DE102005008556A1 - Aircraft controlling device, has decision unit provided to decide execution of security-critical control function on microcomputers and/or control units due to comparison of output data of microcomputers - Google Patents

Abstract

The device has two control units (17) coupled between data buses (B1, B2), where each unit has a microcomputer (18) that is operating independent of each other. The microcomputers have a security critical control software. A decision unit (20) is provided which decides execution of a security-critical control function on the microcomputers and/or control units due to the comparison of output data of the microcomputers.

Description

The The present invention relates to a device for controlling Aircraft, with aerodynamic control surfaces and their actuators as well with pilot-side controls, especially for simple and safe control of aircraft of the approval classes JAR23, Class VSA, I, II, III, IV as well as business jets and reginals of the admission class JAR 25.

Known are so-called "Full Fly-by-wire "platforms, capturing pilot commands, performing the actual control function as well as the control of the actuators in electronic form with the help of computers. The key challenge of such platforms is resilience. That's right System e.g. due to a failure of the fly-by-wire computer (FBWC) out, so the controllability of the aircraft is no longer given. A fatal accident would be the episode.

Aircrafts Class JAR23 Class VSA I, II, III, IV (General Aviation) and Business Jets, Regionals of Class JAR 25 are largely controlled by the pilot via a mechanical control controlled, that is, the central control (control wheel or joystick) and the pedals are mechanical with the different aerodynamic ones control surfaces the primary control connected. The rash of each tax area is directly related to the rash of the tax organs. There are no direct and full ones authority aggressive stabilization features, Flight Envelope Protection and Preset Control. By this type of control, each type of aircraft has a characteristic for him Control behavior learned by flight students through intense practice or specially trained by experienced pilots in the "Type Rating" must become. For adherence to the "Operational Flight Envelope "is alone the pilot in charge. Warning devices to comply with the minimum speed partly available. They do not, however, directly access the Control, but by warning the pilot on the attentive to the critical situation. In any case, the pilot has to react, which makes him often overwhelmed in stressful situations. Such situation are common Reasons for heavy air accidents.

Autopilot systems if available, grab over own servomotors in the mechanical timing chain and lead the Airplane automatically in up to three control axes. The authority of the autopilot is limited. He does not cover the entire flight range from. In the event of a fault, the autopilot shuts itself off or must be switched off by the pilot. In extreme cases, when the autopilot can not turn off anymore, the pilot has to pass him over override the central controls. The Autopilot functions must manually over a "control panel" is activated and deactivated become. Tax specifications such as the tax rate are carried out manually the pilot.

• • Die Flugzeuge weisen eine „Fly-by-Wire"-Steuerung mit voller Steuerautorität in allen drei Steuerachsen auf.
• • Das Flugsteuerungssystem ist mit einem „minimalen" mechanisch-hydraulischen Backupsystem ausgerüstet (bei Airbus für den „Trimable Horizontal Stabilizer" (THS) und das Seitenruder; bei Boeing für ein Spoilerpaar und den THS). Mit diesem System lässt sich das Flugzeug auch bei einem Komplettausfall der „Flyby-Wire"-Steuerung zumindest in einer stabilen Fluglage halten.
• • Ein minimales mechanisch-hydraulisches Backupsystem ist nur sinnvoll, solange das Flugzeug noch natürliche Stabilität im Steuerverhalten aufweist. Flugzeuge mit instabilen Steuerverhalten sind mit derartigen Systemen nicht realisierbar.
• • Die „Fly-by-Wire"-Steuerung umfasst im Wesentlichen – die Flugsteuerung um alle 3 Steuerachsen; – Vorgabesteuerung in der Nickachse durch Vorgabe des Lastvielfachen; – Vorgabesteuerung in der Rollachse durch Vorgabe der Rollrate und beim Überschreiten eines Grenzwertes durch Vorgabe des Rollwinkels; – Automatische Kurvenkoordination für alle drei Steuerachsen (Nick, Gier, Roll); – Automatische Trimmung mit „Side Slip" Minimierung in der Gierachse; – Flugbereichsüberwachung und „Flight Envelope Protection" während des Fluges, allerdings nicht am Boden und nicht beim unmittelbaren Lande- oder Startvorgang); – „Direct Control" (Direct Law) am Boden, d.h., am Boden werden die Steuerklappen proportional zu den Ausschlägen der zentralen Steuerorgane ausgefahren.
• • Bei Fehlern im Flugsteuersystem wird bis auf das „Direct Control" (Direct Law) degradiert. Damit ändert sich das Steuerverhalten des Flugzeugs signifikant.
• • Die Autopilotenfunktionen sind weitgehend von der Flugsteuerung getrennt und müssen über eigene, dafür vorgesehene Bedieneinheiten vorgegeben werden.
• • Eine direkt in die Steuerung eingreifende Führung durch den Autopiloten beim Anrollen und Abheben während des Starts ist nicht vorgesehen.
• • Nach einem zweiten Fehler steht die Autopilotenfunktion nicht mehr zur Verfügung. Es muss dann manuell weitergeflogen werden.

