Modular electronic flight control system

Abstract

Modular electronic flight control system with at least one primary flight control computer and a core system made up of a plurality of actuator modules (10) and a plurality of actuator control electronics (ACEs (20)), wherein each individual actuator module (10) is assigned its own ACE (20), which directly receives pilot instructions (40) and can thereby control the actuator module (10), and wherein each ACE (20) consists of a duplex redundant fault self-detecting computer system consisting of a control and monitoring unit (26), wherein the control unit (25) differs from the monitoring unit (26) in both its software architecture and its hardware architecture, and wherein at least one primary flight control computer (30) processes pilot inputs (40) and additionally provides target values ​​to the ACEs (20).

Description

[0001] The invention relates to an electronic flight control system in which hydraulic and electromechanical actuator modules for the movement of the flight control surfaces are controlled by actuator control electronics (ACEs (ACE = Actuator Control Electronic)).

[0002] With such electronic flight control systems, it is of particular importance to guarantee the functionality of the overall system, even if individual components fail due to malfunctions. For this purpose, a redundant design with several parallel-operating subsystems is generally chosen to improve the safety and reliability of the overall system.

[0003] Central, multi-redundant computer systems are known for this purpose, in which each of the central control computers receives and processes the commands generated by the pilot, e.g., from sidesticks or conventional control columns with sensors, and uses the processed commands to control several or all actuators.

[0004] Furthermore, US Patent 893339 A discloses an electronic flight control system in which several parallel primary computer systems handle more complex control tasks, while parallel ACEs control the actuator modules. This ensures that if the primary computers fail, the actuator modules can still be controlled directly by the ACEs. However, here too, the ACEs are large central units that control a large number of actuator modules simultaneously. This presents safety challenges, as the failure of one ACE affects multiple actuator modules. The control systems are also complex in design, making it difficult to detect errors in the software or hardware. Additionally, maintenance and cost issues arise because the central units must be completely replaced in the event of a failure.Furthermore, the entire system must be redesigned for each aircraft type to accommodate the different number of actuator modules.

[0005] Electronic flight control systems are known from DE 601 08 637 T2 and EP 573 106 A1, in which primary computer systems perform complex control tasks. DE 698 16 889 T2 discloses a specific system for controlling an elevator or rudder, which has two electronically controllable hydraulic actuators and a third actuator that can be controlled both electrically and mechanically.

[0006] The object of the invention is to provide an electronic flight control system that is safe, easy to maintain and easily adaptable to different aircraft models.

[0007] According to the invention, this problem is solved by a modular electronic flight control system according to claim 1. Such a modular electronic flight control system comprises a core system of actuator modules and actuator control electronics (ACEs), wherein each individual actuator module is assigned its own ACE, which directly receives pilot commands and can thereby control the actuator module.

[0008] According to the invention, each ACE consists of a duplex-redundant, fault-detecting computer system comprising a control unit and a monitoring unit. This prevents undetected malfunctions of the ACEs, as a fault in the control unit is detected by the parallel monitoring unit. If necessary, the ACE then enters a safe passive state.

[0009] Furthermore, according to the invention, the control unit and the monitoring unit of the ACEs differ both in the structure of their software and in the structure of their hardware. This ensures that no similar common error events can occur in the control and monitoring units, which further increases safety.

[0010] Firstly, the modular design is particularly safe, as the failure of one ACE does not affect the other ACEs, allowing all other actuator modules to continue operating. Redundant systems can therefore be easily created by attaching multiple actuator modules with their associated ACEs to each flight control axis. If one of the ACEs or actuator modules fails, the other modules are still available to reliably control the corresponding function. The modular design also simplifies maintenance, as the functionality of the subsystems is easy to test, and in the event of a malfunction, only the single defective component needs to be replaced. Furthermore, such a modular system is easily adaptable to different aircraft types, as additional modules with their associated ACEs simply need to be added to the system to accommodate varying numbers of actuator modules required.Because an ACE only needs to control one actuator module, the ACE can be relatively simple in design, which saves development costs and increases safety, as errors in software and hardware can be detected more easily.

