Flight guidance system comprising independent monitor and method for flight guidance

Abstract

The invention relates to a flight guidance system comprising an independent monitor and a method for flight guidance. According to the technical scheme of the invention, aiming at a dual-channel flight guidance architecture, automatic switching of flight guidance data sources during RNP operation is realized by residing a flight guidance monitor in an independent computer; and meanwhile, matched automatic flight mode conversion logic is provided to ensure that the loss or error of two flight guides cannot be caused when a single component fails.

Description

Technical Field

[0001] The present invention relates to the technical field of automatic aircraft flight, and in particular to a flight guidance system including an independent monitor and a method for flight guidance. Background Art

[0002] The flight guidance system (FG) is an important part of the aircraft's automatic flight system, which can provide the pilot with control guidance in the roll and pitch directions throughout the flight profile. The roll and pitch instructions calculated by the flight guidance FG will be displayed on the two displays in the cockpit in the form of guide sticks. The flight guidance (FD) on the left display is usually recorded as FD1, and the flight guidance on the right display is usually recorded as FD2. Dual-channel flight guidance (respectively recorded as FG1 and FG2) is a typical flight guidance architecture solution. In order to meet the RNP operation requirements, it is necessary to ensure that in the dual-channel flight guidance solution, the failure of a single component will not cause the loss or error of both flight guidances, and to minimize the workload of the crew in the event of a failure to improve flight safety.

[0003] The dual-channel flight guidance system is usually resident in the IMA, the main flight control computer or a separate automatic flight computer. When resident, the calculation and signal transmission channels of the two flight guidance are independent of each other. There are two main technical solutions for data flow design:

[0004] Solution 1: FG1 uses the navigation sensor data on the left side and sends the calculated instructions to FD1; FG2 uses the navigation sensor data on the right side and sends the calculated instructions to FD2. When FD1 and FD2 are inconsistent, the display will give an alarm, and the pilot will decide which FG / FD is credible.

[0005] Solution 2: FG1 uses the navigation sensor data on the left, and FG2 uses the navigation sensor data on the right. FD1 and FD2 instructions are both from one of the FGs. When this FG is lost, the pilot manually switches to the instructions of another FG by pressing a button.

[0006] However, in solution 1, the two FDs are independent of each other, so that when a single component fails, both flight guidance will not be lost or erroneous. However, the FD / FG on both sides use different data sources to independently calculate instructions. There is a situation where the two FD instructions are inconsistent, which may frequently trigger FD inconsistency alarms and cause confusion to the pilot. At this time, the pilot needs to manually judge which FD is correct, which increases the burden on the crew and may cause the aircraft to deviate from the route during this process, which is not conducive to RNP operation.

[0007] In addition, in Solution 2, both FD instructions come from a certain FG, which can basically avoid the situation where the two FD instructions are inconsistent. However, when the navigation sensor data required by the FG calculation instruction is wrong, or the FG instruction calculation process is wrong, both FD instructions will be wrong.

[0008] The above technical problems can be solved by adding a third set of FG software to the automatic flight computer, but for some existing dual-channel flight guidance systems, this modification requires a large amount of change. Therefore, a flight guidance system and related methods that further improve the existing technology are urgently needed. Summary of the invention

[0009] This Summary is provided to introduce some concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0010] In response to the problems in the prior art, the present invention proposes to develop a monitor based on the existing dual-channel flight guidance system, and the monitor resides in other existing or newly added high-safety level computers on the aircraft (such as displays, main flight control computers, etc.) and together with the original dual-channel flight guidance system, it forms an improved flight guidance system to ensure that the failure of a single component will not cause the loss or error of both flight guidances, and to minimize the workload of the pilot in the event of a failure, thereby improving flight safety.

[0011] Specifically, in one embodiment of the present invention, a system for flight guidance including an independent monitor is disclosed, comprising:

[0012] a first flight guidance system and a second flight guidance system residing in the autoflight computer, the two flight guidance systems being configured to receive flight tube roll instructions from the first flight control system and the second flight control system on the same side, aircraft airspeed data from the first air data computer and the second air data computer on the same side, and aircraft attitude data from the first inertial navigation system and the second inertial navigation system on the same side, respectively, to calculate the first flight guidance instruction and the second flight guidance instruction, respectively; and

[0013] a first monitor on the same side as the first flight guidance system and a second monitor on the same side as the second flight guidance system, both monitors residing in separate computers other than the autoflight computer, wherein:

[0014] The first monitor and the second monitor both include a first flight guidance system monitor and a second flight guidance system monitor, a first flight control system monitor and a second flight control system monitor, a first inertial navigation system monitor and a second inertial navigation system monitor, and a first air data computer monitor and a second air data computer monitor, and

[0015] Wherein, when at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight control systems, one of the two inertial navigation systems, or one of the two air data computers has failed and the at least one monitor includes a monitor on the same side as the failed flight control system, inertial navigation system or air data computer, the flight guidance system on the same side as the failed flight control system, inertial navigation system or air data computer among the first flight guidance system and the second flight guidance system is configured to switch to using another flight control system, another inertial navigation system, or another air data computer that has not failed to execute respective flight guidance instruction calculations.

[0016] In one embodiment of the present invention, the other independent computer comprises a DAL A-level high-security computer including a display and a main flight control computer.

[0017] In one embodiment of the present invention, the flight tube roll instructions from the first flight control system and the second flight control system are sent to the first monitor and the second monitor and forwarded to the first flight guidance system and the second flight guidance system via the first monitor and the second monitor, and the first inertial navigation system monitor and the second inertial navigation system monitor are configured to respectively monitor whether the first inertial navigation system and the second inertial navigation system fail and give corresponding monitoring results, the first air data computer monitor and the second air data computer monitor are configured to respectively monitor whether the first air data computer and the second air data computer fail and give corresponding monitoring results, the first flight control system monitor and the second flight control system monitor are configured to respectively monitor whether the first flight control system and the second flight control system fail and give corresponding monitoring results, and the first flight guidance system monitor and the second flight guidance system monitor are configured to respectively monitor whether the first flight guidance system and the second flight guidance system fail and give corresponding monitoring results.

[0018] In the above-mentioned embodiment of the present invention, the monitoring result is sent to the first flight guidance system and the second flight guidance system via the corresponding first monitor and the second monitor.

