CN1169321C - Method and apparatus for obtaining high integrity and availability in multi-channel system - Google Patents

Abstract

The present invention relates to a multiple-path system which can monitor and identify faults of the components which appear in the system. The present invention is composed of a plurality of external field replaceable components and independent control paths, wherein each path comprises a plurality of passages which are connected to a local bus. A passage processor of each path is used as majority path judgments which are generated in a transmitter of the bus to show whether the majority paths detect the faults of the transmitter. In order to determine the majority path judgments: firstly, the processor generates the majority path judgments; secondly, an instruction path transmits the majority path judgments to other paths through the bus; thirdly, the processor of each path identifies each majority path judgment; fourthly, the processor generates ultimate majority path judgments of each passage; finally, by determining whether the majority paths continuously generates the ultimate majority path judgments which show the faults which appear in the transmitter, the processor generates the majority path judgments.

Description

Obtain the method and apparatus of high integrity and availability in the multi-channel system

Technical field

The present invention puts it briefly and relates to multichannel Flight By Wire avionics system, more particularly, relates to a kind of method and apparatus that obtains high integrity and availability in multichannel Flight By Wire aviation electronics control system.

Background technology

Before Flight By Wire (fly-by-wire) technology was come out, the flight control surface of commercial aircraft was handled by a cover complicated rope and Machinery Control System.Along with the appearance of Flight By Wire technology, these Machinery Control Systems are substituted by fly-by-wire, do not have direct mechanical connection in this control system between pilot guidance device and the flight control surface.Fly-by-wire does not have to use the mechanical connection such as rope, and adopts the pilot guidance transducer, and it can experience the attitude of pilot guidance, and produces with the proportional signal of telecommunication of the attitude of pilot guidance.These signals of telecommunication are comprehensive with other airplane data of Primary Flight Computer, send the flight control surface instruction, thereby handle the action of commercial aircraft flight control surface.

Because fail safe is the factor of paying the utmost attention to of airplane industry all the time, fly-by-wire comprises redundant component usually, so that therein during certain component failure, the pilot is operating aircraft flight safely still.The applying date of authorizing Buss is on June 3rd, 1992, and application serial is NO.07/893, and 339 name is called in the U.S. Patent application of " multiple access redundant Flight By Wire master flight control system " has described example of this fly-by-wire.The present invention with reference to and quoted content and accompanying drawing in these application documents.Described fly-by-wire can be divided into a series of independently control channels, wherein each passage basically with other channel separation.Therefore, a passage breaks down and does not influence working on of rest channels, and the pilot can only use a passage to drive an airplane.This typical fly-by-wire comprises many other redundant systems, to guarantee passenger and crew's safety, for example, it comprises automatic pilot flight main control computer, Air Data Module, engine shows and the unit warning system, Airplane Information Management System etc.Independently these systems of control channel and aircraft are by global communication data/address bus (Global Communication Data Bus) direct communication.But each parts of fly-by-wire comprise the global communication data/address bus, have constituted potential weak connection, and it goes wrong in the time of might disconnecting or become flexible at component failure or with the connection of parts.If such problem is not detected, perhaps correctly not discerned, consequence is catastrophic.

Therefore, be necessary to provide and have a fly-by-wire that can monitor and discern aircraft components fault or defective.Because fly-by-wire is had very strict safety requirements, be necessary to take the comprehensive of height, so that the digital probability that system is broken down, no matter be to cause afunction but do not have obviously at once the unsettled passivity fault of aircraft, still cause the aircraft components fault, have the obvious unsettled initiative fault of aircraft at once, all be lower than per pilot time 1.0E-10.By harmful the abandoning (nuisance condemnation) of avoiding aircraft components, the availability of this system can be reached above-mentioned required comprehensive degree simultaneously by maximum performance.In addition, in this system, need to differentiate occur in independent control channel with occur in reach between the global communication bus and other aircraft components between fault.The present invention is intended to satisfy these and other needs of Flight By Wire aviation electronics control system.

Summary of the invention

The invention provides and monitor and discern the multi-channel system that each unit of this system breaks down.Multi-channel system is made up of with the independent control channel that is connected with global bus the some external replaceable parts of person (Line Replaceable Units).Control channel is connected with global bus with the external replaceable parts, and each computer access and external replaceable parts are transmitters, and it passes through bus sending information.Each passage comprises many paths that are connected with dedicated bus, and wherein, each path is made up of a power supply, a processor and the interface to bus.Yet each passage has only a path, and promptly bus sending information can be passed through in the instruction path.

Each computer access monitors and detects fault in the multi-channel system in an identical manner.Therefore, have only the closed circuit operation of a passage to be added up.Thereby the processor of each path is that each transmitter that is connected on the bus produces the most judgements of a passage (channel majorityopinion) in certain passage, whether detects the fault in the transmitter to represent most passage.Judge that for determining that passage is most the processor of each path of this passage should at first produce the most judgements of a path (lanemajority opinion), whether detect the fault of the transmitter that communicates by global bus with the majority of representing this path.Then, the instruction of the path of each passage sends to other passage to the most judgements of the path of this passage by global bus.

After each path of passage is received that the path that is produced by the instruction path of each passage is most and is judged, the processor of each path of passage to the path of each passage most judge identified, guarantee that detected fault is not that fault by most place, the instruction path passages of judging of transmission path causes.If this passage does not break down, whether the processor of each path has detected the fault of transmitter for this passage produces the most judgements of the path of having identified to show most paths of this passage.The processor of each path produced a majority judgement of having identified by this way for this passage after, the majority that processor will have been identified judged that the dedicated bus by this passage sends in other path of this passage.

Then, the processor of each path produces the most judgements of final path of a passage.Most of paths that the most judgements of the final path of passage can be represented passage whether the path of passage most judge identify after, be consecutively detected the fault of transmitter.Like this, the most judgements of final path can represent whether transmitter breaks down.Whether whether be continuously the most judgements of path of having identified of passage generation by most of paths of determining passage, break down with the expression transmitter, the processor of each path has generated the most judgements of final path of passage.

At last, by determining whether most of passages continue to produce the final most of passage and judge to represent whether transmitter breaks down, and the processor of each path of passage has generated the majority of passage and judged.

According to an aspect of the present invention, a kind of method that is used for determining the control system fault is provided, wherein this control system comprises the global bus of a band plurality of data bus and can be connected to the transmitter that transmits data in the global bus by global bus, these transmitters comprise some external replaceable parts and some computer access, each passage comprises the some paths that connected by dedicated bus, each path of each passage is connected with a data bus, each external replaceable parts also with data/address bus in one be connected, this method comprises: (a) to each transmitter, each passage, generate that path is most to be judged, the fault when whether having detected with most of paths of expression passage that transmitter transmits data by global bus; (b), send the most judgements of path to other passage by global bus to each computer access; And (c) to each path of passage, judge according to path is most, be that each transmitter generates a passage multichannel and judges, this passage is most judge expression whether most of passage detected fault in the transmitter.

According to a further aspect in the invention, provide a kind of multi-channel system that parts break down in the native system that monitors and discern, this multi-channel system comprises: (a) global bus that is made of the plurality of data bus; (b) several external replaceable parts that are connected with global bus make one in each external replaceable parts and the data/address bus to link to each other, and each external replaceable parts forms one and sends the information emission machine by global bus; And the some computer access that (c) are connected with global bus, each computer access also forms one by global bus's transmission information emission machine, each passage comprises some paths that connected by dedicated bus, each path is by a power supply, a processor and the interface to global bus are formed, a path in each passage constitutes an instruction path, it sends information by global bus, and, each computer access detects the fault in the multi-channel system, like this: for each transmitter that is connected with bus, the processor of each bar path of passage generates that passage relevant with transmitter is most to be judged to represent that most of passage whether has detected the fault in the transmitter.

