Patent Application
20120173052
The present invention relates to a method and a device for automatically monitoring a flight management assembly for an aircraft, in particular for a transport airplane, implementing air operations requiring navigation and guidance performance.
Although not exclusively, the present invention more particularly applies to required navigation performance operations with authorization required, of the RNP AR (<<Required Navigation Performance with Authorization Required>>) type. These RNP AR operations are based on a surface navigation of the RNAV (<<aRea NAVigation>>) type and on operations with required navigation performance of the RNP (<<Required Navigation Performance>>) type. They have the feature of requiring a special authorization for being able to be implemented on an aircraft.
The surface navigation of the RNAV type allows an aircraft to fly from a <<waypoint>> to another waypoint, and no longer from ground stations (of radio-navigation means of the NAVAID type) to ground stations.
It is known that the RNP concept corresponds to a surface navigation, for which there are added (on board the aircraft) monitoring and warning means allowing to ensure that the aircraft remains in a so-called RNP corridor, around a reference trajectory and authorizing taking into consideration curved trajectories. Outside this corridor, there is potentially some relief or other aircrafts. The required performance for a RNP operation type is defined by a RNP value accounting for half the width (in nautical miles: NM) of the corridor around the reference trajectory, where the aircraft should remain 95% of the time during the operation. A second corridor (around the reference trajectory) having half its width twice the RNP value is also defined. The probability that the aircraft goes out of this second corridor should be lower than 10−7 per hour of flight.
The concept of RNP AR operations is even more stringent. The RNP AR procedures are, indeed characterized by:
a final approach segment that could be curved; and
obstacles (mountains, traffic . . . ) that could be located at twice the RNP value with respect to the reference trajectory, while for usual RNP operations, an additional margin with respect to obstacles is provided.
The air authorities have defined a <<Target Level of Safety>> TLS of 10−7 per operation, whatever the type. In the case of RNP AR operations, as the RNP values could go down to 0.1 NM and the obstacles could be located at twice the RNP value of the reference trajectory, this objective results in a probability that the aircraft goes out of the corridor with half a width D=2.RNP that should not exceed 10−7 per procedure.
The equipment embedded on board aircrafts (flight management system, inertial unit, means for updating GPS data and means for guiding the autopilot), as well as the usual architecture, does not allow to reach the target level of safety, if mitigation operational means are not provided, including for the detection and the management of possible breakdowns. This is why a special authorization is required for this type of operation, so as to ensure that the operational procedures and the training of pilots allow to reach the target level of safety. Moreover, as the crew should manage some breakdowns, aircrafts are not able to-day to guarantee a RNP value of 0.1 NM upon a breakdown, as the crew are not able to meet the performance requirements in the autopilot mode.
On current aircrafts, monitoring RNP AR operations is implemented via two usual functions, that is:
a first function monitoring the accuracy and the integrity of the position calculation:
a second function allowing the crew to monitor the guidance of the aircraft:
As set forth previously, current aircrafts are not able to guarantee a RNP value of 0.1 NM upon a breakdown and the crew should be specially trained for flying RNP AR procedures. The crew should, indeed, be able to, adequately, detect and process, the breakdowns being able to compromise the ongoing operation.
The objective for future aircrafts involves having the ability to fly RNP AR procedures with RNP values up to 0.1 NM, and this without restriction (in a normal situation and in the case of a breakdown), in a starting, approach and throttling up mode. To this end, the crew should no longer be considered as the main means for detecting and processing breakdowns.
Now, a flight management assembly, of the FMS (<<Flight Management System>>) type, being responsible for managing the flight plane, the calculation of the trajectory and of deviations/guidance orders nominally operates with two flight management systems, operating in dual mode. In this cooperative nominal operating mode, one of the flight management systems is considered as the master, and it imposes to the other, being considered as the slave, to implement some operations in particular at the level of the management of the flight plane so as to allow it to remain synchronized to said master system. Amongst these operations, are included, in particular, requests for segmenting the trajectory so that the two flight management systems remain synchronized and are able to provide consistent information to the crew.