[0019] In the above-mentioned embodiment of the present invention, the first flight guidance system monitor and the second flight guidance system monitor are further configured to monitor whether the first flight guidance system and the second flight guidance system fail respectively by the following operations: judging whether the flight guidance instructions from the two flight guidance systems are valid; and performing a difference calculation between the flight tube roll instruction and the aircraft roll angle in the aircraft attitude data and judging whether the difference is consistent with the flight guidance instruction. The first flight control system monitor and the second flight control system monitor are further configured to monitor whether the first flight control system and the second flight control system fail respectively by the following operations: judging whether the flight tube roll instructions from the two flight control systems are valid. The first inertial navigation system monitor and the second inertial navigation system monitor are further The first air data computer monitor and the second air data computer monitor are configured to monitor whether the first air data computer and the second air data computer fail respectively by the following operations: determining whether the aircraft attitude data from the two air data computers are valid; and determining whether the aircraft attitude data from one air data computer and the aircraft attitude data from the other air data computer and the standby instrument are all greater than a threshold value, and the first air data computer monitor and the second air data computer monitor are further configured to monitor whether the first air data computer and the second air data computer fail respectively by the following operations: determining whether the aircraft airspeed data from the two air data computers are valid; and determining whether the aircraft airspeed data from one air data computer and the aircraft airspeed data from the other air data computer and the standby instrument are all greater than a threshold value.

[0020] In the above-mentioned embodiment of the present invention, when at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight guidance systems has failed and the at least one monitor includes a monitor on the same side as the failed flight guidance system, the flight guidance instructions calculated by the other flight guidance system that is not failed are displayed on two displays in the cockpit.

[0021] In one embodiment of the present invention, the flight guidance system on the same side as the failed flight control system, inertial navigation system or air data computer is further configured to switch to using the other flight control system, another inertial navigation system, or another air data computer that is not failed to execute the flight guidance instruction calculation when the monitor on the same side as the other flight control system, another inertial navigation system, or another air data computer does not give a monitoring result that the other flight control system, another inertial navigation system, or another air data computer has failed.

[0022] In one embodiment of the present invention, one of the first flight guidance instruction and the second flight guidance instruction is displayed simultaneously on two displays in the cockpit.

[0023] In one embodiment of the present invention, the system further includes a third monitor that is not on the same side as either the first flight guidance system or the second flight guidance system, the third monitor residing in another independent computer different from the autoflight computer, and including the first flight guidance system monitor and the second flight guidance system monitor, the first flight control system monitor and the second flight control system monitor, the first inertial navigation system monitor and the second inertial navigation system monitor, and the first air data computer monitor and the second air data computer monitor.

[0024] In the above-mentioned embodiment of the present invention, when at least two of the first monitor, the second monitor and the third monitor give a monitoring result indicating that one of the two flight control systems, one of the two inertial navigation systems, or one of the two atmospheric data computers has failed, the first flight guidance system and the second flight guidance system are configured to switch to using another flight control system, another inertial navigation system, or another atmospheric data computer that is not failed to perform respective flight guidance instruction calculations, and wherein when at least two of the first monitor, the second monitor and the third monitor give a monitoring result indicating that one of the two flight guidance systems has failed, the flight guidance instructions calculated by the other flight guidance system that is not failed are displayed on two displays in the cockpit.

[0025] In one embodiment of the present invention, the first flight control system monitor and the second flight control system monitor are further configured to determine whether the flight tube rolling instructions from the two flight control systems are consistent, and to give an alarm when they are inconsistent.

[0026] In another embodiment of the present invention, a method for flight guidance is disclosed. The method is performed at the system as described in the above embodiment, and the method includes:

[0027] respectively calculating the first flight guidance instruction and the second flight guidance instruction based on the flight tube roll instruction from the first flight control system and the second flight control system, the aircraft airspeed data from the first air data computer and the second air data computer, and the aircraft attitude data from the first inertial navigation system and the second inertial navigation system;

[0028] respectively monitoring whether the first inertial navigation system and the second inertial navigation system have any faults and providing corresponding monitoring results;

[0029] respectively monitoring whether the first air data computer and the second air data computer have any failure and providing corresponding monitoring results;

[0030] respectively monitoring whether the first flight control system and the second flight control system have any failures and providing corresponding monitoring results; and

[0031] When at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight control systems, one of the two inertial navigation systems, or one of the two air data computers has failed and the at least one monitor includes a monitor on the same side as the failed flight control system, inertial navigation system, or air data computer, switch to using another flight control system, another inertial navigation system, or another air data computer that has not failed to execute flight guidance instruction calculations.

[0032] In one embodiment of the present invention, respectively monitoring whether the first flight control system and the second flight control system have a fault further includes: determining whether the flight control roll instructions from the two flight control systems are valid,

[0033] The method of monitoring whether the first inertial navigation system and the second inertial navigation system fail further comprises: determining whether the aircraft attitude data from the two inertial navigation systems are valid; and determining whether the aircraft attitude data from one inertial navigation system and the aircraft attitude data from another inertial navigation system and the standby instrument are all greater than a threshold value, and

[0034] Monitoring the first air data computer and the second air data computer for failures further includes: determining whether the aircraft airspeed data from the two air data computers are valid; and determining whether the aircraft airspeed data from one air data computer and the aircraft airspeed data from another air data computer and a backup instrument are all greater than a threshold.

[0035] In one embodiment of the present invention, the first flight guidance system and the second flight guidance system are respectively monitored for failure and corresponding monitoring results are given, including: determining whether the flight guidance instructions from the two flight guidance systems are valid; and performing a difference calculation between the flight tube roll instruction and the aircraft roll angle in the aircraft attitude data and determining whether the difference is consistent with the flight guidance instruction; and

[0036] When at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight guidance systems has failed and the at least one monitor includes a monitor on the same side as the failed flight guidance system, the flight guidance instructions calculated by the other flight guidance system that has not failed are displayed on two displays in the cockpit

[0037] In another embodiment of the present invention, when performing monitoring of two inertial navigation systems and two atmospheric data computers, the method further optionally includes switching to using another inertial navigation system or another atmospheric data computer that is not faulty to perform flight tube roll command calculations when at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two inertial navigation systems or one of the two atmospheric data computers has failed and at least one monitor includes a monitor on the same side as the failed inertial navigation system or atmospheric data computer.

