Control device and redundant control incorporating said control device, the redundant control being protected against common mode faults

Abstract

Disclosed is an interconnection device (1) comprising at least two transmission channels (2a, 2b) each provided with one processing means (3a, 3b), each processing means comprising two inputs and two outputs and being designed to perform two distinct functions or one function according to two distinct definitions, the interconnection device (1) also being provided with an input multiplexer (9) and an output multiplexer (10) that are connected to the input and output of the processing means (3a, 3b), respectively, the interconnection device (1) also being provided with a configuration means (8) able to configure the multiplexers (9, 10) such that at least one input signal is transmitted to an input of one of the processing means (3a, 3b) and at least one output signal is transmitted from an output of one of the processing means (3a, 3b), the configuration means (8) also being able to choose one of the functions or one of the function definitions of the two processing means (3a, 3b).

Description

[0001] DESCRIPTION

[0002] TITLE: Control device and redundant control incorporating said control device, protected against common-mode failures

[0003] technical field

[0004] The invention has as its technical domain the redundant control of actuators by human-machine interfaces and more particularly of such controls with a so-called COM-MON structure.

[0005] Previous techniques

[0006] Modern vehicles include an increasing number of electrical controls linking human-machine interfaces to actuators.

[0007] In the case of aircraft, such controls are generally grouped under the "fly-by-wire" concept, developed since the 1960s. An actuator, such as an electro-hydraulic cylinder or a LPV actuator, is then controlled by an electrical link from a human-machine interface, such as a button or control stick. The actuators are thus controlled electrically instead of mechanically, as was often the case previously.

[0008] In a vehicle, particularly in an aircraft, a failure of the controls of the most critical actuators can lead to a loss of vehicle control.

[0009] To limit the susceptibility of these commands to failures, redundancy is generally used. Commands from the human-machine interface are duplicated so that a failure in one part of the command transmission is compensated by a corresponding redundant part.

[0010] However, such a redundant control system can also be subject to a failure affecting both redundant parts simultaneously, known as a common-mode failure. This generally occurs when a component experiences a design or implementation-related failure. All components sharing the same operating conditions or implementation then experience a failure when the required conditions are met. In the case of a redundant control system, the failure can then simultaneously affect both redundant parts containing the same component, interrupting the transmission of the control signal. The greater the number of structures or components shared between redundant parts, the greater the risk of a common-mode failure.

[0011] The state-of-the-art solution to this problem is to design redundant controllers with a different structure while maintaining identical functionality. This reduces the number of shared components and the risk of common-mode failure.

[0012] Such a response has the effect of significantly increasing costs due to a non-redundant cost (NRC) multiplied by two and a redundant cost (RC) not optimized.

[0013] Some electronic actuator controls require a structure called COM-MON, comprising a control channel called COM channel and a monitoring channel called MON channel.

[0014] When redundancy is required for such a COM-MON structured control, each COM channel and each MON channel is typically duplicated. As a result, the redundant COM and MON channels are vulnerable to common-mode failures similar to those that can affect a conventional redundant control system.

[0015] Here again, the state-of-the-art solution to this problem is to propose different structures for redundant COM channels and different structures for redundant MON channels. Furthermore, the COM and MON channels must not have any similarities. This results in four different structures for a single redundant COMMON command.

[0016] It thus appears that development and implementation costs are increasing drastically. There is a need for a redundant control system to limit costs compared to the state of the art, while offering at least the same level of protection.

[0017] From the prior art, we know of document FR3049075 describing a COM-MON type control system allowing a single electronic board reference to include both COM and MON functions. However, such a control system implies that either the MON or COM portion is unused on each electronic board. The cost of this system is therefore high.

[0018] This document does not address the technical problem identified above.

[0019] Description of the invention

[0020] The invention relates to an interconnection device comprising at least two transmission paths, each equipped with a first processing means and a second processing means, each processing means comprising two inputs and two outputs, each processing means being designed to perform two distinct functions or one function according to two distinct definitions, each distinct function among two functions or each distinct definition of a function of one of said processing means being associated with a distinct input and output of said processing means, two definitions of the same function corresponding to two different component arrangements or two different arrangements of executable software instructions allowing the same function to be obtained, the interconnection device also being equipped with an input multiplexer and an output multiplexer connected respectively to the input and output of the processing means,the interconnection device also being equipped with a configuration means capable of configuring the multiplexers so that at least one input signal is transmitted to an input of one of the processing means and at least one output signal is transmitted from an output of one of the processing means, the configuration means also being capable of selecting one of the functions or one of the function definitions of the two processing means.

