Fly-by-wire flight control system for aircraft

Abstract

The present invention relates to an electric flight control system (5) for controlling an aircraft (1).The flight control system (5) comprises a plurality of functional subsets (95), each having at least one dissimilar primary computer (35) and at least one dissimilar secondary computer (36), at least one functional subset (95) being a simplex / duplex subset (96) comprising at least three identical simplex primary computers (41, 42, 43) and at least one duplex secondary computer (44, 45), each duplex secondary computer (44, 45) of a simplex / duplex subset (96) comprising an independent and synchronized control computing channel (46) and a monitoring computing channel (47), each simplex primary computer (41, 42, 43) of a simplex / duplex subset (96) having a single computing channel, and in that, barring failure, the three primary computers (41, 42, 43) of a subset simplex / duplex (96) form two virtual pseudo-duplex computers. Abbreviation figure: figure 1.

Description

Title of the invention: Electric flight control system for aircraft

[0001] The present invention relates to an electric flight control system for an aircraft.

[0002] An aircraft may include movable aerodynamic control surfaces steered by an electric flight control system to direct the aircraft. Such aerodynamic control surfaces may include rotor blades, propeller blades, elevators or rudders, for example.

[0003] An electric flight control system may include several flight control input subsets. Each flight control input subset may be integrated within a pilot-operable control element, such as a control stick, to encode a command following the operation of the control element. Furthermore, the flight control system includes a processing subset that determines a positional command to be achieved by one or more aerodynamic control surfaces based on at least one command encoded by a flight control input subset and the aircraft's current situational state. Such a positional command may be a blade pitch angle, a flap deflection angle, or a rotor or propeller rotational speed, for example.Finally, the flight control system includes at least one actuation subset controlling an actuator acting on one or more aerodynamic control surfaces according to a positional command determined by the processing subset.

[0004] Early fly-by-wire aircraft included a fly-by-wire system arranged in parallel with a backup mechanical fly-by-wire system to allow for manual landing in the event of a failure of the fly-by-wire system. While effective, such an architecture can have the disadvantage of being heavy and bulky.

[0005] Alternatively, an aircraft may include a high-security electrical flight control system so as not to require mechanical redundancy.

[0006] Certification regulations require for such a flight control system a failure occurrence rate less than or equal to 10 flight hours, which leads to a failure occurrence rate less than or equal to 10 10 / flight hour for each subset.

[0007] Therefore, current solutions for electric flight control systems use subsets with synchronous duplex architectures. Each subset It includes several duplex computers. The term "duplex computer" refers, here and thereafter, to a computer with two independent processing channels whose execution is synchronized, unlike a simplex computer which has only one processing channel. The term "processing channel" refers to a digital and / or analog processing unit that performs calculations on quantities represented digitally and / or analogically. The processing unit can perform digital processing with a processor or other types of integrated circuits, including logic circuits. The processing unit can perform analog processing with analog components, whether integrated or not within integrated circuits, such as operational amplifiers.The term processor can refer to a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a microcontroller, etc. For example, a duplex computer may have two processing channels, each with its own processor, while a simplex computer has a single processing channel, for example, with one processor.

[0008] A synchronous duplex computer includes a computing channel, hereafter referred to as the "control computing channel", used to generate the desired output, and a computing channel, hereafter referred to as the "monitoring computing channel", responsible for monitoring the operation of the parallel control computing channel and for invalidating it if a fault is detected.

[0009] Document US2006 / 100750 presents an electric flight control system of this type.

[0010] Document EP3008533 describes a triple redundancy duplex computer architecture for each of the subsets. Furthermore, this architecture includes secure unidirectional links between the subsets.

[0011] Such an architecture having subsets comprising synchronous duplex computers can prove to be cumbersome.

[0012] Furthermore, equipment within the sub-assemblies of an aircraft's fly-by-wire flight control system may be included in a reference equipment list known in English as the "Master Minimum Equipment List (MMEL)." This list defines the equipment that may be inoperative for flight, the conditions to be met to allow flight in accordance with the objectives of the certification authorities, and the number of flight days or hours authorized from the discovery of the failure. This additional condition introduces further constraints and, in particular, requires that the failure occurrence rate for the flight control system be less than or equal to a value between 10⁷ and 10⁸ per flight hour with a reference piece of equipment in failure, i.e., a failure occurrence rate at the level of the Subsets with a failure rate less than or equal to a value between 10⁸ and 10⁹ per flight hour with a reference equipment failure are considered. It should be noted that equipment with a failure probability below an acceptable threshold, typically 10⁵ per flight hour, is not considered. In other words, it is accepted that the failure of equipment with a failure rate below the acceptable threshold will result in the aircraft being grounded.

[0013] Consequently, each sub-assembly must therefore have a failure occurrence rate of 10 10 / flight hour under normal conditions and where applicable of 108 to 10 flight hours under MMEL conditions, namely if the flight is authorized for a certain number of flight hours in the event of failure of a reference equipment of the sub-assembly.

[0014] The present invention then aims to provide an innovative electric flight control system.

[0015] The invention thus relates to an electric flight control system for controlling an aircraft, the flight control system comprising a plurality of functional subsets, the plurality of functional subsets comprising a processing subset determining at least one positional setpoint to be reached by at least one aerodynamic control surface as a function of at least one command, the plurality of functional subsets comprising at least one actuation subset configured to generate as a function of said positional setpoint at least one actuation setpoint which is transmitted to at least one actuator.

[0016] Each functional subset comprises at least one dissimilar primary computer and at least one dissimilar secondary computer, at least one functional subset being a simplex / duplex subset comprising at least three identical simplex primary computers and at least one duplex secondary computer, each duplex secondary computer of a simplex / duplex subset comprising an independent and synchronized control computing channel and a monitoring computing channel, each simplex primary computer of a simplex / duplex subset having a single computing channel, and in that, except in the event of failure, the three primary computers of a simplex / duplex subset form two virtual pseudo-duplex computers.