Now, in a context of air operations requiring navigation and guidance performance, the lateral trajectory is a critical data, as it has a direct impact on the guidance of the aircraft and on the keeping of the protective corridor with respect to obstacles. Via the dual mode operating, an erroneous piece of information from the system could corrupt the slave system without any problem being detected, neither by the systems, nor by the crew. If an erroneous piece of information leads the master system to sequence its lateral flight plane while it should not, it will impose such sequencing to the slave system. Thus, the erroneous sequencing will be carried out consistently and nearly simultaneously by the two flight management systems.
Such an operating mode is therefore not compatible with carrying out air operations requiring navigation and guidance performance.
The present invention aims at solving the above mentioned drawbacks. It relates to a method for automatically monitoring a flight management assembly for an aircraft implementing air operations requiring navigation and guidance performance. The present invention applies to a flight management assembly comprising a first flight management system, of the master type, operating in dual mode with a second flight management system, of the slave type, and that, upon the detection of an obligation for implementing an operation affecting its flight plane, emits, toward said second flight management system, a request asking to carry out at least one operation affecting the flight plane of the latter.
To this end, according to this invention, said method for automatically monitoring a flight management assembly, is remarkable, if said method is activated, upon the emission of such a request, the following operations are implemented consisting in:
a) checking that the conditions for implementing said request are met; and
b) as a function of this check:
In addition, preferably, at step b):
if said conditions are met, the two flight management systems continue to operate in dual mode; and
if said conditions are not met, the two flight management systems will operate in an independent mode.
Thus, thanks to the invention, it is checked whether the necessary conditions (to be set forth below) are met for implementing a request emitted by a first system (for flight management), of the master type, operating in dual mode with a second system (for flight management) of the slave type. And said second flight management system carries out the operation requested by such a request only if said conditions are indeed met.
Moreover, when said conditions are not met, the crew are made aware of the situation thru the emission of a warning signal, and preferably, the two flight management systems are led to operate in an independent mode.
Consequently, the present invention provides a simple breakdown resistant solution, so that a usual dual operating mode, to which this solution is applied, becomes compatible with carrying out air operations requiring navigation and guidance performance.
In a first embodiment, said request is a request for sequencing the flight plane. This invention allows checking whether this request should be carried out or not, whatever the checking conditions (remote, time or geometric). In a particular mode, said request for sequencing the flight plane results from a calculation error of the position of the aircraft. In this case, advantageously, upon the emission of such a sequencing request, at step a):
the difference is calculated between the positions of the aircraft, available respectively to the two flight management systems;
said difference is compared with a threshold value; and
as a function of this comparison, it is considered:
Moreover, advantageously, if the conditions for implementing said request are not met, said second flight management system does not sequence its flight plane.
Moreover, in a second embodiment, said request is a resynchronization request, relative to a modification of the flight plane or to a difference of flight plane between either sides. In such a case, advantageously, in a first alternative embodiment, after inserting in the flight plane a procedure relative to air operations requiring navigation and guidance performance, upon the preparation of an approach phase, if a resynchronization request, relative to a modification of the flight plane, is emitted, at step a) for checking whether the conditions for implementing said request are met, it is checked whether the new flight plane is consistent with the ongoing procedure, such as issued from a navigation data base.
Moreover, advantageously, in a second alternative embodiment, upon an approach phase, wherein a procedure relative to air operations requiring navigation and guidance performance is implemented, if a resynchronization request, relative to a modification of the flight plane, is emitted, at step a) for checking whether the conditions for implementing said request are met, it is checked whether the new novel flight plane is consistent with the ongoing procedure, such as issued from a navigation data base.
It is noticed that the present invention is applicable to an approach procedure and to a departure procedure.
Furthermore, the monitoring step a) is preferably implemented using means being part of said second flight management system (slave system). However, it could also be contemplated implementing step a) using means external to said second flight management system, for example, means of said master system or of another system or equipment of the aircraft.
Furthermore, the activation of the operations carried out at steps a) and b) could be implemented:
automatically, preferably as a function of the configuration of the aircraft and current flight data; and/or
manually by an operator, using a man/machine interface.