In other preferred embodiment of the present invention, the most judgements of passage also can be handled by the processor of each path, to discern the type that transmitter breaks down, for example, fault is intermittent or permanent, and the fault of identification global bus and the fault in the passage.

Description of drawings

With reference to following detailed description and accompanying drawing, can easily find out above-mentioned each side of the present invention and plurality of advantages.Wherein:

Fig. 1 is the block diagram of a multichannel fly-by-wire, comprises three passages (i.e. three Primary Flight Computers, or title PFC) that are connected with a plurality of external replaceable parts (LRU) by global communication bus;

Fig. 2 is the more detailed block diagram of the PFC among Fig. 1, and wherein each PFC comprises three calculating paths, is used for according to the fault in the present invention's supervision and the detection fly-by-wire;

Fig. 3 A and Fig. 3 B are expression transmits the form of information between passage and LRUs by global communication bus block diagrams;

Fig. 4 A, 4B and 4C are functional block diagrams, have represented that how passage is according to the fault in the present invention's supervision and the identification fly-by-wire;

Fig. 5 is a flow chart, and each path of expression passage is to determine whether that path infers the logic that certain LRU breaks down;

Fig. 6 is a flow chart, and expression determines whether that most paths of passage infer the logic that certain LRU breaks down;

Fig. 7 is a flow chart, shows the only path that determines whether passage and infers the step that certain LRU breaks down;

Fig. 8 is a flow chart, shows the step that is used for identifying the judgement of making at Fig. 7;

Fig. 9 is a flow chart, shows the most paths that determine whether passage and still infer the step that certain LRU breaks down after identifying;

Figure 10 is a flow chart, shows the step that determines whether that definite certain LRU of multi-channel breaks down;

Figure 11 is a flow chart, shows the step of determining whether communication bus breaks down;

Figure 12 is a flow chart, shows to determine whether certain LRU or global communication bus the step of intermittent defect occurs;

Figure 13 is a flow chart, shows to determine whether PFC and LRU are in active state, and the step that communicates by global communication bus;

Figure 14 is a flow chart, shows to determine whether certain LRU is in the step of resting state.

Embodiment

Fig. 1 represents the block diagram of multichannel Flight By Wire aviation electronics Critical Control system.Fly-by-wire 31 comprises three independences and the flight control channel that separates, i.e. three independences and the Primary Flight Computer that separates or claim PFC, comprise 40, one central authorities' flight control channels 42 of a left flight corridor and a right flight control channel 4 (hereinafter term " passage " and " PFC " will alternately use). Control channel 40,42,44th, physics and electricity are isolated, so that the inefficacy of arbitrary passage can not have a negative impact to the work of other passage.In order to realize this isolation, three separate control channels must asynchronous working.Yet asynchronous working has caused the temporal delay between the channel function.The those of ordinary skill in aviation electronics field is appreciated that considers that this delay is the requirement for the parameter that adapts to different fly-by-wires.But these parameters are not described at this, because be not that to understand the present invention necessary to their understanding.

Each passage or PFC 40,42,44 pass through global communication bus 34, and send and receive the flight control signal between other aviation electronics parts.These aviation electronics parts comprise: the flight at controls main control computer, and the atmosphere data module, engine shows and the unit warning system, Airplane Information Management System etc.Because type, function and the purpose of aviation electronics parts are unessential to describing the present invention, these parts completely are expressed as external replaceable parts LRUs 30 in Fig. 1, this is a known term of the prior art, is used for describing the aviation electronics parts and can the artificially installs on the aircraft or from aircraft as a unit and unload.

Each LRUs 30 sends data by the PFC 40,42,44 of global communication bus, is used for determining the instruction of chain of command.Global communication bus 34 is made up of three data/address buss, left bus 33, central bus 35 and right bus 37.In a preferred embodiment, data/ address bus 33,35 and 37 adopts ARINC629 data communication chain mode, and this is a standard of airplane industry, yet also can adopt the data communication chain of other type.

Control channel each flight control surface that respectively flies of control system by a kind of LRU operating aircraft of specific type, promptly make movement controller electronic unit (ACE) 38 and make the pilot can only handle the flight of passage for one, like this, the ACE 38 of some redundancies receives pilot's control signal from (not shown) such as the control stick of aircraft, wheel, pedal, rudders.ACE 38 then sends to passage 40,42,44 to the pilot guidance signal by global communication bus 34.Based on pilot guidance signal that receives from ACEs and the data that receive from LRUs 30, passage produces a series of flight control surface instruction, by global communication bus flight control surface commands returns ACEs 38.ACEs 38 finishes the conversion of counting to mould of the flight control surface instruction of each passage generation, and the data after these conversions are sent to a plurality of power control units (PCUs) 36, the motion of each flight control surfaces of their control aircrafts.Very clear, can not make mistakes by the communication between any aviation electronics parts of global communication bus.Description by face can clearly be seen that, this invention can detect by global communication bus 34 at ACE 38, LRU 30 and passage 40,42, garble between 44, definite mistake is that the permanent or intermittent fault because of certain LRU or communication bus 34 causes, still the fault because of passage itself causes.For convenience of description, LRU also will be called as ACEs.

Fig. 2 shows the internal part of the passage 40,42,42 that is connected to global communication bus 34.Because 40,42,44 are actually and are equal to, following narration about left passage 40 is equally applicable to centre gangway and right passage 42,44.Therefore, will misalign centre and right passage goes through.

Left side passage 40 comprises three redundant computation paths 46,48,50.Each path is made up of 54 and input/output interfaces of 52, one microprocessor units of a power supply (PS) (MPU) (I/O) 60.The interface 60 of each path can make this path be directly connected on the global communication bus 34.The MPUs 54 of passage 40 each path is connected by the data/address bus between the path of a special use 54, so that MPU 54 and path 46,48,50 intercom mutually.Yet, in a preferred embodiment of the invention, the microprocessor hardware of each MPU is different, detection with the generic design mistake of quickening any little process chip, for example, the microprocessing unit 54 of path 46 is to be made of 29050 microprocessors that Advanced Micro Devices company produces, the MPU 54 of path 48 is made up of 68040 of Motorola manufacturing, and the MPU 54 of path 50 is made of 80486 of Intel Company's manufacturing, those of ordinary skill in the art can recognize that the included parts of MPUs 54 are also more than shown in Figure 2, because they are normal elements, they are not narrated, this does not influence the understanding of the present invention.

Which kind of type no matter, path 46,48,50 MPU 54 is connected to I/O interface 60 by the data/address bus between path.Then, interface 60 is connected to global communication bus 34, and interface just can be from central bus 35 and right bus 37 received signals, and central bus and right bus also can transmit and receive data by left bus.Interface 60 comprises that also 62,63,64, one error registers of three error registers interrelate with each data/address bus 33,35 or 37.In a preferred embodiment of the invention, adopt the error register of 16 bits.One of ordinary skill in the art as can be seen, the parts that interface 60 comprises are also more than shown in Figure 2, because they are normal elements, do not describe at this, this does not influence the understanding of the present invention.

Although each path 46,48 and 50 is connected on the global communication bus 34, yet at any one time, have only a path to be allowed to send information 78 by global communication bus.Such path is called as " instruction path ".The path 46 of the passage of subjectively selecting in illustrated embodiment 40, the path 48 of passage 42, the path 50 of passage 44 are in order to represent the instruction path of respective channel, so that discuss.Those of ordinary skill in the art can recognize that based on the requirement of fly-by-wire 31, any path 46,48 or 50 of arbitrary passage all can be the instruction path in the passage 40,42 or 44.

