Aircraft flight management system
Patent Information
- Application Number
- FR2023002537
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2023-03-20
- Publication Date
- 2025-03-07
- Estimated Expiration
- 2043-03-20
Smart Images
Figure 00000013_0000
Abstract
Description
Title of the invention: Aircraft flight management system
[0001] The present invention relates to a flight management system for an aircraft.
[0002] The invention relates to the field of on-board systems, and more particularly the optimization of the trajectory of an aircraft.
[0003] In the context of the present invention, the avionics systems are secure on-board systems meeting regulatory constraints of integrity and availability. These avionics systems are characterized by a level of criticality, linked to the level of integrity and the level of availability, imposed by the regulatory standards in force.
[0004] Integrity means the ability of a system to perform a required function correctly. Availability means the ability of a system to perform a required function under given conditions, at a given time or during a given time interval. A "non-avionics" or "open world" system means systems that are not on-board and / or that do not meet the same regulatory constraints of integrity and availability.
[0005] The criticality levels are for example defined in the RTCA DO178-C and EUROCAE ED-12C standards, by five criticality levels (from A to E) defined as follows: Level A: A defect in the system or subsystem under study can cause a catastrophic problem - Flight safety or compromised landing - Aircraft crash. Level B: A defect in the system or subsystem under study can cause a dangerous problem resulting in serious damage or even the death of some occupants. Level C: A defect in the system or subsystem under study may cause a major problem resulting in malfunction of the device's vital equipment. Level D: A defect in the system or subsystem under study may cause a minor problem with no effect on flight safety. Level E: A defect in the system or subsystem under study may cause a problem with no effect on flight safety.
[0006] These 5 levels are also called DAL levels (acronym for "Design Assurance Level" in English). The Levels are established by the functional safety studies. These studies then set the DAL level for the hardware and software in accordance with safety standards (Eurocae ED-79 and SAE ARP4754 "Certification considerations for Highly-Integrated and Complex Aicraft Systems") or aircraft manufacturer directives (ABD100, ABD200,...). The DAL level of a subsystem can be different from the system level provided that the DAL level of the system is achieved by an adequate hardware / software architecture.
[0007] The invention can be applied in the field of air transport, whether it be scheduled aviation, business aviation, aerial work, remotely piloted aircraft or autonomous aircraft.
[0008] Currently, in an onboard aircraft flight management system, or FMS for "Flight Management System" in English, one of the most complex functions is the calculation of the trajectory and predictions (fuel, performance, arrival time), from the aircraft's flight plan. This function is complex because it manages flight optimization and multiple constraints. The processing requires a large computing capacity of the processor or CPU for "Central Processing Unit" in English, and a specific real-time architecture.
[0009] Currently, the trajectory calculation and prediction function is fully implemented on certified avionics systems. The steps for calculating this function are as follows: - Development of the flight plan, - Calculation of the Trajectory, and - Guidance along the trajectory.
[0010] There are numerous patent documents relating to FMS flight management systems, some of which relate to a link between the critical avionics domain and less critical domains (i.e. less critical avionics or non-avionics also called open world).
[0011] For example, document US 10,295,349 B2 is known, which relates to an aircraft flight management system that secures data provided by the non-avionics or open world domain. This document is based on an architecture with two FMS flight management systems, one validating non-critical data from the open world, while the other continues to conduct the flight. This system requires the operation of two FMS flight management systems in parallel, which is costly in terms of resources and financially.
[0012] The traditional approach of optimizing the trajectory in critical certified avionics generates increasingly heavy costs, which are not economically viable.
[0013] Furthermore, none of the methods proposed to connect the flight management system FMS to the open world allows to calculate the trajectory and the predictions in less critical systems (avionics system less critical than a traditional FMS or non-avionics system also called open world system), which limits the performance of the optimization algorithms used.
[0014] An aim of the invention is to respond to the problems previously cited, and in particular to increase the precision of aircraft flight optimization calculations in a field where operational performance requirements require increasingly complex algorithms based on more and more data, while controlling development costs which are significant for the production of certified on-board systems.
