Flight Control Command Selection via Dual-Lane Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In fly-by-wire flight control systems for aircraft, there is a need for a method to select and distribute actuator commands from multiple redundant sources while ensuring high integrity and robustness, particularly in preventing data corruption and power control malfunctions from reaching actuators.
Innovation Solution
The system employs a command lane and a monitor lane to select and combine actuator control commands with check values, forming an actuator control command message that is validated before being sent to actuator controllers, ensuring data integrity and robustness by blocking malfunction effects.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple redundant primary controllers are used to provide actuator control commands, then reliability is improved, but device complexity increases due to the need for command selection and distribution mechanisms
Solution Approach 1:
The system segments the control architecture into distinct primary controllers and a separate command distribution mechanism (interface module with command lanes and monitor lanes). This segmentation allows multiple redundant controllers to operate independently while a dedicated distribution system handles the complexity of command selection and validation, thereby maintaining reliability without concentrating all complexity in the controllers themselves.
Solution Approach 2:
An interface module acts as an intermediary between primary controllers and actuator controllers. This intermediary contains the command selection logic, monitor lanes for validation, and distribution mechanisms. By placing the complexity management function in this intermediary component rather than in the controllers themselves, the system achieves reliable redundant control while isolating the complexity to a specialized distribution layer.
2Reliability
If command selection and validation mechanisms are implemented, then data integrity is improved, but processing time increases due to additional validation steps
Solution Approach 1:
The monitor lane performs validation checks on commands in advance before they are distributed to actuator controllers. By conducting integrity verification preliminarily within the interface module's command lanes, the system ensures data integrity is established before distribution, preventing the need for re-validation or corrective actions that would consume additional time later in the control loop.
Solution Approach 2:
The command distribution system performs self-validation through monitor lanes that automatically check command integrity without requiring external verification. This self-service validation mechanism handles integrity checks internally within the interface module, eliminating the need for additional external validation steps that would increase processing time while maintaining robust data integrity.
3Reliability
If monitor lanes generate check values for command validation, then reliability is improved by blocking malfunction effects, but device complexity increases due to additional monitoring components
Solution Approach 1:
The monitor lane functionality is merged into the existing interface module structure alongside the command lanes. Rather than adding completely separate monitoring hardware, the validation and check value generation capabilities are integrated into the command distribution architecture. This merging approach enhances robustness by incorporating monitoring functions while utilizing the existing structural framework, thereby limiting the increase in overall device complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An apparatus and method for controlling an actuator. A plurality of commands for the actuator are received from a number of primary controllers by a command lane and a monitor lane. The command lane selects a first selected number of commands from the plurality of commands using a selection rule. The monitor lane selects a second selected number of commands from the plurality of commands using the selection rule and generates a check value for the second selected number of commands. The first selected number of commands from the command lane and the check value from the monitor lane are combined to form an actuator control command message comprising the first selected number of commands and the check value. The actuator control command message is sent to an actuator controller for controlling the actuator.