46 corresponding to the capsule 40.
[0155] The capsule reception module 90 is capable of carrying out an authentication check of the data producing system 14 by verifying, from the identifier 42, whether the data received actually comes from the expected data producing system 14.
[0156] Also from the identifier 42 of capsule 40, and in the case of a capsule 40 of fixed size, the capsule reception module 90 is able, using the same correspondence table as that of the data producing system 14, to know the size of the capsule 40, the position of the refresh indicator 44, of the functional data packet 46 and of the integrity check result 48A within the capsule 40.
[0157] The integrity verification module 92 is capable of reconstituting the same memory representation 80 as that produced by the second data producing system 15, from the data recovered from the capsule 40 which were transferred by the transfer link 18.
[0158] It is capable of applying the same algorithm as that implemented by the integrity results calculation module 72A of the second data producing system 15 to calculate a new integrity check result relating to the received data, including the identifier 42, the refresh indicator 44 and the packet of first functional data 46 generated by the first data producing system 14 and transferred via the transfer link 18.
[0159] The integrity verification module 92 is capable of determining that the capsule 40 comprising the identifier 42, the refresh indicator 44 and the data packet 46 is in an intact state, if the new integrity check result that it has calculated from the received data is identical to the integrity check result 48A calculated by the second data producing system 15, extracted from the capsule 40.
[0160] It is suitable for determining that the capsule 40 including the identifier 42, the refresh indicator 44 and the data packet 46 is in a corrupted state, if the new integrity check result that it has calculated from the received data is different from the integrity check result 48A calculated by the second data producing system 15.
[0161] Thus, it is not necessary for the first data producing system 14 to itself produce an integrity check result, nor for the identifier 42A, the refresh indicator 44A and the data packet 46A produced by the second data producing system 15 to be transmitted to the data consuming system 16.
[0162] Any difference between the functional data 46, 46A, the identifiers 42, 42A, and the refresh indicators 44, 44A produced by the first data producing system 14 and the second data producing system 15 is detectable, since the new integrity check result calculated by the data consuming system 16 is then different from the integrity check result 48A calculated by the second data producing system 15.
[0163] Similarly, any corruption of data during transfer over the transfer link 18 or on the secondary transfer link 19 will be detectable, the new integrity check result calculated by the data consumer system 16 also being different from the integrity check result 48A calculated by the second data producer system 15.
[0164] This highly reliable integrity detection is achieved without having to provide complete data transfer redundancy between the data producing systems 14, 15 and the data consuming system. A single transfer link 18 is required for at least two data producing systems 14, 15, thereby reducing the physical lines on the aircraft without affecting the bandwidth.
[0165] Once the integrity of the refresh indicator 44 has been confirmed, the validity verification module 94 is able to evaluate the refreshing of the data contained in the capsule 40 by carrying out a refresh check on the basis of the refresh indicator 44.
[0166] For this purpose, it is suitable for comparing the refresh indicator 44 of each capsule 40 received with the refresh indicator 44 received from a previous capsule 40 to verify that the refresh indicator 44 has been refreshed, for example by having been incremented, or decremented, or by having followed an expected refresh evolution.
[0167] The validity verification module 94 is suitable, for example, for calculating the refresh increment between the refresh indicator 44 of the capsule 40 received, and the refresh indicator 44 of the capsule 40 received just before.
[0168] In the case in particular of a counter or a downcounter, if the increment is unitary in absolute value, the validity verification module 94 is capable of determining that the functional data present in the capsule 40 are indeed refreshed data and of placing the capsule 40 in an expected refresh state.
[0169] In the case of a transmission frequency via the link 18 or acquisition of the data by the data consuming system 16 higher than the frequency of processing of the functional data by the data producing system 14, the validity verification module 94 is capable of authorizing a zero refresh increment on a determined number of capsules 40, calculated for example as a function of the processing, transmission or acquisition frequencies of the capsules 40.
[0170] Beyond the determined number of capsules 40, if the refresh indicator 44 remains identical, it is capable of putting the capsule 40 into an inadequate refresh state, because its data has not been refreshed.
[0171] Furthermore, when the frequency of production and / or transmission of the capsules 40 is greater than the frequency of acquisition of the capsules 40, the validity verification module 94 is capable of authorizing an increment of refresh indicator either greater than one.
[0172] In all cases, the validity verification module 94 is capable of storing the refresh indicator of each capsule 40 just received, to allow an increment calculation when the next capsule 40 is received.
