Multiple-voting fault detection system for flight critical actuation control systems
First Claim
1. A method of detecting faults in an aircraft control system having an actuator, and a plurality of control channels for r®
- receiving control signals and processing said signals to generate output signals for driving said actuator, said method comprising;
in each said channel, generating a monitoring signal representative of actual operation of said actuator and a model signal corresponding to expected operation of said actuator, comparing said monitoring signal to said model signal, and determining an operating status based on results of said comparing;
communicating said monitoring signal and said model signal generated in a first one of said channels to a second one of said channels, and communicating said monitoring signal and said model signal generated in said second channel to said first channel;
in each one of said first and second channels, independently performing comparisons of said monitoring signal and said model signal communicated from the other of said first and second channels and said monitoring signal and said model signal generated in said one of said first and second channels to determine a fault status of each of said first and second channels; and
maintaining communication links between said channels, including a link between said first channel and said second channel; and
providing, in each of said first and second channels, a deactivating switch responsive to a fault status signal from the other of said first and second channels.
1 Assignment
0 Petitions
Accused Products
Abstract
A control system includes a dual actuator (2) and primary and secondary controllers (20, 22), each of which has two control channels. In a normal mode of operation, the primary controller (20) controls both valves (32, 38) of the actuator (2). Each primary channel generates a model signal and a monitoring signal corresponding to expected and actual operation of the actuator, respectively. The two signals from each channel are communicated to the other channel. Each channel monitors itself as well as the other channel by comparing model and monitoring signals; and is also similarly redundantly monitored by the other channel of the controller (20). Each channel independently compares its own signals with the signals from the other channel. Each of the two channels has a deactivating switch responsive to a fault status signal from either of the two channels to thereby allow deactivation of a failed channel even when the failure in such channel prevents it from deactivating itself. The channels of the secondary controller (22) are similarly redundantly monitored by themselves and each other. Communication links are maintained between the primary channels, the secondary channels, and between the primary and secondary channels.
-
Citations
19 Claims
-
1. A method of detecting faults in an aircraft control system having an actuator, and a plurality of control channels for r®
- receiving control signals and processing said signals to generate output signals for driving said actuator, said method comprising;
in each said channel, generating a monitoring signal representative of actual operation of said actuator and a model signal corresponding to expected operation of said actuator, comparing said monitoring signal to said model signal, and determining an operating status based on results of said comparing; communicating said monitoring signal and said model signal generated in a first one of said channels to a second one of said channels, and communicating said monitoring signal and said model signal generated in said second channel to said first channel; in each one of said first and second channels, independently performing comparisons of said monitoring signal and said model signal communicated from the other of said first and second channels and said monitoring signal and said model signal generated in said one of said first and second channels to determine a fault status of each of said first and second channels; and maintaining communication links between said channels, including a link between said first channel and said second channel; and
providing, in each of said first and second channels, a deactivating switch responsive to a fault status signal from the other of said first and second channels. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13)
- receiving control signals and processing said signals to generate output signals for driving said actuator, said method comprising;
-
14. A method of detecting faults in an aircraft control system having an actuator, and a plurality of control channels for receiving control signals and processing said signals to generate output signals for driving said actuator, said method comprising:
-
in each said channel, generating a monitoring signal representative of actual operation of said actuator and a model signal corresponding to expected operation of said actuator, comparing said monitoring signal to said model signal, and determining an operating status based on results of said comparing; communicating said monitoring signal and said model signal generated in a first one of said channels to a second one of said channels, and communicating said monitoring signal and said model signal generated in said second channel to said first channel; in each one of said first and second channels, independently performing comparisons of said monitoring signal and said model signal communicated from the other of said first and second channels and said monitoring signal and said model signal generated in said one of said first and second channels to determine a fault status of each of said first and second channels; and maintaining communication links between said channels, including a link between said first channel and said second channel; and
providing, in each of said first and second channels, a deactivating switch responsive to a fault status signal from the other of said first and second channels;wherein said method comprises providing first and second predetermined difference thresholds, said second threshold representing a greater deviation tolerance than said first threshold;
determining said fault statuses on a basis of said first threshold; and
comparing said output signals of said first and second channels to determine a failure status based on said second threshold.
-
-
15. In an aircraft control system having an actuator, and a plurality of control channels for receiving control signals and processing said signals to generate output signals for driving said actuator, a fault detection system comprising:
-
in each said channel, a monitoring device that interfaces with said actuator to sense actual operation of said actuator and that generates a monitoring signal, model logic for generating a model signal representative of expected operation of said actuator, and comparison logic for comparing said monitoring signal with said model signal; communication links between said channels, including a link between two of said channels for transmitting said model signals and said monitoring signals in both directions between said two of said channels; in each of said two of said channels, voter logic for independently comparing said model signals and said monitoring signals of said two of said channels to determine a fault status of each of said two of said channels, said voter logic including said comparison logic; and in each of said two of said channels, a deactivating switch responsive to a fault status signal from either of said two of said channels. - View Dependent Claims (16, 17, 18, 19)
-
Specification