[0015] According to one aspect of the invention, there is provided an aircraft flight management system comprising: - a first critical avionics module for trajectory calculation, i.e. with an integrity level and availability level imposed by the regulatory standards in force, comprising at least one critical avionics computer and / or at least one critical avionics software for calculating and outputting a secure trajectory, based on a flight plan; - a second trajectory calculation module, less critical than the first critical module, i.e. with a lower integrity level and availability level than those of the first module, comprising at least one computer less critical than a computer of the first module, and / or at least one software less critical than software of the first module, with higher performance than those of the avionics computers and software of the first critical avionics trajectory calculation module, to calculate and output an improved trajectory less secure than that delivered by the first critical avionics module, from a flight plan; - a critical avionics trajectory verification module, configured to confirm or deny the safety of the improved trajectory delivered by the second trajectory calculation module; and - a critical decision avionics module, configured to select a trajectory from among the secure trajectory delivered by the first critical avionics module and the less secure trajectory delivered by the second module, so as to select the less secure improved trajectory if its security is confirmed by the critical verification avionics module, to select the secure trajectory if the security of the less secure improved trajectory is invalidated by the critical verification avionics module, and to output the selected trajectory.
[0016] Also, by second trajectory calculation module, less critical than the first critical avionics module, is meant, with reference to the first critical avionics module, an avionics module less critical than the first critical module or a non-avionics or open world module.
[0017] In one embodiment, the decision critical avionics module is configured to transmit the selected trajectory to a guidance and display device.
[0018]
[0019]
[0020]
[0021]
[0022] According to one embodiment, the second trajectory calculation module comprises at least one remotely connected calculator, for example integrated into a ground calculation server. In one embodiment, the second trajectory calculation module comprises at least one artificial intelligence software. According to one embodiment, the critical avionics trajectory verification module is configured to confirm or deny the safety of the less secure improved trajectory based on checks: - compliance with the aircraft flight plan by the less secure improved trajectory; and / or - continuity of the improved less secure trajectory; and / or - compliance with aircraft performance through the improved trajectory less secure; and / or - obstacle avoidance by the less secure improved trajectory; and / or - proximity of the start of the less secure improved trajectory to the current position of the aircraft. In one embodiment, the critical trajectory verification avionics module is configured to verify the proximity of the start of the less secure improved trajectory to the current position of the aircraft from the respective deviations of parameter values including position, heading and speed, for the start of the less secure improved trajectory and the current position of the aircraft, compared to a respective threshold. There is also provided, according to another aspect of the invention, an aircraft equipped with a flight management system as previously described. There is also provided, according to another aspect of the invention, a method for managing the flight of an aircraft comprising the steps of: - calculate a secure trajectory by a first critical avionics trajectory calculation module, i.e. with an integrity level and availability level imposed by the regulatory standards in force; - calculate a less secure improved trajectory by a second trajectory calculation module, less critical than the first critical module, i.e. with a lower integrity level and availability level than those of the first module; - confirm or deny the safety of the improved less secure trajectory; and - select a trajectory from the secure trajectory delivered by the first critical avionics module and the less secure trajectory delivered by the second module, so as to select the less improved trajectory secure if its safety is confirmed by the critical avionics verification module, to select the secure trajectory if the safety of the less secure improved trajectory is invalidated by the critical avionics verification module, and to output the selected trajectory.
[0023] The invention will be better understood by studying some embodiments described as non-limiting examples and illustrated by the appended drawing in which [Fig. 1] schematically illustrates a flight management system of an aircraft, according to one aspect of the invention.
[0024] [Fig.l] schematically illustrates a system, according to one aspect of the invention.
[0025] The present invention uses the concept of simplex architecture.
[0026] The simplex architecture consists of executing two modules performing the same function in parallel: a simple module characterized by its robustness and high level of security and a complex module characterized by its performance (hence the name "simplex", a contraction of simple and complex).
