Control device and redundant control incorporating said control device, protected against common mode failures

Abstract

An interconnection device (1) comprising at least two transmission paths (2a, 2b), each equipped with a processing means (3a, 3b), each comprising two inputs and two outputs, and designed to perform two distinct functions or one function according to two distinct definitions, the interconnection device (1) also being equipped with an input multiplexer (9) and an output multiplexer (10) connected respectively to the input and output of the processing means (3a, 3b), the interconnection device (1) also being equipped with a configuration means (8) capable of configuring the multiplexers (9, 10) so that at least one input signal is transmitted to an input of one of the processing means (3a, 3b) and at least one output signal is transmitted from an output of one of the processing means (3a, 3b), the configuration means (8) also being capable of selecting one of the functions or one of the function definitions of the two processing means (3a,3b).Figure for the abbreviation: Fig 2.

Description

Title of the invention: Control device and redundant control integrating said control device, protected against common-mode failures. Technical field

[0001] The invention has as its technical field the redundant control of actuators by human-machine interfaces and more particularly of such controls with a so-called COM-MON structure. Previous techniques

[0002] Modern vehicles include an increasing number of electrical controls linking human-machine interfaces to actuators.

[0003] In the case of aircraft, such controls are generally grouped under the "fly-by-wire" concept, developed since the 1960s. An actuator, such as an electro-hydraulic cylinder or an LPV actuator, is then controlled by an electrical link from a human-machine interface, such as a button or control stick. The actuators are thus controlled electrically instead of mechanically, as was sometimes the case previously.

[0004] In a vehicle, particularly in an aircraft, a failure of the controls of the most critical actuators can lead to a loss of control of the vehicle.

[0005] In order to limit the susceptibility of these commands to failures, redundancy is generally used. The commands coming from the human-machine interface are then duplicated so that a failure in one part of the command transmission is compensated by a corresponding redundant part.

[0006] However, such a redundant control system can also be subject to a failure affecting both redundant parts simultaneously, known as a common-mode failure. This is generally the case when a component experiences a failure related to its design or implementation. All components sharing the same operating conditions or the same implementation then experience a failure when the required conditions are met. In the case of a redundant control system, the failure can then simultaneously affect both redundant parts comprising the same component, interrupting the transmission of the control signal. The greater the number of structures or components shared between redundant parts, the greater the risk of a common-mode failure.

[0007] The state-of-the-art response to this problem is to design redundant controls with a different structure while maintaining operation identical. This reduces the number of components in common and the risk of common-mode failure.

[0008] Such a response has the effect of significantly increasing costs due to a non-redundant cost NRC (English acronym for "non-redundant cost") multiplied by two and a non-optimized redundant cost RC (English acronym for "redundant cost").

[0009] Certain electronic actuator controls require a structure called COM-MON, comprising a control channel called COM channel and a monitoring channel called MON channel.

[0010] When redundancy is required for such a COM-MON structured control, each COM channel and each MON channel is generally duplicated. As a result, the redundant COM channels and the redundant MON channels are vulnerable to common-mode failures similar to those that can affect a conventional redundant control.

[0011] Here again, the state-of-the-art solution to this problem is to propose different structures for redundant COM channels and different structures for redundant MON channels. Furthermore, the COM and MON channels must not have any similarities. This results in four different structures for a simply redundant COM-MON command.

[0012] It thus appears that the development and production costs increase drastically.

[0013] There is a need for a redundant control system to limit costs compared to the state of the art, while offering at least the same level of protection.

[0014] From the prior art, document FR3049075 describes a COM-MON type control system that allows a single electronic board reference to include both COM and MON functions. However, such a control system implies that either the MON or COM portion is unused on each electronic board. The cost of this system is therefore high.

[0015] This document does not address the technical problem identified above. Description of the invention

[0016] The invention relates to an interconnection device comprising at least two transmission paths, each equipped with a first processing means and a second processing means, each processing means comprising two inputs and two outputs, each processing means being designed to perform two distinct functions or one function according to two distinct definitions, each distinct function among two functions or each distinct definition of a function of one of said processing means being associated with a separate input and output of said processing means, two definitions of the same function corresponding to two different component arrangements or two different executable software instruction arrangements allowing the same function to be obtained, the interconnection device also being provided with an input multiplexer and an output multiplexer connected respectively at the input and output of the processing means, the interconnection device also being provided with a configuration means capable of configuring the multiplexers so that at least one input signal is transmitted to an input of one of the processing means and at least one output signal is transmitted from an output of one of the processing means, the configuration means also being capable of selecting one of the functions or one of the function definitions of the two processing means.

