Method for communicating an indication of correct operation between two isolated processors

Abstract

One aspect of the invention relates to a method (3) for communicating a first processor (12) implementing a maintenance function of a second processor (11), the second processor (11) implementing a control function of a motor, the first processor (12) and the second processor (11) being isolated in communication by an FPGA (21), the FPGA (21) comprising: a first bidirectional link (L1) with the second processor (11), a second unidirectional link (L2) to the first processor (12), a third unidirectional link (L3) from the first processor (12), the method (3) comprising: Reception (31), by the FPGA (21), of a frame sent by the first processor (12), Evaluation (33), by the FPGA (21), of a predefined parameter to obtain a value of the predefined parameter depending on the received frame, Access (34), by the second processor (11), to the value of the predefined parameter, via the FPGA (21). Figure to be published with the abstract: Figure 3

Description

Title of the invention: Method for communicating an indication of correct operation between two isolated processors TECHNICAL FIELD OF THE INVENTION

[0001] The technical field of the invention is that of cybersecurity, and in particular secure communication between on-board devices in aeronautics.

[0002] The present invention relates to a method of communication between two isolated processors and in particular a method of communication in which one of the two processors isolated for cybersecurity reasons is aware of a state of the other processor despite their isolation. TECHNOLOGICAL BACKGROUND OF THE INVENTION

[0003] Conventionally, in aircraft, an engine is controlled by a computer called "FADEC", from the English "Full Authority Digital Engine Control" for "Full Authority Digital Engine Control" in French. The FADEC interfaces between the cockpit of the aircraft and an engine of the aircraft, ensures electronic protection of the engine and reduces the pilot's load. It allows the aircraft's propulsion system to be monitored, protected and controlled in real time.

[0004] A FADEC is shown in [Fig.l]. The FADEC 1 comprises at least two processors: a first processor 11 performing an engine FC control function, and a second processor 12 performing an FM maintenance function. The maintenance processor 12 makes it possible to maintain, for example to correct or update, the FC control function and therefore the control processor 11. Data from engine sensors can be sent, for example, by the control processor 11 to the maintenance processor 12. The maintenance processor 12 then stores the received data for analysis after the flight of the aircraft, for example by a maintenance operator. In such a case, the maintenance processor 12 must also inform the control processor 11 that the maintenance processor 12 is ready to receive data to be stored.

[0005] With the arrival of new cybersecurity standards applicable to aeronautical equipment, the FM maintenance function also has the role of cybersecurity barrier, isolating the FC control function, which is a critical function, from the outside world. Indeed, a malicious actor could want to take control of the FC control function via the FM maintenance function. The barrier function of the FM maintenance function makes it possible to overcome this problem.

[0006] This barrier function implies that a communication from the maintenance processor 12 to the control processor 11 is cut off in operational mode, that is, when the control processor 11 actually controls the engine. Communication from the control processor 11 to the maintenance processor 12 must, however, be maintained in order to continuously record the flight parameters. These conditions are met by adding an FPGA. An FPGA, from the English "Field-programmable gate array" for "programmable logic networks" in French, is a simple programmable electronic circuit. The FPGA, as shown in [Fig.l], is an intermediary between the control processor 11 and the maintenance processor 12.

[0007] The processors 11 and 12 and the FPGA are connected by links L1 to L3, which are for example, and without limitation, links of the ethernet, CAN, UART, SPI, I2C type, etc., as well known to those skilled in the art. The links L1 to L3 may also be called “links”.

[0008] [Fig.l] shows an embodiment of the FADEC in maintenance mode. [Fig.2] shows an embodiment of the FADEC in operational mode.

[0009] In operational mode, the cutoff of the L3 link makes it possible to prevent a malicious actor from controlling the control function FC of the control processor 11 via the maintenance function FM of the maintenance processor 12. The cutoff is a software cutoff, that is to say that, via the link L1, the processor 11 does not have access to the data sent by the processor 12 via the link L3. The link L3 can for example be functional, but the FPGA can then not listen to the link and therefore not read the data received via the link L3. In operational mode, the link L2 is functional, to be able to indicate to the maintenance processor 12 that the control function 11 implemented by the control processor 11 is functioning correctly.

