Fail-operational fault tolerant flight critical computer architecture and monitoring method
First Claim
1. A flight critical computer system for an aircraft, the aircraft having sensor means for providing sensor signals representative of characteristics concerning the aircraft, said system comprising:
- a first lane having a first primary processor and a first redundant processor and for providing a first command signal, said first primary processor for providing a first output signal and said first redundant processor for generating a first redundant output signal, as a function of said sensor signals;
a second lane having a second primary processor and a second redundant processor and for providing a second command signal, said second primary processor for providing a second output signal and said second redundant processor for generating a second redundant output signal, as a function of said sensor signals;
wherein said first primary processor is dissimilar from said second primary processor and said first and second redundant processors, said second primary processor is dissimilar from said first and second redundant processors, and said redundant processors are substantially similar to each other;
first monitoring means for comparing said first output signal with said second output signal and generating first comparison signals as a function of disagreement therebetween;
second monitoring means for comparing said first output signal with said second redundant output signal and generating second comparison signals as a function of disagreement therebetween;
third monitoring means for comparing said second output signal with said first redundant output signal and generating third comparison signals as a function of disagreement therebetween; and
selection means for selecting, as a function of said first, second, and third comparison signals, one of said first output signal and said first redundant output signal as said first command signal and one of said second output signal and said second redundant output signal as said second command signal while allowing for at least one of said processors to fail before disabling either of said lanes and disabling both of said lanes when both of said lanes are unable to detect any processor failure.
1 Assignment
0 Petitions
Accused Products
Abstract
A flight critical computer system for an aircraft includes dual independent lanes having two processors in each lane. The first lane has a primary processor and a redundant processor and provides a first command signal. The second lane includes a primary processor and a redundant processor and provides a second command signal. A first monitor compares the primary processor of the first lane with the primary processor of the second lane and generates first comparison signals as a function of disagreement therebetween. A second monitor compares the output signals of the redundant processor of the second lane and the primary processor of the first lane and generates second comparison signals as a function of disagreement therebetween. A third monitor compares the primary processor of the second lane with the redundant processor of the first lane and generates third comparison signals as a function of disagreement therebetween. Selection logic selects as a function of the first, second and third comparison signals at least output generated by the processors as a command signal of the system while allowing for at least one processor to fail before both command signals from the lanes, respectively, are disabled.
-
Citations
15 Claims
-
1. A flight critical computer system for an aircraft, the aircraft having sensor means for providing sensor signals representative of characteristics concerning the aircraft, said system comprising:
-
a first lane having a first primary processor and a first redundant processor and for providing a first command signal, said first primary processor for providing a first output signal and said first redundant processor for generating a first redundant output signal, as a function of said sensor signals; a second lane having a second primary processor and a second redundant processor and for providing a second command signal, said second primary processor for providing a second output signal and said second redundant processor for generating a second redundant output signal, as a function of said sensor signals; wherein said first primary processor is dissimilar from said second primary processor and said first and second redundant processors, said second primary processor is dissimilar from said first and second redundant processors, and said redundant processors are substantially similar to each other; first monitoring means for comparing said first output signal with said second output signal and generating first comparison signals as a function of disagreement therebetween; second monitoring means for comparing said first output signal with said second redundant output signal and generating second comparison signals as a function of disagreement therebetween; third monitoring means for comparing said second output signal with said first redundant output signal and generating third comparison signals as a function of disagreement therebetween; and selection means for selecting, as a function of said first, second, and third comparison signals, one of said first output signal and said first redundant output signal as said first command signal and one of said second output signal and said second redundant output signal as said second command signal while allowing for at least one of said processors to fail before disabling either of said lanes and disabling both of said lanes when both of said lanes are unable to detect any processor failure. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A flight critical computer system for an aircraft, the aircraft having sensor means for providing sensor signals representative of characteristics concerning the aircraft, said system comprising:
-
a first lane having a first primary processor and a first redundant processor and for providing a first command signal, said first primary processor for generating a first output signal and said first redundant processor for providing a first redundant output signal as a function of said sensor signals; a second lane having a second primary processor and a second redundant processor and for providing a second command signal, said second primary processor for generating a second output signal and said second redundant processor for generating a second redundant output signal as a function of said sensor signals; wherein said first primary processor is dissimilar from said second primary processor and said first and second redundant processors, said second primary processor is dissimilar from said first and second redundant processors, and said first and second redundant processors are substantially similar to each other; wherein said first primary processor includes first monitor means for monitoring said second primary processor and second monitor means for monitoring said second redundant processor, said first and second monitor means for generating first and second comparison signals, respectively, representative of disagreement or agreement therebetween; wherein said second primary processor includes third monitor means for monitoring said first primary processor and fourth monitor means for monitoring said first redundant processor, said third and fourth monitor means for generating third and fourth comparison signals, respectively, representative of disagreement or agreement therebetween; wherein said first redundant processor includes fifth monitor means for monitoring said second primary processor and for generating fifth comparison signals representative of disagreement or agreement therebetween; wherein said second redundant processor includes sixth monitor means for monitoring said first primary processor and for generating sixth comparison signals representative of disagreement or agreement therebetween, and; selection means for selecting, as a function of said first, second, third, fourth, fifth, and sixth comparison signals, one of said first output signal and said first redundant output signal as said first command signal and one of said second output signal and said second redundant output signal as said second command signal while allowing for at least one of said primary processors and said redundant processors to fail before both said first and second command signals from said first and second lanes, respectively, are disabled. - View Dependent Claims (12)
-
-
13. A monitoring method for fail-operational fault tolerant flight critical computer architecture, said method comprising the steps of:
-
providing dual independent lanes having two dissimilar processors in each lane, said first lane including a first primary processor and a first redundant processor and said second lane including a second primary processor and a second redundant processor, said first and second primary processors being dissimilar and said redundant processors being similar to each other, each of said processors producing an output signal in response to signals from one or more sensors representative of characteristics concerning an aircraft; monitoring the outputs of said first and second primary processors with respect to each other and generating comparison signals representative thereof; monitoring the outputs of said first redundant processor and said second primary processor with respect to each other and generating second comparison signals representative thereof; monitoring the outputs of said second redundant processor and said first primary processor with respect to each other and generating third comparison signals representative thereof; and selecting one of said output signals of said first primary processor and said first redundant processor and selecting one of said output signals of said second primary processor and said second redundant processor as command signals for said aircraft as a function of said first, second, and third comparison signals. - View Dependent Claims (14, 15)
-
Specification