The present invention relates also to a device for automatically monitoring a flight management assembly, such as mentioned hereinabove, of an aircraft implementing air operations requiring navigation and guidance performance.
According to this invention, said device is remarkable in that it comprises:
means for activating said device;
means for checking, upon the emission of a request (requesting to carry out at least one operation affecting the flight plane), that the conditions for implementing said request are met;
means ordering the second flight management system to carry out the operation requested by this request, if said conditions are met;
means ordering said second flight management system not to carry out the operation as requested by the request, if said conditions are not met; and
means for emitting a warning signal, if said conditions are not met.
Additionally, in a preferred embodiment, said device further comprises at least one navigation database used for the above mentioned check. Preferably, each flight management system comprises its own database.
Monitoring according to the invention is particularly adapted for the RNP context, but could also apply to any flight requiring a high level of integrity, of resistance to breakdowns and of monitoring, for following a flight plane. Such a monitoring thus provides:
means for monitoring orders imposed by the master system to the slave system; and
particular operating logics, when inconsistencies are detected between the master system and the slave system.
The present invention also relates to:
a flight management assembly for an aircraft implementing air operations requiring navigation and guidance performance, said assembly comprising a first flight management system, of the master type, and a second flight management system, of the slave type, operating in dual mode, as well as a monitoring device, such as mentioned hereinabove. Preferably, said flight management assembly is symmetric, each of said flight management systems being able to play the part of the master (or of the slave) knowing that at a given instant, there is only one master and one slave; and/or
an aircraft, in particular a transport airplane, being provided with such a flight management assembly and/or such a monitoring device.
The single FIG. of the appended drawing will better explain how this invention can be implemented. This single FIG. is the block diagram of a flight management assembly, comprising a device according to this invention.
The device 1 according to this invention and schematically shown on the single FIG. is intended for automatically checking a flight management assembly 2 for an aircraft (not shown), in particular a transport airplane, being able to implement air operations requiring navigation and guidance performance.
Said flight management assembly 2 being responsible, usually, for managing the flight plane, the calculation of the trajectory and deviations/guidance orders, comprises, amongst others, one unit 3 comprising:
one first flight management system 4, being considered as the master; and
one second flight management system 5, being considered as the slave, both being of the FMS (<<Flight Management System>>) type.
Preferably, said flight management assembly 2 is symmetric, each of said flight management systems 4, 5 being able to play the part of the master (or of the slave) knowing that at a given instant, there is only one master and one slave.
Said flight management assembly 2 also comprises:
an assembly 6 of sources of information, being connected via a link 7 to said unit 3 and providing, amongst others, usually, the flight plane of the aircraft, as well as the current values of parameters relative to the flight of the aircraft and to its environment;
a database 8 being connected via a link 9 to said unit 3 and containing navigation data and information relative to a RNP procedure; and
a man/machine interface 10 being connected via a link 11 to said unit 3.
Said systems 4 and 5 being connected together via a link 12 operate in dual mode. To this end, said system 4 comprises:
usual means 13 being able to detect an obligation for implementing an operation affecting the flight plane of said system 4;
usual means 14 for implementing the operation affecting the flight plane, upon a detection by said means 13; and
usual means 15 for emitting to said system 5, a request requesting the latter to carry out at least one operation affecting the flight plane of said system 5, in the case of the detection by the means 13 of an obligation to implement an operation such as mentioned hereinabove.
Moreover, said system 5 comprises:
usual means 17 intended for receiving a request emitted by the means 15; and
usual means 18 for implementing the operation requested by a request.
The present invention relates to a device 1 for automatically monitoring the flight management assembly 2 of the aircraft implementing air operations requiring navigation and guidance performance.
According to this invention, said device 1 comprises:
means 20 for activating said device 1, being, for example, connected via a link 21 to said unit 3;
means 22:
warning means 23 being, for example, connected via a link 24 to said unit 3 and being formed so to emit a warning signal, if said conditions are not met.
Said warning means 20 are formed, preferably, so as to emit at least one (visual or sound) warning in the cockpit of the aircraft.
