IL101498A - Synstem for transportation means utility systems management - Google Patents

Description

101498/3 SYSTEM FOR TRANSPORTATION MEANS UTILITY SYSTEMS MANAGEMENT ISRAEL AIRCRAFT INDUSTRIES LTD. ww> j >wn π>\ί¾>-πη C: 12653 1-3089 12653pwr.bus I8mar92 FIELD OF THE INVENTION The present invention relates to utilities management systems generally and to utilities management systems in aircraft in particular.

BACKGROUND OF THE INVENTION Vehicle utility systems typically include systems controlling electrical power and distribution, fuel, hydraulic actuators, the engine and its initiation, brakes and lighting, etc. Airplane utility systems also include systems controlling flight, the internal environment, the landing gear, the nose wheel and fire detection, among others.

As utility systems in modern aircraft utilize more sophisticated electrical equipment, the number of electrical and electronic devices, power cables, control cables and wires increases. As a result, space, weight, maintainability and reliability problems arise.

Efforts are being made to reduce the wiring, weight and volume of utilities management systems and to improve their maintainability. These efforts include the use of several utility system management processors in aircraft, connected by a serial data bus to the avionics systems as proposed in the following article: I. Moiz , A.G. Seabridge and J.M. Lowery, "Utilities Management System on the EAP Demonstrator-Aircraft Power System Integration", 871780, 1988, SAE, 1987 Transactions.

The use of load management centers, connected by a serial data bus and containing solid state power controllers and electronic overload protection is proposed for advanced aircraft electrical systems in the following article: William^ R. Dwens , W.R. Ouncumb, R.W. Doerfler, A.R. Jung and R.G. Zuehlke, "Conceptual Design of an Advanced Aircraft Electrical System (AAES)", I987, IEEE pp. 441 - 455.

The use of a signal power conductor with a current carrying capacity of less than the current required to simultaneously operate all the loads is proposed for automotive vehicle load current management systems in U.S. Patent 4,639.609 to Floyd et al.

SUMMARY OF THE INVENTION There is provided, in accordance with an embodiment of the present invention, a system for management of a first plurality of utility systems of a vehicle. The system includes a) a second plurality of local control modules, each located in an operational center of an operational area and each connected to a multiplicity of utilities system components located throughout the operational area, for communicating with and for controlling the utilities system components and b) a data bus connecting the local control modules for enabling communication therebetween, wherein at least one of the local control modules also includes apparatus for managing, via the data bus, at least one of the first plurality of utility systems whose utility system components are located throughout the vehicle.

There is also provided, in accordance with an embodiment of the present invention, a system for management of a first plurality of utility systems of a vehicle. The system includes a) central command apparatus for managing each of the utility systems, b) a second plurality of local control modules, each located in an operational center of an operational area and each connected to a multiplicity of utilities system components located throughout the operational area, for operating the utilities system components and c) a data bus connecting the local control modules to each other and to the central command apparatus for enabling communication therebetween.

Additionally, in accordance with an embodiment of the present invention, each of the operational areas is an area of the vehicle with a generally high density of utility system components .

Moreover, in accordance with an embodiment of the present invention, the utility system components include at least one of actuators, command devices and sensors.

Further, in accordance with an embodiment of the present invention, the system also includes at least one power bus for providing power to each of the second plurality of local control modules.

Still further, in accordance with an embodiment of the present invention, each power bus includes at least two serially connected power conductors of different cross-sections.

Additionally, in accordance with an embodiment of the present invention, the system includes current sensors for measuring current consumption of each local control module and for measuring current provided along the power busses and short-to-ground protection apparatus for receiving measurement data from the current sensors, for calculating whether a short- to-ground exists on a given power bus and if so, for stopping flow of the current on the given power bus.

Moreover, in accordance with an embodiment of the present invention, each of the local control modules includes at least first and second electronic control modules.

Further, in accordance with an embodiment of the present invention, the system operates at least first and second pluralities of actuators wherein the first electronic control module controls the first plurality of actuators and the second electronic control module controls the second plurality of actuators .

Still further, in accordance with an embodiment of the present invention, the first electronic control module manages a first utility system and protects a second utility system and the second electronic control module manages the second utility system and protects the first utility system.

Additionally, in accordance with an embodiment of the present invention, one of the. utility systems is an electrical power generation system and wherein one of the local control modules either controls or operates the electrical power generation system.

Moreover, in accordance with an embodiment of the present invention, each of the local control modules includes a plurality of power controllers connected to the electronic control modules for selectably connecting electrical loads and the utility system components to the power buses.

