Patent Grant
11552640
This application is based on and claims the benefit of priority from Japanese Patent Application Serial No. 2020-039939 (filed on Mar. 9, 2020), the contents of which are hereby incorporated by reference in its entirety.
The present invention relates to a redundancy control device for an aircraft.
A redundancy control device disclosed in Japanese Laid-Open Patent Publication No. 1-98034 (“the '034 Publication”) includes three controllers. Identical signals are supplied to the three controllers and the three controllers are configured to output identical output signals. The output signals from the three controllers are supplied to a majority voting circuit. The majority voting circuit establishes a majority among the inputs by the three controllers and produces a final output. Even if any one of the controllers fails in such a redundancy control device, an appropriate final output can be obtained from the outputs of the other two of the controllers.
Such a redundancy control device using the technique disclosed in the '034 Publication may be used for control of various parts of an aircraft. However, if any two of the controllers fail in the redundancy control device, the reliability of the final output cannot be secured since the final output determined by majority voting changes depending on whether outputs of the two faulty controllers are identical and whether the outputs of the two faulty controllers are identical to an output of the normally working controller. To address this, a monitoring controller may be provided for each of the three controllers. The voting circuit may be configured such that, when the monitoring controller determines failure of the corresponding controller, an output of the controller is not reflected on a final output. However, such monitoring controllers have complex configurations and are prone to failures.
The present invention has been made in view of the above drawback, and one object thereof is to provide a redundancy control device that produces a highly reliable output.
A redundancy control device for aircraft according to one aspect of the invention includes: three controllers each outputting a first voltage or a second voltage different from the first voltage as an output signal to an actuator that drives a moving surface of an aircraft, each of the three controllers performing a same processing to obtain an operation result, each of the three controllers outputting the operation result as a status signal; a comparison circuit provided for each of the three controllers, the comparison circuit outputting a comparison signal based on a comparison between the status signal outputted by a corresponding one of the three controllers and the status signal outputted by another of the three controllers; a switch provided for each of three output lines, each of the three controllers being provided with a corresponding one of the three output lines through which the output signal is outputted by a corresponding one of the three controllers, the switch switching between connection and disconnection of a corresponding one of the three output lines; a switch control unit provided for each switch, the switch control unit outputting a switch signal to the switch in response to the comparison signal from the comparison circuit; a voltage supply unit connected to each of the three output line downstream of the switch, the voltage supply unit supplying the second voltage to the output line when the first voltage from the controller is lost; a latch circuit connected to each of the three output lines downstream of the voltage supply unit, the latch circuit latching the second voltage and keeping outputting the second voltage once the second voltage is inputted thereto; and a majority voting circuit connected to the three output lines downstream of the latch circuits, each of the output signals from the three controllers being inputted to the majority voting circuit through each corresponding one of the output lines, the majority voting circuit establishing a majority vote of the three output signals and outputting the first voltage or the second voltage as a final output signal. The switch control unit outputs the switch signal to disconnect the switch provided in the output line of a first controller, which is a corresponding one of the three controllers, when the comparison signals outputted by the comparison circuits of second and third controllers, which are the other two of the three controllers, both indicate a mismatch between the first controller and the second and third controllers.
If the status signal of one controller does not match the status signal of the other two controllers, the controller is likely to be out of order. Therefore, in the above configuration, the switch control unit disconnects the output line when the comparison signals outputted by the comparison circuits of the other two controllers both indicate a mismatch between the corresponding controller and the other controller. In this case, the voltage supply unit supplies the second voltage to the output line, and the latch circuit latches the second voltage. The second voltage is then inputted to the majority voting circuit through the output line. In this way, when there is a high probability that the controller has failed, the second voltage is inputted to the majority voting circuit through the output line of the controller. Therefore, if two or more controllers fail, the second voltage is inputted to the majority circuit from the corresponding two or more output lines. Thus, the majority voting circuit reliably outputs the second voltage as the final output signal, and the voltage of the final output signal is reliably defined to the second voltage. In this way, when two controllers fail, a reliable output can be obtained as the final output signal without using monitoring controllers.
The redundancy control device may be applied to a plurality of fluid pressure actuators attached to a same moving surface of the aircraft, and the plurality of actuators are configured to be switched between an active mode where the actuators drive the moving surface and a standby mode where the actuators follow the moving surface without driving the moving surface.
As for the redundancy control device for an aircraft, the plurality of actuators attached to the moving surface may include one or more first actuators and one or more second actuators different from the first actuator, and one of the first actuator and the second actuator may be controlled to operate in the active mode, and the other of the first actuator and the second actuator may be controlled to operate in the standby mode.
