Analog Backup Control for Engine Cyber Resilience

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Embedded systems, such as aircraft engine control systems, are vulnerable to cyberattacks, which can lead to catastrophic failures, and traditional digital backup systems may also be compromised, posing a risk to system integrity during hostile events like EMP or nuclear incidents.

Innovation Solution

Incorporating isolated analog backup components that can take over control from compromised digital components, providing a one-way switch to analog control to prevent further disruption and ensuring robustness against cyberattacks and electromagnetic pulses.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Extent of automation

If digital control units are used to control engine components, then control precision and automation are improved, but vulnerability to cyberattacks and electromagnetic disruptions increases

Engineering Contradiction:
Improvedigital control automationVSAvoidsystem security against cyberattacks
Core Design Contradiction:
Extent of automationVSReliability

Solution Approach 1:

The control system is divided into separate digital and analog control units. The digital control unit handles normal automated control operations, while the analog control unit serves as an isolated backup system that can take over if the digital system is compromised. This segmentation allows the system to maintain automation benefits while reducing vulnerability through physical and functional separation.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system changes the operational parameter from purely digital control to a hybrid digital-analog control architecture. By introducing analog control as a backup mode, the system alters its control parameter state to resist electromagnetic disruptions and cyberattacks that target digital systems, thereby improving reliability while preserving automation capabilities.

Inventive Principle:
Principle #35Parameter changes

2Reliability

If digital backup systems are implemented, then system redundancy is improved, but susceptibility to electromagnetic pulses and nuclear incidents increases

Engineering Contradiction:
Improvesystem redundancyVSAvoidelectromagnetic pulse susceptibility
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent replaces digital electronic backup systems with analog control systems. Analog systems using traditional electrical signals are less susceptible to electromagnetic pulses and nuclear electromagnetic interference compared to digital systems with complex processing and communication interfaces. This substitution maintains redundancy while reducing vulnerability to electromagnetic harmful factors.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If analog backup components are added to the system, then resilience against cyberattacks is improved, but device complexity increases

Engineering Contradiction:
Improveresilience against cyberattacksVSAvoidcontrol system architecture
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The analog backup control unit is extracted as a separate, isolated system from the main digital control architecture. This extraction allows the analog backup to function independently without adding complexity to the primary digital control path. The analog system is only activated when the digital system fails or is compromised, thereby improving resilience while minimizing the impact on overall system complexity during normal operation.

Inventive Principle:
Principle #2Taking out (Extraction)

Data Source

PatentUS11440677B2Secured backup feature for an embedded system
Publication Date: 2022.09.13 ROLLS ROYCE CORP
  • US11440677B2 patent drawing
  • US11440677B2 patent drawing

AI summary

A system is described that includes a controllable component of an engine configured to regulate fuel flow to the engine, a digital control unit configured to control the engine by at least communicating with the controllable component of the engine, and a protection component configured to disable communication between the digital control unit and the controllable component of the engine. The system further includes an analog control unit configured to control the engine by at least communicating with the controllable component of the engine in response to the protection component disabling communication between the digital control unit and the controllable component of the engine.