Further, in accordance with an embodiment of the present invention, at least one of the first plurality of power controllers is connected in series with at least one of the second plurality of power controllers.

Still further., in accordance with an embodiment of the present invention, the first and second electronic control modules include first and second failure detection apparatus, respectively, for detecting failures in both of the first and second electronic control modules, respectively.

Additionally, in -accordance wit an embodiment of the present invention, the first and second electronic control modules include first and second apparatus for performing operations of the second and first electronic control modules, respectively, upon detection of a failure in the second or first electronic control modules, respectively.

Moreover, in accordance with an embodiment of the present invention, the first and second electronic control modules include first and second apparatus for operating the second and first pluralities of actuators, respectively, upon detection of a failure in the second or first electronic control modules, respectively.

Further, in accordance with an embodiment of the present invention, each local control module includes apparatus for performing data monitoring of signals received from utility system components to which it is connected.

Still further, in accordance with an embodiment of the present invention, the system includes avionic system interface apparatus for providing communication between an avionic system and the local control modules. The system can also include pilot display interface apparatus for providing communication between pilot displays and the local control modules.

Additionally, in accordance with an embodiment of the present invention, each of the power controllers include apparatus for overcurrent protection.

Moreover, in accordance with an embodiment of the present invention, power controllers of first and second local control modules are connected to a single electrical load thereby to provide redundant connections to at least one of the power buses .

Further, in accordance with an embodiment of the present invention, a portion of the power controllers, under control of the electronic control modules, are connected so as to provide reversible control to an electrical load.

Still further, in accordance with an embodiment of the present invention, the electronic control modules pulse width modulate at least some of the power controllers, thereby to provide proportional control of a utility system component.

Additionally, in accordance with an embodiment of the present invention, the short- to-ground protection apparatus includes apparatus for receiving current measurement data via the data bus and apparatus for determining whether current measured on each of the power busses exceeds the sum of current consumption of each local control module.

Moreover, in accordance with an embodiment of the present invention, the central command apparatus includes apparatus for controlling each of the utility systems and wherein the apparatus for controlling includes apparatus for issuing commands to utility system components via the data bus.

Further, in accordance with an embodiment of the present invention, the central command apparatus includes apparatus for monitoring operation of each of the utility systems.

Still further, in accordance with an embodiment of the present invention, the central command apparatus includes apparatus for managing distribution of electrical power.

Additionally, in accordance with an embodiment of the present invention, the local control modules each include apparatus for performing built-in- tests of the utility systems.

Moreover, in accordance with an embodiment of the present invention, the central command apparatus forms part of the avionic system.

Finally, in accordance with an embodiment of the present invention, the system includes apparatus for managing power distribution throughout the vehicle.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention will be understood and appreciated from the following detailed description, taken in conjunction with the drawings in which: Fig. 1 is a schematic illustration of an integrated utilities management system constructed and operative in accordance with a preferred embodiment of the present invention; Fig. 2 is a schematic illustration of an electrical power system forming part of the system of Fig. 1; Fig. 3 is a schematic illustration of a local control module forming part of the system of Fig. 1; Figs. 4A - 4D are schematic illustrations of connections of electrical loads to the local control module; Fig. 5 is a block diagram of an electronic control circuit, forming part of the local control module of Fig. 3; Fig. 6 is a schematic illustration of a power bus, forming part of the system of Fig. 1, which includes protection against a short to ground; and Fig. 7 s a flow chart illustration of the operation of the local control module of Fig. 3· DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT Reference is made to Fig. 1 which illustrates an integrated utilities management system constructed and operative in accordance with the present invention. The system shown in Fig. 1 is operative for an aircraft, it being understood that this is exemplary only.

The integrated utilities management system typically comprises a plurality of operational units placed in locations, or "operational areas", within the body of the vehicle where the density of electrical components is generally high. In the example system shown in Fig. 1 , there are three operational areas, a tail area 10 , a central area 12 and a nose area 14 .

In each operational area there are typically located at least one local control module (LCM) 30 · The local control module 30 operates and powers the electrical, electromechanical and the electronic components 32 located in the same general area. Typical electronic components are utility system sensors and command devices, and aircraft electrical loads. Sensors include temperature, pressure, flow, speed, position, current, voltage and other utilities system sensors. Command devices can include push buttons, switches, potentiometers, pedals, etc. Aircraft electrical loads includes motors, actuators, valves, heaters, lamps, electronic units, etc.