[0021] The configuration means can be of the pin-programmable type, with each pin arrangement being associated with a function or function definition of each processing means, an input multiplexer configuration, and an output multiplexer configuration.

[0022] Pin programming can enable or disable parts of the control process or control processes executed by the processing means.

[0023] Pin programming can enable or disable different control processes or load different control processes executed by the processing means.

[0024] A function can be a COM control function or a MON monitoring function.

[0025] The invention also relates to a redundant control system of an actuator by a human-machine interface, comprising a first interconnection device and a second interconnection device each as described above, in which the first processing means of the first interconnection device and the first processing means of the second interconnection device are designed to perform the same distinct functions or the same distinct definitions of the same function, the second processing means of the first interconnection device and the second processing means of the second interconnection device are designed to perform the same distinct functions or the same distinct definitions of the same function, at least one processing means of the first interconnection device and at least one processing means of the second interconnection device operate redundantly.

[0026] At least one processing means for the first interconnection device and at least one processing means for the second interconnection device can be configured to perform the same function according to two different definitions. The invention also relates to an aircraft comprising an interface and an actuator, including at least one redundant control system as described above, processing the interface signals in order to transmit them to the actuator.

[0027] Brief description of the drawings

[0028] Other objects, features and advantages of the invention will become apparent from the following description, given solely by way of non-limiting example and made with reference to the accompanying drawings in which:

[0029] - Figure [Fig 1] illustrates a software-configured, two-way control device,

[0030] - Figure [Fig 2] illustrates a hardware-configured two-way control device,

[0031] - Figure [Fig 3] illustrates an embodiment of a COM-MON type redundant control system comprising two interconnection devices,

[0032] - Figure [Fig 4] illustrates a COM-only redundant control system, comprising two interconnection devices, and

[0033] - Figure [Fig 5] illustrates another embodiment of a COM-MON type redundant control system comprising two interconnection devices.

[0034] Detailed description

[0035] The interconnection device according to the invention allows the transmission of redundant control signals between a human-machine interface and an actuator of a vehicle, in particular an aircraft.

[0036] An interconnection device comprises at least two processing means that receive input signals and output signals and can be configured redundantly, thus reducing the risk of common-mode failure. Each processing means can exchange data with at least one other processing means in the interconnection device. This can be the case, for example, when one processing means is linked to the COM control function while a second processing means is linked to the MON monitoring function. Data can then be exchanged between the two processing means so that the second processing means, which is linked to the MON monitoring function, can assess the health status of the first processing means, which is linked to the COM control function.

[0037] Generally, each processing unit is configured to generate a COM control signal or a MON monitoring signal based on signals received as input and / or exchanged with the other processing unit. For example, in a flight control application, input signals might be position commands for a wing component such as an aileron, while output signals generated by a processing unit might be power signals to control an aircraft engine.

[0038] Input and output multiplexing of at least one processing means is carried out by a dedicated multiplexing means, internal or external to the interconnection device and connected respectively to the inputs and outputs of the processing means.

[0039] A transmission channel is defined as having at least two inputs, for receiving signals originating, for example, from a human-machine interface, and at least two outputs, for example, supplying signals to one or more actuators. A transmission channel also includes at least one processing means, an input multiplexer, and an output multiplexer. The signals can be electrical signals, including COM-type control signals or MON-type monitoring signals.

[0040] An interconnection device thus comprises at least two transmission channels and a pin configuration means designed to configure each transmission channel as either a COM or MON channel. Such a configuration implies a change in the operation of both the multiplexers and the processing means. Depending on the end user's needs, the processing means can be configured either in software or hardware.

[0041] Software configuration:

[0042] In a first embodiment, the processing means is at least one execution core of a processor comprising at least two instruction execution cores. In other words, a multi-core processor can be shared between several transmission channels such that at least one of its execution cores executes the instructions associated with the processing means of each transmission channel.

[0043] Each transmission channel is configured as a COM channel or a MON channel, independently of each other, by changing the instructions executed by the channel's processing means.

[0044] In each processing channel, the process executed by the processing means then comprises sub-parts associated with COM operation or sub-parts associated with MON operation. The processing means is then connected to the COM input and output or to the MON input and output via a multiplexer so that the appropriate data passes through the processing means.

