High-integrity calculation method on a single-component computer

Abstract

TITLE: High-integrity calculation method on a single-component computer. One aspect of the invention relates to a method for obtaining a calculation result in which two calculations (CA, CB) are performed respectively by the same processor (P) in different time windows (FT1, FT2), the results are then compared, and the integrity of the results is subsequently compared to ensure the integrity of the calculations. Figure to be published with the abstract: Figure 4

Description

Title of the invention: High-integrity calculation method on a single-component computer. TECHNICAL FIELD OF THE INVENTION

[0001] The technical field of the invention is that of critical data processing.

[0002] The present invention relates to a high-integrity computing method on a computer single-component and in particular a process allowing redundancy of the calculation without redundancy of the component implementing the calculation. TECHNOLOGICAL BACKGROUND OF THE INVENTION

[0003] In the context of mobility revolutions, and in particular the evolution of smaller airborne vehicles and the increase in the value associated with data processing, it is necessary to create reliable, compact, low-energy and low-cost acquisition systems.

[0004] In parallel, scheduled maintenance is becoming less and less popular in favor of solutions that allow maintenance to be performed based on the actual measured condition. This allows for maintenance to be postponed. Actual condition measurement systems are highly critical systems.

[0005] Many data capture and processing systems currently exist.

[0006] Some of these existing systems are of low or medium criticality and do not provide sufficient integrity for performing maintenance deferrals on critical parts.

[0007] Some other existing systems allow sufficient integrity for maintenance deferral applications but are based on redundancy of computing units and are therefore more expensive and more complex.

[0008] In aeronautics, critical systems are required to have a high level of integrity combined with high availability. To meet this requirement, a hardware architecture is usually composed of several computers. For example, a redundancy of two processors, called COM for "computation" and MON for "monitoring," and / or a redundancy of two processors, called PRIM for "Primary" and SEC for "Secondary," can be implemented. The principle of these redundancies is to verify, respectively by the secondary or control processor, the operations performed respectively by the primary or computation processor.

[0009] Certain applications, such as control for maintenance purposes, always require a very high level of data integrity. For these systems, a traditional DAL (Development Assurance Level) architecture should be used. Development Assurance (in French) of level A, that is to say of critical level as defined by the ED-12C and DO-178C standards "Software considerations in airborne Systems and equipment certification" ("Software considerations in the certification of airborne systems and equipment" in French), is very costly.

[0010] There is therefore a need to be able to ensure, by means of a control system for maintenance purposes, a high integrity of calculations while having a limited cost, and requiring less redundancy of calculations than in the prior art. Summary of the invention

[0011] The invention offers a solution to the problems mentioned above, by allowing a high level of integrity of calculations while reducing development, production and maintenance costs.

[0012] One aspect of the invention thus relates to a method for obtaining a calculation result by a processor, the method being characterized in that it comprises: • Obtain at least one initial data point and at least one integrity of the initial data point. • Check if the first data point is intact based on the integrity of the first data point, and interrupt the process when the first data point is not intact. • Implement an initial calculation by the processor within a first time window to obtain an initial calculation result, the first calculation taking into account the first piece of data, • Integrity calculation of the first calculation result to obtain a first integrity, • Obtain at least one second piece of data and at least one integrity of the second piece of data, • Check if the second data point is intact based on the integrity of the second data point, and interrupt the process when the second data point is not intact. • Implement a second calculation by the processor in a second time window different from the first time window to obtain a second calculation result, the second calculation taking into account the second data, • Integrity calculation of the second calculation result to obtain a second integrity, • Comparison of the first calculation result and the second calculation result to obtain an initial difference in the calculation result, • Comparison of the first integrity and the second integrity to obtain a first difference in the integrity of the calculation result, • When each difference is zero between the first result difference and the first integrity difference, obtaining the calculation result, the calculation result being the first result and / or the second result.