If similar components are located in two or more areas, the local control module 30 closest to each component is operative to power it. Thus, only the local control modules 30 located in the nose area 14 are responsible for powering an avionics system 20 which is also located in the nose area 14.

Furthermore, each local control module 30 is responsible for controlling and determining the operation of one utility system .

Typically, the local control modules 30 are located at the "center of gravity" of the operational area from the standpoint of wiring, and are interconnected by a utility serial data bus (UDB) 3 ^ . thereby to reduce the amount of wiring from the local control module 30 to each component.

The utility data bus 31* , such as MIL-STD-1553B or ARINC-629, is double redundant and serial to increase system fault tolerance capabilities.

All local control modules are typically electrically connected to power buses 36 located along the sides of the aircraft which receive power from an electrical power system 26. The power busses 36 enable a reduction in the number of power wires necessary, vis-a-vis the prior art. Power buses are described more in detail hereinbelow with respect to Fig. 5.

Electronic control circuits of one local control module 30 may also receive power from another local control module 30 located in the same operational area by means of a power line 31. It will be appreciated that line 3 provides increased fault tolerance capabilities, to each local control module 30.

If there is more than one local control module 30 in an operational area 10 - 14, half of the local control modules 30 are located on the right side of the vehicle and the other half are located on the left side, thereby to increase survivability. Each side of the craft is connected to two power busses, thereby to further increase fault tolerance.

In accordance with a preferred embodiment of the present invention, local control module 30 is typically redundant and therefore, comprises at least two generally identical independent channels, each controlled by a microprocessor device. Each independent channel contains data acquisition circuits for receiving input signals from utilities system sensors and command devices and solid state power output devices for powering, protecting and operating electrical loads of the various utilities systems to which the local control module 3 is connected. Local control modules are described in more detail hereinbelow with respect to Fig. 3· The utilities data bus 3^ interfaces the utilities systems with an avionic, pilot display and maintenance data recording systems 38 for mutual data transfer. System 38. located in the nose area 14, receives power supply from one or both of local control modules 30 located in nose area 14. Pilot command devices 40, also located in the nose area 14 , are typically connected to the local control modules 30 of the nose area.

In . accordance with a preferred embodiment of the present invention, the electrical power system 26 , described in more detail hereinbelow with respect to Fig. 2 , is located in the tail area 10 . Electrical power system 26 is operative to provide power to the entirety of electrical, electromechanical and electronic components operated by the system of the present invention. It is monitored and controlled by the local control modules . 30 located in the tail operational area 10 .

Typically, a startup command for activating the entire system is provided by the pilot through the pilot command devices 40. The command is delivered directly to the electronic power system 26 , as shown by line 48. Once the command has been received and the system powered up by power buses 36 , all other pilot commands are delivered, through the local control modules 30 in the nose area 14 to the relevant local control m.odules 30 via utility data bus 3^ · The local control modules 30 , in addition to responding to the pilot commands, perform utilities systems management.

Utility systems management includes processing of utility sensor data, monitoring and powering of electrical actuators and other electrical loads, protection against an overload current, operating automatic control and pilot remote control, performing built-in tests of the utility systems, exchanging data among the local control modules 30 and with the avionic, pilot display and maintenance systems 38 .

The management functions of the utilities systems are distributed among the local control modules 30 . Thus, for example, one local control module 30 may control the braking and air conditioning systems and another local control modules 30 controls the hydraulic and nose-wheel steering systems.

The local control module 30 controlling the relevant utility system receives sensor data from and provides commands to the local control modules 30 in other operational areas which actually operate the sensors and actuators of the utility system. The controlling local control module 30 typically controls the relevant utility system automatically. Alternatively, the pilot can control the relevant system. It will be noted that this distribution of functions ensures that a single failure in one local control module 30 will not affect the operation of more than one utility system.

The controlling local control module additionally receives status reports of other relevant utility systems from the local control modules 30 controlling those systems.

In order to provide improved system flexibility and maintainability, all local control modules 3 have identical hardware and software and are thus interchangeable. It will be noted that software modules for the management of the entirety of utility systems of the aircraft are stored in each local control module 30 ; however, only those software modules relevant to the utility system to be controlled are activated for a given local control module 30 .