[0017] The configuration means may be of the pin-programmable type, each pin arrangement being associated with a function or function definition of each processing means, an input multiplexer configuration and an output multiplexer configuration.

[0018] Pin programming can activate or deactivate parts of the control process or control processes executed by the processing means.

[0019] Pin programming can activate or deactivate different control processes or load different control processes executed by the processing means.

[0020] A function can be a COM control function or a MON monitoring function.

[0021] The invention also relates to a redundant control system of an actuator by a human-machine interface, comprising a first interconnection device and a second interconnection device each as described above, in which the first processing means of the first interconnection device and the first processing means of the second interconnection device are designed to perform the same distinct functions or the same distinct definitions of the same function, the second processing means of the first interconnection device and the second processing means of the second interconnection device are designed to perform the same distinct functions or the same distinct definitions of the same function, at least one processing means of the first interconnection device and at least one processing means of the second interconnection device operate redundantly.

[0022] At least one processing means of the first interconnection device and at least one processing means of the second interconnection device can be configured to perform the same function according to two different definitions.

[0023] The invention also relates to an aircraft comprising an interface and an actuator, including at least one redundant control system as described above, processing the interface signals in order to transmit them to the actuator. Brief description of the drawings

[0024] Other objects, features and advantages of the invention will become apparent from the following description, given solely by way of non-limiting example and made with reference to the accompanying drawings in which:

[0025] - Figure [Fig. 1] illustrates a two-way control device software configured,

[0026] - Figure [Fig.2] illustrates a two-way control device hardware configured

[0027] - Figure [Fig.3] illustrates one embodiment of a control system COM-MON type redundant control system comprising two interconnection devices,

[0028] - Figure [Fig. 4] illustrates a COM-type redundant control system only, comprising two interconnection devices, and

[0029] - Figure [Fig. 5] illustrates another embodiment of a control system COM-MON type redundant comprising two interconnection devices. Detailed description

[0030] The interconnection device according to the invention makes it possible to transmit redundant control signals between a human-machine interface and an actuator of a vehicle, in particular of an aircraft.

[0031] An interconnection device comprises at least two processing means that receive input signals and output signals and can be configured redundantly while reducing the risk of common-mode failure. Each processing means can exchange data with at least one other processing means of the interconnection device. This can be the case, in particular, when a first processing means is linked to the COM control function while a second processing means is linked to the MON monitoring function. Data can then be exchanged between the two processing means so that the second processing means, which is linked to the MON monitoring function, can assess the health status of the first processing means, which is linked to the COM control function.

[0032] Generally, each processing means is configured to generate a COM control signal or a MON monitoring signal based on signals received as input and / or exchanged with the other processing means. For example, in the context of a flight control application, the input signals may be position commands for a wing such as an aileron, while the output signals generated by a processing means may be power signals to control an aircraft engine.

[0033] Input and output multiplexing of at least one processing means is carried out by a dedicated multiplexing means, internal or external to the interconnection device and connected respectively to the inputs and outputs of the processing means.

[0034] A transmission channel is defined as having at least two inputs, for receiving signals originating in particular from a human-machine interface, and at least two outputs, for, in particular, supplying signals to one or more actuators. A transmission channel also includes at least one processing means, an input multiplexer, and an output multiplexer. The signals may be electrical signals, in particular COM-type control signals or MON-type monitoring signals.

[0035] An interconnection device thus comprises at least two transmission channels and a pin configuration means designed to configure each transmission channel as either a COM channel or a MON channel. Such a configuration implies a change in the operation of both the multiplexers and the processing means.

[0036] Depending on the end user's needs, the processing means can be configured in software or hardware.

[0037] Software configuration:

[0038] In a first embodiment, the processing means is at least one execution core of a processor comprising at least two instruction execution cores. In other words, a multi-core processor can be shared between several transmission channels such that at least one of its execution cores executes the instructions associated with the processing means of each transmission channel.

[0039] Each transmission channel is configured as a COM channel or as a MON channel, independently of each other, by changing the instructions executed by the channel processing means.

[0040] In each processing channel, the process executed by the processing means then comprises sub-parts associated with COM operation or sub-parts associated with MON operation. The processing means is then connected to the COM input and output or to the MON input and output via a multiplexer so that the appropriate data passes through the processing means.