[0017] The terms "primary" and "secondary" in the expressions "primary computer" and "secondary computer" are used to distinguish the two dissimilar types of computers. The expressions "primary computer" and "secondary computer" can be replaced respectively by "computer of a first type" and "computer of a second type".

[0018] For example, an aerodynamic control surface can take the form of a rotor blade, a positional command being a pitch angle or a rotational speed of the rotor. According to another example, an aerodynamic control surface can take the form of a flap, such as a rudder or elevator flap, a positional command being a deflection angle of the flap relative to a reference.

[0019] The term "each" associated with a component is used whether there is one component or several components in order to avoid unnecessarily complicating the description. Thus, the expression "each duplex secondary computer of a simplex / duplex subset comprising an independent and synchronized control computing channel and a monitoring computing channel" means that the duplex secondary computer(s) of a simplex / duplex subset each comprise an independent and synchronized control computing channel and a monitoring computing channel.

[0020] The expression "virtual pseudo-duplex computer" indicates that a simplex computer in a simplex / duplex subset performs, in particular, the function of a control computing channel for a conventional duplex computer, and that another computer in this simplex / duplex subset performs, in particular, the function of a monitoring computing channel for a conventional duplex computer. Thus, one computer in this simplex / duplex subset generates the desired output, and another computer determines whether this output is correct or not.

[0021] Therefore, each simplex / duplex subset comprises at least four computers. Each computer in such a subset typically has a failure occurrence rate less than or equal to 10⁴ / flight hour, which induces a failure occurrence rate less than or equal to 10¹⁰ / flight hour under normal conditions for this subset.

[0022] In addition, each functional subset includes so-called "primary" computers and one or more so-called "secondary" computers which contribute to obtaining the desired failure occurrence rates by taking into consideration the probability of occurrence of a common mode failure.

[0023] Dissimilarities are dissimilarities of a “physical” type, for example through the use of different component suppliers, different printed circuit board manufacturers, or others, and of a “software” type, for example through different instruction sets, different algorithms, different programming languages, or others.

[0024] To improve dissimilarities, the links with the other subsets respectively of the primary and secondary computer(s) of a subset can travel on different routes within the aircraft to avoid common failure modes.

[0025] Compared to the prior art, the invention thus offers, for each simplex / duplex subset, an additional level of technological dissimilarity with the implementation of simplex and duplex computers. Such a simplex / duplex subset can also meet the constraints related to MMEL conditions as explained below.

[0026] Thus, each simplex / duplex subset can exhibit a failure rate of less than 1010 per flight hour, while also offering an optimized level of dissimilarity, and even optimized cost and / or size. Such a simplex / duplex subset can then optimize the cost, volume, and / or mass of the system, particularly due to the use of simplex computers.

[0027] The electric flight control system may also include one or more of the following features, taken alone or in combination.

[0028] According to one possibility, the at least three primary computers of a simplex / duplex subset can form two virtual pseudo-duplex computers by being configured as follows: a first primary computer is configured to generate a first order, a second primary computer is configured to generate a second order and monitor the first primary computer in a non-synchronized manner with the first primary computer, a third primary computer is configured to monitor the first primary computer and the second primary computer in a non-synchronized manner.

[0029] The three primary computers of a simplex / duplex subset then comprise a single computing channel, but such a computing channel can be configured to perform a control function and / or at least a monitoring function depending on the current situation. Thus, if a simplex / duplex subset forms the processing subset, the first and second orders each take the form of a positional command for the same aerodynamic control surface. Finally, the third primary computer then applies instructions to verify the operation of the first primary computer asynchronously and the second primary computer asynchronously. Thus, the first and second primary computers together form a virtual duplex computer, and the second and third primary computers together form another virtual duplex computer.

[0030] Through cross-monitoring, which is common and not described because it is part of the knowledge of a person skilled in the art, the primary computers of a simplex / duplex subset form two virtual pseudo-duplex computers that are possibly low cost, with an optimized mass, and / or an optimized footprint.

[0031] Optionally, in the event of a failure of a primary computer of a simplex / duplex sub-assembly, the two operating primary computers of that sub- Simplex / duplex sets can automatically reconfigure themselves to generate first order and second order respectively, and each monitor the other primary computer.

[0032] To improve the fault tolerance of a primary computer in a simplex / duplex subset, particularly before takeoff, a dynamic reconfiguration can be implemented to always obtain two computers, each monitored by another computer.

[0033] According to a possibility compatible with the preceding ones, the simplex / duplex subset may comprise three identical simplex primary computers and two identical duplex secondary computers.

[0034] Such a simplex / duplex subset makes it possible to meet the safety level constraints in MMEL conditions with a primary or secondary computer failing before takeoff.

[0035] If the simplex / duplex subset does not have to meet the MMEL conditions, by choice of the manufacturer, then it is possible to arrange a single secondary computer.

[0036] According to a possibility compatible with the preceding ones, the processing subset may include a simplex / duplex subset, at least two primary computers and each secondary computer of the processing subset generating, except in the case of failure, said positional setpoint.

[0037] Simplex and duplex computers of the processing subset are then each responsible for determining a positional setpoint, for the same aerodynamic control surface as a function of the command received.

[0038] According to a possibility compatible with the preceding ones, the primary and secondary computers of each actuation subset can communicate with each other and be configured to determine a positional setpoint to be applied from among the positional setpoints transmitted by the processing subset according to a memorized selection logic.

[0039] This selection logic is implemented in a known manner by the computers of the actuation subset based on a validity state of the computers of the processing subset. These validity states are transmitted by the computers of the processing subset, as well as, for example, by conventional data consolidation / verification processes. By default, only the positional setpoint issued by a predetermined computer is used. If this computer is deemed faulty, only the positional setpoint issued by another predetermined computer is used, and so on until only one selectable computer remains, at which point no further selection changes are made. Optionally, the actuation subset first requests input from the primary computers one after the other. in a pre-established order, then the secondary computers in a pre-established order, or vice versa.

