Autopilot flight director system

Claim 2

An aircraft autopilot flight director system comprising: first, second and third redundant sensor sets, each sensor set producing predetermined output data signals related to the status of the aircraft; first, second and third flight control computers, each computer including means for: (a) comparing the associated sensor signal set with the sensor signal sets of the other two flight control computers and identifying a failure in response to a predetermined discrepancy there between; (b) processing said first, second and third sensor set data signals and producing a reference sensor signal set; (c) processing said reference sensor signal set and producing command control signals; (d) comparing said produced command control signals with the command control signals produced by the other two flight control computers and identifying a self-failure in response to a predetermined discrepancy there between; utilization means for utilizing the command control signals from at least two of the flight control computers as aircraft surface control commands; and common mode fault detection means, utilizing apparatus and control laws unique from any of said first, second and third flight control computers, for independently producing command control signals, said common mode fault means including means for comparing each of said first, second and third flight control computer produced control signals with said independently produced control signals and identifying as a failure each of said computers which produces command controls which deviate from said independently produced command control signal by a predetermined value.

Claim 3

The system of claim 1 wherein each of said flight control computers further includes means for: comparing its assocated sensor signal set with the sensor signal sets associated with the other two flight control computers and identifying a condition wherein the sensor signal sets of two flight computers agree within a predetermined tolerance whereas the sensor signal set of the remaining flight computer is outside of said predetermined tolerance.

Claim 4

The system of claim 2 wherein the utilization means comprises: first transducer means coupled to said first flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; second transducer means coupled to said third flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; and means for combining the mechanical outputs from the first and second transducers and coupling the resultant mechanical output to a predetermined control surface of the aircraft.

Claim 5

The system of claim 3 further comprising: a first transducer sensor for producing an output signal representative of the mechanical output of said first transducer; a second transducer sensor for producing an output signal representative of the mechanical output of said second transducer; means for coupling said first transducer sensor output signal to the first flight control computer and said second transducer sensor output signal to the third flight control computer; and wherein each flight control computer includes means for producing a model transducer sensor signal; said first flight control computer including means for comparing its model transducer produced sensor signal with the first transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween, said first flight control computer otherwise comparing the first transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the second transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the first transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure; said second flight control computer including means for comparing its model transducer produced sensor signal with the first and second transducer sensor produced signals and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second flight control computer model signal is the outside of tolerance signal, the failure otherwise being identified as a cross-channel failure; and said third flight control computer including means for comparing its model transducer produced sensor signal with the second transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween; said third flight control computer otherwise comparing the second transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the first transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure.

Claim 6

The system of claim 4 wherein each of said flight control computers further includes means for: comparing its produced command control signals with the produced command control signals of the other two flight control computers and identifying a condition wherein the produced command control signals of two flight computers agree within a predetermined tolerance whereas the produced command control signal of the remaining flight computer is outside of said predetermined tolerance, this condition being identified as a self-failure if the computer performing the comparison is the out of tolerance computer, the condition otherwise being identified as a cross-channel failure.

Claim 7

The system of claim 5 wherein each flight control computer includes means for self deactivation from continued system service in response to identifying itself as a self-failure.

Claim 8

The system of claim 6 wherein the flight control computers include means for deactivating that flight control computer identified as exhibiting a cross-channel failure by both of the remaining flight control computers.

Claim 9

The system of claim 4 wherein each flight control computer includes means for self deactivation from continued system service in response to identifying itself as a self-failure.

Claim 10

The system of claim 8 wherein the flight control computers include means for deactivating that flight control computer identified as exhibiting a cross-channel failure by both of the remaining flight control computers.

Claim 11

The system of claim 3 wherein each of said flight control computers further includes means for: comparing its produced command control signals with the produced command control signals of the other two flight control computers and identifying a condition wherein the produced command control signals of two flight computers agree within a predetermined tolerance whereas the produced command control signal of the remaining flight computer is outside of said predetermined tolerance, this condition being identified as a self-failure if the computer performing the comparison is the out of tolerance computer, the condition otherwise being identified as a cross-channel failure.

Claim 12

The system of claim 3 wherein each flight control computer includes means for self deactivation from continued system service in response to identifying itself as a self-failure.