[0041] Hardware configuration:

[0042] In a second embodiment, the processing means is a hardware device, such as an electronic control board. Each processing means comprises an arrangement of discrete components associated with COM operation, and an arrangement of discrete components associated with MON operation. Each transmission channel is configured as a COM channel or a MON channel, independently of each other, by changing the arrangement of discrete components of the processing means through which the transmitted data passes. This can be achieved, for example, by means of multiplexers internal to the processing means.

[0043] Regardless of the software or hardware embodiment, within each COM / MON configuration, software or hardware, the processing means can be configured according to a definition from a first definition A or a second definition B. A specific arrangement of instructions or components is then provided for the first definition A and a specific arrangement of instructions or components for the second definition B.

[0044] The first definition A and the second definition B thus make it possible to obtain the same COM control or MON monitoring operation of the processing means, and, by extension, of the control channel comprising the processing means, with different arrangements of discrete components or instructions. The use of different definitions of the same function makes it possible to limit common-mode failures.

[0045] In the case of a software definition of a processing means, pin programming activates or deactivates parts of the control process executed by the processing means. Alternatively, pin programming activates or deactivates different control processes. It can also be provided that pin programming loads different control processes.

[0046] In the case of a hardware definition of a processing means, pin programming modifies the transmission of signals within the processing means between specific arrangements of discrete components.

[0047] Regardless of the hardware or software definition of the processing means, pin programming also modifies the configuration of the input and output multiplexers.

[0048] Figure [Fig. 1] illustrates an interconnection device, referenced 1, connecting a human-machine interface 11 to an actuator 12 via an input multiplexer 9 and an output multiplexer 10 and comprising two transmission channels 2a, 2b. Each transmission channel 2a, 2b comprises a processing means 3a, 3b connected to two COM input connections, referenced 4a, 4b, with two connections MON inputs referenced 5a,5b, two COM output connections referenced 6a,6b and two MON output connections referenced 7a,7b.

[0049] Each processing means 3a,3b thus comprises two inputs and two outputs. It will be understood that one input and one output are dedicated to COM-type control signals, while the other input and output are dedicated to MON-type monitoring signals.

[0050] In accordance with the above description of an interconnection device, the processing means 3a, 3b are defined either in software or in hardware. The interconnection device 1 comprises a pin configuration means 8 connected to the first processing means 3a by connection 8a, to the second processing means 3b by connection 8b, to the input multiplexer 9 by connection 8c, and to the output multiplexer 10 by connection 8d. Specific activation of the pins of the configuration means 8 allows selection of an operating mode for the interconnection device 1, resulting in the transmission of a control signal to each processing means 3a, 3b of the interconnection device, thus controlling COM control or MON monitoring operation, and, as appropriate, according to a predefined first definition A or second definition B.

[0051] In addition to enabling or disabling the COM or MON operation of each processing means 3a, 3b, selecting an operating mode of the interconnect device 1 via the pin configuration means 8 also results in a modification of the routing scheme of each multiplexer so that COM signals are correctly directed to or from a COM input of a processing means configured for COM signal processing. Similarly, the pin configuration means 8 modifies the routing scheme of each multiplexer so that MON signals are correctly directed to or from a MON input of a processing means configured for MON signal processing.

[0052] More specifically, the input multiplexer 9 can be controlled to transmit COM control signals from interface 11 to the first processing means 3a via input connection 4a or to the second processing means 3b via input connection 4b. The same applies to MON monitoring signals, which can be transmitted to the first processing means 3a via input connection 5a or to the second processing means 3b via input connection 5b.

[0053] The same applies to the output multiplexer 10 and the output connections 6a,6b,7a,7b connecting the processing means 3a,3b to the output multiplexer 10.

[0054] In the embodiment illustrated by figure [Fig.1], the multiplexing of the COM and MON channels is carried out outside the interconnection device 1 by the input multiplexer 9 and the output multiplexer 10.

[0055] The input multiplexer 9 and the output multiplexer 10 are configured according to the control signal emitted by the configuration means 8 by pins so that a predefined scheme of transmitting the input signals of each multiplexer 9,10 is applied.

[0056] Depending on the pin programming performed through the configuration means 8, different configurations can be obtained, depending on application needs and the redundancy and dissimilarity requirement related to a required failure rate. For example: a COM-MON configuration with a processing means 3a configured as COM and a processing means 3b configured as MON, or a COM-COM configuration with a processing means 3a configured as COM and a processing means 3b also configured as COM, or a MON-MON configuration with a processing means 3a configured as MON and a processing means 3b also configured as MON, or a MON-COM configuration with a processing means 3a configured as MON and a processing means 3b configured as COM.