[0038] In yet another embodiment of the present invention, a computer storage medium is also disclosed, which stores instructions for flight guidance, including:

[0039] Instructions for respectively calculating the first flight guidance instruction and the second flight guidance instruction based on the flight tube roll instructions from the first flight guidance system and the second flight guidance system on the same side, the aircraft airspeed data from the first air data computer and the second air data computer on the same side, and the aircraft attitude data from the first inertial navigation system and the second inertial navigation system on the same side;

[0040] Instructions for respectively monitoring whether the first inertial navigation system and the second inertial navigation system have a fault and providing corresponding monitoring results;

[0041] Instructions for respectively monitoring whether the first air data computer and the second air data computer have a fault and providing corresponding monitoring results;

[0042] Instructions for respectively monitoring whether the first flight control system and the second flight control system have any failures and providing corresponding monitoring results; and

[0043] When at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight control systems, one of the two inertial navigation systems, or one of the two air data computers has failed and the at least one monitor includes a monitor on the same side as the failed flight control system, inertial navigation system, or air data computer, instructions for switching to using another flight control system, another inertial navigation system, or another air data computer that has not failed to execute respective flight guidance instruction calculations.

[0044] After studying the description of the specific exemplary embodiments of the present invention below in conjunction with the accompanying drawings, other aspects, features and embodiments of the present invention will be apparent to those of ordinary skill in the art. Although features of the present invention may be discussed below with respect to certain embodiments and accompanying drawings, all embodiments of the present invention may include one or more of the advantageous features discussed herein. In other words, although one or more embodiments may be discussed to have certain advantageous features, one or more of such features may also be used according to the various embodiments of the present invention discussed herein. In a similar manner, although exemplary embodiments may be discussed below as device, system or method embodiments, it should be appreciated that such exemplary embodiments may be implemented in various devices, systems, and methods. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to understand in detail the manner in which the above-stated features of the present disclosure are used, a more particular description of the content briefly summarized above may be made with reference to various aspects, some of which are illustrated in the accompanying drawings. It should be noted, however, that the accompanying drawings illustrate only certain typical aspects of the present disclosure and are not to be considered limiting of its scope, as the description may admit to other equally effective aspects.

[0046] Figure 1 is a schematic block diagram of a system for flight guidance including an independent monitor according to an embodiment of the present disclosure.

[0047] Figure 2 is a flow chart of a method for flight directing according to one embodiment of the present disclosure. DETAILED DESCRIPTION

[0048] The various embodiments will be described in more detail below with reference to the accompanying drawings that form part of the present invention and illustrate various specific exemplary embodiments. However, the various embodiments can be implemented in many different forms and should not be interpreted as limiting the various embodiments set forth herein; on the contrary, these embodiments are provided to make the present disclosure thorough and complete, and to fully convey the scope of these embodiments to those of ordinary skill in the art. The various embodiments may be implemented in accordance with methods, systems, or devices. Therefore, these embodiments may be implemented in hardware, in full software, or in a combination of software and hardware. Therefore, the following specific embodiments are not limiting.

[0049] The steps in each flow chart may be performed by hardware (e.g., processor, engine, memory, circuit), software (e.g., operating system, application, driver, machine / processor executable instructions), or a combination thereof. As will be appreciated by those skilled in the art, the methods involved in each embodiment may include more or fewer steps than shown.

[0050] RNP (Required Navigation Performance) operation improves the take-off and landing capabilities of aircraft at airports with special terrain by precisely controlling the lateral position of the aircraft. During RNP operation, the flight guidance system is connected to LNAV or APPR mode, and the flight control system can calculate the flight control roll instruction based on the atmospheric / inertial navigation data, flight plan and the current position of the aircraft. The flight guidance system calculates the flight guidance instruction based on the flight control roll instruction and the current roll angle of the aircraft.

[0051] The dual-channel flight guidance system (including the first flight guidance system and the second flight guidance system, respectively denoted as FG1 and FG2) is a typical flight guidance architecture solution. In order to meet the RNP operation requirements, it is necessary to ensure that in the dual-channel flight guidance solution, the failure of a single component will not lead to the loss or error of both flight guidances, and to reduce the workload of the crew in the event of a failure as much as possible to improve flight safety.

[0052] Based on the dual-channel flight guidance architecture, the present invention proposes a method of configuring the data source required for FG instruction calculation and the resident instruction calculation process monitor (performing simplified FG instruction calculation) in an independent computer (other DAL A-level high-security computers different from the FG resident computer), covering the entire process of FD instruction calculation during RNP operation. When the monitor detects loss or error, the data source can be automatically switched.

[0053] The following monitors reside in an independent computer (other DAL A-level high-security computers different from the FG resident computer): atmospheric data monitor, inertial navigation data monitor, flight control monitor, and flight guidance monitor. These monitors cover all data sources and calculation processes required for FD instruction calculation during RNP operation. When the monitor detects that the ADC (atmospheric data computer) and IRS (inertial navigation system) data sources are lost or erroneous, FMS / FG / FD automatically switches the data source to reduce the pilot's workload; when the monitor detects that the FMS (flight control system) data source is lost, FG / FD automatically switches the data source; when the monitor detects that the FMS data source output is inconsistent, an alarm is given on the display.

[0054] During RNP operation, the flight guidance system is connected to LNAV or APPR mode. In this mode, the flight control system FMS calculates the flight control roll command based on the flight plan and the current position of the aircraft, and sends the command to the monitor resident computer, which is forwarded to the automatic flight computer through the monitor resident computer, so that the monitor can obtain all the required calculation data sources mentioned above, and realize the automatic switching of the FMS data source used by the FG when a certain FMS fails.

[0055] Various aspects of the present invention will be described in detail below.

[0056] Figure 1 is a schematic block diagram of a system 100 for flight guidance including an independent monitor according to one embodiment of the present disclosure.

