RECONFIGURATION PROCESS OF AN AIRCRAFT ENVIRONMENT SURVEILLANCE DEVICE

Abstract

The invention relates to a reconfiguration process for an aircraft environment surveillance device including at least two redundant electronic systems (2, 2′), where each system includes at least two surveillance sets (4-10, 4′-10′) able to provide information about the aircraft's environment. The inventive method and apparatus includes the following steps and structures: detection of simultaneous unavailability (S1, S4) of at least one surveillance set of the first system (4-10) and of at least one surveillance set of a second system (4′-10′); and, in the case where at least two unavailable sets (4-10, 4′-10′) are not redundant sets, automatic selection (S3, S6) of the information obtained, on the one hand, from the available surveillance sets of the first system (4-10), and, on the other hand, from the redundant surveillance set or sets of the second system (4′-10′) that matches the unavailable surveillance set or sets of the first system (4-10).

Description

This application claims priority to French Patent Application No. 11 56596 filed Jul. 20, 2011, the entire contents of which are hereby incorporated by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The invention relates to the surveillance of an aircraft's environment. In this instance, by surveillance, we mean the aircrew's knowledge and management of information about the environment in which the plane travels, such as weather conditions, terrain and traffic.

2. Discussion of Prior Art

In general, each type of information is provided by a dedicated surveillance set (radar, warning system, etc.). The information gathered is forwarded to the aircrew via a display and/or an audio system.

On some planes, these surveillance systems are advantageously part of one single surveillance system of an aircraft's environment, commonly called “Aircraft Environment Surveillance System” (AESS).

In order to make sure the system is available and reliable, each surveillance set is at least duplicated. Therefore, an AESS groups together at least two electronic systems, called “Aircraft Environment Surveillance Units” (AESU), where each one groups together several redundant surveillance sets.

In order to simplify things, a master/slave type of architecture is chosen to manage the transfer of information to the reproduction devices (display, audio system, etc.). Thus, in normal mode, only information obtained from the master surveillance system sets are sent to the aircrew.

If a master surveillance system set is not available, an “Electronic Centralized Aircraft Monitoring” (ECAM) procedure asks the pilots to use a command panel, provided for this purpose, to reconfigure the systems, and thus give the status of master system to the previously slave system in order to extract all the information.

However, this process has disadvantages, namely, in case of a crossover failure of two sets. In this instance, by crossover failure we mean the simultaneous unavailability of a surveillance set of a first system and a non redundant surveillance set (that does not have the same type of information) of a second system.

Indeed, in this situation, the aircrew must choose between the data of the first system and that of the second system. For example, if the terrain surveillance set of the first system and the weather conditions surveillance set of the second system are both faulty, the team must choose between the terrain data and the weather warnings.

Although, in most cases this choice is easy, some situations, such as an approach or a take-off in bad weather in mountainous terrain, make things more difficult.

SUMMARY OF THE INVENTION

The invention proposes among other things to remedy this inconvenience.

Therefore, the invention relates to a reconfiguration process of an aircraft environment surveillance system that includes at least two redundant electronic systems, where each system includes at least two surveillance sets able to provide information about the aircraft's environment,

characterized in that it includes the following steps:

Detection of simultaneous unavailability of at least one surveillance set of said first system and at least one surveillance set of a second system;

In the situation where the said at least two unavailable systems are not redundant systems, automatic selection of the information obtained, on the one hand, from the available surveillance sets of said first system, and, on the other hand, from the redundant surveillance set(s) of the second system, that matches the unavailable surveillance set or sets of the first system.

Thanks to such a process, even during a crossover failure, if at least one surveillance set of a given type of information remains, it will be made available to the aircrew.

In this case, the aircrew will no longer need to make a choice or even perform a reconfiguration because it will be done automatically.

In addition, we will note that the process does not exclude a manual intervention by a member of the aircrew, for example in the case of a simple failure of only one surveillance set, for which switching from one system to the other remains possible. The invention also covers an automatic reconfiguration in this specific case.