[0013] Thanks to the invention, it is possible to achieve high computational integrity without having to use a costly and complex system comprising several processors. Unlike the prior art, the invention proposes a method enabling high computational integrity in a single processor. This method, unlike methods proposed in the prior art, does not require numerous redundancies, but advantageously uses different computational time windows in the same processor to perform two calculations with the same theoretical result. If both calculations yield the same result, and the data integrity has been verified beforehand, the processor is considered to have integrity. Additional integrity tests are proposed later, making it possible to ensure a maximum level of integrity.The invention makes it possible to avoid redundancy in hardware and to limit the risks of intrusion and data compromise by limiting exchanges between hardware components.

[0014] The invention finds particularly relevant application in aeronautical systems, and especially in control systems for maintenance purposes, where data loss does not have catastrophic consequences, unlike undetected data corruption. Thus, the invention is particularly interesting in all applications where data integrity is more important than data availability.

[0015] In addition to the characteristics mentioned in the preceding paragraph, the method according to one aspect of the invention may have one or more complementary characteristics from among the following, considered individually or in all technically possible combinations: • The first calculation is performed by one processor core, and the second calculation is performed by a second processor core. Having two different time windows on two different cores helps limit interference on the resources shared between the two cores, particularly in the event of a security breach affecting these resources. • The first calculation and the second calculation are different and have the same theoretical result. • when at least one difference is not zero between the first result difference and the first integrity difference, a processor integrity fault alert is issued. • A processor integrity fault alert is issued and the process is stopped when a preliminary integrity test performed before the first and / or second calculation indicates that the processor, first core, and / or second core is not intact. This ensures a higher level of security regarding integrity verification and the calculation of new integrity. • A processor integrity fault alert is issued and the process is stopped when a subsequent integrity test performed after the first and / or second calculation indicates that the processor, first core, and / or second core is not intact. This allows for the detection of a failure that may have occurred after the first processor integrity test. • Integrity checks are based on a cyclic redundancy check function and the integrity of the first data, the integrity of the second data, the first integrity and the second integrity obtained are the result of applying the cyclic redundancy check function respectively to the first data, the second data, the first result and the second result. • the process further includes, when each difference is zero among the first difference of result, the first difference of integrity at least one step of storing, in memory, the result of calculation. • the calculation result is a shock information of a part of an aircraft rotor and according to which the first data and the second data are acquired by at least one sensor of the aircraft rotor. • the sensor is a resolver connected to a shaft of the rotor and according to which the integrity of the first data and the integrity of the second data are calculated by a resolver-to-digital converter from the first data and the second data acquired by the resolver.

[0016] Another aspect of the invention relates to an embedded system configured to implement the method according to the invention, the embedded system comprising at least one processor including a first core and a second core and a memory, and at least one sensor configured to acquire the first data and the second data, the sensor being an accelerometer or a resolver.

[0017] Yet another aspect of the invention relates to an aircraft comprising the on-board system according to the invention.

[0018] The invention is particularly interesting for systems where the need is for a high level of integrity of calculation results, and for which high availability of results is less important.

[0019] The invention and its various applications will be better understood upon reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0020] The figures are presented for illustrative purposes only and are in no way limiting of the invention. • Figure [1] shows a schematic representation of a first embodiment of a method for implementing the main calculation according to the invention, • Figure 2 shows a schematic representation of a system for implementing a method according to the invention. • Figure 3 shows a schematic representation of a control system for maintenance purposes related to the implementation of the process according to the invention, • Figure 4 shows a schematic representation of the realization of calculations by two cores of a processor in a method according to the invention. DETAILED DESCRIPTION

[0021] Unless otherwise specified, the same element appearing on different figures has a unique reference.

[0022] Fig. 1 shows a schematic representation of a method for implementing calculation according to the invention.

[0023] The calculation implementation method 1 shown in [Fig. 1] is implemented by at least one processor P such as the processor P shown in [Fig. 2]. The processor P is also called a "single-component computer" because it is a single processor P capable of performing calculations. The processor P comprises at least one first core PL. In a preferred embodiment shown in [Fig. 1], the processor P further comprises at least one second core P2. Of course, the invention then covers any processor P comprising two or more cores.

[0024] Fig. 2 shows a schematic representation of a system for implementing a method according to the invention.

