CA3045247C - Aircraft control system with residual error containment - Google Patents

Abstract

The aircraft control systems and methods disclosed herein are configured to detect a residual error associated with a flight control computer of an aircraft and mitigate the effect( s) of such residual error in order to maintain safe operation of the aircraft. In some embodiments, the systems and methods are configured to detect an out-of-flight-envelope situation of the aircraft and determine whether or not the flight control computer is attempting to recover the aircraft from the out-of-flight-envelope situation. If the flight control computer is perceived as attempting to recover the aircraft from the out-of-flight-envelope situation, the flight control computer is permitted to continue controlling the aircraft. Otherwise, the excursion outside of the normal flight envelope is perceives as potentially having been caused by a residual error and the flight control computer is prevented from continuing to control the aircraft.

Description

AIRCRAFT CONTROL SYSTEM WITH RESIDUAL ERROR CONTAINMENT CROSS REFERENCE TO RELATED APPLICATION(S)

[0001] This International PCT Patent Application relies for priority on U.S.

Provisional Patent Application Serial No. 62/428,150 filed on November 30, 2016.

TECHNICAL FIELD

[0002] The disclosure relates generally to control systems, and more particularly to control systems of aircraft.

BACKGROUND OF THE ART

[0003] Fly-by-wire (“FBW”) aircraft flight control systems are increasingly becoming the preferred type of flight control system for modern aircraft.

The FBW type of control system replaces the relatively heavier mechanical and hydromechanical types of flight control systems. A FBW flight control system commonly comprises a computer system interposed between: (1) the flight control inputs given both automatically by various aircraft component sensors and subsystems such as the autopilot, and manually by the pilots via, e.g., sidestick or yoke controllers, switches, levers, etc.; and (2) the aircraft flight control surfaces and other devices that ultimately control the operation and direction of the aircraft in flight.

[0004] With such FBW systems, there is a potential risk for an unknown residual error to exist in the software run by the computer system, where such residual error may not necessarily manifest itself during testing but could potentially manifest itself during operation of the aircraft.

Due to the unknown nature of such potential residual error it is desirable that the occurrence of such residual error be detected and that its effects be mitigated to ensure a safe operation of the aircraft.

SUMMARY

[0005] In one aspect, the disclosure describes a control system for an aircraft.

The control system comprises: a sensor configured to sense a flight parameter of the aircraft; a flight control computer operatively coupled to receive one or more signals representative of the flight parameter sensed by the sensor and configured to instructions executable by the data processor and configured to cause FCC 30 to carry out one or more control functions associated with the operation of aircraft 10 during flight.

In some embodiments, FCC 30 may be configured to operate under a self-monitoring regime to detect faults of FCC 30.

For example, FCC 30 may comprise a command lane 38 (command channel) and monitoring lane 40 (monitoring channel) with dissimilar processors (command lane-A type and monitor lane-B type).

Monitoring lane 40 may be configured to monitor the operation of command lane 38 of FCC 30 and cause FCC 30 to be taken offline if a fault is detected.

If FCC 30 is taken offline, control system 12 may then rely on alternate controller 32 for the alternate/direct mode of operation.

In cases where control system 12 comprises a plurality of redundant FCCs 30 as illustrated in FIG. 4, the fault and taking offline of one FCC 30 may cause another FCC 30 to take over the control function.

Hence using alternate controller 32 may be avoided unless all of the redundant FCCs 30 have been taken offline.

In some embodiments, FCC(s) 30 may be of the type and configured as disclosed in U.S.

Patent No. 8,818,575.

[0068] Input signals 34 may be provided by a pilot of aircraft 10 via one or more input devices 42, which may include a sidestick or yoke controller, switch(es), lever(s), etc, and/or other sources.

Input signals 34 may also include sensed signals provided by suitable sensors 44.

Input signals 34 may be representative of values derived from sensed signals acquired via sensors 44 or otherwise calculated.

For example, input signals 34 may be representative of flight parameters of aircraft 10 such as a roll angle, a pitch angle, an angle of attack, a calibrated air speed and a Mach number. FCC 30 may control one or more aspects of operation of aircraft 10 based at least in part on such flight parameters and/or other type(s) of input signals 34.

[0069] Control system 12 may also comprise one or more monitoring apparatus such as aircraft response monitoring apparatus 46 (referred hereinafter as “ARM 46”) for monitoring the operation of FCC 30 for the occurrence of a “residual error” for example. A residual error is an error that is unknown in the software run by FCC 30 and that may not manifest itself during testing of FCC 30 and of aircraft 10 but that could potentially manifest itself during operation of aircraft 10.

