Flight control system having an electric actuator to control a hydraulic servo.

Abstract

The present invention relates to an electric flight control system (10) comprising an actuation subset (C), having three external duplex computers (21, 24, 27) for controlling an electric actuator (40). The electric actuator (40) has three stators (42, 43, 44) electrically connected to three respective toggle devices (50). The toggle devices (50) are electrically connected to the same internal simplex computer (80) of the electric actuator (40). Each toggle device (50) is connected to one of the respective external duplex computers (21, 24, 27). Each toggle device (50) is configured to connect to the associated stator (42, 43, 44) either the internal simplex computer (80) or the respective external duplex computer (21, 24, 27). The internal simplex computer (80) is self-monitoring and communicates with the three external duplex computers (21, 24, 27). (Shorthand figure: Figure 1)

Description

Title of the invention: Flight control system having an electric actuator to control a hydraulic servo control.

[0001] The present invention relates to a flight control system having an electric actuator for controlling a hydraulic servo control.

[0002] An aircraft may include movable aerodynamic control surfaces steered by an electric flight control system to direct the aircraft. Such aerodynamic control surfaces may include rotor blades, propeller blades, elevators or rudders, for example.

[0003] An electric flight control system may include several flight control input subsets. Each flight control input subset may be integrated within a pilot-operable control element, such as a control stick, to encode a command following the operation of the control element. Furthermore, the flight control system includes a processing subset that determines a positional setpoint to be achieved in order to position one or more aerodynamic control surfaces as required, based on at least one command encoded by a flight control input subset and the aircraft's current situational state. Such a positional setpoint may be a blade pitch angle, a flap deflection angle, or a rotor or propeller rotational speed, for example.Finally, the flight control system includes at least one actuation subset controlling an actuator acting on one or more aerodynamic control surfaces according to a positional command determined by the processing subset.

[0004] Certification regulations require for such a flight control system a failure occurrence rate less than or equal to 10 flight hours, which leads to a failure occurrence rate less than or equal to 10 10 / flight hour for each subset.

[0005] Furthermore, equipment within sub-assemblies of an aircraft's fly-by-wire flight control system may be included in a reference equipment list known in English as the "Master Minimum Equipment List (MMEL)." This list defines the equipment that may be inoperative for flight, the conditions to be met to allow flight in accordance with the objectives of the certification authorities, and the number of flight days or hours authorized from the discovery of the failure. This additional condition introduces further constraints and leads to Specifically, the failure rate for the flight control system is defined as a failure rate of less than or equal to between 10⁷ and 10⁸ per flight hour with a reference equipment failure, or a failure rate at the sub-assembly level of less than or equal to between 10⁸ and 10⁹ per flight hour with a reference equipment failure. It should be noted that equipment with a failure probability below an acceptable threshold, typically 10⁵ per flight hour, is not considered. In other words, it is accepted that the failure of equipment with a failure rate below the acceptable threshold will result in the aircraft being grounded.

[0006] Consequently, each sub-assembly must therefore have a failure occurrence rate of 10 10 / flight hour under normal conditions and where applicable of 108 to 10 flight hours under MMEL conditions, namely if the flight is authorized for a certain number of flight hours in the event of failure of a reference equipment of the sub-assembly.

[0007] In particular, an electric flight control system may include an electric actuator with a movable power shaft for controlling a hydraulic servo by moving a servo rod relative to at least one servo body. By way of example, a rotorcraft may include several fixed-body hydraulic servos driven by their respective electric actuators, each servo having a movable power rod articulated to a swashplate device, this swashplate device being articulated to at least one pitch link, each pitch link being articulated to a variable-pitch blade.

[0008] In this context, a conventional actuation subset may include an electric actuator equipped with four stators to jointly move a rotor element. Each stator is controlled by an associated actuation computer based on a positional setpoint to be achieved, relative position information between the stator and the rotor measured using an associated position sensor, and a position of the servo control measured with an associated positional sensor of the servo control. Thus, the electric actuator comprises four stators controlled by four respective actuation computers, the electric actuator comprising four position sensors communicating respectively with the four actuation computers, and the servo control comprising four positional sensors communicating respectively with the four actuation computers. Each actuation computer is also a synchronous duplex computer.