[0025] The system shown in [Fig. 2] comprises a processor P and a memory M. The memory M contains instructions which, when executed by the processor P, cause the processor P to implement method 1 according to the invention. In the course of implementing method 1, the processor P may store further data in the memory M or delete data stored in the memory M.

[0026] The system S can, for example, be embedded in an airborne system, for example in an aircraft. The system S implementing method 1 can then advantageously be used as a control system for maintenance purposes. of at least one piece of aircraft equipment. The system S implementing method 1 can also be used as a control system for the maintenance of at least one piece of equipment that is not aircraft equipment. A "control system for maintenance purposes" is defined as a system capable of reporting the status of monitored equipment and indicating whether it requires maintenance. Such systems therefore perform calculations to decide whether the equipment needs maintenance. For example, [Fig. 3] shows a schematic representation of an embodiment of a control system for maintenance purposes SI comprising the processor P and memory M, as well as a sensor C and an ADC / RDC converter. The result of the calculation is then, for example, a shock reading of a part of an aircraft rotor. Preferably, the aircraft rotor sensor is a resolver connected to a shaft of the aircraft rotor.In such a case, the converter is a resolver-to-digital converter. The integrity of the first and second data points can then be calculated by the resolver-to-digital converter from the first and second data points acquired by the resolver. Alternatively, the sensor is any analog sensor, and in such a case, the converter is an analog-to-digital converter, which can also be configured to calculate the integrity of the first and second data points.

[0027] The process 1 described in [Fig.1] comprises several steps enabling a calculation result to be obtained when the processor P implementing it is integral and when the data on which the calculation is based are integral.

[0028] An intact processor P is a device that has not undergone any alteration that would lead to deviant behavior, that is, behavior different from the expected behavior. An intact processor P therefore operates as expected, meaning that it performs calculations in the manner in which it was configured. A processor P can be said to be "intelligent" based on a calculated probability of processor failure. If the fear of failure is high, for example due to a high probability of failure, a verification that the processor P has not undergone any alteration can be implemented, for example by performing calculations whose results are known in advance, and comparing the expected and obtained results.

[0029] Integral data is uncorrupted data, that is to say, data which has not undergone any alteration which would lead it to modify the behavior of the devices using it or the functions which are applied to it.

[0030] The data on which the calculation is based can be stored in memory, along with the integrity of the data calculated for that data at its creation. For example, at the output of sensor C, the integrity of an analog data point can be calculated by a suitable device, for example by the ADC / RDC converter.

[0031] The method 1 described in [Fig.1] does not allow obtaining a result of the calculation when the processor P or the data on which the calculation is based are not integral.

[0032] The term "result of a calculation" means a data item representing a result value of a calculation. The term "calculation" means at least one operation to be applied to at least one data item obtained by the processor P, resulting in at least one outcome. An example of a calculation can be performed within a control system S or SI for maintenance purposes.

[0033] Method 1 according to the invention is a method for obtaining a calculation result using the processor P. Method 1 according to the invention is not limited to the redundancy of the same calculation, and may, on the contrary, include the implementation of two different calculations that should theoretically lead to the same result. When these results obtained are identical, a single calculation result is obtained, which is considered to be an integral result.

[0034] Process 1 is shown in [Fig. 1] as comprising three parts A, B, and C. This representation is used only for a simpler understanding of the process, and the invention is not limited to such a division. Process 1 shown in [Fig. 1] is a first embodiment of a process according to the invention.

[0035] The method 1 shown in [Fig. 1] comprises a first part A for performing a first calculation from initial data and verifying the integrity of the result, a second part B for performing a second calculation and verifying the integrity of the result, and a third part C for verifying the integrity of the processor P by comparing the data obtained at the different stages of the preceding parts A and B. Of course, the invention is not limited to performing two calculations but also covers performing more than two calculations, for example, three, four, or more.

[0036] In a first step 11 of the process 1 according to the invention, included in Part A of [Fig. 1], a first data point DATA_A is obtained. This data point comes, for example, directly from a sensor, via an analog-to-digital converter and / or digital resolver. Alternatively, this data point may have been previously stored in a memory, for example in memory M. This first data point DATA_A is obtained with its integrity I_A, that is, with the result of an integrity calculation of the first data point DATA_A. This integrity calculation may have been performed as close as possible to the sensor, for example by an analog-to-digital converter and / or digital resolver, or by another suitable device.