[0057] It is also understood that the inputs and outputs of the processing means 3a,3b are kept active so that their activity depends only on the transmission of data through the multiplexers 9,10. Similarly, the data carried by these inputs and outputs are taken into account only according to the configuration of the processing means 3a,3b.

[0058] Figure [Fig.2] illustrates an interconnection device 1 similar to that illustrated in Figure [Fig.1]. It differs only in the integration of the input multiplexer 9 and the output multiplexer 10 into the interconnection device 1.

[0059] Figures [Fig.3] to [Fig.5] illustrate some architectures of redundant control systems implemented with such interconnection devices.

[0060] Figure [Fig. 3] illustrates a redundant COM-MON type control system comprising two interconnecting devices la,lb, each connected at its input to an interface 11 of the vehicle, for example a human-machine interface, in particular a control stick or a switch. The interconnecting devices la,lb are connected at their output to an actuator 12 of the vehicle.

[0061] A first interconnection device comprises a first processing means 3a and a second processing means 3b.

[0062] The first processing means 3a is designed to exhibit COM-type operation and MON-type operation, both according to a first definition A. The first processing means 3a switches from one operation to the other depending on the signal received from the configuration means 8.

[0063] Similarly, the second processing means 3b is designed to exhibit COM-type operation and MON-type operation, both according to a second definition B. The second processing means 3b switches from one operation to the other depending on the signal received from the configuration means 8.

[0064] COM-type or MON-type operation, according to a first definition A or a second definition B of the first processing means 3a and the second processing means 3b, can be obtained as a result of a software configuration (choice of an arrangement among different arrangements of software instructions) or a hardware configuration (choice of an arrangement among different arrangements of discrete components).

[0065] The first interconnection device also includes a pin-programmable configuration means 8 and multiplexers 9,10 arranged respectively at the input and output of the processing means 3a,3b.

[0066] The first processing means 3a is connected - as input so as to receive COM-type signals from interface 11 via input multiplexer 9 and a first input connection 20a and - output to actuator 12 so as to transmit COM type signals via output multiplexer 10 and a first output connection 21a.

[0067] The second processing means 3b is connected - as input so as to receive MON type signals from interface 11 via input multiplexer 9 and a second input connection 20b and - output to actuator 12 so as to transmit MON type signals via output multiplexer 10 and a second output connection 21b.

[0068] The configuration means 8 controls the input multiplexer 9 so that COM-type signals from interface 11 are directed to the first processing means 3a associated with COM-type operation via a connection 4a while MON-type signals from interface 11 are directed to the second processing means 3b associated with MON-type operation via a connection 5b.

[0069] The configuration means 8 controls the output multiplexer 10 so that the signals from the first processing means 3a associated with COM type operation via a connection 6a and the MON type signals from the second processing means 3b via a connection 7b associated with MON type operation are directed to the actuator 12.

[0070] It is noted that the input multiplexer 9 is connected to the second processing means 3b via a connection 4b and to the first processing means via a connection 5a. However, due to the chosen configuration, these connections 4b, 5a are not in communication with interface 11.

[0071] The same applies to the output multiplexer 10 for which the connection 7a to the first processing means 3a and the connection 6b to the second processing means 3b are not put into communication with the actuator 12.

[0072] The second interconnection device 1b comprises a first processing means 3a and a second processing means 3b.

[0073] The first processing means 3a is designed to exhibit COM-type operation and MON-type operation according to a first definition A. The first processing means 3a switches from one operation to the other depending on the signal received from the configuration means 8.

[0074] The second processing means 3b is designed to exhibit COM-type operation and MON-type operation according to a second definition B. The second processing means 3b switches from one operation to the other depending on the signal received from the configuration means 8.

[0075] It should be noted that the first processing means 3a is designed similarly in each of the two interconnection devices la,lb. Likewise, the second processing means 3b is also designed similarly in each of the two interconnection devices la,lb. This similar design has the effect of lowering production costs, while protecting against failures through redundancy and against common-mode failures through dissimilarity, as will be explained later.

[0076] COM-type or MON-type operation, according to a first definition A or a second definition B of the first processing means 3a and the second processing means 3b, can be obtained as a result of a software configuration (choice of an arrangement among different arrangements of software instructions) or a hardware configuration (choice of an arrangement among different arrangements of discrete components).