According to one possible feature of the invention, the redundant electronic systems each include at least one weather conditions surveillance set, and at least one surrounding terrain surveillance set.

These sets are commonly seen as the most frequently used on aircraft. Other surveillance sets that may pick up other information about the aircraft's environment may also be considered, namely a TCAS type system (“Traffic Avoidance and Collision System”) and an XPDR type transponder.

Advantageously, each system includes at least one surveillance set said to be independent, where an independent surveillance set includes an internal data base so it may function without requiring additional information from another set of the system being considered.

Thus, a surveillance set that usually depends on another set from the same system to correct or confirm its information becomes independent of this other set to function correctly.

According to an advantageous feature, the weather conditions surveillance set is an independent set.

This applies in particular to a case where such a set contains a weather radar. Indeed, said radar may require that echoes that are not from a weather event, such as those that originate from the ground or elevated terrain, be corrected.

To do this, the radar usually uses information from the terrain surveillance set that allows it to delete the echoes in a “declutter” function.

An independent weather conditions surveillance set includes in particular a simplified terrain data base that allows it to declutter the radar and thus function correctly whatever the status of system to which the terrain surveillance set belongs.

According to a possible feature of the invention, the surveillance sets include surveillance sub-sets.

In particular, this may be the case for the weather conditions and the surrounding terrain surveillance sets.

Thus, according to a possible feature of the invention, the weather conditions surveillance set includes at least one turbulence surveillance sub-set, at least one weather conditions display sub-set or WX DISPLAY reflectivity areas display or “Weather Display” and at least one Windshear surveillance sub-set.

Also, according to a possible feature of the invention, the surrounding terrain surveillance set includes at least one terrain proximity warning sub-set and at least one sub-set with a terrain data base whose information may be displayed, as well as an alert system based on this data base (TERR SYS for “terrain system”).

According to an advantageous feature, the surveillance device incorporates at least one category of sub-sets defined as priority, so that in the case of simultaneous unavailability of a sub-set of a first surveillance system and a non redundant sub-set of a second surveillance system, the selection step provides for the selection of information from the system that contains the priority sub-set.

A priority sub-set is namely a sub-set that gathers information seen as more important than the other information or more useful for the aircrew.

Thus, thanks to the invention, if one of the surveillance sets is only partially unavailable because of the unavailability of one of its sub-sets, transmission of the most important information can be maintained if there is still at least one available priority sub-set.

As TERR SYS data are usually seen as operationally more important for the aircrew, said at least one TERR SYS sub-set is a priority sub-set, in particular in relation to other sub-sets such as a “Ground Proximity Warning System” (GPWS).

According to a possible feature of the invention, the process also includes an information transfer step to an audio and/or video reproduction device.

The device in question is in particular comprised of one or more Vertical Displays or Navigation Displays located inside an aircraft's cockpit. It can be replaced or completed by a sound warning system. The displayer(s) and/or warning systems may, or may not, be part of the surveillance device.

The invention also relates to an aircraft environment surveillance device that includes at least two redundant electronic systems, where each system includes at least two surveillance sets that are able to provide information about the aircraft's environment, which includes:

Means of detecting simultaneous unavailability of at least one surveillance set of said first system and at least one surveillance set of a second system;

Means of selection, that, in the case where the said at least two unavailable systems are not redundant systems, are able to select the information obtained, on the one hand, from the available surveillance sets of said first system, and, on the other hand, from the redundant surveillance set(s) of the second system, that matches the unavailable surveillance set or sets of the first system.

Thus the device includes means allowing it to be reconfigured in the case mentioned below.

This device has the same advantages as those offered by the process briefly explained above.

Advantageously, each device system includes at least one surveillance set defined as independent, where an independent surveillance set includes an internal data base so that it can function without requiring additional information from another set of the system being considered.

According to a specific feature, the surveillance device's surveillance sets include surveillance sub-sets.