As Fig. 3 A, shown in the 3B, passage 40,42 and 44 and LRUs 30 send (being commonly referred to as data) such as data, instructions with the form of information 78 by global communication network 34 at this.Therefore, passage 40,42 and LRU 30 can be commonly referred to as transmitter (TMR).Information 78 is made up of some 16 character strings 70.In an embodiment of the present invention, character string 70 is by identification code 72, and plurality of data word 74 and Cyclic Redundancy Check word are formed.The specific T MR of identification code 72 identification transmission information 78, each data word 74 is made up of 16 the data relevant with specific T MR, and the CRC word is used for being presented at the situation of corrupted data on the global communication bus.Passage 40,42 and 44 path 46,48,50th, synchronous, so that each path receives and handles the information of receiving 78 synchronously.But as following more detailed description, if in global communication bus 34, LRUs 30 or 38 perhaps occurs wrong or causes wrong factor among the PFCs 40,42 and 44, and the path of each passage is so that each passage is made separately decision-making according to these information 78.

Fig. 4 A, 4B and 4C are functional block diagrams, have represented passage 40,42 and 44 how according to the mistake in the present invention's monitoring and the identification fly-by-wire 31, with the comprehensive and availability of the height that obtains system.Because the function that passage 40,42 and 44 is finished is actually identical, so only the function that a passage is finished is described.In the following description, this passage is called as " own passage " (OC), and subjectively selecting this passage is for convenience and corresponding with the left control channel 40 of fly-by-wire 31.Correspondingly, passage 42 and 44 subjectively be called as respectively " its passage 1 " (OC1) and " its passage 2 " (OC2).Yet if describe the function that passage 42 is finished, passage 44 is called as " its passage 1 ", and passage 40 will be called as " its passage 2 ".Therefore, those of ordinary skill in the art as can be seen, the function that " own passage " finished also can be finished in " its passage ".

Please refer to Fig. 4 A, this illustrates own passage for monitoring and discern the function that the fault in the fly-by-wire 31 is finished.Those of ordinary skill in the art can be clear that, described function is that the MPU 54 by the path 46,48 of own passage and 50 finishes synchronously.Shown in Fig. 4 A, in each path 40,42 and 44, processing procedure is begun by the error register function for monitoring.Especially, error register monitor 100 monitors by passage by global communication bus from LRU 30 and 38 and other passage 40,42 and 44 information 78 that receive.For ease of explanation and discussion, the present invention is directed to the information 78 that sends through global communication bus 34 by certain specific T MR (no matter being PFC or LRU) ', those of ordinary skill in the art can recognize, in the fly-by-wire by LRU 30 or 38, the perhaps information 78 that send of passage 40,42 or 44 and information 78 ' processed in the same way.

Because path 46,48 and 50 through data/address bus 33, arbitrary bus in 35 or 37 from specific TMR receive information 78 ', the error register monitor 100 of path produces one and receives fault (RCVF) signal, and this signal can show whether specific TMR is just sending an information that has extra mistake.Each path of own passage then sends its RCVF signal by the dedicated bus 56 of own passage to the MPU 54 of other path.Since the information 78 that each path Synchronous Processing of passage is received from global communication bus 34 ', the MPUs 54 of each path will roughly send to its RCVF signal other MPUs simultaneously.Therefore, each path 46,48 and 50 of own passage will be received three RCVF signals (all representing with numeral 20).

In module 122, the path that each path 46,48 and 50 MPU 54 finish three RCVF information 20 intersects associating, determine whether most path infer specific TMR just sending the information 78 that has extra mistake '.This decision-making is called as the most judgements of path of own passage, completely represents with numeral 22 in Fig. 4 A.Preferably each path of own passage is finished three path intersection associatings that receive fault-signal 20, and each path is determined the most judgements 22 of a path.The instruction path 46 of own passage is then judged to other passage transmission path majority by global communication bus 34.

As noted above, its passage 1 and its passage 2 also can be finished above-mentioned functions.Therefore, the instruction path 48 and 50 of its passage 1 and its passage 2 sends the most judgements 22 of their paths separately by global communication bus to own passage (and each other) respectively.So, each path 46 of own passage, 48 and 50 from global communication bus 34 receive paths 40,42 and 44 path majority judges 22, and each path 46,48 of own passage and 50 microprocessor 54 are then identified the most judgement of the path 22 (modules of receiving 194,204 and 206), guarantee that passage 40,42 and 44 is normally worked when instruction path separately sends that its path is most judges 22.Thereby each path produces the most judgements of the path of having identified for passage separately.In Fig. 4 A, the most judgements of the path after each passage is identified are all represented with numeral 24.Majority after each passage is identified is judged other path that is sent to own passage by MPU 54 through dedicated bus 56.

Can see that in Fig. 4 A the path 46,48 and 50 of own passage receives the most judgements of path after the evaluation that is produced by each path.More particularly, each path is received three groups of most judgements of the path after the evaluation, and they are: 1) path of own passage is most judges, by path 46,48 and 50 evaluations; 2) path of its passage 1 is most judges, is identified by path 46,48 and 50; 3) path of its passage 2 is most judges, is identified by path 46,48 and 50.Microprocessor 54 is then finished the most paths intersection associating (modules of judging 208 of path after each group is identified, 234 and 236), to determine each passage 40,42 and 44 final path is most judges (all representing with numeral 26) whether to have determined that with most paths of expression passage certain fault results from certain specific TMR in Fig. 4 A.

At last, in module 250, each path 46,48 and 50 is finished the passages intersection associating that final path majority is judged, determines the most judgements 28 of passage, and it represents whether multi-channel determines that fault has taken place specific TMR.In another embodiment of the present invention, the most judgements of passage are handled by each path, fault type that identification specific T MR occurs or the fault that is identified in other parts in the fly-by-wire 31.

Please refer to Fig. 4 B, there is shown the most decision-makings of judging of path that one of path by own passage is made.Because the function that each path 46,48 and 50 of passage is finished is actually identical, and each path finishes simultaneously, so only locate the function of a path of passage is described.In being described below, this path is called as " own path " or " OL ", and path 46 correspondences of subjectively selected and own passage.Correspondingly, path 48 and 50 subjectively be called respectively " its path A " (OLA) and " its path B " (OLB).Yet if describe the function that path 48 is finished, path 48 just can be called as " own path ", and path 50 and 46 is called as " its path A " and " its path B " respectively.By top description, one of ordinary skill in the art is appreciated that the function of finishing shown in Fig. 4 B in own path, in fact also finishes simultaneously in its path A and its path B simultaneously.For ease of explanation, the function with dashed lines that its path A and its path B finish is represented in Fig. 4 B.

As previously mentioned, the LRU 30 of fly-by-wire 31 or 38 and the particular data bus 33,35 or 37 of PFC 40,42 and 44 by global communication bus communicate by letter with 44 with passage 40,42 in the mode that sends signal 78.Information is received by each path 46,48 of each own passage and 50 interface.Specifically please refer to the own path of own passage, the information 78 that specific T MR in the fly-by-wire is sent ' and each character string 70, the fault register 62 of interface 60 is deposited in the error message of relevant character string, in 63 or 64, and interface 60 is to be associated with the specific bus that specific T MR sends usefulness.Error register has stored the word of a pre-determined bit length, as 16, and the particular type of each expression mistake when character string transmits on global communication bus 34 and damages.Thereby if character string 70 comprises mistake, corresponding position can be put 1 in the error register of association, otherwise this position is put 0.Supervision is used the error message that is stored in error register 62,63 and 64 at the error register of function shown in Fig. 4 module 100, determine whether the error message 78 whether the specific T MR that is monitored infers extra quantity ' transmission.Show in detail among Fig. 5 to making this decision-making logic of the present invention.

