1,105,201. Correspondence control systems. BENDIX CORPORATION. March 23, 1966 [March 31, 1965; April 1, 1965], No. 12841/66. Heading G1N. [Also in Division H3] In a fail operative system for an aircraft control which is normally operated by a pair of servomechanisms, 59A, 59B, a third servomechanism 59C is provided as a monitoring device, the input signals to the three servomechanisms are compared in pairs and, in the event of an excessive difference between the inputs, an indicator and a fault relay are operated. As shown (Figs.2 and 2A), rudder 104 is controlled in accordance with the outputs from yaw rate gyros 10A, 10B, 10C by way of solenoid-operated clutches 87A, 87B. The gyro outputs are passed through respective yaw rate washout and filter units 43 to gates 50, the latter each receiving an input from each of the units 43 and selecting the intermediate amplitude signal in each case. The gate outputs are supplied to servoamplifiers 59 to drive servomotors 65, which in the case of channel A and channel B drive the clutches 87A, 87B. Each servo unit has rate feedback from rate generator 73 and follow-up feedback from synchro 96. The outputs from units 43 are compared in pairs by comparators 115 (1A, 2A, 3A) and the follow-up signals in the servosystems are compared in pairs by comparators 115 (1B, 2B, 3B). A system failure which causes the output from one of the units 43 to deviate from the outputs from the other units causes two comparators (A) to generate an output in the form of a logic 0 (low voltage) signal. A single logic 0 output indicates a single comparator failure. In both cases gates 50 select the intermediate gyro signal, which has not deviated, and control 103 continues to be driven, but a logic circuit (see below) causes a warning light to be lit. Failures which cause alarms from all three comparators (A) cause the logic circuit to de-energize clutch solenoids 110 to disengage both clutches 87. A failure of one of the comparators (B) causes the warning light to be lit, as for comparators (A), but a logic 0 output from two comparators (B), indicating deviation of the follow-up signal in one of the servosystems, causes disengagement of the appropriate clutch, except in the case of outputs from 115 (1B) and 115 (2B) indicative of failure of the monitoring servosystem, in which cause neither clutch is disengaged. Logic 0 outputs from all three comparators (B) cause disengagement of both clutches. The logic circuit senses disengagement of either or both clutches to light warning lights. Once alarmed each comparator continues to give a logic 0 output until reset by the operator. Logic circuit (Fig. 4). The outputs from comparators 115 are supplied through lines 275 to OR-gates 300, which provide inputs to drivers 315 and 317, each of which has three AND-type inputs. Provided at least one comparator (A) gives a logic 1 (high voltage) output indicative of normal operation gates 300A and 300B continue to provide inputs to all the drivers 315, 317. Provided comparator 115 (3B) gives an output gates 300C to 300F all supply inputs to the drivers, but if one or other comparator 115 (1B) or 115 (2B) alarms, one pair of gates 300C, 300E or 300D, 300F stops giving an output. One pair of drivers 315A, 317A or 315B, 317B therefore also stops giving an output so that current from the appropriate source 341 no longer passes through the drivers, through line 333 and switch 330 to the clutch solenoid 110, and the appropriate clutch is disengaged. This condition is sensed by a current monitor Fig. 6 (not shown) which causes the outputs on lines 373 and 375 to change from a logic 0 to a logic 1 state and the output on line 395 to change from a logic 1 to a logic 0 state. Lines 373, 375 are connected to the AND-type inputs of a pair of drivers 400, 402 so that the latter energize lamps 404, 406 when both solenoids 110 are deenergized. Level sensors 550 Fig. 7 (not shown) detect excessive increases or decreases of the potential between drivers 315 and 317, due to shorting of either driver, the alarm condition being signalled by a change in the output on line 605 from a logic 0 to a logic 1 state. The outputs from OR-gates 300 are monitored by a module failure indicator 450 Fig. 5 (not shown) which normally produces a logic 1 output, which is changed to a logic 0 output if the outputs of all the OR-gates are changed to logic 0. The comparator outputs on lines 275, the current monitor outputs on lines 395 and the module failure indicator output on line 445 are monitored by NAND- gates 440, 442. The inputs on all the lines are logic 1 when operation is normal, but if any one line changes to logic 0 the appropriate NAND-gate supplies an output signal to driver 420, which has