GB2200225A - Computer control of an apparatus, - Google Patents

Abstract

An apparatus 112 (e.g. a gas turbine fuel control) can be controlled by either of two computers 113, 114 in respective lanes A, B connection of the computers 113, 114 to the apparatus 112 being controlled by switch devices 119, 121 in respective input-output buses 118, 120 of the computers 113, 114. The switch devices 119, 121 are responsive to control signals generated by a logic arrangement 132 in response to faults in either computer 113, 114. The logic arrangement 132 includes a latching bistable device (150, 151; Fig 4) which maintains the switch devices 119, 121 in their last operated state, in the absence of a subsequent fault in the currently controlling computer. <IMAGE>

Description

" SYSTEM FOR COMPUTER CONTROL OF AN APPARATUS" This invention relates to a system in which an apparatus can be controlled by either of two computer lanes.

It is known from U.S. Patent 4590549 to provide a system in which an apparatus, for example a gas turbine engine fuel system, can be controlled by either of two identical computer lanes. A malfunction of one computer lane operates a switching circuit to effect transfer of control to the other computer lane. It is required to ensure that when control has thus been transferred it shall not automatically revert to the aforesaid one computer lane if the fault thereon disappears.

According to the invention there is provided a system having two computer lanes for controlling an apparatus, a switching device responsive to control signals for selectively placing said apparatus under control of either one of said lanes, and a logic arrangement for generating said control signals, said logic arrangement comprising a latching device responsive to a fault in one of said lanes for generating a control signal to place said apparatus under control of the other of said lanes, said latching device being maintained in its last operated state by its last-generated control signal.

Embodiments of the invention will now be described by way of example only and with reference to the accompanying drawings in which: Figure 1 is a diagram of a gas turbine engine fuel control system responsive to signals from either of two computer lanes, Figure 2 is a diagram of a switching logic circuit forming part of Figure 1, Figure 3 shows a diagram of an alternative gas turbine engine fuel control system responsive to signals from either of two computer lanes, Figure 4 is a di gram of a logic arrangement forming part of Figure 3, Figure 5 is a diagram of a voltage detector circuit forming part of Figure 4, and Figure 6 is. a diagram of a coupling circuit forming part of Figure 4.

As shown in Figure 1 a gas turbine engine 10 is supplied with fuel from a pump 11 by way of a variable metering device 12. The device 12 is selectively controllable by signals from a digital computer arrangement 13 in a computer lane A, or by a digital computer arrangement 14 in a computer lane B. Signals from lane A or lane B are supplied to the metering device 12 by way of a switching circuit 15 which is responsive to control signals from a logic circuit 16, shown in more detail in Figure 2.

The circuit 16 may beset manually by signals on lines 17, 18 from a selector 19, to place the device 12 under control of lane B or lane A. Alternatively the selector 19 may be set to allow lane control to be effected automatically in response to faults occurring in the lanes A or B. In this latter automatic operation signals are provided on both of the lines 17, 18.

As shown in Figure 2 the circuit 16 comprises two fault integrator devices 20, 21 which are responsive to signals on respective lines 22, 23 from watchdog timers tithe respective lanes A and B. The devices 20, 21 generate fault signals on respective lines 24, 25 if fault indications on the respective lines 22, 23 persist for more than a predetermined time.

The lines 17, 24 are connected to inverting inputs of NOR gate 26 whose output is connected to a line 27 which communicates with computers 13 and 14. The line 27 is also connected to the preset terminal PR of a latching circuit 28 who-se Q terminal is connected by a line 29 to the switching circuit 15 Figure 1) and to both of the computers 13, 14. A normally-closed relay 30 is energisable by a logic 1 at the Q terminal of latching circuit 28 to open the relay contacts.

