Digital fail operational automatic flight control system utilizing redundant dissimilar data processing

• US 4,622,667 A
• Filed: 11/27/1984
• Issued: 11/11/1986
• Est. Priority Date: 11/27/1984
• Status: Expired due to Term

• Current Assignee: Honeywell Incorporated (Honeywell International Inc.)
• Original Assignee: Sperry Corporation (Unisys Corporation)
• Inventors: Yount, Larry J.
• Primary Examiner(s): Gruber, Felix D.
• Assistant Examiner(s): Black, Thomas G.
• Application Number:
  US06/675,154
• Time in Patent Office: 714 Days
• Field of Search: 364/184, 364/187, 364/434, 371/68, 371/37, 371/9, 244/194
• US Class Current: 714/11
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: G05D 1/0077 using redundant signals or controls
• CPC Class Codes: G06F 11/16 Error detection or correction of the data by redundancy in hardware
• CPC Class Codes: G06F 11/1633 using mutual exchange of the output between the redundant processing components
• CPC Class Codes: G06F 11/20 using active fault-masking, e.g. by switching out faulty elements or by switching in spare elements
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component
• CPC Class Codes: G06F 11/2043 where the redundant components share a common memory address space

Abstract

An automatic flight control system that is software fault tolerant fail operational in response to a first generic failure utilizes two independent subsystems each including a dual channel flight control computer. One channel in each flight control computer includes a digital processor and the other channel includes two digital processors. Cross channel monitoring is included in each flight control computer to discern disagreements between the outputs of the channels. If disagreement occurs between one of the two processing elements in the channel including two processing elements and the processing element of the channel having one processing element, the involved processing element in the two-element channel is disabled. If both processing elements in the two element channel disagree with the processing element in the other channel, the subsystem is disabled. All of the processing elements perform identical tasks. The three processing elements in each subsystem provide dissimilar data processing with respect to each other. The processing elements in the single element channels provide dissimilar data processing with respect to each other. Only three unique types of dissimilar data processing are utilized.

Claims

1. An automatic flight control system for aircraft having sensor means for providing sensor signals in accordance with flight conditions experienced by said aircraft and having aircraft control means responsive to control signals for controlling the flight conditions of said aircraft, said system comprising

at least first and second automatic flight control subsystems,

said first subsystem including first and second automatic flight control system channels and said second subsystem including third and fourth automatic flight control system channels,

said first, second, third and fourth automatic flight control system channels receiving said sensor signals and providing said control signals,

a first digital data processing computer included in said first channel,

second and third digital data processing computers included in said second channel,

first cross channel monitoring means for comparing the output of said first computer with the outputs of said second and third computers and providing first and second comparison signals in accordance with disagreement therebetween, respectively,

first disabling means responsive to said first comparison signal for disabling said second computer when said first comparison signal indicates disagreement between the outputs of said first and second computers,

second disabling means responsive to said second comparison signal for disabling said third computer when said second comparison signal indicates disagreement between the outputs of said first and third computers,

third disabling means responsive to said first and second comparison signals for disabling said first automatic flight control subsystem when said first and second comparison signals indicate disagreement between the outputs of said first and second computers and between the outputs of said first and third computers, respectively,

a fourth digital data processing computer included in said third channel,

fifth and sixth digital data processing computers included in said fourth channel,

second cross channel monitoring means for comparing the output of said fourth computer with the outputs of said fifth and sixth computers and providing third and fourth comparison signals in accordance with disagreement therebetween, respectively,

fourth disabling means responsive to said third comparison signal for disabling said fifth computer when said third comparison signal indicates disagreement between the outputs of said fourth and fifth computers,

fifth disabling means responsive to said fourth comparison signal for disabling said sixth computer when said fourth comparison signal indicates disagreement between the outputs of said fourth and sixth computers, and

sixth disabling means responsive to said third and fourth comparison signals for disabling said second automatic flight control subsystem when said third and fourth comparison signals indicate disagreement between the outputs of said fourth and fifth computers and the outputs of said fourth and sixth computers, respectively,

said first, second, third, fourth, fifth and sixth computers performing identical tasks with respect to each other for providing said control signals in response to said sensor signals,

said first, second and third computers providing dissimilar data processing with respect to each other,

said fourth, fifth and sixth computers providing dissimilar data processing with respect to each other,

said first and fourth computers providing dissimilar data processing with respect to each other,

each of said first, second, third, fourth, fifth and sixth computers being selected from a group consisting of three computers that provide dissimilar data processing with respect to each other,

whereby said automatic flight control system is fail-operational with respect to a first generic fault.