[0045] Hardware configuration:

[0046] In a second embodiment, the processing means is a hardware device, such as an electronic control board. Each processing means comprises an arrangement of discrete components associated with COM operation and an arrangement of discrete components associated with MON operation. Each transmission channel is configured independently as either a COM or MON channel by changing the arrangement of discrete components in the processing means through which the transmitted data passes. This can be achieved, for example, by means of multiplexers internal to the processing means. Regardless of whether it is software or hardware, within each software or hardware COM / MON configuration, the processing means can be configured according to either a first definition A or a second definition B.A specific arrangement of instructions or components is then planned for the first definition A and a specific arrangement of instructions or components for the second definition B.

[0047] The first definition A and the second definition B thus allow for the same COM control or MON monitoring operation of the processing means, and, by extension, of the control channel comprising the processing means, with different arrangements of discrete components or instructions. Using different definitions of the same function helps to limit common-mode failures.

[0048] In the case of a software definition of a processing means, pin programming activates or deactivates parts of the control process executed by the processing means. Alternatively, pin programming activates or deactivates different control processes. It can also be provided that pin programming loads different control processes.

[0049] In the case of a hardware definition of a processing means, pin programming modifies the transmission of signals within the processing means between specific arrangements of discrete components.

[0050] Regardless of the hardware or software definition of the processing means, pin programming also modifies the configuration of the input and output multiplexers.

[0051] Figure [Fig 1] illustrates an interconnection device referenced 1, connecting a human-machine interface 11 to an actuator 12 via an input multiplexer 9 and an output multiplexer 10 and comprising two transmission paths 2a, 2b. Each transmission path 2a, 2b comprises a processing means 3a, 3b connected to two COM input connections referenced 4a, 4b, two MON input connections referenced 5a, 5b, two COM output connections referenced 6a, 6b and two MON output connections referenced 7a, 7b.

[0052] Each processing unit 3a, 3b thus comprises two inputs and two outputs. It will be understood that one input and one output are dedicated to COM type control signals, while the other input and output are dedicated to MON type monitoring signals.

[0053] In accordance with the above description of an interconnection device, the processing means 3a, 3b are defined either in software or hardware. The interconnection device 1 includes a pin configuration means 8 connected to the first processing means 3a by connection 8a, to the second processing means 3b by connection 8b, to the input multiplexer 9 by connection 8c, and to the output multiplexer 10 by connection 8d. Specific activation of the pins of the configuration means 8 allows selection of an operating mode for the interconnection device 1, resulting in the transmission of a control signal to each processing means 3a, 3b of the interconnection device, thus controlling COM control or MON monitoring operation, and, as appropriate, according to a predefined first definition A or second definition B.

[0054] In addition to enabling or disabling the COM or MON operation of each processing means 3a, 3b, selecting an operating mode for the interconnect device 1 via the pin configuration means 8 also results in a modification of the routing scheme of each multiplexer so that COM signals are correctly directed to or from a COM input of a processing means configured for COM signal processing. Similarly, the pin configuration means 8 modifies the routing scheme of each multiplexer so that MON signals are correctly directed to or from a MON input of a processing means configured for MON signal processing.

[0055] More specifically, the input multiplexer 9 can be controlled to transmit COM control signals from interface 11 to the first processing unit 3a via input connection 4a or to the second processing unit 3b via input connection 4b. The same applies to MON monitoring signals, which can be transmitted to the first processing unit 3a via input connection 5a or to the second processing unit 3b via input connection 5b.

[0056] The same applies to the output multiplexer 10 and the output connections 6a, 6b, 7a, 7b connecting the processing means 3a, 3b to the output multiplexer 10.

[0057] In the embodiment illustrated by the figure [Fig 1], the multiplexing of the COM and MON channels is carried out outside the interconnection device 1 by the input multiplexer 9 and the output multiplexer 10.

[0058] The input multiplexer 9 and the output multiplexer 10 are configured according to the control signal emitted by the configuration means 8 per pin so that a predefined signal transmission scheme at the input of each multiplexer 9, 10 is applied.

[0059] Depending on the pin programming performed via configuration means 8, different configurations can be obtained, according to application needs and the redundancy and dissimilarity requirements related to a required failure rate. For example: a COM-MON configuration with a processing means 3a configured as COM and a processing means 3b configured as MON; or a COM-COM configuration with a processing means 3a configured as COM and a processing means 3b also configured as COM; or a MON-MON configuration with a processing means 3a configured as MON and a processing means 3b also configured as MON; or a MON-COM configuration with a processing means 3a configured as MON and a processing means 3b configured as COM.