The usual operation of a dual mode being not acceptable in a context of operations requiring navigation and guidance performance, as a breakdown of the master system could be automatically propagated to the slave system without the crew are able to detect it, a monitoring is thus initiated, within the context of present invention, preferably at the level of the slave system 5, with the aim to check the requests sent by the master system 4, for any erroneous piece of information able to impact the lateral trajectory or the associated guidance.
Thus, the device 1 according to this invention allows to check whether the necessary conditions are met for implementing a request emitted by the master system 4, operating in dual mode with the slave system 5. And said system 5 carries out the operation requested by this request only if said conditions are indeed met.
Furthermore, when said conditions are not met, the crew are warned by the warning means 23 thanks to the emission of a corresponding warning signal in the cockpit of the aircraft.
Moreover, preferably, in this case, said device 1 makes the two flight management systems 4 and 5 operate in an independent mode, replacing the dual mode used until then.
Consequently, the present invention provides a simple breakdown resistant solution, so that a usual dual operating mode, to which this solution is applied, becomes compatible with carrying out air operations requiring navigation and guidance performance.
For achieving such an objective, two monitoring means (being part of means 22) could be initiated between the master system 4 and the slave system 5, that is:
means for monitoring the sequencing of the trajectory; and
means for monitoring resynchronizations of the slave system 5 on the master system 4.
These two monitoring means allow to check the management of the lateral trajectory and to protect the flight plane of each system 4, 5. Without requiring the least action from the crew, these monitoring means allow to permanently guarantee the independence of the two systems 4 and 5 even in dual mode. Each request from the master system 4 is checked by the slave system 5 able to take it into consideration only if it has the ability to do so. In case of mismatch, the crew are warned and the operation mode could be degraded (switching from the dual mode to the independent mode).
In order to limit the exposure time of these two monitoring means, they only apply to RNP AR procedures referred to as <<Low RNP>>, that is to the procedures for which the current value of RNP is lower than or equal to 0.3. The activation of these monitoring means is, in this case, automatic and does not require any action from the crew.
Within the context of the present invention, the activation of said device 1 could be implemented:
automatically, preferably as a function of the configuration of the aircraft and of current flight data, by means (not specifically shown) being part of said means 20. In particular, the activation could be implemented before the aircraft enters in a RNP AR procedure, in order to check that the two systems 4 and 5 are in an adequate configuration and to warn the crew if this is not the case; and/or
manually by an operator, by means of a man/machine interface (not specifically shown) being part of the means 20, preferably using a screen page allowing the crew to interact with the assembly 2.
In a first embodiment, said request is a request for sequencing the flight plane. This invention allows to check whether this request should be carried out or not, whatever the checking conditions (remote, time or geometric). Preferably, said request for sequencing the flight plane results from a calculation error of the position of the aircraft. In this case, upon the emission of such a sequencing request by the means 15, the means 22 implement the following operations, using appropriate elements (being not specifically shown):
calculating the difference between the positions of the aircraft, available respectively to the two flight management systems 4 and 5;
comparing this difference to a predetermined threshold value; and
as a function of this comparison, considering:
Moreover, if the conditions for implementing said request are not met, said system 5 does not sequence its flight plane.
This first embodiment corresponds to the following situation. The crew fly a RNP AR procedure, in automatic modes (slaving of the aircraft on its lateral, vertical trajectory and in speed), and the RNP monitoring are active. The operation of the aircraft and of the systems involved in the monitoring is nominal. On the pilot's side, a calculation error of the position of the aircraft occurs. Whatever its cause, this breakdown leads the master system 4 (being on this side) to lie in conditions authorizing to sequence the next passage point of the flight plane. It sends (using means 15) a sequencing request to the slave system 5, in accordance with the dual operating mode. Two situations may then occur:
either the slave system 5 also lies in the sequencing conditions (low difference of position between the two systems 4 and 5), and in this case, no problem is detected and:
or the slave system 5 does not lie in the sequencing conditions, and a conflict is then detected between the two systems 4 and 5 and:
In the first situation, the two systems 4 and 5 remain synchronized, and they continue to collaborate in dual mode.