[0057] like Figure 1 As shown, in one embodiment of the present invention, the system 100 may include two flight guidance systems, namely a first flight guidance system (FG1) and a second flight guidance system (FG2). Both FG1 and FG2 may reside in an automatic flight computer. FG1 may be configured to receive a flight tube roll instruction (FMS1 instruction) from the first flight tube system (FMS1) on the same side, aircraft airspeed data from the first air data computer (ADC1) on the same side, and aircraft attitude data from the first inertial navigation system (IRS1) on the same side to calculate the first flight guidance instruction (FG1 instruction). FG2 may be configured to receive a flight tube roll instruction (FMS2 instruction) from the second flight tube system (FMS2) on the same side, aircraft airspeed data from the second air data computer (ADC2) on the same side, and aircraft attitude data from the second inertial navigation system (IRS2) on the same side to calculate the second flight guidance instruction (FG2 instruction).

[0058] In one embodiment of the present invention, one of the first flight guidance instruction (FG1 instruction) and the second flight guidance instruction (FG2 instruction) is simultaneously displayed on the left and right displays in the cockpit as the FD1 instruction and the FD2 instruction. In other words, the instructions of the two FDs are both from a certain FG, and the pilot can select which FG to come from through the control panel in the cockpit.

[0059] In the above embodiment, Figure 1 The system 100 shown may also include a first monitor (monitor 1) on the same side as the first flight guidance system (FG1) and a second monitor (monitor 2) on the same side as the second flight guidance system (FG2), both of which reside in other independent computers different from the autoflight computer (i.e., monitor 1 and monitor 2 reside in monitor resident computers A and B, respectively). In one embodiment of the present invention, the other independent computer includes a DAL A-level high-security computer, including a display and a main flight control computer.

[0060] exist Figure 1 In the illustrated embodiment, the flight tube roll instructions (FMS1 instructions and FMS2 instructions) from FMS1 and FMS2 are sent to monitor 1 and monitor 2, respectively, and are forwarded to the first flight guidance system (FG1) and the second flight guidance system (FG2) via monitor 1 and monitor 2, respectively.

[0061] During RNP operation, the first and second flight guidance systems are connected to LNAV or APPR mode. In this mode, the first and second flight control systems can calculate the flight control roll command based on the atmospheric / inertial navigation data, flight plan and current aircraft position. The command is sent to the corresponding monitor resident computer and forwarded to the automatic flight computer through the corresponding monitor resident computer, so that the monitor can obtain all the required calculation data sources and realize the automatic switching of the FMS data source used by the FG when a certain FMS fails.

[0062] Subsequently, the first and second flight guidance systems calculate the flight guidance (FD) instruction according to the flight tube roll instruction and the current roll angle of the aircraft. In this process, the data sources required to obtain the FD instruction include: aircraft attitude data (including aircraft roll angle) given by the inertial navigation system IRS, aircraft airspeed data given by the atmospheric data computer ADC, and flight tube roll instruction given by the flight control system FMS. Therefore, in order to cover the entire process of FD instruction calculation during RNP operation, each of the monitor resident computers A and B has the following monitors resident (that is, each of monitor 1 and monitor 2 includes the following monitors):

[0063] a) FG1 monitor and FG2 monitor are used to monitor whether the two FGs are faulty. The monitors in the two computers give the monitoring results of FG1_invalid_from_A, FG2 invalid_from_A, FG1_invalid_from_B, and FG2invalid_from_B respectively;

[0064] b) ADC1 and ADC2 monitors are used to monitor whether the two ADCs are faulty. The monitors in the two computers give the monitoring results of ADC1_invalid_from_A, ADC2 invalid_from_A, ADC1_invalid_from_B, and ADC2invalid_from_B respectively;

[0065] c) IRS1 and IRS2 monitors are used to monitor whether the two IRSs are faulty. The monitors in the two computers give the monitoring results of IRS1_invalid_from_A, IRS2 invalid_from_A, IRS1_invalid_from_B, and IRS2invalid_from_B respectively;

[0066] d) FMS1 and FMS2 monitors are used to monitor whether the two FMSs have any faults. The monitors in the two computers give the monitoring results of FMS1_invalid_from_A, FMS2 invalid_from_A, FMS1_invalid_from_B, and FMS2invalid_from_B respectively.

[0067] All the above monitoring results can be given via the corresponding first and second monitors and sent to both the first flight guidance system (FG1) and the second flight guidance system (FG2) in the automatic flight computer.

[0068] In one embodiment of the present invention, when at least one of the first monitor (monitor 1) and the second monitor (monitor 2) gives a monitoring result indicating that one of the two flight management systems (FMS1 and FMS2), one of the two inertial navigation systems (IRS1 and IRS2), or one of the two air data computers (ADC1 and ADC2) has failed and the at least one monitor includes a monitor on the same side as the failed flight management system, inertial navigation system or air data computer, the first flight guidance system (FG1) or the second flight guidance system (FG2), that is, the flight guidance system on the same side as the failed flight management system, inertial navigation system or air data computer (failure side FG), can be configured to switch to using another flight management system, another inertial navigation system, or another air data computer that has not failed to perform respective flight guidance instruction calculations. In one embodiment of the present invention, the faulty side FG may be further configured to switch to using the non-faulty another flight control system, another inertial navigation system, or another air data computer to perform flight guidance instruction calculations when the monitor on the same side as the other flight control system, another inertial navigation system, or another air data computer does not give a monitoring result indicating that the other flight control system, another inertial navigation system, or another air data computer has failed (in this case, the other flight control system / inertial navigation system / air data computer is determined by the monitor on the same side as not having failed). For example, FG1 is using ADC1, and if monitor 1 believes that ADC1 has failed, then if monitor 2 believes that ADC2 has no failure, then FG1 will switch to using ADC2. For another example, FG1 is using FMS1, and if monitor 1 believes that FMS1 has failed, then if monitor 2 believes that FMS2 has no failure, then FG1 will switch to using FMS2. For another example, FG1 is using IRS1. If monitor 1 believes that IRS1 is faulty, then FG1 will switch to using IRS2 only if monitor 2 believes that IRS2 is not faulty.

[0069] In an exemplary embodiment of the present invention, when both monitor 1 and monitor 2 give monitoring results indicating that FMS1 has failed (i.e., FMS1_invalid_from_A and FMS1_invalid_from_B), the failure is confirmed and FG1 can switch to using the flight tube roll command from FMS2 that is not failed (the determination that FMS2 has not failed is as described above) to calculate the flight guidance command.

[0070] In another exemplary embodiment of the present invention, when only monitor 1 gives a monitoring result indicating that FMS1 fails (ie, FMS1_invalid_from_A), the failure is confirmed and FG1 may switch to using the tube roll command from the non-failed FMS2 to calculate the flight guidance command.

