MULTI-CHANNEL PROTECTION LOGIC

• US 20130079894A1
• Filed: 09/22/2011
• Published: 03/28/2013
• Est. Priority Date: 09/22/2011
• Status: Active Grant

• Current Assignee: Hamilton Sundstrand Corporation (Raytheon Technologies Corporation d/b/a RTX)
• Original Assignee: Hamilton Sundstrand Corporation (Raytheon Technologies Corporation d/b/a RTX)
• Inventors: Kamenetz, Jeffry K., Johnston, Mark A., Marotta, Edward John, O'Neil, John M.
• Granted Patent: US 9,483,032 B2
• Time in Patent Office: Days
• US Class Current: 700/4
• CPC Class Codes: F01D 21/02 Shutting-down responsive to overspeed
• CPC Class Codes: F02C 9/46 Emergency fuel control
• CPC Class Codes: F02D 2200/101 Engine speed
• CPC Class Codes: F02D 2400/08 Redundant elements, e.g. two sensors for measuring the same parameter
• CPC Class Codes: F02D 41/22 Safety or indicating devices for abnormal conditions in air/fuel ratio feedback systems F02D41/1495, in electric control linkage F02D11/107, in purge control systems F02M25/0809
• CPC Class Codes: F02D 41/266 the computer being backed-up or assisted by another circuit, e.g. analogue
• CPC Class Codes: F02D 41/28 Interface circuits
• CPC Class Codes: F05D 2270/021 to prevent overspeed
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A multi-channel controller uses multiple logic gates and multiple control channels to provide fault tolerant protection against undesired events.

Claims

1. A multi-channel controller comprising:

a first control channel having a first primary controller with a first primary control output signal and a first protection device with a first protection device output signal without sharing a microprocessor bus with the first primary control;

a second control channel having a second primary controller with a second primary control output signal and a second protection device with a second protection device output signal without sharing a microprocessor bus with the second primary control; and

a plurality of logic gates connecting each of said first primary control output signal, said first protection device output signal, said second primary control output signal, and said second protection device output signal to a controlled device.

2. The multi-channel controller of claim 1, wherein said first primary control output signal, said first protection device output signal, said second primary control output signal, and said second protection device output signal are overspeed detected signals.

3. The multi-channel controller of claim 1, wherein the controlled device is a multi-channel solenoid having a first channel and a second channel and wherein either of said channels is individually sufficient to actuate said multi-channel solenoid

4. The multi-channel controller of claim 1,

wherein said plurality of logic gates comprises at least a first primary OR gate and a second primary OR gate;

wherein said first primary OR gate combines a first primary control output signal and a second alternate output control signal representative of at least one of the second primary control signal, a second protection device signal and a health of the second control channel;

wherein said second primary OR gate combines a second primary control output signal and a first alternate output control signal representative of at least one of the first primary control signal, the first protection device signal and a health of the first control channel; and

wherein said first primary OR gate outputs a control signal to a controlled device and said second primary OR gate outputs a control signal to the controlled device.

5. The multi-channel controller of claim 4, wherein said first control channel comprises an alternate OR gate having an input of a first primary control output signal, a first protection device output signal and a first channel health signal, and wherein said alternate OR gate outputs an event detected signal to said second primary OR gate.

6. The multi-channel controller of claim 4, wherein said first channel comprises a channel health control AND gate having a first input corresponding to a first primary controller health and a second input corresponding to a first protection device health.

7. The multi-channel controller of claim 1, wherein said first control channel and said second control channel are symmetrical.

8. The multi-channel controller of claim 1, wherein said plurality of logic gates comprises a solid state logic circuit.

9. The multi-channel controller of claim 1, where the protection device comprises a combination of solid state logic circuits and software in a microprocessor independent of the primary controller.

10. The multi-channel controller of claim 1, wherein said controller is configured such that a multi-channel controller remains operable to detect an event when a fault occurs within at least one of a primary controller and a protection device that does not share a microprocessor bus with the primary controller, and wherein said multi-channel controller is configured such that a false event detection is prevented in an otherwise healthy system.

