Control system for a system rendered secure through diversification

• US 7,631,113 B2
• Filed: 03/12/2007
• Issued: 12/08/2009
• Est. Priority Date: 03/17/2006
• Status: Active Grant

• Current Assignee: Alstom Transport SA (Alstom SA)
• Original Assignee: Alstom Transport SA (Alstom SA)
• Inventors: Bougalt, Cyrille
• Primary Examiner(s): Kindred; Alford W
• Assistant Examiner(s): Martinez; David E
• Application Number:
  US11/716,956
• Publication Number:
  US 20070260773A1
• Time in Patent Office: 1,002 Days
• Field of Search: 710/5, 710/20
• US Class Current: 710/20
• CPC Class Codes: B61L 19/06 Interlocking devices having electrical operation
• CPC Class Codes: B61L 21/04 Electrical locking and release of the route; Electrical repeat locks
• CPC Class Codes: G06F 11/1487 using N-version programming
• CPC Class Codes: G06F 11/1641 where the comparison is not performed by the redundant processing components
• CPC Class Codes: G06F 11/184 where the redundant components implement processing functionality

Abstract

This control system for a system rendered secure by diversification comprises: a set of processors processing railway commands, arranged in parallel and each capable of receiving different sets of instructions, a component for selecting commands selected from the output data issuing from the processors.

The modular applications automatic systems are identical for all sets of instructions and each set of instructions associated with a processor is specific for creating a separate sequencer for the successive activation of modular application automatic systems in a particular sequence.

Claims

1. A control system for a railway system rendered secure through diversification comprising:

at least two processors processing commands for the railway system, the processors arranged in parallel to receive identical input data on a corresponding input, each processor receiving a first and second set of instructions, each processor calculates and delivers identical output data at different outputs with respect to the identical input data, the first set of instructions being different than the second set of instructions,

a command selection component including at least two inputs and a command output, each input connected to an output of a processor, the command output delivering a command signal selected from the processor output data, based on predetermined criterion,

the first and second set of instructions corresponding to each processor running at least two modular application automatic systems, the modular application automatic systems being identical for the first and second sets of instructions,

the first and second sets of instructions corresponding to each processor being specific to creating a subsequent activation sequencer for the modular application automatic systems in an associated sequence,

each sequencer differing from other sequencers by the specific associated sequence.

2. The control system rendered secure through diversification as recited in claim 1 wherein each sequencer specifically activates and sequences the modular application automatic systems based on a different cyclical sequence of running the application automatic systems having the same cycle and a different cycle start or path direction.

3. The control system rendered secure through diversification as recited in claim 2 wherein each sequencer specifically activates and sequences the modular application automatic systems based on a different cyclical sequence of running the application automatic systems having the same cycle path in the same direction.

4. The control system rendered secure through diversification as recited in claim 1 wherein each sequencer specifically sequences the modular application automatic systems based on a different sequencer sequence formed from a succession of partial sequences of modular application automatic systems grouped into subgroups subdividing the set of modular application automatic systems in the control system.

5. The control system rendered secure through diversification as recited in claim 4 wherein the subgroups of automatic systems are the same for the at least two processors.

6. The control system rendered secure through diversification as recited in claim 1 wherein each modular application automatic system includes automatic system inputs and automatic system outputs,

the automatic system input being external when receiving a variable item of input data from the control system,

the automatic system output being external when delivering a variable item of output data from the control system,

an input and an output for a same automatic system or two different automatic systems being internal when the input and output are being interconnected and exchanging a given variable internal item of data,

the set of variable input items of data and output data of the automatic systems forming a state vector for the control system,

for each processor the control system including a working memory, the working memory including a register for the start state when running the sequence of automatic systems containing the values for the set of state variables before the sequence of automatic systems is run, and a register for the end state when running the sequence of automatic systems containing the values of the set of state variables for the state vector obtained after running the sequence of automatic systems.

7. The control system rendered secure through diversification as recited in claim 6 wherein for each processor and while the sequence is being run, each processor only reads from the start state register and only writes to the end state register.

8. The control system rendered secure through diversification as recited in claim 7 wherein for each processor, the start state register for the sequence can only be written to and refreshed by the values for the state variables present in the sequence end register once the sequence has been run and each processor runs the sequence of automatic systems repeatedly until the values for the state variables of at least two associated state registers are the same.

9. The control system rendered secure through diversification as recited in claim 1 wherein each processor includes a program database including a set of processor instructions loaded into the processor and running the sequence of application automatic systems in the sequence ordered by the sequencer associated with the processor.

10. The control system rendered secure through diversification as recited in claim 9 wherein each program database includes a set of instructions obtained using the same compiler.

11. The control system rendered secure through diversification as recited in claim 1 wherein the command selection component is a component reaching a decision on the basis of a majority vote from the output data originating from all the processors, the component being able to compare the output data originating from the respective outputs of each processor and transmit common output data on a majority basis in relation to the set of processors on the basis of a predetermined majority criterion.

12. The control system rendered secure through diversification as recited in claim 11 wherein the command selection component is a component making decisions based on unanimity.

13. The control system rendered secure through diversification as recited in claim 1 that controls a rendered secure type railway system.

14. A secure control process for a system comprising stages comprising:

loading at least two processors from program databases associated with different sets of instructions,

providing identical input data to the processors arranged in parallel via respective inputs,

running the different set of instructions associated with each processor, each processor computing and delivering identical output data at the respective outputs based on identical input data, the running of a set of instructions by a processor including the steps of;

running at least two modular application automatic systems, the modular application automatic systems being identical for each set of instructions, in a specific sequence different from the sequences for the other sets of instructions,

extracting the output data obtained after running the sequence, and

delivering the output data to the command selection component,

selecting a command signal selected from the output data originating from the processors, on the basis of a specific criterion.

15. The secure control process as recited in claim 14 further comprising the steps of:

validating or correspondingly prohibiting transmission of the command issuing from the plurality of data outputs received, on the basis of the selection criterion; and

signaling the existence of a fault in at least one processor in the event of prohibition.