[0009] The expression "duplex computer" here and subsequently refers to a computer which comprises two independent computing channels whose execution is synchronized. Unlike a simplex computer, which has only one processing channel, a processing channel is a digital and / or analog processing unit that performs calculations on quantities represented digitally and / or analogically. The processing unit can perform digital processing using a processor or other types of integrated circuits, including logic circuits. The processing unit can perform analog processing using analog components, whether integrated or not within integrated circuits, such as operational amplifiers. The term "processor" can refer to a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), a microcontroller, and so on.For example, a duplex computer may include two computing channels, each with a processor, whereas a simplex computer has a single computing channel, for example with one processor.

[0010] Such an actuation subsystem makes it possible to achieve a failure occurrence rate of less than or equal to 10 10 / flight hour under normal conditions, and 10 flight hours under MMEL conditions, but requires large numbers of stators, computers and interconnection links, which can induce a non-negligible cost, mass and / or size.

[0011] US patent 12024306 B2 is not in the technical field in describing a hydraulic system comprising a first hydraulic actuator controlled by a first actuator control device and a second hydraulic actuator controlled by a second actuator control device. The actuation system is further provided with a shared redundant actuator control device and at least one transfer device operationally connected to the aforementioned actuator control devices.

[0012] The present invention then aims to provide an innovative electric flight control system capable of achieving a failure occurrence rate of less than or equal to 1010 / flight hour under normal conditions, and of 108 to 109 / flight hour under MMEL conditions.

[0013] The present invention relates to an electric flight control system for controlling a hydraulic servo control, said flight control system comprising a processing subset generating at least one positional setpoint, said flight control system comprising an actuation subset, said flight control system comprising an electric actuator for controlling the servo control, said electric actuator comprising a rotor element set in motion by a plurality of stators.

[0014] The actuation subset comprises three external duplex computers for controlling said electric actuator according to said at least one positional setpoint, said plurality of stators comprising only three stators electrically connected to three respective toggle devices of the electric actuator, the toggle devices being electrically connected to the same internal simplex computer of the electric actuator, each toggle device being connected to one of the respective external duplex computers, each toggle device being configured to connect to the associated stator the respective internal simplex computer or external duplex computer, the internal simplex computer being self-monitored and communicating with the three external duplex computers.

[0015] The terms "external" and "internal" are used to distinguish the so-called "external" duplex computers located outside the electric actuator from the simplex computer located inside the electric actuator.

[0016] The external duplex computers and the internal simplex computer are also similar, intrinsically and possibly also at the component level. For example, the processor of the simplex computer is different from the processors of the external duplex computers. Alternatively, the external duplex computers may be similar.

[0017] Thus, unlike a conventional flight control system having an electric actuator comprising four stators connected to four external computers, the electric actuator has only three stators to generate rotating magnetic fields enabling the rotor element to be moved.

[0018] In the nominal case, the three stators are respectively controlled by the three external duplex computers via the three switching devices. The internal simplex computer is then in active standby mode. This internal simplex computer ensures that the external duplex computers are functioning correctly using validity signals transmitted by the external duplex computers.

[0019] In the event of a failure of an external duplex computer, the associated stator is then controlled by the internal simplex computer. The switchgear connects the internal simplex computer to the stator in place of the failed external duplex computer. This internal simplex computer is specifically integrated directly within the electric actuator and implements a self-monitoring processing unit to ensure its integrity. Such an internal simplex computer can achieve a failure rate of less than or equal to 10⁵ / flight hour, which may allow the actuator to be removed from the list of reference equipment.

[0020] Such an electrical actuator then makes it possible to use only a limited number of stators, sensors, and interconnecting links in order to obtain a subsystem The actuation system has a failure rate of 1010 or less per flight hour under normal conditions, and 108 to 109 per flight hour under MMEL conditions. Thus, such a flight control system can offer optimized cost, weight, and / or size. Reducing the number of external duplex computers to three external duplex computers and one internal simplex computer integrated into the electric actuator offers savings in terms of wiring, weight, and size, as well as a more optimized cost due to the elimination of one external duplex computer, while the integration of an internal simplex computer into the electric actuator has a limited financial impact.

[0021] The electric actuator may also have one or more of the following characteristics, taken alone or in combination.

[0022] Thus, each external duplex computer may include a control channel generating an external control signal as a function of at least one positional setpoint, each external duplex computer including a monitoring channel generating a validity signal.

[0023] Each external duplex computer can be of a common type to provide the control signal and the validity signal.

