GB2172722A

GB2172722A - Backup control system (bucs)

Info

Publication number: GB2172722A
Application number: GB08606033A
Authority: GB
Inventors: Richard D Murphy; William C Fischer
Original assignee: United Technologies Corp
Current assignee: RTX Corp
Priority date: 1985-03-22
Filing date: 1986-03-12
Publication date: 1986-09-24
Also published as: IT8619782A0; JPS61221903A; GB2172722B; IT1188453B; IT8619782A1; GB8606033D0; FR2579339A1; DE3609267A1; FR2579339B1

Description

1 GB2172722A 1

SPECIFICATION

Backup control system (BUCS) Technical Field The invention relates to techniques for responding to software errors, especially in life critical systems such as aircraft control.

Background of the Invention

Continued proper operation of a digital sys- tem following a software fault is highly desir able in modern computer systems and be comes mandatory in a life critical digital sys tem, such as those employed in aircraft pri mary fliqht control systems. A software error may manifest itself by the processor becom ing mired within the program and not complet ing its tasks, or by the processor completing its tasks too rapidly by not executing all of its program. Redundant hardware and voting schemes provide hardware fault protection but do not provide safeguards against software faults when the redundant computers are pro grammed with identical software. Thus, each of the redundant channels can suffer the same software fault, at virtually the same instant.

The present state of the art in software verifi cation and validation does not provide any tool or technique which can guarantee the ab- 95 sence of software faults; on the contrary, ex perience has shown that software errors con tinue to exist even in exhaustively verified and validated software.

Backup systems have been provided by sim- ple analog systems, additional digital systems which are dissimilarly programmed, or by me chanical means. Reversion to these backups generally occurs following disagreement be tween the redundant channels of the prime digital system. These backup systems require significant additional hardware with the atten dant disadvantages of cost, weight, power de mand and heat dissipation. The analog and mechanical backups are additionally con strained to be simple derivatives of t ' he usually highly complex and nonlinear implementation of the prime digital system.

Disclosure of the Invention

It is an object of the invention to provide a means of continuing the proper operation of a digital computer system in the presence of a software error with minimal additional hard ware.

According to the invention, a backup soft ware program is installed in an isolated por tion in the memory of at least one of the redundant computers. The second program performs basically the same functions as the prime program but is dissimilarly programmed to avoid a common software error. Switcho ver to the second program occurs either auto matically, or manually by the operator (i.e. pi lot) when he detects an anomaly. Automatic 130 switchover is initiated when at least n-1 (in a system having n levels of redundancy) computer monitors indicate a software fault condition. The computer monitors may be duty cy- cle timers which detect a computer cycling improperly (too long or too short), reasonableness testers, analog comparision models, or a combination of these types. Complexity and sophistication of the monitors will vary for particular applications but, in general, the monitors must be implemented in hardware to preclude their being rendered ineffective by the common software faults they are intended to discover. The assembler or compiler used to assemble/compile the backup mode program is also dissimilarly programmed to eliminate possible assembler/compiler faults as a source of common mode software faults.

Other objects, features, and advantages of the invention will become more apparent in light of the following description thereof.

Brief Description of the Drawings

Fig. 1 is a block diagram of a control sys- tem employing the invention; Fig. 2 is a schematic of a monitor for the invention; and Fig. 3 is a block diagram detailing a portion of the invention.

Best Mode for Carrying Out the Invention

In Fig. 1 is shown a computer based control system (10) having four computer channels AD. Each channel has a processor section 12, associated input/output hardware 14, and memory 16. The memory 16 is divided into two portions. A portion 18 contains primary software which is accessed during normal system operation. A portion 20 contains dis- similar backup software, and is accessed only upon failure of the primary software. A monitor 22, is operable to determine failure of the primary software. The monitor 22 is, for example, a duty cycle timer, resonableness tester, or analog comparison model.

The four channels A-D are redundant; that is, each contains copies of the primary and backup software in their respective memories 16. The computer system 10 implements a voting scheme in either hardware or software, such as is known, to output the most appropriate selected signal to a controlled device 24, such as the control surface actuators of an aircraft, in response to inputs 26, such as signals from a pilot or sensors. It should be understood that the invention is applicable to any number of channels, and that the backup software could be installed in only one channel.

Fig. 2 details a typical -monitor 22 used in each channel of the computer system 10, for instance the channel A, which is representative of the monitors 22 in channels B, C, and D. An OR gate 30A (the "A" suffix indicates association with channel A) is responsive to 2 GB2172722A 2 signals from a watchdog timer 32A, a short duty cycle timer 34A, and a signal on a line 36A, indicative of other protective conditions; any of which will cause the OR gate 30A to provide a signal on a line 40A that will shut down the power to channel A. A relay 42A for the channel A trips in response to the signal on the line 40A to shut down the channel A. Similar OR gates 3013-301) and relays 4213-42D are provided for the other channels B-D. The switching logic for the monitors 22 should be implemented in.hardware so that they are independent of software faults.