For large transport aircraft of the new type, such as the Airbus A320, A330 / 340 or the Boeing B777, all of which belong to the approval class JAR 25 (FAR 25), the state of the art is as follows:

• • Aircraft have fly-by-wire control with full control authority in all three control axes.
• • The flight control system is equipped with a "minimal" mechanical-hydraulic backup system (at Airbus for the "Trimable Horizontal Stabilizer" (THS) and the rudder, at Boeing for a spoiler pair and the THS). With this system, the aircraft can be maintained at least in a stable attitude even in the event of complete failure of the flyby-wire control.
• • A minimal mechanical-hydraulic backup system only makes sense, as long as the aircraft still has natural stability in the control behavior. Aircraft with unstable control behavior are not feasible with such systems.
• • The "fly-by-wire" control essentially comprises - the flight control around all 3 control axes, - default control in the pitch axis by specifying the load factor, - default control in the roll axis by specifying the roll rate and exceeding a limit by specifying the roll angle - Automatic curve coordination for all three control axes (pitch, yaw, roll) - Automatic trimming with "Side Slip" minimization in the yaw axis; - Flight area monitoring and "Flight Envelope Protection" during the flight, but not on the ground and not during the direct landing or take-off operation; - "Direct Control" on the ground, ie on the ground the control flaps become proportional to the rashes of the extended central control organs.
• • Errors in the flight control system are downgraded to "direct control" (direct law), which means that the steering behavior of the aircraft changes significantly.
• • The autopilot functions are largely separate from the flight control and have their own, because be specified for intended control units.
• • The autopilot does not envisage direct guidance into the control when rolling up and taking off during take-off.
• • After a second error, the autopilot function is no longer available. It must then be flown manually.

task It is the object of the present invention to provide a simply structured device to provide control of aircraft, despite a faulty ECU functioning remains.

These The object is achieved by a device for controlling aircraft with a redundant Data bus system with two data buses, with aerodynamic control surfaces, their actuators each coupled to only one of the two data buses, and with pilot-side controls connected to one or both data buses coupled, wherein between the data buses at least two ECUs are coupled, each functionally equivalent safety critical Include control software, which is processed by at least one of the control units is so that in case of failure of the currently active control unit, the safety-critical Control task can now be taken over by the other controller, wherein every control unit two independent of each other working microcomputer, both of which are safety-critical Include control software and their from sensor data of the controls and / or other sensors calculated result data interchangeably and are comparable to each other, and being a decision-making tool is provided, which decides on the basis of the comparison of the result data, which microcomputer or which control unit the safety-critical Performs control task.

The control device according to the invention, hereinafter also referred to as "Carefree Control System "(CCS), is used for easy and safe control of flight control of the Admission classes JAR23, Class VSA, I, II, III, IV and Business Jets and reginals of approval class JAR 25.

On Such a fly-by-wire platform according to the invention become flight control and autopilot functions in integrated form implemented with the goal over preferably few input units give the pilot a simple, concise and to enable automatic guidance of the aircraft in many phases of flight without that he is dealing with a variety of different "modes" in flight control and Take care of autopilot system got to.

• • Im dynamischen Steuerbereich bei der Durchführung von Manövern (Manövermode) werden über den „Stick Controller" für den Piloten natürlich wahrnehmbare physikalische Größen wie das Lastvielfache (Nickachse) oder die Rollrate (Rollachse) vorgegeben.
• • Im statischen Bereich (Cruise-Mode) werden die Piloteneingaben über den „Stick Controller" weitgehend als Änderungen der Bahnführung oder der Flugzeugausrichtung bzw. des Flugbahnneigungswinkels interpretiert.
• • Die o.a. Vorgabesteuerung stellt sicher, dass die Steuercharakteristik des Flugzeuges über den gesamten Bereich der „Operational Flight Envelope" (OFE) annähernd gleich ist, also nicht von Geschwindigkeit u.a. abhängt.

The commands entered by the pilot via a "stick controller" (SC) are interpreted by the CCS as default commands.These command commands are interpreted in different phases by CCS in different ways, in such a way that the resulting control behavior of the aircraft is the same For example, the CCS interprets transversal roll-overs, take-offs, cruise-mode or landing as presets of different sizes: A lateral excursion at the SC gives the lateral acceleration of the aircraft, in another phase the In any case, at the end of the maneuver, it will cause the aircraft to change course or orientation, even if the maneuver is dependent on the flight phase and on the given task the airbag-dependent choice of default sizes :

• • In the dynamic control range when performing maneuvers (maneuvering mode), the pilot's "stick controller" specifies natural physical parameters such as the load multiple (pitch axis) or the roll rate (roll axis).
• • In the static area (cruise mode), the pilot inputs via the "stick controller" are largely interpreted as changes in the path guidance or the aircraft orientation or the trajectory inclination angle.
• • The above-mentioned default control ensures that the control characteristic of the aircraft is approximately the same over the entire range of the "Operational Flight Envelope" (OFE), ie does not depend on speed and the like.