[0011] Advantageously, the modular electronic flight control system according to the invention comprises, in addition to the core system, at least one primary flight control computer that processes the pilot inputs and provides the ACEs with the setpoints in normal mode instead of the direct pilot inputs. Complex control tasks that facilitate the pilot's control of the aircraft can thus be performed by the primary flight control computers, which are separate from the core system. If these primary flight control computers fail, the aircraft can still be controlled directly by the pilot using the core system.

[0012] Advantageously, the ACEs of the modular electronic flight control system according to the invention include a selection logic that decides whether the direct pilot inputs or the setpoints of the primary flight control computers are used to control the actuator modules. This selection logic ensures that, in an emergency, direct control by the core system is used, thus increasing safety.

[0013] Furthermore, the selection logic advantageously uses direct pilot inputs to control the actuator modules if no setpoints are available from the primary flight control computers, or if these are faulty or contradictory. This ensures reliable detection of a failure or error in the primary flight control computers and guarantees safe control via the core system. When multiple primary flight control computers are used, the selection logic can also compare the setpoints they provide to determine whether a correct setpoint can be identified, which is then used to control the actuator modules. Otherwise, for safety reasons, the direct pilot inputs are used.

[0014] Advantageously, the ACEs and the actuator modules are designed as separate units, so that the electronics can be easily accessed and centrally located, making them easy to maintain.

[0015] Furthermore, the ACEs are advantageously housed in one or more outer enclosures, thereby simplifying the electrical and mechanical interfaces. For safety-critical flight control axes, the simultaneous failure of all ACEs due to a common fault event is advantageously prevented by dividing the modules into two outer enclosures and using two different types of ACEs, which differ in both their hardware and software architecture.

[0016] Two actuator modules actuate a safety-critical control surface. One actuator module is controlled by an ACE of one type, while the other actuator module is controlled by an ACE of the other type. Since only one actuator module is sufficient to move the control surface, only one actuator module is active at any given time, while the other remains passive in a standby mode. If, however, a fault occurs in the active actuator module or its control system, this actuator module is switched to the safe passive mode, and the previously passive actuator module takes over the control of the control surface.

[0017] While existing electronic flight control systems are based on analog ACEs and mechanical emergency control devices, this system creates a modular, fully microprocessor-based electronic system with a total of four different dissimilar computer channels per control surface.

[0018] When using at least one primary flight control computer, the pilot inputs are advantageously modulated in the primary flight control computer by various static and dynamic parameters of the flight attitude and situation into predetermined control rules and then output as setpoints to the ACEs. Based on these setpoints, the ACEs then control the actuator modules. The scope and nature of the control rules are largely arbitrary due to the variable application software of the flight control computers and are redefined for each aircraft by the aerodynamic and functional requirements. This also saves costs, as only the software for the primary flight control computers needs to be changed, while the ACEs can be used in all aircraft types.

[0019] Advantageously, the primary flight control computers are also duplex-redundant, fault-detecting computer systems consisting of a control unit and a monitoring unit. Here, too, the control unit and the monitoring unit of the primary flight control computers advantageously differ in both their software and hardware architectures. As with the ACEs, this architecture prevents the erroneous generation of setpoints for the core system due to a single fault event. If any discrepancy occurs between the control unit and the monitoring unit, the primary flight control computer automatically switches to a safe passive mode.

[0020] While current technology for similar applications prescribes a rigid computer configuration, the primary flight control computers described here are flexible in their number. Depending on availability requirements, one or more flight control computers can be used in parallel.

[0021] Advantageously, in normal flight control mode, the primary flight control computers control the ACEs by specifying setpoints, while in direct flight control mode, the core system is controlled directly via the pilot's inputs. In normal flight control mode, the complex control functions of the primary flight control computers are thus available for controlling the aircraft. However, if errors occur or the primary flight control computers fail completely, the system can switch to direct flight control mode, in which the ACEs, and therefore the actuator modules, are controlled directly via the pilot's inputs. Such a multiply redundant system thus further increases safety.

[0022] Advantageously, only those functions that are not safety-critical are exclusive components of the normal flight control mode. This makes it possible to use only one type of device for the primary flight control computers. While this means that the failure of all primary flight control computers due to a single fault event is not extremely unlikely in the sense of FAR 25, this is not problematic for safety because all safety-critical functions are present in the direct flight control mode. Such a setup with multiple primary flight control computers of the same type has the advantage that the largely non-critical but relatively complex and extensive functions of the normal flight control mode only need to be developed and certified in two dissimilar computer channels.

