CONTROL SYSTEMS FOR UNMANNED VEHICLES

• US 20150280919A1
• Filed: 10/22/2013
• Published: 10/01/2015
• Est. Priority Date: 10/25/2012
• Status: Active Grant

• Current Assignee: BAE Systems Plc
• Original Assignee: BAE Systems Plc
• Inventors: Cullen, Alan Manuel, Colosimo, Nicholas Giacomo Robert
• Granted Patent: US 9,935,776 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: B64U 10/25 Fixed-wing aircraft VTOL aircraft B64U10/20
• CPC Class Codes: B64U 2201/10 autonomous, i.e. by navigating independently from ground or air stations, e.g. by using inertial navigation systems [INS]
• CPC Class Codes: G05D 1/0077 using redundant signals or controls
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A control system (100) for an unmanned vehicle (10) includes a control processing unit (102) which receives input signals from one or more sensors (101) and supplies output signals to one or more actuators (103). Processing modules (110) are divided into a plurality of successively linked stages (120). In a first stage (120A), multiple processing modules (110) produce substantially equivalent payload data when operating correctly. Message cryptography units (140) generate cryptographically signed messages (800) containing the payload data. In a second stage, a voting cryptography unit (130) receives and examines the cryptographically signed messages, and applies voting logic to derive a validated payload data for use by the respective processing module (120) of the second stage. A control method is also described.

Claims

1. A control system for an unmanned vehicle, the control system comprising:

a control processing unit arranged to receive input signals from one or more sensors and to supply output signals to one or more actuators, the control processing unit comprising a plurality of processing modules which are arranged into a plurality of stages, wherein the stages are successively linked with outputs from a plurality of the processing modules in a preceding first stage being coupled to inputs of one or more of the processing modules in a subsequent second stage;

wherein, in the first stage, the plurality of the processing modules produce substantially equivalent payload data when operating correctly and each of the processing module includes a message cryptography unit which generates cryptographically signed messages containing the payload data, and

wherein, in the second stage, each of the one or more processing modules comprises a voting cryptography unit which receives the cryptographically signed messages from the plurality of processing modules of the first stage, examines the cryptographically signed messages, and applies voting logic to derive a validated payload data from the cryptographically signed messages for use by the processing module of the second stage.

2. The control system of claim 1, wherein each of the processing modules is a physical hardware component which is separately removable and replaceable within the control system.

3. The control system of claim 1, wherein the processing modules are provided with at least double modular redundancy within each stage.

4. The control system of claim 1, wherein the or each processing module of the subsequent second stage comprises a processor unit arranged to support one or more logical processing applications which use the validated payload data from the voting cryptography unit of the processing module.

5. The control system of claim 1, wherein the control processing unit comprises at least a third stage which is successively linked to the second stage, wherein the processing modules of the second stage each further comprise the message cryptography unit generating the cryptographically signed messages containing the payload data of the processing module and the or each of the processing modules of the third stage comprise the voting cryptography unit which derive the validated payload data from the cryptographically signed messages for use by the processing module.

6. The control system of claim 1, wherein each of the message cryptography units produces a message stream comprising the cryptographically signed messages, and wherein each of the voting cryptography units in the processing modules of the subsequent stage is arranged to receive a plurality of the message streams from a plurality of the message cryptography units in the processing modules of the preceding stage.

7. The control system of claim 1, wherein the control processing unit comprises a plurality of communications networks, wherein the processing modules within each stage are coupled at their inputs to each of the communications networks and at their outputs to a respective one of the communications networks, each of the networks carrying the message streams from the processing modules in the preceding stage to a plurality of the modules in a subsequent stage.

8. The control system of claim 1, wherein the message cryptography units are arranged to generate outgoing cryptographically signed messages including a time stamp field containing a time stamp, and each of the voting cryptography units includes a time synchronisation unit arranged to validate the time stamp of incoming cryptographically signed messages.