Reference is now made to Fig. 2 which details the electrical power system 26 . The system 26 comprises two main generators 50 typically of three phase AC power and typically of 115 VAC, an emergency backup generator and a battery set 4 . The AC power sources (e.g. the generators 0 and 52 ) are controlled by generator control units 51 and are typically connected to internal AC busses 66 using three line contactors 53 and a plurality of switching devices 65 and 63 . Devices 65 and 63 provide dual redundancy such that simultaneous failures in any two AC power sources do not cause power loss in any of the internal AC busses 66 .

Three DC power busses 36a , 3 b and 36c are connected to the internal AC busses 66 typically through three-phase AC switching devices 60 , fuses 67 and transformer-rectifier units 64 which convert AC power received from internal AC busses 66 to the DC voltage utilized by power busses 36 . A fourth DC power bus 36d is connected to the battery set 4 via a DC switching device 61 and fuse a 69 . The currents flowing through power busses 36 are measured by current sensors 62.

As mentioned hereinabove, one of the local control modules 30 of the tail area 10 control power system 26. Therefore, the responsible local control module 30 receives inputs from the current sensors 62 and the transformer rectifier units 64 in order to measure current and voltage values on busses 66.

Furthermore, the responsible local control module operates switching devices 60, 61 and 63, and generator control units 51 · Alternatively, switching device 6l may be operated by a start-up command from the pilot command device 40 via a start-up line 48.

Prior to system start-up, all contactors 53 and switching devices 60, 61, 63 and 65 are deenergized and the correspondent circuits are disconnected. The start-up command sets the switching device 61 to connect the corresponding power bus 36d to battery set 5 thereby energizing the local control module 30 connected to power bus 36d. The energized local control modules 30 begin operation and supply power to the other local control modules 30 via line 31 (Fig. 1)· once the local control modules 30 are energized, the utility data bus 34 is energized thereby enabling the pilot to send commands to all the utilities systems. an engine start command is then issued to activate the engine start system.

After starting the engine, the relevant local control module 30 in the tail area 10 sends a command to the generator control units 51 controlling the main generators 50 thereby to energize the remaining power buses 36a - 36c. The line contactors 53 of the main generators 0 are activated by the generator control units 1 and connect the internal buses 66 to the main generators 50. If desired, the pilot can manually command the disconnection of the line contactors 53· If a main generator fails, the relevant local control modules 30 receive and analyze data from the electrical power system 26, operate the emergency generator 51 and enable or disable switching devices 63 and 65 as necessary.

Reference is now made to Fig. 3 which illustrates the elements of one local control module 30 · The local control module 30 typically comprises a power junction submodule 70 and typically two generally identical electronic control submodules 72a and 72b connected to the power junction submodule 70 via standard connectors j . In this manner, the control and power modules are separated and can be disconnected one from the other for maintenance and/or repair purposes.

Each local control module 30 is typically fully redundant for operation in the event of failure of one of submodules 72a or 72b .

Each control submodule 72a or 72b typically comprises, an electronic control circuit (ECC) 76a or 76b , respectively, described in more detail hereinbelow with respect to Fig. 4 .

It will be noted that the elements of the control units 72 are identical. Therefore, the elements of unit 72a are denoted by the letter 'a' and the elements of unit 72b are denoted by the letter 'b' .

Each load is controlled via solid state power controllers (SSPCs) 78 and 79 , such as the SSP-21110 series controllers of ILC Data Device Corporation of Bohemia, New York, U.S.A., which are based on power M0SFET switches, power controllers 78 and 79 also typically perform overcurrent and short- to-ground protection and include built-in test circuits and status reporting.

Typically, one "contact" of each power controllers 78 are fixedly connected to a power bus and the other contact is connected to a device outside of the local control submodule 72 . Typically, both contacts of the power controllers 79 are connected to devices outside of the local control submodule 72 .

The power controllers 78 and 79 are connected to control lines 15^ and 152 for fault tolerance purposes where lines 154 extend between the electronic control circuit 76 and the power controllers 78 and 79 of the same submodule 72 and lines 152 extend between the electronic control circuit 76 of one submodule 72 and the power controllers 78 and 79 of the other submodule. For example, power controllers 78a and 79 a are con- nected to control lines 154a and 152b .

The output of the testing circuits of the power controllers 78 and 79 is provided as input, along lines 158 , to the relevant electronic control circuit 76 .

Data exchange between submodules 72 for data comparison and fault tolerance management is performed by means of crosstalk via utility data bus 3 .

The power controllers 78 switch power received from power junction submodule 70 · As described in more detail herein-below, the power junction submodule 70 is controlled by the electronic control circuits 76 . When two buses 36 are available, the electronic control circuits 76 attempt to balance the available current across the electrical loads (not shown) . If one of the buses fails, the power junction submodule 70 connects both submodules 72 to the non-failed bus.