Claim 13

The system of claim 11 wherein the flight control computers include means for deactivating that flight control computer identified as exhibiting a cross-channel failure by both of the remaining flight control computers.

Claim 14

The system of claim 2 wherein each flight control computer includes means for ignoring the data signals from an identified failed sensor signal set.

Claim 15

The system of claim 13 wherein the flight control computers include means for deactivating that flight control computer identified as exhibiting a cross-channel failure by both of the remaining flight control computers.

Claim 16

The system of claim 2 wherein the flight control computers include means for deactivating all flight control computers from continued system service in response to identifying two of said computers as self-failures or cross-channel failures.

Claim 18

The system of claim 16 wherein the f1ight control computers include means for deactivating all flight control computers from continued system service in response to identifying two of said computers as self failures or cross-channel failures.

Claim 19

The system of claim 1 wherein the utilization means comprises: first transducer means coupled to said first flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; second transducer means coupled to said third flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; and means for combining the mechanical outputs from the first and second transducers and coupling the resultant mechanical output to a predetermined control surface of the aircraft.

Claim 20

The system of claim 18 further comprising: a first transducer sensor for producing an output signal representative of the mechanical ouput of said first transducer; a second transducer sensor for producing an output signal representative of the mechanical output of said second transducer; means for coupling said first transducer sensor output signal to the first flight control computer and said second transducer sensor output signal to the third flight control computer; and wherein each flight control computer includes means for producing a model transducer sensor signal; said first flight control computer including means for comparing its model transducer produced sensor signal with the first transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween, said first flight control computer otherwise comparing the first transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the second transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the first transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure; said second flight control computer including means for comparing its model transducer produced sensor signal with the first and second transducer sensor produced signals and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second flight control computer model signal is the outside of tolerance signal, the failure otherwise being identified as a cross-channel failure; and said third flight control computer including means for comparing its model transducer produced sensor signal with the second transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween; said third flight control computer otherwise comparing the second transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the first transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure.

Claim 21

The system of claim 19 wherein each flight control computer includes means for self deactivation from continued system service in response to identifying itself as a self-failure.

Claim 22

The system of claim 20 wherein the flight control computers include means for deactivating that flight control computer identified as exhibiting a cross-channel failure by both of the remaining flight control computers.

Claim 23

The system of claim 19 wherein the flight control computers include means for deactivating all flight control computers from continued system service in response to identifying two of said computers as self-failures or cross-channel failures.

Claim 24

The system of claim 18 further comprising: limiting means for limiting the mechanical output of each of said first and second transducer means to a predetermined maximum; and bias means for applying a predetermined mechanical bias to said control surface of the aircraft such that in the event one of the first and second transducer means produces a mechanical output that is limited by the limiting means, the combined output of the remaining transducer means and the bias means tends to activate the control surface to a position of trimmed aircraft flight.

Claim 27

The system of claim 24 wherein the flight control computers include means for deactivating all flight control computers from continued system service in response to identifying two of said computers as self-failures.

Claim 28

An aircraft autopilot flight director system comprising: first, second and third redundant sensor sets, each sensor set producing predetermined output data signals related to the status of the aircraft; first, second and third flight control computers, each computer including means for: (a) comparing the associated sensor signal set with the sensor signal sets of the other two flight control computers and identifying a failure in response to a predetermined discrepancy therebetween; (b) processing said first, second and third sensor set data signals and producing a reference sensor signal set; (c) processing said reference sensor signal set and producing command control signals; (d) comparing said produced command control signals with the command control signals produced by the other two flight control computers and identifying a self-failure in response to a predetermined discrepancy therebetween; utilization means for utilizing the command control signals from at least two of the flight control computers as aircraft surface control commands, said utilization means further comprising: first transducer means coupled to said first flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; second transducer means coupled to said third flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; and means for combining the mechanical outputs from the first and second transducers and coupling the resultant mechanical output to a predetermined control surface of the aircraft; a first transducer sensor for producing an output signal representative of the mechanical output of said first transducer; a second transducer sensor for producing an output signal representative of the mechanical output of said second transducer; means for coupling said first transducer sensor output signal to the first flight control computer and said second transducer sensor output signal to the third flight control computer; and wherein each flight control computer includes means for producing a model transducer sensor signal; said first flight control computer including means for comparing its model transducer produced sensor signal with the first transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween, said first flight control computer otherwise comparing the first transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the second transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the first transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure; said second flight control computer including means for comparing its model transducer produced sensor signal with the first and second transducer sensor produced signals and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second flight control computer model signal is the outside of tolerance signal, the failure otherwise being identified as a cross-channel failure; and said third flight control computer including means for comparing its model transducer produced sensor signal with the second transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween: said third flight control computer otherwise comparing the second transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the first transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure.

