System and method for maintaining system integrity in control systems having multi-lane computational differences

Patent metadata

Field	Value
Publication number	US-9611033-B1
Application number	US-201514864846-A
Country	US
Kind code	B1
Filing date	Sep 24, 2015
Priority date	Sep 24, 2015
Publication date	Apr 4, 2017
Grant date	Apr 4, 2017

Abstract

A control system for an aircraft including first and second lanes having respective first and second processors dissimilar to one another and configured to output respective first and second computation data. At least one programmable logic device may be configured to receive the first computation data output and the second computation data output, determine a difference therebetween, and transmit a corrective computation data output to the first processor and the second processor via respective feedback loops if the difference between the first computation data output and the second computation data output exceeds a predetermined threshold value.

First claim

We claim:

1. A control system for an aircraft, comprising:
a first lane configured to communicate with one or more sensors configured to generate event data utilized in controlling the aircraft, the first lane comprising:
a first processor configured to receive input data comprising the event data from the one or more sensors and to generate a first computation data output in electronic communication with one or more actuators or instrumentation utilized in operation of the aircraft;

a second lane configured to communicate with the one or more sensors, the second lane comprising:
a second processor configured to receive the input data comprising the event data from the one or more sensors and to generate a second computation data output;

a comparator in electronic communication with the first processor and the second processor, the comparator configured to receive the first computation data output and the second computation data output and to transmit a command signal operable to prohibit the electronic communication between the first processor and the one or more actuators or instrumentation if a first difference between the first computation data output and the second computation data output exceeds a first predetermined threshold value; and
at least one programmable logic device in electronic communication with the first processor and the second processor, the at least one programmable logic device configured to receive the first computation data output and the second computation data output, determine a second difference between the first computation data output and the second computation data output, and transmit a corrective computation data output to the first processor and the second processor via respective feedback loops if the difference between the first computation data output and the second computation data output exceeds a second predetermined threshold value, wherein the input data further comprises the corrective computation data output.

2. The control system of claim 1 , wherein the at least one programmable logic device comprises:
a first programmable logic device configured to receive the first computation data output and the second computation data output, determine the second difference between the first computation data output and the second computation data output, and transmit the corrective computation data output to the first processor via a first feedback loop if the second difference between the first computation data output and the second computation data output exceeds the second predetermined threshold value; and
a second programmable logic device configured to receive the first computation data output and the second computation data output, determine the second difference between the first computation data output and the second computation data output, and transmit the corrective computation data output to the second processor via a second feedback loop if the second difference between the first computation data output and the second computation data output exceeds the second predetermined threshold value.

3. The control system of claim 2 , wherein:
the corrective computation data output is limited in magnitude by a third predetermined threshold value;
the input data further comprises the corrective computation data output;
the first processor is further configured to generate the first computation data output based on the event data received from the one or more sensors and the corrective computation data transmitted from the first programmable logic device; and
the second processor is further configured to generate the second computation data output based on the event data received from the one or more sensors and the corrective computation data transmitted from the second programmable logic device.

4. The control system of claim 2 , wherein the first programmable logic device is dissimilar in hardware and software to the second programmable logic device.

5. The control system of claim 1 , wherein the at least one programmable device is a field programmable gate array.

6. The control system of claim 1 , wherein the first processor is dissimilar in hardware and software to the second processor.

7. The control system of claim 1 , wherein the first lane further comprises a switch in electronic communication with the comparator and configured to prohibit electronic communication between the first processor and the one or more actuators or instrumentation upon receipt of the command signal.

8. The control system of claim 1 , wherein:
the corrective computation data output is limited in magnitude by a third predetermined threshold value;
the first processor is further configured to generate the first computation data output based on the event data received from the one or more sensors and the corrective computation data transmitted from the at least one programmable logic device; and
the second processor is further configured to generate the second computation data output based on the event data received from the one or more sensors and the corrective computation data transmitted from the at least one programmable logic device.

9. The control system of claim 1 , wherein the comparator is a field programmable gate array and the at least one programmable logic device is the field programmable gate array.

10. The control system of claim 1 , wherein the first processor and the second processor are configured to receive the input data asynchronously.

11. A monitoring method for a control system of an aircraft, comprising:
transmitting event data generated from one or more sensors indicative of operation characteristics of the aircraft to a first processor of a first computation lane and a second processor of a second computation lane;
processing input data comprising the event data in the first processor and generating a first computation data output in electronic communication with one or more actuators or instrumentation utilized in operation of the aircraft;
processing the input data comprising the event data in the second processor and generating a second computation data output;
transmitting a command signal operable to prohibit the electronic communication between the first processor and the one or more actuators or instrumentation if a first difference between the first computation data output and the second computation data output exceeds a first predetermined threshold value;
determining a second difference between the first computation data output and the second computation data output in at least one programmable logic device;
calculating a corrective computation data output if the second difference exceeds a second predetermined threshold value stored in the at least one programmable logic device; and
feeding the corrective computation data output to the first processor and the second processor via respective feedback loops if the second difference exceeds the second predetermined threshold value, wherein the input data further comprises the corrective computation data output.

12. The monitoring method of claim 11 , further comprising:
determining the first difference between the first computation data output and the second computation data output via a comparator.

13. The monitoring method of claim 12 , wherein:
the at least one programmable logic device comprises a first programmable logic device and a second programmable logic device;
feeding the corrective computation data output to the first processor and the second processor further comprises:
feeding the corrective computation data output to the first processor from the first programmable logic device via a first feedback loop, and feeding

Assignees

• Kovalan Mark A
• Singer Mark Clifford
• Johnson Douglas R
• Rockwell Collins Inc

Inventors

• Kovalan Mark A
• Singer Mark Clifford
• Johnson Douglas R

Classifications

• B64C19/00 Primary

  Aircraft control not otherwise provided for · CPC title

• G05B19/05

  Programmable logic controllers, e.g. simulating logic interconnections of signals according to ladder diagrams or function charts · CPC title

• G05B9/03 Primary

  with multiple-channel loop, i.e. redundant control systems · CPC title

• G05B19/042

  using digital processors (G05B19/05 takes precedence) · CPC title