• • das automatische Umschalten zwischen den verschiedenen Modes der klassischen Fly-By-Wire-Flugsteuerung und des Autopiloten, wobei das automatische Umschalten zwischen den Modes für den Piloten transparent ist (nicht unmittelbar erkennbar ist) das Anwenden der Vorgabesteuerung auch während des Abfangbogens mit Alignment (Längsausrichtung) das Anwenden der Vorgabesteuerungen auf alle Bodenoperationen
• • die Steuerung nur mit dem Stick über alle Flug- und Rollphasen.

In order to achieve the natural control characteristic, a multiplicity of different control codes is required in the CCS. Many of them, such as course and altitude control, have been in use for a long time. New are:

• The automatic switching between the different modes of the classic fly-by-wire flight control and the autopilot, wherein the automatic switching between the modes for the pilot is transparent (not immediately recognizable), the application of the default control even during the Intercept arc with alignment applying default controls to all ground operations
• • Control only with the stick over all flight and taxi phases.

flight control and autopilot functions become both functional and platform-driven merged into a single entity.

Over a consistently designed "Flight Envelope Protection "(FEP) ensures that the aircraft does not leave its "Operational Flight Envelope" can and therefore always in a safe for the pilot controllable Flight condition is. This "Flight Envelope Protection "is also active in operations on the ground, i. during the rolling phase at start and landing. Even in these phases, the pilot controls the aircraft via "stick Controller "(optional also over the pedals) over Default commands, which depend on the Roll state automatically be limited.

For stabilization while Starting to take off at take-off will be a combination of aerodynamic Stabilization with a just over the chassis to be steered realized "vehicle stabilization" carried out for the stabilization when putting on and rolling out during The landing will be a combination of aerodynamic stabilization with one over Steering and braking realized "vehicle stabilization" performed.

at today only in large Transport aircraft used "fly-by-wire" controls changes the control characteristics significant when system errors occur. The top step The control characteristic is the "Normal Law", the lowest level The tax characteristic is the so-called "direct law", the normal law corresponds to that in Manövermode CCS applied "Law." In Direct Law the control surfaces largely proportional to the "stick controller" and pedal commands knocked out. In case of system errors, the flight control of huge Finally, transport planes in the Direct Law. This is associated with a significant change the control characteristic. Direct Law is not used in the CCS. Is there a significant degradation in tax systems in the Control characteristic, so must all these cases be trained by the pilot. This is just the case here considered Aircraft, partly controlled by private pilots, unacceptable. Therefore in CCS the rules and the redundancy management are the fly-by-wire platform so combined that itself in case of errors, the control characteristic of the aircraft does not change significantly. Indeed In the case of errors, the "Operational Flight Envelope" can be restricted although the performance reduce the aircraft, but does not provide a training case dar. The error-related "Flight Envelope "restriction becomes automatically performed by the CCS.

• • Der Pilot steuert das Flugzeug im Wesentlichen ausschließlich über den Stick Controller (neu) und den Schubhebel.
• • Per „Stick Controller" erfolgt die Eingabe von – Vorgabegrößen für die Flugsteuerung (heute Stand bei Airbus) und – die automatische Flugführung (neu).
• • Das Umschalten von manuellen „Steuermodes" auf automatische „Führungsmodes" und damit verbunden die automatische Variation der Bedeutung der Vorgabe erfolgt automatisch und transparent für den Piloten (neu). Dies gilt für den gesamten Flug- und Rollbereich (neu).
• • Eine „Flight Envelope Protection", ausgeweitet auf das Rollen (neu), Abheben (neu) und Aufsetzen am Boden, schützt das Flugzeug automatisch vor unsicheren Flugzuständen.
• • Systemfehler bedingte Degradationen in der Steuercharakteristik der Art, dass sie vom Piloten trainiert werden müssen, gibt es nicht (neu).
• • Durch CCS ist es möglich, unterschiedlichen Flugzeugtypen eine vergleichbare Steuercharakteristik aufzuprägen und damit das „Type-Rating" für Piloten unnötig zu machen oder auf ein Minimum zu begrenzen (Airbus).
• • Das „Fly-by-Wire"-System ohne Backup ermöglicht die über Regelung erzeugte künstliche Stabilisierung des dynamischen Steuerverhaltens des Flugzeugs und damit den Verzicht auf natürliche Stabilität beim Auslegung von Flugzeugen. Dies wiederum erlaubt eine weitere Steigerung der Leistung bzw. Effizienz des Flugzeugs, ohne damit die Steuercharakteristik für Piloten zu verschlechtern oder das Flugzeug gar unfliegbar zu machen.

