GB1560555A - Control systems - Google Patents

Description

(54) CONTROL SYSTEMS (71) We, SMITHS INDUSTRIES LI MITED, a British Company of Cricklewood, London NW2 6JN, do hereby declare the invention, for which we pray that a patent may be granted to us, and the method by which it is to be performed, to be particularly described in and by the following statement: This invention relates to control systems, and in particular to control systems utilizing digital processing techniques.

The invention is especially concerned with failure-survival control systems of the kind in which two or more control lanes, each capable of providing the control output required of the system, are operated together so as to provide a degree of redundancy that is utilized to ensure continued correct control in spite of the occurrence of a fault or failure in the system.

Systems of this kind have been used for controlling flight of aircraft, and in this context have more usually involved the processing of data in analogue form in each of three or more lanes, and comparison between the output signals of the lanes for determining the existence of a fault or failure in any of them. Such a system possesses a high degree of integrity against malfunction arising from component failure, because the probability of a majority of the lanes suffering failures at exactly the same time (and thus generating consistent, incorrect output signals) is of an extremely low order of magnitude.

Correct operation of each lane, however, depends not only upon the functioning of the equipment in the lane, but also upon the supply of valid data to it. For this reason a set of sensors, usually equal in number to the number of control lanes, is provided for each item of input data. The sensors of each set supply nominally-identical signals representative of the value of the relevant item of data to the respective control lanes, but there are inevitable slight differences between these signals arising from the manufacturing and operating tolerances that will exist between the different sensors of the set. Thus if no remedial action were taken in the system to equalize the data signals used in the different control lanes, the output control signals of these lanes would in general always be different from one another.Although these differences between the output signals of the control lanes might not be large enough to exceed the threshold for detection of a fault or failure, existence of them could very easily prejudice appropriate detection of a real fault or failure within a lane, or make the detection process too sensitive to minor, unimportant differences between the lanes.

In order to achieve equalization and avoid the undesirable consequences of slight differences between the nominally-identical sensor-signals, use may be made of amalgamation techniques. In these an amalgamate signal is derived in each lane in respect of each set of sensors, the amalgamate having a value (for example, the mean or a median value) intermediate the sensor-signal values. Any sensor signal differing by more than some prescribed amount and outside the acceptable tolerance range, is automatically excluded from the amalgamation process, and thereby cannot affect lane operation.

Amalgamation of the various sets of input-data signals, and the computation from the resultant intermediate-valued amalgamate signals of the appropriate control demand in each lane, can be readily carried out using digital processing. More particularly it has been proposed to include a digital processor in each lane for deriving the intermediate values appropriate to the different items of input data, and to compute from them an appropriate, digital demand-signal. With such a system the demand signal in each lane is converted to analogue form and then compared in a differential amplifier with a feedback signal so as to derive the appropriate error, or command signal capable of providing the desired corrective control. The command signals of all the lanes are then submitted to a process of amalgamation in analogue form within voter-monitor circuits.The votermonitor circuits serve to provide respective output-control signals of the system that are equalized to a substantial extent as regards any differences between the analogue feedback signals supplied to the differential amplifiers.

It is an object of the present invention to provide a control system of improved form as compared with the previously proposed system.

According to the present invention there is provided a control system for effecting displacement of a member, the control system including two or more control lanes, each capable of providing the control output required of the system in accordance with two or more channels of input signals and with two or more channels of feedback signals, said feedback signals being derived in accordance with displacement of said member, wherein said control lanes are arranged to be operated together so as to provide for continued correct control in spite of the occurrence of a fault or failure in the system, wherein digital processors are included in the control lanes for use in the generation of the control outputs of those lanes, wherein digital representations of the input data for each channel of input signals and digital representations of the feedback data from each channel of feedback signals are exchanged between the control lanes, and wherein a digital processor of each lane derives an intermediate value of each item of input and feedback data for use in the computation of the control output of that lane.

Thus with the control system of the present invention the feedback data, rather than being dealt with in analogue form as in prior systems, is processed in digital form together with the input data. The digital processors used to process the input data are also used for the feedback data, and the additional analogue voter-monitor circuits which have previously been proposed for equalization in respect of the feedback signals are no longer necessary. Such equalization may be carried out directly on the digital repesentations of the feedback data in exactly the same way as for the input data. Reduction in the complexity, cost and weight of equipment in the system is accordingly obtainable.

A control system in accordance with this invention for flight control of an aircraft will now be described, by way of example, with reference to the accompanying drawings, in which Figures 1 and 2, when placed side by side, together provide a block schematic diagram of the flight-control system.