[0060] It is also understood that the inputs and outputs of the processing means 3a, 3b are kept active so that their activity depends only on the transmission of data through the multiplexers 9, 10. Similarly, the data carried by these inputs and outputs are only taken into account according to the configuration of the processing means 3a, 3b.

[0061] Figure [Fig 2] illustrates an interconnection device 1 similar to that illustrated by figure [Fig 1], differing only in the integration of the input multiplexer 9 and the output multiplexer 10 into the interconnection device 1.

[0062] Figures [Fig 3] to [Fig 5] illustrate some redundant control system architectures implemented with such interconnection devices.

[0063] Figure [Fig 3] illustrates a redundant COM-MON type control system comprising two interconnecting devices la, lb, each connected at its input to an interface 11 of the vehicle, for example a human-machine interface, such as a joystick or a switch. The interconnecting devices la, lb are connected at their output to an actuator 12 of the vehicle.

[0064] A first interconnection device comprises a first processing means 3a and a second processing means 3b.

[0065] The first processing means 3a is designed to exhibit COM-type operation and MON-type operation, both according to a first definition A. The first processing means 3a switches from one operation to the other depending on the signal received from the configuration means 8.

[0066] Similarly, the second processing means 3b is designed to exhibit both COM-type and MON-type operation, according to a second definition B. The second processing means 3b switches from one operation to the other depending on the signal received from the configuration means 8.

[0067] COM-type or MON-type operation, according to a first definition A or a second definition B of the first processing means 3a and the second processing means 3b, can be obtained as a result of a software configuration (choice of an arrangement among different arrangements of software instructions) or a hardware configuration (choice of an arrangement among different arrangements of discrete components).

[0068] The first interconnection device also includes a pin-programmable configuration means 8 and multiplexers 9, 10 arranged respectively at the input and output of the processing means 3a, 3b.

[0069] The first processing means 3a is connected at the input so as to receive COM type signals from interface 11 via the input multiplexer 9 and a first input connection 20a and at the output to actuator 12 so as to transmit COM type signals via the output multiplexer 10 and a first output connection 21a.

[0070] The second processing means 3b is connected at the input so as to receive MON type signals from interface 11 via the input multiplexer 9 and a second input connection 20b and at the output to actuator 12 so as to transmit MON type signals via the output multiplexer 10 and a second output connection 21b.

[0071] The configuration means 8 controls the input multiplexer 9 so that COM-type signals from interface 11 are directed to the first processing means 3a associated with COM-type operation via a connection 4a while MON-type signals from interface 11 are directed to the second processing means 3b associated with MON-type operation via a connection 5b.

[0072] The configuration means 8 controls the output multiplexer 10 so that the signals from the first processing means 3a associated with COM type operation via a connection 6a and the MON type signals from the second processing means 3b via a connection 7b associated with MON type operation are directed to the actuator 12.

[0073] Note that the input multiplexer 9 is connected to the second processing unit 3b via a connection 4b and to the first processing unit via a connection 5a. However, due to the chosen configuration, these connections 4b and 5a are not connected to interface 11.

[0074] The same applies to the output multiplexer 10, for which the connection 7a to the first processing means 3a and the connection 6b to the second processing means 3b are not put into communication with the actuator 12.

[0075] The second interconnection device 1b comprises a first processing means 3a and a second processing means 3b.

[0076] The first processing means 3a is designed to exhibit COM-type operation and MON-type operation according to a first definition A. The first processing means 3a switches from one operation to the other depending on the signal received from the configuration means 8.

[0077] The second processing means 3b is designed to exhibit COM-type operation and MON-type operation according to a second definition B. The second processing means 3b switches from one operation to the other depending on the signal received from the configuration means 8.

[0078] It is noted that the first processing means 3a is designed similarly in each of the two interconnection devices la, lb. Likewise, the second processing means 3b is also designed similarly in each of the two interconnection devices la, lb. This similar design has the effect of lowering production costs, while protecting against failures through redundancy and against common-mode failures through dissimilarity, as will be highlighted later.

[0079] COM-type or MON-type operation, according to a first definition A or a second definition B of the first processing means 3a and the second processing means 3b, can be obtained as a result of a software configuration (choice of an arrangement among different arrangements of software instructions) or a hardware configuration (choice of an arrangement among different arrangements of discrete components).