2. The system of claim 1 in which said group consists of three computers that are dissimilar in hardware with respect to each other.

3. The system of claim 1 in which said group consists of three computers that are dissimilar in software with respect to each other.

4. The system of claim 1 in which said group consists of three computers that are dissimilar in hardware and in software with respect to each other.

5. The system of claim 1 in which said channels include respective input data conversion portions responsive to said sensor signals for converting said sensor signals into a format suitable for inputting into said computers in said channels.

6. The system of claim 1 in which said channels include respective output data conversion portions for converting the outputs provided by said computers in said channels into a format suitable for said control signals for application to said aircraft control means.

7. The system of claim 1 in which said second computer includes

cross channel monitoring means for comparing the output of said first computer with the output of said second computer, and

latch means for storing a discrete signal in accordance with said comparison, said latch means providing said first comparison signal.

8. The system of claim 1 in which said third computer includes

cross channel monitoring means for comparing the output of said first computer with the output of said third computer, and

latch means for storing a discrete signal in accordance with said comparison, said latch means providing said second comparison signal.

9. The system of claim 1 in which said fifth computer includes

cross channel monitoring means for comparing the output of said fourth computer with the output of said fifth computer, and

latch means for storing a discrete signal in accordance with said comparison, said latch means providing said third comparison signal.

10. The system of claim 1 in which said sixth computer includes

cross channel monitoring means for comparing the output of said fourth computer with the output of said sixth computer, and

latch means for storing a discrete signal in accordance with said comparison, said latch means providing said fourth comparison signal.

11. The system of claim 1 further comprising

a third automatic flight control subsystem,

said third subsystem including fifth and sixth automatic flight control system channels,

said fifth and sixth automatic flight control system channels receiving said sensor signals and providing said control signals,

a seventh digital data processing computer included in said fifth channel,

eighth and ninth digital data processing computers included in said sixth channel,

third cross channel monitoring means for comparing the output of said seventh computer with the outputs of said eighth and ninth computers and providing fifth and sixth comparison signals in accordance with disagreement therebetween, respectively,

seventh disabling means responsive to said fifth comparison signal for disabling said eighth computer when said fifth comparison signal indicates disagreement between the outputs of said seventh and eighth computers,

eighth disabling means responsive to said sixth comparison signal for disabling said ninth computer when said sixth comparison signal indicates disagreement between the outputs of said seventh and ninth computers, and

ninth disabling means responsive to said fifth and sixth comparison signals for disabling said third automatic flight control subsystem when said fifth and sixth comparison signals indicate disagreement betwen the outputs of said seventh and eighth computers and the outputs of said seventh and ninth computers, respectively,

said first, second, third, fourth, fifth, sixth, seventh, eighth and ninth computers performing identical tasks with respect to each other for providing said control signals in response to said sensor signals,

said seventh, eighth and ninth computers providing dissimilar data processing with respect to each other,

said first, fourth and seventh computers providing dissimilar data processing with respect to each other,

each of said first, second, third, fourth, fifth, sixth, seventh, eighth and ninth computers being selected from said group consisting of three computers that provide dissimilar data processing with respect to each other,

whereby said automatic flight control system is fail operational with respect to a first generic fault and is fail operational with respect to first and second random faults.

12. The system of claim 1 in which said first computer includes

cross channel monitoring means for comparing the output of said first computer with the outputs of said second and third computers, and

first and second latch means for storing discrete signals in accordance with said comparisons, respectively, said first and second latch means providing said first and second comparison signals respectively.

13. The system of claim 12 in which said second computer includes

cross channel monitoring means for comparing the output of said first computer with the output of said second computer, and

third latch means for storing a discrete signal in accordance with said comparison, said third latch means providing said first comparison signal.

14. The system of claim 13 in which said third computer includes

cross channel monitoring means for comparing the output of said first computer with the output of said third computer, and

fourth latch means for storing a discrete signal in accordance with said comparison, said fourth latch means providing said second comparison signal.

15. The system of claim 14 in which said first disabling means comprises

first switch means for transmitting the outputs of said second computer, and

first OR gate means coupled to receive the outputs of said first and third latches for disabling said first switch means from transmitting the outputs of said second computer when either said first or third latch means provides a discrete signal representative of disagreement.