The lines 18, 25 are connected to inverting in-puts of NOR gate 31 whose output is connected by a line 32 with the computers 13 and 14. The line 32 is connectable to a line 33 through the ~relay 30. The line 33 is connected to the switching circuit 15 (Figure 1) and to both computers 13, 14. The line 33 is also connected to an inverting terminal of NAND gate 34 whose other input terminal is connected to the line 24 and whose output terminal is connected to an inverting input to a NOR gate 35 whose other inverting input is connected to a line 36. A logic 0 pulse is applied to line 36 at initial switch on. The output of gate 35 is connected by a line 37 to the clear terminal CL of the latching circuit 28. The circuit 16 includes 2Hz clocks 40, 41, whose clock pulses are applied to respective AND gates 42, 43.Inverting inputs of the gates 42, 43 are connected to respective lines 24, 25 and the outputs of these gates are connected by way of lines 44, 45 with the computers 13, 14 respectively. 2Hz clock signals will thus be applied to the lines 44, 45 only when the signals on lines 24, 25 respectively are logic 0.

In use, at initial switch-on, the output signals from integrating devices 20, 21 are logic 1, indicating an absence of faults. With the device 19 (Figure 1) set to permit automatic control the signals on lines 17, 18 are also logic 1. The logic 0 pulse on the line 36 results in a logic 0 on line 37, setting the Q output of the latching circuit 28 to logic 1, opening the relay 30 and isolating the line 33 which applies a logic 0 to the gate 34. The CL terminal of circuit 28 is thereby maintained at logic 0 after the switch on pulse on line 36 has ended. The relay 30 is thus latched open by the circuit 28. The gates 26, 31 provide logic 1 outputs on the lines 27, 32, indicating no failure in either of the lines A or B. The logic 1 at the Q terminal of latching circuit 28 and on line 29 also indicates that lane A is the controlling lane (ALIC).The logic 0 on line 33 also indicates that lane B is not in control.

If a failure subsequently occurs in lane A, the output from the fault integrating device 20 becomes logic 0, setting the signal on line 27 to logic 0 and the output from gate 34 to logic 1. The signal on line 37 to the CL terminal of latching circuit 28 thus becomes logic 1, allowing the circuit 28 to be set by the signal on line 27. The logic 0 at the PR terminal of circuit 28 causes its Q output to set the signal on line 29 at logic 0 indicating that lane A is no longer in control and de-energising the relay 30 shut. The logic 1 signal on line 32 is thus applied to line 33 to indicate that lane B is in control (BLIC).The gate 34 responds to the signal on line 3 to maintain the CL terminal of the latching circuit 28 at logic 1, preventing response of the circuit 28 to any subsequent change in the output signal from the device 20. Lane B is thus maintained in control even if the fault in lane A subsequently clears. Logic 0 on line 24 causes 2Hz clock signals to be applied to line 44. These clock signals reset the computer in lane A, in an attempt to clear the fault in that lane.

In the event of a subsequent failure in lane B the signals on line 32, 33 become logic 0. Gate 34 will, however, set the CL terminal of latching circuit 28 to logic 0 only if the fault on lane A has cleared, that is if the signal on line 24 is logic 1. If the fault in lane A has thus cleared the resultant logic 0 on line 37 clears the latching circuit 28 to place logic 1 on line 29 to the switching circuit 15. Failure of lane B results in 2Hz clock signals on line 45 to reset all components of lane B.

Alternatively an attempt may be made at any time to restore control to lane A by operating the selector 19 (Figure 1) to set the signal on line 18 to logic 0, indicating that lane B is to be disenabled. -If this is done the signal on line 32 becomes logic 0 and the sequence of events is as described above following a failure of lane B. Control may similarly be shifted from lane A to lane B by operating the selector 19 to place logic 0 on line 17 and logic 1 on line 18. In any circumstances, however, transfer to another lane is possible only when the lane previously in control has relinquished that control.

The failure signals on lines 27 or 32 are applied to both computer lanes A, B so that each lane is advised of the state of the other lane. The ALIC and BLIC signals on lines 29, 33 respectively are similarly applied to computer lanes A, B.

