Single fault impervious integrated control and monitoring system

[0002] This invention relates to integrated control and monitoring systems for aircraft guidance and safety equipment at airports, and more particularly to an integrated system in which no single component or communications failure can adversely affect the functionality of the system.

[0003] Airports contain a wide variety of equipment which air traffic control personnel use to aid in the process of launching and recovering aircraft in a safe and efficient manner. Each user interface to this equipment is unique, because there is no common manufacturer and because each equipment performs a different function. It may be as simple as a panel of push buttons with incandescent lamps or as complex as a rack of switches and LEDs. In addition, the interfaces are typically located in different places such as the tower cab, scattered equipment cabinets, or field locations. Such equipment and interfaces may include runway lights, instrument landing systems (ILS), emergency generators, and other systems that ensure safe management of the aircraft.

[0004] It has previously been proposed, in a first-generation system, to connect all of these various interfaces to a common high-speed network of workstations known as an Integrated Control and Monitor System (ICMS) manufactured by the assignee of this application. The advantage of ICMS is that it allows all the interfaces to be displayed to a controller at a common location a in a graphical user interface (GUI) format that has a common “look and feel”. It also allows the controller to selectively control and monitor all the equipment from one or more locations. The ICMS further allows the provision of computer controlled interlocks to prevent human error. For example, each physical runway at an airport represents two virtual runways, one handling traffic in one direction, the other handling traffic in the opposite direction. Each of these virtual runways has its own set of equipment. It is therefore imperative that when the traffic direction on a physical runway is changed, ICMS refuses to turn on the equipment for the new virtual runway until the equipment (for example the localizer and the glide slope transmitters) of the previous virtual runway has shut down.

[0005] The first-generation ICMS was well accepted, but it had the drawback that certain component failures within ICMS could adversely affect the monitoring and control of not just one piece of equipment, but all of them simultaneously. It therefore became desirable to provide a second generation ICMS with no single point of failure, that is, a system such that no one component of the ICMS could fail and result in a complete ICMS failure.

[0006] The present invention provides such a no-single-point-of-failure (NSPF) configuration of an ICMS by adding an identical redundant component to any component that represents a single point of interface to the remote equipment. ICMS is comprised of a group of computers linked together over a high speed Ethernet local area network (LAN) utilizing the Transport Control Protocol over Internet Protocol (TCP/IP) architecture. These computers are of two different types.

[0007] One type of computer is a commercially off the shelf (COTS) IBM compatible computer which is classified as an ICMS Remote Workstation. The ICMS Remote Workstation provides a user interface to ICMS monitored equipment for the air traffic controller. There can be as many ICMS Remote Workstations as needed based on the number of user interfaces required. An ICMS Remote Workstation may be classified as either a Remote Master Workstation or Remote Slave Workstation. There may be only one Remote Master Workstation at any given time. The non Remote Master Workstations are classified as Remote Slave Workstations.

[0008] The other type of computer is also COTS industrial grade computer and is classified as an ICMS concentrator. Redundant pairs of concentrators share a common interface to the remote equipment. Each concentrator is connected to the Remote Workstations on its own LAN. The redundant pair of concentrators are connected to each other through a digital interface which is used to provide status signals to each other. One concentrator is active or primary at any given time. This means that it is providing the interface between the Remote Master Workstation and the remote equipment. The standby or secondary concentrator monitors the status of the remote equipment and the control status of the primary concentrator. If the primary concentrator experiences a communication failure with the Remote Master Workstation, it will relinquish its primary concentrator status to the secondary concentrator and allow operational status and control between the Remote Master Workstation and the remote equipment to continue without interruption. Once the failed concentrator reestablishes communications with the Remote Master Workstation, it becomes the inactive or secondary concentrator. This provides the concentrator with the ability to interface with the equipment in the case of the active primary concentrator, or in the case of the active secondary concentrator, the ability to monitor the status of the active primary concentrator interface and thus prevent the concentrator from representing a single point of failure for ICMS.

[0009] ICMS also provides another important feature of status and control archiving. Each of the concentrators maintains an archive file where it records all status changes received from, and controls sent to, the remote equipment. Each archive entry is time and date stamped which allows recreation of valuable remote equipment status changes and controller interaction with the remote equipment in the case of an accident.

[0010] FIG. 1 is a diagram showing the interconnection of the system of the invention;

[0011] FIG. 2 depicts a typical display of the information generated by the system; and

[0012] FIGS. 3a,3band 3care flow chart illustrating the response of the concentrators to a fault condition.

