Apparatus for synchronizing flight management computers where only the computer chosen to be the master received pilot inputs and transfers the inputs to the spare

• US 5,790,791 A
• Filed: 05/12/1995
• Issued: 08/04/1998
• Est. Priority Date: 05/12/1995
• Status: Expired due to Term

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Chong, Ray K., Gunn, Peter D., Herald, Richard A.
• Primary Examiner(s): Lee, Thomas C.
• Assistant Examiner(s): Huang, Po C.
• Application Number:
  US08/440,563
• Time in Patent Office: 1,180 Days
• Field of Search: 318/85, 326/38, 364/132, 364/137, 364/187, 364/405, 375/202, 395/182.08, 395/489, 395/182.09, 395/182.11, 395/182.21, 395/728, 395/200.38, 395/200.4, 395/200.62, 395/200.78, 395/800.31, 455/54.1
• US Class Current: 709/208
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems
• CPC Class Codes: G05D 1/0077 using redundant signals or controls
• CPC Class Codes: G06F 11/1658 Data re-synchronization of a redundant component, or initial sync of replacement, additional or spare unit
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare
• CPC Class Codes: G06F 11/2038 with a single idle spare processing component
• CPC Class Codes: G06F 11/2097 maintaining the standby controller/processing unit updated initialisation or re-synchronisation thereof G06F11/1658 and subgroups
• CPC Class Codes: G06F 11/22 Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing

Abstract

A method and apparatus for choosing which flight management computer (FMC) of two FMCs will function as a master FMC (11) and which will function as a spare FMC (13) in maintaining data commonalty and synchronization between the master FMC (11) and the spare FMC (13) is disclosed. The status of a control switch (15) having FMC select and auto positions is scanned to determine the state of the switch. If the switch (15) is in an FMC select position, the related FMC is chosen to be the master FMC and the other FMC is chosen to be the spare FMC. If the switch is in the auto position, the failure status of the FMCs is evaluated. If one of the FMCs has failed, the other is chosen to be the master FMC. If the FMCs are both operating, the health of the FMCs is evaluated. If both FMCs are healthy, one is chosen to be the master FMC and the other is chosen to be the spare FMC, in accordance with a predetermined protocol. If the health of one of the FMCs has degraded, the other FMC is chosen to be the master FMC. Only the master FMC receives pilot data, which is forwarded to the spare FMC. The master FMC maintains object managers and sends changed data to the spare FMC when a data change occurs. The spare FMC stores the changed data within its own object managers.

Claims

1. A method of choosing which flight management computer (FMC) of a pair of FMCs will function as a master FMC and which will function as a spare FMC and maintaining data commonalty and synchronization between the master FMC and the spare FMC comprising:

determining if either flight management computer (FMC) of a pair of FMCs has failed;

if one FMC has failed, choosing the other FMC to function as a master FMC and the failed FMC to function as a spare FMC;

if neither FMC has failed, choosing one FMC to function as a master FMC and the other to function as a spare FMC in accordance with a predetermined protocol;

supplying data to the FMC chosen to function as the master FMC;

forwarding data received by the FMC chosen to be the master FMC to the FMC chosen to be the spare FMC; and

synchronizing the FMC chosen to be the spare FMC to the FMC chosen to be the master FMC.

2. The method claimed in claim 1 wherein said predetermined protocol includes:

determining if said FMCs are healthy;

determining if a selected one of said FMCs is claiming to be a master FMC; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if both of said FMCs are healthy and if said selected one of said FMCs is claiming to be a master FMC.

3. The method claimed in claim 2 wherein said predetermined protocol also includes:

if both of said FMCs are healthy and if said selected one of said FMCs is not claiming to be a master FMC, determining if said selected one of said FMCs is claiming to be a spare FMC; and

choosing said selected one of said FMCs to function as said spare FMC and the other FMC to function as said master FMC if both of said FMCs are healthy and if said selected one of said FMCs is claiming to be a spare FMC.

4. The method claimed in claim 3 wherein said predetermined protocol also includes:

choosing the other of said FMCs to function as said master FMC if the health of one of said FMCs has degraded and choosing the FMC whose health has degraded to function as said spare FMC.

5. The method claimed in claim 4 wherein said predetermined protocol also includes:

determining if a selected one of said FMCs is claiming to be a master FMC if the health of both of said FMCs has degraded; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if the health of both of said FMCs has degraded if said selected one of said FMCs is claiming to be a master FMC.