The characteristics of the control device according to the invention are as follows:

• • The pilot steers the aircraft essentially exclusively via the stick controller (new) and the throttle lever.
• • The "Stick Controller" is used to enter - default values for the flight control (today stand on Airbus) and - automatic flight guidance (new).
• • Switching from manual "control modes" to automatic "guidance modes" and, as a result, the automatic variation of the meaning of the preset is automatic and transparent for the pilot (new). This applies to the entire flight and taxi area (new).
• • A "Flight Envelope Protection", extended to rolling (new), lifting (new) and landing on the ground, automatically protects the aircraft from unsafe flight conditions.
• • System-related degradations in the control characteristic of the kind that they must be trained by the pilot, there is not (new).
• • CCS makes it possible to impose comparable control characteristics on different types of aircraft, thereby eliminating or minimizing the "type rating" for pilots (Airbus).
• • The fly-by-wire system with no back-up allows for artificial stabilization of the aircraft's dynamic control behavior, eliminating the need for natural stability in aircraft design, which in turn further enhances the performance and efficiency of the aircraft without impairing the pilot's control characteristics or even making the aircraft fly.

• • Kein mechanisches Backup (neu für Transportflugzeuge)
• • Die Plattform lässt sich an die unterschiedlichen Sicherheitsanforderungen ohne große Systemänderungen anpassen: P{Ausfall für eine einstündige Mission} < 10^–6 ... 10^–9
• • Die Plattform besteht aus zwei Systemhälften, welche voneinander weitgehend getrennt sind (neu)
• • Fällt eine Systemhälfte komplett aus, so ist die Steuerbarkeit des Flugzeugs bei gleich bleibender Steuercharakteristik sichergestellt
• • Jeder Seite sind Stellmotoren, Sensoren, Energieversorgung, ein Systembus fest zugeordnet (neu)
• • Der Systembus arbeitet bevorzugt nach dem „Time triggered Datentransferverfahren"
• • Die beiden Systembusse arbeiten unabhängig voneinander und sind miteinander nicht synchronisiert.
• • Beide Busse können dissimilar zueinander aufgebaut sein (z.B. FlexRay und TTP).
• • Stellmotoren und Sensoren sind nur mit dem Systembus ihrer Seite verbunden
• • „Smart"-Sensoren oder -Stellmotoren sind direkt mit dem Systembus ihrer Seite verbunden und erhalten/versenden darüber Daten von/an den FBWC beider Seiten
• • „Dumb"-Sensoren oder -Stellmotoren, die keinen direkten Anschluss an den Systembus aufweisen, sind über ein IOM mit ihrem Systembus verbunden und erhalten/versenden darüber Daten von/an den FBWC beider Seiten
• • Die Daten aller Stellmotoren und Sensoren stehen beiden FBWC zur Verfügung
• • Eine externe Einheit erhält über ihren Systembus Daten von den FBWC beider Seiten
• • Jeder FBWC ist intern modular aufgebaut
• • Jeder FBWC kann intern redundant aufgebaut sein
• • Die interne Redundanz eines FBWC ist für externe über den Systembus oder IOM angekoppelte Einheiten transparent; folglich ist das System skalierbar bzgl. der FBWC-internen Redundanz
• • Die Module eines FBWC tauschen ihre Daten untereinander über die Systembusse aus
• • Die beiden FBWC tauschen ihre Daten untereinander ebenfalls über die Systembusse aus.
• • Nur die CPM innerhalb eines FBWC haben Zugang zu beiden Systembussen • Die CPM sind die zentralen Module eines FBWC.
• • Das CPM ist duplex aufgebaut, um so eigene Fehler sicher erkennen zu können.
• • Das CPM hat nur minimale IO-Fähigkeit.
• • Jeder FBWC muss mindestens ein CPM aufweisen
• • Das CPM bearbeitet die Steueraufgaben des CCS und bearbeitet das System-/Redundanz-/Ressourcemanagement
• • Im Falle des Ausfalls eines CPM kann innerhalb eines FBWC ein anderes CPM eine weniger sicherheitskritische Aufgabe suspendieren und dafür die absolut sicherheitskritische Aufgabe übernehmen (Dynamic Resource Sharing).