[0037] There are several ways to calculate the integrity of data. The invention covers any means of calculating the integrity of the result of a calculation that provides output information concerning the integrity of the result or data on the basis of which it is possible to verify the integrity of the result. In one embodiment Preferably, at least one, and preferably all integrity calculations of the invention use a cyclic redundancy check function, also called a CRC. A CRC function provides an integrity value. This first integrity value can then be compared to a second integrity value obtained from the same data using the same CRC function a second time. If the first and second integrity values ​​are equal—that is, if the difference between these two integrity values ​​is zero or equal to a predetermined value—then integrity is verified. CRC functions are primarily used for data transmission by appending the integrity value obtained by applying the CRC function to the data whose integrity is to be verified.If the data was compromised during transmission, using the CRC function again on that data gives a non-zero result, or one different from an expected result.

[0038] In a second step 12 of process 1, the integrity of the first data point is checked. To do this, an integrity value I_A2 of the first data point DATA_A is calculated by the processor P and compared with the integrity value I_A obtained for the first data point DATA_A. If the two integrity values ​​I_A and I_A2 are identical, then the first data point DATA_A is intact and process 1 continues. Conversely, if the two integrity values ​​I_A and I_A2 are different, then process 1 is stopped ("N" in [Fig. 1]). An alert can then be issued following this anomaly detection ("Anom").

[0039] In a third step 13, a first calculation is performed by the processor P. "A first calculation is performed" means executing at least one operation constituting a first calculation on input data obtained in step 11 by the processor P. This data is the first data DATA_A. This first data DATA_A comes, for example, from equipment monitored by the processor P, or from any other device capable of sending data to the processor P. Step 13, which implements the first calculation, yields a first result RA. This first result is a data item representing a value resulting from the first calculation performed by the processor P. In an embodiment not shown, the result RA is then stored in memory M.In a so-called "dual-core" embodiment, in which the processor P comprises at least two cores PI and P2 and in which the two calculations CA and CB are respectively implemented by different cores of the processor P, this first calculation is implemented by the first core PL.

[0040] In a fourth step 14 of the process 1 according to the invention, included in Part A of [Fig. 1], an integrity calculation of the first result RA from the first implementation 13 of the first calculation is performed. Step 14 therefore comprises performing an integrity calculation on the result obtained in step 13, to obtain a first integrity I_RA, or first "integrity data" I_RA. In a mode of realization not represented, the first integrity I_RA is then stored in memory M. It is important to note that step 14 of integrity calculation allows obtaining a first integrity data, and not verifying the integrity of the result of the calculation.

[0041] To verify that the processor P, having implemented steps 11 to 14, is intact, method 1 comprises, in an embodiment not shown, a first step T1 for testing the integrity of the processor P before steps 11 to 14 and a second step T2 for testing the integrity of the processor P after steps 11 to 14. Alternatively, a single integrity test T1 can be carried out before or between steps 11 to 14, or a single integrity test T2 can be carried out after or between steps 11 to 14. Thus, it is possible to detect whether an integrity problem exists on the processor P before and / or after implementing steps 11 to 14, and therefore to know where the integrity problem originates, i.e., whether it existed before steps 11 to 14 or not.Such integrity test steps T1 and T2 each include verifying the processor P's ability to produce the correct result for a known calculation, for example, a checksum or cyclic redundancy check (CRC) calculation, and / or to correctly compare two obtained results, for example, two checksums or two CRCs obtained from two checksum or CRC calculations, respectively. A checksum or CRC calculation involves using a calculation function on a set of data to obtain an expected result. The checksum or CRC calculation is preferably performed with a set of values ​​whose outcome is known. Verifying the processor P's comparison capability includes, with known sets of values, verifying that the processor P can distinguish incorrect values ​​from correct ones.If an integrity problem is detected during at least one of the steps T1 and / or T2, an integrity fault alert, or integrity anomaly Anom, is raised and process 1 can be stopped. The result data RA, the integrity data I_RA and / or any data related to the calculation can also be deleted from memory M when it has been stored there.