The redundancy control device may be applied to an electromechanical actuator attached to a moving surface of the aircraft.
An embodiment of an actuator to which a redundancy control device for an aircraft is applied will be hereunder described with reference to the accompanying drawings.
Configurations of the actuator and its control will be now described.
As shown in
The first actuator 300 is an electrohydraulic system. A main body 310 of the first actuator 300 has a tubular cylinder 510. The interior of the cylinder 510 constitutes a fluid chamber into which and from which a hydraulic fluid is fed and discharged. In the fluid chamber, a rod 520 having a columnar shape is positioned coaxially with the cylinder 510. A tip of the rod 520 protrudes out from the cylinder 510 and is attached to the flap 600. Inside the cylinder 510, a piston 530 projects from an outer peripheral surface of the rod 520. The piston 530 divides the fluid chamber into two in an axial direction of the cylinder 510.
A connection passage 540 is connected to each of the pair of fluid chambers divided by the piston 530. The pair of connection passages 540 are coupled to a mode switching valve 550 that switches a flow path of the hydraulic fluid. The mode switching valve 550 is a solenoid valve whose position is switched between a communicating position 551 and a cutoff position 552 according to a supply of electric power. When the mode switching valve 550 is switched to the communicating position, the mode switching valve 550 operates in a feeding and discharging mode. That is, one of the pair of connection passages 540 is connected to a feed passage 561 of the hydraulic oil, and the other of the connection passages 540 is connected to a discharge passage 562 of the hydraulic oil. Thus, the hydraulic oil delivered from the pump 570 is supplied to one fluid chamber through the feed passage 561, and the hydraulic oil is discharged from the other fluid chamber to a tank 580 through the discharge passage 562.
When the mode switching valve 550 is switched to the cutoff position 552, the mode switching valve 550 operates in a bypass mode. Specifically, the pair of connection passages 540A switched to the cutoff position 552 are cut off from both the feed passage 561 and the discharge passage 562. At the same time, the pair of connection passages 540A switched to the cutoff position 552 are connected to each other. As a result, the hydraulic fluid can move back and forth between the pair of fluid chambers. A connection switching valve 560 for switching connections of the feed passage 561 and the discharge passage 562 to the pair of connection passages 540 is provided in the feed passage 561 and the discharge passage 562. The connection switching valve 560, the mode switching valve 550, the feed passage 561, the discharge passage 562, and the pair of connection passages 540 form a first hydraulic circuit 320 that feeds and discharges the hydraulic fluid to the main body 310 of the first actuator 300. The first actuator 300 includes the first hydraulic circuit 320 and the main body 310.
The switching valves 550 and 560 and the pump 570 of the first hydraulic circuit 320 are controlled a first redundancy control device 350. The first redundancy control device 350 estimates values of current and the like for controlling the switching valves 550, 560 and the pump 570 based on a command signal S from an upper-level device 700, and outputs them to the first hydraulic circuit 320 as a command signal P. The upper-level device 700 is a control device that comprehensively controls various moving surfaces attached to the aircraft. As described above, the plurality of first actuators 300 are provided. These first actuators 300 are controlled by the same first redundancy control device 350 and operate synchronously.
A main body 410 of a second actuator 400 has the same configuration as the main body 310 of the first actuator 300. Hydraulic fluid is fed to and discharged from the main body 410 by a second hydraulic circuit 420 having the same configuration as the first hydraulic circuit 320. The second hydraulic circuit 420 is controlled by a second redundancy control device 450 having the same configuration as the first redundancy control device 350. For the second actuator 400, the same components as those of the first actuator 300 are designated by the same reference numerals as those of the first actuator 300, and will not be repeatedly described. As described above, the plurality of second actuators 400 are provided. These second actuators 400 are controlled by the same second redundancy control device 450 and operate synchronously.
During normal operation, the upper-level device 700 transmits the command signal S to control the first actuator 300 such that the first actuator 300 operates in an active mode in which the flap 600 is driven by the first actuator, and control the second actuator 400 such that the second actuator 400 operates in a standby mode in which the second actuator 400 stands by for a failure of the first actuator 300. Here, in the first actuator 300 controlled to operate in the active mode, the mode switching valve 550 is controlled to operate in a feed/discharge mode, and the connection switching valve 560 and the pump 570 operate according to a target position of the flap 600. In the second actuator 400 controlled to operate in the standby mode, the mode switching valve 550 is controlled to operate in the bypass mode and the pair of connection passages 540A are connected to each other. Thus, the hydraulic fluid moves back and forth between the pair of fluid chambers according to operation of the flap 600. That is, the second actuator 400 follows movement of the flap 600. As will be described later, when a failure occurs in the first redundancy control device 350, the mode switching valve 550 of the first hydraulic circuit 320 is forcibly switched to the bypass mode. That is, the first actuator 300 enters the standby mode. In this case, the upper-level device 700 controls the second actuator 400 through the second redundancy control device 450 such that the second actuator 400 operates in the active mode.
