Apparatus and method for backup control in a distributed flight control system

• US 20070164166A1
• Filed: 01/17/2007
• Published: 07/19/2007
• Est. Priority Date: 01/17/2006
• Status: Active Grant

• Current Assignee: Gulfstream Aerospace Corporation (General Dynamics Corporation)
• Original Assignee: Gulfstream Aerospace Corporation (General Dynamics Corporation)
• Inventors: Hirvonen, Jukka Matti
• Granted Patent: US 7,984,878 B2
• Time in Patent Office: Days
• US Class Current: 244/175
• CPC Class Codes: B64C 13/504 using electro-hydrostatic actuators [EHA's]
• CPC Class Codes: B64C 13/505 having duplication or stand-by provisions
• CPC Class Codes: G05D 1/0077 using redundant signals or controls
• CPC Class Codes: Y02T 50/40 Weight reduction

Abstract

Embodiments of the invention relate to a flight control system for controlling an aircraft during flight. The flight control system may include a primary controller configured to receive an input from a pilot and to output a primary control signal and a primary transmission path connected to the primary controller and configured to relay the primary control signal. The flight control system may also include a backup controller configured to receive the input from the pilot and to output a backup control signal and a backup transmission path connected to the backup controller and configured to relay the backup control signal. Additionally, the flight control system may include an actuator having a remote electronics unit configured to receive the primary control signal and the backup control signal and to determine if the primary control signal is available and valid. The remote electronics unit may be configured to output an actuator command based on the primary control signal if the primary control signal is available and valid and to output the actuator command based on the backup control signal if the primary control signal is unavailable or invalid.

Claims

1. A flight control system for controlling an aircraft, the flight control system comprising:

a first controller configured to receive a first input and to output a primary control signal;

a first transmission path coupled to the first controller and configured to relay the primary control signal;

a second controller configured to receive a second input and to output a backup control signal;

a second transmission path coupled to the second controller and configured to relay the backup control signal;

an actuator having actuator electronics configured to receive the primary control signal along the first transmission path and the backup control signal along the second transmission path and configured to determine if the primary control signal is valid; and

the actuator electronics located remotely from the primary controller and adjacent to the actuator and configured to output an actuator command based, at least in part, on the primary control signal if the primary control signal is valid and to output the actuator command based, at least in part, on the backup control signal if the primary control signal is not valid.

2. The flight control system of claim 1, wherein the first controller receives the first input from a primary sensor and the second controller receives the second input from a redundant sensor.

3. The flight control system of claim 1, wherein the actuator is placed in a predetermined safe mode if neither the primary control signal nor the backup control signal are valid.

4. The flight control system of claim 1, wherein the actuator electronics is configured to receive an actuator sensor input and compute the actuator command based, at least in part, on the actuator sensor input and at least one of the primary control signal or the backup control signal.

5. The flight control system of claim 1, wherein the first transmission path is bidirectional.

6. The flight control system of claim 5, wherein the second transmission path is unidirectional.

7. The flight control system of claim 6, wherein:

the actuator electronics are further configured to transmit the backup control signal to the first controller via the first transmission path; and

the first controller is further configured to monitor the backup control signal and generate a backup control system status signal.

8. The flight control system of claim 6, further comprising:

a first data link between the first controller and the second controller;

a validation data generator in the first controller; and

validation data generated by the validation data generator and transmitted to the second controller via the data link, the validation data being included in the backup control signal.

9. The flight control system of claim 8, wherein:

the actuator electronics are further configured to transmit the validation data in the backup control signal to the first controller via the first transmission path; and

the first controller is further configured to generate a backup control system status signal based, at least in part, on a comparison of the validation data transmitted to the second controller and the validation data received from the actuator electronics.

10. The flight control system of claim 9, wherein the actuator electronics further comprises:

a first input/output coupled to the first transmission path;

a second input/output coupled to the second transmission path, the second input/output being separate and independent from the first input/output; and

a second data link between the second input/output and the first input/output;

wherein the validation data is transmitted from the second input/output to the first input/output and the first input/output transmits the validation data to the first controller.

11. The flight control system of claim 10, wherein the first data link and second data link are optical links.

12. The flight control system of claim 1, wherein the second controller is separate and independent from the first controller.

13. The flight control system of claim 1, wherein the second transmission path is separate and independent from the first transmission path.

14. The flight control system of claim 1, wherein:

the actuator comprises a first plurality of actuators with each actuator having actuator electronics configured to receive the primary control signal along the first transmission path and the backup control signal along the second transmission path and configured to determine if the primary control signal is valid; and

each of the first plurality of actuators and actuator electronics is configured to use the backup control signal if the primary control signal is not valid.

15. The flight control system of claim 14, further comprising a second plurality of actuators configured to receive the primary control signal along the primary transmission path but not configured to receive the backup control signal.

16. The flight control system of claim 15, wherein the first plurality of actuators are coupled to a set of control surfaces capable of minimum acceptable control.

17. A backup control signal monitoring system for a flight control system, the flight control system comprising:

a first controller configured to receive a first input and to output a primary control signal;

a first transmission path coupled to the first controller and configured to relay the primary control signal;

a second controller configured to receive a second input and to output a backup control signal, the second controller being separate and independent from the first controller;

a second transmission path coupled to the second controller and configured to relay the backup control signal, the second transmission path being separate and independent from the first transmission path;

an actuator having actuator electronics located remotely from the primary controller and adjacent to the actuator; and

the actuator electronics being configured to receive the primary control signal along the first transmission path and the backup control signal along the second transmission path and configured to transmit backup validation data to the first controller via the first transmission path;

wherein the first controller is further configured to generate a backup control system status signal based, at least in part, on the backup validation data.