[0042] Preferably, in the embodiment in which the processor P comprises at least two cores PI and P2, the integrity tests T1 and / or T2 include a test of the processor's PI and P2 cores to ensure that one PI core of the processor does not cause disturbances to the other core during a computation. This can be achieved by monitoring a common communication bus and / or a central interconnect node (also called an "interconnect") to which the cores are connected.

[0043] In a first variant of the second embodiment, the variant being not shown, an integrity test such as the T1 and T2 tests is performed after each computation implementation, i.e. after steps 14 and 18 in [Fig. 3]. In this In a variant, [Fig. 3] would include a T2 step after step 14 and a T2 step after step 18. The T1 step may be performed only once at the beginning of process 1, or before each calculation. If an integrity problem is detected during at least one of the integrity test steps T1 and / or T2, an integrity fault alert, or integrity anomaly Anom, is raised and process 1 may be stopped. The result data RA, the integrity data I_RA, and / or any calculation-related data may also be deleted from memory M once it has been stored there.

[0044] In a second variant of the second embodiment, the variant being not shown, an integrity test such as tests T1 and T2 is performed after all the computation implementations, i.e., after step 18 in [Fig. 1]. In this variant, [Fig. 1] would include a single step T2 after step 18, step 18 being the last computation implementation of process 1. Step T1 may be performed only once at the beginning of process 1, or before each calculation. If an integrity problem is detected during at least one of the integrity test steps T1 and / or T2, an integrity fault alert, or integrity anomaly Anom, is raised and process 1 may be stopped. The result data RA, the integrity data I_RA, and / or any data related to the calculation may also be deleted from memory M when it has been stored there.

[0045] The first and second embodiments are then identical.

[0046] The process 1 then includes, in part B, a step 15 of obtaining a second data point DATA_B. This data point may have been obtained in the same way as the first data point DATA_A, or in a different way, for example via another sensor or by already being stored in memory. This second data point DATA_B is obtained together with its integrity I_B.

[0047] The process 1 then includes a step 16 of verifying the integrity of this second data DATA_B, in the same way as the verification of the integrity of the first data DATA_A in step 11, but from the integrity I_B of the second data DATA_B.

[0048] Then, a step 17 implementing a second calculation CB yields a second result RB. This second result RB is a data point representing a result value of the second calculation CB implemented by the processor P. This second calculation CB can be identical to the first calculation CA, or different from the first calculation CA but with the same expected result. In the latter case, the two calculations CA and CB must give the same results, even if the input data and the method of obtaining the result are different. In such a case, the advantage is not requiring strict redundancy of the same calculation. For this purpose, different calculation libraries can be used, each calculation library being used by the core of the processor P implementing the associated calculation. Alternatively, the Different libraries can use different internal blocks of the P processor. For example, one library might use the integer arithmetic unit, and another library might use the floating-point arithmetic unit. Alternatively, a common arithmetic library can be used, without necessarily implying identical calculations; that is, even in the case of different CA and CB calculations.

[0049] In the so-called "dual-core" embodiment, step 17 of the second calculation CB is performed by a core of processor P different from the core that performed the first calculation CA. Otherwise, steps 15 to 18 are performed by the same core PI that performed the first calculation CA. Preferably, in the "dual-core" embodiment, all steps 15 to 18 of part B of method 1 are performed by a core of processor P different from the core of processor P that performed steps 11 to 14. For example, as shown in [Fig. 4], if core P2 of processor P performed steps 11 to 14, core PI of processor P performs steps 15 to 18. This ensures the integrity of the calculation result, identifying cases in which only one of the cores is corrupted.