[0023] Of course, the (inventive) modular flight control system does not preclude the use of two primary flight control computer types with different software and hardware configurations to increase safety.

[0024] In the event of a malfunction or data discrepancy among all primary flight control computers, the system advantageously switches from normal flight control mode to direct flight control mode. This ensures that, after the loss of normal flight control mode, the entire modular electronic flight control system relies on the availability of the core system, which guarantees all safety-critical functions. This is ensured in particular by the fact that all functions of the direct flight control mode are part of the ACEs (Aircraft Control Units).

[0025] For this purpose, the ACEs of the modular electronic flight control system according to the invention advantageously include the selection logic that decides whether the direct pilot inputs or the setpoints of the primary flight control computers are used to control the actuator modules. This corresponds to switching between normal flight control mode and direct flight control mode.

[0026] Advantageously, the system switches from normal to direct mode when the setpoints provided by multiple primary flight control computers are faulty, contradictory, or completely missing. When using two primary flight control computers operating in parallel, this ensures that if one malfunctions, the system switches to the core system for safety reasons, unless it can be determined which primary flight control computer is sending the incorrect signal. When using more than two parallel computers, a faulty signal can potentially be identified by majority vote, and the correct signal can then be used to control the actuator modules.

[0027] In the present modular electronic flight control systems, the pilot commands are advantageously entered manually via input elements in the cockpit, such as sidesticks or conventional control columns for the roll and pitch axes or pedals for the yaw axis, converted into electrical, preferably doubly redundant, signals via electronic position sensors and transmitted as a command to the ACEs.

[0028] Advantageously, each ACE is assigned at least a few redundant electronic position sensors, so that the modular design is also implemented on the cockpit side. Different input elements simply need to provide the same number of sensor pairs.

[0029] The ACEs and the primary flight control computers naturally consist essentially of digital processors with appropriate software.

[0030] Advantageously, the primary flight control computers communicate with the ACEs via a bus system to facilitate the modular design and expansion of the system and to ensure secure and fast communication.

[0031] It is also advantageous that the ACEs communicate with each other via a bus system, again to facilitate the modular design and expansion of the system and to ensure secure and fast communication.

[0032] Advantageously, the primary flight control computers receive the pilot instructions via the ACEs, so that the primary flight control computers only need this one connection to receive the pilot instructions.

[0033] The actuator modules comprise hydraulic, electric, or electrohydraulic drives, for whose control the ACEs may include digital-to-analog converters. However, it is also possible that the actuator modules themselves contain such converter electronics and receive digital control commands from the ACEs.

[0034] Exemplary embodiments of the present invention will now be described in more detail with reference to drawings.

[0035] This shows: Fig. 1: a schematic representation of a first embodiment of the modular electronic flight control system of the present invention, Fig. 2: a schematic representation of an embodiment of the ACEs and the primary flight control computer of the present invention, Fig. 3: a further schematic representation of the embodiment of the ACE and the primary flight control computer of the present invention, Fig. 4: A schematic representation of the overall design of the modular electronic flight control system of the present invention.

[0036] In Fig. Figure 1 shows a first embodiment of a modular electronic flight control system of the present invention. The pilot and copilot control the system by providing manual commands via input elements 40. In the first embodiment, these input elements 40 are so-called sidesticks, which allow for complex control commands. Of course, other input elements are also possible, which can likewise be connected to the modular electronic flight control system and which then actuate other actuators. For the sake of simplicity, however, only this one input element 40 for the pilot and copilot is shown in the first embodiment. In these input elements 40, the manual pilot commands are converted into electrical signals via electronic position sensors, with duplex redundant electrical signals being used in the first embodiment.The input elements 40 are used here to control the control surfaces 15, by whose movement the aircraft can be controlled.

[0037] The duplex redundant control signals from the input elements 40 are forwarded to the ACEs 20 and 21 via signal lines 70. Each of the ACEs 20 and 21 controls exactly one actuator module 10 or 11.