As detailed in Fig. 4 , the power controllers 79 are typically connected in series to power controllers 78 , either of the same submodule 7 or of the other submodule 72 .

The utilization of power controllers 78 and 79 for powering and control of actuators and other loads is described hereinbelow with respect to Fig. 4 .

The electronic control circuits 76 are additionally connected to sensors and command devices of the utility systems via control wires 77 · The electronic control circuits 76 are further connected to the utility data bus 34 , for communication with other local control modules 30 , and receive power from power busses 36 and via wire 31 from other local control modules 30 .

Initially, the loads of the actuators are balanced between the control submodules 72 , as described hereinbelow. However, if a failure occurs in one electronic control circuit 76 , the local control module 30 is designed to switch the control to the other electronic control circuit 76 .

Power junction submodule 70 typically comprises a portion of power busses 36 which provide power to submodules 72 for their internal use. Power junction submodule 70 also typical- ly comprises at least two relays 92 and at least two current sensors 9^.

Each relay 92 is connected to its corresponding set of power controllers 78 and 79 and is operative, upon a command from the corresponding electronic control circuit 76, to switch the power source to the power controllers 78 and 79 from one power bus 36 to the next if one of busses 36 has failed.

Current sensors 9** measure the current consumption of the local control module 30 from the relevant power bus 36· Each current sensor ^ provides "its data to its corresponding electronic control circuit 76 which data is utilized for short-to-ground protection as described hereinbelow with respect to Fig. 6.

The utility systems which the local control module 30 is to control are indicated to the local control module 30 via a configuration code provided as a signal on two separate sets of identification pins 15 · The pins 151 typically provide a discrete signal when shorted to ground.

At startup, the configuration code is checked and the indicated software modules for the utility systems to be controlled by the local control module 30 are activated. Each utility system is controlled by a different electrical control circuit 76. Therefore, each location within an operational area has a different configuration code indicating the utility system or systems to be controlled.

Each local control submodule 7 connects to a different set of identification pins 151 and therefore, controls a different utility system.

Reference is now made to Figs. 4A - 4D which exemplify connection of flight critical and essential electrical actuators and other loads to an local control module 30.

Fig. 4A illustrates a redundant control system for fuel booster pumps 89 which enables the full system to continue to operate after one pump 89 is disconnected due to failure. Normally, booster pump 89a operates continuously, while pump 89b is in a stand-by position. A failure in submodule 72a or in pump 89a itself causes activation of booster pump 89b.

Fig. 4B illustrates a redundant control system which provides protection from abnormal activation due to a single failure in addition to the continuous protection shown in Fig. 4A. In the example shown, an electrohydraulic valve contains two coils, 91a and 91b. At one time, only one of the coils for example, 91a, is typically operated, typically by a pilot command.

Each coil 9 is connected to and controlled by a power controller 78 of one submodule 72, which in turn, is connected to a power controller 79 of the other submodule. The power controller 79 provides protection against undesirable activation. Any shorting of power controller 78 or 79 due to hardware or software failure, will not cause undesired activation of the valve.

Fig. ^tC shows an example of reversible control of a redundant electromechanical actuator with the same redundancy capabilities as in the example of Fig. 4B. In this example the power controllers 78 of each submodule 72 are connected together in a Wheatstone bridge connection to two redundant reversible drive actuators 81. Position sensors 93 provide actuator position feedback .

In the example of Figs. and 4C the control may be performed in an analog or a proportional mode utilizing pulse-width modulation control of the power controllers 78.

In the example of Fig. 4D, an uninterruptable power supply for an essential electronic unit, such as the flight control computer 95. is accomplished by connecting the power supply of computer 95 to two local control modules 30a and 30b, where local control module 30a is connected to power buses 36a and 36b and local control module 30b is connected to power buses 36c and 36d.

The power supply of computer 95 is typically connected to four power controllers 78, each of which is connected to a different one of power buses 36. Current flow between power busses 36 is prevented by diodes 93 installed in the power supply of computer 95· The configuration of the power controllers 78 and 79 for each local control module 30 is indicated to each local control module 30 through jumpering of the contacts of the power controllers 78 and 79 and through connection of the loads to the power controllers 78 and 79· Reference is now made to Fig. which illustrates the elements of the electronic control circuit 76 in block diagram format .

