Testing of redundant control systems

Claim 2

Method of testing redundant control circuit systems, wherein a plurality of control circuits operate in parallel and are supervised by a monitor, the monitor disconnecting defective control circuits from the system during norMal operation, comprising the steps of: a. testing the monitor as to its response capability to distinguish between similar and dissimilar outputs of the control circuits; b. providing representation of the state of the monitor; c. providing subsequently simulated, similar inputs to the control circuits, varying in unison over a particular range; and d. using the monitor to test persistence of similarity of outputs of the control circuits as the similar inputs vary over the particular range.

Claim 3

Method as in claim 1, the monitor test comprising, first applying control signals to the monitor in representation of different outputs of the control circuit, differing by a value below the threshold of monitor response; second, applying corresponding control signals to the monitor differing by a value in excess of the monitor threshold.

Claim 4

Method as in claim 2, the monitor test including applying control signals to the inputs of the control circuits, the first and second control signals developed by the control circuits themselves in response thereto to be effective in the monitor.

Claim 5

Method as in claim 2, the control signals being applied to the monitor directly in lieu of outputs of the control circuits.

Claim 6

Method as in claim 1, the simulated inputs provided through stimulation of transducers connected to the inputs of the control circuits.

Claim 7

Method as in claim 1, the test including testing the reaction of an actuator controlled by the plurality of circuits as operating in parallel.

Claim 8

Method as in claim 1, preceded by a test in which the test sequence of the steps (a) through (d) is run through at a high speed for each test to lead to an error indications; counting the number of error indications and correlating the number with the total number of tests conducted.

Claim 9

Method as in claim 1, the connect state of the outputs of the control circuits being represented by switch state signals, the monitor test including, comparing the switch state signals with reference signals representing the desired switch state for input test signals applied to the monitor.

Claim 10

Method as in claim 1, including the step of stopping the test sequence upon detection of defect.

Claim 11

Method for testing the principle components of a redundancy control system having at least three parallely operating control circuits, the system further including a monitor and a switching circuit, the monitor for responding to incorrect operation of and defective control circuits, to control disconnection thereof by means of the switching circuit, comprising: simulating operational signals of the control circuits in representation of different operational states, including first signals controlled for representing differing control circuit outputs, and second signals controlled for representing similar control circuit outputs; and providing indication of monitor response to the different operational signals.

Claim 12

Method for testing the principle components of a redundancy control system having at least three parallely operating control circuits, the system further including a monitor and a switching circuit, the monitor for responding to incorrect operation of and defective control circuits, to control disconnection thereof by means of the switching circuit, comprising: simulating operational signals of the control circuits in representation of different operational states, including first signals controlled for representing differing control circuit outputs, and second signals controlled for representing similar control circuit outputs; and providing indication of monitor response to the different operational signals.

Claim 13

A circuit for testing the principle components of a redundancy control system, having at least three parallely operating control circuits, the system further including a monitor and a switching circuit, the monitor for responding to incorrect operation of and defective control circuits, to control disconnection thereof by means of the switching circuit, comprising: means connected for simulating operational signals of the control circuits in representation of different operational states, including first signals controlled for representing differing control circuit outputs, and second controlled for representing similar control circuit outputs; and means connected to provide indication of monitor response to the different operational signals.

Claim 14

A circuit for testing the principle components of a redundancy control system, having at least three parallely operating control circuits, the system further including a monitor and a switching circuit, the monitor for responding to incorrect operation of and defective control circuits, to control disconnection thereof by means of the switching circuit, comprising: means connected for simulating operational signals of the control circuits in representation of different operational states, including first signals controlled for representing differing control circuit outputs, and second controlled for representing similar control circuit outputs; and means connected to provide indication of monitor response to the different operational signals.

Claim 15

A circuit as in claim 11, the first signals applied to the inputs of the control circuit, the circuit including program means to cause first signals as applied to respective two control circuits to differ by particular amounts.

Claim 16

A circuit as in claim 12, additional first signals being provided by The program means to differ to the extent that the resulting outputs differ by value less than the response of the monitor.

Claim 17

A circuit as in claim 11, there being transducers connected to provide regular inputs for the control circuits, the test device including means for activating the transducers under control of the program means, to obtain the second signals.

Claim 18

A circuit as in claim 11, there being means to provide representation of the state of the switching circuit, the program means providing representation of the desired state of the switching circuit commensurate with the correct response by the monitor to the operational signals, there being means connected to provide indication of any difference in the two representations.

Claim 19

A circuit as in claim 11, including program means for conducting a sequence of tests by providing a particular sequence of test signals, there being means to cause the test signals to operate the control circuits.

Claim 20

A circuit as in claim 11, including a control signal generator having plural outputs respectively coupled to the control circuits, to obtain simulated operational signals for zero input as provided by transducers to the inputs of the control circuit so as to test operativeness of the monitor.

Claim 21

A circuit for cooperation with a redundancy flight control system, having at least three parallely operating control circuits, a monitor connected to the control circuits for supervising operation thereof, and a disconnect and switching system to disconnect defective control circuits, comprising: a first test signal generator connected to simulate monitor inputs for testing response of the monitor as to control of disconnect operation of the disconnect system; a second test signal generator connected to cause the control circuits to respond respectively to inputs varying over a particular range; means connected to detect response of the monitor to any dissimilarity in outputs of the control circuits as said inputs vary over the particular range; and program means connected to sequentially operate the first and second test signal generators.

Claim 22

A circuit for cooperation with a redundancy flight control system, having at least three parallely operating control circuits, a monitor connected to the control circuits for supervising operation thereof, and a disconnect and switching system to disconnect defective control circuits, comprising: a first test signal generator connected to simulate monitor inputs for testing response of the monitor as to control of disconnect operation of the disconnect system; a second test signal generator connected to cause the control circuits to respond respectively to inputs varying over a particular range; means connected to detect response of the monitor to any dissimilarity in outputs of the control circuits as said inputs vary over the particular range; and program means connected to sequentially operate the first and second test signal generators.

Claim 23

A circuit as in claim 18, the first signal generator coupled to the control circuits and providing first signals in response to which the monitor is not to respond, and second signal in response to which the monitor is to respond to operate the disconnect system; the program means providing a sequence of reference signals that represent the correct state of the disconnect system.

Claim 24

A circuit as in claim 18, including means for testing actuating means operated by the parallely operating control circuits.