Due to such unknown and unpredictable nature of such potential residual error(s) in the software of FCC 30, it is desirable that the occurrence of such residual error be recognized and that its potential effects on the operation of aircraft 10 be mitigated to ensure a safe operation of aircraft 10.

More details on residual errors are provided in U.S.

Patent Publication No. 2016/0202701 A1.

[0070] In some embodiments, command lane 38 and monitoring lane 40 of FCC 30 may both run substantially identical algorithms with substantially identical CLAWS.

Accordingly, it is possible that such residual error could manifest itself in both command lane 38 and monitoring lane 40 (e.g., simultaneously) and therefore may not be detectable by monitoring lane 40.

Furthermore, since each FCC 30 of a control system 12 comprising a plurality of redundant FCCs 30 may be substantially identical and running identical software, such unknown residual error in the software could potentially be inherent to all FCCs 30.

[0071] ARM 46 may provide an independent monitoring function for detecting the occurrence of such unknown residual error in FCC 30 and mitigate its effects.

The independence of ARM 46 may be provided by the use one or more monitoring algorithms that are executed by ARM 46 that are different from the one or more command algorithms that are executed by FCC 30 so that a same residual error occurring in FCC 30 would likely not occur in ARM 46 and would therefore be detectable by ARM 46.

[0072] In various embodiments, ARM 46 may be configured to detect such residual error by detecting a situation where aircraft 10 may be operating outside of its normal flight envelope and then monitoring one or more control commands (e.g., output signals 36) being output by FCC 30 to see whether or not FCC 30 is attempting to cause aircraft 10 to return within its flight envelope.

In other words, ARM 46 may monitor the validity of the one or more control commands generated by FCC 30 during the out-of-flight-envelope situation.

The detection of the out-of-flightenvelope situation may be detected by receiving one or more signals representative of one or more flight parameters sensed by sensor(s) 44 or otherwise generated and determining that the flight parameter(s) is/are indicative of an out-of-flight-envelope situation of aircraft 10.

While aircraft 10 is in the out-of-flight-envelope situation, ARM 46 may evaluate one or more control commands output by FCC 30 and associated with the one or more flight parameters.

For example, an aileron command may be associated with the roll of aircraft and an elevator command may be associated with the pitch of aircraft 10.

If the control commands output by FCC 30 are not perceived to be trying to recover aircraft 10 from the out-of-flight-envelope control commands.

For example, evaluating the one or more control commands may comprise computing an average of successive control commands.

[0094] In some embodiments of method 100, determining that the flight parameter of aircraft 10 is indicative of the out-of-flight-envelope situation of aircraft 10 may comprise determining whether the flight parameter satisfies a persistence criterion (e.g., see criteria 58 in FIG. 7).

[0095] In some embodiments of method 100, the evaluation of the one or more control commands may be conducted using one or more monitoring algorithms that are different from one or more command algorithms used by FCC 30.

[0096] In some embodiments of method 100, the evaluation of the one or more control commands may be conducted using monitoring instructions stored in a memory partition of FCC 30 that is separate from a memory partition that stores command instructions configured to generate the one or more control commands by FCC 30.

[0097] In some embodiments of method 100, the flight parameter may include, a roll angle of aircraft 10, a pitch angle of aircraft 10, an angle of attack of aircraft 10, a calibrated air speed of aircraft 10, or a Mach number of aircraft 10.

In some embodiments of method 100, the flight parameter may include a combination of two or more of the foregoing flight parameters.

[0098] The above description is meant to be exemplary only, and one skilled in the relevant arts will recognize that changes may be made to the embodiments described without departing from the scope of the invention disclosed.

The present disclosure is intended to cover and embrace all suitable changes in technology.

Modifications which fall within the scope of the present invention will be apparent to those skilled in the art, in light of a review of this disclosure.

Claims (41)