[0080] The second interconnection device 1b includes a pin-programmable configuration means 8 and multiplexers 9, 10 arranged respectively at the input and output of the processing means 3a, 3b.

[0081] The first processing means 3a is connected: at the input so as to receive MON type signals from interface 11 via the input multiplexer 9 and a fourth input connection 20d and at the output, to actuator 12 so as to transmit MON type signals via the output multiplexer 10 and a fourth output connection 21d.

[0082] The second processing method 3b is connected:

[0083] - as input so as to receive COM type signals from interface 11, input multiplexer 9 and a third input connection 20c and

[0084] - output to actuator 12 so as to transmit COM type signals from output multiplexer 10 and a third output connection 21 c.

[0085] Configuration means 8 controls the input multiplexer 9 so that COM signals from interface 11 are directed to the second processing means 3b, which operates in COM mode, while MON signals from interface 11 are directed to the first processing means 3a, which operates in MON mode. Thus, configuration means 8 controls the input multiplexer 9 so that COM signals from interface 11 are directed to the second processing means 3b, which operates in COM mode, via connection 5a, while MON signals from interface 11 are directed to the first processing means 3a, which operates in MON mode, via connection 4b.

[0086] The configuration means 8 controls the output multiplexer 10 so that COM type signals from the second processing means 3b associated with COM type operation and MON type signals from the first processing means 3a associated with MON type operation are directed to the actuator 12. Thus, the configuration means 8 controls the output multiplexer 10 so that signals from the second processing means 3a associated with COM type operation via a connection 7a and MON type signals from the first processing means 3a via a connection 6b associated with MON type operation are directed to the actuator 12.

[0087] Similar to the first interconnection device, we note here that the input multiplexer 9 is connected to the second processing means 3b via a connection 5b and to the first processing means via a connection 4a. However, due to the chosen configuration, these connections 4a and 5b are not connected to interface 11.

[0088] The same applies to the output multiplexer 10, for which the connection 6a to the first processing means 3a and the connection 7b to the second processing means 3b are not put into communication with the actuator 12.

[0089] In the example illustrated by Figure [Fig 3], the first processing means 3a of the first interconnection device la is configured in COM type operation according to a first definition A, the second processing means 3b of the first interconnection device la is configured in MON type operation according to a second definition B, the first processing means 3a of the second interconnection device 1b is configured in MON type operation according to a first definition A, the second processing means 3b of the second interconnection device 1b is configured in COM type operation according to a second definition B.

[0090] The control system is thus of the redundant COM type, and this configuration is protected against common-mode failures due to the induced dissimilarity. Indeed, each of the COM-type processing means has a different definition from the others (first definition A, second definition B), while each of the MON-type processing means also has a different definition from the others (first definition A, second definition B).

[0091] This protection against common-mode failures is achieved at the cost of a non-redundant NRC, which remains high due to the need to develop two definitions for each COM processing means and for each MON processing means. However, the cost of the redundant control system is lower than the cost of the prior-art control system because the first interconnection device 1a and the second interconnection device 1b have the same structure. In other words, the interconnection device 1a and the interconnection device 1b comprise the same components and / or the same software. Pin configuration allows the interconnection device 1a and the interconnection device 1b to be configured differently.

[0092] Figure [Eig 4] illustrates a COM-COM type redundant control system, comprising two interconnect devices la, lb, each connected at its input to a vehicle interface 11, for example a human-machine interface, such as a joystick or switch. The interconnect devices la, lb are connected at their output to a vehicle actuator 12.

[0093] The first interconnection device comprises a first processing means 3a and a second processing means 3b.

[0094] The first processing means 3a is designed to exhibit COM-type operation and MON-type operation according to a first definition A. The first processing means 3a switches from one operation to the other depending on the signal received from the configuration means 8.

[0095] The second processing means 3b is designed to exhibit COM-type operation and MON-type operation according to a second definition B. The second processing means 3b switches from one operation to the other depending on the signal received from the configuration means 8.

[0096] COM-type or MON-type operation, according to a first definition A or a second definition B of the first processing means 3a and the second processing means 3b, can be obtained as a result of a software instantiation (different arrangements of software instructions) or a hardware instantiation (different arrangements of discrete components).

[0097] The first interconnection device also includes a pin-programmable configuration means 8 and multiplexers 9, 10 arranged respectively at the input and output of the first interconnection device l a.