[0013] FIG. 1 illustrates the architecture of an NSPF ICMS according to the invention. In this configuration, a pair of IEEE 802.3, 10baseT hubs 24aand 24bare located in the Tower Cab, each of them feeding five Remote Workstations 32, 34, 36, 38, and 40. Use of 10baseT topology is done to improve the reliability. If one of the five 10baseT segments 41, in the Tower fails, it will not adversely effect the other four segments. The two hubs are connected over redundant 10base2 LANs 30aand 30b,to the facility fiber optic network 20, which provides an extension to another pair of redundant IEEE 802.3 LANs 18aand 18b,in the Tower base building. The LANs in the base building extend to the equipment room where the redundant pair of concentrators 14aand 14bare located and to a Remote Workstation 28. The LANs also extend to the Tower Radar Approach Control room (TRACON) and the Maintenance Control Center (MCC) where Remote Workstations 26 and 22 are located.

[0014] The concentrators 14aand 14buse part of the digital I/O 16 that they share, to establish status signals 16pbetween the concentrators to determine who is the primary concentrator, and status signals 16sto determine who is the secondary concentrator 16s.The secondary concentrator also uses another status line, 16c,to communicate to the primary concentrator the fact that it has established communication with the Remote Master Workstation. These status lines can be read or actively driven by either concentrator.

[0015] When concentrator 14aor 14bis in primary status it is fully functional on both its inputs and its outputs, i.e. it receives information from the interfaces 12 and transmits that information over the LAN at regular intervals (e.g. once per second) to the currently Remote Master Workstation, 40. Conversely, the primary concentrator receives commands from the Remote Master Workstation over the LAN and transmits them in the appropriate format to the remote equipment through the interfaces 12.

[0016] When a concentrator 14aor 14bis in secondary status, it continues to monitor the interfaces between the active primary concentrator and the remote equipment. It places its common outputs into a passive state to prevent conflicts with the primary concentrator's common outputs. The secondary concentrator continues to search for the Remote Master Workstation so that it may be ready to connect in the case of a failure on the active primary concentrator.

[0017] Each ICMS workstation 22 through 40 contains a file which is located in C:\WINNT\SYSTEM32\DRIVERS\ETC\HOSTS where all of the workstations of the ICMS are defined by (1) IP address, (2) workstation name, and (3) workstation alias name. This file, which is created and statically maintained by the ICMS System Administrator, is used by the workstation to resolve IP addresses from workstation alias names. There may be five Remote Workstations defined as potential Remote Master Workstations. There can be only one Remote Master Workstation at any given time. These five workstations have alias names defined in the HOSTS file as “Remote-Master-1” (highest priority) through “Remote-Master-5” (lowest priority). Although the names of the remote workstations vary from one ICMS installation to another, the alias names remain the same. In this manner, ICMS can access this file to determine which workstation is the next potential Remote Master by its alias. In the case that a Remote Master Workstation fails or is shut down, the next highest priority workstation in the HOSTS file will assume Remote Master status and begin listening for TCP connections on the redundant LANs 18a,18band 30a,30b.

[0018] The ICMS concentrators 14aand 14balso contain an identical copy of this file located in C:\PCTCP\ETC\HOSTS. When the Remote Master Workstation relinquishes its Master status, the ICMS concentrators 14aand 14bsee this as a network communication failure and through the use of the “HOSTS” file, initiate a search for the new Remote Master Workstation.

[0019] The other Remote Slave Workstations sense the loss of the Remote Master Workstation and begin to search for the new Remote Master Workstation in the same manner as the concentrators. To save time, the search is performed using User Datagram Protocol (UDP). Using the alias names, “Remote-Master-1” through “Remote-Master-5” as defined in the HOSTS file, query packets can be sent out without the protocol overhead involved with a TCP connection. These query packets continue at regular intervals (1 per 250 milliseconds), rotating through the alias list until the Remote Slave Workstations and the concentrators receive a UDP query response defining which workstation is the Remote Master Workstation. This response may be sent by another Remote Slave Workstation as well as the Remote Master Workstation. Upon receiving this response, the Remote Slave Workstations and the concentrators will establish TCP connections with the Remote Master Workstation.