[0024] For example, said electric actuator may include three primary position sensors, each measuring an angular position of the rotor element, the three primary position sensors being connected respectively to three external duplex computers, each external duplex computer being configured to generate an external control signal as a function of at least said at least one positional setpoint and said angular position.

[0025] The external duplex computers then control the power supply to the stators based at least on the positions measured by the primary position sensors. Only three primary position sensors are then required. This feature can optimize the cost, mass, and / or size of the system.

[0026] The control channel can, for example, generate the control signal by applying a stored law giving the characteristics of the control signal as a function of at least the positional setpoint and the received angular position.

[0027] Optionally, each external duplex computer can be configured to receive a current position from a servo control element, each external duplex computer being configured to generate an external control signal based on said at least one positional setpoint and said angular position as well as the current position.

[0028] According to a possibility compatible with the preceding ones, each switching device can be connected to the control channel and the monitoring channel of the corresponding external duplex computer, each switching device being connected to the internal simplex computer in order to receive an internal control signal and a selection signal emitted by this internal simplex computer, each switching device being configured to transmit to the corresponding stator the internal control signal or the external control signal depending on the selection signal and the validity signal.

[0029] Such a tilting device thus proves to be simple and effective.

[0030] Each switching device is thus controlled by the associated external duplex computer and by the internal simplex computer to transmit either the internal control signal or the external control signal to the stator. The switching from the external duplex computer to the internal simplex computer to control the power supply of a stator is based on the validity state of the external duplex computer transmitted via the validity signal. This validity signal is generated by the external duplex computer in a conventional manner, for example from internal integrity elements and after consolidation between the control and monitoring processing channels.

[0031] Furthermore, the switching from the external duplex computer to the internal simplex computer for a stator is also based on the selection signal. The internal simplex computer can output, for each switching device, a selection signal based on the validity signals emitted by the external duplex computers and its own integrity state. The internal simplex computer can ensure that it outputs only one selection signal at a time.

[0032] For example, each switching device may include a first switch and a fourth switch connected in series to the control channel of the corresponding external duplex computer and to the corresponding stator, each switching device including a second switch and a third switch connected in series to the internal simplex computer to be able to receive the internal control signal and to the corresponding stator, the first switch and the fourth switch being electrically connected to the monitoring channel of the corresponding external duplex computer so that each is placed in an open or closed state depending on the validity signal received, the second switch being electrically connected, optionally by an inverter gate, to the monitoring channel of the corresponding external duplex computer so that it is placed in an open or closed state depending on the validity signal received,The third switch is electrically connected to the internal simplex computer in order to receive the selection signal and be placed in an open or closed state depending on the received selection signal.

[0033] The switches allow the switching device to transmit either the internal control signal or the external control signal to the associated stator. Each switch can, for example, take the form of a relay or a transistor. of MOSFET type, or others. In particular, the transmission of the external control signal issued by an external duplex computer to a stator passes through the first switch and the fourth switch, both controlled by the validity signal issued by this external duplex computer, in order to ensure that in the event of a short-circuit failure of the first or the fourth switch, followed by an invalidity of the external duplex computer, the switching mechanism does not interconnect the command issued by the external duplex computer with the command issued by the internal simplex computer.

[0034] According to a possibility compatible with the preceding ones, the internal simplex computer may include three external validation connections connected respectively to the three external duplex computers to receive a validity signal emitted by each external duplex computer, the internal simplex computer being configured to emit to each switching device a selection signal based at least on the validity signal emitted by the external duplex computer in communication with this switching device.

[0035] The validity signal emitted by an external duplex computer can in particular be emitted by its monitoring computing channel, or even its control computing channel.

[0036] The internal simplex control unit can be configured to evaluate the validity of control signals using the usual validity signals. Therefore, the internal simplex control unit emits a selection signal as soon as a validity signal carries information indicating that the associated duplex control unit is malfunctioning, in order to control the stator in question. The internal simplex control unit can be configured to take control of a single stator, namely, in place of the first control unit deemed defective among the duplex control units.

[0037] According to a possibility compatible with the preceding ones, the internal simplex computer may include a single computing channel equipped with a microprocessor or a microcontroller having a first core and a second core configured to perform the same operations in parallel.