[0040] The selection logic can be consolidated in a conventional manner between the computers of the actuation subset to harmonize the issued actuation instructions, each actuator being controlled by all the computers of the associated actuation subset. To achieve this, the computers of the actuation subset are configured to exchange data with each other, through unidirectional or bidirectional inter-computer exchange links that can be of various technologies, directions, numbers, or interconnections.

[0041] According to a possibility compatible with the preceding ones, the flight control system may comprise a plurality of actuators, said plurality of functional subsets comprising an actuation subset per actuator.

[0042] Thus, the processing subset can be configured to establish sets of positional setpoints transmitted to respective actuation subsets, each actuation subset driving a dedicated actuator.

[0043] Alternatively, at least one processing subset can be configured to establish sets of positional setpoints transmitted to several actuation subsets.

[0044] According to a possibility compatible with the preceding ones, said plurality of functional subsets may include at least one subset for acquiring a pilot command to acquire said command from a maneuver of an associated piloting element maneuverable by a pilot.

[0045] For example, said control command acquisition subset is integrated into the associated control unit.

[0046] For example, a helicopter includes a collective pitch control stick incorporating its own flight control input subset and a cyclic pitch control stick incorporating its own flight control input subset. The two flight control input subsets communicate with the processing subset, this processing subset issuing, based on the received commands, sets of positional instructions transmitted to actuation subsets.

[0047] Alternatively or in addition, said flight control system may include an antenna configured to receive said command and transmit it to the processing subset, and / or said flight control system may include an autopilot device configured to generate said command and transmit it to the processing subset.

[0048] According to a possibility compatible with the preceding ones, each computer of the control command acquisition subset can be connected by at least a first control link to each primary computer of the processing subset, each computer of the control command acquisition subset being connected by at least a second control link to each control calculation channel and to each monitoring calculation channel of each secondary computer of the processing subset, each first control link being dis similar to each second control link.

[0049] The links between the computers of the acquisition subset of a possible control command and the primary computers of the processing subset are dissimilar to the links between the computers of the acquisition subset of a control command and the secondary computers of the processing subset in order to improve the dissimilarity.

[0050] For example, each first control link is a unidirectional link and each second control link is a bidirectional link. According to another example, each first control link is a bidirectional link and each second control link is a unidirectional link.

[0051] For example, unidirectional links may be of the type called TIA / EIA-485 unidirectional, TIA / EIA-422 or ARINC 429, and bidirectional links may be buses for example of the type called CAN, MIL-STD-1553, TIA / EIA-485 bidirectional, AFDX, Time-Triggered Ethernet, FlexRay or LIN.

[0052] According to another example, each first control link is a bidirectional link and each second control link is a bidirectional link dissimilar to each first control link.

[0053] According to a possibility compatible with the preceding ones, the acquisition subset of a pilot control command may comprise:

[0054] - or, according to a first variant, two identical primary simplex computers as well as two identical and dissimilar simplex secondary computers of the two simplex primary computers, the two primary computers and the two secondary computers of the control command acquisition subset each acquiring said command, the two primary computers and the two secondary computers of the control command acquisition subset each having a single calculation channel,

[0055] - or, according to a second variant, a simplex / duplex subset, at least two primary computers and each secondary computer of the acquisition subset of a control command acquiring said command except in case of failure,

[0056] - or, according to a third variant, two identical duplex primary computers as well as two identical and dissimilar duplex secondary computers, the two duplex primary computers and the two secondary duplex computers of the control command acquisition subset, each acquiring said command and each having an independent control calculation channel and an independent monitoring calculation channel,

[0057] - or, according to a fourth variant, a duplex primary computer and a computer dissimilar duplex secondary, the duplex primary computer and the duplex secondary computer of the control command acquisition subset each acquiring said command and each having an independent command calculation channel and an independent monitoring calculation channel.

[0058] Each computer in the control command acquisition subset is configured to acquire control information from a control device, such as a joystick, and to transmit it via data exchange links to all computers in the processing subset. The data is provided to the single processing channel of each simplex computer and to each processing channel of the duplex computer(s), if applicable, to enable the implementation of standard monitoring mechanisms for received commands.

[0059] According to the first embodiment of the flight control acquisition subset, the use of four dissimilar simplex computers in pairs offers an increased level of dissimilarity, which makes it possible to meet the safety requirements under MMEL conditions with a primary or secondary computer failing before takeoff. This first embodiment of the flight control acquisition subset can lead to a significant reduction in the cost / size / mass of the system with fewer electronic components and connections.

[0060] The second embodiment of the acquisition subset of a pilot control is also interesting.

[0061] The third embodiment of the flight control acquisition subassembly comprises four duplex computers, which makes it possible to meet the safety requirements under MMEL conditions with a primary or secondary computer failing before takeoff. The command processing channel of each computer is monitored by its monitoring processing channel, which can invalidate it, for example, in the usual way by inhibiting the communication flow with the computer deemed faulty. This embodiment provides enhanced fault detection.

[0062] The fourth variant is optimized for an aircraft not required to meet the safety level constraints in MMEL conditions with a computer failure before takeoff.

[0063] According to a possibility consistent with the preceding ones, the actuation subset may comprise: - either, according to a first variant, a simplex / duplex subset, at least two primary computers and each secondary computer of the actuation subset generating, except in case of failure, an actuation command, - or, according to a second variant, two identical duplex primary computers and two identical and dissimilar duplex secondary computers of the two primary computers, the two duplex primary computers and the two duplex secondary computers of the actuation subset each generating an actuation command and each having an independent control calculation channel and an independent monitoring calculation channel, - or, according to a third variant, a dissimilar primary duplex computer and secondary duplex computer, the primary duplex computer and the secondary duplex computer of the actuation subset each generating an actuation command and each having an independent control calculation channel and an independent monitoring calculation channel.

