Apparatus and method for backup control in a distributed flight control system

• US 7,984,878 B2
• Filed: 01/17/2007
• Issued: 07/26/2011
• Est. Priority Date: 01/17/2006
• Status: Active Grant

• Current Assignee: Gulfstream Aerospace Corporation (General Dynamics Corporation)
• Original Assignee: Gulfstream Aerospace Corporation (General Dynamics Corporation)
• Inventors: Hirvonen, Jukka Matti
• Primary Examiner(s): Dinh; Tien
• Assistant Examiner(s): BENEDIK, JUSTIN M
• Application Number:
  US11/654,890
• Publication Number:
  US 20070164166A1
• Time in Patent Office: 1,651 Days
• Field of Search: 244/194, 244/195, 244/196
• US Class Current: 244/194
• CPC Class Codes: B64C 13/504 using electro-hydrostatic actuators [EHA's]
• CPC Class Codes: B64C 13/505 having duplication or stand-by provisions
• CPC Class Codes: G05D 1/0077 using redundant signals or controls
• CPC Class Codes: Y02T 50/40 Weight reduction

Abstract

Embodiments of the invention relate to a flight control system for controlling an aircraft during flight. The flight control system may include a primary controller configured to receive an input from a pilot and to output a primary control signal and a primary transmission path connected to the primary controller and configured to relay the primary control signal. The flight control system may also include a backup controller configured to receive the input from the pilot and to output a backup control signal and a backup transmission path connected to the backup controller and configured to relay the backup control signal. Additionally, the flight control system may include an actuator having a remote electronics unit configured to receive the primary control signal and the backup control signal and to determine if the primary control signal is available and valid. The remote electronics unit may be configured to output an actuator command based on the primary control signal if the primary control signal is available and valid and to output the actuator command based on the backup control signal if the primary control signal is unavailable or invalid.

Claims

1. A flight control system for controlling an aircraft, comprising:

a plurality of primary controllers each configured to receive a first input and to output a primary control signal;

a plurality of first transmission paths each coupled to a respective one of the primary controllers and configured to relay the primary control signal;

an independent and dissimilar controller comprising at least one functional component that is dissimilar from a corresponding functional component of the primary controllers, wherein the differences of the dissimilar functional components of the primary controllers and independent and dissimilar controller comprise at least one of a wireless system versus a wired system, digital data transmission versus analog data transmission, and separate and distinct gain schedules, the independent and dissimilar controller configured to receive a second input and to output a backup control signal;

a second transmission path coupled to the independent and dissimilar controller and configured to relay the backup control signal;

an actuator having actuator electronics configured to receive the primary control signal along at least one of the first transmission paths and the backup control signal along the second transmission path, the actuator electronics being configured to determine if the primary control signal is valid, the actuator electronics being located remotely from the primary controllers and adjacent to the actuator, and the actuator electronics being further configured to output an actuator command based, at least in part, on the primary control signal if the primary control signal is valid and to output the actuator command based, at least in part, on the backup control signal if the primary control signal is not valid.

2. The flight control system of claim 1, wherein the primary controllers receive the first input from a primary sensor and the independent and dissimilar controller receives the second input from a redundant sensor.

3. The flight control system of claim 1, wherein the actuator is placed in a predetermined safe mode if neither the primary control signal nor the backup control signal are valid.

4. The flight control system of claim 1, wherein the actuator electronics are further configured to receive an actuator sensor input and to compute the actuator command based, at least in part, on the actuator sensor input and at least one of the primary control signal or the backup control signal.

5. The flight control system of claim 1, wherein at least one of the first transmission paths is bi-directional.

6. The flight control system of claim 5, wherein the second transmission path is unidirectional.

7. The flight control system of claim 6, wherein:

the actuator electronics are further configured to transmit the backup control signal to at least one of the primary controllers via at least one of the first transmission paths; and

the at least one of the primary controllers is further configured to monitor the backup control signal and to generate a backup control system status signal.