[0071] In still another exemplary embodiment of the present invention, when only the monitor 2 gives a monitoring result indicating that the FMS 1 has failed (ie, FMS1_invalid_from_B), the failure is not confirmed because the monitor 2 is on a different side from the FMS 1 .

[0072] In one embodiment of the present invention, when at least one of the first monitor (Monitor 1) and the second monitor (Monitor 2) gives a monitoring result indicating that one of the two flight guidance systems (FG1 and FG2) has failed and the at least one monitor includes a monitor on the same side as the failed flight guidance system, the flight guidance instructions calculated by the other flight guidance system that is not failed are displayed on two displays in the cockpit (as FD1 and FD2).

[0073] In other words, when no fault occurs, FG1 uses the data of ADC1, IRS1, and FMS1 to calculate the command, and FG2 uses the data of ADC2, IRS2, and FMS2 to calculate the command. When the ADC monitor in the monitor computer detects that ADC1 or ADC2 has failed, the FG on the faulty side of the two FGs will switch to using the ADC data on the non-faulty side. Similarly, when the IRS monitor in the monitor computer detects that IRS1 or IRS2 has failed, the FG on the faulty side of the two FGs will switch to using the IRS data on the non-faulty side; when the FMS monitor in the monitor computer detects that FMS1 or FMS2 is invalid, the FG on the faulty side of the two FGs will switch to using the FMS data on the non-faulty side; when the FMS monitor in the monitor computer detects that the outputs of FMS1 and FMS2 are inconsistent, an alarm will be given, and the pilot will judge which FMS is normal.

[0074] In another embodiment of the present invention, since FMS1 and FMS2 use the aircraft airspeed data from ADC1 and ADC2 on the same side and the aircraft attitude data from IRS1 and IRS2 on the same side to calculate the flight tube roll command, when at least one of the monitors 1 and 2 gives a monitoring result indicating that one of the two ADCs or one of the two IRSs has failed and the at least one monitor includes a monitor on the same side as the failed ADC or IRS, these monitoring results can be sent to the two FMSs, and the FMS on the failed side can be further configured to switch to using another ADC or another IRS that is not failed to perform the flight tube roll command calculation. In this way, front-end fault monitoring and data source switching can be implemented to ensure that the data source required for the FMS to calculate the flight tube roll command is fault-free.

[0075] In another embodiment of the present invention, the system 100 may further include a third monitor (Monitor 3) not on the same side as either the first flight guidance system (FG1) or the second flight guidance system (FG2). Figure 1 The third monitor may reside in an independent computer other than the auto-flight computer (the monitor resides in computer C, Figure 1 (not shown), and may include, like the first monitor and the second monitor, a first flight guidance system monitor (FG1 monitor) and a second flight guidance system monitor (FG2 monitor), a first flight management system monitor (FMS1 monitor) and a second flight management system monitor (FMS2 monitor), a first inertial navigation system monitor (IRS1 monitor) and a second inertial navigation system monitor (IRS2 monitor), and a first air data computer monitor (ADC1 monitor) and a second air data computer monitor (ADC2 monitor).

[0076] In this embodiment, when at least two of the first monitor (monitor 1), the second monitor (monitor 2) and the third monitor (monitor 3) give a monitoring result indicating that one of the two flight management systems (FMS1 and FMS2), one of the two inertial navigation systems (IRS1 and IRS2), or one of the two atmospheric data computers (ADC1 and ADC2) has failed, the faulty side FG in the first flight guidance system (FG1) and the second flight guidance system (FG2) can be configured to switch to using another non-faulty flight management system, another inertial navigation system, or another atmospheric data computer to perform flight guidance instruction calculation, and when at least two of the first monitor (monitor 1), the second monitor (monitor 2) and the third monitor (monitor 3) give a monitoring result indicating that one of the two flight guidance systems (FG1 and FG2) has failed, the flight guidance instructions calculated by the other non-faulty flight guidance system are displayed on two displays in the cockpit.

[0077] In an exemplary embodiment of the present invention, when the three monitors, monitor 1, monitor 2 and monitor 3, all give monitoring results indicating that IRS1 has failed (i.e., IRS1_invalid_from_A, IRS1_invalid_from_B and IRS1_invalid_from_C), the failure is confirmed and FG1 can switch to using the aircraft attitude data from the non-failed IRS2 (the determination that IRS2 has not failed is as described above) to calculate the respective flight guidance instructions.

[0078] In another exemplary embodiment of the present invention, when only monitor 1 and monitor 2 give monitoring results indicating that IRS1 has failed (i.e., IRS1_invalid_from_A and IRS1_invalid_from_B), the failure is confirmed because two of the three monitors (monitor 1 and monitor 2) have given monitoring results indicating a failure, and FG1 can switch to using the aircraft attitude data from the non-faulty IRS2 to calculate the flight guidance instructions.

[0079] In another exemplary embodiment of the present invention, when only monitor 2 and monitor 3 give monitoring results indicating that IRS1 has failed (i.e., IRS1_invalid_from_B and IRS1_invalid_from_C), the fault is also confirmed because two of the three monitors (monitor 2 and monitor 3) have given monitoring results indicating the fault, even though the two monitors are on different sides of IRS1 (this fault judgment logic is different from the embodiment in which the system only includes two monitors).

[0080] As can be understood by those skilled in the art, in other embodiments of the present invention, the system 100 may further include more (more than three) monitors, but the layout of these monitors and the fault determination (and non-fault determination) logic also follow the above-mentioned embodiments, that is, there may be multiple monitors, and if the multiple monitors refer to two monitors, then the fault is confirmed when at least one monitor determines a fault (failure or error) and the at least one monitor includes a fault-side monitor, otherwise it is not confirmed; if the multiple monitors refer to more than two monitors, then the fault can be confirmed when at least half of the monitors determine a fault (failure or error), otherwise it is not confirmed, and in these two cases, if the monitor on the same side of the ADC / IRS / FMS to be switched by the FG or FMS does not give a monitoring result indicating that the ADC / IRS / FMS has a fault, then the ADC / IRS / FMS is determined to be non-faulty by the monitor on the same side, and the FG or FMS can switch to using the ADC / IRS / FMS to perform instruction calculations, so these other embodiments do not violate the spirit and scope of the present invention.