The control device CCS according to the invention is implemented on a fly-by-wire platform without mechanical backup. The essential characteristics of the control device according to the invention are:

• • No mechanical backup (new for transport planes)
• • The platform can be adapted to different security requirements without major system changes: P {one-hour mission failure} <10 ^-6 ... 10 ^-9
• • The platform consists of two system halves, which are largely separated from each other (new)
• • If one half of the system fails completely, the controllability of the aircraft is ensured with the same control characteristic
• • Each side has positioning motors, sensors, power supply, a system bus permanently assigned (new)
• The system bus preferably operates according to the "time-triggered data transfer method"
• • The two system buses work independently and are not synchronized with each other.
• • Both buses may be dissimilar to each other (eg FlexRay and TTP).
• • Actuators and sensors are only connected to the system bus on their side
• • "Smart" sensors or motors are directly connected to the system bus on their side and receive / send data from / to the FBWC on both sides
• • "Dumb" sensors or motors that are not directly connected to the system bus are connected to their system bus via an IOM and receive / send data to / from the FBWC on both sides
• • The data of all servomotors and sensors are available to both FBWCs
• • An external unit receives data from the FBWC on both sides via its system bus
• • Each FBWC has a modular internal structure
• • Each FBWC can be internally redundant
• • The internal redundancy of a FBWC is transparent to external devices connected via the system bus or IOM; Consequently, the system is scalable with respect to the internal FBWC redundancy
• • The modules of a FBWC exchange their data with each other via the system buses
• • The two FBWC also exchange their data with each other via the system buses.
• • Only the CPMs within a FBWC have access to both system busses • The CPMs are the central modules of a FBWC.
• • The CPM is constructed in duplex mode so that you can reliably identify your own errors.
• • The CPM has only minimal IO capability.
• • Each FBWC must have at least one CPM
• • The CPM processes the control tasks of the CCS and processes the system / redundancy / resource management
• • In the event of a CPM failure, another CPM within one FBWC can suspend a less critical task and take on the task that is absolutely critical to security (Dynamic Resource Sharing).

In detail, the characteristics of the fly-by-wire platform and the FBWC are shown in the following two tables:

• • Sehr einfache und sichere Steuerung des Flugzeugs durch (Privat-)Piloten
• • Erhöhung der Sicherheit – durch weitgehende Entlastung des Piloten von der eigentlichen Steuerung des Flugzeugs – durch das für den Piloten transparente Systemverhalten bzg. der Aktivierung unterschiedlicher Steuer- und „Flugführungsmodes" im CCS (dem Pilot bleiben CCS-interne „Modeumschaltungen" verborgen; der Pilot fliegt das Flugzeug nach einer seinen natürlichen Steuergefühlen in allen Flugphasen weitgehend angepassten Vorgabesteuerung) – wegen keiner signifikanten Änderung der Steuercharakteristik bei Systemfehlern – durch die automatische „Flight Envelope Protection" mit integriertem Schutz der Flugzeugstruktur in allen Betriebsphasen – durch automatische Anpassung der „Allowed Flight Envelope" (AFE) im Fall von Systemfehlern, sofern notwendig
• • Reduktion des Ausbildungsaufwandes durch das vereinfachte Handhaben des Flugzeugs sowohl im dynamischen Steuerbereich (Manövermode) als auch im horizontalen und vertikalen „Cruise-Mode"
• • Aufprägen von ähnlichem oder gleichem Steuerverhalten bei Flugzeugen unterschiedlichen Typs und damit signifikante Vereinfachung des „Type-Ratings" für Piloten
• • Schaffung eines Leistungs- und Effizienzerhöhungspotentials für Flugzeuge – durch künstliche Stabilisierung des Flugzeugs mit CCS – durch im CCS integrierten Strukturschutz
• • Anwendung des Steuersystems auf verschiedene Flugzeugtypen durch die skalierbare Ausführung des Systems bezüglich – Rechnerredundanz – Anzahl und Typ der Sensoren – Anzahl und Typ der Stellmotoren – Technologie der Stellmotoren in Bezug auf Dumb/Smart-Ausführung

Advantages of the control device CCS according to the invention for the above-mentioned aircraft classes are:

• • Very simple and safe control of the aircraft by (private) pilots
• • Increased safety - by largely relieving the pilot of the actual control of the aircraft - by the transparent for the pilot system behavior bzg. the activation of different control and "flight control" modes in the CCS (the pilot remains hidden CCS-internal "mode remodeling"), the pilot flies the plane after a natural control feelings in all phases of flight largely adjusted default control) - due to no significant change in control characteristics in case of system failure - by the automatic "Flight Envelope Protection" with integrated protection of the aircraft structure in all phases of operation - by automatic adaptation of the "Allowed Flight Envelope" (AFE) in case of system errors, if necessary
• • Reduction of training costs due to the simplified handling of the aircraft both in the dynamic control range (maneuvering mode) and in horizontal and vertical "cruise mode"
• • Imposing similar or similar control behavior on aircraft of different types and thus significantly simplifying pilot type rating
• • Creating a performance and efficiency enhancement potential for aircraft - by artificially stabilizing the aircraft with CCS - through CCS integrated structural protection
• • Application of the control system to different types of aircraft due to the scalable design of the system with respect to - Computer redundancy - Number and type of sensors - Number and type of servomotors - Technology of servomotors with respect to Dumb / Smart design