[0098] Configuration means 8 controls the input multiplexer 9 so that COM-type signals from interface 11 are directed to the first processing means 3a, which is associated with COM-type operation, via the first incoming connection 20a and connection 4a. It should be noted that interface 11 does not transmit a MON-type signal to the first interconnection device 1a in this embodiment. This results in a second incoming connection 20b of the input multiplexer 9 that is not connected to interface 11.

[0099] The configuration means 8 also controls the output multiplexer 10 so that signals from the first processing means 3a, associated with COM operation, are directed to the actuator 12 via a first outgoing connection 21a and connection 4a. Again, no MON-type signals are emitted by the first interconnection device 1a. This results in a second outgoing connection 21b of the output multiplexer 10 that is not connected to the actuator 12. The second interconnection device 1b comprises a first processing means 3a and a second processing means 3b.

[0100] As with the first interconnection device 1a, a third incoming connection 20c links interface 11 to the input multiplexer 9 of the second interconnection device 1b. It should be noted that interface 11 does not transmit a MON-type signal to the second interconnection device 1b in this embodiment. This results in a second incoming connection 20d of the input multiplexer 9 that is not connected to interface 11.

[0101] Here again, no MON type signal is emitted by the second interconnection device 1b. This results in a second outgoing connection 21d of the output multiplexer 10 which is not connected to the actuator 12.

[0102] Only a third outgoing connection 21c links the output multiplexer 10 of the second interconnection device 1b to the actuator 12.

[0103] The first processing means 3a is designed to exhibit COM-type operation and MON-type operation according to a first definition A. The second processing means 3b is designed to exhibit COM-type operation and MON-type operation according to a second definition B. The first processing means 3a and the second processing means 3b switch from one operation to the other depending on the signal received from the configuration means 8.

[0104] COM-type or MON-type operation, according to a first definition A or a second definition B of the first processing means 3a and the second processing means 3b, can be obtained as a result of a software instantiation (different arrangements of software instructions) or a hardware instantiation (different arrangements of discrete components).

[0105] It is noted that the first processing means 3a of the two interconnection devices la, lb are designed similarly. Likewise, the second processing means 3b of the two interconnection devices la, lb are also designed similarly. This similar design has the effect of lowering production costs, while protecting against failures through redundancy and common-mode failures through dissimilarity, as will be highlighted later.

[0106] The first processing means 3a is connected: at the input so as to receive COM type signals from interface 11 via the input multiplexer 9 and a first input connection 20a, and at the output to actuator 12 so as to transmit COM type signals via the output multiplexer 10 and a first output connection 21a.

[0107] The second processing means 3b is not connected to interface 11 or to actuator 12.

[0108] The second interconnection device 1b includes a pin-programmable configuration means 8 and multiplexers 9, 10 arranged respectively at the input and output of the second interconnection device 1b.

[0109] The configuration means 8 controls the multiplexers 9, 10 so that the COM type signals of interface 11 are directed to the second processing means 3b associated with COM type operation.

[0110] The configuration means 8 controls the output multiplexer 10 so that the signals from the second processing means 3b associated with COM-type operation are directed to the actuator 12.

[0111] The first processing means 3a is not connected to interface 11 or to actuator 12.

[0112] The second processing means 3b is connected: at the input so as to receive COM type signals from interface 11 via the input multiplexer 9 and a third input connection 20c and at the output to the actuator 12 so as to transmit COM type signals via the output multiplexer 10 and a third output connection 21c. In the example illustrated by the figure [Fig 4], the first processing means 3a of the first interconnection device la is configured in COM type operation according to a first definition A, the second processing means 3b of the second interconnection device 1b is configured in COM type operation according to a second definition B.

[0113] Note that the configuration of the interconnection devices la, lb are similar to that illustrated in Figure [Fig 3]. However, here, although the interconnection devices la, lb are defined to process COM type signals and MON type signals, only COM type signals are emitted by interface 11 and transmitted to actuator 12. Therefore, in this example, only the COM type channels of these interconnection devices la, lb are active.

[0114] In this embodiment implementing redundancy of the two COM-type channels and protection against common-mode failures due to the dissimilarity of the COM-type processing means through a different definition from each other (first definition A, second definition B).

[0115] This protection comes at the cost of a consistently high NRC (Network Reference Cost) due to the need to develop two definitions, one for each COM (Common) processing method and one for each MON (Monitor) processing method. However, the cost of the redundant control system is lower than the cost of the prior art control system because the first interconnection device (1a) and the second interconnection device (1b) have the same structure. Furthermore, the redundant control system benefits from common-mode fault protection, which is absent in the prior art solution.