[0173] It is also suitable for taking into account the resetting of the refresh indicator 44, when the latter reaches its maximum value.
[0174] Thus, depending on the increment calculated between the refresh indicators 44 of two successive capsules 40, the validity verification module 94 is able to determine whether the functional data present in the capsule 40 are indeed refreshed data that can be used by the consumer system 16, and to put the capsule 40 into an expected refresh state. If, on the contrary, the data are not refreshed or if unreceived intermediate data are missing, it is able to put the capsule 40 into an inadequate refresh state.
[0175] When the capsule 40 comes from the expected data producer system 14, 15, when it is in the integrated state and when it is in the expected refresh state, the functional data that it contains are considered valid and are then suitable for use by the consumer system 16, or for transmission to another aircraft system for use.
[0176] When a capsule 40 does not come from the expected data producing system 14, or when it is in the corrupted state or in an inadequate refresh state, the validity verification module 94 is able to exclude the data coming from the capsule 40, which are considered invalid.
[0177] The validity verification module 94 is advantageously capable of implementing a resetting phase, for a given resetting duration corresponding for example to the reinitialization of a computer or to the stopping of a transient failure.
[0178] In this case, as soon as a new capsule 40 is received, coming from the expected data producer system 14 and being in the intact state, the validity verification module 94 is able to memorize the new value of the refresh indicator 44 of this capsule 40. Then, it is able to recover the refresh indicator 40 of each new capsule 40 arriving, to determine a refresh increment. If the refresh increment reflects an expected refresh state, the validity verification module 94 is able, after the predefined rearmament duration, to put the capsules 40 back into the valid state.
[0179] In certain cases, if the integrity or refresh failure affecting the data contained in the capsules 40 is persistent, that is to say that it occurs regularly or arbitrarily, the validity verification module 94 is capable of definitively stopping the rearming and declaring the data transfer system data 10 in default.
[0180] In operation, the first data producing system 14 and the second data producing system 15 simultaneously produce, by their functional data 46, 46A producing modules 70, 70A, a capsule identifier 42, 42A, a refresh indicator 44, 44A updated at each production of functional data, independently of the data transmission frequency in the transfer link 18, and a functional data packet 46, 46A. The second functional data 46A, the identifier 42A and the refresh indicator 44A produced by the second data producing system 15 are intended, in normal operation, to be identical respectively to the first functional data 46, to the identifier 42 and to the refresh indicator 44 produced by the first data producing system 14 at each production of data.
[0181] Then, the module for calculating an integrity check result 72A of the second data producing system 15 develops a memory representation 80 of the identifier 42A, of the refresh indicator 44A and of the data packet 46A. It then implements a calculation of a checksum, or / and of a cyclic redundancy code as defined above, on the memory representation 80 to obtain an integrity check result 48A.
[0182] The formatting module 74A of the second data producing system 15 then transmits the integrity check result 48A to the first data producing system 14 via the secondary transfer link 19.
[0183] The formatting module 74 of the first data producing system 14 then emits each capsule 40 corresponding to a production of functional data, preferably in the form of a plurality of words 50A to 50F, as described previously.
[0184] The capsule 40 comprises the capsule identifier 42 produced by the first data producing system 14, the refresh indicator 44, updated by the first data producing system 14 at each production of functional data, independently of the frequency of transmission of the data in the transfer link 18, and the packet 46 of first functional data produced by the first data producing system 14 during a functional production of data.
[0185] The capsule 40 further comprises an integrity check result 48A, calculated by the second data producing system 15, as explained above.
[0186] After reception of the capsule 40 by the capsule reception module 90, the integrity verification module 92 reconstitutes the same memory representation 80 as that produced by the second data producing system 15, from the data recovered from the capsule 40 which were transferred by the transfer link 18.
[0187] It applies the same algorithm as that implemented by the integrity results calculation module 72A of the second data producing system 15 and calculates a new integrity check result relating to the received data, including the identifier 42, the refresh indicator 44 and the first functional data packet 46 generated by the first data producing system 14 and transferred via the transfer link 18.
[0188] The integrity verification module 92 then determines that the capsule 40 comprising the identifier 42, the refresh indicator 44 and the data packet 46 is in an intact state, if the new integrity check result that it has calculated from the received data is identical to the integrity check result 48A calculated by the second data producer system 15, extracted from the capsule 40.
[0189] It determines that the capsule 40 including the identifier 42, the refresh indicator 44 and the data packet 46 is in a corrupted state, if the new integrity check result that it has calculated from the received data is different from the integrity check result 48A calculated by the second data producing system 15 extracted from the capsule 40.