[0038] According to a possibility compatible with the preceding ones, said electric actuator may comprise a first and a second secondary position sensor, each measuring an angular position of the rotor element, the internal simplex computer comprising an external control connection connected to the processing sub-assembly to receive a positional command, the internal simplex computer comprising a positional connection receiving a current position from a servo control element, the internal simplex computer comprising a first core configured to determine a first intermediate command as a function of the positional command as well as the current position and the angular positions transmitted by the first secondary position sensor and the second sensor of secondary position, the internal simplex computer comprising a second core configured to determine a second intermediate order based on the positional setpoint as well as the current position and angular positions transmitted by the first secondary position sensor and the second secondary position sensor, said internal simplex computer being configured to consolidate a final order using the first and second orders, said internal simplex computer sending to each switching device an internal control signal carrying said final order.

[0039] The use of two secondary position sensors makes it possible to take into account the slight deformation of the rotor element that may be caused during operation by the stators. Optionally, since the rotor element extends from a first end to a second end, the two secondary position sensors can be arranged respectively at the first end and the second end.

[0040] Alternatively, the first and second cores can perform a consistency check between themselves to ensure the integrity of the calculations. If this consistency check confirms the consistency of the first and second orders, the final order can, for example, be equal to one of the first and second orders, or to an average of the first and second orders. Otherwise, the internal simplex calculator can be rendered inoperative.

[0041] According to another alternative, the internal simplex computer can take the form of a dual-core processing unit known as a "lockstep" to ensure the integrity of the calculations. Such a unit can include a microcontroller or a component known by the acronym "SoC" and the English expression "System on Chip" having the first and second cores and at least one peripheral, including a standard peripheral for managing consistency between the operations performed by the cores. This peripheral verifies that the execution flows on the two cores are indeed identical and that the results are also identical. If this is not the case, the internal simplex computer is invalidated. Conversely, if it is the case, the final order can be equal to one of the first and second orders, for example.

[0042] The invention further relates to an aircraft equipped with an aerodynamic control surface mechanically connected by a mechanical linkage to a hydraulic servo control. The aircraft comprises a flight control system according to the invention, said rotor element of the electric actuator being kinematically connected to a hydraulic distributor of the servo control.

[0043] Optionally, the internal simplex computer and the external duplex computers can be electrically connected to respective positional sensors of the servo control.

[0044] The invention and its advantages will become apparent in more detail in the following description, with illustrative examples given by reference to the accompanying figures, which represent:

[0045] [Fig. 1], a view of an aircraft having an electric flight control system comprising an electric actuator according to the invention, and

[0046] the [Fig.2], a view of a tilting device according to the invention.

[0047] Elements present in several separate figures are assigned one and the same reference.

[0048] Fig. 1 shows an aircraft 1 equipped with at least one aerodynamic control surface 5 having an adjustable position for steering this aircraft 1. The position of the aerodynamic control surface 5 can be modified by a hydraulic servo control 15.

[0049] For this purpose, the servo control 15 is connected by a mechanical link to the aerodynamic control 5. Such a hydraulic servo control 15 can conventionally comprise a hydraulic distributor 18, as well as at least one body 16 and a power rod 17 movable relative to each other under the effect of the circulation of a hydraulic fluid conveyed in the hydraulic distributor 18.

[0050] According to the example in [Fig. 1], the aircraft 1 is a rotorcraft comprising a rotor equipped with a variable-pitch blade 5. This example includes a servo control 15 having a fixed body 16 and a power rod 17 articulated to a swashplate device 6, at least one pitch control link 7 being articulated to the blade 5 and to this swashplate device 6. According to another example, an aerodynamic control surface 5 can take the form of a movable flap, for example.

[0051] Furthermore, the hydraulic servo control 15 is controlled by an electric flight control system 10.

[0052] The electric flight control system 10 includes a processing subset 30 generating at least one positional setpoint, to be achieved in order to position the aerodynamic control surface in the required manner, and an actuation subset driving an electric actuator 40 as a function of said at least one positional setpoint.

[0053] This electric actuator 40 is equipped with a rotor element 41 set in motion by a plurality of stators 42, 43, 44. The rotor element 41 is mechanically connected to a lever 11 of the hydraulic distributor 18 of the servo control 15. Thus, a rotation of this rotor element 41 under the effect of magnetic fields induces a stimulus of the hydraulic distributor 18 to extend or retract the servo control 15. The electric actuator 40 and the servo control 15 can form a single piece of equipment, or two separate pieces of equipment.