Logic among Fig. 5 starts from module 102, the MPU 54 read error registers 62 of own path, 63 or 64, they send the data/address bus 33 that uses with specific T MR, 35 or 37 associations, with obtain with information 78 ' the fault message of certain character string 70 association, and information 78 ' send by the specific T MR of 72 identifications of the identifier in the character string 70.In decision-making module 104, this logic can determine whether to detect mistake in character string.In other words, this logic can determine whether that the error register position that is associated with this character string is changed to 1.If sure, logic flow proceeds to module 106, is used for that the error counter value of number of errors increases in the trace information this moment.But, if the result of decision-making module 104 negate, the error counter value does not increase, logic flow is directly to decision-making module 108.At decision-making module 108, this logic can determine information 78 ' the error message of last character string 70 whether from correct error register, read, that is, the information 78 that whether sends by specific TMR ' in the error message of all character strings 70 all processed.If not, logic flow turns back to module 102, reads from correct error register with the error message of character late string association.Logic is followed replicated blocks 104 to 108, and is processed up to whole information.

If the result of decision-making module 108 is sure, that is, if the error message of last character string of information is read, logic flow proceeds to decision-making module 110.At decision-making module 110, this logic can determine whether error counter has exceeded first preset threshold value, and it is equivalent to the maximum wrong number estimated in the given time period.As can be seen, first preset threshold value is the function of the different parameters of fly-by-wire, comprises that the system failure is lower than the restriction of the security requirement of the such harshness of 1.0E-10 when every flight.Therefore, initial threshold can change with the fly-by-wire parameter, to reach the comprehensive degree of expectation.

If the result of decision-making module 110 is sure, logic flow proceeds to module 112, at this moment the reception fault-signal (RCVF of own path _OL) be changed to very, show that own path infers that specific TMR just sends wrong character string with the failure rate that exceeds the quata.In other words, own path infers that certain type fault has appearred in specific TMR.Yet, if the result of decision-making module 110 negates that logic flow proceeds to module 114, at this moment RCVF _OLBe changed to vacation, show that own passage do not infer the fault of specific T MR.Be appreciated that RCVF _OLWith the specific T MR association that is monitored by the error register monitor, thereby RCVF _OLAlso sending used particular data bus 33,35 or 37 with specific T MR is associated.At module 116, RCVF _OLBe stored among the internal memory of own path MPU 54, and be sent to other path of own passage, infer that specific TMR sends vicious character string with the speed that exceeds the quata so that each path 46,48 and 50 self can determine whether most paths of own passage.

Please see Figure 4B now again, those of ordinary skill in the art utilizes logic shown in Figure 5 as can be seen, and its path A of own passage and its path B have produced their RCVF signal, i.e. RCVF _OLAAnd RCVF _OLB, and they are sent to the own path of own passage by exclusive data bus 56.Correspondingly, own path is respectively from its path A and its path B reception RCVF _OLAAnd RCVF _OLB, and from the internal memory of its MPU, recover RCVF _OLSignal.In module 122, the MPU 54 of own path finishes the path 46 by own passage, the path of 48 and 50 three RCVF signals that produce intersects unites, so that be that own passage forms the most judgements of a path, whether the most of paths of own passage infer that specific TMR sends vicious character string with the speed that exceeds the quata in its expression, and promptly this specific TMR breaks down.

Being used for finishing the RCVF signal path intersects the logic that the own path MPU 54 of associating adopts and has done to illustrate in more detail at Fig. 6.This logic flow is from module 124 beginning, determines whether that at this RCVF is set to very at least two paths of own passage.If the result is sure, logic flow proceeds to module 126, and at this moment, path is most judges that (LMO) is changed to very, shows that two paths of passage infer that specific TMR sends vicious character string with the speed that exceeds the quata at least.In other words, two of passage paths are inferred the fault of specific T MR at least, thereby specific TMR is held " bad judgement ".Yet, if the result of decision-making module 124 negates that at least two paths have determined that specific TMR does not break down.Thereby LMO is made as vacation, and logic flow proceeds to module 130.At decision-making module 130, this logic determines whether LMO is set as very.If logic flow proceeds to module 132, bad judgement counter increment this moment.Bad judgement counter monitors that at least two paths of own passage produce the number of times of bad judgement to specific T MR.Yet, if the result of module 130 negate, bad judgement counter depreciation, logic flow proceeds to decision-making module 136.

At decision-making module 136, this logic is determined badly to judge whether counter has exceeded second preset threshold value.Second preset threshold value is suitable to the greatest hope number of times of the bad judgement of specific T MR with most paths.In a preferred embodiment, second preset threshold value also is confirmed as the function of different fly-by-wire parameters, and parameter comprises aforesaid security-stringent requirement.Thereby the comprehensive degree of system is further improved.If the result of decision-making module 136 is sure, logic flow proceeds to module 138, and at this moment, the most judgements of confirmed path (are also referred to as the grey Reflector GFF of own passage _OC) be changed to very, show that at least two paths of own passage infer that constantly specific TMR just sends vicious character string with the speed that exceeds the quata.In other words, certain type fault in the fly-by-wire 31 is confirmed by the bad judgement that continues of the most paths of own passage.If yet the result of decision-making module 136 negates that logic flow proceeds to module 140, at this moment GFF _OCBe changed to vacation, represent that most paths of own passage have determined that the fault among the specific T MR does not take place because most paths do not continue to infer fault.Infer that the possible errors condition of fault does not continue to exist, and has avoided specific the harmful of TMR to abandon owing to make own path.Thereby the availability of such specific T MR is maintained in fly-by-wire 31.In addition, one of ordinary skill in the art can be seen, " bad judgement " lasting requirement also is adapted to the asynchronous working of three passages.At last, if path and all the other two are instantaneous inconsistent, this path will be obeyed and mostly be judged.

Path is most in case own passage is confirmed judges and GFF _OCBe determined, it will be sent to its passage 1 and its passage 2 of fly-by-wire 31, to be used for the realization of other function.Thus, logic flow proceeds to decision-making module 142, and this moment, this logic determined whether own path is the instruction path of passage.If logic flow proceeds to module 144, at this moment, the MPU 54 of own path passes through global communication bus 34 with GFF _OCSend to its path A of fly-by-wire 31, its path B, its passage 1 and its passage 2.If own path is not the instruction path, logic proceeds to module 146, and at this moment, the MPU 54 of own path is only GFF _OCDeposit internal memory in to use it for anything else.Because its path A and its path B finish this function simultaneously, can see that the instruction path of own passage (its path A, or its path B) sends GFF to other passage of module 144 _OC

Work as GFF _OCWhen being sent by the instruction path of own passage, own path must determine whether it holds bad judgement to specific T MR separately.If own probably path breaks down, rather than the problem of specific TMR.So at decision-making module 148, whether logic is determined the own path of specific TMR is that RCVF is changed to genuine unique path, i.e. RCVF _OLBe changed to true and RCVF _OLAAnd RCVF _OLBBe changed to vacation.If the result is sure, logic flow proceeds to module 150, and this moment, the own path reception fault-signal (OWNF) to specific TMR was changed to very, represented that own path may break down.But, if the result of decision-making module 148 negates that own path does not break down and OWNF in the module 152 is changed to vacation.As mentioned above, RCVF _OLSending each data/ address bus 33,35 or 37 that adopts with specific TMR and specific T MR is associated.Like this, clearly, OWNF also transmits each data/ address bus 33,35 or 37 that uses with specific TMR and TMR and is associated.As described below, OWNF is adopted the decision-making of finishing a PFC path fault by own path, confirms that the own path of own passage breaks down.