[0010] The interruption of the L3 communication from the maintenance processor 12 to the control processor 11 has an undesirable consequence for the control processor 11: in operational mode, the control processor 11 does not know whether the FM maintenance function implemented by the maintenance processor 12 is functioning correctly.

[0011] A solution provided in the prior art is to add a communication link L4 directly between the control processor 11 and the maintenance processor 12. This link L4 is a link allowing only predefined discretes to be transmitted, and only in one direction: from the maintenance processor 12 to the control processor 11. This link L4 comprises for example one electrical wire per discrete transmitted, the discretes then being interpreted by the control function FC receiving them. These predefined discretes, also called TV life indicators, can for example indicate the state of the maintenance processor 12. The two processors 11 and 12 are then always isolated from the cybersecurity point of view, because it is considered that sending erroneous or malicious discretes or sending predefined discretes does not disrupt the control function FC of the control processor 11. This solution is not satisfactory in that it requires a different architecture and additional components, and special programming of the FC control function to learn how to manage these TV life indicators. This then penalizes the reliability and volume of the FADEC.

[0012] Furthermore, this solution is not very robust to simple failures. Indeed, a failure of the FM maintenance function can lead, combined with electrical noise, to behavior similar to a case without failure. The failure will then not be detected by the FC control function. It would be possible to improve the detection, by using a precise duty cycle and / or frequency of change of the discrete, but this requires the implementation of a more complex detection function.

[0013] There is therefore a need in a FADEC, for the control function, to have access to information concerning the state of the maintenance function in operational mode without adding components specific to the transmission of this information. Summary of the invention

[0014] The invention offers a solution to the problems mentioned above, by allowing the control function of a FADEC to have access to reliable information concerning the state of the maintenance function without adding components specific to the transmission of this information.

[0015] One aspect of the invention relates to a method for communicating an indication of correct operation by a first processor to a second processor, the first processor implementing a maintenance function of the second processor, the second processor implementing a control function of a motor, the first processor and the second processor being isolated in communication by an FPGA, the FPGA comprising: • a first bidirectional communication link with the second processor, • a second unidirectional communication link from the FPGA to the first processor, • a third unidirectional communication link from the first processor to the FPGA, the method comprising at least the steps of: • Reception, by the FPGA, via the third link, of at least one frame sent by the first processor, • Evaluation, by the FPGA, of a predefined parameter to obtain a value of the predefined parameter, the value of the predefined parameter depending on the frame received, • access, by the second processor, via the first link, to the value of the predefined parameter, via the FPGA.

[0016] Thanks to the invention, it is possible, for a processor implementing a motor control function, to know the state of a maintenance processor implementing a maintenance function. The invention allows the control processor to have the state of the maintenance processor while maintaining the link between the two processors cut by the FPGA which isolates them in communication.

[0017] By "two isolated processors in communication by the FPGA" is meant the fact that each communication from one of the two processors intended for the other of the two processors is necessarily received by the FPGA then transmitted by the FPGA to the destination processor according to a communication policy. Thanks to this isolation, in operational mode, the maintenance processor cannot transmit communication to the control processor because the FPGA is configured not to transmit communications in this direction.

[0018] The invention, by not transmitting the communications from the maintenance processor intended for the control processor, makes it possible to maintain this isolation, necessary to guarantee a high level of security. By transmitting a parameter dependent on the communications received, the invention makes it possible not to transmit the communications received, therefore to maintain the isolation, while informing the control processor of the state of the maintenance processor, and this without additional architecture compared to the already existing system.

[0019] In addition to the characteristics which have just been mentioned in the preceding paragraph, the method according to one aspect of the invention may have one or more complementary characteristics among the following, considered individually or according to all technically possible combinations: • the FPGA is configured to implement an operational mode in which the frames received via the third link are deleted by the FPGA after the evaluation step, and a maintenance mode in which the frames received via the third link are stored by the FPGA after the reception step, the method being implemented in operational mode. • the parameter is a counter of the number of frames received, the counter being incremented with each new frame reception. • the method further comprises, before the evaluation step, a step of verification, by the FPGA, of the integrity of each frame received via the third link, the evaluation step being carried out, for each frame received, only if the received frame is intact. • the integrity verification step includes the evaluation of a cyclic redundancy check included in the frame or a checksum included in the frame. • the engine controlled by the control function is an aircraft engine.

