Autopilot flight director system
First Claim
1. An aircraft autopilot flight director system comprising:
- first, second and third redundant sensor sets, each sensor set producing predetermined output data signals related to the status of the aircraft;
first, second and third flight control computers, each computer including means for;
(a) comparing the associated sensor signal set with the sensor signal sets of the other two flight control computers and identifying a failure in response to a predetermined discrepancy there between;
(b) processing said first, second and third sensor set data signals and producing a reference sensor signal set;
(c) processing said reference sensor signal set and producing command control signals;
(d) comparing said produced command control signals with the command control signals produced by the other two flight control computers and identifying a self-failure in response to a predetermined discrepancy there between;
utilization means for utilizing the command control signals from at least two of the flight control computers as aircraft surface control commands; and
common mode fault detection means, utilizing apparatus and control laws unique from any of said first, second and third flight control computers, for independently producing command control signals, said common mode fault means including means for comparing each of said first, second and third flight control computer produced control signals with said independently produced control signals and identifying as a failure each of said computers which produces command controls which deviate from said independently produced command control signal by a predetermined value.
1 Assignment
0 Petitions
Accused Products
Abstract
Each of three redundant sensor sets (16, 18, 20) provides flight status data to a corresponding one of three flight control computers (22, 24, 26). Each of the computers shares sensor data as well as computed control surface command signals with all other system computers. The command signal outputs from two computers are transduced (34, 36) to mechanical commands which are combined and applied to the appropriate aircraft control surface. The remaining computer output is a mathematical model of the mechanical outputs of the other channels. Fault detection and isolation is accomplished by cross channel comparing sensor data, command signals, model/surface position information and by incorporating channel monitors for detecting generic or common mode flight control computer failures.
87 Citations
32 Claims
-
1. An aircraft autopilot flight director system comprising:
-
first, second and third redundant sensor sets, each sensor set producing predetermined output data signals related to the status of the aircraft; first, second and third flight control computers, each computer including means for; (a) comparing the associated sensor signal set with the sensor signal sets of the other two flight control computers and identifying a failure in response to a predetermined discrepancy there between; (b) processing said first, second and third sensor set data signals and producing a reference sensor signal set; (c) processing said reference sensor signal set and producing command control signals; (d) comparing said produced command control signals with the command control signals produced by the other two flight control computers and identifying a self-failure in response to a predetermined discrepancy there between; utilization means for utilizing the command control signals from at least two of the flight control computers as aircraft surface control commands; and common mode fault detection means, utilizing apparatus and control laws unique from any of said first, second and third flight control computers, for independently producing command control signals, said common mode fault means including means for comparing each of said first, second and third flight control computer produced control signals with said independently produced control signals and identifying as a failure each of said computers which produces command controls which deviate from said independently produced command control signal by a predetermined value. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23)
-
- 24. The system of cIaim 1 wherein each flight control computer includes means for self deactivation from continued system service in response to identifying itself as a self-failure.
-
26. An aircraft autopilot flight director system comprising:
-
first, second and third redundant sensor sets, each sensor set producing predetermined output data signals related to the status of the aircraft; first, second and third flight control computers, each computer including means for; (a) comparing the associated sensor signal set with the sensor signal sets of the other two flight control computers and identifying a failure in response to a predetermined discrepancy therebetween; (b) processing said first, second and third sensor set data signals and producing a reference sensor signal set; (c) processing said reference sensor signal set and producing command control signals; (d) comparing said produced command control signals with the command control signals produced by the other two flight control computers and identifying a self-failure in response to a predetermined discrepancy therebetween; utilization means for utilizing the command control signals from at least two of the flight control computers as aircraft surface control commands, said utilization means further comprising; first transducer means coupled to said first flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; second transducer means coupled to said third flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; and means for combining the mechanical outputs from the first and second transducers and coupling the resultant mechanical output to a predetermined control surface of the aircraft; a first transducer sensor for producing an output signal representative of the mechanical output of said first transducer; a second transducer sensor for producing an output signal representative of the mechanical output of said second transducer; means for coupling said first transducer sensor output signal to the first flight control computer and said second transducer sensor output signal to the third flight control computer; and wherein each flight control computer includes means for producing a model transducer sensor signal; said first flight control computer including means for comparing its model transducer produced sensor signal with the first transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween, said first flight control computer otherwise comparing the first transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the second transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the first transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure; said second flight control computer including means for comparing its model transducer produced sensor signal with the first and second transducer sensor produced signals and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second flight control computer model signal is the outside of tolerance signal, the failure otherwise being identified as a cross-channel failure; and said third flight control computer including means for comparing its model transducer produced sensor signal with the second transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween;
said third flight control computer otherwise comparing the second transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the first transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure. - View Dependent Claims (27, 28, 29, 30, 31, 32)
-
Specification