With reference to Fig. 4 B, the MPU 54 of own path finishes the fault decision-making of PFC path in module 154, to determine whether own path breaks down.Finished the logic of PFC path fault decision-making describes in detail at Fig. 7 by MPU 54 being used for of adopting.If own path is inferred the three or more TMR that sends on each data/ address bus 33,35 or 37 and breaks down that own path then more may break down individually.Therefore, 156 beginnings of self-decision module, this logic can determine whether that own path infers that on left bus 33 at least three TMR that transmit break down, and other path is not inferred same fault, just, whether OWNF is placed in very with respect to the three or more TMR that transmits on left bus 33.If like this, left bus failure discrete magnitude (LBF) is placed in 158 modules very, shows that own path infers that separately at least three TMR break down on left bus.If the result of decision-making module 156 negates that LBF is changed to vacation in 160 modules, represents that own path is not to infer that separately at least three TMR break down on left bus.

Logic flow then proceeds to decision-making module 162, and at this moment, it determines whether that own path infers that separately at least three TMR break down on central bus, and all the other paths are not inferred same fault.If like this, in module 164, the fault discrete magnitude (CBF) of central bus is changed to very.If not, in module 166, CBF is changed to vacation.Equally, logic proceeds to decision-making module 168, and at this moment, it determines whether that own path infers that separately at least three TMR break down on right bus, and all the other paths are not inferred same fault.If like this, among module 170, the fault discrete magnitude (RBF) of right bus is changed to very.If not, in module 172, the RBF discrete magnitude is changed to vacation.

At LBF, after CBF and RBF were set up, logic step proceeded to module 174, and at this moment, it determines whether LBF, and any of CBF or RBF is changed to very.In other words, this logic can determine that whether own path is the path that at least three TMR that judgement unique in passage sends break down on bus 33,35 or 37.If own path fault discrete magnitude (OLF) is changed in module 176 very, can confirm to exist on own path the possibility of fault so.If the result of decision-making module 174 negates that OLF is changed to vacation in module 178.At decision-making module 180, this logic can determine whether that OLF is changed to very, if the failure counter value in module 182 increases.Failure counter is followed the tracks of own passage is judged the three or more TMR faults that occur separately on specific bus number of times.If OLF is false, so own path is not for judging the unique path of this fault, thereby in module 184, the failure counter value reduces.In decision-making module 186, this logic can determine whether failure counter has exceeded the 3rd preset threshold value, and it is equivalent to the maximum times that own path causes three or more TMR to break down on bus.The same with above-mentioned second preset threshold value, the 3rd preset threshold value is the function of different system parameter, can obtain high integrity like this in fly-by-wire.

If the result of decision-making module 186 is sure, own path continues separately to judge that three or more TMR break down on the specific bus, thereby own path most possibly breaks down.Own path this continue inconsistent must break down at another path of own passage and add own path before solve, be that own passage produces that incorrect confirmed path is most to be judged.Therefore, in module 188, a path receives fault-signal (LRCVF) and is changed to very, shows that fault has appearred in own path.Shown in Fig. 4 B, LRCVF is then utilized by other PFC function in the module 192, PFC path redundancy management function (not shown) for example, it uses LRCVF to suppress where necessary or restarts own path, and prevents that own path from forming the most GFF of judgement of wrong confirmed path _OCYet, if the result of decision-making module 186 negate, own path does not break down probably, LRCVF is changed to vacation in module 190, avoids once more harmful the abandoning of aircraft components improved the availability of system.

Referring now to Fig. 4 A and 4C, clearly concurrent the serving of path 48 and 50 generations stated with the relevant most GFF of judgement of they self confirmed paths of own path _OC1And GFF _OC2Therefore, each path 46,48,50 of own passage is by global communication bus 34, from its passage reception GFF _OC, receive GFF from its passage 1 _OC1, receive GFF from its passage 2 _OC2Next function that the own path of own passage is finished is to identify each GFF signal of receiving, and to guarantee this passage, the PFC that promptly sends specific GFF does not break down.Like this, MPU 54 identifies GFF in module 194,204 and 206 _OC, GFF _OC1And GFF _OC2Fig. 8 shows MPU 54 and identifies GFF _OCThe logic that adopts.Those of ordinary skill in the art can see that in module 204 and 206, in fact the MPU 54 of own path has utilized with module 194 identical logics and identified GFF _OC1And GFF _OC2Thereby, the logic that adopts in module 204 and 206 is not described further.

With reference to Fig. 8, logic step at this moment, can not be tested the PFC FRESH that determines whether with own passage association from 196 of decision-making module _OCSignal has been changed to very.As following discussed in detail, PFCFRESH _OCWhether own passage is also on one's own initiative to its passage 1 and its passage 2 transmission information 78 in expression.If own passage also is in active state, GFF _OCProcessing can proceed.Therefore, logic flow will proceed to module 198, and this moment, the path that will identify of MPU 54 of own path was mostly judged (GFF _{(OC) (OL)}) be arranged to the most GFF of judgement of (but for before unidentified) path of equaling to confirm _OCIn module 200, the MPU 54 of own path passes through exclusive data bus 56 with GFF _{(OC) (OL)}Send to its path A and its path B of its passage.

If the result of decision-making module 196 negates, if i.e. PFC FRESH _OCBe false, own passage does not send information 78 to its passage on one's own initiative.Thereby own passage most possibly breaks down.Thereby logic flow proceeds to module 202, herein without identifying and present disabled GFF _OCSignal is stored in the internal memory of MPU 54, so that can be adopted to close own passage where necessary by other PFC function.

GFF _OC, GFF _OC1And GFF _OC2After module 194 was identified by own path, the path of each passage after the evaluation is most judged GFF _{(OC) (OL)}, GFF _{(OC1) (OL)}And GFF _{(OC2) (OL)}Be sent to other path of own passage through exclusive data bus 56.Shown in Fig. 4 C dotted line, in module 194,204 and 206, its path A and its path B are also to GFF _OC, GFF _OC1, GFF _OC2Make evaluation.Therefore, its path A most GFF of judgement of path that will identify _{(OC) (OLA)}, GFF _{(OC1) (OLA)}And GFF _{(OC2) (OLA)}, the path that its path B will identify is most judges GFF _{(OC) (OLB)}, GFF _{(OC1) (OLB)}And GFF _{(OC2) (OLB)}Send to own path by exclusive data bus 56.As a result, each path 46,48 and 50 of own passage receives that one group of passage path after identifying is most to be judged.For example, first group of receiving of own path comprises GFF _{(OC) (OL)}, GFF _{(OC) (OLA)}And GFF _{(OC) (OLB)}, second group comprises GFF _{(OC1) (OL)}, GFF _{(OC1) (OLA)}And GFF _{(OC1) (OLB)}, the 3rd group comprises GFF _{(OC2) (OL)}, GFF _{(OC2) (OLA)}And GFF _{(OC2) (OLB)}

Then, the MPU 54 of own path finishes passage separately and identifies that path most paths of judging in back intersect associating, so that be that the passage 40,42 and 44 of fly-by-wire 31 is determined the most judgements of final paths.More particularly, in module 208, finish first group of the own passage most path of judging of path after identifying and intersected associating.Equally, finished most paths of judging of path after second group the evaluation of its passage 1 and intersect associating in module 234, and in module 236, the most paths of judging of path after having finished to its passage 2 the 3rd group and identifying intersect associating.Fig. 9 has been shown in further detail the path most path crossbinding fashionable logics that adopt judged of MPU 54 after first group of evaluation finishing own passage of own path.Yet, those of ordinary skill in the art can be clear that very much, own path MPU 54 has adopted and has finished second and third group with first group of practically identical logic and identify that path most paths of judging in back intersect associating, and promptly the most paths of judging of the path after the evaluation of its passage 1 and its passage 2 intersect associating.So the logic that adopts in module 234 and 236 is not described further.