[0020] Another aspect of the invention relates to a system configured to implement the method according to the invention, the system comprising: • an aircraft engine, • a first processor • a second processor, • an FPGA comprising: • a first bidirectional communication link with the second processor, • a second unidirectional communication link from the FPGA to the first processor, • a third unidirectional communication link from the first processor to the FPGA, • the first processor implementing a maintenance function of the second processor, the second processor implementing an aircraft engine control function, the first processor and the second processor being isolated in communication by the FPGA.

[0021] Another aspect of the invention relates to a computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement the method according to the invention.

[0022] Another aspect of the invention relates to a computer-readable recording medium comprising instructions which, when executed by a computer, cause the latter to implement the method according to the invention.

[0023] The invention and its various applications will be better understood upon reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0024] The figures are presented for information purposes only and in no way limit the invention. • [Fig.l] shows a schematic representation of a state-of-the-art system in maintenance mode. • [Fig.2] shows a schematic representation of a state-of-the-art system in operational mode. • [Fig.3] shows a schematic representation of a system implementing the method according to the invention. • [Fig.4] shows a schematic representation of the method according to the invention. DETAILED DESCRIPTION

[0025] Unless otherwise specified, the same element appearing in different figures presents a unique reference.

[0026] [Fig.3] shows a schematic representation of a system according to the invention.

[0027] The system 2 according to the invention comprises a first processor 12 and a second processor 11. The first processor 12 implements a maintenance function of the second processor 11. It will thus be called “maintenance processor 12”. The second processor 11 implements a function for controlling an engine. It will thus be called “control processor 11”. The controlled engine is for example an aircraft engine. The system 2 is then embedded in the aircraft comprising the aircraft engine.

[0028] A processor implements a function when it executes instructions stored by a memory, the instructions causing the processor to implement method steps corresponding to the function to be implemented.

[0029] The control processor 11 and the maintenance processor 12 are separated by an FPGA 21, which isolates the two processors 11 and 12 in communication, that is to say that the two processors 11 and 12 can only communicate via the FPGA 21.

[0030] The FPGA 21 allows the two processors 11 and 12 to communicate via the communication links L1 to L3, as in the prior art. The FPGA 21 is then configured to transmit, or not, the frames from one processor to the other processor, thus performing the function of isolating the communicating processors 11 and 12.

[0031] System 2 comprises: • a first bidirectional communication link L1 between the FPGA 21 and the control processor 11, • a second unidirectional L2 communication link from the FPGA 21 to the maintenance processor 12, • a third unidirectional L3 communication link from the maintenance processor 12 to the FPGA 21.

[0032] The FPGA 21 comprises a data reception function Rx via the third link L3 and a data transmission function Tx via the second link L2.

[0033] The system 2 can operate in operational mode and in maintenance mode.

[0034] In maintenance mode, all communication links L1 to L3 are functional, that is to say, they can allow the transit of a communication.

[0035] In operational mode, the L3 link is cut by the FPGA, this cut not being physical but software. The cut is a software cut, that is to say that, via the L1 link, the processor 11 does not have access to the data sent by the processor 12 via the L3 link. The L3 link may for example be in a physical state to transmit communications, but the FPGA may then not read on the link and therefore not read the data received via the L3 link. In operational mode, the L2 link is functional, for be able to indicate to the maintenance processor 12 that the control function 11 implemented by the control processor 11 is operating correctly. The data reception function Rx is stopped in operational mode.

[0036] “Correct operation” or “operates correctly” means “normal” or “expected” operation, i.e., operation that meets an operating standard.

[0037] The mode change is carried out by controlling the FPGA 21, which implements for this purpose a mode change function of the system 2. The control from one mode to the other among the operational and maintenance modes of the FPGA 21 is implemented by the control processor 11.

[0038] The method according to the invention is shown in [Fig.4] and comprises at least three steps. The method according to the invention is implemented by the system 2.

[0039] The method 3 according to the invention allows the control processor 11 to have access to an operating indicator of the maintenance processor 12 in operational mode. According to the invention, the operating indicator of the maintenance processor 12 is created by the FPGA 21, from frames sent by the maintenance processor 12.