The first redundancy control device 350 and the second redundancy control device 450 will be now described in detail. The second redundancy control device 450 has the identical configuration as the first redundancy control device 350 so that the description thereof will be omitted.
As shown in
A first control circuit 21 of the first controller 11 generates and outputs a control signal P for the first hydraulic circuit 320 based on the command signal S from the upper-level device 700. A second control circuit 22 of the second controller 12 and a third control circuit 23 of the third controller 13 also perform identical functions as the first control circuit 21. One of the three controllers 11, 12, and 13 is selected as a main system, and the control signal P of the controller selected as the main system is supplied to the first hydraulic circuit 320.
The first control circuit 21 performs a count-up process in which counting up is carried out over a predetermined fixed period, and outputs that operational result to the first comparison circuit 31 of the first controller 11 as a first status signal N1 of the first controller 11. The first control circuit 21 repeats such a process at a predetermined cycle. Once the first status signal N1 is supplied to the first comparison circuit 31, the first comparison circuit 31 outputs the first status signal to a second comparison circuit 32 of the second controller 12 and a third comparison circuit 33 of the third controller 13 via a communication line (not shown). The second control circuit 22 and the second comparison circuit 32 also perform the same processes to output a second status signal N2 of the second controller 12 to the first comparison circuit 31 and the third comparison circuit 33. The third control circuit 23 and the third comparison circuit 33 also perform the same processes to output a third status signal N3 of the third controller 13 to the first comparison circuit 31 and the second comparison circuit 32. Thus, the three comparison circuits 31, 32, and 33 exchange their status signals with each other. The three comparison circuits 31, 32, and 33 send and receive status signals in synchronization with each other.
The first comparison circuit 31 has two output terminals that output comparison signals C based on a comparison between the first status signal N1 and the status signals of the other controllers. A first comparison output terminal 31A, which is one of the two output terminals, outputs the comparison signal C based on a comparison between the first status signal N1 and the second status signal N2. The first comparison output terminal 31A outputs a high voltage H as the comparison signal C when the first status signal N1 and the second status signal N2 match each other, and outputs a low voltage L, which is a voltage lower than the voltage H, when the first status signal N1 and the second status signal N2 do not match each other. A second comparison output terminal 31B, which is the other of the two output terminals, outputs the comparison signal C based on a comparison between the first status signal N1 and the third status signal N3. The second comparison output terminal 31B outputs the high voltage H as the comparison signal C when the first status signal N1 and the third status signal N3 match each other, and outputs the low voltage L when the first status signal N1 and the third status signal N3 do not match each other.
Similar to the first comparison circuit 31, the second comparison circuit 32 has a first comparison output terminal 32A and a second comparison output terminal 32B. The first comparison output terminal 32A outputs the comparison signal C based on a comparison between the second status signal N2 and the third status signal N3, and the second comparison output terminal 32B outputs the comparison signal C based on a comparison between the second status signal N2 and the first status signal N1. The third comparison circuit 33 also has a first comparison output terminal 33A and a second comparison output terminal 33B. The first comparison output terminal 33A outputs the comparison signal C based on a comparison between the third status signal N3 and the second status signal N2, and the second comparison output terminal 33B outputs the comparison signal C based on a comparison between the third status signal N3 and the first status signal N1. Similar to the first comparison circuit 31, each comparison output terminal outputs the high voltage H as the comparison signal C when the two status signals inputted thereto match each other, and outputs the low voltage L as the comparison signal C when the two status signals inputted thereto do not match each other.
The first control circuit 21 has an abnormality output terminal 21A that outputs an output signal T indicating the presence or absence of an abnormality in the first redundancy control device 350. The abnormality output terminal 21A outputs the output signal T based on the comparison signals C output from the two comparison output terminals 31A and 31B of the first comparison circuit 31. Specifically, the abnormality output terminal 21A outputs the high voltage H as the output signal T when at least one of the comparison signals C output from the two comparison output terminals 31A and 31B of the first comparison circuit 31 has a high voltage H. Whereas when both the comparison signals C output from the two comparison output terminals 31A and 31B have the low voltage L, the abnormality output terminal 21A outputs the low voltage L as the output signal T. The second control circuit 22 also has an identical abnormality output terminal 22A, and the third control circuit 23 also has an identical abnormality output terminal 23A. That is, these abnormality output terminals also output the high voltage H as the output signal T when at least one of the comparison signals C output from the two output terminals of their comparison circuits of their own controllers has the high voltage H. Whereas the output terminals output the low voltage L when both the comparison signals C have the low voltage L.