[0077] The second interconnection device 1b includes a pin-programmable configuration means 8 and multiplexers 9,10 arranged respectively at the input and output of the processing means 3a,3b.

[0078] The first processing means 3a is connected: - as input so as to receive MON type signals from interface 11 via input multiplexer 9 and a fourth input connection 20d and - at the output, to the actuator 12 so as to transmit the MON type signals via the output multiplexer 10 and a fourth output connection 21d.

[0079] The second processing means 3b is connected:

[0080] - as an input so as to receive COM-type signals from interface 11, of the input multiplexer 9 and a third input connection 20c and

[0081] - output to actuator 12 so as to transmit COM-type signals from output multiplexer 10 and a third output connection 21c.

[0082] The configuration means 8 controls the input multiplexer 9 so that COM-type signals from interface 11 are directed to the second processing means 3b associated with COM-type operation, while MON-type signals from interface 11 are directed to the first processing means 3a associated with MON-type operation. Thus, the configuration means 8 controls the input multiplexer 9 so that COM-type signals from interface 11 are directed to the second processing means 3b associated with COM-type operation via a connection 5a, while MON-type signals from interface 11 are directed to the first processing means 3a associated with MON-type operation via a connection 4b.

[0083] The configuration means 8 controls the output multiplexer 10 so that COM type signals from the second processing means 3b associated with COM type operation and MON type signals from the first processing means 3a associated with MON type operation are directed to the actuator 12. Thus, the configuration means 8 controls the output multiplexer 10 so that signals from the second processing means 3a associated with COM type operation via a connection 7a and MON type signals from the first processing means 3a via a connection 6b associated with MON type operation are directed to the actuator 12.

[0084] Similar to the first interconnection device 1a, it is noted here that the input multiplexer 9 is connected to the second processing means 3b via a connection 5b and to the first processing means via a connection 4a. However, due to the chosen configuration, these connections 4a, 5b are not in communication with the interface 11.

[0085] The same applies to the output multiplexer 10 for which the connection 6a to the first processing means 3a and the connection 7b to the second processing means 3b are not put into communication with the actuator 12.

[0086] In the example illustrated by Figure [Fig. 3], the first processing means 3a of the first interconnection device la is configured in type operation COM according to a first definition A, the second processing means 3b of the first interconnection device is configured in MON type operation according to a second definition B, the first processing means 3a of the second interconnection device 1b is configured in MON type operation according to a first definition A, the second processing means 3b of the second interconnection device 1b is configured in COM type operation according to a second definition B.

[0087] The control system is thus of the redundant COM-MON type, and this configuration is protected against common-mode failures due to the induced dissimilarity. Indeed, each of the COM-type processing means has a different definition from the other (first definition A, second definition B), while each of the MON-type processing means also has a different definition from the other (first definition A, second definition B).

[0088] This protection against common-mode failures is achieved at the cost of a non-redundant NRC, which remains high due to the need to develop two definitions for each COM processing means and for each MON processing means. However, the cost of the redundant control system is lower than the cost of the prior art control system because the first interconnection device 1a and the second interconnection device 1b have the same structure. In other words, the interconnection device 1a and the interconnection device 1b comprise the same components and / or the same software. The pin configuration allows the interconnection device 1a and the interconnection device 1b to be configured in different ways.

[0089] Figure [Fig. 4] illustrates a redundant COM-COM type control system, comprising two interconnection devices la,lb, each connected at its input to an interface 11 of the vehicle, for example a human-machine interface, in particular a control stick or a switch. The interconnection devices la,lb are connected at their output to an actuator 12 of the vehicle.

[0090] The first interconnection device comprises a first processing means 3a and a second processing means 3b.

[0091] The first processing means 3a is designed to exhibit COM-type operation and MON-type operation according to a first definition A. The first processing means 3a switches from one operation to the other depending on the signal received from the configuration means 8.

[0092] The second processing means 3b is designed to exhibit COM-type operation and MON-type operation according to a second definition B. The second processing means 3b switches from one operation to the other depending on the signal received from the configuration means 8.

[0093] COM-type or MON-type operation, according to a first definition A or a second definition B of the first processing means 3a and the second processing means 3b, can be obtained as a result of software instantiation (different arrangements of software instructions) or hardware instantiation (different arrangements of discrete components).

[0094] The first interconnection device also includes a pin-programmable configuration means 8 and multiplexers 9, 10 arranged respectively at the input and output of the first interconnection device.