As shown in Figure 3 a gas turbine engine 110 is supplied with fuel from a pump 111 by way of a variable metering device 112. The device 112 is selectively controllable by signals from a digital computer 113 in a computer lane A or by a digital computer 114 in a computer lane B. Signals from lane A or lane B are supplied to the metering device 12 by way -of input-output terminals 115, 116 and a D-A and A-D converter 117. Computer 113 communicates with its terminal 115 through an input-output bus 118 and a buffer circuit 119. Computer 114 communicates with its input-output terminal 116 through a bus 120 and a buffer circuit 121. The buses 118, 120 are interconnected by way of an inter-lane bus 122 and two buffer circuits 123, 124. The buffer circuits 119, 121, 123, 124 comprise a switching circuit responsive to control signals on respective lines 125, 126.

The arrangement is such that in the presence of a signal on line 125 and the absence of a signal on line 126 the computer 113 has access to its own input/output unit 115 through the buffer circuit 119 and also to the input-output circuit 116 through the inter-lane bus 122 and buffers 123, 124, and computer 114 is isolated by the buffer 121. Similarly, in the presence of a signal on 126 and absence of a signal on line 125 the computer 114 can communicate with both the terminals 115, 116 and the computer 113 is isolated by the buffer 119.

The signals on lines 125 and 126 are obtained from a logic arrangement 132.

The arrangement 132 is responsive to signals on respective lines 140, 141 from fault integrators in the respective lane A and B, low level signals on the lines l#9, 141 being provided if fault conditions persist for more than a predetermined time. The arrangement 132 is also responsive to signals on lines 142, 143 from a manually operable selector device 144, to place lane B or lane A respectively in control of the device 112.

The arrangement 132 is also supplied with 1 kHz signals on lines 145, 146 from respective oscillators 147, 148.

As shown in Figure 4 the logic arrangement 132 comprises two AND gates 15C, 151 which provide output signals on the respective lines 125, 126. The lines 125, 126 are coupled to one input of the respective gates 151, 150 to provide a set-reset bistable latching circuit. This coupling is by way of respective identical coupli-ng circuits 152, 153 which are responsive to the magnitude of a supply voltage V for the- system as a whole, and which are connected to inputs of the respective gates 151, 150 by lines 154, 155.

Identical voltage detector circuits 170, 171 are responsive to the supply voltage V and to 150 kHz signals on lines 172, 173 from respective oscillators 174, 175. The circuits 170, 171 provide 150 kHz signals on respective lines 176, 177 if the magnitude of the voltage V is within predetermined limits.

The detector circuit 171 is shown in detail in Figure 5 and includes a rail 180 to which the supply voltage V is applied. Resistors 181, 182 are connected between the rail 180 and an earth rail 183 to derive a voltage which is proportional to the supply voltage V. This voltage is applied on a line 184 to the non-inverting input of a comparator 185 A zener diode 187 and a resistor 188 are also connected between the rails 180, 183 to derive a voltage proportional to an acceptable value of the supply voltage V, this derived voltage bang applied to the inverting input of comparator 185, to the non-inverting input of a comparator 189 and to the inverting input of comparator 186. The inverting input of comparator 189 is connected to the junction of two resistors 191, 192 which are connected between lines 180 and 183 to provide a further sensed voltage proportional to V.A capacitor 190 is also connected between lines 180 and 183. The arrangement is such that both comparators 185, 189 will provide high level output signals if the supply voltage V is between upper and lower limits.

The outputs of comparators 185, 189 are connected to a line 193 which is, in the absence of high level outputs from both comparators 185, 189, maintained at a relatively low voltage by means of resistors 194, 195 through which the line 193 is connected to the rails 180, 183 respectively. Line 193 is connected through a resistor 196 to the non-inverting input of comparator 186 which, if the outputs of comparators 185, 189 are both high, provides a high level signal on a line 197 and, by way of a resistor 198 an enabling signal on an output line 199.