As shown in Figure 5, the logic of module 208 starts from decision-making module 210, at this moment, tests with the path majority after the evaluation of two paths determining own passage judging whether to be changed to very at least, i.e. majority judgement GFF after at least three evaluations _{(OC) (OL)}, GFF _{(OC) (OLA)}And GFF _{(OC) (OLB)}In two be true.If the result is sure, logic flow proceeds to module 122, be changed to very at this instantaneous path most judgement signal (LMO '), even represent that two of passage paths infer that also specific TMR sends vicious character string with the speed that exceeds the quata at least after identifying.In other words, at least two paths have " the bad judgement after the evaluation " to specific T MR now in this passage.Yet, if the result of decision-making module 210 negate, LMO ' is changed to vacation in module 214, is illustrated in after the GFF signal identifies, most paths of own passage are no longer inferred the fault of specific T MR.At decision-making module 216, this logic determines whether LMO ' is changed to very.If the bad judgement Counter Value so, after the evaluation in module 218 increases.Most paths that bad judgement counter after the evaluation is used for determining whether own passage have bad judgement after the evaluation to specific T MR always, so that avoid the harmful of specific T MR abandoned, to keep the availability of system.Yet, if the result of decision-making module 216 negates that because most path is not inferred the fault of specific T MR, the bad judgement Counter Value after the evaluation in module 220 reduces.

At decision-making module 222, bad after logic determine to be identified judges whether Counter Value surpasses the 3rd preset threshold value, and it equals the maximum times that specific T MR that the most paths of own passage have identifies the bad judgement in back.In preferred enforcement, preset threshold value is the function of different fly-by-wire parameters, comprises the safety requirements of aforesaid harshness.Thereby the degree of integration of multi-channel system further improves again.If the result of decision-making module 222 is sure, the most judgements of final path (are also referred to as path allied signal LCS _OC) be changed to very, being illustrated in after the evaluation of GFF signal, at least two paths of own passage determine that constantly specific T MR just sends vicious character string 70 with the speed that exceeds the quata.In other words, the final path of own passage is most judges that fault has appearred in expression specific T MR.Yet, if the result of decision-making module 222 negates that this logic proceeds to module 226, at this LCS _OCBe changed to vacation, represent that most paths of own passage have determined that specific T MR does not break down.Those of ordinary skill in the art can find out, in both cases, does not enjoy final most judgements that most the 3rd paths of judging will be obeyed own passage in the own passage.Can see that also what this can be avoided being harmful to abandons, and has ensured the availability of system.

At LCS _OCBefore being used for other purposes, own path must determine whether it determines the fault of specific T MR separately.Thereby, at LCS _OCBe changed to after the true or false, logic flow proceeds to decision-making module 228, and it determines that whether own path is that the path of evaluation of specific T MR is most and judges the unique path that is changed to genuine passage at this, i.e. GFF whether _{(OC) (OL)}Be changed to very, and GFF _{(OC) (OLA)}And GFF _{(OC) (OLB)}Be changed to vacation.If the result is sure, logic flow proceeds to module 230, the own path reception fault after this identifies (OWNF ' _OC) be changed to very.Yet, if the result of decision-making module 230 negates OWNF ' _OCBe changed to vacation.Shown in Fig. 4 C, OWNF ' is used in the decision-making of PFC path fault in module 238 _OCWhether the own path of determining passage breaks down or lost efficacy.

The logic that is used for finishing the decision-making of PFC path fault in module 238 is in fact identical with the logic of finishing the path fault decision-making in module 154.See Fig. 7.Thereby, utilize OWNF ' _OCThe logic of finishing the decision-making of PFC path fault no longer describes in detail.Shown in Fig. 4 C, if own path breaks down, the path reception fault-signal after the evaluation (LRCVF ' _OC) be changed to very.Otherwise, because own path does not break down LRCVF ' _OCBe changed to vacation.LRCVF ' _OCThen by other PFC function in the module 204,, be used for suppressing where necessary and restarting own path as PFC path redundancy management function (not shown).

Can see that from the description of front the path after the evaluation of its passage 1 is most judges that the path of (module 234) intersects the associating employing with above-mentioned the same logic, is its passage 1 (LCS _OC1) and identify after own path receive fault (OWNF ' _OC1) the most judgements of the final path of generation.Equally, in module 236, betide the GFF in the module 236 _{(OC2) (OL)}, GFF _{(OC2) (OLA)}And GFF _{(OC2) (OLB)}Path crossbinding be combined into its passage 2 and identify after own path receive fault (OWNF ' _OC2) a most judgement of final path of generation (LCS _OC2).OWNF ' _OC1And OWNF ' _OC2Shown in module 242,244,246,248 in further handle.In case the MPU 54 of own path is a passage 40,42 and 44 determine the most judgements of final path, then finish the most paths of judging of final path and intersect associating in module 250, thus determine expression whether most passages detect that the passage of fault of specific T MR is most to be judged.

Figure 10 shows in module 250 to finishing LCS _OC, LCS _OC1And LCS _OC2Path intersect associating and the logic used.Logic starts from decision-making module 252, and at this moment, it determines to judge with the final path of specific T MR association is most whether at least two passages in fly-by-wire 31 have been changed to very.In other words, logic determines whether that at least two passages have the bad passage judgement to specific T MR.If the result of module 252 is sure, passage is most judges that (CMO) is changed to very, and at least two passages can determine that the fault of certain type appears in specific TMR in the expression fly-by-wire 31.If but the result of decision-making module 252 negates that CMO is changed to vacation in module 256, represents that most of passages can determine that specific T MR does not break down.At decision-making module 258, logic determines whether CMO is changed to very.If bad passage judges that Counter Value increases.See module 260.Bad passage judges counter monitors how multi-channel is continuously specific T MR and forms bad passage and judge, so that abandoning of avoiding being harmful to improves the availability of system.Yet, if the result of decision-making module 258 negates that owing to do not infer the fault of specific T MR, bad passage judges that Counter Value reduces.See module 262.

Referring to decision-making module 264, logic determines bad passage judges whether counter has exceeded the 4th preset threshold value, and it equals most of passages specific T MR is had the maximum times that bad passage is judged.The 4th preset threshold value is by different fly-by-wire parameters, comprises the determined function of safety requirements of aforementioned harshness, so that further improve the comprehensive degree of system.If the result of decision-making module 264 is sure, then in module 266, TMR useful signal (TXVLD) is changed to vacation, shows that the multi-channel of fly-by-wire 31 continues that specific T MR is had bad judgement.In other words, most of passages can be confirmed certain type fault of occurring in specific T MR.If the result of decision-making module 264 negates that TXVLD is changed to very in module 268 so, represents that the multi-channel of fly-by-wire 31 can determine that specific T MR does not break down.Similarly, one of ordinary skill in the art can be clear that this process has been avoided the harmful of specific T MR abandoned.TXVLD then is stored in the internal memory of MPU 54, to finish other PFC function shown in the module 270, as the input signal management function of PFC, is used for when the TXVLD of specific T MR makes mistakes, and gets rid of the use to the data that come from this TMR.

Shown in Fig. 4 C, in the path 46,48 and 50 of own passage, passage intersects to unite synchronously to be finished.Thereby each path of own passage produces the TXVLD signal with specific T MR association.Between the path of the state of TXVLD in a passage will be identical.

Referring again to Fig. 4 C, in module 250, be then used in other function by adopting the passage intersection to unite definite TXVLD signal, whether intermittent or permanent fault appear to determine TMR, and perhaps whether global communication bus really breaks down.In module 272, the MPU 54 of own path finishes the function for monitoring of data/address bus.MPU 54 illustrates in greater detail in Figure 11 for finishing the used logic of this function.Logic starts from decision-making module 274, and it determines whether that the TXVLD of at least two TMR working is changed to vacation on specific bus herein, and bus can be left bus 33, central bus 35 or right bus 37.TXVLD may be changed to vacation because of the intermittence or the permanent fault of communication bus 34 if so.Thereby in module 276, a bus useful signal (BVLD) is changed to vacation, and fault has appearred in a certain bus 33,35 or 37 that expression specific T MR uses.Otherwise in module 278, BVLD is changed to very.In module 280, BVLD is stored in the internal memory of MPR 54 of own path, so that finish other PFC function, as PFC input signal management function, if the BVLD of the LRU that sends on specific bus is changed to vacation, it is invalid that this SIGNALS MANAGEMENT function will make by tape jam data/address bus 33,35 or 37 all information that send.