According to an advantageous feature, the surveillance device includes a category of sub-sets that are priority, so that in the case of simultaneous navailability of a sub-set of a first surveillance system and a non redundant sub-set of a second surveillance system, the means of selection are able to select the information from the system that includes the priority sub-set.

According to a particular feature, the redundant electronic systems of the surveillance device each include at least one weather conditions surveillance set and at least one surrounding terrain surveillance set.

Advantageously, the device's weather conditions surveillance set is an independent set.

According to a specific feature, the surveillance device's weather conditions surveillance set includes at least one turbulence surveillance sub-set, at least one weather conditions display sub-set (WX DISPLAY) and at least one windshear surveillance sub-set

According to one specific feature of the device, the surrounding terrain surveillance set includes at least one terrain proximity warning sub-set and at least one sub-set equipped with a terrain data base whose information can be displayed, as well as a warning system based on this data base or “Terrain System” (TERR SYS).

Advantageously, such a TERR SYS sub-set is a priority sub-set.

According to specific conditions, the surveillance device as set forth in the invention also includes means of transferring information to an audio and/or video reproduction device.

Finally, the invention relates to an aircraft that includes a device as set forth in the invention as briefly described above.

BRIEF DESCRIPTION OF THE DRAWINGS

Other features and advantages will appear during the following description, given as an example but not limited thereto and made in reference to the attached drawings, where:

FIG. 1 is a schematic representation of the device as set forth in the invention in normal mode;

FIG. 2 represents the device in FIG. 1 in the case of unavailability of a surveillance set of a first electronic system;

FIG. 3 represents the device in FIG. 1 in the case of simultaneous unavailability of two non redundant surveillance sets of different systems;

FIG. 4 is a flow chart of the process as set forth in the invention;

FIG. 5 represents the device in FIG. 1 in the case of partial unavailability of two redundant surveillance sets of two different redundant systems, where the unavailable sub-sets are redundant themselves;

FIG. 6 represents the device in FIG. 1 in the case of simultaneous unavailability of two surveillance sets of two different redundant systems, where the unavailable sub-sets are redundant themselves.

DETAILED DISCUSSION OF EMBODIMENTS

An aircraft environment surveillance device as set forth in the invention is represented in FIG. 1. This surveillance device 1, or AESS includes several redundant surveillance electronic systems. In this instance, device 1 includes a first system 2 and a second system 2′ that are redundant, or AESU.

Each system 2,2′ includes several surveillance sets of which the number depends in particular on the type of information we wish to make available. In order to simplify the denominations of these sets, the surveillance set included in the first surveillance system will be called the first set and the surveillance set included in the second surveillance system will be called the second set.

Herein, the first and second systems 2,2′ each include a weather radar 4,4′, a terrain avoidance warning system 6,6′, a collision avoidance warning system 8,8′ and a transponder 10,10′. Preferably, these surveillance sets are respectively of known types: Weather Radar (WXR), Terrain Avoidance Warning System (TAWS), Traffic Avoidance and Collision System (TCAS) and Transponder (XPDR). From here on, these acronyms will be used to designate the different surveillance sets.

In the execution mode of the device 1 presented in FIG. 1, some of these surveillance sets are comprised of sub-sets. Thus the first and second WXR sets 4,4′ are each comprised of three sub-sets: a windshear prediction system, “Predictive Windshear” (PRED W/S) 4a, 4a′, a turbulence surveillance system (TURB) 4b, 4b′, and a weather conditions display or reflectivity zone display or “Weather Display” (WX DISPLAY) system 4c, 4c′. From here on, these will also be designated by their acronyms.

As to the first and second TAWS sets 6, 6′, they are each comprised of a system equipped with a terrain data base whose information can be displayed, as well as a warning system based on this data based (“Terrain System”) TERR SYS 6a, 6a′ and a Ground Proximity Warning System (GPWS), 6b, 6b′.