two OR-type inputs, and causes fault light 432 to be lit and fault relay 448 to be energized. The inputs to NAND-gates 440, 442 are also supplied to a NOR-gate 610, which also receives the outputs from level sensors 550 on lines 605, which outputs during normal operation are logic 0. During a testing operation (see below) the signals on lines 275, 395 and 445 are caused to change to logic 0, illumination of lamp 622 then indicating that this has occurred and that the level sensors have not been alarmed. Pre-flight testing. Correct operation of the system is tested prior to take-off by the circuit of Fig. 8. The circuit is set by depressing switch 655, switch 657 being closed automatically on contact 659 by an interlink with the landing gear. To perform a test, button 663 is pressed and is locked in by holding coil 685. As a result a timing circuit 682 Fig. 9 (not shown) starts operating, and current is supplied through switches 715, 669, 673 and 677, switch mechanism 38, and switch elements 28 to three torquing coils 34 associated with respective rate gyros 10. The rotors of the gyros have small permanent magnets embedded in them which co-operate with torquing coils 34 upon energization of the latter to torque the gyros. (Switch elements 28, in their alternative positions closing contacts 30 (Fig. 2), permit the speeds of rotation of the rotors to be verified using voltmeters 32). The simulated yaw rate is sensed by pick-off synchros 14 and the rudder is controlled in accordance therewith. At the end of the interval timed by timer 682 an output is produced on line 690. If, during this first phase of the test, a fault has occurred fault light 432 will have been lit and fault relay 448 will have been energized, and the timer output will light lamp 725. If no fault is present the timer output is applied to test relay coil 702 to open contact 717 and close contact 730, the former stopping the torquing current flowing to coils 34 and the latter locking in relay 702. In addition switches 650 (1A, 2A, 1B, 2B) close on to earthed contacts 760 to 766 thus earthing one input line, 160, of each comparator 115. The yaw rate washout and filter units 43 are so constructed that upon removal of the yaw rate inputs supplied during the first timed interval they produce an output of equal amplitude and opposite polarity during a subsequent timed interval. As a result each comparator signals a fault: This causes all the OR-gates 300 to signal logic 0, the clutch control solenoids 110 to be de-energized, the current monitors 337 to signal logic 1 on lines 373, 375 and logic 0 on lines 395, the NAND-gates 440, 442 to signal logic 1, the module failure indicator 450 to signal logic 0, and NOR-gate 610 to signal logic 1 (provided the level sensor outputs on lines 605 remain at logic 0). Lights 404, 406, 432 and 622 are therefore immediately illuminated, and relay 448 is energized. The relay is such that switch arm 696 remains out of contact with both contacts 698, 728 for a sufficient time, e.g. four milliseconds, for the timing circuit 682 to reset, before closing on contact 728. After a second timed interval light 725 is lit, indicating completion of the test. Light 622 (and the other lights) should remain lit at the end of the test, indicating that the comparators have all locked-in in the alarmed condition. The circuit is reset by moving switch 655 to the OFF position, as shown in Fig. 8, and then returning it to the ON position. The yaw rate washout and filter units 43 Fig. 13 (not shown) each include relays which in units 43A and 43B are de-energized when switch 655 is ON and in unit 43C are energized when the switch is ON. Units 43A and 43B and unit 43C are of identical construction but are connected differently so that when switch 655 is ON the units 43 and all units controlled thereby are operative, but when switch 655 is OFF the filter networks of units 43, the resetting conductors 261 of all the comparators and conductors 396 of the current monitors are all earthed. In addition, when switch 655 is OFF, conductors 348, 354 connecting current monitors 337 to the power supply at 40, 356 are disconnected. Yaw rate washout and filter units 43 Fig. 13 (not shown). The circuit is not described in detail in the specification but includes amplifier, demodulator, filter, modulator and emitter follower stages. The gain of the unit changes with changes in the dutch roll frequency of the aircraft, being higher when the dutch roll frequency is low. The filter removes high frequency signals to prevent coupling with body-bending modes of the aircraft. The unit allows the system to synchronize to a constant yaw rate during turning of the aircraft, since it has zero gain for steady state signals.