[0054] This electric actuator 40 is connected to three external duplex computers 21, 24, 27 of the actuation subassembly. In addition, the three external duplex computers 21, 24, 27 and the electric actuator 40 are all connected to the processing subset 30 so that the electric actuator 40 is controlled according to each positional setpoint generated by the processing subset 30.

[0055] Thus, the processing subset 30 conventionally comprises one or more computers configured to generate and transmit at least one positional command to the three external duplex computers 21, 24, 27 and to the electric actuator 40. If several positional commands relating to the same parameter are issued by redundant computers, the three external duplex computers 21, 24, 27 and the electric actuator 40 can be configured to use one of the positional commands by applying a conventional selection method. For example, this positional command relates to a position that the power rod 17 must reach relative to the body 16, or vice versa in the case of a servo control 15 with a moving body.

[0056] From then on, each external duplex computer 21, 24, 27 generates in a conventional manner an external control signal Command? 1, CommandP2, CommandP3 and a validity signal ValidityP1, ValidityP2, ValidityP3 depending at least on the positional instructions received.

[0057] To this end, the three external duplex computers 21, 24, 27 each have a control processing channel 22, 25, 28 generating the external control signal CommandP1, CommandP2, CommandP3 and a monitoring processing channel 23, 26, 29 generating the validity signal ValidityP1, ValidityP2, ValidityP3. The control processing channel 22, 25, 28 and the monitoring processing channel 23, 26, 29 of the same external duplex computer 21, 24, 27 can be independent and synchronized.

[0058] For example, the control calculation channel 22, 25, 28 of each external duplex computer 21, 24, 27 is configured to generate a control signal, for example analog, transmitted to the electric actuator 40 and to its monitoring calculation channel 23, 26, 29. In addition, the monitoring calculation channel 23, 26, 29 of an external duplex computer 21, 24, 27 is configured to verify that the control calculation channel 22, 25, 28 of this same external duplex computer 21, 24, 27 is functioning correctly, for example by performing calculations which should lead to the same result as the result carried by the control signal. The monitoring calculation channel 23, 26, 29 then emits a validity signal ValidityP1, ValidityP2, ValidityP3, for example analog, indicating whether the associated control calculation channel 22, 25, 28 is functioning correctly or malfunctioning.

[0059] To enable the external duplex computers 21, 24, 27 to generate the control signals and the validity signals, the electric actuator 40 may include three primary position sensors 91, 92, 93, each measuring an angular position of the rotor element 41, for example at the level of the associated stator. The three sensors Primary position sensors 91, 92, 93 are connected respectively to three external duplex computers 21, 24, 27 to transmit to them three measurement signals respectively: PosMot PI, PosMot P2, PosMot P3. Optionally, the external duplex computers 21, 24, 27 are also connected to respective positional sensors 191, 192, 193 of the servo control 15, each measuring a situational position of the servo control 15. Each positional sensor 191, 192, 193 can measure a position of the power rod 17 relative to the body 16, for example, and transmit it via a rod position signal Ptigel, Ptige2, Ptige3.

[0060] Thus, each control calculation channel 22, 25, 28 of an external duplex computer 21, 24, 27 can apply a stored law to generate an external control signal that is a function of the received positional setpoint, or even of the received angular position and / or the received situational position. Similarly, each monitoring calculation channel 23, 26, 29 can take these parameters into account to evaluate the operation of the control calculation channel 22, 25, 28 of its external duplex computer.

[0061] Independently of these aspects, the electric actuator 40 is provided with a rotor element 41 set in motion by rotating magnetic fields generated by three stators 42, 43, 44. The three stators 42, 43, 44 are electrically connected respectively to three tilting devices 50 of the electric actuator 40. Reference numeral 50 designates any of the tilting devices, reference numerals 51, 52, 53 each designating a particular tilting device if necessary.

[0062] The switching devices 50 are each connected to the control channel 22, 25, 28 and the monitoring channel 23, 26, 29 of the corresponding external duplex computer 21, 24, 27. Thus, a first stator 42 is electrically connected to a first switching device 51 which is connected to the computing channels 22, 23 of a first external duplex computer 21, a second stator 43 is electrically connected to a second switching device 52 which is connected to the computing channels 25, 26 of a second external duplex computer 24, and a third stator 44 is electrically connected to a third switching device 53 which is connected to the computing channels 28, 29 of a third external duplex computer 27.

