High data integrity processing system

Patent metadata

Field	Value
Publication number	US-10740186-B2
Application number	US-201715595844-A
Country	US
Kind code	B2
Filing date	May 15, 2017
Priority date	May 15, 2017
Publication date	Aug 11, 2020
Grant date	Aug 11, 2020

Abstract

Disclosed is a high data integrity processing system (“HDIPS”) that includes a first processing device and a triple voted processing (“TVP”) device in signal communication with the first processing device. The first processing device has a high radiation resistance and includes a processor, a cache memory, and a computer-readable medium (“CRM”). The CRM has encoded thereon computer-executable instructions to cause the processer to execute a periodic first integrity check on the first processing device producing a first integrity result, which is transmitted to the TVP device. The TVP device includes firmware having encoded thereon machine instructions to, simultaneously with the periodic first integrity check, cause the TVP device to execute a second integrity check producing a second integrity result, compare the first integrity result with the second integrity result, and power reset the first processing device if the first integrity result does not match the second integrity result.

First claim

What is claimed is:

1. A high data integrity processing system (“HDIPS”), the HDIPS comprising:
a first processing device, wherein the first processing device includes a processor and a computer-readable medium (“CRM”), the CRM having, encoded thereon, first computer-executable instructions to cause the processor to perform a periodic first integrity check on the first processing device to produce a first integrity result;
a cache memory; and
a triple-voted processing (“TVP”) device in signal communication with the first processing device, wherein the TVP device includes firmware, the firmware having, encoded thereon, machine instructions to cause the TVP device to:
perform a second integrity check, substantially simultaneously with the periodic first integrity check on the first processing device to produce, a second integrity result,
compare the first integrity result with the second integrity result, and
power reset the first processing device if the first integrity result does not match the second integrity result.

2. The HDIPS of claim 1 , wherein the first processing device utilizes silicon on insulator (“SOT”) technology, and wherein the TVP device is a field-programmable gate array (“FPGA”) utilizing a triple-mode redundancy (“TMR”) technology.

3. The HDIPS of claim 2 , wherein the first processing device utilizes an Avionics Application Standard Software Interface (“ARINC”) 653 operating system (“OS”).

4. The HDIPS of claim 1 , wherein the CRM further includes, encoded thereon, second computer-executable instructions to perform, after performance of the first periodic integrity check, a double authentication process (“DAP”) of first data, wherein the second computer-executable instructions cause the processor to:
receive the first data at the first processing device,
execute, at a first time value, a first calculation of the first data to produce a first DAP result,
flush the cache memory after executing the first calculation,
execute, at a second time value, a second calculation of the first data to produce a second DAP result, wherein the second time value is subsequent to the first time value,
compare, at a third time value, the first DAP result with the second DAP result, wherein the third time value is subsequent to the second time value, and
flush the cache memory if the first DAP result does not match the second DAP result.

5. The HDIPS of claim 4 , wherein the cache memory is a random access memory (“RAM”) that is integrated directly with the processor or is in direct signal communication with the processor.

6. The HDIPS of claim 4 , wherein the second computer-executable instructions that execute the first calculation and that execute the second calculation, include particular computer-executable instructions that cause the processor to:
execute the first calculation in a first partition of a frame of the cache memory having a first memory address,
store the first DAP result in an error-correcting code (“ECC”) memory in signal communication with the first processing device prior to flushing the cache memory, and
execute the second calculation in a second partition of the frame of the cache memory having a second memory address after the flushing the cache memory.

7. The HDIPS of claim 6 , wherein the first computer-executable instructions that perform the periodic first integrity check on the first processing device include particular computer-executable instructions that cause the processor to:
establish an integrity partition of the frame that is located at a beginning of the frame prior to the first partition,
execute a built-in-test (“BIT”) for the first processing device prior to receiving the first data, and
perform a data check of the ECC memory.

8. The HDIPS of claim 7 , wherein a portion of the particular computer-executable instructions that perform the data check cause the processor to:
read a memory value from the ECC memory,
compare the memory value against an ECC value of the ECC memory corresponding to the memory value,
generate a regenerated ECC value, and
compare the ECC value with the regenerated ECC value.

9. The HDIPS of claim 1 , wherein the first computer-executable instructions that perform the periodic first integrity check on the first processing device cause the processor to generate a first pseudo-random sequence utilizing a first linear-feedback shift register (“LFSR”) within the first processing device, wherein the machine instructions that perform the second integrity check on the TVP device cause the TVP device to generate a second pseudo-random sequence utilizing a second LFSR within the TVP device, and wherein the machine instructions that cause the TVP device to compare the first integrity result with the second integrity result cause the TVP device to compare the first pseudo-random sequence with the second pseudo-random sequence.

10. The HDIPS of claim 9 , wherein the first LFSR and the second LFSR include a seed that is the same for both.

11. The HDIPS of claim 4 , wherein the CRM further includes, encoded thereon, third computer-executable instructions, wherein the third computer-executable instructions cause the processor to:
transmit the first DAP result to an external system in signal communication with the first processing device if the first DAP result does match the second DAP result, and
receiving second data at the first processing device after flushing the cache memory if the first DAP result does not match the second DAP result.

12. The HDIPS of claim 11 , wherein the first processing device is a device utilizing silicon on insulator (“SOT”) technology, and wherein the TVP device is a field-programmable gate array (“FPGA”) utilizing a triple-mode redundancy (“TMR”) technology.

13. The HDIPS of claim 12 , wherein the first processing device utilizes an Avionics Application Standard Software Interface (“ARINC”) 653 operating system (“OS”).

14. A method for high data integrity processing within a radiation environment with a high data integrity processing system (“HDIPS”) in signal communication with an external system, the method comprising:
performing a periodic first integrity check on a first processing device to produce a first integrity result;
performing a second integrity check, substantially simultaneously with the periodic first integrity check, on a triple-voted processing (“TVP”) device to produce a second integrity result;
comparing the first integrity result with the second integrity result; and
power resetting the first processing device in response to the first integrity result not matching the second integrity result.

15. The method of claim 14 , further comprising, after performance of the periodic first integrity check, performing a double authentication process (“DAP”) for first data, the DAP including:
receiving the first data at the first processing device,
executing, at a first time value, a first calculation of the first data to produce a first DAP result,
flushing a cache memory after executing the first calculation,
executing, at a second time value, a second calculation of the first data to produce a second DAP result, wherein the second time value is subsequent to the first time value,
comparing, at a third time value, the first DAP result with the second DAP result, wherein the third time value is subsequent to the second time value,
flushing the cache memory if the first DAP result does not match the second DAP result, and
transmitting the first DAP result to an external system in signal communication with the first processing device if the first DAP result does match the second D

Assignees

• Boeing Co

Inventors

• Boettjer Bruce A
• Dooley Maryanne

Classifications

• G06F11/183 Primary

  by voting, the voting not being performed by the redundant components · CPC title

• G06F11/184

  where the redundant components implement processing functionality · CPC title

• G06F11/187

  Voting techniques · CPC title

• G06F11/1064

  in cache or content addressable memories · CPC title

• G06F11/0706 Primary

  the processing taking place on a specific hardware platform or in a specific software environment · CPC title