[0020] Only a concentrator which has primary status will attempt to make a TCP connection to the Remote Master Workstation. The secondary concentrators will continue to send the query UDP packets out to monitor the availability of the Remote Master Workstation. These UDP queries are sent at a slower rate, (1 per second), to minimize the impact on the bandwidth of the network. As long as it continues to receive response UDP packets defining who the Remote Master Workstation is, the secondary concentrator will maintain active status signals to the primary concentrator indicating that it is ready to assume primary concentrator status in the case that the active primary concentrator fails or is taken off line by a technician.

[0021] As shown in FIGS. 3a-c,when a concentrator is powered on it will check status line 16pfor an active low level signal, indicating that the other concentrator has assumed primary status. If this line is at an active low level it will assert a active low signal on status line 16s,indicating that it has assumed active secondary concentrator status. When it determines who the Remote Master Workstation is, it will assert an active low level on line 16cindicating that it is ready to assume primary concentrator status in the case there is a failure with the current active primary concentrator.

[0022] However, at power on, if line 16pis at an inactive high level indicating that there is no current active primary concentrator, one of the concentrators will assert an active low level on line 16pindicating it has assumed active primary concentrator status. It will then look at line 16sand line 16cfor active low signals indicating that there is a secondary concentrator with good communications with the Remote Master Workstation. If either of these lines are in an inactive high state, the primary concentrator will report to the Remote Master Workstation that the secondary concentrator is down. When both of these lines 16sand 16cassume an active low level, the primary concentrator will report to the Remote Master Workstation that the secondary LAN is up and that the secondary concentrator is up and ready to assume primary status in the case of a failure in the current active primary concentrator.

[0023] In case there is a failure in the active primary concentrator's ability to communicate with the active Remoter Master Workstation, assuming that the secondary concentrator is up and ready to take over, the primary concentrator will remove the active low level placed on 16pand assert an active low level on status line 16s,indicating that it is assuming secondary concentrator status. It will then wait for the secondary concentrator to assert a active low level on 16p,indicating that the current secondary concentrator has assumed primary concentrator status. In case there is no secondary concentrator at the time of the failure, or the secondary concentrator does not have communications with the Remote Master Workstation, the primary concentrator will continue to maintain primary status until the failure is remedied and communication reestablished, or a secondary concentrator becomes available with communication with the Remote Master Workstation.

[0024] Each of the concentrators contains a configuration file, “C:\ICMS\ICMS.CFG”, which is read from the hard disk drive when the concentrator is powered on, or does a reset. This file, which is created by the ICMS System Administrator, contains two types of information. This information is called facility records and STD Bus records. A facility record defines the facility identification, such as (1) DIA for Denver International Airport, (2) the active runway identification, such as 34L, (3) the identification of the inactive primary interlocked runway, such as 16R, (4) the inactive secondary interlocked runway, if any, and (5) the maximum category rating for this runway. It also contains (6) a list of equipment that this runway has associated with ICMS. The STD Bus records provide the details about the I/O cards installed in the concentrator, i.e. (1) the type of I/O card, (2) the I/O card's STD Bus address, and (3) the equipment it is interface to. These records allow ICMS to adapt to the facility that it is associated with. It also allows one common package of ICMS software to be used for all ICMS installed facilities.

[0025] When a primary concentrator establishes a TCP connection to the Remote Master Workstation, it sends copies of all of the facility records that were defined in its configuration file. This informs the Remote Master Workstation of the facility runways details and equipment associated with them, as defined by that concentrator. It also ensures that both the concentrator and the Remote Master Workstation have the same information about the facility. The Remote Master Workstation will send copies of these same facility records to the Remote Slave Workstations.

[0026] After receiving the facility records, the active Remote Master will send a command to the concentrator to set the time and date. This ensures that the concentrator is synchronized with the active Remote Workstation which receives its time from the facility time standard.

[0027] The active Remote Master will then send the concentrator a command to turn on the equipment status update. The concentrator will then start polling the facility equipment for status as defined in the configuration file. It will send this information in TCP packets to the Remote Master Workstation at regular intervals (1 per second). The Remote Master Workstation will then disseminate this same information in TCP packets to all of the Remote Slave Workstations. Any additional commands sent to the primary concentrator are initiated by the air traffic controller from the Remote Workstation GUI. These commands are used to turn equipment on or off or change equipment operational parameters. The Remote Master Workstation is the only Remote Workstation where a user may originate any control commands for the ILS equipment. This ensures that there is one point of responsibility for the life-critical ILS equipment. Commands to turn the lighting aids equipment such as ALSF, MALSR, and PAPI may originate from any Remote Workstation. In case the command originates from a Remote Slave Workstation, the command is sent to the Remote Master Workstation first after which it is forwarded to the appropriate concentrator. This allows the Remote Master Workstation the capability of selectively allowing only authorized Remote Slave Workstations to have control capabilities.