1. WHAT IS CLAIMED IS: 1. A control system for an aircraft, the control system comprising: a sensor configured to sense a flight parameter of the aircraft; a flight control computer operatively coupled to receive one or more signals representative of the flight parameter sensed by the sensor and configured to control one or more aspects of operation of the aircraft at least partially based on the flight parameter; and a monitoring apparatus configured to: receive the one or more signals representative of the flight parameter sensed by the sensor; determine that the flight parameter is indicative of an out-of-flightenvelope situation of the aircraft; while the aircraft is in the out-of-flight-envelope situation, evaluate one or more control commands output by the flight control computer and associated with the flight parameter; determine that a residual error does not exist in the flight control computer when the one or more control commands are indicative of the flight control computer attempting to cause the aircraft to return within its flight envelope, and when the residual error is determined not to exist in the flight control computer, allow the flight control computer to continue controlling the one or more aspects of operation of the aircraft; and determine that the residual error exists in the flight control computer when the one or more control commands are indicative of the flight control computer not attempting to cause the aircraft to return within its flight envelope, and when the residual error is so determined to exist, prevent the flight control computer from controlling the one or more aspects of operation of the aircraft.
2. 2. The control system as defined in claim 1, comprising an alternate control device, and, wherein the monitoring apparatus is configured to, conditioned upon the one or more control commands being indicative of the flight control computer not attempting to 21 cause the aircraft to return within its flight envelope, allow the one or more aspects of operation of the aircraft to be controlled using the alternate control device.
3. 3. The control system as defined in claim 1, comprising an alternate control device, and, wherein the monitoring apparatus is configured to, conditioned upon the flight parameter reaching a trip limit beyond a flight envelope of the aircraft, prevent the flight control computer from controlling the one or more aspects of operation of the aircraft and allow the one or more aspects of operation of the aircraft to be controlled using the alternate control device.
4. 4. The control system as defined in any one of claims 2 and 3, wherein the alternate control device has reduced functionality relative to the flight control computer.
5. 5. The control system as defined in any one of claims 1 to 4, wherein evaluating the one or more control commands comprises computing a trend associated with a plurality of the control commands.
6. 6. The control system as defined in any one of claims 1 to 4, wherein evaluating the one or more control commands comprises computing an average of successive control commands.
7. 7. The control system as defined in any one of claims 1 to 6, wherein determining that the flight parameter of the aircraft is indicative of the out-of-flight-envelope situation of the aircraft comprises determining whether the flight parameter satisfies a persistence criterion.
8. 8. The control system as defined in any one of claims 1 to 7, wherein the monitoring apparatus is configured to use one or more monitoring algorithms that are different from one or more command algorithms used by the flight control computer.
9. 9. The control system as defined in any one of claims 1 to 8, wherein the monitoring apparatus comprises monitoring instructions stored in a memory partition of 22 the flight control computer that is separate from a memory partition that stores command instructions configured to generate the one or more control commands by the flight control computer.
10. 10. The control system as defined in any one of claims 1 to 9, wherein the flight parameter is a roll angle of the aircraft.
11. 11. The control system as defined in any one of claims 1 to 9, wherein the flight parameter is a pitch angle of the aircraft.
12. 12. The control system as defined in any one of claims 1 to 9, wherein the flight parameter is an angle of attack of the aircraft.
13. 13. The control system as defined in any one of claims 1 to 9, wherein the flight parameter is a calibrated air speed of the aircraft.
14. 14. The control system as defined in any one of claims 1 to 9, wherein the flight parameter is a Mach number of the aircraft.
15. 15. The control system as defined in any one of claims 1 to 14, wherein the flight control computer comprises a command lane and a monitoring lane.
16. 16. A monitoring apparatus for a control system of an aircraft, the monitoring apparatus comprising: one or more data processors; and non-transitory machine-readable memory storing instructions executable by the one or more data processors and configured to cause the one or more data processors to: determine that a flight parameter of the aircraft is indicative of an out-offlight-envelope situation of the aircraft while one or more aspects of operation of the aircraft are controlled using a flight control computer; 23 while the aircraft is in the out-of-flight-envelope situation, evaluate one or more control commands output by the flight control computer and associated with the flight parameter; determine that a residual error does not exist in the flight control computer when the one or more control commands are indicative of the flight control computer attempting to cause the aircraft to return within its flight envelope, and when the residual error is determined not to exist in the flight control computer, allow the flight control computer to continue controlling the one or more aspects of operation of the aircraft; and determine that the residual error exists in the flight control computer when the one or more control commands are indicative of the flight control computer not attempting to cause the aircraft to return within its flight envelope, and when the residual error is so determined to exist, prevent the flight control computer from controlling the one or more aspects of operation of the aircraft.
17. 17. The monitoring apparatus as defined in claim 16, wherein the instructions are configured to cause the one or more data processors to, conditioned upon the one or more control commands being indicative of the flight control computer not attempting to cause the aircraft to return within its flight envelope, allow the one or more aspects of operation of the aircraft to be controlled using an alternate control device.