[0038] The present embodiment of the modular electronic flight control system of the present invention is designed with quadruple redundancy. For this purpose, two actuator modules 10 and 11 are attached to each control surface 15, which are controlled by two differently configured ACEs 20 and 21. The ACEs 20 and 21 differ in both their hardware and software configurations. This ensures that no simultaneous, identical fault events can occur that would lead to malfunctions and thus shutdown in both ACEs. Since both actuator modules 10 and 11 are capable of controlling the control surface 15 independently, only one of the actuator modules is active. The other actuator module, here 11, is in a damped bypass mode.

[0039] If an error is detected in the ACE 20, which controls the active actuator module 10, the ACE 20 switches to a passive mode, in which the actuator module 10 switches to damped bypass mode. The ACE 21 then switches the actuator module 11 it controls to an active mode, in which the control surface 15 is then controlled by the ACE 21 and the actuator module 11.

[0040] The ACEs 20 and 21 communicate with each other via a BUS system 72, so that the ACE in standby mode can detect an error in the active ACE and take over control.

[0041] Furthermore, in this embodiment, the ACEs 20 and 21 are connected to the primary flight control computers 30 and 31 via a BUS system 72. On the one hand, the primary flight control computers 30 and 31 receive the pilot inputs from the ACEs 20 and 21; on the other hand, the primary flight control computers 30 and 31 return setpoint values ​​to the ACEs.

[0042] In direct flight control mode, the direct pilot inputs from input elements 40 are used in ACEs 20 and 21, while in normal flight control mode, the setpoints from the primary flight control computers 30 and 31 are used to control the actuator modules 10 and 11. The primary flight control computers 30 and 31 perform the calculation of all control functions for normal flight control mode. For this purpose, the pilot inputs are received by the ACEs, modulated by various static and dynamic parameters of the flight attitude and situation into predetermined control laws, and then returned to the ACEs as setpoints. Due to the variable application software of the flight control computers, the scope and nature of the control laws are largely arbitrary and are redefined for each aircraft based on aerodynamic and functional requirements.

[0043] The startup process of the first embodiment of the present invention proceeds as follows: After the electrical power connections and hydraulic supply are switched on, the ACEs 20 initially switch the actuator modules 10 they control into active mode, while the ACEs 21 keep their actuator modules 11 in standby mode. To achieve a fast and reliable switch between active and standby modes, the ACEs 20 and 21, and in particular those ACEs that control the same control surface 15, communicate via a BUS system 72, in this case an ARINC 429 BUS system.

[0044] If hydraulic or electrical problems occur in an active actuator module 10, the controlling ACE 20 detects this through appropriate monitoring functions and sends a corresponding message to the other ACE 21 via the BUS system 72. The latter then switches its actuator module 11 to active mode. If a problem also occurs in the second actuator module 11, the first ACE 20 can become active again if the problem initially present there has since been resolved.

[0045] In Fig. Figure 2 shows a more detailed representation of the exemplary embodiment of the primary flight control computers 30 and 31 and the ACE 20. The ACE 20 receives the pilot commands electronically from the input elements 40 (not shown) via signal lines 70. To process these signals, the ACE 20 has a control-monitor structure consisting of a control unit 25 and a monitoring unit 26. This makes the ACE 20 duplex redundant and fault-detecting, as the monitoring unit 26 detects faults in the control unit 25. If such a fault is detected, the ACE 20 enters a safe passive state, switches the connected actuator module 10 to a damped bypass mode, and notifies the other ACE 21. The control unit 25 and the monitoring unit 26 have different designs in terms of both software and hardware.These dissimilar structures prevent undetected malfunctions of the ACE due to a similar error event (common mode). The actuator module 10 is controlled by the ACE 20 via an actuator interface 24; communication with the other ACEs 21 and the primary flight control computers 30 and 31 takes place via a bus system 71 and 72.