[0040] For this, the method 3 according to the invention comprises a first step 31 of reception, by the FPGA 21, of at least one frame sent by the maintenance processor 12. This frame is sent by the maintenance processor 12 via the third unidirectional link L3. The communication links L1 to L3 comply with a communication protocol, for example chosen from Ethernet, CAN, UART, SPI, I2C etc. The frame sent by the maintenance processor 12 complies with the same protocol. The frame is preferably a predefined frame, that is to say a frame known to the maintenance processor 12 and to the FPGA 21. For example, a predefined frame has a particular structure, known to the transmitter and the receiver. A predefined frame does not necessarily have a predefined content. This step 31 may comprise the reception of several simultaneous frames.

[0041] Upon receipt of the frame, the FPGA 21 evaluates a predefined parameter in a step 33. The predefined parameter takes, after the evaluation, a value dependent on the received frame. When several frames are received, the predefined parameter takes a value dependent on the several received frames.

[0042] The predefined parameter is preferably a counter of frames received. Thus, the counter of frames received by the FPGA 21 has a value corresponding to the number of frames received. Another possible predefined parameter is for example an average number of frames per predefined time interval, or any other parameter reflecting the state of the maintenance processor 12.

[0043] The predefined parameter is an indication of correct operation of the processor of maintenance 12 in that it reflects the expected operation of the maintenance processor 12. When the predefined parameter is a counter of received frames, the maintenance processor 12 has a correct operation when it sends a predefined number of frames, or a predefined number of frames per time interval. The frame counter can allow the control processor 11 to know if the maintenance processor 12 is still in correct operation if the control processor 12 receives a regularly incremented counter, for example every predefined time interval.

[0044] In operational mode, after the evaluation step 33, the frames received in step 31 are deleted by the FPGA 21. Thus, the control processor 11 does not have access to the frames received, and no communication from the maintenance processor 12 to the control processor 11 takes place or is possible.

[0045] In maintenance mode, the frames received by the FPGA 21 are stored by the FPGA 21, for example in a memory external to the FPGA 21.

[0046] The predefined parameter is then stored by the FPGA 21, for example in an external memory accessible by the FPGA 21.

[0047] Step 34 comprises access, by the control processor 11, to the predefined parameter, i.e. to an indication of correct operation of the maintenance method. Depending on the value of the indicator, or depending on a variation in its value, the control processor 11 then knows whether the maintenance processor 12 is in correct operation or in an incorrect operating state. The control processor 11 is capable of making this decision by configuring the control processor 11.In order for the control processor 11 to have access to the predefined parameter, the FPGA 21 can transmit, in a step 34, the stored parameter to the control processor 11 via the bidirectional communication link LL. In a variant, the predefined parameter can be stored in a memory, for example in a register included in the memory, and the control processor 11 transmits a request via the bidirectional link L1 to the FPGA21, for access to the memory or for access to the register included in the memory, to access the predefined parameter. Thus, the control processor 11 has access to reliable information concerning the operating state of the maintenance processor 12, without compromising the communication isolation between the two processors 11 and 12, thus maintaining a high level of security of the system 2.

[0048] The predefined parameter may also depend on an integrity check implemented by the FPGA 21. This check is implemented in an integrity check step 32, before the evaluation of the value of the predefined parameter in step 33. Depending on the result of the integrity check, the predefined parameter is then evaluated or not with respect to the received frame(s) having been the subject of the check. of integrity.

[0049] The integrity verification step 32 comprises the implementation of the evaluation of a cyclic redundancy check included in each frame received in step 31 or of a checksum included in each frame received in step 31. Thus, the FPGA 21 knows whether each frame received is intact and has therefore been sent by the maintenance processor 12. The addition of an integrity check to each frame by the maintenance processor 12 and its verification make it possible to ensure that the control processor has access to reliable information on the correct operation of the maintenance processor 12. Another advantage is that the FPGA 21 requires very little adaptation, and only software adaptations, to be able to verify the integrity of the frames received, unlike the state of the art which requires numerous modifications to the system.