[0081] During the switching of data sources (e.g., ADC, FMS, IRS), the flight guidance system maintains the LNAV / APPR mode and automatically synchronizes the source data or instructions to avoid excessive transient response of the aircraft during the switching process and to avoid the aircraft from deviating from the route during fault handling.

[0082] In one embodiment of the present invention, the first flight guidance system monitor (FG1 monitor) and the second flight guidance system monitor (FG2 monitor) can be further configured to monitor whether the first flight guidance system (FG1) and the second flight guidance system (FG2) are faulty by: determining whether the flight guidance instructions from the two flight guidance systems are valid; and performing a difference calculation between the flight tube roll instruction and the aircraft roll angle in the aircraft attitude data from the IRS and determining whether the difference is consistent with the flight guidance instruction. In other words, for the FG monitor, monitoring may include:

[0083] a) Determine the validity of FG data. When the data sent by a certain FG is invalid, the FG is deemed invalid;

[0084] b) The FG1 monitor of the monitor resident computer performs the difference calculation of "flight tube roll instruction-aircraft roll angle" (using the same data source as FG1) and compares it with the instruction issued by FG1. When the two are inconsistent, it is determined that an error has occurred, and the monitor resident computer sends the FG1_invalid_from_A / FG1_invalid_from_B set signal;

[0085] c) The FG2 monitor of the monitor resident computer performs the difference calculation of "flight tube roll instruction-aircraft roll angle" (using the same data source as FG2) and compares it with the instruction issued by FG2. When the two are inconsistent, it is determined that an error has occurred and the monitor sends out the FG2_invalid_from_A / FG2_invalid_from_B set signal.

[0086] The FG1_invalid_from_A, FG1_invalid_from_B, FG2_invalid_from_A, and FG2_invalid_from_B signals issued by the monitor will be sent to the two FGs. The FGs determine which side of the FG to use as the data source for the two FDs based on the monitoring results.

[0087] In the present invention, considering that the flight guidance includes multiple modes and the algorithm is complex, according to the actual situation of RNP operation, a simplified method of comparing the difference between "flight tube roll instruction-aircraft roll angle" is used to monitor the flight guidance calculation process in LNAV and APPR modes.

[0088] In one embodiment of the present invention, the first flight control system monitor (FMS1 monitor) and the second flight control system monitor (FMS2 monitor) may be further configured to monitor whether the first flight control system (FMS1) and the second flight control system (FMS2) are faulty by the following operations: determining whether the flight tube roll instructions from the two flight control systems are valid. In addition, the first flight control system monitor (FMS1 monitor) and the second flight control system monitor (FMS2 monitor) may be further configured to determine whether the flight tube roll instructions from the two flight control systems are consistent, and to give an alarm when they are inconsistent. In other words, for the FMS monitor, monitoring may include:

[0089] a) Determine the validity of FMS data. When the data sent by a certain FMS is invalid, the FMS is deemed invalid;

[0090] b) Compare the outputs of FMS1 and FMS2 and give an alarm when the two are inconsistent.

[0091] Taking FMS1 failure as an example, when FMS1 is judged as invalid by monitor resident computer A, monitor resident computer A sends FMS1_invalid_from_A set signal. When FMS1 is judged as invalid by monitor resident computer B, monitor resident computer B sends FMS1_invalid_from_B set signal. At this time, FG1 will switch to using the data sent by FMS2 (including the flight tube roll command) for command calculation.

[0092] When the outputs of the two FMSs are inconsistent, the FMS monitor gives an alarm and displays it on the cockpit display. The pilot decides which FMS is correct and switches the data source manually.

[0093] In one embodiment of the present invention, the first inertial navigation system monitor (IRS1 monitor) and the second inertial navigation system monitor (IRS2 monitor) may be further configured to monitor whether the first inertial navigation system (IRS1) and the second inertial navigation system (IRS2) are faulty by: determining whether the aircraft attitude data from the two inertial navigation systems are valid; and determining whether the aircraft attitude data from one inertial navigation system is consistent with the aircraft attitude data from another inertial navigation system and the backup instrument ( Figure 1 In other words, for an IRS monitor, monitoring may include:

[0094] a) Determine the validity of IRS data. When the data sent by an IRS is invalid, the IRS is deemed invalid;

[0095] b) Compare the outputs of IRS1, IRS2 and ISI (backup instrument). When the difference between the output of a certain IRS and the other two outputs is greater than the threshold, the IRS is judged to be wrong.

[0096] Taking IRS1 failure as an example, when IRS1 is judged as invalid or erroneous by monitor resident computer A, monitor resident computer A sends IRS1_invalid_from_A set signal. When IRS1 is judged as invalid or erroneous by monitor resident computer B, monitor resident computer B sends IRS1_invalid_from_B set signal. At this time, FG1 will switch to using the attitude data sent by IRS2 to perform flight guidance instruction calculations, and FMS1 can optionally use the attitude data sent by IRS2 to perform flight tube roll instruction calculations.

[0097] In one embodiment of the present invention, the first air data computer monitor (ADC1 monitor) and the second air data computer monitor (ADC2 monitor) may be further configured to monitor whether the first air data computer (ADC1) and the second air data computer (ADC2) are faulty by: determining whether the aircraft airspeed data from the two air data computers are valid; and determining whether the aircraft airspeed data from one air data computer and the aircraft airspeed data from another air data computer and the standby instrument (ISI) are all greater than a threshold. In other words, for the ADC monitor, monitoring may include:

[0098] a) Determine the validity of ADC data. When the data sent by a certain ADC is invalid, the ADC is deemed invalid;

[0099] b) Compare the outputs of ADC1, ADC2 and ISI (spare instrument). When the difference between the output of a certain ADC and the other two outputs is greater than the threshold, the ADC is judged to be wrong.

[0100] Taking ADC1 failure as an example, when ADC1 is judged as invalid or erroneous by monitor resident computer A, monitor resident computer A sends ADC1_invalid_from_A set signal. When ADC1 is judged as invalid or erroneous by monitor resident computer B, monitor resident computer B sends ADC1_invalid_from_B set signal. At this time, FG1 will switch to using the airspeed data sent by ADC2 to perform flight guidance command calculations, and FMS1 can optionally use the airspeed data sent by ADC2 to perform flight tube roll command calculations.

