초록 ▼

An automatic flight control system that is software fault tolerant fail operational in response to a first generic failure utilizes two independent subsystems each including a dual channel flight control computer. One channel in each flight control computer includes a digital processor and the other

An automatic flight control system that is software fault tolerant fail operational in response to a first generic failure utilizes two independent subsystems each including a dual channel flight control computer. One channel in each flight control computer includes a digital processor and the other channel includes two digital processors. Cross channel monitoring is included in each flight control computer to discern disagreements between the outputs of the channels. If disagreement occurs between one of the two processing elements in the channel including two processing elements and the processing element of the channel having one processing element, the involved processing element in the two-element channel is disabled. If both processing elements in the two element channel disagree with the processing element in the other channel, the subsystem is disabled. All of the processing elements perform identical tasks. The three processing elements in each subsystem provide dissimilar data processing with respect to each other. The processing elements in the single element channels provide dissimilar data processing with respect to each other. Only three unique types of dissimilar data processing are utilized.

대표청구항 ▼

An automatic flight control system for aircraft having sensor means for providing sensor signals in accordance with flight conditions experienced by said aircraft and having aircraft control means responsive to control signals for controlling the flight conditions of said aircraft, said system compr

An automatic flight control system for aircraft having sensor means for providing sensor signals in accordance with flight conditions experienced by said aircraft and having aircraft control means responsive to control signals for controlling the flight conditions of said aircraft, said system comprising at least first and second automatic flight control subsystems, said first subsystem including first and second automatic flight control system channels and said second subsystem including third and fourth automatic flight control system channels, said first, second, third and fourth automatic flight control system channels receiving said sensor signals and providing said control signals, a first digital data processing computer included in said first channel, second and third digital data processing computers included in said second channel, first cross channel monitoring means for comparing the output of said first computer with the outputs of said second and third computers and providing first and second comparison signals in accordance with disagreement therebetween, respectively, first disabling means responsive to said first comparison signal for disabling said second computer when said first comparison signal indicates disagreement between the outputs of said first and second computers, second disabling means responsive to said second comparison signal for disabling said third computer when said second comparison signal indicates disagreement between the outputs of said first and third computers, third disabling means responsive to said first and second comparison signals for disabling said first automatic flight control subsystem when said first and second comparison signals indicate disagreement between the outputs of said first and second computers and between the outputs of said first and third computers, respectively, a fourth digital data processing computer included in said third channel, fifth and sixth digital data processing computers included in said fourth channel, second cross channel monitoring means for comparing the output of said fourth computer with the outputs of said fifth and sixth computers and providing third and fourth comparison signals in accordance with disagreement therebetween, respectively, fourth disabling means responsive to said third comparison signal for disabling said fifth computer when said third comparison signal indicates disagreement between the outputs of said fourth and fifth computers, fifth disabling means responsive to said fourth comparison signal for disabling said sixth computer when said fourth comparison signal indicates disagreement between the outputs of said fourth and sixth computers, and sixth disabling means responsive to said third and fourth comparison signals for disabling said second automatic flight control subsystem when said third and fourth comparison signals indicate disagreement between the outputs of said fourth and fifth computers and the outputs of said fourth and sixth computers, respectively, said first, second, third, fourth, fifth and sixth computers performing identical tasks with respect to each other for providing said control signals in response to said sensor signals, said first, second and third computers providing dissimilar data processing with respect to each other, said fourth, fifth and sixth computers providing dissimilar data processing with respect to each other, said first and fourth computers providing dissimilar data processing with respect to each other, each of said first, second, third, fourth, fifth and sixth computers being selected from a group consisting of three computers that provide dissimilar data processing with respect to each other, whereby said automatic flight control system is fail-operational with respect to a first generic fault.