[0116] Figure [Fig 5] illustrates another example of a COM-MON type redundant control system. Here again, the control system comprises two interconnection devices, α and β, each connected as input to a vehicle interface 11, for example, a human-machine interface, such as a joystick or switch, and as output to a vehicle actuator 12. In the configuration shown here, a first interconnection device α includes a first processing means 3a designed to exhibit COM-type operation.

[0117] The first processing unit 3a is connected: as an input so as to receive COM-type signals from interface 11 via an input multiplexer

[0118] 9 and a first input connection 20a and output to the actuator 12 so as to transmit COM type signals via an output multiplexer

[0119] 10 and a first output connection 21 a.

[0120] The first interconnection device includes a second processing means 3b designed to exhibit MON-type operation.

[0121] The second processing means 3b is connected: at the input so as to receive MON type signals from interface 11 via an input multiplexer

[0122] 9 and a second input connection 20b and output to actuator 12 so as to transmit MON type signals via an output multiplexer

[0123] 10 and a second output connection 21 b.

[0124] The second processing means 3b is designed to exhibit MON-type operation according to a first definition A and MON-type operation, but according to a second definition B.

[0125] MON-type operation, according to a first definition A or a second definition B of the second processing means 3b, can be obtained as a result of software instantiation (different arrangements of software instructions) or hardware instantiation (different arrangements of discrete components).

[0126] The first interconnection device la includes a pin-programmable configuration means 8 and multiplexers 9, 10 arranged respectively at the input and output of each first interconnection device la.

[0127] The first processing means 3a is connected: at the input so as to receive COM type signals from interface 11 via the input multiplexer 9 and a first input connection 20a and at the output to actuator 12 so as to transmit COM type signals via the output multiplexer 10 and a first output connection 21a.

[0128] The second processing means 3b is connected: at the input so as to receive MON type signals from interface 11 via the input multiplexer 9 and a second input connection 20b and at the output to actuator 12 so as to transmit MON type signals via the output multiplexer 10 and a second output connection 21b.

[0129] The configuration means 8 controls the input multiplexer 9a so that the MON type signals from interface 11 are directed to the second processing means 3b associated with MON type operation according to a first definition A.

[0130] The configuration means 8 controls the output multiplexer 10a so that the signals from the second processing means 3b associated with MON-type operation according to a first definition A are directed to the actuator 12.

[0131] The pin programming of the configuration means 8 allows the operation of the second processing means 3b of type MON to be chosen according to a first definition A or a second definition B.

[0132] Pin programming also allows multiplexers 9, 10 to be configured to transmit the input signal and to retrieve the output signal from the second processing means 3b associated with MON type operation.

[0133] A second interconnection device 1b includes a first processing means 3a designed to exhibit COM-type operation.

[0134] The first processing unit 3a is connected: as an input so as to receive COM-type signals from interface 11 via an input multiplexer

[0135] 9 and a third input connection 20c and output to actuator 12 so as to transmit COM type signals via an output multiplexer

[0136] 10 and a third output connection 21 c.

[0137] The second interconnection device 1b also includes a second processing means 3b designed to exhibit MON-type operation.

[0138] The second processing means 3b is connected: at the input so as to receive MON type signals from interface 11 via an input multiplexer

[0139] 9 and a fourth input connection 20d and output to actuator 12 so as to transmit MON type signals via an output multiplexer

[0140] 10 and a fourth output connection 21 d.

[0141] The second processing means 3b is designed to exhibit MON-type operation according to the first definition A or according to a second definition B. The second processing means 3b switches from one operation to the other depending on the signal received from the configuration means 8.

[0142] MON-type operation, according to a first definition A or a second definition B of the second processing means 3b, can be obtained as a result of software instantiation (different arrangements of software instructions) or hardware instantiation (different arrangements of discrete components).

[0143] The second interconnection device 1b includes a pin-programmable configuration means 8 and multiplexers 9, 10 arranged respectively at the input and output of each second interconnection device 1b.

[0144] The configuration means 8 controls the input multiplexer 9 so that MON-type signals from interface 11 are directed to the second processing means 3b associated with MON-type operation.

[0145] The configuration means 8 controls the output multiplexer 10 so that the signals from the second processing means 3b associated with MON-type operation are directed to the actuator 12.

[0146] It is noted that the first processing means 3a of the two interconnection devices la, lb are designed similarly. Likewise, the second processing means 3b of the two interconnection devices la, lb are also designed similarly. This similar design has the effect of lowering production costs, while protecting against failures through redundancy and common-mode failures through dissimilarity, as will be highlighted later.