6. The method claimed in claim 1 wherein said predetermined protocol includes:

if both of said FMCs are healthy, determining if a selected one of said FMCs is claiming to be a spare FMC; and

choosing said selected one of said FMCs to function as said spare FMC and the other FMC to function as said master FMC if both of said FMCs are healthy and if said selected one of said FMCs is claiming to be a spare FMC.

7. The method claimed in claim 6 wherein said predetermined protocol also includes:

choosing the other of said FMCs to function as said master FMC if the health of one of said FMCs has degraded and choosing the FMC whose health has degraded to function as said spare FMC.

8. The method claimed in claim 7 wherein said predetermined protocol also includes:

determining if a selected one of said FMCs is claiming to be a master FMC if the health of both of said FMCs has degraded; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if the health of both of said FMCs has degraded if said selected one of said FMCs is claiming to be a master FMC.

9. The method claimed in claim 1 wherein said predetermined protocol includes:

choosing the other of said FMCs to function as said master FMC if the health of one of said FMCs has degraded and choosing the FMC whose health has degraded to function as said spare FMC.

10. The method claimed in claim 9 wherein said predetermined protocol also includes:

determining if a selected one of said FMCs is claiming to be a master FMC if the health of both of said FMCs has degraded; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if the health of both of said FMCs has degraded if said selected one of said FMCs is claiming to be a master FMC.

11. The method claimed in claim 1 wherein said predetermined protocol includes:

determining if a selected one of said FMCs is claiming to be a master FMC if the health of both of said FMCs has degraded; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if the health of both of said FMCs has degraded, if said selected one of said FMCs is claiming to be a master FMC.

12. The method claimed in claim 1, wherein the FMCs include sync counters and wherein synchronizing the FMC chosen to be the spare FMC to the FMC chosen to be the master FMC comprises each FMC:

determining if the determining FMC is a master FMC;

if the determining FMC is a master FMC, determining if the other FMC is alive;

if the other FMC is not alive, setting a sync counter in the determining FMC;

if the determining FMC is not a master FMC, determining if the determining FMC is a spare FMC;

if the determining FMC is a spare FMC, determining if the other FMC is alive; and

if the other FMC is not alive, setting a sync counter in the determining FMC.

13. The method claimed in claim 12 includes the master FMC:

determining if the sync counter of the determining FMC is zero or if the sync counter of the master FMC does not equal the sync counter of the spare FMC;

if the sync counter of the determining FMC is not zero, and the sync counter of the master FMC equals the sync counter of the spare FMC, determining if the master FMC has updated data;

if the master FMC has updated data, sending the updated data to the spare FMC; and

incrementing the sync counter of the determining FMC.

14. The method claimed in claim 13 includes the master FMC sending synchronization data to the spare FMC if the sync counter of the determining FMC is zero or the sync counter of the master FMC does not equal the sync counter of the spare FMC.

15. The method claimed in claim 14 wherein the sync counter of the determining FMC is incremented after all sync data has been sent to the spare FMC.

16. The method claimed in claim 15 including the spare FMC:

determining if new data has been sent from the master FMC;

if new data has been sent from the master FMC, forwarding the data to the object managers of the spare FMC; and

after the data has been sent to the object managers of the spare FMC, setting the sync counter of the spare FMC equal to the sync counter of the master FMC.

17. In a pair of flight management computers, the improvement comprising apparatus for choosing which flight management computer (FMC) of a pair of FMCs will function as a master FMC and which will function as a spare FMC, and for maintaining data commonalty and synchronization between the master FMC and the spare FMC, said improvement including:

each of said FMCs including a master/spare determination subroutine for determining if either of said flight management computers has failed and, if one FMC has failed, choosing the failed FMC to function as a spare FMC and choosing the other of said FMCs to function as a master FMC; and

a sync protocol for controlling the transfer of data received by the FMC chosen to function as the master FMC from the pilot inputs to the FMC chosen to function as the spare FMC while inhibiting the FMC chosen to be the spare FMC from processing received data from said pilot inputs, and for synchronizing the FMC chosen to be the spare FMC to the FMC chosen to be the master FMC.

18. The improvement claimed in claim 17 wherein said master/spare determination subroutine includes:

determining if said FMCs are healthy;

determining if a selected one of said FMCs is claiming to be a master FMC; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if both of said FMCs are healthy and if said selected one of said FMCs is claiming to be a master FMC.