[0063] In addition, the tilting devices 50 are all electrically connected to the same internal simplex computer 80 of the electric actuator 40. Therefore, each tilting device 50 is configured to connect, at any given moment, to the associated stator 42, 43, 44 the respective internal simplex computer 80 or external duplex computer 21, 24, 27, and thus transmit a CommandM1, CommandM2, CommandM3 signal to this stator.

[0064] Figure 2 illustrates such a tilting device 50.

[0065] Thus, each switching device 50 has a first switch 66 and a fourth switch 70 connected in series to the control channel 22, 25, 28 of the corresponding external duplex computer 21, 24, 27, for example via a first socket 61 of the electric actuator 40. When the first switch 66 and the fourth switch 70 are closed, this first switch 66 and this fourth switch 70 thus transmit to the corresponding stator 42, 43, 44 an external control signal Command? 1, CommandP2, CommandP3 emitted by the control calculation channel 22, 25, 28 of the associated external duplex computer 21, 24, 27.For this purpose, the first switch 66 and the fourth switch 70 are electrically connected to the monitoring channel 23, 26, 29 of the corresponding external duplex computer 21, 24, 27, for example via a second socket 62 of the electric actuator 40, to be placed in a closed state if the received validity signal ValidityP1, ValidityP2, ValidityP3 indicates that the control calculation channel 22, 25, 28 is functioning correctly, or in an open state otherwise.

[0066] In addition, each toggle device 50 has a second switch 67 and a third switch 68 in series electrically on the one hand to the internal simplex computer 80, for example via a third socket 63 of the electric actuator 40 in order to be able to receive an internal control signal Commands and, on the other hand to the corresponding stator 42, 43, 44.

[0067] The second switch 67 is electrically connected to the monitoring channel 23, 26, 29 of the corresponding external duplex computer 21, 24, 27, optionally via a reversing gate 69, or even the second socket 62 of the electric actuator 40, to be placed in an open state if the validity signal ValidityP1, ValidityP2, ValidityP3 indicates that the corresponding control signal is valid, and closed otherwise. Finally, the third switch 68 is electrically connected to a connection of the internal simplex computer 80 transmitting a selection signal SelectionP1, SelectionP2, SelectionP3, for example via a fourth socket 64 of the electric actuator 40, to be placed in an open state if the received selection signal SelectionP1, SelectionP2, SelectionP3 indicates that the corresponding control signal is valid, and closed otherwise.

[0068] Consequently, if the transmitted control signal is valid, the first switch 66 and the fourth switch 70 are closed while the second switch 67 and the third switch 68 are open, which allows the external control signal emitted by the associated external duplex computer 21, 24, 27 to be transmitted to the stator 42, 43, 44. Conversely, if the transmitted control signal is invalid, the first switch 66 and the fourth switch 70 are open while the second switch 67 and the third switch 68 are closed, which allows the signal Internal control commands issued by the internal simplex 80 computer to be transmitted to the stator 42,43,44.

[0069] To control the switching devices 50 and with reference to [Fig.1], the internal simplex computer 80 has three external validation connections 83, 84, 85 connected respectively to the three monitoring computing channels 23, 26, 29 to receive the validity signals ValidityP1, ValidityP2, ValidityP3 emitted by the corresponding external duplex computer 21, 24, 27.

[0070] The internal simplex computer 80 is configured to transmit, if necessary, to each switching device 50 the respective selection signal SelectionP1, SelectionP2, SelectionP3 depending at least on the validity signal ValidityP1, ValidityP2, ValidityP3 transmitted by the external duplex computer 21, 24, 27 in communication with this switching device 50. If a validity signal indicates that the external duplex computer 21, 24, 27 concerned is defective, then the internal simplex computer 80 transmits the associated selection signal to the relevant switching device 50.

[0071] This internal simplex computer 80 is also self-monitoring. Thus, the internal simplex computer 80 may comprise a single computing channel equipped with a microprocessor or microcontroller having a first core 81 and a second core 82 configured to perform the same operations in parallel.

[0072] Furthermore, the electric actuator 40 may include a first and a second secondary position sensors 94, 95, each measuring an angular position of the rotor element 41 and transmitting measurements MotorPositionS-1 and MotorPositionS-2 respectively to the internal simplex computer 80. Since the rotor element 41 extends from a first end 411 to a second end 412, the two secondary position sensors 94, 95 may be arranged respectively at the first end 411 and the second end 412.