16. The system of claim 15 in which said second disabling means comprises

second switch means for transmitting the outputs of said third computer, and

second OR gate means coupled to receive the outputs of said second and fourth latch means for disabling said second switch means from transmitting the outputs of said third computer when either said second or fourth latch means provides a discrete signal representative of disagreement.

17. The system of claim 16 in which said third disabling means includes AND gate means coupled to receive the outputs of said first and second OR gate means for disabling said first automatic flight control subsystem when said first and second OR gate means both provide disabling signals.

18. The system of claim 1 in which said fourth computer includes

cross channel monitoring means for comparing the output of said fourth computer with the outputs of said fifth and sixth computers, and

first and second latch means for storing discrete signals in accordance with said comparisons respectively, said first and second latch means providing said third and fourth comparison signals respectively.

19. The system of claim 18 in which said fifth computer includes

cross channel monitoring means for comparing the output of said fourth computer with the output of said fifth computer, and

third latch means for storing a discrete signal in accordance with said comparison, said third latch means providing said third comparison signal.

20. The system of claim 19 in which said sixth computer includes

cross channel monitoring means for comparing the output of said fourth computer with the output of said sixth computer, and

fourth latch means for storing a discrete signal in accordance with said comparison, said fourth latch means providing said fourth comparison signal.

21. The system of claim 20 in which said fourth disabling means comprises

first switch means for transmitting the outputs of said fifth computer, and

first OR gate means coupled to receive the outputs of said first and third latch means for disabling said first switch means from transmitting the outputs of said fifth computer when either said first or third latch means provides a discrete signal representative of disagreement.

22. The system of claim 21 in which said fifth disabling means comprises

second switch means for transmitting the outputs of said sixth computer, and

second OR gate means coupled to receive the outputs of said second and fourth latch means for disabling said second switch means for transmitting the outputs of said sixth computer when either said second or fourth latch means provides a discrete signal representative of disagreement.

23. The system of claim 22 in which said sixth disabling means includes AND gate means coupled to receive the outputs of said first and second OR gate means for disabling said second automatic flight control subsystem when said first and second OR gate means both provide disabling signals.

24. An automatic flight control system for aircraft having sensor means for providing sensor signals in accordance with flight conditions experienced by said aircraft and having aircraft control means responsive to control signals for controling the flight conditions of said aircraft, said system comprising

at least first and second automatic flight control subsystems,

said first subsystem including first and second automatic flight control system channels and said second subsystem including third and fourth automatic flight control system channels,

said first, second, third and fourth automatic flight control system channels receiving said sensor signals and providing said control signals,

a first digital data processing computer included in said first channel,

second and third digital data processing computers included in said second channel,

first cross channel monitoring means for comparing the output of said first channel with the output of said second channel and providing a first comparison signal in accordance with disagreement therebetween,

first substituting means responsive to said first comparison signal for disabling said second computer and substituting said third computer therefor when said first comparison signal indicates disagreement between the outputs of said first and second channels,

first disabling means responsive to said first cross channel monitoring means for disabling said first automatic flight control subsystem when said substitution of said third computer for said second computer does not resolve said disagreement,

a fourth digital data processing computer included in said third channel,

fifth and sixth digital data processing computers included in said fourth channel,

second cross channel monitoring means for comparing the output of said third channel with the output of said fourth channel and providing a second comparison signal in accordance with disagreement therebetween,

second substituting means responsive to said second comparison signal for disabling said fifth computer and substituting said sixth computer therefor when said second comparison signal indicates disagreement between the outputs of said third and fourth channels,

second disabling means responsive to said second cross channel monitoring means for disabling said second automatic flight control subsystem when said substitution of said sixth computer for said fifth computer does not resolve said disagreement,

said first, second, third, fourth, fifth and sixth computers performing identical tasks with respect to each other for providing said control signals in response to said sensor signals,

said first, second and third computers providing dissimilar data processing with respect to each other,

said fourth, fifth and sixth computers providing dissimilar data processing with respect to each other,

said first and fourth computers providing dissimilar data processing with respect to each other,

each of said first, second, third, fourth, fifth and sixth computers being selected from a group consisting of three computers that provide dissimilar data processing with respect to each other,

whereby said automatic flight control system is fail-operational with respect to a first generic fault.