[0064] The computers of each actuation sub-assembly are configured so that the actuator(s) act on the aerodynamic control surfaces, according to the positional commands issued by the processing sub-assembly. All variants offer a higher level of technological dissimilarity.

[0065] The first embodiment of the actuation sub-assembly provides an additional technological dissimilarity with the asynchronous duplex operation induced by the simplex / duplex sub-assembly, and makes it possible to meet the safety level constraints in MMEL conditions with a primary or secondary computer failing before takeoff.

[0066] The second embodiment of the actuation sub-assembly is optimized in terms of size, and makes it possible to meet the safety level constraints in MMEL conditions with a primary or secondary computer failing before takeoff.

[0067] The third variant is optimized for an aircraft not required to meet the safety level constraints in MMEL conditions with a computer that has failed before takeoff.

[0068] According to a possibility compatible with the preceding ones: i) the processing subset may comprise a simplex / duplex subset having two secondary computers, two primary computers, and each secondary computer of the processing subset generating, except in the case of failure, said positional setpoint; ii) the control command acquisition subset may comprise two identical simplex primary computers and two identical and dissimilar simplex secondary computers of the control command acquisition subset, the two computers primary and the two secondary computers of the control command acquisition subset each generating said command, the two simplex primary computers and the two simplex secondary computers of the control command acquisition subset each having a single calculation channel, iii) the actuation subset may include two identical duplex primary computers and two identical and dissimilar duplex secondary computers of the two primary computers of the actuation subset, the two duplex primary computers and the two duplex secondary computers of the actuation subset each generating an actuation command and each having an independent control calculation channel and an independent monitoring calculation channel.

[0069] For each of the three subsets, dissimilar computers are used. Such a system is optimized in terms of size and / or weight and makes it possible to meet the safety level constraints in MMEL conditions with a primary or secondary computer failing before takeoff.

[0070] According to a possibility compatible with the preceding ones, each primary computer of the processing subset can be connected by a bidirectional primary link to each computer of the actuation subset, each secondary computer of the processing subset can be connected by a bidirectional secondary link to each computer of the actuation subset, each bidirectional primary link being different from each bidirectional secondary link.

[0071] The links between the computers of the processing subset and the actuation subset can be, for example, of the CAN, MIL-STD-1553, TIA / EIA-485 bidirectional, AFDX, Time-Triggered Ethernet, FlexRay or LIN type.

[0072] According to a possibility compatible with the preceding ones, the computers of the processing subset can communicate with each other through a plurality of inter-computer links.

[0073] The computers of the processing subset can be configured in a conventional manner to communicate with each other, through unidirectional or bidirectional inter-computer exchange links which can be of various technologies, directions, numbers or interconnections, in order to consolidate the input information, from the acquisition subset of a piloting command or from sensors used to evaluate the current state of the aircraft.

[0074] Furthermore, an aircraft equipped with at least one movable aerodynamic control surface for steering this aircraft may be equipped with an electric flight control system according to the invention.

[0075] The invention and its advantages will become apparent in more detail in the following description, with illustrative examples given by reference to the accompanying figures, which represent:

[0076] [Fig. 1], a view of a flight control system having a simplex / duplex subset according to the invention,

[0077] [Fig.2], a view illustrating the three simplex computers of a simplex / duplex subset in the event of a failure,

[0078] [Fig. 3], a view illustrating an automatic reconfiguration of the three simplex computers of a simplex / duplex subset in the event of a failure of a first simplex computer,

[0079] [Fig. 4], a view illustrating an automatic reconfiguration of the three simplex computers of a simplex / duplex subset in the event of a failure of a second simplex computer,

[0080] [Fig. 5], a view illustrating an automatic reconfiguration of the three simplex computers of a simplex / duplex subset in the event of a failure of a third simplex computer,

[0081] [Fig.6], a view of the links between the control command acquisition subset and the simplex computers of the processing subset of [Fig.1],

[0082] [Fig.7], a view of the links between the control command acquisition subset and the duplex computers of the processing subset of [Fig.1],

[0083] [Fig.8], a view of the links between the actuation subset and the simplex computers of the processing subset of [Fig.1],

[0084] [Fig.9], a view of the links between the actuation subset and the duplex computers of the processing subset of [Fig.1],

[0085] [Fig. 10], a view of a flight control system having a pilot control acquisition subset equipped with duplex computers,

[0086] [Fig. 11], a view of the links between the flight control acquisition subset and the simplex computers of the processing subset of [Fig. 10],

[0087] [Fig. 12], a view of the links between the flight control acquisition subset and the duplex computers of the processing subset of [Fig. 10],

[0088] [Fig. 13], a view of a flight control system having a flight control acquisition subset having a simplex / duplex subset,

[0089] [Fig. 14], a view of a flight control system having an actuation subset having a simplex / duplex subset,

[0090] the [Fig. 15], a view of the links between the actuation subset and the simplex computers of the processing subset of the [Fig. 14],

[0091] [Fig. 16], a view of the links between the actuation subset and the duplex computers of the processing subset of [Fig. 14], and

[0092] the [Fig. 17], a view of a simplex / duplex subset having a single duplex computer.

[0093] Elements present in several separate figures are assigned one and the same reference.

[0094] Fig. 1 presents an electric flight control system 5 for an aircraft 1.

[0095] This electric flight control system 5 includes control surfaces Aerodynamic control surfaces 10 allow the aircraft 1 to be steered. According to the example in [Fig. 1], the aircraft 1 is a rotorcraft comprising a main rotor with first blades 11 of variable pitch and a yaw control rotor with second blades 12 of variable pitch. According to the example in [Fig. 17] described later, the aircraft 1 can be an unmanned aircraft with several rotors 13, 14 with variable speeds. According to another example, an aerodynamic control surface can take the form of a movable flap, for example.