[0101] As those skilled in the art will appreciate, the above threshold may be any suitable threshold and is not limited to any specific threshold.

[0102] Figure 2 is a flow chart of a method 200 for flight directing according to one embodiment of the present disclosure.

[0103] In this embodiment, if Figure 2 As shown, the method 200 starts at step 202, and the first flight guidance instruction and the second flight guidance instruction are respectively calculated based on the flight tube roll instructions from the first flight control system and the second flight control system, the aircraft airspeed data from the first air data computer and the second air data computer, and the aircraft attitude data from the first inertial navigation system and the second inertial navigation system.

[0104] Then, the method 200 proceeds to step 204, respectively monitoring whether the first inertial navigation system and the second inertial navigation system have a fault and providing corresponding monitoring results. In one embodiment of the present invention, respectively monitoring whether the first inertial navigation system and the second inertial navigation system have a fault further includes: determining whether the aircraft attitude data from the two inertial navigation systems are valid; and determining whether the aircraft attitude data from one inertial navigation system and the aircraft attitude data from the other inertial navigation system and the standby instrument are all greater than a threshold.

[0105] Next, the method 200 proceeds to step 206, respectively monitoring whether the first air data computer and the second air data computer fail and giving corresponding monitoring results. In one embodiment of the present invention, respectively monitoring whether the first air data computer and the second air data computer fail further includes: determining whether the aircraft airspeed data from the two air data computers are valid; and determining whether the aircraft airspeed data from one air data computer and the aircraft airspeed data from another air data computer and the standby instrument are both greater than a threshold. In another embodiment of the present invention, after step 206, the method 200 may also optionally include switching to using another inertial navigation system or another air data computer that is not failed to perform the flight tube roll command calculation when at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two inertial navigation systems or one of the two air data computers fails and the at least one monitor includes a monitor on the same side as the failed inertial navigation system or air data computer.

[0106] Then, the method 200 proceeds to step 208, respectively monitoring whether the first flight control system and the second flight control system have a fault and providing corresponding monitoring results. In one embodiment of the present invention, respectively monitoring whether the first flight control system and the second flight control system have a fault further includes: determining whether the flight control roll instructions from the two flight control systems are valid.

[0107] Finally, the method 200 continues to step 210, when at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight control systems, one of the two inertial navigation systems, or one of the two air data computers has failed and the at least one monitor includes a monitor on the same side as the failed flight control system, inertial navigation system, or air data computer, switching to using another flight control system, another inertial navigation system, or another air data computer that is not failed to execute flight guidance instruction calculation.

[0108] The method 200 ends after step 210 .

[0109] In another embodiment of the present invention, method 200 optionally further includes monitoring the first flight guidance system and the second flight guidance system for failure and providing corresponding monitoring results after step 210. In this embodiment of the present invention, monitoring the first flight guidance system and the second flight guidance system for failure further includes: determining whether the flight guidance instructions from the two flight guidance systems are valid; and performing a difference calculation between the flight tube roll instruction and the aircraft roll angle in the aircraft attitude data and determining whether the difference is consistent with the flight guidance instruction.

[0110] In the above embodiment, method 200 also optionally includes displaying flight guidance instructions calculated by another flight guidance system that is not faulty on two displays in the cockpit when at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight guidance systems has failed and at least one monitor includes a monitor on the same side as the failed flight guidance system.

[0111] In summary, the present invention proposes a monitoring system and method for a dual-channel flight guidance system. The technical solution of the present invention is aimed at a dual-channel flight guidance architecture, and realizes automatic switching of flight guidance data sources during RNP operation by resident flight guidance monitors in separate computers to reduce pilot workload, and provides matching automatic flight mode conversion logic to ensure that failure of a single component will not cause loss or error of both flight guidance.

[0112] Embodiments of the present invention have been described above with reference to block diagrams and / or the operating instructions of methods, systems, and computer program products according to embodiments of the present invention. Each function / action noted in the frame may occur in an order different from that shown in any flow chart. For example, depending on the function / action involved, two frames shown in succession may actually be performed substantially simultaneously, or these frames may sometimes be performed in an opposite order.

[0113] The above is only a preferred specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A system for flight guidance including an independent monitor, comprising: a first flight guidance system and a second flight guidance system residing in the autoflight computer, the two flight guidance systems being configured to receive flight tube roll instructions from the first flight control system and the second flight control system on the same side, aircraft airspeed data from the first air data computer and the second air data computer on the same side, and aircraft attitude data from the first inertial navigation system and the second inertial navigation system on the same side, respectively, to calculate the first flight guidance instruction and the second flight guidance instruction, respectively; and a first monitor on the same side as the first flight guidance system and a second monitor on the same side as the second flight guidance system, both monitors residing in separate computers other than the autoflight computer, wherein: Both the first monitor and the second monitor include a first flight guidance system monitor and a second flight guidance system monitor, a first flight control system monitor and a second flight control system monitor, a first inertial navigation system monitor and a second inertial navigation system monitor, and a first air data computer monitor and a second air data computer monitor, and When at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight control systems, one of the two inertial navigation systems, or one of the two air data computers has failed and the at least one monitor includes a monitor on the same side as the failed flight control system, inertial navigation system or air data computer, the flight guidance system on the same side as the failed flight control system, inertial navigation system or air data computer of the first flight guidance system and the second flight guidance system is configured to switch to using another flight control system, another inertial navigation system, or another air data computer that has not failed to perform flight guidance instruction calculations.

2. The system of claim 1, wherein the other independent computers include DAL Class A high-security computers including displays and a main flight control computer.

3. The system of claim 1, wherein: The flight tube roll instructions from the first flight control system and the second flight control system are sent to the first monitor and the second monitor, and are forwarded to the first flight guidance system and the second flight guidance system via the first monitor and the second monitor. The first inertial navigation system monitor and the second inertial navigation system monitor are configured to respectively monitor whether the first inertial navigation system and the second inertial navigation system have any faults and provide corresponding monitoring results. The first air data computer monitor and the second air data computer monitor are configured to monitor whether the first air data computer and the second air data computer fail respectively and provide corresponding monitoring results. The first flight control system monitor and the second flight control system monitor are configured to respectively monitor whether the first flight control system and the second flight control system have any failure and provide corresponding monitoring results. The first flight guidance system monitor and the second flight guidance system monitor are configured to monitor whether the first flight guidance system and the second flight guidance system fail respectively and give corresponding monitoring results, and The monitoring result is given via the corresponding first monitor and the second monitor and sent to the first flight guidance system and the second flight guidance system.

