Flight management system for an aircraft and method of securing open world data using such a system

• US 10,295,349 B2
• Filed: 05/23/2017
• Issued: 05/21/2019
• Est. Priority Date: 05/24/2016
• Status: Active Grant

• Current Assignee: Airbus Operations (European Aeronautic Defence and Space Company EADS NV)
• Original Assignee: Airbus Operations (European Aeronautic Defence and Space Company EADS NV)
• Inventors: Mere, Jean-Claude
• Primary Examiner(s): Beaulieu, Yonel
• Application Number:
  US15/603,000
• Publication Number:
  US 20170343357A1
• Time in Patent Office: 728 Days
• CPC Class Codes: B64D 2045/0075 Adaptations for use of electronic flight bags in aircraft; Supports therefor in the cockpit
• CPC Class Codes: B64D 45/00 Aircraft indicators or protectors not otherwise provided for camouflage F41H3/00
• CPC Class Codes: G01C 21/20 Instruments for performing navigational calculations G01C21/24, G01C21/26 take precedence
• CPC Class Codes: G01C 23/00 Combined instruments indicating more than one navigational value, e.g. for aircraft; Combined measuring devices for measuring two or more variables of movement, e.g. distance, speed or acceleration
• CPC Class Codes: G05D 1/0077 using redundant signals or controls
• CPC Class Codes: G06F 11/1658 Data re-synchronization of a redundant component, or initial sync of replacement, additional or spare unit
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component
• CPC Class Codes: G08G 5/0008 with other aircraft
• CPC Class Codes: G08G 5/0013 with a ground station
• CPC Class Codes: G08G 5/0021 located in the aircraft

Abstract

A flight management system for an aircraft and method of securing open world data using such a system. The flight management system includes at least two flight management computers including one computer termed active forming part of an active guidance subsystem configured to supply data for guiding the aircraft. Another computer is termed inactive at the current time. The flight management system includes a validation subsystem that includes the inactive flight management computer and a validation unit connected to the flight management computers. The validation subsystem is independent of the active guidance subsystem and configured to validate open world data and to transmit at least to the active flight management computer data that is validated during the validation.

Claims

1. An aircraft flight management system comprising:

at least two flight management computers, of which a first computer termed active at a current time forms part of an active guidance subsystem configured to supply data for guiding an aircraft at the current time, and a second computer is termed inactive at the current time;

a validation subsystem comprising the second, inactive flight management computer and a validation unit connected to the first and second flight management computers;

the validation unit comprising a display unit and at least one display screen, wherein the validation unit is configured to display at least a computed value of a parameter on the at least one display screen;

the display unit comprising a validation device enabling an operator to declare valid open world data used to compute the displayed value of the parameter;

wherein the validation subsystem is independent of the active guidance subsystem and configured to allow validation of open world data and to transmit at least to the first, active flight management computer data that is validated during the validation.

2. The aircraft flight management system according to claim 1, wherein the validation unit comprises:

a storage unit configured to store open world data to be validated; and

a computation unit configured to compute a value of at least one parameter from the data.

3. The aircraft flight management system according to claim 2, wherein the flight management system comprises the first, active flight management computer dedicated to a first operator flying the aircraft at the current time and the second, inactive flight management computer dedicated to a second operator not flying the aircraft at the current time, and wherein the validation subsystem comprises the second, inactive flight management computer dedicated to the second operator not flying the aircraft at the current time.

4. The aircraft flight management system according to claim 2, wherein the aircraft flight management system comprises at least one operational principal flight management computer and one backup flight management computer, and wherein the validation subsystem comprises the backup flight management computer.

5. The aircraft flight management system according to claim 1, wherein the aircraft flight management system comprises at least one operational principal flight management computer and one backup flight management computer, and wherein the validation subsystem comprises the backup flight management computer.

6. The aircraft flight management system according to claim 1, wherein the flight management system comprises the first, active flight management computer dedicated to a first operator flying the aircraft at the current time and the second, inactive flight management computer dedicated to a second operator not flying the aircraft at the current time, and wherein the validation subsystem comprises the second, inactive flight management computer dedicated to the second operator not flying the aircraft at the current time.

7. The aircraft flight management system according to claim 1, wherein the validation unit is hosted in a dedicated system.

8. The aircraft flight management system according to claim 1, wherein the validation unit comprises a plurality of subsystems divided between and hosted in a plurality of different avionic systems.