[0096] Regardless of the nature of the aerodynamic control surfaces 10 and the way in which they are controlled to steer the aircraft 1, the electric flight control system 5 comprises several functional sub-assemblies 95 performing various functions.

[0097] Thus, the electric flight control system 5 may include one or more functional subassemblies 95 of the type flight control input subassembly A for generating a command. Each flight control input subassembly A has the function of acquiring a command emitted from a flight control element 20. A flight control input subassembly A may be integrated into the associated flight control element 20 and may be connected to conventional sensors. The reference numeral "A" designates any of the illustrated flight control input subassemblies, with the reference numerals "A1, A2, A3" designating specific subassemblies if necessary.

[0098] According to the illustrated example, the electric flight control system 5 includes a collective pitch lever 21 for collectively controlling the pitch of the first blades 11 of the main rotor, the lever 21 being equipped with at least one position sensor in communication with a first flight control acquisition subset AL. The lever 21 may also be equipped with at least one button or equivalent in communication with the first flight control acquisition subset AL.

[0099] By sensor we mean here a physical sensor capable of directly measuring the parameter in question but also a system which may include one or more physical sensor(s) as well as signal processing means enabling the provision of an estimate of the parameter from the measurements provided by these physical sensors.

[0100] According to the illustrated example, the electric flight control system 5 includes a cyclic pitch control stick 22 for cyclically controlling the pitch of the first blades 11 of the main rotor, the stick 22 being equipped with at least one position sensor in communication with a second acquisition subset of a pilot control A2. The joystick 22 can also be equipped with at least one button or equivalent in communication with the second acquisition subset of a pilot control A2.

[0101] According to the illustrated example, the electric flight control system 5 includes a rudder pedal 23 for collectively controlling the pitch of the second blades 12, the rudder pedal 23 being equipped with at least one position sensor in communication with a third subset for acquiring a pilot control A3.

[0102] According to one possibility, an antenna 26 or an automatic piloting device 27 can generate a command.

[0103] Independently of this aspect, the electric flight control system 5 includes a functional subset of the type processing subset B. The processing subset B has the function of determining at least one positional setpoint to be reached by at least one aerodynamic control surface, as a function of at least one command or at least one situational measurement measured by a situational sensor 25. Such a situational sensor 25 can be one of the following sensors: a speed sensor measuring a rotational speed of the rotor, an airspeed sensor of the aircraft 1, an inertial navigation system, a radiosonde, a radar altimeter, a satellite positioning system of the aircraft 1, or other common sensors.

[0104] Furthermore, the electric flight control system 5 includes at least one functional subset of the actuation subset type C having the function of generating at least one actuation command transmitted to at least one actuator 30 as a function of at least one positional command.

[0105] Each actuation subset C is configured to generate an actuation command transmitted to at least one actuator 30 based on the corresponding positional command. In the presence of several actuators 30, the fly-by-wire flight control system 5 may include one actuation subset per actuator 30. In another example, the fly-by-wire flight control system 5 may include, in particular, an actuation subset controlling one actuator 30, for example, to control the pitch of the blades of a tail rotor, and an actuation subset controlling several actuators 30, for example, to control the pitch of the blades of a helicopter's main rotor. The reference numeral "C" designates any of the illustrated actuation subsets, with the reference numerals "C1, C2, C3" designating specific subsets if necessary.Similarly, the reference "30" designates any of the illustrated actuators, while the references "31, 32, 33, 34" designate specific actuators if needed.

[0106] According to the illustrated example, the pitch of the first blades 11 can be controlled by three actuators 31, 32, 33 controlled by three actuation sub-assemblies Cl, C2, C3 respectively. In addition, the pitch of the second blades 12 can be controlled by an actuator 34 controlled by its own actuation sub-assembly C4.

[0107] Regardless of the number of actuation subsets C and the presence or absence of control command acquisition subsets A, each functional subset comprises a plurality of computers. The computers of the same functional subset can be arranged within the same equipment.

[0108] More specifically, each functional subset comprises at least one computer referred to as "primary computer 35" and at least one computer referred to as "secondary computer 36" to be distinguished from a primary computer 35. Within the same functional subset, the primary computer(s) 35 are dissimilar from the secondary computer(s) 36. The reference "35" designates any of the primary computers, and the reference "36" designates any of the secondary computers.

[0109] In addition, at least one of the functional subsets includes a subset referred to as the "simplex / duplex subset 96". Each simplex / duplex subset 96 comprises at least three identical primary simplex computers 41, 42, 43 and at least one secondary duplex computer 44, 45. The secondary duplex computer(s) 44, 45 of a simplex / duplex subset 96 have an independent and synchronized control computing channel 46 and a monitoring computing channel 47. Conversely, each primary simplex computer 41, 42, 43 of a simplex / duplex subset 96 has a single computing channel.

[0110] Generally, reference numeral 46 designates the control processing channel of a duplex computer, and reference numeral 47 designates the monitoring processing channel of the same duplex computer. Similarly, reference numeral 48 designates the single processing channel of a simplex computer.

[0111] In the absence of a failure, the three primary computers 41, 42, 43 of a simplex / duplex subset 96 form two virtual pseudo-duplex computers.

[0112] According to [Fig. 2], a first primary computer 41 is configured to execute COM 1 instructions to generate a first command in a conventional manner, for example, a target collective pitch angle. A second primary computer 42 is also configured to execute COM 2 instructions to generate a second command of the same type as the first command, namely, also a collective pitch angle in this example. In addition, the second primary computer 42 checks in a conventional, asynchronous manner that the first primary computer 41 is functioning normally by executing M0N1-1 instructions. Finally, the third primary computer 43 is configured to monitor the first primary computer 41 by executing MON 1-2 instructions and the second primary computer 42 asynchronously by executing M0N2 instructions. Thus, the first Primary computer 41 and the second primary computer 42, or even the third primary computer 43, together form a first virtual pseudo-duplex computer CAL1. Similarly, the second primary computer 42 and the third primary computer 43 together form a second virtual pseudo-duplex computer CAL2.