[0147] In the example illustrated by Figure [Fig 5], the first processing means 3a of the first interconnection device la is configured in COM type operation, the second processing means 3b of the first interconnection device la is configured in MON type operation according to a first definition A, the first processing means 3a of the second interconnection device 1b is configured in COM type operation, the second processing means 3b of the second interconnection device 1b is configured in MON type operation according to a second definition B.

[0148] As in the other control systems described above, the first interconnection device 1a and the second interconnection device 1b are structurally and functionally identical. They differ only in the choice of the first definition A or the second definition B associated with the MON-type operation controlled by pin programming.

[0149] Unlike the control system illustrated in Figure [Fig 3], the multiplexers 9a, 10a described here only process MON type signals. COM type signals are transmitted directly to the first processing means 3a. The control system in this embodiment is protected by redundancy due to the presence of two COM type channels and two MON type channels, and against common mode failures because each of the MON type processing means has a different definition (first definition A for one and second definition B for the other).

[0150] This protection comes at the cost of a consistently high NRC due to the need to develop two different MON structures for each MON processing method. The cost of the redundant control system is lower than the cost of the prior art control system because the first interconnection device 1a and the second interconnection device 1b have the same structure. Furthermore, the redundant control system benefits from common-mode failure protection for the MON channel, which is absent in the prior art solution.

Claims

DEMANDS 1. Interconnection device (l, la, lb) comprising at least two transmission paths (2a, 2b) each equipped with a first processing means (3a) and a second processing means (3b), each processing means (3a, 3b) comprising two inputs and two outputs, each processing means (3a, 3b) being designed to perform two distinct functions or one function according to two distinct definitions, each distinct function among two functions or each distinct definition of a function of one of said processing means (3a, 3b) being associated with a distinct input and output of said processing means (3a, 3b), two definitions of the same function corresponding to two different component arrangements or two different arrangements of executable software instructions allowing the same function to be obtained, the interconnection device (l, 1a,1b) also being equipped with an input multiplexer (9) and an output multiplexer (10) connected respectively to the input and output of the processing means (3a, 3b), the interconnection device (l, la, lb) also being equipped with a configuration means (8) capable of configuring the multiplexers (9, 10) so that at least one input signal is transmitted to an input of one of the processing means (3a, 3b) and at least one output signal is transmitted from an output of one of the processing means (3a, 3b), the configuration means (8) also being capable of selecting one of the functions or one of the function definitions of the two processing means (3a, 3b).

2. Interconnection device (1, 1a, 1b) according to claim 1, wherein the configuration means (8) is of the pin-programmable type, each pin arrangement being associated with a function or function definition of each processing means (3a, 3b), with an input multiplexer configuration (9) and with an output multiplexer configuration (10).

3. Interconnection device (1, 1a, 1b) according to claim 2, in which pin programming activates or deactivates parts of the control process or control processes executed by the processing means.

4. Interconnection device (1, 1a, 1b) according to claim 2, wherein pin programming activates or deactivates different control processes or loads different control processes executed by the processing means.

5. Interconnection device (l, la, lb) according to any one of claims 1 to 4, wherein a function is a COM control function or a MON monitoring function.

6. Redundant control system of an actuator (12) by a human-machine interface (11), comprising a first interconnection device (1a) and a second interconnection device (1b), each according to any one of claims 1 to 5, wherein the first processing means (3a) of the first interconnection device (1a) and the first processing means (3a) of the second interconnection device (1b) are designed to perform the same distinct functions or the same distinct definitions of the same function, the second processing means (3b) of the first interconnection device (1a) and the second processing means (3b) of the second interconnection device (1b) are designed to perform the same distinct functions or the same distinct definitions of the same function, at least one processing means (3a, 3b) of the first interconnection device (1a) and at least one processing means (3a,3b) of the second interconnection device (1b) operate redundantly.

7. Redundant control system of an actuator (12) by a human-machine interface (11), according to claim 6, in which at least one processing means (3a, 3b) of the first interconnection device (1a) and at least one processing means (3a, 3b) of the second interconnection device (1b) are configured to perform the same function according to two different definitions.

8. Aircraft comprising an interface (11) and an actuator (12), characterized in that it comprises at least one redundant control system according to claim 6 or 7, processing the signals from the interface (11) in order to transmit them to the actuator (12).

Images