[0073] Optionally, the internal simplex computer 80 may include an external control connection 86 connected to the processing subset 30 to receive a positional setpoint to be achieved and a positional connection 87 connected to a positional sensor 194 receiving a current position PtigeS of a servo control element 15, and according to the example described above of the power rod 17 relative to the body 16.

[0074] The first core 81 can then be configured to determine, for example using a stored law, a first intermediate command based on the positional setpoint or even the current position and the measurements PositionmotorS-1, PositionmotorS-2 transmitted by the first secondary position sensor 94 and the second secondary position sensor 95. Similarly, the second core 82 is configured to determine, for example using a stored law, a second intermediate order depending on the positional setpoint or even the current position and the measurements PositionmotorS-1, PositionmotorS-2 transmitted by the first secondary position sensor 94 and the second secondary position sensor 95.

[0075] Optionally, the first core 81 and the second core 82 communicate with each other to consolidate a final order using the first and second orders. For example, the final order may be one of the first and second orders if the difference between the first and second orders is less than a limit, or it may be an average of the first and second orders according to another possibility. The internal simplex computer 80 then sends the internal control signal carrying said final order to each switching device 50.

[0076] According to another possibility, the internal simplex calculator 80 may include a consistency management device to evaluate the consistency of calculations.

[0077] Thus, under nominal conditions, the switching devices 50 transmit an external control signal, for example analog, from the associated external duplex computer 21, 24, 27 to the associated stator 42, 43, 44. If one of the external duplex computers 21, 24, 27 is deemed defective, then the validity signal emitted by the defective external duplex computer 21, 24, 27 and the corresponding selection signal change so that the switching device 50 transmits to the stator 42, 43, 44 not the erroneous external control signal but the internal control signal.

[0078] Naturally, the present invention is subject to numerous variations in its implementation. Although several embodiments have been described, it is understood that it is not conceivable to exhaustively identify all possible embodiments. It is, of course, conceivable to replace a described means with an equivalent means without departing from the scope of the present invention as defined by the claims.

Claims

Demands

1. An electric flight control system (10) for controlling a hydraulic servo control (15), said flight control system (10) comprising a processing subset (30) generating at least one positional setpoint, said flight control system (10) comprising an actuation subset, said flight control system (10) comprising an electric actuator (40) for controlling the servo control (15), said electric actuator (40) comprising a rotor element (41) set in motion by a plurality of stators (42, 43, 44), characterized in that the actuation subset comprises three external duplex computers (21, 24, 27) for controlling said electric actuator (40) as a function of said at least one positional setpoint, said plurality of stators comprising only three stators (42, 43, 44) electrically connected to three respective tilting devices (50) of the electric actuator (40),the toggle devices (50) being electrically connected to the same internal simplex computer (80) of the electric actuator (40), each toggle device (50) being connected to one of the respective external duplex computers (21, 24, 27), each toggle device (50) being configured to connect to the associated stator (42, 43, 44) the respective internal simplex computer (80) or the external duplex computer (21, 24, 27), the internal simplex computer (80) being self-monitoring and communicating with the three external duplex computers (21, 24, 27).

2. Flight control system according to claim 1, characterized in that each external duplex computer (21, 24, 27) has a control channel (22, 25, 28) generating an external control signal (CommandP1, CommandP2, CommandP3) as a function of at least said at least one positional setpoint, each external duplex computer (21, 24, 27) having a monitoring channel (23, 26, 29) generating a validity signal (ValidityP1, ValidityP2, ValidityP3).

3. Flight control system according to claim 2, characterized in that said electric actuator (40) comprises three primary position sensors (91, 92, 93), each measuring a angular position of the rotor element (41), the three primary position sensors (91, 92, 93) being connected respectively to the three external duplex computers (21, 24, 27), each external duplex computer (21, 24, 27) being configured to generate an external control signal (CommandP1, CommandP2, CommandP3) as a function of at least one positional setpoint and angular position.

4. Flight control system according to claim 3, characterized in that each external duplex computer (21, 24, 27) is configured to receive a current position from a servo control element (15), each external duplex computer (21, 24, 27) being configured to generate an external control signal (CommandP1, CommandP2, CommandP3) as a function of said at least one positional setpoint and said angular position as well as the current position.