[0050] Furthermore, step 17 of the second calculation CB is performed in a different time window FT2 than the time window FT1 used for the first calculation CA. More broadly, and preferably, steps 15 to 18 are performed in a different time window FT2 than the time window FT1 used for steps 11 to 14. This makes it possible to identify cases in which the processor P (or each core of the processor P in the so-called "dual-core" embodiment) is corrupted at a given time, and to identify the periods in which the processor P was intact and the periods in which it was not. The time windows FT1 and FT2 differ in that they do not overlap and in that they begin at different times. The invention covers any time window duration, as the two time windows FT1 and FT2 may be of the same or different durations.The FT1 time window can precede or follow the FT2 time window.

[0051] In an embodiment not shown, the second result RB is then stored in memory M.

[0052] Step 17, which implements the second calculation, is followed by step 18, which calculates the integrity of the second result RB obtained from implementation 17 of the second calculation CB. The integrity calculation in step 18 is the same as the integrity calculation in step 14; that is, steps 18 and 14 use the same integrity calculation function, respectively on the results RA and RB. Step 18 of the integrity calculation yields a second integrity I_RB, in the same way as step 14 allowed obtaining a first integrity I_RA. In an unrepresented embodiment, the second integrity I_RB is then stored in memory M.

[0053] The method 1 according to the invention then includes steps 19 and 20, included in part C of verification of the integrity of the processor P.

[0054] In step 19, a comparison of the first result RA and the second result RB is performed by the processor P. This yields a result difference RB-RA. This difference is not limited to a subtraction or a division. Any function that verifies the similarity of the results RA and RB is covered by the invention. The result difference RB-RA is a representative measure of the similarity of the first and second results RA and RB.

[0055] At step 20, a comparison of the first integrity I_RA and the second integrity I_RB is performed by the processor P. This yields an integrity difference I_RB-I_RA. This difference is not limited to a subtraction or division. Any function that verifies the similarity of the integrity data I_RA and I_RB is covered by the invention. The integrity difference I_RB-I_RA is a representative measure of the similarity of the first and second integrity values ​​I_RA and I_RB.

[0056] Steps 19 and 20 can be redundant for higher computational integrity; that is, in another embodiment, the method according to the invention comprises two or more steps for comparing integrity and two or more steps for comparing results. The invention covers any redundancy of the steps for comparing results and any redundancy of the steps for comparing integrity.

[0057] The process 1 then includes a Verifl check step to verify that each difference is zero or equal to a predetermined value among the result difference RB-RA and the integrity difference I_RB-I_RA. "Each difference is zero" means that the results are equal or similar and that the integrities are equal or similar. "Each difference is equal to a predetermined value" means that a value has been predetermined, for example by an operator, and stored in memory, and that the difference of the results is equal to the predetermined value. When this Verifl check is confirmed "O", that is, when each difference among the result difference RB-RA and the integrity difference I_RB-I_RA is zero or equal to a predetermined value, the computation result is provided by the processor P in a Res step.This provision of the calculation result can be a sending, by the processor P, of the calculation result to another device, the storage of the calculation result in memory M, and / or the use of the calculation result in another function implemented by the processor P. The calculation result is the first result and / or the second result, which may be identical or whose difference is equal to a predetermined value.

[0058] When at least one difference between the result difference RB-RA and the integrity difference I_RB-I_RA is not zero, that is, when the results are unequal or dissimilar, and / or the integrities are unequal or dissimilar, or when at least one difference between the result difference RB-RA and the integrity difference I_RB-I_RA is not equal to a predetermined value if a predetermined value has been defined, the computation result is not provided by the processor P. In such a case, data destruction may be performed at a "Dest" step. In an alternative, the data may not be destroyed or deleted from memory M, but may be marked as unsound. "Marked" data may have appended data indicating that it is unreliable. "Marked" data may also be data modified so as no longer to be recognized by a recipient.

[0059] A processor integrity fault alert can also be raised when the Verifl check is not confirmed "N". "Raising an alert" means sending an alert to another device, or storing information related to the processor integrity fault in memory M.