The sensed voltage at the junction of resistors 191, 192 is applied through a line 200 to the non-inverting input of a comparator 201, the inverting input of which is connected to line 193. The output of comparator 201 is connected via a resistor 202 to line 180, and via resistor 203 to its non-inverting input. The line 200 is also connected to the inverting input of a comparator 211, the non-inverting input of which is connected to a junction 213 which is connected via a resistor 214 to a line 197, line 197 also being connected via a resistor 212 and a line 210 to the non-inverting input of comparator 185. Junction 213 isfalso connected via a resistor 215 to line 183, and via a resistor 204 to line 173. The output of comparator 211 is connected via a resistor 217 to line 180, and via an inverter 216 to line 177.

The arrangement is such that when the output signals from both of the comparators 185, 189 are high, and in the absence of an oscillating signal on the line 173, the volt#age at junction 213 is substantially equal to that on line 200. Thus with the signal on line 197 high and with an oscillatory signal on line 173, the signal at junction 213 will oscillate about a voltage substantially equal to that on line 200. The comparator 211 then provides an oscillating output through an inverter 216 to the line 177. If the signal on line 197 becomes low as a result of excursion of the supply voltage V outside either of its desired limits, the voltage of the positive-going peaks of the oscillation at junction 213 will not exceed the voltage on line 200 and there is no oscillatory output from comparator 211. The purpose of resistors 212, 203 is to provide hysteresis in switching around the lower and upper limits respectively of the voltage V.

In order for there to be a 150 kHz output on line 177 the supply voltage V must be within its required limits and -the oscillator 175 must be working satisfactorily.

Since operation of the oscillator 175 is also dependent on the supply voltage V, the detector circuit 171 effects a double check on that voltage. The detector circuit 170 operates similarly.

The coupling circuit 153 shown in Figure 6 shows an AND gate 230 responsive to the signal on line 126 (Figure 4) and to the signals on lines 177 and 199 from the circuit 171. If the signals on lines 126 and 199 are hitch, indicating that lane B is operating satisfactorily and that its supply voltage V is within limits, the 150 kHz signal on line 177 will pass through the gate 230 and a capacitor 231 for rectification by a diode 232 and smoothing by a capacitor 233. The rectified voltage is applied by way of a low-pass filter arrangement 234 to the inverting input of a comparator 235 whose non-inverting input is supplied with a 2.5v reference voltage. A diode 236 is connected between the inverting input of comparator 235 and 5v voltage supply to prevent the aforesaid inverting input going above 5 volts.Output signals from the comparator 235 are supplied on the line 155 (Figure 4) to the other side of the latching circuit. A low level signal will thus be applied to line 155 only when lane B and the oscillator 175 are working correctly and the supply voltage V is within its prescribed limits. The low-pass filter arrangement 234 prevents spurious transient signals at the output of the gate 230 from resulting in low level, signals on line 155. The coupling circuit 152 operates similarly.

It is arranged that at initial switch-on both of the computers 113 and 114 provide low-level fault signals on their respective lines 140, 141, so that the logic arrangement 132 provides low-level signals on the lines 125, 126 whereby both of the computers 113, 114 are isolated from the input-output terminals 115, 116 and from the inter-lane bus 122. The selector device 144 provides a low level signal on line 142 or 143 if lane A or lane B respectively are to be removed from control of the device 112. If control is required to be changed automatically the device 144 places high level signals on both of the lines 142, 143. At switch-on the first of the computers 113, 114 to complete its internal check provides high level signals on the lines 140 or 141, placing that computer in control of the device 112.Assuming that computer 113 first generates the signal on line 140, the absence of a signal on line 126 and the inverting effect of the coupling circu-it 153 (Figure 6) will result in a high level signal on line 155. These high level signals in conjunction with that on line 142 cause the gate 150 to provide a high level signal on line 125, which in turn acts through the coupling and inverting circuit 152 and the gate 151 to maintain the signal on line 126 low.

Lane A therefore assumes control of the device 112, and circuit 152 provide a low level signal on line 154 which maintains a low level signal on line 126, isolating the computer 114 from the device 112.