[0113] In the event of a failure of a primary computer 41,42,43 of a simplex / duplex subset 96, the two operating primary computers 41,42,43 of this simplex / duplex subset 96 are configured to automatically reconfigure themselves to generate respectively the first order and the second order and each monitor the other primary computer 41,42,43.

[0114] According to [Fig. 3], in the event of a failure detected in the usual manner in the first primary control unit 41 of a simplex / duplex subset 96 by one of the other control units, the second primary control unit 42 executes COM2 instructions to generate the second command and the third primary control unit 43 executes C0M1 instructions to generate the first command. In addition, the second primary control unit 42 executes M0N1 instructions to monitor the third primary control unit 43, and the third primary control unit 43 executes M0N2 instructions to monitor the second primary control unit 42.

[0115] According to [Fig. 4], in the event of a normally detected failure of the second primary control unit 42 of a simplex / duplex subset 96 by one of the other control units, the third primary control unit 43 executes COM2 instructions to generate the second command and the first primary control unit 41 executes C0M1 instructions to generate the first command. Furthermore, the third primary control unit 43 executes M0N1 instructions to monitor the first primary control unit 41, and the first primary control unit 41 executes M0N2 instructions to monitor the third primary control unit 43.

[0116] According to [Fig. 5], in the event of a failure detected in the usual manner in the third primary control unit 43 of a simplex / duplex subset 96 by one of the other control units, the second primary control unit 42 executes COM2 instructions to generate the second command and the first primary control unit 41 executes C0M1 instructions to generate the first command. In addition, the second primary control unit 42 executes M0N1 instructions to monitor the first primary control unit 41, and the first primary control unit 41 executes M0N2 instructions to monitor the second primary control unit 42.

[0117] With reference to [Fig. 1], to meet the required levels under MMEL conditions, a simplex / duplex subset 96 comprises three identical simplex primary computers 41-43 and two identical duplex secondary computers 44-45. References 41-43 hereafter generally designate the simplex primary computers of a simplex / duplex subset 96, and references 44-45 subsequently designate the secondary duplex computers of a simplex / duplex subset 96.

[0118] Furthermore, and as illustrated in [Fig. 1], the processing subset B comprises a simplex / duplex subset equipped with three primary computers 61, 62, 63 and one or two secondary computers 64, 65, two of the primary computers 61, 62, 63 and each secondary computer 64, 65 of the processing subset B each generating, except in the case of failure, a positional setpoint for the same actuator 30.

[0119] The acquisition subset of a control command A may optionally include: - according to the variant of [Fig. 1], two identical primary simplex computers 51, 52 and two identical secondary simplex computers 53, 54, dissimilar to the two primary simplex computers 51, 52, the two primary computers 51, 52 and the two secondary computers 53, 54 of the control command acquisition subset A each acquiring said command, the two primary computers 51, 52 and the two secondary computers 53, 54 of the control command acquisition subset A each having a single calculation channel, or - according to the example of [Fig. 13] described below, a simplex / duplex subset 96, at least two primary computers 81-83 and each secondary computer 84-85 of the acquisition subset of a control command A acquiring, barring failure, said command, or - according to the variant of [Fig. 10] described below, two identical duplex primary computers 55, 56 and two identical and dissimilar duplex secondary computers 57, 58 of the acquisition subset of a control command A, each acquiring said command and each having an independent control calculation channel and an independent monitoring calculation channel, or - a duplex primary computer 55 and a duplex secondary computer 57 similar, the duplex primary computer 55 and the duplex secondary computer 57 of the acquisition subset of a control command A each acquiring said command and each having an independent control calculation channel and an independent monitoring calculation channel.

[0120] According to another aspect, the actuation subset C comprises, optionally: - according to the variant illustrated in [Fig. 14], a simplex / duplex subset 96, at least two primary computers 86-88 and each secondary computer 89-90 of the actuation subset C generating, except in the case of failure, each an actuation setpoint, or - according to the variant illustrated in [Fig.1], two identical duplex primary computers 71, 72 and two identical and dissimilar duplex secondary computers 73, 74 of the two primary computers 71, 72, the two duplex primary computers 71, 72 and the two duplex secondary computers 73, 74 of the actuation subset C each generating an actuation command and each having an independent control calculation channel and a monitoring calculation channel, or - according to the variant illustrated in [Fig.17], a dissimilar duplex primary computer 76 and duplex secondary computer 77, the duplex primary computer 76 and duplex secondary computer 77 of the actuation subset C each generating an actuation command and each having an independent control calculation channel and a monitoring calculation channel.

[0121] Thus, according to the realization of [Fig. 1]:

[0122] i) the processing subset B comprises a simplex / duplex subset 96 having three primary computers 61-63 and two secondary computers 64, 65, at least two of the primary computers 61-63 and each secondary computer 64-65 of the processing subset B each generating, except in the case of failure, said positional setpoint;

[0123] ii) the control command acquisition subset A comprises two identical primary simplex computers 51, 52 and two identical secondary simplex computers 53, 54 which are dissimilar to the two primary computers 51, 52 of the control command acquisition subset A, the two primary computers 51, 52 and the two secondary computers 53, 54 of the control command acquisition subset A each generating said command, the two primary simplex computers 51, 52 and the two secondary simplex computers 53, 54 of the control command acquisition subset A each having a single calculation channel;

[0124] iii) the actuation subset C comprises two identical duplex primary computers 71, 72 and two identical and dissimilar duplex secondary computers 73, 74 of the actuation subset C, the two duplex primary computers 71, 72 and the two duplex secondary computers 73, 74 of the actuation subset C each generating an actuation command and each having an independent control calculation channel and an independent monitoring calculation channel.