Claim 29

An aircraft autopilot flight director system comprising: first, second and third redundant sensor sets, each sensor set producing predetermined output data signals related to the status of the aircraft; first, second and third flight control computers, each computer including means for: (a) comparing the associated sensor signal set with the sensor signal sets of the other two flight control computers and identifying a failure in response to a predetermined discrepancy therebetween; (b) processing said first, second and third sensor set data signals and producing a reference sensor signal set; (c) processing said reference sensor signal set and producing command control signals; (d) comparing said produced command control signals with the command control signals produced by the other two flight control computers and identifying a self-failure in response to a predetermined discrepancy therebetween; utilization means for utilizing the command control signals from at least two of the flight control computers as aircraft surface control commands, said utilization means further comprising: first transducer means coupled to said first flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; second transducer means coupled to said third flight control computer for transducing the command control signals produced thereby to a corresponding mechanical output; and means for combining the mechanical outputs from the first and second transducers and coupling the resultant mechanical output to a predetermined control surface of the aircraft; a first transducer sensor for producing an output signal representative of the mechanical output of said first transducer; a second transducer sensor for producing an output signal representative of the mechanical output of said second transducer; means for coupling said first transducer sensor output signal to the first flight control computer and said second transducer sensor output signal to the third flight control computer; and wherein each flight control computer includes means for producing a model transducer sensor signal; said first flight control computer including means for comparing its model transducer produced sensor signal with the first transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween, said first flight control computer otherwise comparing the first transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the second transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the first transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure; said second flight control computer including means for comparing its model transducer produced sensor signal with the first and second transducer sensor produced signals and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second flight control computer model signal is the outside of tolerance signal, the failure otherwise being identified as a cross-channel failure; and said third flight control computer including means for comparing its model transducer produced sensor signal with the second transducer sensor produced output signal and indicating a self-failure in response to a predetermined discrepancy therebetween: said third flight control computer otherwise comparing the second transducer sensor produced output signal with the model transducer sensor signal of the second flight control computer and the first transducer sensor produced output signal and identifying a condition wherein two of said signals are within a predetermined tolerance and the third signal is outside of said tolerance, this condition being identified as a self-failure if the second transducer sensor produced output signal is the signal outside of said predetermined tolerance, the failure otherwise being identified as a cross-channel failure.

Claim 30

The system of claim 26 wherein each of said flight control computers further includes means for: comparing its produced command control signals with the produced command control signals of the other two flight control computers and identifying a condition wherein the produced command control signals of two flight computers agree within a predetermined tolerance whereas the produced command control signal of the remaining flight computer is outside of said predetermined tolerance, this condition being identified as a self-failure if the computer performing the comparison is the out of tolerance computer, the condition otherwise being identified as a cross-channel failure.

Claim 31

The system of claim 26 wherein each flight control computer includes means for self deactivation from continued system service in response to identifying itself as a self-failure.

Claim 32

The system of claim 26 further comprising: limiting means for limiting the mechanical output of each of said first and second transducer means to a predetermined maximum; and bias means for applying a predetermined mechanical bias to said control surface of the aircraft such that in the event one of the first and second transducer means produces a mechanical output that is limited by the limiting means, the combined output of the remaining transducer means and the bias means tends to activate the control surface to a position of trimmed aircraft flight.

Claim 33

The system of claim 26 wherein each flight control computer includes means for ignoring the data signals from an identified failed sensor signal set.

Claim 34

The system of claim 30 wherein the flight control computers include means for deactivating that flight control computer identified as exhibiting a cross-channel failure by both of the remaining flight control computers.

Claim 35

The system of claim 31 wherein the flight control computers include means for deactivating all flight control computers from continued system service in response to identifying two of said computers as self-failures.