[0190] In a variant, the second data producing system 15 produces a second capsule 40A containing the identifier 42A, the refresh indicator 44A, the second functional data 46A and the integrity check result 48A. This second capsule is transferred via the data link 19 to the first data producing system 14. The data producing system 14 then transmits the capsules 40 and 40A via the data link 18 to the data consuming system 16.
[0191] In this case, the data consuming system 16 performs the aforementioned checks on the capsules 40 and 40A, then compares each data item from the capsule 40 with the corresponding data item from the capsule 40A to ensure that they are consistent (comparison with threshold for example).
[0192] If so, the consistent data can be used by the data consuming system 16.
[0193] In a variant, not shown, the capsule 40 is transmitted through a transmission protocol using messages consisting of several consecutive words 50, generally sent in atomic form, one after the other.
[0194] Generally, at least one word 50 of each message contains just transmission protocol management information. The capsule 40 is then distributed over several words 50 of the same message not containing transmission protocol management information, unlike the protocol described above in which each word 50 contains transmission protocol management information.
[0195] One or more words of the same message then contain the capsule identifier 42 and the refresh indicator 44, one or more words of the same message contain the functional data 46 and one or more words of the same message contain the integrity check result 48A, calculated from the identifier 42, the refresh indicator 44 and the data packet 46 of the capsule 40.
[0196] In yet another variant (not shown), each capsule 40 is distributed over a plurality of messages by distributing the capsule identifier 42, the refresh indicator 44, the functional data 46 and the integrity check result 48 over words of the plurality of messages.
[0197] In another variant (not shown), the capsule 40 is devoid of functional data 46. The capsule 40 as such then comprising the capsule identifier 42, the refresh indicator 44, and the result 48A of integrity control relating to the identifier 42A and to the refresh indicator 44A is then the equivalent of a signal to trigger or validate an action. The data transmitted by the capsule 40 is then the presence or absence of the capsule 40.
Claims
Claims
1. Data transfer system (10) for an aircraft (12), comprising: - a first data producing system (14), capable of producing, at successive times, first data (46); - a second data producing system (15), redundant and preferably synchronous with the first data producing system (14), the second data producing system (15) being capable of advantageously producing at successive times, second data (46A), intended to be identical to the first data (46); - at least one data consuming system (16), capable of receiving and using the first data (46); at least one of the first data producing system (14), the second data producing system (15) and the or each data consuming system (16) being on board an aircraft (12); - a data transfer link (18) between the first data producing system (14) and the or each data consuming system (16), the first data producing system (14) being able to transfer the first data (46) to the or each data consuming system (16) via the data transfer link (18);characterized in that the second data producing system (15) is capable of producing an integrity check result (48A) relating at least to the second data (46A), the integrity check result (48A) being intended to be transmitted to the or each data consuming system (16), the or each data consuming system (16) being capable of recovering the first data (46) transferred from the first data producing system (14) and the integrity check result (48A) produced by the second producing system, the or each data consuming system (16) being capable of checking the integrity of the first data (46), by establishing a new integrity check result from the first data (46) and by comparing the new integrity check result with the integrity check result (48A) produced by the second data producing system (15).;
2. A transfer system (10) according to claim 1, wherein the second data producing system (15) is adapted to transmit the integrity check result (48A) relating to the second data (46A) to the first data producing system (14).
3. A transfer system (10) according to claim 2, wherein the first data producing system (14) is adapted to transfer the integrity check result (48A) from the second data producing system (15) through the data transfer link (18).
4. A transfer system (10) according to any one of claims 2 to 3, wherein the data transfer link (18) exclusively connects the first data producing system (14) to the or each data consuming system (16), with no data transfer link connecting the second data producing system (15) to the or each data consuming system (16).
5. A transfer system (10) according to any one of claims 2 to 4, wherein the second data producing system (15) is incapable of directly transferring the second data (46A) to the or each data consuming system (16) without passing through the first data producing system (14).