The system to be described is part of a quadruplex flight-control installation replacing the conventional mechanical linkages between the pilot's control and the moveable aerodynamic-control surfaces (namely, elevators, ailerons and rudder) of the aircraft. Movements of the pilot's controls are sensed by electrical transducers that generate electrical signals representative of these movements, and the positions of the control surfaces and the motions of the aircraft are similarly sensed to produce two more groups of signals. The three groups of signals are supplied to servo-computers which derive from them the electrical command signals appropriate for actuation of the aircraft control-surfaces in accordance with the pilot's demands in pitch, bank and yaw.The pilot's controls and the control surfaces are thus linked solely by electrical circuits, and the control and safety of the aircraft is very dependent on the integrity of these circuits.

Referring to Figures 1 and 2, the elevator surfaces 10 of the aircraft are driven by two hydraulic rams 11 and 12 that are coupled together and to the elevator surfaces 10 by a common link 13. Hydraulic fluid is supplied to the rams 11 and 12 via respective spoolvalves 14 and 15 which are intercoupled mechanically via a link 16, and which are positioned by two sets of three servo-valve actuators 17 to 19, and 20 to 22, respectively. A set of three actuators is provided to drive each valve 14 and 15 so that if one of the three (or its control circuitry) fails, disconnection of that actuator is unnecessary, since the remaining two actuators of the set, together with the three actuators of the other set, have sufficient power or authority between them to resist and overcome conflict from the 'failed' actuator.

The position of the linkage 13 is sensed by four transducers 23 to 26, each of which supplies an analogue signal in accordance with this position to a respective one of four flight-control computers 27 to 30. The control computers 27 to 30 also receive nominally-identical analogue signals in accordance with pitch-demands signalled from four transducers 31 to 34 respectively, that are coupled to the pilot's controls (not shown).

Other nominally-identical analogue signals, in this case in accordance with motion of the aircraft, in particular the rate of change of attitude, are supplied to the computers 27 to 30 from four sources 35 to 38 in the appropriate instrumentation of the aircraft.

The four control computers 27 to 30 derive from the input and feedback data conveyed by the analogue signals, command signals appropriate for application to the actuators 17,18, 21 and 22 to control the elevator-surfaces 10 in accordance with the pilot's pitch-demand. To this end each computer 27 to 30 includes an analogue-todigital converter 100 which receives the input signals supplied to that computer, in cyclic succession from an individual multiplexer 101, and which supplied the corresponding digital representations to a digital processing unit 102 of the computer. The unit 102 of each computer receives not only digital representations of the input and feedback data from the converter 100 of that same computer, but also nominally-identical digital representations of the same data from the converters 100 of the other three computers.Each unit 102 acts in accordance with a stored program to compute a digital command dependent on the input and feedback data, and for the purposes of the computation the value of each item of data used is derived in accordance with a process of amalgamation of the set of four nominally-identical representations supplied in respect of that item. More particularly, each unit 102 is programmed to determine for each set of four digital representations whether any one of the set differs in value from the others by more than an amount prescribed in relation to the acceptable operational-tolerances applicable to that item of data, and if not to derive for use in the computation of the digital command a digital representation having a value (for example the mean or the median) intermediate the extremes of the range of the four signalled values.If any one of the signalled values differs by more than the prescribed amount from the others it is excluded from the derivation of the intermediate-value representation.

A signal in accordance with the digital command computed by the unit 102 of each control computer 27 to 30, is supplied via a respective digital-to-analogue converter 103 to a sample-and-hold circuit 104, and also directly to two digital-data transmitters 105 and 106. The output of the circuit 104 is compared in an amplifier 107 with a representation of the setting of the two spool valves 14 and 15. In the latter respect, there are four transducers 39 to 42 coupled to the link 16 for supplying to the amplifiers 107 of the four computers 27 to 30, respectively, analogue signals representative of the setting of the spool valves 14 and 15 (and thus of the rate of movement of the rams 11 and 12).The output signals of the amplifiers 107 of the four computers 27 to 30, which are each accordingly representative of the error in position of the spool valves 14 and 15, are applied to the actuators 17, 18, 20 and 21 respectively, in the sense to correct this error and thereby cause the rams 11 and 12, to drive the elevator surfaces 10 via the link 13 at a rate appropriate to satisfy the pilot's demand in pitch.

The output signals of the digital-data transmitters 105 of the control computer 27 to 30 are supplied to individual digital-data receivers 110 to 113 of a digital monitorcomputer 43, whereas the output signals of the transmitters 106 of the four control computers 27 to 30 are supplied to corresponding digital-data receivers 110 to 113 of a digital monitor-computer 44. The digital signals received by the receivers 110 to 113 in each computer 43 and 44 are compared to detect whether any one of them is significantly inconsistent with the others. To this end, each computer 43 and 44 includes a digital-processing unit 114 which acts according to a stored program to compare the four signals with one another and to derive a representative signal from them.