[0050] If the verification 32 of the integrity of the frame received in step 31 is positive, the predefined parameter is evaluated in a step 33 and the frame is deleted by the FPGA 21. Thus, the control processor 11 does not have access to the received frame but does have access to a predefined parameter dependent on the received frame and indicating correct operation of the maintenance processor 12. By “the integrity of the frame received in step 31 is positive” is meant the fact that the frame is intact, that is to say that the cyclic redundancy check or the checksum included in the received frame can be found from a predefined calculation carried out from the frame. In the case of a positive integrity verification, the method is then continued up to step 34.

[0051] If the verification 32 of the integrity of the frame received in step 31 is negative, the predefined parameter is not evaluated in a step 33 and the frame is deleted by the FPGA 21. Thus, the control processor 11 does not have access to the received frame and the predefined parameter is not evaluated because the received frame was not in integrity. By "the integrity of the frame received in step 31 is negative" is meant the fact that the frame is not in integrity, that is to say that the cyclic redundancy check or the checksum included in the received frame cannot be found from a predefined calculation carried out from the frame. In the case of a negative integrity verification, the method is then stopped until a new frame is received in a step 31.

[0052] The method 3 according to the invention is repeated, during the operational mode, at each new reception of one or more frames sent by the maintenance processor 12 via the unidirectional link L3. For the entire duration of the operational mode, the control processor 11 then knows the operating state of the maintenance processor 12, without compromising the prerequisite of communication isolation of the two processors 11 and 12.

Claims

Claims

1. Method (3) for communicating an indication of correct operation by a first processor (12) to a second processor (11), the first processor (12) implementing a maintenance function of the second processor (11), the second processor (11) implementing a control function of an aircraft engine, the first processor (12) and the second processor (11) being isolated in communication by an FPGA (21), the FPGA (21) comprising: - a first link (L1) for bidirectional communication with the second processor (11), - a second link (L2) for unidirectional communication from the FPGA (21) to the first processor (12), - a third link (L3) for unidirectional communication from the first processor (12) to the FPGA (21), the method (3) comprising at least the steps of: - Receiving (31), by the FPGA (21), via the third link (L3), at least one frame sent by the first processor (12),- Evaluation (33), by the FPGA (21), of a predefined parameter to obtain a value of the predefined parameter, the value of the predefined parameter depending on the received frame, - Access (34), by the second processor (11), via the first link (Ll), to the value of the predefined parameter, via the FPGA (21).,

2. Method (3) according to the preceding claim according to which the FPGA (21) is configured to implement an operational mode in which the frames received via the third link (L3) are deleted by the FPGA (21) after the evaluation step, and a maintenance mode in which the frames received via the third link (L3) are stored by the FPGA (21) after the reception step (31), the method (3) being implemented in operational mode.

3. Method (3) according to one of the preceding claims, wherein the parameter is a counter of the number of frames received, the counter being incremented with each new frame reception.

4. Method (3) according to one of the preceding claims further comprising, before the evaluation step (33), a verification step (32), by the FPGA (21), of the integrity of each frame received via the third link (L3), the evaluation step (33) being carried out, for each frame received, only if the received frame is intact.

5. Method (3) according to the preceding claim according to which the integrity verification step (32) comprises an evaluation of a cyclic redundancy check included in the frame or of a checksum included in the frame.

6. Method (3) according to one of the preceding claims according to which the engine controlled by the control function is an aircraft engine.

7. System (2) configured to implement the method (3) according to any one of the preceding claims, the system (2) comprising: - an aircraft engine, - a first processor (12), - a second processor (11), - an FPGA (21) comprising: • a first two-way communication link (L1) with the second processor (11), • a second one-way communication link (L2) from the FPGA (21) to the first processor (12), • a third one-way communication link (L3) from the first processor (12) to the FPGA (21), the first processor (12) implementing a maintenance function of the second processor (11), the second processor (11) implementing a control function of the aircraft engine, the first processor (12) and the second processor (11) being isolated in communication by the FPGA (21).

8. A computer program product comprising instructions which, when the program is executed by a computer, cause the latter to implement the method (3) according to any one of claims 1 to 6.

9. A computer-readable recording medium comprising instructions which, when executed by a computer, lead the latter to implement the method (3) according to any one of claims 1 to 6.

Images