11. The multi-channel controller of claim 1, further comprising a plurality of self-test signal monitors connecting each of said first and second protection device with at least one of an input through a high side switch, an input through a low side switch, an output of a local overspeed vote signal, an output of a remote overspeed vote signal, and a plurality of outputs of one of said first and second primary controller.

12. A method for controlling a multi-channel solenoid comprising the steps of:

detecting an event using at least one of a first primary controller, a second primary controller, a first protection device, and a second protection device;

outputting an event detected signal from each of said first primary controller, said second primary controller, said first protection device, and said second protection device detecting said event; and

activating at least one channel of a multi-channel solenoid when at least one of said first and said second protection devices detects said event

wherein each of said protection devices do not share a microprocessor bus with their primary controllers.

13. The method of claim 12 wherein said event is an engine overspeed.

14. The method of claim 12, wherein said step of activating at least one channel of said multi-channel solenoid when at least one of said first and said second protection devices detects said event comprises:

providing a first activation input to a first channel of said multi-channel solenoid when said first primary controller detects said event; and

providing a second activation input to said first channel of said multi-channel solenoid when said first protection device detects said event.

15. The method of claim 12, wherein said step of activating at least one channel of said multi-channel solenoid when at least one of said first and said second protection devices detects said event comprises:

providing a first activation input to a first channel of said multi-channel solenoid when a second primary controller detects said event; and

providing a second activation input to said first channel of said multi-channel solenoid when said first protection device detects said event.

16. The method of claim 12, wherein said step of activating at least one channel of said multi-channel solenoid when at least one of said first and said second protection devices detects said event comprises:

providing a first activation input to a first channel of said multi-channel solenoid from said second primary controller when a sensor input to said second primary controller is in a failure state; and

providing a second activation input to a first channel of said multi-channel solenoid from said first protection device when said first protection device detects said event.

17. The method of claim 12, wherein said step of activating at least one channel of said multi-channel solenoid when at least one of said first and said second protection devices detects said event comprises:

providing a first activation input to a first channel of said multi-channel solenoid from a second channel health AND gate when said second primary controller and said second protection device are in a failure state; and

providing a second activation input to a first channel of said multi-channel solenoid from a first protection device when said first protection device detects said event.

18. The method of claim 12, wherein said step of activating at least one channel of said multi-channel solenoid when at least one of said first and said second protection devices detects said event comprises:

providing a first activation input to a first channel of said multi-channel solenoid from a first primary AND gate when a link between said first AND gate and the second channel is broken; and

providing a second activation input to a first channel of said multi-channel solenoid from a first protection device when said protection device detects said event.

19. The method of claim 12, wherein said step of activating at least one channel of a multi-channel solenoid when at least one of said first and said second protection devices detects said event occurs when at least one fault is present.

20. The method of claim 12, wherein said step of activating at least one channel of a multi-channel solenoid when at least one of said first and said second protection devices detects said event does not occur when at least one fault is present in the system and no event occurs.

21. A method for controlling a multi-channel solenoid using software comprising the steps of:

monitoring a current through an overspeed solenoid, and thereby determining the health of a controller and the health of a plurality of logic gates using a protection device.

22. The method of claim 21, further comprising the step of monitoring a voltage of a solenoid Low Side Switch (LSS) using said protection device.

23. The method of claim 22, wherein said step of monitoring the voltage of the solenoid Low Side Switch (LSS) using said protection device comprises raising a voltage of said signal to a voltage level readable by a protection device, wherein said voltage level is less than a voltage required to energize said multi-channel solenoid.

24. The method of claim 21, further comprising the steps of:

monitoring a high side switch command using said protection device;

monitoring at least one command from a primary controller using said protection device;

monitoring an output of a local overspeed vote signal using said protection device;

monitoring an output of a remote overspeed vote signal using said protection device;

monitoring a plurality of outputs of a primary controller using said protection device; and

determining a health of at least one of a primary controller and a plurality of logic gates based on said monitoring steps.

25. The method of claim 24, wherein said step of determining a health of at least one of a primary controller and a plurality of logic gates comprises passing an event detected signal form a primary controller to a primary OR gate and activating a self-test overspeed vote signal and determining that said primary controller and said plurality of logic gates are healthy when said high side switch and said low side switch operate as expected.