[0027] The flight management system 1 of an aircraft comprises: - a first critical avionics module 2 for trajectory calculation, i.e. with an integrity level and availability level imposed by the regulatory standards in force, comprising at least one critical avionics computer and / or at least one critical avionics software for calculating and outputting a secure trajectory, based on a flight plan 3; - a second trajectory calculation module 4, less critical than the first critical module 2, i.e. with a lower integrity level and availability level than those of the first module 2, comprising at least one computer less critical than a computer of the first module 2, and / or at least one software less critical than software of the first module 2, with higher performance than those of the avionics computers and software of the first critical avionics module 2 for trajectory calculation, to calculate and output an improved trajectory less secure than that delivered by the first critical avionics module 2, from a flight plan; - a critical avionics module 5 for trajectory verification, configured to confirm or deny the safety of the improved trajectory delivered by the second trajectory calculation module 4; and - a critical avionics decision module 6, configured to select a trajectory from among the secure trajectory delivered by the first critical avionics module 2 and the less secure trajectory delivered by the second module 4, so as to select the less secure improved trajectory if its security is confirmed by the critical avionics verification module 5, to select the secure trajectory if the security of the improved trajectory
[0028]
[0029]
[0030]
[0031]
[0032]
[0033]
[0034] less secure is invalidated by the critical avionics module 5 of verification, and to output the selected trajectory. The first critical avionics module 2 for trajectory calculation implements trajectory calculation with the objectives of respecting flight plan constraints and keeping the algorithms simple. This module does not necessarily offer an optimized solution. It must be simple, integrated and stable over time. The second trajectory calculation module 4 implements an optimized trajectory calculation, with fine use of the aircraft's performance and taking into account all constraints, regulatory or not (for example the energy footprint of the flight). The calculation of the necessary fuel can be more precise, this allowing for example to inform precisely whether a flight is possible or not. All these calculations can implement complex algorithms. The second trajectory calculation module 4 is not intended to be secure, which allows: - to use algorithms whose security would be complex (for example artificial intelligence algorithms), - to run on powerful computers (possibly data centers outside the aircraft), and - to have up-to-date and accurate data (for example, weather and air traffic predictions). The second module 4 for calculating improved, less secure trajectory, called High Performance, is therefore oriented towards optimization. The decision critical avionics module 6 is configured to transmit the selected trajectory to a guidance and display device 7. The second, less critical trajectory calculation module 4 may comprise at least one remotely connected computer, for example integrated into a ground calculation server. The second trajectory calculation module 4 may include at least one artificial intelligence software. The critical avionics module 5 trajectory verification is configured to confirm or deny the safety of the improved less secure trajectory from checks: - compliance with the aircraft flight plan by the less secure improved trajectory; and / or - continuity of the improved less secure trajectory; and / or - compliance with aircraft performance through the improved trajectory less secure; and / or - obstacle avoidance by the less secure improved trajectory; and / or - proximity to the start of the less secure improved trajectory with the current position of the aircraft.
[0035] The critical avionics trajectory verification module 5 is configured to verify the proximity of the start of the less secure improved trajectory with the current position of the aircraft from the respective deviations of parameter values including the position, the heading and the speed, for the start of the less secure improved trajectory and the current position of the aircraft, by comparison with a respective threshold.
[0036] The critical avionics module 5 for trajectory verification is a strategic component of this architecture. It validates or invalidates less critical calculations, making it possible for the trajectory to be used by the critical avionics world. Several checks are performed on the trajectory: - Compliance with the flight plan: the trajectory must respect the stages defined by the flight plan (legs and constraints). The flight plan representing the contract with ATM, it is important that the trajectory remains within the envelope of the corridor defined by the flight plan while respecting the required navigation precision (Required Navigation Performance, RNP) on each section; and / or - Continuity: the trajectory must be defined at every point and the segments that define it must be contiguous; and / or - Compliance with aircraft performance: the trajectory must be able to be flown by the aircraft taking into account its performance. This concerns, among other things, turn radii, climb rates and speeds; and / or - Obstacle avoidance: the trajectory must not conflict with the terrain and / or elements of the physical environment; and / or - Proximity of the start of the improved trajectory less secure with the current position of the aircraft.
[0037] The critical avionics decision module 6 is configured to select a trajectory from among the secure trajectory and the less secure improved trajectory, so as to select the less secure improved trajectory if its security is confirmed by the critical avionics verification module 5, to select the secure trajectory if the security of the less secure improved trajectory is invalidated by the critical avionics verification module (5), and to output the selected trajectory.
[0038] An aircraft may be provided with a flight management system as described.
[0039] There is also provided a method for managing the flight of an aircraft comprising the steps of: - calculate a secure trajectory by a first critical avionics module 2 for trajectory calculation, i.e. with an integrity level and availability level imposed by the regulatory standards in force; - calculate an improved trajectory less secure by a second module 4 trajectory calculation, less critical than the first critical module 2, i.e. integrity level and availability level lower than those of the first module 2; - confirm or deny the safety of the improved less secure trajectory; and - selecting a trajectory from the secure trajectory delivered by the first critical avionics module 2 and the less secure trajectory delivered by the second module 4, so as to select the less secure improved trajectory if its security is confirmed by the critical avionics verification module 5, to select the secure trajectory if the security of the less secure improved trajectory is invalidated by the critical avionics verification module 5, and to output the selected trajectory.