Claims

1. Demands Method (1) of obtaining a calculation result by a processor (P), method (1) being characterized in that it comprises: - Obtain (11) at least one first data point (DATA_A) and at least one integrity of the first data point (I_A), - Check (12) if the first data (DATA_A) is intact based on the integrity of the first data (I_A), and interrupt the process (1) when the first data (DATA_A) is not intact, - Implement (13) a first calculation (CA) by the processor (P) in a first time window (FT1) to obtain a first calculation result (RA), the first calculation (CA) taking into account the first data (DATA_A), - Integrity calculation (14) of the first calculation result (RA) to obtain a first integrity (I_RA), - Obtain (15) at least one second data point (DATA_B) and at least one integrity of the second data point (I_B), - Check (16) if the second data (DATA_B) is intact based on the integrity of the second data (I_B), and interrupt the process when the second data is not intact, - Implement (17) a second calculation (CB) by the processor (P) in a second time window (FT2) different from the first time window (FT1) to obtain a second calculation result (RB), the second calculation (CB) taking into account the second data (DATA_B), - Integrity calculation (18) of the second calculation result (RB) to obtain a second integrity (I_RA), - Comparison (19) of the first calculation result (RA) and the second calculation result (RB) to obtain a first difference in calculation result (RB-RA), - Comparison (20) of the first integrity (I_RA) and the second integrity (I_RB) to obtain a first difference in the integrity of the calculation result (I_RB-I_RA), - When (Verifl) each difference is zero or equal to a predetermined value (0) among the first result difference (RB-RA) and the first integrity difference (I_RB-I_RA), obtaining (Res) the calculation result, the calculation result being the first result (RA) and / or the second result (RB).

2. Method (1) according to the preceding claim wherein the first calculation (CA) is implemented by a first core (PI) of the processor (P) and wherein the second calculation (CB) is implemented by a second core (P2) of the processor (P).

3. Method (1) according to any one of the preceding claims wherein the first calculation (CA) and the second calculation (CB) are different and have the same theoretical result.

4. A method (1) according to any one of the preceding claims in which, when at least one difference is not zero (N) or is not equal to a predetermined value among the first result difference (RB-RA) and the first integrity difference (I_RB-I_RA), a processor integrity fault alert (Anom) (P) is issued.

5. A method (1) according to any one of the preceding claims wherein a processor (P) integrity fault alert (Anom) is issued and the method (1) is stopped when a preliminary integrity test (Tl) implemented before the implementation (11) of the first computation (CA) and / or the second computation (CB) indicates that the processor (P) is not intact.

6. A method (1) according to any one of the preceding claims wherein a processor (P) integrity fault alert is issued and the method (1) is stopped when a subsequent integrity test (T2) implemented after the implementation (13) of the first computation (CA) and / or the second computation (CB) indicates that the processor (P) is not intact.

7. A method (1) according to any one of the preceding claims, wherein the integrity checks (12, 16) are based on a cyclic redundancy check function and the integrity of the first data point (I_A), the integrity of the second data point (I_B), the first integrity (I_RA), and the second integrity (I_RB) obtained are the result of applying the check function of cyclic redundancy respectively to the first data (DAT_A), to the second data (DATA_B), to the first result (RA) and to the second result (RB).

8. Method (1) according to any one of the preceding claims further comprising, when each difference is zero or equal to a predetermined value (0) among the first result difference (RB-RA) and the first integrity difference (I_RB-I_RA), at least one step of storing in memory (M) the result of calculation.

9. A method (1) according to any one of the preceding claims wherein the calculation result is a shock information of a part of an aircraft rotor and wherein the first data and the second data are acquired by at least one sensor of the aircraft rotor.

10. Method (1) according to claim 9 wherein the sensor is a resolver connected to a shaft of the rotor and wherein the integrity of the first data (I_A) and the integrity of the second data (I_B) are calculated by a resolver-to-digital converter (RDC) from the first data (DATA_A) and the second data (DATA_B) acquired by the resolver.

11. Embedded system (S) configured to implement the method according to any one of the preceding claims, the embedded system (S) comprising at least one processor (P) comprising a first core (PI) and a second core (P2) and a memory (M), and at least one sensor configured to acquire the first data (DATA_A) and the second data (DATA_B), the sensor being an accelerometer or a resolver.

12. Aircraft comprising the on-board system (S) according to claim 11.

Images