[0125] Regardless of the composition of the actuation subset C and the acquisition subset of an optional control command A, the computers of the subset for acquiring a control command A encodes a command and transmits it to each computing channel of the processing subset B.

[0126] To this end, each computer in the control command acquisition subset A is connected by at least one first control link 66 to each primary computer 35 of the processing subset B as illustrated in [Fig. 6], or even by two first control links 66 in the presence of unidirectional links. In particular, at least the primary computers of the processing subset B that need to calculate a setpoint, or even all the primary computers of the processing subset B according to the variant illustrated in [Fig. 6] which allows for reconfiguration, can be connected to two unidirectional links 661, 662 going respectively to the primary and secondary computers of the control command acquisition subset A.Furthermore, each computer in the control command acquisition subset A is connected by at least one second control link 67 to each control computing channel 46 and to each monitoring computing channel 47 of each secondary computer 36 of the processing subset B as illustrated in [Fig. 7], or even by two second control links in the presence of unidirectional links. Each first control link 66 is dissimilar to each second control link 67.

[0127] Each first control link 66 is, according to [Fig. 6], a unidirectional link, and each second control link 67 is, according to [Fig. 7], a bidirectional link. The reverse is also possible. According to another possibility, the first and second control links are bidirectional links of two different types.

[0128] From then on, the computers 61-65 of the processing subset B communicate with each other through a plurality of inter-computer links 79 in order to evaluate the commands received in the usual way.

[0129] In addition, at least two primary computers and the secondary computer(s) of the processing subset B each generate, in a usual way, a positional setpoint based on the commands received, and on the measurement(s) emitted by the situational sensor(s) 25.

[0130] The positional instructions are then transmitted to the computers of the actuation subset C.

[0131] For this purpose, each primary computer of the processing subset B is connected by a bidirectional primary link 68 to each computing channel of each computer of the actuation subset C as illustrated in [Fig.8], or even to each other primary computer of the processing subset B.

[0132] Furthermore, and with reference to [Fig. 9], each channel of a secondary computer in the processing subset B is connected by a bidirectional secondary link 69 to each channel of each computer in the actuation subset C, each link The primary bidirectional link is different from each secondary bidirectional link. The monitoring computing channel of a secondary computer can typically inhibit the transmission of a positional setpoint with its control computing channel if a fault is detected.

[0133] From then on, the computers of each actuation subset C communicate with each other in order to determine a positional instruction to be applied from among the positional instructions transmitted by the processing subset B according to a memorized selection logic.

[0134] Figures 10 to 17 illustrate various variants.

[0135] According to [Fig. 10], a control command acquisition subset A may comprise two dissimilar computers 55, 57 if the system does not have to meet MMEL conditions, or even four dissimilar duplex computers 55-58 in pairs if the system has to meet MMEL conditions, instead of the four simplex computers of [Fig. 1]. According to Figures 11 and 12, each control computing channel of a duplex computer in the control command acquisition subset A communicates via bidirectional links with its monitoring computing channel, with the simplex computers in the processing subset B, and with each control computing channel of each secondary computer in the processing subset B.

[0136] Figure 13 illustrates an acquisition subset of a control unit A comprising a simplex / duplex subset according to the invention. Only two links are shown to avoid cluttering the figure.

[0137] According to [Fig. 14], an actuation subset C may comprise a simplex / duplex subset instead of the subset of [Fig. 1]. According to Figures 15 and 16, each computing channel of the computers in the processing subset B communicates with each computing channel of the computers in the actuation subset C via bidirectional links.

[0138] According to [Fig.17], a simplex / duplex subset may include a single secondary computer. Thus, a simplified architecture may include an acquisition subset of an optional control command A equipped with two primary computers and two secondary computers, a processing subset B having three simplex computers and one duplex computer, and an actuation subset C per actuator 30 comprising two duplex computers.

[0139] Naturally, the present invention is subject to numerous variations in its implementation. Although several embodiments have been described, it is understood that it is not conceivable to exhaustively identify all possible embodiments. It is, of course, conceivable to replace a described means with an equivalent means without departing from the scope of the present invention as defined by the claims.

Claims

1.

2. Demands An electric flight control system (5) for controlling an aircraft (1), the flight control system (5) comprising a plurality of functional subsets (95), the plurality of functional subsets comprising a processing subset (B) determining at least one positional setpoint to be reached by at least one aerodynamic control surface (10) as a function of at least one command, the plurality of functional subsets comprising at least one actuation subset (C) configured to generate, as a function of said positional setpoint, at least one actuation setpoint which is transmitted to at least one actuator (30), characterized in that each functional subset (95) comprises at least one dissimilar primary computer (35) and at least one dissimilar secondary computer (36), at least one functional subset (95) being a simplex / duplex subset (96) comprising at least three simplex primary computers (41, 42,43) identical and at least one duplex secondary computer (44, 45), each duplex secondary computer (44, 45) of a simplex / duplex subset (96) comprising an independent and synchronized control computing channel (46) and a monitoring computing channel (47), each simplex primary computer (41, 42, 43) of a simplex / duplex subset (96) having a single computing channel, and in that, except in the event of a failure, the three primary computers (41, 42, 43) of a simplex / duplex subset (96) form two virtual pseudo-duplex computers. An electric flight control system according to claim 1, characterized in that the at least three primary computers (41, 42, 43) of a simplex / duplex subset (96) form two virtual pseudo-duplex computers by being configured as follows: a first primary computer (41) is configured to generate a first command, a second primary computer (42) is configured to generate a second command and monitor the first primary computer (41) in a non-synchronous manner with the first primary computer (41), a third primary computer (43) is configured to monitor the first computer primary (41) and the second primary computer (42) in a non-synchronized manner.