[0095] The configuration means 8 controls the input multiplexer 9 so that COM-type signals from interface 11 are directed to the first processing means 3a associated with COM-type operation via the first incoming connection 20a and connection 4a. It should be noted that interface 11 does not transmit a MON-type signal to the first interconnection device 1a in this embodiment. This results in a second incoming connection 20b of the input multiplexer 9 that is not connected to interface 11.

[0096] The configuration means 8 also controls the output multiplexer 10 so that signals from the first processing means 3a associated with COM-type operation are directed to the actuator 12 via a first output connection 21a and connection 4a. Here again, no MON-type signal is emitted by the first interconnection device 1a. This results in a second output connection 21b of the output multiplexer 10 that is not connected to the actuator 12.

[0097] The second interconnection device 1b comprises a first processing means 3a and a second processing means 3b.

[0098] As with the first interconnection device 1a, a third incoming connection 20c links interface 11 to the input multiplexer 9 of the second interconnection device 1b. It should be noted that interface 11 does not transmit a MON-type signal to the second interconnection device 1b in this embodiment. This results in a second incoming connection 20d of the input multiplexer 9 that is not connected to interface 11.

[0099] Here again, no MON type signal is emitted by the second interconnection device 1b. This results in a second outgoing connection 21d of the output multiplexer 10 which is not connected to the actuator 12.

[0100] Only a third outgoing connection 21c links the output multiplexer 10 of the second interconnecting device 1b to the actuator 12.

[0101] The first processing means 3a is designed to exhibit COM-type operation and MON-type operation according to a first definition A. The second processing means 3b is designed to exhibit operation of type COM and a type MON operation according to a second definition B. The first processing means 3a and the second processing means 3b switch from one operation to the other depending on the signal received from the configuration means 8.

[0102] COM-type or MON-type operation, according to a first definition A or a second definition B of the first processing means 3a and the second processing means 3b, can be obtained as a result of software instantiation (different arrangements of software instructions) or hardware instantiation (different arrangements of discrete components).

[0103] It is noted that the first processing means 3a of the two interconnection devices la,lb are designed similarly. Likewise, the second processing means 3b of the two interconnection devices la,lb are also designed similarly. This similar design has the effect of lowering production costs, while protecting against failures through redundancy and common-mode failures through dissimilarity, as will be explained later.

[0104] The first processing means 3a is connected: - as an input so as to receive COM-type signals from interface 11 via input multiplexer 9 and a first input connection 20a, and - output to actuator 12 so as to transmit COM type signals via output multiplexer 10 and a first output connection 21a.

[0105] The second processing means 3b is not connected to interface 11 or to actuator 12.

[0106] The second interconnection device 1b includes a pin-programmable configuration means 8 and multiplexers 9,10 arranged respectively at the input and output of the second interconnection device 1b.

[0107] The configuration means 8 controls the multiplexers 9,10 so that the COM-type signals from interface 11 are directed to the second processing means 3b associated with COM-type operation.

[0108] The configuration means 8 controls the output multiplexer 10 so that the signals from the second processing means 3b associated with COM-type operation are directed to the actuator 12.

[0109] The first processing means 3a is not connected to interface 11 or to actuator 12.

[0110] The second processing means 3b is connected: - as input so as to receive COM-type signals from interface 11 via input multiplexer 9 and a third input connection 20c and - output to actuator 12 so as to transmit COM type signals via output multiplexer 10 and a third output connection 21c.

[0111] In the example illustrated by figure [Fig.4], the first processing means 3a of the first interconnection device la is configured in COM type operation according to a first definition A, the second processing means 3b of the second interconnection device 1b is configured in COM type operation according to a second definition B.

[0112] It should be noted that the configuration of the interconnection devices la,lb is similar to that illustrated in Figure [Fig.3]. However, here, although the interconnection devices la,lb are defined to process COM and MON type signals, only COM type signals are emitted by interface 11 and transmitted to actuator 12. Therefore, in this example, only the COM type channels of these interconnection devices la,lb are active.

[0113] In this embodiment implementing redundancy of the two COM-type channels and protection against common-mode failures due to the dissimilarity of the COM-type processing means through a different definition from each other (first definition A, second definition B).

[0114] This protection is achieved at the cost of a consistently high NRC due to the need to develop two definitions for each COM processing means and for each MON processing means. However, the cost of the redundant control system is lower than the cost of the prior art control system because the first interconnection device 1a and the second interconnection device 1b have the same structure. Furthermore, the redundant control system benefits from protection against common-mode failures, which is absent in the prior art solution.