Referring again to Fig. 4 C, after the data/address bus function for monitoring was finished in module 272, the MPU54 of own path finished initiatively TMR function for monitoring in module 284.Figure 12 at length shows with MPU and finishes this function and the logic that adopts.Logic starts from decision-making module 286, and this moment, it determined that whether the TXVLD of specific T MR becomes present falsity from the true value in past.If so, TXVLD rollover counter value increases in module 288.The TXVLD rollover counter is followed the tracks of TXVLD from really becoming false number of times.If the result of decision-making module 286 negates, the TXVLD rollover counter is not rised in value, and logic flow proceeds to decision-making module 290.

At decision-making module 290, this logic determines that whether the active transmitter useful signal (TMRVLD) of specific T MR becomes present falsity from the true value in past.As described below, TMRVLD represents whether specific TMR still initiatively sends to own passage with information 78.If no, TMRVLD will be changed to vacation.Otherwise TMRVLD will be changed to very.If the result of decision-making module 290 is sure, TMRVLD rollover counter value increases in module 292.The TMRVLD rollover counter is followed the tracks of TMRVLD from really becoming false number of times.If the result of decision-making module 290 negates, TMRVLD rollover counter value does not increase, and logic flow proceeds directly to decision-making module 294.

In decision-making module 294, this logic determines whether big the 5th preset threshold value of the value of TXVLD or TMRVLD rollover counter.The 5th preset threshold value equals upset number of times maximum in one permission period.As can be seen, in aircraft flight, TMRVLD is from very representing that the existence of specific T MR intermittent defect is likely because with due to being connected of global communication bus 34 is loose to the frequent upset of vacation.On the other hand, the frequent upset of TXVLD is illustrated in the global communication bus 34 intermittent defect is arranged.If the result of decision-making module 294 is sure, transmitter normal signal (TXOK) is changed to vacation in module 296.In module 298, the MPU 54 of own path pins data related with specific T MR in its internal memory, is remaining the use of interrupting in-flight the TMR data.If the result of decision-making module 294 negates, logic flow proceeds to module 300 so, and the TXOK of specific herein TMR is changed to very.

Referring again to Fig. 4 C, in case TXVLD, BVLD and TXOK determined by own path, and MPU 54 utilizes these signals to finish renewal function for monitoring in module 304.Upgrade function for monitoring and determine passage 40,42, whether 44 also send information 78 to other passage of fly-by-wire 31 on one's own initiative, and whether specific T MR still sends information to own passage on one's own initiative.Figure 13 shows and upgrades the logic that function for monitoring adopts.Whether still can see from the description to Figure 13, can determine passage 40,42 in the logic shown in the module 305 to 315, whether 44 also send information on one's own initiative, and can determine specific T MR active transmission information in the logic shown in the module 316 to 320.

The logic of Figure 13 starts from decision-making module 305, and it determines whether the specific TMR that is monitored is specific PFC herein.If so, logic proceeds to module 306, it determines the TXVLD with specific PFC association herein, and whether any of BVLD and TXOK is changed to vacation.If this specific PFC may break down so.Thereby in module 312, the PFC FRESH signal of the fault that expresses possibility is changed to vacation.Yet, if the result of decision-making module 306 negate, logic proceeds to decision-making module 308, herein it determine specific PFC whether preset time at interval in to any transmission information 78 of two its passages.If PFC FRESH is changed to very in module 310, shows that specific PFC still sends information on one's own initiative so.If the result of decision-making module 312 negates that PFC FRESH is changed to vacation in module 308, represent that specific PFC may be in resting state.In case PFC FRESH is set up, logic ends at module 321.Can see that if the specific PFC that is monitored is own passage, PFC FRESH has represented the active state of own passage, the spy is designated as PFC FRESH _OCSimilarly, if the specific PFC that is monitored is its passage 1 or its passage 2, PFC FRESH _OC1Or PFC FRESH _OC2Can represent the state of passage respectively.

If the result of decision-making module 305 negates, specific TMR is actually a certain LRU rather than a certain PFC, and in this case, logic is walked around module 306 to 312, and proceeding to module 314 to 320, they determine whether a certain LRU still sends information by global communication bus 34 to own passage.More particularly, in decision-making module 314, this logic is determined the TXVLD related with LRU, and whether any of BVLD and TXOK is changed to vacation.If specific LRU may break down.Thereby, be changed to vacation at the express possibility LRU FRESH of fault of module 320.Yet, if the result of decision-making module 314 negate, logic proceeds to decision-making module 316, it determines that whether own path receives information 78 from specific LRU at preset time at interval herein.If LRU FRESH is changed to very in module 318, represent that specific LRU still communicates with own passage.Otherwise LRUFRESH is changed to vacation in module 320, represents specific LRU dormancy fully.Upgrade function for monitoring and end at module 321.

Shown in Fig. 4 C, in case the renewal function for monitoring in module 304 stops, PFC FRESH and LRU FRESH then are used for other PFC function.More particularly, PFC FRESH is used for other PFC function in module 322, and as the management of PFC input signal, it can be with pathway closure when passage does not initiatively send information 78.Specific PFC FRESH signal, PFC FRESH _OC, PFC FRESH _OC1With PFC FRESH _OC2Also utilized, to identify the most judgements of path in module 194,204 and 206, GFF by the MPU 54 of own path _OC, GFF _OC1And GFF _OC2PFC FRESH and LRU FRESH are used to finish the dormancy TMR function for monitoring in module 324 by own path MPU 54, can confirm at this dormancy TMR function for monitoring whether specific PFC or LRU are in resting state fully.

Figure 14 shows in detail own path MPU 54 and finish the logic that dormancy LRU function for monitoring is adopted in module 324.This logic starts from decision-making module 325, and this moment, it determined whether the specific T MR that is monitored is specific PFC.If logic proceeds to decision-making module 326, at this moment, it determines whether the PFC FRESH of specific PFC is continued to be changed to vacation, that is, whether PFC FRESH is built in vacation at interval at preset time.In a preferred embodiment of the invention, this preset time is spaced apart about 2.5 minutes.One of ordinary skill in the art as can be seen, as required should the time interval can be by the parameter change of fly-by-wire, to obtain the comprehensive degree of expectation.Surpass 2.5 minutes if PFC FRESH is in false state, can determine that with this logic specific PFC is in resting state.Thereby above-mentioned active transmitter useful signal (TMRVLD) is false in module 327.Otherwise TMRVLD places very in module 328.

If the result of decision-making module 325 negates that specific TMR is actually a certain LRU rather than a certain PFC.In this case, logic is walked around decision-making module 326, proceeds to decision-making module 330.At decision-making module 330, can determine to this logic of specific LRU whether LRU FRESH is changed to vacation constantly in the preset time interval, promptly whether LRU FRESH is in vacation at the fixed time at interval as in 2.5 minutes.If LRU FRESH is in the false time and surpasses this time interval, this logic can determine that specific LRU very likely is in resting state.Thereby above-mentioned active transmitter useful signal (TMRVLD) is changed to vacation in module 327.Otherwise TMRVLD is changed in module 328 very.

As mentioned above, TMRVLD is used to finish initiatively TMR function for monitoring 284, whether be in the intermittent defect with definite particular transmitter, rather than dormancy fully.Falsity represents that a certain specific T MR and being connected of data/address bus 34 may disconnect or unclamp.Yet if TMRVLD is often from really becoming vacation, being connected of a certain probably TMR and communication bus intermittently disconnects or unclamps.