3. Electric flight control system according to claim 2, characterized in that in the event of failure of a primary computer of a simplex / duplex subset (96), the two operating primary computers of this simplex / duplex subset (96) automatically reconfigure themselves to generate first order and second order respectively and each monitor the other primary computer.

4. Electric flight control system according to any one of claims 1 to 3, characterized in that the simplex / duplex subassembly (96) comprises three identical simplex primary computers (41, 42, 43) and two identical duplex secondary computers (44, 45).

5. Electric flight control system according to any one of claims 1 to 4, characterized in that the processing subset (B) comprises a simplex / duplex subset (96), at least two primary computers (61-63) and each secondary computer (64-65) of the processing subset (B) each generating said positional setpoint except in case of failure.

6. Electric flight control system according to claim 5, characterized in that the primary (35) and secondary (36) computers of each actuation subset (C) communicate with each other and are configured to determine a positional setpoint to be applied from among the positional setpoints transmitted by the processing subset (B) according to a memorized selection logic.

7. Electric flight control system according to any one of claims 1 to 6, characterized in that said flight control system (5) comprises a plurality of actuators (30), said plurality of functional subassemblies (95) comprising an actuation subassembly (C) per actuator (30).

8. An electric flight control system according to any one of claims 1 to 7, characterized in that said plurality of functional subassemblies (95) comprises at least one acquisition subassembly of a piloting command (A) to acquire said command from a maneuver of an associated piloting device (20) maneuverable by a pilot.

9. Electric flight control system according to any one of claims 1 to 8, characterized in that said flight control system (5) comprises an antenna (26) configured to receive said command and transmit it to the processing subset (B), or said flight control system (5) comprises an autopilot device (27) configured to generate said command and transmit it to the processing subset (B).

10. An electric flight control system according to claim 5 and any one of claims 8 or 9 taken in combination with claim 8, characterized in that each computer of the flight control acquisition subset (A) is connected by at least one first control link (66) to each primary computer of the processing subset (B), each computer of the flight control acquisition subset (A) being connected by at least one second control link (67) to each control computing channel and to each monitoring computing channel of each secondary computer of the processing subset (B), each first control link (66) being dissimilar to each second control link (67).

11. An electric flight control system according to any one of claims 1 to 10 taken in combination with claim 8, characterized in that the flight control acquisition subset (A) comprises: - either two identical simplex primary computers (51, 52) and two identical and dissimilar simplex secondary computers (53, 54) of the flight control acquisition subset (A), each acquiring said command, the two primary computers (51, 52) and the two secondary computers (53, 54) of the flight control acquisition subset (A) each having a single computing channel,

12. - either a simplex / duplex subset (96), at least two primary computers (81-83) and each secondary computer (84-85) of the control command acquisition subset (A) acquiring said command except in case of failure, - either two identical duplex primary computers (55, 56) and two identical and dissimilar duplex secondary computers (57, 58) from the two duplex primary computers (55, 56), the two duplex primary computers (55, 56) and the two duplex secondary computers (57, 58) of the control command acquisition subset (A) each acquiring said command and each having an independent control calculation channel and an independent monitoring calculation channel, - either a dissimilar primary duplex computer (55) and secondary duplex computer (57), the primary duplex computer (55) and the secondary duplex computer (57) of the control command acquisition subset (A) each acquiring said command and each having an independent control calculation channel and an independent monitoring calculation channel. An electric flight control system according to any one of claims 1 to 11, characterized in that the actuation subassembly (C) comprises: - either a simplex / duplex subset (96), at least two primary computers (86-88) and each secondary computer (89-90) of the actuation subset (C) generating, except in case of failure, each an actuation command, - either two identical duplex primary computers (71, 72) and two identical and dissimilar duplex secondary computers (73, 74) of the actuation subset (C), each generating an actuation command and each having an independent control calculation channel and a separate monitoring calculation channel, - or one dissimilar duplex primary computer (76) and one dissimilar duplex secondary computer (77), each generating an actuation command and each having an independent control calculation channel and an independent monitoring calculation channel.

13. Electric flight control system according to claim 8, characterized in that: i) the processing subset (B) comprises a simplex / duplex subset (96) having two secondary computers (64, 65), two primary computers (61-63) and each secondary computer (64-65) of the processing subset (B) each generating, except in the case of failure, said positional setpoint; (ii) the control command acquisition subset (A) comprises two identical primary simplex computers (51, 52) and two identical secondary simplex computers (53, 54) that are dissimilar to the two primary computers (51, 52) of the control command acquisition subset (A), the two primary computers (51, 52) and the two secondary computers (53, 54) of the control command acquisition subset (A) each generating said command, the two primary simplex computers (51,52) and the two simplex secondary computers (53, 54) of the control command acquisition subset (A), each having a single calculation channel, iii) the actuation subset (C) comprises two identical duplex primary computers (71, 72) and two identical and dissimilar duplex secondary computers (73, 74) of the actuation subset (C), the two duplex primary computers (71, 72) and the two duplex secondary computers (73, 74) of the actuation subset (C) each generating an actuation command and each having an independent control calculation channel and a separate monitoring calculation channel.

14. An electric flight control system according to any one of claims 1 to 13, characterized in that each primary computer (35) of the processing subset (B) is connected by at least one bidirectional primary link (68) to each computer of the actuation subset (C), each secondary computer (36) of the processing subset (B) is connected by at least one bidirectional secondary link (69) to each computer of the actuation subset (C), each bidirectional primary link (68) being different from each bidirectional secondary link (69).

15. Electric flight control system according to any one of claims 1 to 14, characterized in that the computers of the processing subset (B) communicate with each other through a plurality of intercomputer links (79).

16. Aircraft (1) equipped with at least one movable aerodynamic control surface (10) for steering such aircraft (1), characterized in that said aircraft (1) comprises an electric flight control system (5) according to any one of claims 1 to 15.

Images