9. A method of securing open world data using an aircraft flight management system, the aircraft flight management system comprising:

at least two flight management computers, of which a first computer termed active at a current time forms part of an active guidance subsystem configured to supply data for guiding an aircraft at the current time, and a second computer is termed inactive at the current time;

a validation subsystem comprising the second, inactive flight management computer and a validation unit connected to the first and second flight management computers;

the validation unit comprising a display unit and at least one display screen, wherein the validation unit is configured to display at least a computed value of a parameter on the at least one display screen;

the display unit comprising a validation device enabling an operator to declare valid open world data used to compute the displayed value of the parameter; and

wherein the validation subsystem is independent of the active guidance subsystem and configured to allow a validation of open world data and to transmit at least to the first, active flight management computer data that is validated during the validation;

the method comprising a sequence of validation steps executed after reception by the flight management system of open world data to be validated by an operator and comprising;

a desynchronization step comprising using a validation unit to desynchronize the two flight management computers;

a data processing step comprising loading the data to be validated into a flight plan termed secondary of the inactive flight management computer and the inactive flight management computer calculating the value of at least one corresponding parameter using the data;

a display step executed by a display unit and comprising displaying results of the computation on at least one display screen of the display unit for validation;

a validation step executed by an operator acting on the validation device and comprising validating the data or not validating the data by the operator;

a subsequent step comprising, in case of validation of the data, transferring the validated data to the active flight management computer, deleting the secondary flight plan from the inactive flight management computer after transferring the data and resynchronizing the first and second flight management computers so that the inactive flight management computer is initialized to at least one flight plan of the active flight management computer.

10. The method according to claim 9, wherein in case of non-validation of the data, the subsequent step at least comprises sending an error message and deleting the non-validated data from the second, inactive flight management computer.

11. The method according to claim 10, wherein the sequence of validation steps comprises, between the synchronization step and the data processing step, an auxiliary processing step comprising, if necessary, deleting from the second, inactive flight management computer flight plans that the second, inactive flight management computer contains.

12. The method according to claim 9, wherein the sequence of validation steps comprises, between the synchronization step and the data processing step, an auxiliary processing step comprising, if necessary, deleting from the second, inactive flight management computer flight plans that the second, inactive flight management computer contains.

13. The method according to claim 9, wherein the data processing step comprises computing a flight path and predictions.

14. The method according to claim 9, comprising protocol filtering of the open world data executed by a filter unit before execution of the sequence of validation steps.

15. An aircraft comprising an aircraft flight management system, the aircraft flight management system comprising:

at least two flight management computers, of which a first computer termed active at a current time forms part of an active guidance subsystem configured to supply data for guiding the aircraft at the current time, and a second computer is termed inactive at the current time;

a validation subsystem comprising the second, inactive flight management computer and a validation unit connected to the first and second flight management computers;

the validation unit comprising a display unit and at least one display screen, wherein the validation unit is configured to display at least a computed value of a parameter on at least one display screen;

the display unit comprising a validation device enabling an operator to declare valid open world data used to compute the displayed value of the parameter; and

wherein the validation subsystem is independent of the active guidance subsystem and configured to allow a validation of open world data and to transmit at least to the first, active flight management computer data that is validated during the validation.

16. An aircraft flight management system comprising:

at least two flight management computers, of which a first computer termed active at a current time forms part of an active guidance subsystem configured to supply data for guiding an aircraft at the current time, and a second computer is termed inactive at the current time; and

a validation subsystem comprising the second, inactive flight management computer and a validation unit connected to the first and second flight management computers;

the validation unit comprising;

at least one display screen, wherein the validation unit is configured to display at least a computed value of a parameter on the at least one display screen; and

a validation device enabling an operator to declare valid open world data used to compute the displayed value of the parameter;

wherein the validation subsystem is configured to allow validation of open world data and to transmit at least to the first, active flight management computer data that is validated during the validation.

17. A method of securing open world data using an aircraft flight management system, the aircraft flight management system comprising:

at least two flight management computers, of which a first computer termed active at a current time forms part of an active guidance subsystem configured to supply data for guiding an aircraft at the current time, and a second computer is termed inactive at the current time; and

a validation subsystem comprising the second, inactive flight management computer and a validation unit connected to the first and second flight management computers;

the validation unit comprising;

at least one display screen, wherein the validation unit is configured to display at least a computed value of a parameter on the at least one display screen; and

a validation device enabling an operator to declare valid open world data used to compute the displayed value of the parameter;

wherein the validation subsystem is configured to allow a validation of open world data and to transmit at least to the first, active flight management computer data that is validated during the validation;

the method comprising, after reception by the flight management system of open world data;

executing a desynchronization step comprising using the validation unit to desynchronize the two flight management computers;

executing a data processing step comprising loading the data to be validated into a flight plan termed secondary of the inactive flight management computer and the inactive flight management computer calculating the value of at least one corresponding parameter using the data;

executing a display step, by the validation unit, comprising displaying results of the computation on at least one display screen of the validation unit for validation;

executing a validation step, on the validation device, comprising validating the data or not validating the data by the validation device; and

executing a subsequent step comprising, in case of validation of the data, transferring the validated data to the active flight management computer, deleting the secondary flight plan from the inactive flight management computer after transferring the data and resynchronizing the first and second flight management computers so that the inactive flight management computer is initialized to at least one flight plan of the active flight management computer.