Similarly if computer 114 first generates a signal on line 141, lane B assumes control and computer 113 is isolated.

With signals on both lines 140 and 141 at a high level and with lane A initially in control by virtue of its being first to generate the signal on line 140, a subsequent low level signal on line 140, indicating malfunction of the computer 113 places a low level signal on line 125 and a high level signal on line 154. Provided that the signal line 141 remains high and that the select signal on line 143 is high, indicating that lane B is not required to be disabled, lane B assumes control of the device 112 and the computer 113 is isolated. The bistable latching circuit (Fig. 4) prevents lane A from resuming control even if the signal on line 140 subsequently becomes high, so long as the signal on line 141 is high.

Referring back to Figure 4, the signals on line 199 and on a corresponding line 250 from-circuit 170 are also applied to one input of respective OR gates 252, 251, whose other inputs are supplied with the signals on respective lines 140, 141. Gates 251, 252 thus provide high level output signals if the supply voltage V is within limits or if the fault integrators in the respective lanes A and B have high level outputs, indicating that the computers 113, 114 are operating satisfactorily. The 1 kHz signals on lines 145, 146 are applied to clock terminals of respective frequency divider circuits 253, 254 whose reset terminals are responsive to signals from the respective gates 251, 252.The arrangement is such that the circuits 253, 254 provide clock signals when their respective voltage supplies V are not within limits, or when the fault integrators in the respective lanes A, B indicate that either of the computers 113 or 114 is not operating correctly, or when both of these conditions are satisfied.

The clock signals are inverted and applied on lines 255, 256 to reset the respective computers 113, 114.

A computer in a failed lane is thereby reset continually in an attempt to clear the fault, so that it may assume control if a fault arises on the other lane.

As shown in Figure 3 the computers 113, 114 are responsive to the signals on lines 125, 126 respectively, as well as to those on lines 155, 156 respectively. In the absence of low-level fault signals on lines 140, 141, and of low-level wde-selectw signals on lines 142, 143, signals on lines 125 and 155 should correspond, as should signals on lines 126, 154.

Such correspondence indicates that the logic arrangment is operating correctly, and is monitored by both computers 113, 114. Additionally the computers 113, 114 are responsive to the signals on lines 141, 140 respectively. Each computer thus monitors the other computer for absence of faults.

Claims (9)

1. A system having two computer lanes for controlling aq~apparatus, a switching device responsive to switch control signals for selectively placing said apparatus under control of either one of said lanes (A, B), and a logic arrangement for generating said control signals, said logic arrangement comprising a latching device responsive to a fault in one of said lanes for generating a control signal to place said apparatus under control of the other of said lanes, said latching device being maintained in its last operated state by its last-generated control signal.

2. A system as claimed in Claim 1 in which said logic arrangement is responsive to signals from a lane selector device for placing said apparatus under control of a predetermined one of said lanes.

3. A system as claimed in Claim 1 or Claim 2 in which said latching device comprises a cross-connected set-reset bistable circuit responsive to fault indicating signals in said computer lanes.

4. A system as claimed in Claim 3 in which each cross-connection of said bistable circuit includes a coupling circuit responsive ti a level of supply voltage for said system.

5. A system as claimed in Claim 4 in which each said cross-connection includes a voltage detection circuit for providing an enabling signal to said coupling circuit when said supply voltage is within predetermined limits.

6. A system as claimed in Claim 5 in which each said voltage detection circuit is responsive to an oscillatory input signal and includes means for gating sated input signal to said coupling circuit only when said supply voltage is within its predetermined limits.

7. A system as claimed in Claim 6 in which said coupling circuit is responsive to said enabling signal and to said oscillatory signal to effect a cross-coupling of said bistable circuit.

8. A system as claimed in Claim 1 in which said switching device comprises buffer circuits in input-output buses of the respective computer lanes.

9. A system as claimed in Claim 8 which includes a further buffer circuit responsive to a signal from said logic arrangement to interconnect said input-output buses.