Systems and methods for command management

• US 10,409,659 B2
• Filed: 03/16/2017
• Issued: 09/10/2019
• Est. Priority Date: 03/16/2017
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Bilek, Jan, Born, Rick J., Dostal, Martin, Kolcarek, Pavel
• Primary Examiner(s): Rashid, Wissam
• Application Number:
  US15/460,505
• Publication Number:
  US 20180267845A1
• Time in Patent Office: 908 Days
• Field of Search: None
• CPC Class Codes: G06F 9/451 Execution arrangements for user interfaces
• CPC Class Codes: G06F 9/4825 Interrupt from clock, e.g. time of day
• CPC Class Codes: G06F 9/4881 Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues
• CPC Class Codes: G06F 9/5005 to service a request
• CPC Class Codes: G06F 9/546 Message passing systems or structures, e.g. queues

Abstract

Systems and methods capable of increasing reliability of received commands across a variety of different kinds of input devices and modalities are provided. The provided systems and methods easily expand to support additional input devices, and easily adapt to a wide variety of command destinations, such as subsystems and components. The provided systems and methods employ command specific verification strategies before transmitting the command to its destination. The provided systems and methods also concurrently support a wide variety of command destinations, such as subsystems and components.

Claims

1. A command management system, the system comprising:

a memory device; and

a processor coupled to the memory device, the processor configured to;

(a) reference stored supported commands;

(b) reference a predefined safety-critical scale to associate each supported command with a respective criticality level;

(c) assign each input device of a plurality of input devices a respective reliability score;

(d) receive a first received command from a first input device of the plurality of input devices;

(e) generate a request reliability score for the received command based on the reliability score of the first input device;

(f) compare the request reliability score to the criticality level associated with the first received command;

(g) transmit the command responsive to determining that the request reliability score is >

=the criticality level;

determine whether the first received command has immediate effect;

determine whether the first received command has more than a minimal safety effect, based on its criticality level; and

determine whether the first received command has undo functionality.

2. The system of claim 1, wherein the processor is further configured to:

transmit the first received command to a command destination responsive to the determination that the first received command meets both of the conditions;

(i) does not have immediate effect, and (ii) has undo functionality; and

generate and transmit a notification associated with the command.

3. The system of claim 1, wherein the processor is further configured to:

responsive to determining that the first received command meets both of the conditions;

(i) does not have immediate effect, and (ii) does not have undo functionality;

receive a confirmation from a user input device responsive to requesting a confirmation of the first received command;

verify the confirmation;

and only transmit the first received command responsive to the verified confirmation.

4. The system of claim 1, wherein the processor is further configured to:

responsive to determining that the first received command meets both of the conditions;

(i) has immediate effect, and (ii) has more than a minimal safety effect;

receive a confirmation responsive to requesting a confirmation of the first received command;

verify the confirmation;

and only transmit the first received command responsive to the verified confirmation.

5. The system of claim 1, wherein the processor is further configured to:

responsive to determining that the first received command meets both of the conditions;

(i) has immediate effect, and (ii) does not have more than a minimal safety effect;

transmit a notification of the first received command to a user interface; and

transmit the first received command only upon the condition that a cancellation is not received within a predetermined delay time after transmission of the notification of the first received command.

6. The system of claim 1, wherein the processor is further configured to:

receive a second received command from a second input device of the plurality of input devices; and

responsive to determining that the first received command and the second received command are related, (i) generate the request reliability score further based on the assigned reliability score of the second input device, and (ii) repeat (f)-(g).

7. The system of claim 3, wherein the processor is configured to verify the confirmation of the command by comparing a required reliability score with a reliability score of a user input device from which the confirmation came.

8. The system of claim 7, wherein the user input device providing the confirmation of the command is a touch screen device.

9. A method for a command management system, the method comprising:

in a reliability engine,

referencing stored supported commands;

associating each supported command with a respective safety-criticality level from a predefined safety-critical scale;

assigning a respective reliability score to each input device of a plurality of input devices in communication with the reliability engine;

receiving a first command from a first input device of the plurality of input devices;

generating a request reliability score for the received command based on the assigned reliability score of the first input device;

comparing the request reliability score to the safety-criticality level associated with the command; and

transmitting the command responsive to determining that the request reliability score is >

=the safety-criticality level;

receiving a second command from a second input device of the plurality of input devices; and

responsive to determining that the first received command and the second received command are related, generating the request reliability score further based on the assigned reliability score of the second input device.

10. The method of claim 9, further comprising

determining whether the first received command has immediate effect;

determining whether the first received command has more than a minimal safety effect, based on its criticality level; and

determining whether the first received command has undo functionality.

11. The method of claim 10, further comprising:

responsive to determining that the first received command meets both of the conditions;

(i) does not have immediate effect, and (ii) has undo functionality;

transmiting the first received command to a command destination; and

generating and transmiting a notification associated with the first received command.

12. The method of claim 10, further comprising:

responsive to determining that the first received command meets both of the conditions;

(i) does not have immediate effect, and (ii) does not have undo functionality;

receiving a confirmation of the first received command;

verifying the confirmation of the first received command;

and only transmitting the first received command responsive to the verified confirmation.

13. The method of claim 10, further comprising:

responsive to determining that the first received command meets both of the conditions;

(i) has immediate effect, and (ii) has more than a minimal safety effect, based on its criticality level;

receiving a confirmation of the first received command;

verifying the confirmation of the first received command;

and only transmitting the first received command responsive to the verified confirmation.

14. The method of claim 10, further comprising:

responsive to determining that the first received command meets both of the conditions;

(i) has immediate effect, and (ii) does not have more than a minimal safety effect, based on its criticality level;

transmitting a notification of the first received command to a user interface; and

transmitting the first received command only upon the condition that a cancellation is not received within a predetermined delay time after transmission of the notification of the first received command.

15. An aircraft, comprising:

a plurality of user input devices;

a command management system coupled to the plurality of input devices and to a plurality of command destinations, the command management system comprising a memory device, and a processor coupled to the memory device, the command management system configured to;

(a) reference stored supported commands associated with the command destinations;

(b) associate each supported command with a respective criticality level from a predefined safety-critical scale;

(c) assign each user input device of the plurality of user input devices a respective reliability score;

(d) receive a first received command from a first user input device of the plurality of user input devices;

(e) generate a request reliability score for the received command based on the assigned reliability score of the first input device;

(f) compare the request reliability score to the criticality level associated with the first received command;

(g) determine that the request reliability score is >

=the criticality level, and transmit the command;

determine whether the first received command has immediate effect;

determine whether the first received command has a significant impact; and

determine whether the first received command has undo functionality.

16. The aircraft of claim 15, wherein the command management system is further configured to:

responsive to determining that the first received command meets both of the conditions;

(i) does not have immediate effect, and (ii) has undo functionality;

transmit the first received command to a command destination; and

generate and transmit a notification associated with the command.

17. The aircraft of claim 15, wherein the command management system is further configured to:

upon determining that the first received command;

(a) meets both of the conditions, (i) does not have immediate effect, and (ii) does not have undo functionality, or

(b) meets both of the conditions;

(i) has immediate effect, and (ii) has more than a minimal safety effect, based on its criticality level,

verify a confirmation of the first received command;

and only transmit the first received command responsive to verifying the confirmation.