18. 18. The monitoring apparatus as defined in claim 16, wherein the instructions are configured to cause the one or more data processors to, conditioned upon the flight parameter reaching a trip limit beyond a flight envelope of the aircraft, prevent the flight control computer from controlling the one or more aspects of operation of the aircraft and allow the one or more aspects of operation of the aircraft to be controlled using an alternate control device.
19. 19. The monitoring apparatus as defined in any one of claims 16 to 18, wherein evaluating the one or more control commands comprises computing a trend associated with a plurality of the control commands. 24
20. 20. The control system as defined in any one of claims 16 to 19, wherein evaluating the one or more control commands comprises computing an average of successive control commands.
21. 21. The monitoring apparatus as defined in any one of claims 16 to 20, wherein determining that the flight parameter of the aircraft is indicative of the out-of-flightenvelope situation of the aircraft comprises determining whether the flight parameter satisfies a persistence criterion.
22. 22. The monitoring apparatus as defined in any one of claims 16 to 21, wherein the machine-readable memory comprises a memory partition of the flight control computer that is separate from a memory partition that stores command instructions configured to generate the one or more control commands by the flight control computer.
23. 23. The monitoring apparatus as defined in any one of claims 16 to 22, wherein the flight parameter is a roll angle of the aircraft.
24. 24. The monitoring apparatus as defined in any one of claims 16 to 22, wherein the flight parameter is a pitch angle of the aircraft.
25. 25. The monitoring apparatus as defined in any one of claims 16 to 22, wherein the flight parameter is an angle of attack of the aircraft.
26. 26. The monitoring apparatus as defined in any one of claims 16 to 22, wherein the flight parameter is a calibrated air speed of the aircraft.
27. 27. The monitoring apparatus as defined in any one of claims 16 to 22, wherein the flight parameter is a Mach number of the aircraft.
28. 28. A method for controlling an aircraft during flight, the method comprising: determining that a flight parameter of the aircraft is indicative of an out-of-flightenvelope situation of the aircraft while one or more aspects of operation of the aircraft are controlled using a flight control computer; while the aircraft is in the out-of-flight-envelope situation, evaluating one or more control commands output by the flight control computer and associated with the flight parameter; determining that a residual error does not exist in the flight control computer when the one or more control commands are indicative of the flight control computer attempting to cause the aircraft to return within its flight envelope, and when the residual error is determined not to exist in the flight control computer, allowing the flight control computer to continue controlling the one or more aspects of operation of the aircraft; and determining that the residual error exists in the flight control computer when the one or more control commands are indicative of the flight control computer not attempting to cause the aircraft to return within its flight envelope, and when the residual error is so determined to exist, preventing the flight control computer from controlling the one or more aspects of operation of the aircraft.
29. 29. The method as defined in claim 28, comprising, conditioned upon the one or more control commands being indicative of the flight control computer not attempting to cause the aircraft to return within its flight envelope, allowing the one or more aspects of operation of the aircraft to be controlled using an alternate control device of the aircraft.
30. 30. The method as defined in claim 28, comprising, conditioned upon the flight parameter reaching a trip limit beyond a flight envelope of the aircraft, preventing the flight control computer from controlling the one or more aspects of operation of the aircraft and allowing the one or more aspects of operation of the aircraft to be controlled using an alternate control device of the aircraft.
31. 31. The method as defined in any one of claims 29 and 30, wherein the alternate control device has reduced functionality relative to the flight control computer. 26
32. 32. The method as defined in any one of claims 28 to 31, wherein evaluating the one or more control commands comprises computing a trend associated with a plurality of the control commands.
33. 33. The method as defined in any one of claims 28 to 31, wherein evaluating the one or more control commands comprises computing an average of successive control commands.
34. 34. The method as defined in any one of claims 28 to 33, wherein determining that the flight parameter of the aircraft is indicative of the out-of-flight-envelope situation of the aircraft comprises determining whether the flight parameter satisfies a persistence criterion.
35. 35. The method as defined in any one of claims 28 to 34, wherein the evaluation of the one or more control commands is conducted using one or more monitoring algorithms that are different from one or more command algorithms used by the flight control computer.
36. 36. The method as defined in any one of claims 28 to 35, wherein the evaluation of the one or more control commands is conducted using monitoring instructions stored in a memory partition of the flight control computer that is separate from a memory partition that stores command instructions configured to generate the one or more control commands by the flight control computer.
37. 37. The method as defined in any one of claims 28 to 36, wherein the flight parameter is a roll angle of the aircraft.
38. 38. The method as defined in any one of claims 28 to 36, wherein the flight parameter is a pitch angle of the aircraft.
39. 39. The method as defined in any one of claims 28 to 36, wherein the flight parameter is an angle of attack of the aircraft. 27
40. 40. The method as defined in any one of claims 28 to 36, wherein the flight parameter is a calibrated air speed of the aircraft.
41. 41. The method as defined in any one of claims 28 to 36, wherein the flight parameter is a Mach number of the aircraft.