[0046] The primary flight control computers 30 and 31 also feature a control-monitor architecture consisting of a control unit 35 and a monitoring unit 36. These two units also differ in their hardware and software design, thus preventing undetected malfunctions caused by the same type of error event. Unlike the ACEs 20 and 21, which in this embodiment also have dissimilar hardware and software designs, the primary flight control computers 30 and 31 all have the same design. The primary flight control computers 30 and 31 can be used in varying numbers.Since they all share the same architecture, the development effort is not increased by using multiple parallel primary flight control computers. Therefore, the number of these primary flight control computers, 30 and 31, can be increased to achieve greater system redundancy without a corresponding increase in development costs. Primary flight control computers 30 and 31 communicate internally via an X-Link or a BUS system, through which they also connect to the aircraft's other system computers. These systems include, for example, the flight recorder, the autopilot, the inertial platform, and the cockpit display systems.

[0047] If the control unit 35 fails due to errors, the monitoring unit 36 ​​detects this and can interrupt the setpoint data via the control switch 37. The primary flight control computers 31 continue to perform the tasks of normal flight control mode. If these also fail, the selection logic of the ACEs 20 can switch to direct flight control mode.

[0048] Fig. Figure 3 also shows an embodiment of the primary flight control computer 30 and the ACE 20, particularly illustrating the switching between normal flight control mode and direct flight control mode. The ACE 20 receives pilot input from the input element 40, in this case a sidestick, via signal lines 70. This input is processed on the one hand by the functions of the direct flight control mode 50 and on the other hand forwarded to the primary flight control computer 30 via the BUS system 71.

[0049] The functions of the normal flight control mode 60 are located there, which modulate the pilot's inputs through various static and dynamic parameters of the flight attitude and situation according to predetermined rules, thus providing target values ​​for the ACEs. This occurs in both the control unit 35 and the monitoring unit 36, so that the two values ​​can be compared, and in case of errors, the primary flight control computer 30 can be put into a safe passive state via a switch 65.

[0050] The setpoints calculated in normal flight control mode 60 are then returned to the ACE 20 via the BUS system 71. The ACE 20 also receives setpoints from the other primary flight control computers 31. A selection logic 70 determines whether the setpoints provided by the primary flight control computers 30 and 31 are error-free. If a correct signal is identified, it is used to control the actuator module 10 via switch 75 after passing through a rate-of-rise limiter 71. However, if no correct setpoint can be obtained from the primary flight control computers 30 and 31, the selection logic 70 toggles switch 75 so that the values ​​from direct flight control mode 50 are used to control the actuator module 10.

[0051] This direct flight control mode 50 encompasses all functions that are safety-critical for controlling the aircraft. Therefore, in the event of a failure of the primary flight control computers 30 or 31, or in the event of errors in these primary flight control computers, the aircraft can be safely controlled via direct flight control mode 50. Downstream of switch 75, a control unit 76 is provided for regulating the position of the actuator module, in which the signals from either direct flight control mode 50 or normal flight control mode 60 are used as the setpoint for the actuator position.

[0052] The ACE 20 also contains a control unit 25 and a monitoring unit 26, which have different hardware and software configurations and monitor each other.

[0053] The Fig. 4 shows the entire system, whereas previously in the Fig. 1 only a detail of a control axis was shown.

[0054] For each input element 40, such as the pilot's sidesticks 90 and the co-pilot's sidesticks 91, the airbrake lever 92, the rudder lever 93, the slat / flap lever 94 and the trim switch 101, at least one ACE 20 or 21 is provided.

[0055] In general, to increase safety, each input element 40 is assigned several parallel-operating ACEs, which act on the same control surface with the actuator modules they control. In particular, two dissimilar ACEs 20 and 21 are provided for each of the ailerons 95, elevators 96, flaps 99, slats 98, and horizontal stabilizers 102. Three parallel-operating ACEs are even provided for controlling the rudder 97.

[0056] These ACEs 20 and 21 communicate with each other via a bus system 72, so that if one ACE 20 or the connected actuator module 10 fails, the other actuator module 11 acting on the same control surface can be activated via the other ACE 21.

[0057] The ACEs 20 and 21 also communicate via a BUS system 71 with the primary flight control computers 30 and 31, which in a normal flight control mode take over complex flight control tasks and return target values ​​to the ACEs based on the pilot instructions they receive via the ACEs.