According to the invention is a Data bus system with control units for controlling the actuators for the aerodynamic control surfaces provided the aircraft. The control data is about the Transfer data bus system in the form of electronic messages and an actuator, such as an electric motor, then causes the actual adjustment of the aerodynamic control surfaces. One Data bus is in this sense a simple LIN, CAN, or FlexRay data bus. Each data bus can have two data bus lines in each case, as is customary for CAN, for example.

sensors with safety-related tasks, including sensors for recording the pilot commands in safety-related control units, are executed multiple times (redundant). In this case, multiple sensors with safety-relevant tasks are like that coupled to the two system buses, that at each of the two System buses coupled to at least one of the multiple sensors is. The data of the multiply executed sensors are so over the both system buses are transmitted to the control units. The currently active one control unit chooses in Essentially about Majority vote, the correct data from the redundant sensors.

Control units with safety-related Tasks are each as duplex, d. H. in itself or the same dissimilaren hardware modules, double designed. Dissimilar means here that the hardware modules are functionally identical, but with different Components executed could be, so design or production error in a component type is not occur simultaneously in both hardware modules (e.g. the CPUs of the two hardware modules are different in type). Execution with two hardware modules has for the control unit the advantage that calculates its task separately in each of the hardware modules and the results are compared. With agreement can of a proper function of the respective hardware module are assumed. distinguish If the two calculated results, then the currently active control unit performs accordingly a given error routine calculations by. In case of error takes over then another controller the safety-critical control task or less safety-critical Errors can take over even only one of the two microcomputer of the controller, the task as far as a plausibility check before carried out has been. The controllers are about the data bus system with the respective safety-relevant actuators (Servomotors) for the aerodynamic control surfaces connected.

Preferably is a safety-critical operating function either by a single control element coupled to both data buses, e.g. at a single-pilot pilot's joystick, or through two controls (e.g., on a two pilot airplane, the control sticks of the Pilots and the copilot), of which one to the one and the other is connected to the other data bus realized.

Prefers the two data buses are independent from each other and not synchronized.

In an advantageous embodiment of the invention, one of the control units is provided with respect to a safety-critical control task as the master control unit, which controls the safety-critical operation executes this task task critical in the event of an error on the other control unit. With regard to a control task, the data bus system has two independent control devices each having two mutually independently operating microcomputers. Within each control unit there are two microcomputers with a data interface connected between the two microcomputers, via which the result data calculated from the security-relevant control messages are interchangeable and comparable with one another. The decision-making means, which can be implemented as software in each control device, then decides on the basis of the comparison of the result data which microcomputer or which control device performs the safety-critical control task.

The Data bus system is multi-redundant in this way. Related to a safety-critical control task is at least two ECUs provided with the necessary control software. In proper operation of the data bus system one of the two control units, hereinafter referred to as the master controller, the safety-critical Control, e.g. the control of all shelves. The corresponding actuator messages and data are transferred on one of the two data buses to the master controller, the news and data of the sensors and other systems become on one and for transmit safety-critical data on both buses to the master control unit. The control data is within the master controller respectively independently calculated on the two microcomputers. For identical result data will then be a proper operation detected by the master controller, and calculate one of the microcomputers or both microcomputers new control signals and these are on both data buses to the Transmit actuators, wherein an actuator is coupled only to a data bus. distinguish However, the two calculated result data in the master control unit, so instructed the decision-making tool about the data bus the other control unit with the calculation of the respective Control tasks. This other controller has the system control data on the data bus also previously received and stored, so that now start the calculation of the control data without delay can. This ensures that that in safety-critical applications in the aircraft control and communication on the data bus system even if errors occur continued without delay can be. This creates a fail-safe data bus system based on the designated safety-critical control tasks.

Prefers are every safety-critical operating function at least one sensor, which is coupled to the one data bus, and at least one sensor, which are coupled to the other data bus assigned. By The double (multiple) design can be safety-critical Sensors are better checked for their function. Here are the redundant sensors as possible immediately distributed to both system buses. In case of error can then a sensor can be switched within the provided plausibility range Provides data.

Prefers Every microcomputer has the control software of all safety-critical ones Control tasks, so that the total information on each control unit all safety-critical control tasks is provided. Thereby can any controller in case of error also as representative for another control unit at each any safety-critical control task occur.

Further Advantages of the invention will become apparent from the description and the Drawing. Likewise, the mentioned above and the features further listed individually or can be used for several in any combination. The shown and described embodiments are not as final enumeration but have rather exemplary character for the description of the Invention.