19. The improvement claimed in claim 18 wherein said master/spare determination subroutine also includes:

if both of said FMCs are healthy and if said selected one of said FMCs is not claiming to be a master FMC, determining if said selected one of said FMCs is claiming to be a spare FMC; and

choosing said selected one of said FMCs to function as said spare FMC and the other FMC to function as said master FMC if both of said FMCs are healthy and if said selected one of said FMCs is claiming to be a spare FMC.

20. The improvement claimed in claim 19 wherein said master/spare determination subroutine also includes:

choosing the other of said FMCs to function as said master FMC if the health of one of said FMCs has degraded and choosing the FMC whose health has degraded to function as said spare FMC.

21. The improvement claimed in claim 20 wherein said master/spare determination subroutine also includes:

determining if a selected one of said FMCs is claiming to be a master FMC if the health of both of said FMCs has degraded; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if the health of both of said FMCs has degraded if said selected one of said FMCs is claiming to be a master FMC.

22. The improvement claimed in claim 17 wherein said master/spare determination subroutine includes:

if both of said FMCs are healthy, determining if a selected one of said FMCs is claiming to be a spare FMC; and

choosing said selected one of said FMCs to function as said spare FMC and the other FMC to function as said master FMC if both of said FMCs are healthy and if said selected one of said FMCs is claiming to be a spare FMC.

23. The improvement claimed in claim 22 wherein said master/spare determination subroutine also includes:

choosing the other of said FMCs to function as said master FMC if the health of one of said FMCs has degraded and choosing the FMC whose health has degraded to function as said spare FMC.

24. The improvement claimed in claim 23 wherein said master/spare determination subroutine also includes:

determining if a selected one of said FMCs is claiming to be a master FMC if the health of both of said FMCs has degraded; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if the health of both of said FMCs has degraded if said selected one of said FMCs is claiming to be a master FMC.

25. The improvement claimed in claim 17 wherein said master/spare determination subroutine includes:

choosing the other of said FMCs to function as said master FMC if the health of one of said FMCs has degraded and choosing the FMC whose health has degraded to function as said spare FMC.

26. The improvement claimed in claim 25 wherein said master/spare determination subroutine also includes:

determining if a selected one of said FMCs is claiming to be a master FMC if the health of both of said FMCs has degraded; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if the health of both of said FMCs has degraded if said selected one of said FMCs is claiming to be a master FMC.

27. The improvement claimed in claim 17 wherein said master/spare determination subroutine includes:

determining if a selected one of said FMCs is claiming to be a master FMC if the health of both of said FMCs has degraded; and

choosing said selected one of said FMCs to function as said master FMC and the other FMC to function as said spare FMC if the health of both of said FMCs has degraded if said selected one of said FMCs is claiming to be a master FMC.

28. The improvement claimed in claim 17, wherein the sync protocol comprises each FMC:

determining if the determining FMC is a master FMC;

if the determining FMC is a master FMC, determining if the other FMC is alive;

if the other FMC is not alive, setting a sync counter in the determining FMC;

if the determining FMC is not a master FMC, determining if the determining FMC is a spare FMC;

if the determining FMC is a spare FMC, determining if the other FMC is alive; and

if the other FMC is not alive, setting a sync counter in the determining FMC.

29. The improvement claimed in claim 24 wherein the sync protocol includes the master FMC:

determining if the sync counter of the determining FMC is zero or if the sync counter of the FMC does not equal the sync counter of the spare FMC;

if the sync counter of the determining FMC is not zero, and the sync counter of the master FMC equals the sync counter of the spare FMC, determining if the master FMC has updated data;

if the master FMC has updated data, sending the updated data to the spare FMC; and

incrementing the sync counter of the determining FMC.

30. The improvement claimed in claim 29 wherein the sync protocol includes the master FMC sending synchronization data to the spare FMC if the sync counter of the determining FMC is zero or the sync counter of the master FMC does not equal the sync counter of the spare FMC.

31. The improvement claimed in claim 30 wherein the sync counter of the determining FMC is incremented after all sync data has been sent to the spare FMC.

32. The improvement claimed in claim 31 wherein the sync protocol includes the spare FMC:

determining if new data has been sent from the master FMC;

if new data has been sent from the master FMC, forwarding the data to the object managers of the spare FMC; and

after the data has been sent to the object managers of the spare FMC, setting the sync counter of the spare FMC equal to the sync counter of the master FMC.