A switching section 44A includes two con- tact sets 46A-46D, 48A-48D from each relay 42A-42D, arranged as shown so that any three channel failures will generate a signal on a line 48A to an AND circuit 50A.

Another switching section 52A includes a third contact set 54A-54D from each relay 42A42D arranged in parallel so that the failure of any one channel starts a timer, such as an integrator 56A driving a comparator 58A, so that until a predetermined interval of time (T,,,) has elapsed, indicative of the time within which a common mode software failure would be experienced in all channels, a signal is provided to the AND circuit 50A. (The timer 56A may be reset for conditions such as rotor brake---ON---.) If it is judged that a common mode failure is not a near simultaneous event, then T,,, can be set to infinity. This will permit the backup software to be engaged whenever n-1 out of n severs occur.

The AND circuit 50A is only responsive to the signals from the switching section 44A and the comparator 58A to provide a signal on a line 60 when the flight critical system is active (such as might be sensed by a rotor brake release signal in a helicopter embodiment) as indicated by a signal on a line 61 (common to all channels A-D).

A switching section 64A includes a contact set 66A-66D from each relay 42A42D ar- ranged in series so that a signal is output on a line 68A in response to a software failure in all four channels A-D.

An OR gate 70A is responsive to the output of the AND gate 50A and to the output of the switching section 64A to provide a signal on a line 72A which will initiate the backup mode of operation based on either contingency. The signal on the line 72A is also provided in response to a manual over- ride signal on a line 73 to the OR gate 70A.

The signal on the line 72A will proceed to the channel A as a nonmaskable hardware in terrupt signal on a line 73A if an AND circuit 74A is armed by an arming signal on a line 76A to its input. The nonmaskable hardware 125 interrupt request is issued to each channel A D, whereupon the CPU 12 will complete what ever instruction it is currently executing before acknowledging the nonmaskabie interrupt. The hardware transfer logic will respond to the nonmaskable interrupt by switching to the backup memory bank. The CPU will then begin "servicing the interrupt" at the prescribed memory location in the backup memory. The interrupt service routine in this case will actually be the backup software. This switchover logic accomplishes a unified switchover of the processor at a known processor state and to a known location in the backup memory. It is necessary that the backup system reinitialize the system, for instance by reinitializing. Suspect fault conditions could also be reset, since they could be faulty indications of the malfunctionary software. It is also desirable to synchronize the commands computed to actuator positions (in an aircraft) to minimize transients, and then blend over a period of time to the backup memory commands.

In a system such as a, n aircraft control sys- tem, the backup software can be a simplified control law. Generally, the simpler the control law is, the easier it is to verify and validate. The backup software can be installed in all of the computers, but it may be preferable to install it in only one, thereby avoiding voting schemes and other complications in the event of switchover to the backup software.

The backup system requires limited additional input/output interfaces, digital logic cir- cuitry, and new software for each channel that it is installed in.

When the pilot arms the Backup Mode (76A), the FCS (Flight Control System) will continue to operate in the normal mode until any one or more of the following conditions occur: 1. The pilot initiates a backup transfer. 2. n-1 control system channels output sever after the prescribed time interval T,,,. 105 3. n control system channels output sever. The Backup mode transfer logic selects from the aforementioned condition list any active requesting condition, signal to drive a nonmaskable interrupt request to the processor(s) in the channel. The reaction to the nonmaskable interrupt can be thought of as causing a jam transfer to the backup memory for instructions. The same transfer process will be separately occurring in the other channels.

With reference to Fig. 3, each channel will respond to the NNI via a hardware interrupt 80 which will cause the following sequential actions to occur:

1. The memory bank will be switched from the prime memory bank 82 to the backup memory bank 84; 2. The proper starting address of the backup software (residing in the backup memory bank) will be transferred into program counter 86; and 3. The CPU 88 will execute its next instruction from the starting address of the backup program now stored in the program counter.

Claims

3 GB2172722A 3 1. A method of providing backup control for a software-based control system in the event of a software fault, comprising:

installing primary software in memory; installing dissimilarly designed backup software in an isolated portion of memory; executing the primary software in a normal mode of operation; sensing a fault in the primary software; executing the backup software in response to the sensed fault.
2. A method according to claim 1, comprising; providing a nonmaskable interrupt request in response to the sensed fault; completing whatever instruction is being executed in the primary software when the nonmaskable interrupt request is provided, and then acknowledging the nonmaskable interrupt request; and executing the backup software in response to the nonmaskable interrupt request.
3. A method according to claim 1, comprising jam-transferring to the isolated portion of memory in response to the sensed fault.
4. A method according to claim 1 wherein the backup software is simplier than the primary software.
5. A method according to claim 1, for a redundant computer system having n-channels, comprising:

installing identical copies of primary software in each channel of memory; installing dissimilar backup software in an isolated portion of at least one channel's memory; executing the primary software in a normal mode of operation; sensing a fault in the primary software; and executing the backup software in response to the sensed fault.

Printed in the United Kingdom for Her Majesty's Stationery Office, Did 8818935, 1986, 4235. Published at The Patent Office, 25 Southampton Buildings, London, WC2A 1 AY, from which copies may be obtained.