18. The monitoring system of claim 17, wherein the second transmission path is unidirectional.

19. The monitoring system of claim 17, wherein the backup validation data includes the backup control signal.

20. The monitoring system of claim 17, further comprising:

a first data link between the first controller and the second controller; and

a validation data generator in the first controller;

wherein the validation data is generated by the validation data generator and transmitted to the second controller via the data link, the validation data being included in the backup control signal received by the actuator electronics.

21. The monitoring system of claim 20, wherein the backup control system status signal is based, at least in part, on a comparison of the validation data transmitted to the second controller and the validation data received from the actuator electronics.

22. The monitoring system of claim 21, wherein the validation data is a bit.

23. A flight control system comprising:

a first processor configured to receive a first input and to output a primary control signal;

a first path coupled to the first processor and configured to relay the primary control signal;

a second processor configured to receive a second input and to output a backup control signal, the second controller being separate and independent from the first controller;

a second path coupled to the second processor and configured to relay the backup control signal, the second path being separate and independent from the first path;

a first actuator coupled to an aircraft control surface, the first actuator having a first actuator electronics coupled to the first path, the first actuator electronics configured to receive the primary control signal and to determine if the primary control signal is valid; and

a second actuator coupled to the aircraft control surface, the second actuator having a second actuator electronics coupled to the first path and the second path, the second actuator electronics configured to receive the primary control signal and the backup control signal and to determine if the primary control signal is valid;

wherein the second actuator electronics is configured to use the backup control signal to control the aircraft control surface only if the first actuator electronics and the second actuator electronics determines that the primary control signal is not valid.

24. The control system of claim 23, further comprising:

a status link coupled between the first actuator electronics and the second actuator electronics;

wherein the second actuator electronics receives information via the status link indicating whether the first actuator electronics determined that the primary control signal is not valid.

25. The control system of claim 24, wherein the first path comprises:

a first primary path coupled between the first controller and the first actuator electronics and configured to relay the primary control signal to the first actuator electronics; and

a second primary path coupled between the first controller and the second actuator electronics and configured to relay the primary control signal to the second actuator electronics, the second primary path being separate from the first primary path.

26. A method of controlling an aircraft control surface comprising:

receiving a primary control signal in an actuator electronics from a first processor, the actuator electronics being separate and independent from the first processor;

receiving a backup control signal in the actuator electronics from a second processor, the actuator electronics being separate and independent from the second processor;

determining whether the primary control signal is valid;

generating an actuator command signal by the actuator electronics based, at least in part, on the primary control signal if the primary control signal is valid;

generating the actuator command signal by the actuator electronics based, at least in part, on the backup control signal if the primary control signal is not valid;

actuating an actuator based on the actuator command signal to control an aircraft control surface.

27. The method of claim 26, further comprising placing the actuator in a predetermined safe mode if neither the primary control signal nor the backup control signal are valid.

28. The method of claim 26, further comprising:

receiving an actuator position feedback signal in the actuator electronics;

wherein;

generating the actuator command signal is based, at least in part, on the actuator position feedback signal and the primary control signal if the primary control signal is valid; and

generating the actuator command signal is based, at least in part, on the actuator position feedback signal an the backup control signal if the primary control signal is not valid.

29. A method of operating a flight control system comprising:

receiving a primary control signal in an actuator electronics from a first processor, the actuator electronics being separate and independent from the first processor;

receiving a backup control signal in the actuator electronics from a second processor, the actuator electronics being separate and independent from the second processor;

transmitting backup validation data from the actuator electronics to the first processor;

generating a backup control system status signal based, at least in part, on the backup validation data;

generating an actuator command signal by the actuator electronics based, at least in part, on at least one of the primary control signal or the backup control signal;

actuating an actuator based on the actuator command signal to control an aircraft control surface.

30. The method of claim 29, wherein the backup validation data includes the backup control signal.

31. The method of claim 29, further comprising:

generating the backup validation data in a validation data generator in the first controller;

transmitting the backup validation data across a first data link between the first processor and the second processor; and

including the backup validation data in the backup control signal received by the actuator electronics.

32. The method of claim 31, further comprising:

comparing the backup validation data transmitted to the second processor across the first data link;

wherein the backup control system status signal is based, at least in part, on the comparison of the backup validation data transmitted to the second processor and the backup validation data received from the actuator electronics.

33. A method of controlling a aircraft control surface comprising:

receiving a primary control signal in a first actuator electronics from a first processor, the actuator electronics being separate and independent from the first processor;

receiving the primary control signal in a second actuator electronics from the first processor, the second actuator electronics being separate and independent from the first processor;

receiving a backup control signal in the second actuator electronics from a second processor, the second actuator electronics being separate and independent from the second processor;

determining whether the primary control signal is valid in the first actuator electronics;

determining whether the primary control signal is valid in the second actuator electronics;

generating a first actuator command signal in the first actuator electronics based, at least in part, on the primary control signal if the first actuator electronics determines the primary control signal is valid;

generating a second actuator command signal in the second actuator electronics based, at least in part, on the primary control signal if the second actuator electronics determines the primary control signal is valid;

generating the second actuator command signal in the second actuator electronics based, at least in part, on the backup control signal if the first actuator electronics and the second actuator electronics determine that the primary control signal is not valid;

actuating a first actuator based on the first actuator command signal to control an aircraft control surface; and

actuating a second actuator based on the second actuator command signal to control the aircraft control surface.

34. The method of claim 33, further comprising:

transmitting status information across a status link between the first actuator electronics and the second actuator electronics;

determining in the second actuator electronics whether the first actuator electronics determined that the primary control signal is not valid based, at least in part, on the status information.