6. Transfer system (10) according to any one of the preceding claims, in which the first data producer system (14) is capable of generating, at each data generation, a data capsule (40), each data capsule (40) comprising: - an identifier (42) of the data producer, a refresh indicator (44) updated at each data generation, possibly a packet of first functional data (46), generated by the first data producer system (14);and - the integrity check result (48A) of the data produced by the second data producing system (15), the or each data consuming system (16) being able to recover each data capsule (40) to extract the identifier (42), the refresh indicator (44), possibly the packet of first functional data (46), produced by the first data producing system (14) and the integrity check result (48A) generated by the second data producing system (15).;
7. Transfer system (10) according to claim 6, in which the second data producing system (15) is capable of generating, at each data generation, an identifier (42A) of the data producer intended to be identical to the identifier (42) generated by the first data producing system (14), a refresh indicator (44A), varying with each data generation, intended to be identical to the refresh indicator (44) generated by the first data producing system (14), the integrity check result (48A) being calculated from the identifier (42A) of the data producer, the refresh indicator (44A) and possibly second functional data (46A), generated by the second data producing system (15).
8. A transfer system (10) according to any one of claims 6 or 7, wherein the transfer link (18) implements a transfer protocol generating words (50), each data capsule (40) being transmitted using a plurality of words (50A to 50F).
9. Transfer system (10) according to any one of claims 6 to 8, wherein the plurality of words (50A to 50F) comprises: at least one identification word (50A) comprising the identifier (42) and / or the refresh indicator (44), optionally at least one functional data word (50B to 50D) containing first functional data of the functional data packet (46), and at least one integrity verification word (50E, 50F), containing the integrity check result (48A) produced by the second data producing system (15).
10. Transfer system (10) according to any one of claims 6 to 9, in which the second data producer system (15) is capable of developing the integrity check result (48A) by adopting a memory representation (80) from the data to be distributed in the words (50A to 50F) intended to transfer the data capsule (40), the or each data consumer system (16) being capable of reconstituting the memory representation (80) developed by the data producer system (14) from the data recovered from the words (50A to 50F) of the data capsule (40).
11. A transfer system (10) according to any preceding claim, wherein the integrity check result (48A) is a checksum or a cyclic redundancy code.
12. Data consuming system (16), intended to be used in a data transfer system (10) of an aircraft (12), the data transfer system (10) comprising a first data producing system (14), capable of producing, at successive times, first data (46) and a second data producing system (15), redundant and preferably synchronous with the first data producing system data (14), the second data producing system (15) being capable of advantageously producing at successive times, second data (46A), intended to be identical to the first data (46) the or each data consumer system (16) being capable of recovering the first data (46) transferred from the first data producer system (14) and an integrity check result (48A) produced by the second producer system relating to the second data (46A), the or each data consumer system (16) being capable of checking the integrity of the first data (46), by establishing a new integrity check result from at least the first data (46) and by comparing the new integrity check result with the integrity check result (48A) produced by the second data producer system (15).
13. A method of transferring aircraft data (12) comprising the following steps: - production, at successive times, of first data (46) by a first data producing system (14); - development, advantageously at successive times, of second data (46A), intended to be identical to the first data (46) by a second data producing system (15), redundant and preferably synchronous with the first data producing system (14); - transfer of the first data (46) via a data transfer link (18) between the first data producing system (14) and the or each data consuming system (16); - reception and use of the first data (46) by at least one data consuming system (16); at least one of the first data producing system (14), the second data producing system (15) and the or each data consuming system (16) being on board an aircraft (12); characterized by the following steps: - development by the second data producing system (15) of an integrity check result (48A) relating to the second data (46A); - transfer of the integrity check result (48A) to the or each data consuming system (16); - recovery by the or each data consuming system (16) first data (46) transferred from the first data producing system (14) and the integrity check result (48A) produced by the second producing system; - integrity check of the first data (46) by the or each data consumer system (16), by establishing a new integrity check result from at least the first data (46) and by comparing the new integrity check result with the integrity check result (48A) produced by the second data producer system (15).
14. The method of claim 13, wherein the first data (46) produced by the first data producing system (14) and the integrity check result (48A) produced by the second data producing system (15) are transmitted through the data transfer link (18), the second data (46A) produced by the second data producing system (15) not being transmitted directly to the or each data consuming system (16) without passing through the first data producing system (14).
15. The method of claim 14, wherein the first data producing system (14) generates, at each data generation, a data capsule (40), each data capsule (40) comprising: - an identifier (42) of the data producer, a refresh indicator (44) updated with each data generation, possibly a packet of first functional data (46), generated by the first data producer system (14); and - the integrity check result (48A) of the data produced by the second data producing system (15), the method comprising the recovery, by the or each data consuming system (16) of each data capsule (40) to extract the identifier (42), the refresh indicator (44), possibly the packet of first functional data (46), produced by the first data producing system (14) and the integrity check result (48A) produced by the second data producing system (15).