Each electronic surveillance system 2,2′ also includes an IOM interface module 12, 12′ (“Input Output Module”) with the audio and/or video reproduction device 14 present in the cockpit. Such a device is known in the prior art and will not be described herein, but we will note that it may potentially be part of the surveillance device 1.

The surveillance device also includes a switch 15, that can be of a purely software nature and not necessarily be a physical switch. Lastly, the surveillance device 1 includes a control panel for an external operator, not represented but also known in the prior art. Indeed, although the process described above makes it possible to do an automatic reconfiguration in the case of a crossover failure, it does not exclude a manual intervention by an operator such as a member of the aircrew.

The role of each of the surveillance sub-sets is to gather data from the environmental conditions in which the aircraft travels. This information is grouped together within the surveillance set made up of the sub-sets. Thus the PRED W/S 4a, 4a′, TURB 4b, 4b′ and WX DISPLAY 4c, 4c′ sub-sets collect and/or contain weather related information, grouped together respectively in the WXR 4,4′ sets. The GPWS 6b, 6b′ sub-sets and the TERR SYS 6a, 6a′ sub-sets collect and/or contain terrain related information respectively grouped together in the TAWS 6,6′ sets. Lastly the TCAS 8, 8′ and XPDR 10,10′ sets collect information from the air traffic situation.

The information gathered by the first system 2 and second system 2′ sets is respectively communicated to the first and second interface modules 12, 12′ whose functions are to make sure they are available and to manage the interface with the reproduction device 14. In addition, the first and second interface modules 12, 12′ ensure internal communication (“cross-talk”) between the first and second systems 2,2′. The latter is namely independent and does not require any data that is external to the device 1. To this end, it is for example based on a known type of bus AFDX.

The internal communication makes it possible to exchange information about the availability of the surveillance sets. Thus, for example, if the first WRX set 4 or one of its sub-sets breaks down or becomes unavailable for any other reason, the first IOM module 12 informs the second IOM 12′ which, in exchange, indicates if the second WXR set 4′ is available.

In all cases, the information forwarded to the reproduction device 14 is forwarded through the switch 15 that determines which of the two systems is the master system. Only the IOM of the master system, in this instance the IOM 12 in FIG. 1, transfers information to the reproduction device 14. This data comes either from the master system surveillance sets or from the IOM of the slave system, in this instance the IOM 12′ of system 2′.

FIG. 2 shows a case of failure or unavailability of the first TAWS surveillance set 6 for another reason. In such a case, the procedures associated with the surveillance devices of the prior art force the aircrew to use the control panel to switch from the first system 1 to the second system 2. Thus, the first system 1 passes from the status of master to slave via the switch 15 and the second interface module 12′ only communicates the information obtained from the second sets to the reproduction devices.

If later, as illustrated in FIG. 3, the second WXR surveillance set 4′ also breaks down or becomes unavailable for any other reason, the aircrew may, according to the prior art, either continue to obtain the remaining information from the second system 2′, in other words, only the terrain related information through the second TAWS 6′ set, or once again reverse the statuses of the second system 2′ and the first system 2 to only obtain the information remaining from the first system 2, in other words the weather related information from the first WXR set 4.

As explained previously, this choice can be potentially difficult in some situations. The process as set forth in the invention, illustrated in FIG. 4, resolves this problem. This reconfiguration process 16 includes a first crossover failure detection step S1. If a crossover failure is detected, it triggers step S2, a redundancy test of the unavailable surveillance sets. If this test is negative, an available set selection step S3 is put in motion. If it is positive, an unavailable sub-set detection step S4 is put in motion. At the end of this step S4, a sub-set redundancy test step S5 is put in motion. If this new test is negative, a priority sub-set selection step S6 is put in motion. If it is positive, a waiting step S7 is put in motion.

The functions and consequences of these various steps will now be described in more detail in relation to the example in FIG. 3. The function of the detection step S1 is to detect the simultaneous unavailability of a surveillance set of the first system 2 and a surveillance set of the second system 2′. Namely, this step is performed by the availability means of detection that are the first and second interface modules 12, 12′.