It demonstrate:

1 the system architecture of the control device for a single-pilot aircraft according to the invention; and

2 the system architecture of the control device for a two-pilot aircraft according to the invention.

In the 1 Aircraft control device 1 shown comprises a redundantly designed data bus system with a first data bus B1 and a second data bus B2. The two data buses B1 and B2 operate independently of each other and are not synchronized. They can be dissimilar to each other, ie, the For example, one data bus may be of the "FlexRay" type and the other may be of the "TTP" type, for example. Each data bus B1 or B2 each consists of two data bus lines (not shown).

To the two data buses B1 and B2 are different components, such as operator panels 2 - 6 , Modules 7 . 8th , Actuators 9 - 12 for the rudder 13 - 16 of the aircraft as well as control devices 17 for driving the actuators, connected. Depending on whether the function in the aircraft is safety-critical, the components are either arranged only on a data bus B1, B2 or between the two data buses, so that messages from both data buses B1, B2 can be received and evaluated with regard to their correctness.

The reference numbers 2 and 3 denote the pilot stick (STICK PIC) or the foot pedals (PEDAL) of the pilot, the reference numeral 4 the flap lever (FLAP LEVER PIC) of the pilot and the reference numerals 5 . 6 the nose wheel control (NWS) or the brake control (BRAKE & TACHO, WOW). The actors 9 ₁ . 9 ₂ serve for the control of bilateral ailerons 13 ₁ . 13 ₂ , the actors 10 ₁ . 10 ₂ for controlling double-sided flap rudders 14 ₁ . 14 ₂ , the actors 11 ₁ . 11 ₂ for controlling double-sided elevators 15 ₁ . 15 ₂ and the actors 12 ₁ . 12 ₂ for controlling the rudder 16 , The actuators indicated with 1 are only coupled to the data bus B1 and the actuators indicated by 2 only to the data bus B2. Also the brake components 6 ₁ . 6 ₂ are each provided only on a data bus B1 or B2 to control the respective brake cylinder or to detect braking values, and arranged as a simplex components each on a wheel and control motors or pneumatic or hydraulic components of the brake system.

In addition to these only one data bus B1 and B2 associated components, which must not be failsafe, the safety-critical components, ie the controls 2 . 3 and the controllers 17 , doubly designed and coupled to both data buses B1, B2.

The double design of the controls 2 . 3 means that the movement of eg the joystick is detected by two mutually redundant sensor groups. Each sensor group includes, for example, a pair of sensors with two sensors (not shown), wherein the one pair of sensors is coupled only to the data bus B1 and the other sensor pair only to the data bus B2. From the redundant sensor data, a sensor value is essentially determined by a "voting process" and in the control unit 17 be used for control. In this case, the sensor data supplied by a sensor pair of a control element are compared with each other and only if they coincide with each other, for further processing in the control unit 17 selected. In the case of multiple errors, ie if the sensor data supplied via the data buses B1 and B2 do not match, this task can be transferred to another control unit 17 be relocated. Due to this function, there is a high error security for the joystick, in the absence of which the aircraft would be unfit for flight. Within milliseconds can be switched after detection of an error, so that the safety-critical control function is taken over by another controller.

The controllers 17 each contain the same safety-critical control software, which is processed by at least one of the control units, so that in case of failure of the currently active control unit, the safety-critical control task can now be taken over by the other control unit. Each control unit 17 includes two mutually independent microcomputers 18 , which each have the control software of all safety-critical control task, so that in case of failure of a control unit, the control task can be taken over by another control unit. Between the two microcomputers 18 there is a data interface 19 in which the messages arriving via the data buses B1, B2 or the data of the first microcomputer calculated therefrom 18 be compared with those from the messages of the data buses B1, B2 derived or calculated result data of the second microcomputer 18 , With the data interface 19 connected is a decision-making tool 20 that makes sense as software in just one or all controllers 17 is implemented and that the proper functioning of both microcomputers 18 checks and compares their data. Instead of the control unit 17 provided data interface 19 can the microcomputer 18 also exchange their data via the data buses B1, B2.

In case of error, ie if the calculated result data of the one microcomputer 18 from those of the other microcomputer 18 deviate recognizes the means of decision 20 a mistake and depending on the diagnosis becomes the decision-making tool 20 the functions of the controller identified as faulty 17 on a replacement control unit 17 passed, so that the control tasks can then be done in this replacement control unit. The inventive concept provides that essentially the same hardware and essentially the same software on the microcomputers 18 a control unit is provided twice and in this way the result from the messages is calculated twice, ie redundantly. In the event of an error, this is distributed decision means 20 according to a predetermined error handling routine, the safety-critical control task to another controller or another microcomputer 18 ,

For controlling the safety-critical rudder 16 are two actuators 12 ₁ and 12 ₂ provided that both simultaneously "active / active" or "active / standby" the rudder drive. If an actuator fails 12 , this is detected by sensors, the affected actuator is switched off ("switched to idle: standby"), and now only driven by the remaining actuator.