The electronic control circuit 76 typically comprises a microcontroller 130, such as the 80196 controller manufactured by INTEL of the USA, for controlling the operation of the circuit 76 and a watchdog circuit 132, such as is known in the art, for monitoring the operation of the microcontroller.

The microcontroller 130 receives, via input circuits 134, discrete and analog input data received from the utility systems sensors and command devices. The input circuits 134 typically comprise some or all of filters, voltage dividers, buffers, amplifiers and other suitable input modifying circuitry.

The microcontroller 130 also receives status data from the power controllers 78 and 79 (Fig- 3) via lines 158. Commands are received from and data are sent to other local control modules 30 via the utility data bus 34 after suitable processing by a databus interface circuit (DBI) 136, such as the BUS-8554 manufactured by DDC Company, Inc. working in conjunction with a utility data bus 34 comprised of a MIL-STD-1553B type data bus.

The microcontroller 130 processes the data it has acquired and, based on the results of the processing and/or commands from the other local control modules 30, operates the power controllers 78 and the relay 9 (Fig. 3) via one of two tri-state buffers 138 and l40.

Buffers 138 of a first electronic control submodule 72 are connected, via lines 154, to the power controllers 78 and 79 associated with the first electronic control submodule 72 and buffers l40 are connected, via line 152, to the power controllers 78 and 79 of the second electronic control submodule 72 of the same local control module 30.

The microcontroller 130 continually performs a Built-in-Test (BIT) of the entirety of electronic components to which it is connected. If there are no failures, then a "valid" signal is sent to the second electronic control circuit 76.

However, if any of the components fail, or if the microcontroller 130 itself fails, the watchdog circuit 132 disables buffers 138, disabling the entirety of power controllers to which buffers 138 are connected. No "valid" signal is sent to the second circuit 76 indicating to the second circuit 76 to enable its buffers 140 to control the power controllers 78 and 79 of the first control submodule 72. In this instance, the second control circuit 76 controls the entirety of the power controllers 78 and 79 of the local control module 30.

Power is supplied to the components of the electronic control circuit 76 from a power supply 142 which receives power from the power busses 36 and from other local control modules 30.

Reference is now made to Fig. 6 which details one power bus 36 and its interconnection with electrical power system 26 (Figs. 1 and 2) and a few local control modules 30.

Power bus 36 typically comprises a multiplicity of power conductors 120, 122 and 124 of decreasing cross-section. Power conductor 120 carries DC current from the transformer-rectifier unit 64 (Fig. 2) forming part of the electrical power system 26 to a first local control module 30 located in the tail area 10 of the aircraft. Power conductor 122 carries DC current from the first local control module 30 to a second local control module 30 located in central area 12 and power conductor 124 carries DC current from the second local control module 30 to a third local control module 30 located in nose area 14.

Because power conductor 120 carries current for all of the local control modules 30, its cross-section is the largest of the conductors 120 - 124. Power conductor 122 carries current for two local control modules 30 and therefore, has a somewhat smaller cross-section than power conductor 120. Power conductor 124, carrying current only for one local control module 30, has the smallest cross-section. The cross-section of each power conductor 120 - 124 corresponds to the maximum continuous current expected to be carried on the conductor.

It will be appreciated that the cross-section variance enables the system of the present invention to weigh generally less than utility maintenance systems of the prior art.

As is known in the art, a short to ground on power conductor 124, with a small cross-section, can cause a shorting current which generally may be less than the maximum continuous current of power conductor 12Θ which has a larger cross-section. Because of this, a standard protection device, such as a line circuit breaker or a fuse, installed on the output of transformer-rectifier unit 64 would not be effective.

In accordance with the present invention, short to ground protection is provided as follows: the local control modules 30 in the tail area 10 receive a reading of the local current consumption level ij at each local control module 30 from its current sensor 9 . ' j' varies from 1 to the number of local control modules 30 , which, in the example shown in Fig. 6 is 3 · The tail local control modules 30 also receive, from current sensor 62 of the electrical power system 26, an output current iQut transmitted by the transformer-rectifier unit 64.

The data regarding current levels are transmitted from the corresponding electronic control circuits 76 via the utility data bus 34 .

The output current iQUt is then compared to the sum of the local consumption currents ij . If the output current iQUt exceeds the sum of the local consumption currents ij by more than some threshold, then a short to ground exists and the local control module 3 in the tail area 10 transmits a command to disconnect the relevant switch 60 which consequently deenergizes the relevant power bus 36 · In the presence of a short to ground on any of the power busses 36 , the local control modules 30 are still operable since they can receive DC power from the second DC bus 36 to which they are connected.