Herein, as the first TAWS surveillance set 6 and the second WXR surveillance set 4′ are simultaneously unavailable, the surveillance sets redundancy test step S2 is triggered. The object of this step is to determine if the two sets, whose simultaneous unavailability was detected, are redundant or not, meaning if they are of the same type and have the same function within their respective systems. Once again this step is performed by the interface modules that are able to determine which sets are inactive.

In this instance, in the example in FIG. 3, as the first TAWS surveillance set 6 and the second WXR surveillance set 4′ are not redundant, the available sets selection step S3 is put in motion. During this step, the information selected is obtained, on the one hand from the available surveillance sets of the first system 2, meaning from the WXR 4, the TCAS 8 and the XPDR 10, and on the other hand, from the redundant surveillance set of the second system 2′ that matches the unavailable surveillance set of the first system 2, in other words the TAWS 6′.

To this end, the IOM module 12′ communicates the data from the TAWS 6′ to the IOM module 12 which transfers said data, in addition to the data obtained from the available sets of its own system, to the reproduction device 14. In this manner, contrary to the prior art, in case of a crossover failure of surveillance sets, the aircrew does not have to choose between certain types of information because it is all available. It is no longer necessary to use the control panel because the reconfiguration occurs automatically.

Furthermore, unless there is an overall failure of a master system, it is no longer necessary to perform switches from the master to the slave system, whether these switches are manual or automatic. However, the surveillance device or the display device may include warning means that inform the aircrew of the unavailability of the sets and the reconfiguration that was performed. Also, the aircrew does still have the possibility of performing manual reconfigurations like for the devices of the prior art.

Lastly, according to an advantageous condition in relation to the devices and processes of the prior art, the WXR sets 4, 4′ have an internal terrain data base that allows them to declutter the weather radar by deleting the echoes linked to the ground or the landscape (“declutter function”) without needing the information obtained from the TAWS set 6,6′ of their system.

We will now describe the steps that result from a positive response to the test performed in the set redundancy test step S2. To this end, we will refer to FIGS. 5 and 6 that illustrate cases where the first and second TAWS surveillance sets 6,6′ are simultaneously unavailable. In this case, the sub-set failure (or unavailability) detection step S4 is put in motion. Indeed, although a set is seen as unavailable as soon as one of its sub-sets is unavailable, some of its sub-sets may continue to function.

Thus, during the sub-set failure detection step S4, the IOM modules 12, 12′ detect which sub-sets of the unavailable sets are unavailable, and in such a case, identifies them. Then, the sub-set redundancy test step S5 is put in motion. The object of this step is to determine if the simultaneously unavailable sub-sets of the redundant sets are themselves redundant sub-sets. Again, this test is performed by the IOM interface modules 12, 12′ which have the means to locate the unavailabilities and make this distinction.

If this test is positive as in the example of FIG. 5 where the first and second GPWS sub-sets 6b, 6b′ are simultaneously unavailable, the waiting step S7 is put in motion. This step does not lead to any action on the part of the device, because performing a reconfiguration of the first system 2 to the second system 2′ or the reconfiguration of some sets would have no effect on the availability of the information.

On the other hand, if the sub-set redundancy test step S5 results in a negative test, as it would in the case of the example in FIG. 6 where the non redundant first TERR SYS subset 6a and second GPWS sub-set 6′b are simultaneously unavailable, the priority sub-sets selection step S6 is put in motion. Herein, by priority sub-set, we mean a sub-set for which the category of information emitted is seen as more operationally important for the aircrew than the others.

During this step, the information emanating from the system that includes the sub-set identified as being priority is selected. In this instance, the TERR SYS type sub-sets are priority because they are commonly seen as more useful for the aircrew. Therefore, the process 16 selects the information from the second system 2′ whose TERR SYS sub-set 6′a is still available. Again this selection is performed by the IOM interface module 12′ which then communicates the selected information to the IOM interface module 12 which in turn transfers it to the reproduction device 14.