This representative signal has a value in accordance with an amalgamate (mean or median value) of the four signals (but with any detected in the comparison process as being inconsistent with the others, excluded). This representative signal is supplied via an individual digital-to-analogue converter 115 to a sample-and-hold circuit 116 for comparison in an amplifier 117 with a representation of the setting of the two spool valves 14 and 15. In the latter respect two transducers 45 and 46 corresponding to the transducers 39 to 42 are coupled to the link 16 for supplying to the amplifiers 117 of the two computers 43 and 44, respectively, analogue signals representative of the setting of the spool valves 14 and 15.The resultant error-signals are supplied to the actuators 19 and 22 respectively, in the same way as the error signals from the amplifiers 107 of the computers 27 to 30 are supplied to the actuators 17, 18, 20 and 21.

In the event that there is a component failure in any one of the four control computers 27 to 30 causing that computer to generate a control signal inconsistent with the control signals generated by the other three computers, then, as referred to above, that control signal is detected by the processing units 114 and excluded from the computations they perform. Consequently the control signals supplied to the actuators 19 and 22 will in general be in accord with the control signals supplied to three of the four actuators 17, 18, 20 and 21.Control of the setting of the spool-valve 14 or 15 from the faulty control computer will thus be overridden by the other control computer and the monitor computer which act in accord with one another to control that same valve, and their operation in this respect will be aided by the two control computers and the monitor computer controlling the other valve.

The probability of more than one of the computers 27 to 30 suffering the same component failure simultaneously is very low, and is within the normally-sccepted limits for failure-survival. However, there remains the possibility that some particular value of input signal will generate a digital representation in the control computers 27 to 30 which, in conjunction with the programmed sequence of operations within the digital-processing units 102 will cause malfunction of each of them. Such malfunction might arise, for example, because the process of implementing the written computer program in terms of the logic embodied in the control computers 27 to 30, introduces an unpredictable and spurious interaction between the program and the data derived from the input signals.

Safeguards against the possibility of a malfunction - a common-mode malfunction - arising in this way are incorporated into the system of Figures 1 and 2. In this respect the input signals applied to the control computers 29 and 30 are applied in the opposite sense to the input signals applied to the control computers 27 and 28. To this end, the connections of the transducers 25, 26, 33 and 34, and of sources 37 and 38, to the control computers 29 and 30 are reversed (indicated diagrammatically by crossover-line pairs R) as compared with the connections (indicated by uncrossed-line pairs D) of the transducers 23, 2431 and 32, and the sources 35 and 36, to the computers 27 and 28. This ensures that the binary numbers used to represent the same magnitude in the two pairs of computers 27 and 28, and 29 and 30 are different.

Thus athough the control computers 27 to 30 all receive and operate on nominallyidentical input and feedback data, the control computers 29 and 30 operate with combinations of binary digits which are different from those in the control computers 27 and 28. The difference of even one digit involved in the reversal of sign, is sufficient to ensure that any freak pattern that might give rise to failures in the individual computers 27 to 30 does not occur in all four computers 27 to 30 simultaneously, and so does not lead to a common-mode failure of the whole system.

Compensation for the reversals of sign to the control computers 29 and 30, is made by reversals (R) introduced into the analogue signal connections from the transducers 41 and 42 to the amplifiers 107 of the computers 29 and 30, and from those amplifiers 107 to the actuators 20 and 21; these contrast with the direct, uncrossed connections (D) from the transducers 39 and 40, and to the actuators 17 and 18, in relation to the amplifiers 107 of the computers 27 and 28.The amalgamation programs performed in the units 102 of the control computers 27 to 30, and in the units 114 of the monitor computers 43 and 44, compensate automatically for the reversal of sign effective between one pair and the other of the compared digital representations; the amalgamate derived in each case is attributed the appropriate sign to maintain the difference of digital representation as between the different pairs of computers 27 to 30.

Reference is directed to co-pending Patent Application No. 9643/76 (Serial No.

1560554) which includes more-detailed explanation of the system of Figures 1 and 2 and the safeguards incorporated therein in respect of common-mode malfunction as referred to above.

WHAT WE CLAIM IS: 1. A control system for effecting displacement of a member, the control system including two or more control lanes, each capable of providing the control output required of the system in accordance with two or more channels of input signals and with two or more channels of feedback signals, said feedback signals being derived in accordance with displacement of said member, wherein said control lanes are arranged to be operated together so as to provide for continued correct control in spite of the occurrence of a fault or failure in the system, wherein digital processors are included in the control lanes for use in the generation of the control outputs of those lanes, wherein digital representations of the input data for each channel of input signals and digital representations of the feedback data from each channel of feedback signals are exchanged between the control lanes, and wherein a digital processor of each lane derives an intermediate value of each item of input and feedback data for use in the computation of the control output of that lane.