9. An unmanned aerial vehicle comprising the control system of claim 1.

10. A control method for an unmanned vehicle, the method comprising:

receiving input signals from one or more sensors;

processing the input signals by a plurality of processing modules which are arranged into a plurality of stages, wherein the stages are successively linked with outputs from a plurality of the processing modules in a preceding first stage being coupled to inputs of one or more of the processing modules in a subsequent second stage;

producing substantially equivalent payload data by the plurality of the processing modules in the first stage when operating correctly and generating cryptographically signed messages containing the payload data by a message cryptography unit in each of the processing modules of the first stage;

applying voting logic to cryptographically signed messages by a voting cryptography unit in the or each processing module of the second stage to derive a validated payload data from the cryptographically signed messages for use by the processing module of the second stage;

generating an output signal using the validated payload data; and

supplying the output signals to one or more actuators.

11. The control method of claim 10, further comprising:

sending a message stream comprising the cryptographically signed messages by each of the message cryptography units of the processing modules of the first stage; and

receiving the message streams by each of the voting cryptography units in the processing modules of the subsequent stage.

12. The control method of claim 10, further comprising carrying the message streams over a plurality of communications networks, wherein the processing modules within each stage are coupled at their inputs to each of the communications networks and at their outputs to a respective one of the communications networks, each of the networks carrying the message streams from the processing modules in the preceding stage to a plurality of the modules in a subsequent stage.

13. The control method of claim 10, further comprising passing the payload data substantially unidirectionally through the control processing unit between the plurality of stages.

14. The control method of claim 10, further comprising cryptographically examining the cryptographically signed messages and raising a failure alert condition when the cryptographically signed messages fail the cryptographic examination and/or examining the payload data in the cryptographically signed messages and raising a failure alert condition when the payload data is inconsistent between the messages.

15. The control method of claim 10, further comprising encoding or encrypting at least part of the payload data within the messages.

16. A tangible, non-transient computer-readable storage medium having instructions recorded thereon which cause a computer device to perform a control process for an unmanned vehicle, the process comprising

receiving input signals from one or more sensors;

processing the input signals b a plurality of processing modules which are arranged into a plurality of stages, wherein the stages are successively linked with outputs from a plurality of the processing modules in a preceding first stage being coupled to inputs of one or more of the processing modules in a subsequent second stage;

producing substantially equivalent payload data by the plurality of the processing modules in the first stage when operating correctly and generating cryptographically signed messages containing the payload data by a message cryptography unit in each of the processing modules of the first stage;

applying voting logic to cryptographically signed messages by a voting cryptography unit in the or each processing module of the second stage to derive a validated payload data from the cryptographically signed messages for use by the processing module of the second stage;

causing generation of an output signal using the validated payload data; and

causing the output signals to be supplied to one or more actuators.

17. The computer-readable storage medium of claim 16, the process further comprising:

sending a message stream comprising the cryptographically signed messages by each of the message cryptography units of the processing modules of the first stage; and

receiving the message streams by each of the voting cryptography units in the processing modules of the subsequent stage.

18. The computer-readable storage medium of claim 16, the process further comprising carrying the message streams over a plurality of communications networks, wherein the processing modules within each stage are coupled at their inputs to each of the communications networks and at their outputs to a respective one of the communications networks, each of the networks carrying the message streams from the processing modules in the preceding stage to a plurality of the modules in a subsequent stage.

19. The computer-readable storage medium of claim 16, the process further comprising passing the payload data substantially unidirectionally through the control processing unit between the plurality of stages.

20. The computer-readable storage medium of claim 16, the process further comprising at least one of:

cryptographically examining the cryptographically signed messages and raising a failure alert condition when the cryptographically signed messages fail the cryptographic examination and/or examining the payload data in the cryptographically signed messages and raising a failure alert condition when the payload data is inconsistent between the messages; and

encoding or encrypting at least part of the payload data within the messages.