8. The flight control system of claim 1, wherein the independent and dissimilar controller is separate from the primary controllers.

9. The flight control system of claim 1, wherein the second transmission path is separate and independent from the first transmission paths.

10. The flight control system of claim 1, wherein the plurality of primary controllers comprises hardware and software components that are distinct from corresponding hardware and software components of the independent and dissimilar controller.

11. A backup control signal monitoring system for a flight control system, comprising:

a primary controller configured to receive a first input and to output a primary control signal;

a first transmission path coupled to the primary controller and configured to relay the primary control signal;

an independent and dissimilar controller comprising at least one functional component that is dissimilar from a corresponding functional component of the primary controller, wherein the differences of the dissimilar functional components of the primary controller and independent and dissimilar controller comprise at least one of a wireless system versus a wired system, digital data transmission versus analog data transmission, and separate and distinct gain schedules, the independent and dissimilar controller configured to receive a second input and to output a backup control signal;

the independent and dissimilar controller being separate from the first controller;

a second transmission path coupled to the independent and dissimilar controller and configured to relay the backup control signal, the second transmission path being separate and independent from the first transmission path;

an actuator having actuator electronics located remotely from the primary controller and adjacent to the actuator; and

the actuator electronics being configured to receive the primary control signal along the first transmission path and the backup control signal along the second transmission path and configured to transmit backup validation data to the primary controller via the first transmission path and configured to determine if the primary control signal is valid;

wherein the primary controller is further configured to generate a backup control system status signal based, at least in part, on the backup validation data.

12. The monitoring system of claim 11, wherein the second transmission path is unidirectional.

13. The monitoring system of claim 11, wherein the backup validation data includes the backup control signal.

14. A flight control system, comprising:

a plurality of primary processors configured to receive a first input and to output a primary control signal;

a plurality of first paths coupled to a respective one of the primary processors and configured to relay the primary control signal;

an independent and dissimilar processor comprising at least one functional component that is dissimilar from a corresponding functional component of the primary processors, wherein the differences of the dissimilar functional components of the primary processors and independent and dissimilar processor comprise at least one of a wireless system versus a wired system, digital data transmission versus analog data transmission, and separate and distinct gain schedules, the independent and dissimilar processor configured to receive a second input and to output a backup control signal;

the second controller being separate and independent from the primary controllers;

a second path coupled to independent and dissimilar processor and configured to relay the backup control signal, the second path being separate and independent from the first path;

a first actuator coupled to an aircraft control surface, the first actuator having a first actuator electronics coupled to at least one of the first paths, the first actuator electronics configured to receive the primary control signal and to determine if the primary control signal is valid; and

a second actuator coupled to the aircraft control surface, the second actuator having a second actuator electronics coupled to the at least one of the first paths and the second path, the second actuator electronics configured to receive the primary control signal and the backup control signal and to determine if the primary control signal is valid;

wherein the second actuator electronics are configured to use the backup control signal to control the aircraft control surface only if the first actuator electronics and the second actuator electronics determine that the primary control signal is not valid.

15. The control system of claim 14, further comprising:

a status link coupled between the first actuator electronics and the second actuator electronics;

wherein the second actuator electronics receives information via the status link indicating whether the first actuator electronics determined that the primary control signal is not valid.

16. The control system of claim 15, wherein the at least one of the first paths comprises:

a first primary path coupled between the primary controllers and the first actuator electronics and configured to relay the primary control signal to the first actuator electronics; and

a second primary path coupled between the primary controllers and the second actuator electronics and configured to relay the primary control signal to the second actuator electronics, the second primary path being separate from the first primary path.

