Architecture using integrated backup control and protection hardware

• US 8,340,793 B2
• Filed: 06/01/2010
• Issued: 12/25/2012
• Est. Priority Date: 10/09/2009
• Status: Active Grant

• Current Assignee: Hamilton Sundstrand Corporation (Raytheon Technologies Corporation d/b/a RTX)
• Original Assignee: Hamilton Sundstrand Corporation (Raytheon Technologies Corporation d/b/a RTX)
• Inventors: Kamenetz, Jeffry K., DiVincenzo, Gregory, Johnston, Mark A., Kokas, Jay W., Orsini, Luke T., Fischer, Steven R., Hartman, Jay H., Roy, Kevin P., Betterini, William
• Primary Examiner(s): Kasenge, Charles
• Assistant Examiner(s): STEVENS, THOMAS H
• Application Number:
  US12/791,163
• Publication Number:
  US 20110087343A1
• Time in Patent Office: 938 Days
• Field of Search: 714/2, 714 411- 44, 700/82
• US Class Current: 700/82
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 2219/25471 Replace existing control system with new different system in real time
• CPC Class Codes: G06F 11/0796 Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element
• CPC Class Codes: G06F 11/2028 eliminating a faulty processor or activating a spare

Abstract

An electronic control configuration includes at least one secondary microprocessor operable to control a device. The at least one secondary microprocessor assumes protection control of the device responsive to a first type of failure by transmitting a protection control signal to a first effector. The at least one secondary microprocessor assumes backup control of the device responsive to a second type of failure by transmitting a backup control signal to a second effector. The backup control functionality of the at least one secondary microprocessor can be selectively disabled.

Claims

1. An electronic control configuration, comprising:

at least one primary microprocessor operable to control a device using a first shaft and a first effector; and

at least one secondary microprocessor operable to control the device using a second shaft and a second effector, the at least one secondary microprocessor assuming protection control of the device responsive to a first type of failure by transmitting a protection control signal to the first effector, the at least one secondary microprocessor assuming backup control of the device responsive to a second type of failure by transmitting a backup control signal to the second effector, wherein the backup control functionality of the at least one secondary microprocessor can be selectively disabled.

2. The electronic control configuration of claim 1, wherein the first type of failure is a failure in which at least one primary control microprocessor is able to control the device but requires assistance from the at least one secondary microprocessor to avoid damaging the device, and wherein the second type of failure is a failure in which the at least one primary control microprocessor is unable to control the device and relinquishes control of the device to either another primary control microprocessor or the at least one secondary microprocessor.

3. The electronic control configuration of claim 2, wherein the at least one primary control microprocessor is operable to detect its own failure when the failure is the second type of failure, but is unable to detect its own failure when the failure is the first type of failure.

4. The electronic control configuration of claim 2, wherein first type of failure includes one or more of a temporary memory failure of the at least one primary control microprocessor, or the at least one primary control microprocessor erroneously measuring an operating speed of the device.

5. The electronic control configuration of claim 2, wherein the second type of failure includes a fault of the primary control microprocessor or a loss of a sensor input signal from the device.

6. The electronic control configuration of claim 2, wherein the at least one primary control microprocessor includes a first primary control microprocessor operable to control the device, and a second primary control microprocessor operable to control the device in response to the first primary control microprocessor experiencing the second type of failure.

7. The electronic control configuration of claim 6, wherein the at least one secondary microprocessor includes:

a first secondary microprocessor operable to assume protection control of the device if the first primary control microprocessor experiences the first type of failure, and operable to assume backup control of the device if the first and second primary control microprocessors experience the second type of failure; and

a second secondary microprocessor operable to assume protection control of the device if the second primary control microprocessor experiences the first type of failure, the second secondary microprocessor having its backup control functionality disabled.

8. The electronic control configuration of claim 6, wherein the at least one secondary microprocessor includes:

a first secondary microprocessor operable to assume protection control of the device if the first primary control microprocessor experiences the first type of failure; and

a second secondary microprocessor operable to assume protection control of the device if the second primary control microprocessor experiences the first type of failure, wherein either of the first secondary microprocessor or second secondary microprocessor is operable to assume backup control of the device if the first and second primary control microprocessors experience the second type of failure.

