Computer system security with redundant diverse secondary control system with incompatible primary control system

A method of controlling a process or system with protection against software based security attacks, the method comprising:

• at a primary control system:
• receiving sensor signals from a sensor,
• determining first actuation signals configured to control operation of at least a portion of a controlled system by using at least one software based algorithm which relies at least in part on the sensor signals,
• sending the first actuation signals;
• at a redundant and diverse secondary control system:
• receiving the sensor signals from the sensor,
• determining second actuation signals configured to control operation of the at least a portion of the controlled system by using a hardware based system incompatible with the primary control system configured to run a hardware-coded control operation relying at least in part on the sensor signals,
• sending the second actuation signals;
• receiving the first actuation signals and the second actuation signals at an output control device;
• at a monitor device:
• receiving the sensor signals,
• receiving and comparing the first actuation signals and the second actuation signals,
• determining whether error occurred with respect to one or both of the first and second actuation signals,
• sending an output control device signal to the output control device to effect provision of either the first actuation signals or the second actuation signals by the output control device based on whether an error occurred with respect to the first actuation signals;
• outputting from the an output control device either the first actuation signals or the second actuation signals to the controlled system to control operation of the controlled system based on the output control device signal.

An apparatus providing protection against software based security attacks, the apparatus to be used with a primary control system comprising an input port configured to receive sensor signals from a sensor, an output port configured to send first actuations signals configured to control operation of at least a portion of a controlled system, and a hardware component running at least one software based algorithm configured to output the first actuation signals based on the sensor signals, the apparatus comprising:

• a redundant and diverse secondary control system comprising:
• a second input port configured to receive the sensor signals from the sensor,
• a second output port configured to send second actuations signals configured to control operation of the at least a portion of the controlled system,
• a hardware based system incompatible with the primary control system configured to run at least one hardware-coded algorithm that generates the second actuation signals based on the sensor signals,
• an output control device configured to receive the first actuation signals and the second actuation signals and to output either the first actuation signals or the second actuation signals to the controlled system to control operation of the controlled system;
• a memory configured to store data regarding safe operational parameters including expectant actuation signals based on sensor signals for the controlled system;
• a monitor device configured to:
• receive the sensor signals,
• receive and compare the first actuation signals and the second actuation signals,
• determine whether error occurred with respect to the first and second actuation signals by comparing the expectant actuation signal to one or both of the first actuation signals and the second actuation signals based on the sensor signals,
• send an output control device signal to the output control device to effect provision of either the first actuation signals or the second actuation signals by the output control device based on whether an error occurred with respect to the first actuation signals.