Flight Control Monitoring for Residual Error Containment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Fly-by-wire aircraft flight control systems face the risk of unknown residual errors in their software, which may not manifest during testing but could occur during operation, potentially leading to unsafe conditions.
Innovation Solution
A control system that includes a sensor to detect flight parameters, a flight control computer, and a monitoring apparatus to evaluate control commands. The monitoring apparatus determines if the flight control computer is attempting to return the aircraft within its flight envelope; if not, it prevents the computer from controlling the aircraft, allowing an alternate control device to take over, ensuring safe operation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If a flight control computer is used to control aircraft operation, then automation and control precision are improved, but the risk of residual software errors increasing system unreliability worsens
Solution Approach 1:
A monitoring apparatus is introduced as an intermediary component between the flight control computer and the aircraft control surfaces. This monitoring apparatus independently evaluates control commands generated by the flight control computer, checking whether they attempt to return the aircraft within its flight envelope. The monitoring apparatus acts as a safety mediator that can prevent erroneous commands from reaching the control surfaces while allowing valid commands to pass through, thus resolving the contradiction between automation and reliability.
2Reliability
If residual error detection and mitigation systems are added, then system reliability is improved, but device complexity increases
Solution Approach 1:
The control system is segmented into functionally independent components: the flight control computer that generates control commands, and the monitoring apparatus that independently evaluates those commands. This segmentation allows the monitoring function to be added without modifying the core flight control software, thereby improving reliability while minimizing the increase in overall system complexity. The monitoring apparatus uses a separate, simplified evaluation logic focused solely on detecting whether commands attempt to return the aircraft within the flight envelope.
3Object-affected harmful factors
If the monitoring apparatus prevents control commands during out-of-envelope situations, then safety is improved, but loss of control authority worsens
Solution Approach 1:
The monitoring apparatus dynamically adjusts its level of intervention based on the aircraft's flight envelope status. When the aircraft is within the flight envelope, the monitoring apparatus allows all control commands to pass through without restriction, maintaining full control authority. When the aircraft exits the flight envelope, the monitoring apparatus activates its evaluation function, dynamically preventing only those commands that would exacerbate the out-of-envelope condition. This dynamic approach ensures safety during critical situations while preserving ease of operation during normal flight.
Data Source
AI summary
The aircraft control systems and methods disclosed herein are configured to detect a residual error associated with a flight control computer of an aircraft and mitigate the effect(s) of such residual error in order to maintain safe operation of the aircraft. In some embodiments, the systems and methods are configured to detect an out-of-flight-envelope situation of the aircraft and determine whether or not the flight control computer is attempting to recover the aircraft from the out-of-flight-envelope situation. If the flight control computer is perceived as attempting to recover the aircraft from the out-of-flight-envelope situation, the flight control computer is permitted to continue controlling the aircraft. Otherwise, the excursion outside of the normal flight envelope is perceives as potentially having been caused by a residual error and the flight control computer is prevented from continuing to control the aircraft.