The module 7 ₁ . 7 ₂ are IO modules (IOM) and the modules 8 ₂ . 8 ₂ Gateway modules (GWM), which, as their indexing shows, are each connected to only one of the data buses B1 or B2. If external units are not "smart" (ie the data is exchanged via discrete switching signals or discrete analogue control signals), the necessary electronics are integrated in an IO module 7 housed with the controllers 17 communicated. About the GWM modules 8th becomes the connection of a data bus B1, B2 to other external bus systems, eg GPS systems 21 ₁ . 21 ₂ and ECU systems 22 ₁ . 22 ₂ produced.

The controllers 17 , IO modules 7 and GWM modules 8th are in two blocks 23a and 23b arranged, which are each connected to different power sources.

From the control device 1 is different in the 2 shown control device 1' with the same functioning only in that the control functions of the control units 2 . 3 now on the pilot and co-pilot side each with its own control unit 2 ₁ . 2 ₂ and 3 ₁ . 3 ₂ are realized.

Abbreviations and translations

FPlat

Fly by Wire platform

FBWC

Fly by wire computer

CPM

Computing modules

IOM

Input / output modules

GWM

Gateway modules

PDM

Power Distribution modules

SC

Star Cpoupler

SC

Stick controller

HDG

heading

TRK

tracking

BRG

Bearing

PIC

Pilot In Command

FO

First Officer

NWS

Nose Wheel Steering

WOW

Weight On Wheel

GPS

Global Positioning system

ECU

Engine control unit

PWR

power

TTP

Time Trigger Protocol

BAT

Battery

GENE

generator

Co

Command

Not a word

monitor

PS

Power supply

Flight

Envelope Protection Flight range monitoring

CCS

Carefree Control System

AFP

Allowed Flight Envelope

CAN

Controller Area Network

A / C

Aircraft

Claims (9)

Contraption ( 1 ; 1' ) for controlling aircraft, with a redundant data bus system with two data buses (B1, B2), with aerodynamic control surfaces ( 13 - 16 ), whose actuators ( 9 - 12 ) are each coupled to only one of the two data buses (B1, B2), and with pilot-side operating elements ( 2 . 3 ; 2 ₁ . 2 ₂ . 3 ₁ . 3 ₂ ), which are coupled to one or both data buses, wherein between the data buses (B1, B2) min at least two control devices ( 17 ) are coupled, each containing functionally identical safety-critical control software, which is processed by at least one of the control units, so that in case of failure of the currently active controller, the safety-critical control task can now be taken over by the other controller, each control unit ( 17 ) two mutually independent microcomputers ( 18 ), both of which contain the safety-critical control software and their sensor data from the operating elements ( 2 . 3 . 2 ₁ . 2 ₂ . 3 ₁ . 3 ₂ ) and / or other sensors ( 21 ₁ . 21 ₂ . 22 ₁ . 22 ₂ ) are interchangeable and comparable, and where a decision-making tool ( 20 ) which, on the basis of the comparison of the result data, decides which microcomputer ( 18 ) or which control device ( 17 ) performs the safety-critical control task. Control device according to Claim 1, characterized in that between the two microcomputers ( 18 ) of a control device ( 17 ) a data interface ( 19 ) is provided, via which the two microcomputer ( 18 ) exchange their results and compare them. Control device according to Claim 1 or 2, characterized in that the microcomputers ( 18 ) of a control device ( 17 ) exchange their result data over the data buses (B1, B2) and compare them. Control device according to one of the preceding claims, characterized in that a safety-critical operating function either by a single to both data buses (B1, B2) coupled control ( 2 ; 3 ) or by two control elements ( 2 ₁ . 2 ₂ ; 3 ₁ . 3 ₂ ), one of which is connected to one and the other to the other data bus is realized. Control device according to one of the preceding claims, characterized in that the two data buses (B1, B2) are independent of each other and are not synchronized. Control device according to one of the preceding claims, characterized in that one of the control devices ( 17 ) with respect to a safety-critical control task is provided as a master control unit, which executes the safety-critical control task, wherein the decision-making means ( 20 ) this safety-critical control task in the event of an error on another control unit ( 17 ) transmits. Control device according to one of the preceding claims, characterized characterized in that any safety-critical operating function at least one sensor coupled to the one data bus, and at least one sensor coupled to the other data bus are assigned. Control device according to one of the preceding claims, characterized characterized in that each data bus (B1, B2) has two bus lines (channels) having. Control device according to one of the preceding claims, characterized in that each microcomputer ( 18 ) has the control software of all safety-critical control tasks, so that on each control unit ( 17 ) the total information of all safety-critical control tasks is provided.