[0028] Since the concentrator is the focal point for all equipment status and equipment commands, an archive capability is maintained in the concentrator. Every command sent to the equipment and all status changes received from the equipment as well as any error conditions encountered in the concentrator are logged into an archive file with a time and date stamp. A separate archive file is maintained for each day. Each day at midnight, each concentrator will close the archive file for that day and send a copy of it to the NT Server Remote Workstation using File Transport Protocol (FTP). The concentrator will maintain a copy of that file on its hard disk drive also. An archive file for the new day will be created and the archiving process will continue.

[0029] Most of the time the concentrator is just sending equipment status packets to the Remote Master Workstation. Unless the concentrator receives a command from the Remote Master Workstation, it has no indication the Remote Master Workstation is present. To solve this problem the primary concentrator sends a TCP “Heartbeat” query to the Remote Master Workstation. If the Remote Master Workstation fails to respond to the query, the primary concentrator will close the TCP connection and relinquish primary concentrator status to the secondary concentrator, assuming it has contact with the Remote Master Workstation. If there is no secondary concentrator, or it does not have communication with the Remote Master Workstation, the primary concentrator will continue to search for a new Remote Master Workstation.

[0030] The concentrator pair 14a,14balso contain a “Watch Dog Timer” which will perform a hard reset on the concentrator in the event that the concentrator fails to respond to its ICMS related task. Upon initialization, the concentrator will launch the ICMS application and resume its ICMS related task. If the primary concentrator is reset by the “Watch Dog Timer”, the secondary concentrator will assume primary status and continue ICMS operation without affecting the remote equipment or the air traffic controller's user interface on the Remote Workstations.

[0031] The concentrator pairs are connected to the remote equipment in a parallel fashion shown at 12 in FIG. 1. In a preferred embodiment, there are currently (1) RS 232C serial interfaces, (2) RS 485 serial interfaces, (3) digital I/O, (4) static tone interfaces, and (5) frequency-shift-keying (FSK) interfaces used to communicate with the remote equipment. RS 232C is used to interface with the Mark 20 ILS. RS 485 is used to interface to the RVR equipment. Digital I/O is used to interface to MALSRs, PAPIs and Mark 20 ILS equipment. FSK is used to interface with the ALSF's, and static tones are used to interface with the Mark 1 ILS and DME equipment.

[0032] The Remote Workstation displays the status information in a GUI format. The general status for the entire facility is displayed in a Summary Screen in the form of a simple x-y matrix (see FIG. 2). The equipment columns are displayed across the x-axis and the runway identification is displayed down the y-axis. The general status information is highlighted with colors for the convenience of the user. Blue background indicates that the equipment is in a NORMAL state and is turned off, in the case of lighting aids equipment, or is interlocked off in the case of ILS equipment. Green background color indicates that the equipment is in a NORMAL state and turned on, in the case of lighting aids equipment, or in the case of ILS equipment, is interlocked on. Light blue or light green indicate that the equipment is in some state of degradation, i.e. it may be in CAT 1 condition when it has a maximum rating of CAT 3. A background color of red is used to indicate an alarm condition for equipment. Once the alarm condition is acknowledged the background color becomes orange. Using these color schemes, an air traffic controller may determine the overall status for the complete facility with a casual glance at the Summary Screen. Detailed status for a particular equipment may be obtained by clicking the mouse on the x-y cell associated with that equipment status. This will generate another window containing the detailed status information about that equipment along with any buttons for controls associated with that equipment. In the advent that an equipment exhibits an alarm condition, this will be brought to the air traffic controller's attention by the x-y status cell for the equipment changing to red background color, accompanied with an audible klaxon sound from the workstation. Once the air traffic controller has determined the source of the alarm for that equipment by bringing up the equipment GUI window, he may acknowledge the alarm by clicking the acknowledge button on the equipment GUI window. This will change the background color on the Summary Screen for that equipment x-y status cell to orange. It will also silence the audible alarm on that workstation. The use of this red-orange color scheme allows the user to differentiate between new and previously acknowledged equipment alarm conditions.