[0040] The present invention has the following advantages: - Reducing the complexity of critical avionics software: critical avionics modules ("High Assurance" calculation, trajectory verification and decision module) perform simple calculations, as opposed to less critical modules (avionics or non-avionics) ("High Performance" calculation), which concentrate all the algorithmic optimization complexity. Reducing the complexity of critical avionics algorithms reduces the number of requirements, lines of code and therefore tests. - Reducing hardware requirements: Reducing the CPU footprint of critical avionics algorithms, and therefore the real-time architecture of the software, reduces the power required by critical avionics computers, and therefore reduces costs by using older and / or lighter hardware. For less critical calculations, a standard or COTS computer (Commercial Off The Shelf) can be used, which allows for better SWaP (Size, Weight and Power). - Adapting to future needs: the FMS developments mainly focus on improving trajectory optimization and taking into account an increasing number of constraints. Moving these efforts into the open world makes developments much easier and allows for rapid adaptation to future needs. - Compatibility with new technologies: the "High Performance" chain of the Simplex architecture offers the possibility of using techniques that are very difficult to certify, such as Artificial Intelligence. - Avionics module stability: functional variability can be carried by the critical avionics "High Performance" chain. Avionics algorithms critics of the "Haute Assurance" channel are not impacted by new needs.
Claims
1. Claims Flight management system (1) of an aircraft comprising: - a first critical avionics module (2) for trajectory calculation, i.e. integrity level and availability level imposed by the regulatory standards in force, comprising at least one critical avionics computer and / or at least one critical avionics software for calculating and outputting a secure trajectory, from a flight plan (3); - a second trajectory calculation module (4), less critical than the first critical module (2), i.e. with a lower integrity level and availability level than those of the first module (2), comprising at least one computer less critical than a computer of the first module (2), and / or at least one software less critical than software of the first module (2), with higher performance than those of the avionics computers and software of the first critical avionics module (2) for calculating the trajectory, for calculating and outputting an improved trajectory that is less secure than that delivered by the first critical avionics module (2), based on a flight plan; - a critical avionics module (5) for trajectory verification, configured to confirm or deny the safety of the less secure improved trajectory delivered by the second module (4); and - a critical avionics decision module (6), configured to select a trajectory from the secure trajectory delivered by the first critical avionics module (2) and the less secure trajectory delivered by the second module (4), so as to select the less secure improved trajectory if its security is confirmed by the critical avionics verification module (5), to select the secure trajectory if the security of the less secure improved trajectory is invalidated by the critical avionics verification module (5), and to output the selected trajectory; the critical avionics module (5) for trajectory verification being configured to confirm or deny the safety of the less secure improved trajectory based on checks: - compliance with the aircraft flight plan by the less secure improved trajectory; and / or - continuity of the less secure improved trajectory; and / or - compliance with aircraft performance by the less secure improved trajectory; and / or - obstacle avoidance by the less secure improved trajectory; and / or proximity of the start of the less secure improved trajectory to the current position of the aircraft.
2. The system of claim 1, wherein the decision critical avionics module (6) is configured to transmit the selected trajectory to a guidance and display device (7).
3. System according to one of the preceding claims, in which the second trajectory calculation module (4) comprises at least one remotely connected calculator, for example integrated into a ground calculation server.
4. System according to one of the preceding claims, in which the second trajectory calculation module (4) comprises at least one artificial intelligence software.
5. System according to one of the preceding claims, in which the critical avionics module (5) for trajectory verification is configured to verify the proximity of the start of the less secure improved trajectory with the current position of the aircraft from the respective deviations of parameter values comprising the position, the heading and the speed, for the start of the less secure improved trajectory and the current position of the aircraft, by comparison with a respective threshold.
6. Aircraft provided with a flight management system according to one of the preceding claims.
7. Method for managing the flight of an aircraft comprising the steps of: - calculating a secure trajectory by a first critical avionics module (2) for calculating the trajectory, i.e. level integrity and availability level imposed by current regulatory standards; - calculate a less secure improved trajectory by a second trajectory calculation module (4), less critical than the first critical module (2), i.e. with a lower integrity level and availability level than those of the first module (2); - confirm or deny the safety of the improved less secure trajectory; and - selecting a trajectory from the secure trajectory delivered by the first critical avionics module (2) and the less secure trajectory delivered by the second module (4), so as to select the less secure improved trajectory if its security is confirmed by the critical avionics verification module (5), to select the secure trajectory if the security of the less secure improved trajectory is invalidated by the critical avionics verification module (5), and to output the selected trajectory; the step of confirming or denying the safety of the less secure improved trajectory being carried out from checks: - compliance with the aircraft flight plan by the less secure improved trajectory; and / or - continuity of the improved less secure trajectory; and / or - compliance with aircraft performance by the less secure improved trajectory; and / or - obstacle avoidance by the less secure improved trajectory; and / or - a proximity of the start of the improved trajectory less secure with the current position of the aircraft.