Two-way architecture

Patent metadata

Field	Value
Publication number	US-10162314-B2
Application number	US-201515508455-A
Country	US
Kind code	B2
Filing date	Sep 4, 2015
Priority date	Sep 5, 2014
Publication date	Dec 25, 2018
Grant date	Dec 25, 2018

Abstract

The present invention concerns a method for switching, by a local processing unit ( 1,2 ) of a flight control system of an aircraft, configured to control at least one local actuator, connected to at least one local sensor and connected via at least one link ( 3,4 ) to an opposite processing unit ( 2,1 ) configured to control at least one opposite actuator and be connected to at least one opposite sensor, said local processing unit ( 1,2 ) being further configured to be connected to backup communication means ( 13,14 ) enabling data exchanges between the local processing unit ( 1,2 ) and the opposite processing unit ( 2,1 ) in the case of failures of the links connecting same ( 3,4 ), said backup communication means comprising an array of sensors or actuators ( 13 ) and/or a secure onboard network for the avionics ( 14 ), comprising steps of: •—sending, to the opposite processing unit ( 2,1 ), acquisition data relative to the at least one local sensor and actuator data relative to the at least one local actuator, •—receiving, from the opposite processing unit ( 2,1 ), acquisition data relative to the at least one opposite sensor and actuator data relative to the at least one opposite actuator, •—receiving an item of opposite health data and determining an item of local health data, •—switching said local processing unit ( 1,2 ) from a first state to a second state chosen from an active state ( 15 ), a passive state ( 16 ) and a slave state ( 18 ), depending on the opposite health data received and the local health data determined.

First claim

The invention claimed is:

1. A switching method applied by a first processing unit, called local processing unit, of a flight control system of an aircraft comprising at least one engine,
said local processing unit being configured for controlling at least one actuator, called local actuator, so as to control the engine of the aircraft, and being able to be connected to at least one local sensor and to be connected via at least one link to a second processing unit, called opposite processing unit, configured for controlling at least one opposite actuator and being connected to at least one opposite sensor, said local processing unit being further configured so as to be connected to emergency communication means giving the possibility of ensuring exchanges of data between the local processing unit and the opposite processing unit in the case of failures of said at least one link connecting them, said emergency communication means comprising at least one of a network of sensors, a network of actuators and an onboard secure network for avionics,
said method comprising steps of:
sending to the opposite processing unit acquisition data relative to the at least one local sensor and actuator data relative to the at least one local actuator,
receiving from the opposite processing unit acquisition data relative to the at least one opposite sensor and actuator data relative to the at least one opposite actuator,
receiving a health datum relative to the health condition of the opposite processing unit, called opposite health datum,
determining a health datum relative to the health of said local processing unit, called local health datum,
switching of said local processing unit from a first state to a second state, depending on said received opposite health datum and on said determined local health datum,

said steps of sending, receiving acquisition data and of receiving a health datum being applied via said at least one link or said emergency communication means, and said states being from among an active state in which the local processing unit ensures control of the engine of the aircraft, a passive state in which the local processing unit does not ensure the control of the engine of the aircraft and a slave state in which the local processing unit gives over to the opposite processing unit the control of said local actuators for controlling the engine of the aircraft,
wherein the switching step comprises:
determining, from the local health datum, a state datum relative to the state of said local processing unit and from a health status datum of the local processing unit relative to the capability of the local processing unit of ensuring control of the engine, and
switching said local processing unit into the slave state:
when the state datum indicates that the local processing unit is in a passive state and,
when the health status datum indicates a status in which:
the local processing unit is capable of communicating with the opposite processing unit,
the local processing unit is incapable of ensuring the control of the engine,
and the local processing unit is capable of controlling the local actuators.

2. The method according to claim 1 , wherein
the opposite processing unit and the local processing unit being connected via on a first bidirectional digital link and via a second bidirectional digital link,
and the opposite processing unit transmitting an opposite health datum over each of the links,
the step of receiving an opposite health datum comprises receiving a first opposite health datum over the first link and a second redundant opposite health datum over the second link, verifying consistency of said first and second received health data, and determining said opposite health datum transmitted depending on said verification.

3. The method according to claim 2 , wherein determining the transmitted opposite health datum comprises, when said first and second received health data are not consistent, a consolidation step during which the transmitted opposite health datum is determined from data received over at least two successive frames.

4. The method according to claim 1 , wherein receiving an opposite health datum comprises verifying integrity of said received health datum.

5. The method according to claim 1 , wherein determining a local health datum comprises diagnosing the health condition relative to the hardware and to the software of said local processing unit.

6. The method according to claim 1 , wherein the switching step comprises:
a determination step, in which said local processing unit determines from said local and opposite health data that its health condition is better than that of the opposite processing unit,
a waiting step in which said local processing unit waits for the opposite processing unit to switch into the passive state,
switching the local processing unit into the active state.

7. A computer program product comprising non-transitory code instructions for executing a switching method according to claim 1 when this program is executed by a processor.

8. A flight control system comprising two processing units of a flight control system of an aircraft comprising at least one engine, each processing unit configured for controlling at least one actuator, called local actuator, so as to control the engine of the aircraft,
said processing unit, called local processing unit, being able to be connected to at least one local sensor and to be connected via at least one link to a second processing unit, called opposite processing unit, configured for controlling at least one opposite actuator and being connected to at least one opposite sensor, said local processing unit being further configured so as to be connected to emergency communication means giving the possibility of ensuring exchanges of data between the local processing unit and the opposite processing unit in the case of failures of said at least one link connecting them, said emergency communication means comprising at least one of a network of sensors, a network of actuators and an onboard secure network for avionics,
and wherein the processing unit is further configured to:
send to the opposite processing unit acquisition data relative to the at least one local sensor and actuator data relative to the at least one local actuator,
receive from the opposite processing unit, acquisition data relative to the at least one opposite sensor and actuator data relative to the at least one opposite actuator,
receive a health datum relative to the health condition of the opposite processing unit, called opposite health datum,
determining a health datum relative to the health of said local processing unit, called local health datum,
wherein the processing unit further comprises a switch for switching said local processing unit from a first state to a second state, depending on said received opposite health datum and on said determined local health datum,
said states being from among an active state in which the local processing unit ensures control of the engine of the aircraft, a passive state in which the local processing unit does not ensure the control of the engine of the aircraft and a slave state in which the local processing unit gives over to the opposite processing unit the control of said local actuators for controlling the engine of the aircraft,
further comprising the emergency communication means giving the possibility of ensuring exchanges of data between the local processing unit and the opposite processing unit in the case of failures of the links connecting them, said emergency communication means comprising the network of sensors or actuators and/or the onboard secure network for avionics.

9. The flight control system

Assignees

• Sagem Defense Securite
• Turbomeca
• Safran Electronics And Defense
• Safran Helicopter Engines

Inventors

• Liu Celine
• Marti Nicolas
• Langford Stephen

Classifications

• G05B2219/25163

  Transmit twice, redundant, same data on different channels, check each channel · CPC title

• G05B2219/25174

  Ethernet · CPC title

• G05B2219/23316

  Standby, inactive, sleep or active, operation mode · CPC title

• G05B2219/25144

  Between microcomputers, processors · CPC title

• G06F11/3089

  Monitoring arrangements determined by the means or processing involved in sensing the monitored data, e.g. interfaces, connectors, sensors, probes, agents (software debugging using additional hardware using a specific debug interface G06F11/3656; performance evaluation by tracing or monitoring G06F11/3466) · CPC title