Claims

[1] Modular electronic flight control system with at least one primary flight control computer and a core system made up of a plurality of actuator modules (10) and a plurality of actuator control electronics (ACEs (20)), wherein each individual actuator module (10) is assigned its own ACE (20), which directly receives pilot instructions (40) and can thereby control the actuator module (10), and wherein each ACE (20) consists of a duplex redundant fault self-detecting computer system consisting of a control and monitoring unit (26), wherein the control unit (25) differs from the monitoring unit (26) in both its software architecture and its hardware architecture, and wherein at least one primary flight control computer (30) processes pilot inputs (40) and additionally provides target values ​​to the ACEs (20). [2] Modular electronic flight control system according to claim 1, wherein the ACEs (20) comprise a selection logic that decides whether the direct pilot inputs (40) or the setpoints of the primary flight control computers are used to control the actuator modules (10). [3] Modular electronic flight control system according to claim 2, wherein the selection logic uses the direct pilot inputs (40) to control the actuator modules (10) when no setpoints are available from the primary flight control computers or when these are faulty or contradictory. [4] Modular electronic flight control system according to claim 1, wherein the ACE (20) enters a safe passive mode in the event of a fault. [5] Modular electronic flight control system according to claim 1, wherein the ACEs (20) and the actuator modules (10) are designed as separate units. [6] Modular electronic flight control system according to claim 1, wherein the ACEs (20) are housed in one or more outer enclosures. [7] Modular electronic flight control system according to claim 1, wherein at least two actuator modules (10) with associated ACEs (20) are used to control safety-critical flight control axes, wherein the ACEs (20) differ in both software and hardware design. [8] Modular electronic flight control system according to claim 1, wherein the at least one primary flight control computer (30) modulates and processes the pilot inputs (40) by means of static and / or dynamic parameters of the flight situation according to predetermined rule laws. [9] Modular electronic flight control system according to claim 1, wherein the at least one primary flight control computer (30) consists of a duplex redundant fault self-detecting computer system comprising a control and monitoring unit (26). [10] Modular electronic flight control system according to claim 9, wherein the control unit (25) of the at least one primary flight control computer differs from the monitoring unit (26) of the at least one primary flight control computer in both software architecture and hardware architecture. [11] Modular electronic flight control system according to claim 9, wherein the at least one primary flight control computer (30) enters a safe passive mode in the event of a fault. [12] Modular electronic flight control system according to claim 1, wherein at least two identical primary flight control computers (30) are used. [13] Modular electronic flight control system according to claim 1, wherein at least two primary flight control computers (30) are used which differ in both software architecture and hardware architecture. [14] Modular electronic flight control system according to claim 1, wherein in a normal flight control mode the primary flight control computers control the ACEs (20) by specifying setpoints, while in a direct flight control mode the core system is controlled directly by the pilot inputs (40). [15] Modular electronic flight control system according to claim 14, wherein only those functions whose loss is not safety-critical are an exclusive part of the normal flight control mode. [16] Modular electronic flight control system according to claim 14, wherein in the event of a malfunction of the primary flight control computer, the system switches from normal flight control mode to direct flight control mode. [17] Modular electronic flight control system according to claim 14, wherein the primary flight control computers perform the calculation of all functions of the normal flight control mode. [18] Modular electronic flight control system according to claim 14, wherein the functions of the direct flight control mode are part of the ACEs (20). [19] Modular electronic flight control system according to claim 18, wherein in the event of faulty, contradictory or missing setpoints of the primary flight control computers the ACEs (20) control the actuator module (10)e with the pilot inputs (40) processed in direct mode. [20] Modular electronic flight control system according to claim 1, wherein the number of actuator modules (10) and the ACEs (20) associated therewith can be adapted to the number and availability requirement of the flight control axes to be moved. [21] Modular electronic flight control system according to claim 1, wherein manual pilot inputs (40) are transmitted to the ACEs (20) via electronic position sensors. [22] Modular electronic flight control system according to claim 21, wherein each ACE (20) is assigned at least one redundant pair of electrical position sensors. [23] Modular electronic flight control system according to claim 1, wherein the primary flight control computers receive the pilot inputs (40) via the ACEs (20). [24] Modular electronic flight control system according to claim 1, wherein the primary flight control computers communicate with the ACEs (20) via a bus system (72). [25] Modular electronic flight control system according to claim 1, wherein the ACEs (20) communicate with each other via a bus system (72).

Images