17. A method of controlling an aircraft control surface, comprising:

receiving a primary control signal in an actuator electronics from a plurality of primary processors, the actuator electronics being separate and independent from the primary processors;

receiving a backup control signal in the actuator electronics from an independent and dissimilar processor comprising at least one functional component that is dissimilar from a corresponding functional component of the primary processors, wherein the differences of the dissimilar functional components of the primary processors and independent and dissimilar processor comprise at least one of a wireless system versus a wired system, digital data transmission versus analog data transmission, and separate and distinct gain schedules, the actuator electronics being separate and independent from the independent and dissimilar processor;

determining whether the primary control signal is valid in the actuator electronics;

generating an actuator command signal by the actuator electronics based, at least in part, on the primary control signal if the primary control signal is valid;

generating the actuator command signal by the actuator electronics based, at least in part, on the backup control signal if the primary control signal is not valid;

actuating an actuator based on the actuator command signal to control an aircraft control surface.

18. The method of claim 17, further comprising placing the actuator in a predetermined safe mode if neither the primary control signal nor the backup control signal is valid.

19. The method of claim 17, further comprising:

receiving an actuator position feedback signal in the actuator electronics;

wherein;

generating the actuator command signal is based, at least in part, on the actuator position feedback signal and the primary control signal if the primary control signal is valid; and

generating the actuator command signal is based, at least in part, on the actuator position feedback signal and the backup control signal if the primary control signal is not valid.

20. The method of claim 17, wherein the plurality of primary controllers comprises hardware and software components that are distinct from corresponding hardware and software components of the independent and dissimilar controller.

21. A method of operating a flight control system, comprising:

receiving a primary control signal in an actuator electronics from a plurality of primary processors, the actuator electronics being separate and independent from the primary processors;

receiving a backup control signal in the actuator electronics from an independent and dissimilar processor comprising at least one functional component that is dissimilar from a corresponding functional component of the primary processors, wherein the differences of the dissimilar functional components of the primary processors and independent and dissimilar processor comprise at least one of a wireless system versus a wired system, digital data transmission versus analog data transmission, and separate and distinct gain schedules, the actuator electronics being separate and independent from the independent and dissimilar processor;

transmitting backup validation data from the actuator electronics to the primary processors;

generating a backup control system status signal based, at least in part, on the backup validation data;

generating an actuator command signal by the actuator electronics based, at least in part, on at least one of the primary control signal or the backup control signal; and

actuating an actuator based on the actuator command signal to control an aircraft control surface.

22. The method of claim 21, wherein the backup validation data includes the backup control signal.

23. A method of controlling an aircraft control surface, comprising:

receiving a primary control signal in a first actuator electronics from a primary processor, the actuator electronics being separate and independent from the primary processor;

receiving the primary control signal in a second actuator electronics from the primary processor, the second actuator electronics being separate and independent from the primary processor;

receiving a backup control signal in the second actuator electronics from an independent and dissimilar processor comprising at least one functional component that is dissimilar from a corresponding functional component of the primary processor, wherein the differences of the dissimilar functional components of the primary processor and independent and dissimilar processor comprise at least one of a wireless system versus a wired system, digital data transmission versus analog data transmission, and separate and distinct gain schedules, the second actuator electronics being separate from the independent and dissimilar processor;

determining whether the primary control signal is valid in the first actuator electronics;

determining whether the primary control signal is valid in the second actuator electronics;

generating a first actuator command signal in the first actuator electronics based, at least in part, on the primary control signal if the first actuator electronics determines the primary control signal is valid;

generating a second actuator command signal in the second actuator electronics based, at least in part, on the primary control signal if the second actuator electronics determines the primary control signal is valid;

generating the second actuator command signal in the second actuator electronics based, at least in part, on the backup control signal if the first actuator electronics and the second actuator electronics determine that the primary control signal is not valid;

actuating a first actuator based on the first actuator command signal to control an aircraft control surface; and

actuating a second actuator based on the second actuator command signal to control the aircraft control surface.

24. The method of claim 23, further comprising:

transmitting status information across a status link between the first actuator electronics and the second actuator electronics;

determining in the second actuator electronics whether the first actuator electronics determined that the primary control signal is not valid based, at least in part, on the status information.