11. The electronic control configuration of claim 1, wherein the device is a mechanically-controllable component of a vehicle or a building.

9. An electronic control configuration, comprising:

at least one secondary microprocessor operable to control a device, the at least one secondary microprocessor assuming protection control of the device responsive to a first type of failure by transmitting a protection control signal to a first effector, the at least one secondary microprocessor assuming backup control of the device responsive to a second type of failure by transmitting a backup control signal to a second effector, wherein a backup control functionality of the at least one secondary microprocessor can be selectively disabled;

wherein the first type of failure is a failure in which at least one primary control microprocessor is able to control the device but requires assistance from the at least one secondary microprocessor to avoid damaging the device, and wherein the second type of failure is a failure in which the at least one primary control microprocessor is unable to control the device and relinquishes control of the device to either another primary control microprocessor or the at least one secondary microprocessor; and

wherein the at least one secondary microprocessor controls the device along a first shaft using the first effector, wherein the at least one primary control microprocessor controls the device along a second shaft using the second effector, wherein each of the first effector and the second effector include at least one of a stepper motor, a torque motor and a dual-coil solenoid.

10. The electronic control configuration of claim 9, wherein the at least one primary control microprocessor and the at least one secondary microprocessor communicate via a serial bus.

12. An electronic control configuration, comprising:

a first primary control operable to control a device using a first shaft and a first effector to control the device;

a first secondary control operable to assume protection control of the device if the first primary control experiences a first type of failure;

a second primary control operable to control the device using a second shaft and a second effector in response to the first primary control experiencing a second type of failure; and

a second secondary control operable to assume protection control of the device if the second primary control experiences the first type of failure, at least one of the secondary controls being operable to assume backup control of the device if both the first and second primary controls experience the second type of failure.

13. The electronic control configuration of claim 12, wherein each of the secondary controls have both backup and protection control functionality, and wherein the second secondary control has its backup protection features disabled.

14. The electronic control configuration of claim 12, wherein each of the secondary controls have both backup and protection control functionality, and wherein both of the first secondary control and the second secondary control have their backup protection features enabled.

15. The electronic control configuration of claim 12, wherein the first primary control and the first secondary control correspond to a first control channel, the first secondary control controlling the device along a first shaft using a first winding of a first effector, the first primary control controlling the device along a second shaft using a first winding of a second effector, and wherein the second primary control and the second secondary control correspond to a second control channel, the second secondary control controlling the device along the first shaft using a second winding of the first effector, and the second primary control controlling the device along the second shaft using a second winding of the second effector.

16. The electronic control configuration of claim 12, wherein the device is a mechanically-controllable component of a vehicle or a building.

17. A method of electronically controlling a device, comprising:

controlling a device using a first primary control microprocessor, a first shaft, and a first effector;

assuming protection control of the device using a first secondary microprocessor, the first shaft, and the first effector in response to the first primary control microprocessor experiencing a first type of failure;

controlling the device using a second primary control microprocessor, a second shaft, and a second effector in response to the first primary control microprocessor experiencing a second type of failure;

assuming protection control of the device using a second secondary microprocessor, the second shaft, and the second effector in response to the second primary control microprocessor experiencing the first type of failure; and

assuming backup control of the device using one of the first secondary microprocessor and the second secondary microprocessor in response to the first primary control microprocessor and the second primary control microprocessor experiencing the second type of failure.

18. The method of claim 17, including:

disabling a backup control feature of the second secondary microprocessor.

19. The method of claim 17, wherein the first type of failure is a failure in which a primary control is able to control the device but requires assistance from its corresponding secondary control to avoid damaging the device, and wherein the second type of failure is a failure in which a primary control is unable to control the device and relinquishes control of the device to either the other primary control or to its corresponding secondary control.

20. The method of claim 17, wherein said step of assuming backup control of the device is only performed in response to each of the first primary control microprocessor and the second primary control microprocessor experiencing the second type of failure, acknowledging the occurrence of their respective failure, and relinquishing control of the device.