On the contrary, in the second situation, the two systems 4 and 5 cannot remain synchronized (the flight planes being different), and the dual mode is replaced by the independent mode. There is no longer any communication between the two systems 4 and 5. The master system 4 does not impose anything to the slave system 5. This switch to an independent mode is detected by the other systems involved in RNP monitoring, resulting in reconfigurations in the cockpit, being visible for the crew.
Moreover, in a second embodiment, said request is a resynchronization request, relative to a modification of the flight plane or to a difference of flight plane (between both sides of the aircraft).
In such a case, two situations should be distinguished.
In a first situation relative to a first alternative embodiment, after the insertion in the flight plane of a procedure relative to air operations requiring navigation and guidance performance, upon the preparation of an approach phase, if a resynchronization request (relative to a modification of the flight plane) is emitted by the means 15, the means 22 check whether the new flight plane is consistent with the ongoing procedure, such as issued from the navigation database 8.
In this first situation, the aircraft is flying, typically in a cruising phase, and the crew prepare the approach of a runway of an airport with a view to landing, inserting in the flight plane a RNP AR procedure. After this procedure has been inserted, a breakdown induces a modification in the flight plane of the master system 4. There is thus an inconsistency between the flight planes of the two systems 4 and 5. Such an inconsistency is not detectable by the crew, but it affects the RNP AR procedure. In accordance with the dual operating mode, the master system 4 sends a resynchronization order to the slave system 5 requesting it to delete its own flight plane and to become reinitialized with the data from the master system 4. The slave system 5 receives the new flight plane, detects the presence of a RNP AR procedure and compares it with the RNP AR procedure being located in the navigation database 8. Given the initial breakdown that has affected the flight plane of the master system 4, the monitoring means 22 of the slave system detect an inconsistency between this new flight plane and the procedure issued from the database 8. The slave system 5 rejects the resynchronization, and a warning message is emitted by the means 23, for warning the crew, so that they become aware of the problem before initiating a RNP AR procedure. Consequently, the crew have had the time to recharge the RNP procedure in the systems 4 and 5 and to ensure that the flight planes are in accordance.
In a second situation relative to a second alternative embodiment, upon an approach phase of a runway of an airport with a view to landing, wherein a procedure relative to air operations requiring navigation and guidance performance is implemented, if a resynchronization request (relative to a modification of the flight plane) is emitted by the means 15, the means 22 check whether the new flight plane is consistent with the ongoing procedure, such as issued from the navigation database 8.
In this second situation, the aircraft is flying, typically in an approach phase, and flies according to a RNP AR procedure. A breakdown induces an error in the flight plane (and thus in the ongoing RNP AR procedure) of the master system 4. As in the previous case, an inconsistency is detected between the two systems 4 and 5, and the master system 4 requests the slave system 5 to become resynchronized on it. The slave system 5 receives this request and the new flight plane. It detects, using the monitoring means 22, the inconsistency with the RNP AR procedure lying in the database 8. It rejects the resynchronization and the communication between the two systems 4 and 5, and the dual mode is then given up to the profit of the independent mode, allowing to avoid the erroneous piece of information from being propagated from the master system 4 to the slave system 5. This independent operating mode is maintained and blocking the synchronization is maintained as long as the aircraft flies according to this RNP AR procedure.
The present invention could apply to an approach procedure, as described previously, but also to a departure procedure.
The architecture and the different monitoring functions, as described above, allow the aircraft to meet the safety requirements inherent to RNP AR operations, being able to detect and to identify automatically a defective system. The crew could further follow and monitor whether the operation is properly carried out.
The present invention is adapted to air operations of the RNP type, but it could also be used for any flight requiring a high level of integrity, of resistance to breakdowns and of monitoring, for following a flight plane. For example, it may be employed for operations in a mountain environment, for which RNP procedures would not have been created.
Furthermore, the monitoring according to the invention is implemented using means 22 being part, preferably, of said flight management system 5 (slave system). However, it could also be contemplated to implement the monitoring using means being external to said system 5, for example, means being part of said master system 4 or of another system of the aircraft.
| Number | Date | Country | Kind |
|---|---|---|---|
| 11 50073 | Jan 2011 | FR | national |