[0115] Figure [Fig.5] illustrates another example of an embodiment of a COM-MON type redundant control system. The control system here also comprises two interconnection devices la,lb each connected at the input to an interface 11 of the vehicle, for example a human-machine interface, in particular a control stick or a switch and at the output to an actuator 12 of the vehicle.

[0116] In the configuration proposed here, a first interconnection device la includes a first processing means 3a designed to exhibit COM-type operation.

[0117] The first processing means 3a is connected: - as an input so as to receive COM-type signals from interface 11 via an input multiplexer 9 and a first input connection 20a and - output to actuator 12 so as to transmit COM type signals via an output multiplexer 10 and a first output connection 21a.

[0118] The first interconnection device includes a second processing means 3b designed to exhibit MON-type operation.

[0119] The second processing means 3b is connected: - as input so as to receive MON type signals from interface 11 via an input multiplexer 9 and a second input connection 20b and - output to actuator 12 so as to transmit MON type signals via an output multiplexer 10 and a second output connection 21b.

[0120] The second processing means 3b is designed to exhibit MON-type operation according to a first definition A and MON-type operation, but according to a second definition B.

[0121] MON-type operation, according to a first definition A or a second definition B of the second processing means 3b, can be obtained as a result of software instantiation (different arrangements of software instructions) or hardware instantiation (different arrangements of discrete components).

[0122] The first interconnection device la comprises a pin-programmable configuration means 8 and multiplexers 9,10 arranged respectively at the input and output of each first interconnection device la.

[0123] The first processing means 3a is connected: - as input so as to receive COM-type signals from interface 11 via input multiplexer 9 and a first input connection 20a and - output to actuator 12 so as to transmit COM type signals via output multiplexer 10 and a first output connection 21a.

[0124] The second processing means 3b is connected: - as input so as to receive MON type signals from interface 11 via input multiplexer 9 and a second input connection 20b and - output to actuator 12 so as to transmit MON type signals via output multiplexer 10 and a second output connection 21b.

[0125] The configuration means 8 controls the input multiplexer 9a so that MON-type signals from interface 11 are directed to the second means of treatment 3b associated with a MON type operation according to a first definition A.

[0126] The configuration means 8 controls the output multiplexer 10a so that the signals from the second processing means 3b associated with MON-type operation according to a first definition A are directed to the actuator 12.

[0127] Pin programming of configuration means 8 allows selection of operation of the second processing means 3b of type MON according to a first definition A or a second definition B.

[0128] Pin programming also allows the multiplexers 9,10 to be configured to transmit the input signal and to retrieve the output signal from the second processing means 3b associated with MON-type operation.

[0129] A second interconnection device 1b includes a first processing means 3a designed to exhibit COM-type operation.

[0130] The first processing means 3a is connected: - as input so as to receive COM-type signals from interface 11 via an input multiplexer 9 and a third input connection 20c and - output to actuator 12 so as to transmit COM type signals via an output multiplexer 10 and a third output connection 21c.

[0131] The second interconnection device 1b also includes a second processing means 3b designed to exhibit MON-type operation.

[0132] The second processing means 3b is connected: - as input so as to receive MON type signals from interface 11 via an input multiplexer 9 and a fourth input connection 20d and - output to actuator 12 so as to transmit MON type signals via an output multiplexer 10 and a fourth output connection 21d.

[0133] The second processing means 3b is designed to exhibit MON-type operation according to the first definition A or according to a second definition B. The second processing means 3b switches from one operation to the other depending on the signal received from the configuration means 8.

[0134] MON-type operation, according to a first definition A or a second definition B of the second processing means 3b, can be obtained as a result of software instantiation (different arrangements of software instructions) or hardware instantiation (different arrangements of discrete components).

[0135] The second interconnection device 1b includes a pin-programmable configuration means 8 and multiplexers 9,10 arranged respectively at the input and output of each second interconnection device 1b.

[0136] The configuration means 8 controls the input multiplexer 9 so that the MON-type signals from interface 11 are directed to the second processing means 3b associated with MON-type operation.

[0137] The configuration means 8 controls the output multiplexer 10 so that the signals from the second processing means 3b associated with MON-type operation are directed to the actuator 12.

[0138] It is noted that the first processing means 3a of the two interconnection devices la,lb are designed similarly. Likewise, the second processing means 3b of the two interconnection devices la,lb are also designed similarly. This similar design has the effect of lowering production costs, while protecting against failures through redundancy and common-mode failures through dissimilarity, as will be explained later.