Reference is now made to Fig. 7 which illustrates, in flow chart form, the operation of one of electronic control circuits 76 of an local control module 30 · Upon power up, at step 200, the electronic control circuit 76 performs a Power-On BIT to test that the entirety of its circuitry is functioning.

If no failure is detected during the Power-On BIT then the buffers 138 of the electronic control circuit 76 are operative, buffers l40 are inoperative, and the "valid" message is sent to the second electronic control circuit via the utility data bus 34 (step 202). Otherwise, all buffers 138 and l40 are disabled (step 201).

In step 203 , electronic control circuit 76 initialization is performed, including selection of the operative software modules based on the code provided by the identification pins 151 (Fig. 3 ) .

In accordance with the initialization step, in a normal mode of operation, the software of a first electronic control circuit 76 has to manage a first utility system and to protect a second utility system and the software of a second electronic control circuit 76 of the same local control module 30 has to manage the second utility system and protect the first utility system.

After initialization (step 203 ) electronic control circuit 76 performs its normal operation cycle, electronic control circuit 76 performs data acquisition of all its input signals (step 204), receives data and commands via utility data bus 34 from other local control modules 30 i the avionic, display and maintenance systems 38 and from the pilot (step 205 ) , and performs a continuous BIT (step 206 ) .

If no failures are detected by the continuous BIT, then the electronic control circuit 76 sends a "valid" message to its second electronic control circuit 76 via utility data bus 34 (step 208) .

In step 209 t each electronic control circuit 76 processes data for the utility system it is managing and in step 210, each electronic control circuit 76 processes data for the utility system it is protecting. The results of this processing are always utilized to operate the system being managed and are utilized for operating the system being protected only if buffers l40 are enabled.

It will be appreciated that the data processing performed in step 209 also acts as built-in- tests of the utility systems being managed and protected.

At step 211, the electronic control circuit 76 sends the commands, (received via utility data bus from other local control modules or from the pilot in step 205 . ) to operate the power controllers 78 and 79 of the actuators connected to it, which typically form part of a utility system managed by other local control modules 30 .

In step 212, the electronic control circuit 76 issues commands, via the utility data bus 3^* . to the other local control modules 30 operating the actuators of the utility system it is managing and to the avionic system and the pilot.

If, at the appropriate time, electronic control circuit 76a receives a "valid" signal from its corresponding electronic control circuit 76b (step 213 ) , then the operational cycle is repeated beginning with step 204. Otherwise, buffers l40 are enabled (step 214) and the electronic control circuit 76a issues the commands (step 215 ) , calculated during step 210 , through the utility data bus 3^ . to the local control modules 30 operating the actuators managed by the failed electronic control circuit 76b and to the avionic system. Messages can also be sent to the pilot .

The electronic control circuit 76a then returns to step 204 , performing all the functions of both electronic control circuits 76 .

It is possible, though not illustrated, to concentrate the management functions of all the utility systems in additional central control modules connected to the utility data bus 34 . In this alternative embodiment, the local control modules 30 only operate the utility system components 32 and do not manage or protect any of the utility systems.

It is also possible, though not illustrated, that a portion of the avionic system will perform the functions of the central control modules.

It will be appreciated by persons skilled in the art that the present invention is not limited to what has been particularly shown and described hereinabove. Rather, the scope of the present invention is defined only by the claims that follow: 101498/2 12653pwr.cla 6/11/94

Claims (9)

1. CLAIMS 1. A system for management of a first plurality of utility systems of a vehicle, the system comprising: a second plurality of local control modules, each located in an operational center of an operational area and each connected to a multiplicity of utilities system components located throughout said operational area, for communicating with and for controlling said utilities system components; and a data bus connecting said local control modules for enabling communication therebetween, wherein at least one of said local control modules also comprises a device for managing, via said data bus, at least one of said first plurality of utility systems whose utility system components are located throughout said vehicle.

2. A system for management of a first plurality of utility systems of a vehicle, the system comprising: central command device for managing each of said utility systems; a second plurality of local control modules, each located in an operational center of an operational area and each connected to a multiplicity of utilities system components located throughout said operational area, for operating said utilities system components; and a redundant serial data bus connecting said local control modules to each other and to said central command device ■■ for enabling communication therebetween.

3. A system according to either of claims 1 or 2 and wherein each of said operational areas is an area of said vehicle with a generally high density of utility system components.

