Aircraft Actuator Backup Control Architecture Against Common-Mode Failure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Aircraft actuation and propulsion engine control systems face challenges in mitigating common mode failures due to design and manufacturing errors in complex electronic hardware, leading to potential catastrophic results when multiple controllers are deactivated simultaneously.
Innovation Solution
The implementation of a command monitor backup control architecture that includes a first and second command module with different electronic configurations and a monitor module, allowing the actuator to be controlled using the second control signal when the first command module is deactivated or malfunctioning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional command/monitor module pairs are used with identical electronic configurations, then manufacturing simplicity is maintained, but common mode failures can deactivate all controllers simultaneously leading to catastrophic results
Solution Approach 1:
The patent applies asymmetry by configuring the first and second command modules with different electronic configurations. This asymmetric design ensures that a common mode failure affecting one configuration will not necessarily affect the other, thereby preventing simultaneous deactivation of all controllers and improving system reliability.
Solution Approach 2:
The patent segments the control system into multiple independent command modules (first and second command modules) with distinct electronic configurations. This segmentation isolates potential failures to specific modules, allowing other segments to continue operating and maintaining overall system functionality.
2Ease of manufacture
If multiple controllers with identical configurations are used, then ease of manufacture is improved, but the loss of actuation functionality increases when common mode failures occur
Solution Approach 1:
The patent implements asymmetry in the electronic configurations of parallel command modules. While this increases manufacturing complexity compared to identical modules, it ensures that common mode failures cannot simultaneously disable all controllers, thereby preserving actuation functionality and improving reliability.
Solution Approach 2:
The patent changes the electronic configuration parameters of the command modules to be different from each other. This parameter differentiation ensures that failures affecting one configuration do not propagate to others, maintaining system functionality despite the increased manufacturing complexity.
3Reliability
If backup command modules with different electronic configurations are implemented, then system reliability is improved against common mode failures, but device complexity increases
Solution Approach 1:
The patent segments the control system into multiple independent command modules with different electronic configurations. This segmentation creates functional redundancy where failure of one module does not compromise the entire system, improving backup reliability while managing complexity through modular architecture.
Solution Approach 2:
The patent implements preliminary action by pre-configuring multiple command modules with different electronic configurations before operation. This preparatory measure ensures that if one module fails, another is already in place and configured to take over, improving reliability without requiring complex real-time reconfiguration.
Data Source
AI summary
System, methods, and machine-readable media may facilitate control of an aircraft. An actuator may be controlled based on the following. A first control signal may be output, with a first command module, to control the actuator. The first command module may include a first electronic configuration. Commands generated by the first command module and/or system response signals may be monitored with a monitor module. The monitor module may include a third electronic configuration that is different from the first electronic configuration. A second control signal may be output, with a second command module, to control the actuator when the first command module is deactivated or malfunctioning. The second command module may include a second electronic configuration that is different from the first electronic configuration and the third electronic configuration. The actuator may be controlled using the second control signal when the first command module is deactivated or malfunctioning.