From Fig. 4 A, 4B and 4C can find out, the function of finishing in each passage 40,42 and each path 46,48 and 50 of 44 in fly-by-wire is actually identical.So each path of each passage finally can be identified in each TMR, i.e. LRU in the fly-by-wire 30 or 38, PFC 40,42 or 44, path 46,48 and 50, and the fault in data/address bus 33,35 and 37.According to the present invention, the path of each passage has also been avoided harmful the abandoning of aircraft components obtained high comprehensive degree like this and improved the availability of aircraft components in the fly-by-wire.

When the preferred embodiments of the present invention are described, can see in appended claim scope, under the premise of without departing from the spirit of the present invention, can make all changes to the present invention.For example, although the present invention is described the fly-by-wire with three redundancys, one of ordinary skill in the art is appreciated that the present invention is also applicable to the system more than three passages.Equally, the present invention can be applicable to that also each passage contains the system that surpasses three paths.In these cases, most definition of judging will be determined by design specification, if even number bar path is promptly arranged, most judgements are made of the half path, or need simple majority to constitute, and, it can also be seen that the present invention also goes for any multi-channel system, thereby be not limited to fly-by-wire or other any avionics system.

Claims (17)

1, a kind of method that is used for determining the control system fault, wherein this control system comprises the global bus of a band plurality of data bus and can be connected to the transmitter that transmits data in the global bus by global bus, these transmitters comprise some external replaceable parts and some computer access, each passage comprises the some paths that connected by dedicated bus, each path of each passage is connected with a data bus, each external replaceable parts also with data/address bus in one be connected, this method comprises:

(a), generate that path is most to be judged, the fault when whether having detected with most of paths of expression passage that transmitter transmits data by global bus to each transmitter, each passage;

(b), send the most judgements of path to other passage by global bus to each computer access; And

(c) to each path of passage, judge according to path is most, be that each transmitter generates a passage multichannel and judges, this passage is most judge expression whether most of passage detected fault in the transmitter.

2, the method for claim 1 generates the most methods of judging of path and comprises:

(a) generation error signal, whether this state representation has the mistake of exceeding the quata by transmitter by the data that global bus sends;

(b) rub-out signal is sent to other path of passage by the dedicated bus of passage;

(c) determine whether that most of paths all continue the generation error signal, this signal condition represents by the data that transmitter sends whether the mistake of exceeding the quata is arranged by global bus.

3, method as claimed in claim 2, wherein each passage is identified the most judgements of its path by following method:

(a) receive the most judgements of path by global bus from each passage; And

(b) judge each path that receives is most:

(i) by passage update signal of assessment, this signal indication sends whether the most passages of judging of path are active state, thereby determines whether this passage sends fault;

If (ii) passage does not send fault,, then judge for the path after evaluation of passage generation is most if most of paths of passage have detected fault in transmitter; And

(iii) generate after majority after the evaluation of passage judges, the majority judgement after will identifying by the dedicated bus of passage sends in other path of this passage.

4, method as claimed in claim 3, this method also comprises: after the most judgements of the path of identifying passage, each passage generates that final path is most to be judged, continues to detect the fault in the transmitter to represent the multi-channel of passage whether, and authentication method is:

(a) receive from each passage that one group of path after identifying is most to be judged, the group of each passage comprises that the path after the evaluation of this passage is most to be judged, this path is most to be judged by each path of this passage and identify and send;

(b) judge the path after one group of evaluation of each passage is most, generate the most judgements of final path of passage according to the path multichannel judgement group after the evaluation of this passage.

5, method as claimed in claim 4 wherein generates the most methods of judging of described final path and also comprises, determines whether that most of paths continue to generate that passage after the evaluation that the expression transmitter breaks down is most judges.

6, method as claimed in claim 5 wherein generates the most methods of judging of passage and also comprises:

To each path in the passage, determine whether that most of passages continue to generate final most judgements that the expression transmitter breaks down.

7, method as claimed in claim 6 also comprises according to passage is most and judges produce the bus useful signal, this bus useful signal represents whether the data/address bus that is connected with transmitter breaks down.

8, as method as described in the claim 7, also comprise according to passage is most and judging and whether the expression transmitter is in the transmitter sleep signal of resting state, generate a satisfactory transmitter signal, described satisfactory transmitter signal represents whether transmitter intermittent defect occurs.

9, method as claimed in claim 8 also comprises according to the most judgements of passage, bus useful signal and satisfactory transmitter signal generating the passage update signal, and the generation method is:

(a) determine whether this transmitter is a passage;

(b), determine that passage most is judged, whether in bus useful signal or the satisfactory transmitter signal any represent to have detected fault if transmitter is a passage; And

(c), determine whether at interval interior at the fixed time transmitter has sent information if detected fault.

10, method as claimed in claim 9 also comprises according to the most judgements of passage, bus useful signal and satisfactory transmitter signal generating an external replaceable component update signal, and the generation method is:

(a), determine that passage is mostly judged, whether in bus useful signal or the satisfactory transmitter signal any represent to have detected fault if transmitter is not a passage but external replaceable parts; And

(b), determine whether path has received the interior at interval at the fixed time information that sends of transmitter if detected fault.

11, method as claimed in claim 10 also comprises according to passage update signal and external replaceable component update signal generating the transmitter sleep signal, and the generation method is:

(a) determine whether transmitter is a passage;

(b), determine whether the passage update signal represents that transmitter does not send information in the interval at the fixed time if transmitter is a passage;

(c), determine whether external replaceable parts signal represents that passage does not receive the information from the external replaceable parts at the fixed time at interval if transmitter is external replaceable parts.

12, method as claimed in claim 11, wherein judge and method that the transmitter sleep signal generates satisfactory transmitter signal also comprises according to passage is most:

(a) determine that the passage majority judges whether variation constantly the fault is being arranged from expression transmitter fault-free to the expression transmitter; And

(b) determine whether the transmitter sleep signal is changing to the dormancy of expression transmitter constantly from the activity of expression transmitter.

13, method as claimed in claim 2, wherein generating the most methods of judging of channel passage also comprises: if only there is a path generation error signal indication transmitter just to send the exceed the quata information of mistake of a band by global bus in this passage, whether this path may break down then to generate a path fault signal indication.

14, method as claimed in claim 13 also comprises, by determining that path continues to generate the path fault signal that this path of expression may break down, can confirm that this path breaks down.

15, method as claimed in claim 4, wherein generating the most methods of judging of the final path of passage also comprises, if only there is a path generation error signal indication transmitter just to send the exceed the quata information of mistake of a band by bus in this passage, whether this path may break down with expression then to generate a final path fault signal.

16, method as claimed in claim 15, it also comprises, by determining whether path continues to generate the final path fault signal that this path of expression may break down, and can confirm that this path breaks down.

17, a kind ofly monitor and discern the multi-channel system that parts break down in the native system, this multi-channel system comprises:

(a) global bus that constitutes by the plurality of data bus;

(b) several external replaceable parts that are connected with global bus make one in each external replaceable parts and the data/address bus to link to each other, and each external replaceable parts forms one and sends the information emission machine by global bus; And

(c) the some computer access that are connected with global bus, each computer access also forms one by global bus's transmission information emission machine, each passage comprises some paths that connected by dedicated bus, each path is made up of a power supply, a processor and the interface to global bus, a path in each passage constitutes an instruction path, and it sends information by global bus, and, each computer access detects the fault in the multi-channel system, like this:

For each transmitter that is connected with bus, the processor of each bar path of passage generates that passage relevant with transmitter is most to be judged to represent that most of passage whether has detected the fault in the transmitter.

Images