4. A system according to any of the previous claims and wherein said utility system components comprise at least one of actuators, command devices and sensors.

5. A system according to any of the previous claims and also including at least one power bus for providing power to each of said second plurality of local control modules.

6. A system according to claim 5 and wherein said at least one power bus comprises at least two serially connected power conductors of different cross-sections.

7. A system according to claim 6 and also including current sensors for measuring current consumption of each local control module and for measuring current provided along said power busses and short-to-ground protection device for receiving measurement data from said current sensors, for calculating whether a short-to-ground exists on a given power bus and if so, for stopping flow of said current on said given power bus. 101498/2 wherein each of said local control modules comprises at least first and second electronic control modules. 9. A system according to claim 8 and also including at least first and second pluralities of actuators wherein said first electronic control module controls said first plurality of actuators and said second electronic control module controls said second plurality of actuators. 10. A system according to claim 1 wherein each of said local control modules comprises at least first and second electronic control modules and wherein said first electronic control module manages a first utility system and protects a second utility system and said second electronic control module manages said second utility system and protects said first utility system. 11. A system according to claim 1 wherein one of said utility systems is an electrical power generation system and wherein one of said local control modules controls said electrical power generation system. 12. A system according to claim 2 wherein one of said utility systems is an electrical power generation system and wherein one of said local control modules operates said electrical power generation system. 13. A system according to claim 8 and wherein each of said local control modules comprise a plurality of power controllers connected to said electronic control modules for selectably connecting electrical loads and said utility system components to said power buses. 14. A system according to claim 13 and wherein at least one of said first plurality of power controllers is connected in series with at least one of said second plurality of power controllers . 15. A system according to claim 9 wherein said first and second electronic control modules comprise first and second failure detection device/ respectively, for detecting failures in both of said first and second electronic control modules, respectively. 16. A system according to claim 15 and wherein said first and second electronic control modules comprise first and second device for performing operations of said second and first electronic control modules, respectively, upon detection of a failure in said second or first electronic control modules, respectively. 17. A system according to claim 15 and wherein said first and second electronic control modules comprise first and second device for operating said second and first pluralities of actuators, respectively, upon detection of a failure in said second or first electronic control modules, respectively. 101498/2 1

8. A system according to any of the previous claims and wherein each local control module comprises a device-* for performing data monitoring of signals received from utility system components to which it is connected. 1

9. A system according to claim 1 and including avionic system interface device for connecting said data bus to an avionic system thereby to provide communication between said avionic system and said local control modules. 20. A system according to claim 1 and including pilot display interface device for connecting said data bus to pilot displays thereby to provide communication between said pilot displays and said local control modules. 21. A system according to claim 2 and including avionic system interface device for providing communication between an avionic system and said local control modules. 22. A system according to claim 2 and including pilot display interface device for providing communication between pilot displays and said local control modules. 23. A system according to claim 13 and wherein each of said power controllers comprise a device* for overcurrent protection. 24. A system according to claim 13 and wherein power controllers of first and second local, control modules are connected to a single electrical load thereby to provide redundant connections to at least one of said power buses. 25. A system according to claim 13 and wherein a portion of said power controllers/ under control of said electronic control modules, are connected so as to provide reversible control to an electrical load. 26. A system according to claim 13 and wherein said electronic control modules pulse width modulate at least some of said power controllers, thereby to provide proportional control of a utility system component. 27. A system according to claim 5 and wherein said short-to-ground protection efevice comprises an apparatus for receiving current measurement data via said data bus and a device for determining whether current measured on each of said power busses exceeds the sum of current consumption of each local control module. 28. A system according to claim 2 and wherein said central command device comprises an apparatus' for controlling each of said utility systems and wherein said apparatus^ for controlling includes a "*device for issuing commands to utility system components via said data bus. 101498/2 29. A system according to claim 2 and wherein said central command device comprises an apparatus for monitoring operation of each of said utility systems. .· 30. A system according to claim 2 and wherein said central command device comprises an apparatus for managing distribution of electrical power. 31. A system according to either of claims 1 or 2 and wherein said local control modules each include a device for performing built-in-tests of said utility systems. 32. A system .according to claim 21 and wherein 'said central command device forms part of said ayionic system. 33. A system according to claim 1 and including a device for managing power distribution throughout said vehicle. 34. A system substantially as shown and described hereinabove. 35. A system substantially as illustrated in any of the .For the^Ajplicant/ Sanford T. Go£b"& Co. C.12653