5. A flight control system according to any one of claims 2 to 4, characterized in that each toggle device (50) is connected to the control channel (22, 25, 28) and the monitoring channel (23, 26, 29) of the corresponding external duplex computer (21, 24, 27), each toggle device (50) being connected to the internal simplex computer (80) to receive an internal control signal (Commands) and a selection signal (SelectionP1, SelectionP2, SelectionP3) emitted by this internal simplex computer (80), each toggle device (50) being configured to transmit to the corresponding stator (42, 43, 44) the internal control signal (Commands) or the external control signal (CommandP1, CommandP2, CommandP3) depending on the selection signal (SelectionP1, SelectionP2, SelectionP3) and the validity signal (ValidityP1, ValidityP2, ValidityP3).

6. Flight control system claim 5, characterized in that each toggle device (50) comprises a first switch (66) and a fourth switch (70) connected in series to the control channel (22, 25, 28) of the corresponding external duplex computer (21, 24, 27) and to the corresponding stator (42, 43, 44), each toggle device (50) comprising a second switch (67) and a third switch (68) connected in series to the internal simplex computer (80) to receive the internal control signal (Commands) and to the corresponding stator (42, 43, 44), the first switch (66) and the fourth switch (70) being electrically connected to the monitoring channel (23, 26, 29) of the corresponding external duplex computer (21, 24, 27) to be placed in an open or closed state depending on the validity signal (ValidityP1, ValidityP2, ValidityP3) received, the second switch (67) being electrically connected to the monitoring channel (23, 26, 29) of the corresponding external duplex computer (21, 24, 27) to be placed in an open or closed state depending on the validity signal (ValidityP1, ValidityP2, ValidityP3) received, the third switch (68) being electrically connected to the internal simplex computer (80) to receive the selection signal (SelectionP1, SelectionP2,SelectionP3) to be placed in an open or closed state depending on the selection signal (SelectionP1, SelectionP2, SelectionP3) received.

7. Flight control system according to any one of claims 1 to 6, characterized in that said internal simplex computer (80) has three external validation connections (83, 84, 85) connected respectively to the three external duplex computers (21, 24, 27) to receive a validity signal (ValidityP1, ValidityP2, ValidityP3) emitted by each external duplex computer (21, 24, 27), said internal simplex computer (80) being configured to emit to each switch device (50) a selection signal (SelectionP1, SelectionP2, SelectionP3) as a function at least of the validity signal (ValidityP1, ValidityP2, ValidityP3) emitted by the external duplex computer (21, 24, 27) in communication with this switch device (50).

8. Flight control system according to any one of claims 1 to 7, characterized in that said internal simplex computer (80) comprises a single computing channel equipped with a microprocessor or microcontroller having a first core (81) and a second core (82) configured to perform the same operations in parallel.

9. Flight control system according to any one of claims 1 to 8, characterized in that said electric actuator (40) comprises a first and a second secondary position sensors (94, 95) each measuring an angular position of the rotor element (41), said internal simplex computer (80) comprising an external control connection (86) connected to the processing sub-assembly (30) to receive a positional command, said internal simplex computer (80) comprising a positional connection (87) receiving a current position from a servo control element (15), said internal simplex computer (80) comprising a first core (81) configured to determine a first intermediate command as a function of the positional command as well as the current position and the angular positions transmitted by the first secondary position sensor (94) and the second secondary position sensor (95),said internal simplex computer (80) comprising a second core (82) configured to determine a second intermediate order as a function of the positional setpoint as well as the current position and the angular positions transmitted by the first secondary position sensor (94) and the second secondary position sensor (95), said internal simplex computer (80) being configured to consolidate a final order using the first and second orders, said internal simplex computer (80) transmitting to each switching device (50) an internal control signal (Commands) carrying said final order.

10. Flight control system according to claim 9, characterized in that the rotor element (41) extends from a first end (411) to a second end (412), the two secondary position sensors (94, 95) are arranged respectively at the first end (411) and at the second end (412).

11. Aircraft (1) equipped with an aerodynamic rudder (5) mechanically connected by a mechanical linkage (11) to a hydraulic servocontrol (15), characterized in that said aircraft (1) comprises a flight control system (10) according to any one of claims 1 to 10, said rotor element of the actuator being kinematically connected to a hydraulic distributor (18) of the servocontrol (15).

12. Aircraft according to claim 11, characterized in that the internal simplex computer (80) and the external duplex computers (21, 24, 27) are electrically connected to respective positional sensors (191, 192, 193, 194) of the servo control (15).

Images