We will note that thanks to the internal data base of the WXR sets 4, 4′, even in the case of simultaneous unavailability of the redundant TAWS sets 6,6′ (case not represented), the WXR sets can function correctly and operate the “declutter” function.

The steps of the process 16 described above are performed automatically. However, they do not exclude an intervention by the aircrew on the control panel, which may be required in the case of a failure of only one surveillance set to exchange the statuses of the systems 2, 2′.

We will also note that a different number of surveillance systems, surveillance sets in each system or even surveillance sub-sets in each set would not in any way change the principle of the invention that may be adapted accordingly.

While the invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not to be limited to the disclosed embodiment, but on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A method of reconfiguration of an aircraft environment surveillance device that includes first and second redundant electronic systems, where each system includes at least two surveillance sets able to provide information related to the aircraft's environment, said method comprising the following steps: detection of simultaneous unavailability of at least one surveillance set of said first system and at least one surveillance set of a second system; anddetermine if said at least two unavailable sets are not redundant sets, and automatically selecting information obtained, on the one hand, from available surveillance sets of said first system, and, on the other hand, from the redundant surveillance set or sets of the second system that matches the unavailable surveillance set or sets of the first system, wherein said above steps are implemented by a computer.

2. A method of reconfiguration according to claim 1, wherein each system includes at least one surveillance set defined as independent, where an independent surveillance set includes an internal data base so that it can function without requiring additional information from another set of the system considered.

3. A method of reconfiguration according to claim 1, wherein the redundant electronic systems each include at least one weather conditions surveillance set and at least one surrounding terrain surveillance set.

4. A method of reconfiguration according to claim 2, wherein one weather conditions surveillance set is an independent set.

5. A method of reconfiguration according to claim 1, wherein the surveillance sets include surveillance sub-sets.

6. A method of reconfiguration according to claim 3, wherein the weather conditions surveillance set includes at least one turbulence surveillance sub-set, at least one weather conditions display sub-set and at least one windshear surveillance sub-set.

7. A method of reconfiguration according to claim 3, wherein the surrounding terrain surveillance set contains at least one terrain proximity warning sub-set and at least one sub-set with a terrain data base and an associated warning system.

8. A method of reconfiguration according to claim 5, wherein the surveillance device includes at least one sub-set category defined as priority, so that in the case of simultaneous unavailability of a sub-set of a first surveillance system and a non redundant sub-set of a second surveillance system, the selection step (S6) will select information obtained from the system that includes the priority sub-set.

9. A method of reconfiguration according to claim 7, wherein said at least one sub-set equipped with a terrain data base and an associated warning system is a priority sub-set.

10. A method of reconfiguration according to claim 1, wherein it also includes a step that transfers information to an audio and/or video reproduction device.

11. Aircraft environment surveillance device including at least two redundant electronic systems, where each system contains at least two surveillance sets able to provide information about the aircraft's environment, wherein said device includes: means for detecting simultaneous unavailability of at least one surveillance set of said first system and at least one surveillance set of a second system; andmeans for automatically selecting in the case where said at least two unavailable sets are not redundant sets, the information obtained, on the one hand from the available surveillance sets of said first system, and, on the other hand, from the redundant surveillance set or sets of the second system that matches the unavailable surveillance set or sets of the first system.

12. The surveillance device according to claim 11, wherein each system includes at least one surveillance system defined as independent, where an independent surveillance set includes an internal data base so that it can function without requiring additional information from another set of the system being considered.

13. The surveillance device according to claim 11, wherein the surveillance sets include surveillance sub-sets.

14. The surveillance device according to claim 13, wherein the device incorporates at least one category of sub-sets defined as priority, so that in the case of simultaneous unavailability of a sub-set of a first surveillance system and a non redundant sub-set of a second surveillance system, the selection means are able to select information obtained from the system that includes the priority sub-set.

15. Aircraft containing a device according to claim 11.