[0139] In the example illustrated by the figure [Fig.5], the first processing means 3a of the first interconnection device la is configured in COM type operation, the second processing means 3b of the first interconnection device la is configured in MON type operation according to a first definition A, the first processing means 3a of the second interconnection device 1b is configured in COM type operation, the second processing means 3b of the second interconnection device 1b is configured in MON type operation according to a second definition B.

[0140] As in the other control systems described above, the first interconnection device 1a and the second interconnection device 1b are structurally and functionally identical. They differ only in the choice of the first definition A or the second definition B associated with the MON-type operation controlled by pin programming.

[0141] Unlike the control system illustrated in Figure [Fig. 3], the multiplexers 9a, 10a described herein process only MON type signals. COM type signals are transmitted directly to the first processing means 3a.

[0142] The control system in this embodiment is protected by redundancy due to the presence of two COM type channels and two MON type channels, and against common mode failures due to the fact that each of the MON type processing means has a definition (first definition A for one and second definition B for the other) different from each other.

[0143] This protection is achieved at the cost of a consistently high NRC cost due to the need to develop two different MON structures for each MON processing means.

[0144] The cost of the redundant control system is lower than the cost of the prior art control system because the first interconnection device 1a and the second interconnection device 1b have the same structure. Furthermore, the redundant control system benefits from common-mode fault protection for the MON channel, which is absent in the prior art solution.

Claims

Demands

1. An interconnection device (l,la,lb) comprising at least two transmission paths (2a,2b), each equipped with a first processing means (3a) and a second processing means (3b), each processing means (3a,3b) comprising two inputs and two outputs, each processing means (3a,3b) being designed to perform two distinct functions or one function according to two distinct definitions, each distinct function among two functions or each distinct definition of a function of one of said processing means (3a,3b) being associated with a distinct input and output of said processing means (3a,3b), two definitions of the same function corresponding to two different component arrangements or two different arrangements of executable software instructions for obtaining the same function, the interconnection device (l,la,lb) also being equipped with an input multiplexer (9) and an output multiplexer (10) connected respectively to the input and output of the processing means (3a,3b), the interconnection device (l,la,lb) also being equipped with a configuration means (8) capable of configuring the multiplexers (9,10) so that at least one input signal is transmitted to an input of one of the processing means (3a,3b) and at least one output signal is transmitted from an output of one of the processing means (3a,3b), the configuration means (8) also being capable of selecting one of the functions or one of the function definitions of the two processing means (3a,3b).

2. Interconnection device (l,la,lb) according to claim 1, wherein the configuration means (8) is of the pin-programmable type, each pin arrangement being associated with a function or function definition of each processing means (3a,3b), with an input multiplexer configuration (9) and with an output multiplexer configuration (10).

3. Interconnection device (l,la,lb) according to claim 2, wherein pin programming activates or deactivates parts of the control process or control processes executed by the processing means.

4. Interconnection device (l,la,lb) according to claim 2, wherein pin programming activates or deactivates processes of different commands or load of different command processes executed by the processing means.

5. Interconnection device (l,la,lb) according to any one of claims 1 to 4, wherein a function is a COM control function or a MON monitoring function.

6. A redundant control system for an actuator (12) via a human-machine interface (11), comprising a first interconnection device (1a) and a second interconnection device (1b), each according to any one of claims 1 to 5, wherein the first processing means (3a) of the first interconnection device (1a) and the first processing means (3a) of the second interconnection device (1b) are designed to perform the same distinct functions or the same distinct definitions of the same function, the second processing means (3b) of the first interconnection device (1a) and the second processing means (3b) of the second interconnection device (1b) are designed to perform the same distinct functions or the same distinct definitions of the same function, at least one processing means (3a, 3b) of the first interconnection device (1a) and at least one processing means (3a,3b) of the second interconnection device (1b) operate redundantly.

7. Redundant control system of an actuator (12) by a human-machine interface (11), according to claim 6, wherein at least one processing means (3a,3b) of the first interconnection device (la) and at least one processing means (3a,3b) of the second interconnection device (1b) are configured to perform the same function according to two different definitions.

8. Aircraft comprising an interface (11) and an actuator (12), characterized in that it comprises at least one redundant control system according to claim 6 or 7, processing the signals from the interface (11) in order to transmit them to the actuator (12).

Images