2. A control system according to Claim 1 wherein it is arranged that the input and feedback signals are supplied to each said processor in time division multiplex.

3. A control system according to Claim 1 or 2 wherein the control outputs of the lanes are supplied to individual actuators, and wherein the actuators are all coupled together to provide a consolidated output drive of the system.

4. A control system according to any one of the preceding Claims wherein it is arranged that the digital output signals of the processors are supplied to one or more further lanes, and wherein each of the one or more further lanes includes a digital processor which is for deriving an intermediate value of the signals received by that lane and which is arranged to provide a further control output in accordance with the de

**WARNING** end of DESC field may overlap start of CLMS **.

Claims (4)

1. **WARNING** start of CLMS field may overlap end of DESC **.

   valve.

   The probability of more than one of the computers 27 to 30 suffering the same component failure simultaneously is very low, and is within the normally-sccepted limits for failure-survival. However, there remains the possibility that some particular value of input signal will generate a digital representation in the control computers 27 to 30 which, in conjunction with the programmed sequence of operations within the digital-processing units 102 will cause malfunction of each of them. Such malfunction might arise, for example, because the process of implementing the written computer program in terms of the logic embodied in the control computers 27 to 30, introduces an unpredictable and spurious interaction between the program and the data derived from the input signals.

   Safeguards against the possibility of a malfunction - a common-mode malfunction - arising in this way are incorporated into the system of Figures 1 and 2. In this respect the input signals applied to the control computers 29 and 30 are applied in the opposite sense to the input signals applied to the control computers 27 and 28. To this end, the connections of the transducers 25, 26, 33 and 34, and of sources 37 and 38, to the control computers 29 and 30 are reversed (indicated diagrammatically by crossover-line pairs R) as compared with the connections (indicated by uncrossed-line pairs D) of the transducers 23, 2431 and 32, and the sources 35 and 36, to the computers 27 and 28. This ensures that the binary numbers used to represent the same magnitude in the two pairs of computers 27 and 28, and 29 and 30 are different.

   Thus athough the control computers 27 to 30 all receive and operate on nominallyidentical input and feedback data, the control computers 29 and 30 operate with combinations of binary digits which are different from those in the control computers 27 and 28. The difference of even one digit involved in the reversal of sign, is sufficient to ensure that any freak pattern that might give rise to failures in the individual computers 27 to 30 does not occur in all four computers 27 to 30 simultaneously, and so does not lead to a common-mode failure of the whole system.

   Compensation for the reversals of sign to the control computers 29 and 30, is made by reversals (R) introduced into the analogue signal connections from the transducers 41 and 42 to the amplifiers 107 of the computers 29 and 30, and from those amplifiers 107 to the actuators 20 and 21; these contrast with the direct, uncrossed connections (D) from the transducers 39 and 40, and to the actuators 17 and 18, in relation to the amplifiers 107 of the computers 27 and 28.The amalgamation programs performed in the units 102 of the control computers 27 to 30, and in the units 114 of the monitor computers 43 and 44, compensate automatically for the reversal of sign effective between one pair and the other of the compared digital representations; the amalgamate derived in each case is attributed the appropriate sign to maintain the difference of digital representation as between the different pairs of computers 27 to 30.

   Reference is directed to co-pending Patent Application No. 9643/76 (Serial No.

   1560554) which includes more-detailed explanation of the system of Figures 1 and 2 and the safeguards incorporated therein in respect of common-mode malfunction as referred to above.

   WHAT WE CLAIM IS: 1. A control system for effecting displacement of a member, the control system including two or more control lanes, each capable of providing the control output required of the system in accordance with two or more channels of input signals and with two or more channels of feedback signals, said feedback signals being derived in accordance with displacement of said member, wherein said control lanes are arranged to be operated together so as to provide for continued correct control in spite of the occurrence of a fault or failure in the system, wherein digital processors are included in the control lanes for use in the generation of the control outputs of those lanes, wherein digital representations of the input data for each channel of input signals and digital representations of the feedback data from each channel of feedback signals are exchanged between the control lanes, and wherein a digital processor of each lane derives an intermediate value of each item of input and feedback data for use in the computation of the control output of that lane.
2. 2. A control system according to Claim 1 wherein it is arranged that the input and feedback signals are supplied to each said processor in time division multiplex.
3. 3. A control system according to Claim 1 or 2 wherein the control outputs of the lanes are supplied to individual actuators, and wherein the actuators are all coupled together to provide a consolidated output drive of the system.
4. 4. A control system according to any one of the preceding Claims wherein it is arranged that the digital output signals of the processors are supplied to one or more further lanes, and wherein each of the one or more further lanes includes a digital processor which is for deriving an intermediate value of the signals received by that lane and which is arranged to provide a further control output in accordance with the de

   rived intermediate value of said digital output signals.