4. The system of claim 3, wherein: The first flight guidance system monitor and the second flight guidance system monitor are further configured to monitor whether the first flight guidance system and the second flight guidance system fail respectively by: determining whether the flight guidance instructions from the two flight guidance systems are valid; and performing a difference calculation between the flight tube roll instruction and the aircraft roll angle in the aircraft attitude data and determining whether the difference is consistent with the flight guidance instruction. The first flight control system monitor and the second flight control system monitor are further configured to monitor whether the first flight control system and the second flight control system have failed respectively by: determining whether the flight control roll instructions from the two flight control systems are valid; The first inertial navigation system monitor and the second inertial navigation system monitor are further configured to monitor whether the first inertial navigation system and the second inertial navigation system fail respectively by: determining whether the aircraft attitude data from the two inertial navigation systems are valid; and determining whether the aircraft attitude data from one inertial navigation system and the aircraft attitude data from the other inertial navigation system and the standby instrument are all greater than a threshold value, and The first air data computer monitor and the second air data computer monitor are further configured to monitor whether the first air data computer and the second air data computer respectively fail by: determining whether the aircraft airspeed data from the two air data computers are valid; and determining whether the aircraft airspeed data from one air data computer and the aircraft airspeed data from the other air data computer and the standby instrument are all greater than a threshold.

5. The system of claim 4, wherein when at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight guidance systems has failed and the at least one monitor includes a monitor on the same side as the failed flight guidance system, the flight guidance instructions calculated by the other flight guidance system that is not failed are displayed on two displays in the cockpit.

6. The system of claim 1 , wherein the flight guidance system on the same side as the failed flight control system, the inertial navigation system or the air data computer is further configured to switch to using the other flight control system, the other inertial navigation system or the other air data computer that is not failed to execute the flight guidance instruction calculation if a monitor on the same side as the other flight control system, the other inertial navigation system or the other air data computer does not give a monitoring result indicating that the other flight control system, the other inertial navigation system or the other air data computer has failed.

7. The system of claim 1 , wherein the system further comprises a third monitor that is not on the same side as either the first flight guidance system or the second flight guidance system, the third monitor residing in another independent computer different from the autoflight computer, and comprising the first flight guidance system monitor and the second flight guidance system monitor, the first flight control system monitor and the second flight control system monitor, the first inertial navigation system monitor and the second inertial navigation system monitor, and the first air data computer monitor and the second air data computer monitor.

8. The system of claim 7, wherein when at least two of the first monitor, the second monitor, and the third monitor give a monitoring result indicating that one of the two flight control systems, one of the two inertial navigation systems, or one of the two air data computers fails, the first flight guidance system and the second flight guidance system are configured to switch to using another flight control system, another inertial navigation system, or another air data computer that is not failed to perform respective flight guidance instruction calculations, and When at least two of the first monitor, the second monitor and the third monitor give monitoring results indicating that one of the two flight guidance systems has failed, the flight guidance instructions calculated by the other flight guidance system that is not failed are displayed on two displays in the cockpit.

9. The system of claim 1, wherein the first flight control system monitor and the second flight control system monitor are further configured to determine whether the flight tube roll instructions from the two flight control systems are consistent, and to give an alarm when they are inconsistent.

10. A method for flight guidance, the method being performed at the system according to claim 1, the method comprising: respectively calculating the first flight guidance instruction and the second flight guidance instruction based on the flight tube roll instruction from the first flight control system and the second flight control system on the same side, the aircraft airspeed data from the first air data computer and the second air data computer on the same side, and the aircraft attitude data from the first inertial navigation system and the second inertial navigation system on the same side; respectively monitoring whether the first inertial navigation system and the second inertial navigation system have any faults and providing corresponding monitoring results; respectively monitoring whether the first air data computer and the second air data computer have any failure and providing corresponding monitoring results; respectively monitoring whether the first flight control system and the second flight control system have any faults and providing corresponding monitoring results; and When at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight control systems, one of the two inertial navigation systems, or one of the two air data computers has failed, and the at least one monitor includes a monitor on the same side as the failed flight control system, inertial navigation system, or air data computer, switch to using another flight control system, another inertial navigation system, or another air data computer that has not failed to execute flight guidance instruction calculations.

11. The method of claim 10, wherein: The method of separately monitoring whether the first flight control system and the second flight control system have any faults further includes: determining whether the flight control roll instructions from the two flight control systems are valid; The method of monitoring whether the first inertial navigation system and the second inertial navigation system fail further comprises: determining whether the aircraft attitude data from the two inertial navigation systems are valid; and determining whether the aircraft attitude data from one inertial navigation system and the aircraft attitude data from another inertial navigation system and the standby instrument are all greater than a threshold value, and Monitoring the first air data computer and the second air data computer for failures further includes: determining whether the aircraft airspeed data from the two air data computers are valid; and determining whether the aircraft airspeed data from one air data computer and the aircraft airspeed data from another air data computer and a backup instrument are all greater than a threshold.

12. The method of claim 10, wherein the method further comprises: respectively monitoring whether the first flight guidance system and the second flight guidance system have any faults and providing corresponding monitoring results, including determining whether the flight guidance instructions from the two flight guidance systems are valid; and performing a difference calculation between the flight tube roll instruction and the aircraft roll angle in the aircraft attitude data and determining whether the difference is consistent with the flight guidance instruction; as well as When at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two flight guidance systems has failed and the at least one monitor includes a monitor on the same side as the failed flight guidance system, the flight guidance instructions calculated by the other flight guidance system that is not failed are displayed on two displays in the cockpit.

13. The method of claim 10, wherein when performing monitoring of two inertial navigation systems and two air data computers, the method further comprises switching to using another inertial navigation system or another air data computer that is not faulty to perform flight tube roll command calculation when at least one of the first monitor and the second monitor gives a monitoring result indicating that one of the two inertial navigation systems or one of the two air data computers has failed and the at least one monitor includes a monitor on the same side as the failed inertial navigation system or air data computer.

Images