When an abnormality occurs in the flight control system for operating various moving surfaces of the aircraft, for example, a signal indicating the abnormality of the flight control system is transmitted to the three control circuits 21, 22, 23 as the command signal S from the upper-level device 700. In this case, the three control circuits 21, 22, 23 forcibly output the output signal T of the low voltage L from the abnormality output terminals 21A, 22A, and 23A, respectively. Further, when a signal instructing shutdown of the first redundancy control device 350 is supplied to the three control circuits 21, 22, 23 via the upper-level device 700 or any other circuit, the three control circuits 21, 22, 23 forcibly output the output signal T of the low voltage L from the abnormality output terminals 21A, 22A, 23A respectively. When a signal instructing activation of the first redundancy control device 350 is supplied to the three control circuits 21, 22, 23 via the upper-level device 700 or any other circuit, the three control circuits 21, 22, 23 forcibly output the output signal T of the high voltage H from the abnormality output terminals 21A, 22A, 23A, respectively when initializing process of the respective control circuit is completed.
Output lines are connected to the abnormality output terminals 21A, 22A, and 23A, respectively. That is, a first output line 91 is connected to the abnormality output terminal 21A of the first control circuit 21. A second output line 92 is connected to the abnormality output terminal 22A of the second control circuit 22. A third output line 93 is connected to the abnormality output terminal 23A of the second control circuit 23.
These three output lines 91, 92, 93 are connected to a majority voting circuit 70. The majority voting circuit 70 establishes a majority vote of the output signals T inputted from these three output lines 91, 92, 93 and outputs the low voltage L or the high voltage H as a final output signal F. Specifically, the majority voting circuit 70 includes three AND circuits, that is, a first AND circuit 71, a second AND circuit 72, and a third AND circuit 73. The first output line 91 and the second output line 92 are connected to input terminals of the first AND circuit 71. The first output line 91 and the third output line 93 are connected to input terminals of the second AND circuit 72. The second output line 92 and the third output line 93 are connected to input terminals of the third AND circuit 73. Each of the three AND circuits 71, 72, 73 outputs the low voltage L when at least one of the output signals T from the two output lines has the low voltage L, and outputs the high voltage H when both the output signals T from the two output lines have the high voltage H.
The output terminals of the three AND circuits 71, 72, 73 are connected to input terminals of an OR circuit 74 in the majority voting circuit 70. The OR circuit 74 outputs the low voltage L from its output terminal when all the signals inputted thereto from the three AND circuits 71, 72, 73 have the low voltage L. Whereas when at least one of the signals from the three AND circuits 71, 72, 73 has the high voltage H, the OR circuit 74 outputs the high voltage H from its output terminal. The output from the OR circuit 74 is outputted to the first hydraulic circuit 320 as a final output signal F from the first redundancy control device 350. The final output signal F is a signal for switching between enable and disable of the control signal P outputted by the control circuit. When the final output signal F has the high voltage H, the control signal P is enabled and the first hydraulic circuit 320 is controlled based on the control signal P. Whereas when the final output signal F has the low voltage L, the control signal P is disabled. At the same time, in the first hydraulic circuit 320, the mode switching valve 550 shown in
As shown in
In the first output line 91, a first pull-down resistor 51 is provided on the downstream side of the first switch 41 with respect to the flowing direction of the signal in the first output line 91, that is, on the side of the first switch 41 closer to the majority voting circuit 70. The first pull-down resistor 51 serves as a voltage supply unit. Here, when the first switch 41 is switched to the disconnected state, the output signal T from the first controller 11 is lost in the first output line 91. At this time, the low voltage L is applied to the first output line 91 by the first pull-down resistor 51. That is, the first pull-down resistor 51 supplies the low voltage L to the first output line 91 when the output signal T from the first controller 11 is lost as the first switch 41 switches to the disconnected state.
In the first output line 91, a first latch circuit 61 is provided on the downstream side of the first pull-down resistor 51 with respect to the flowing direction of the signal in the first output line 91, that is, on the side of the first pull-down resistor 51 closer to the majority voting circuit 70. Once the low voltage L is supplied to the first latch circuit 61, the first latch circuit 61 latches the low voltage L and keeps outputting the low voltage L. Although not shown, the first latch circuit 61 is connected to reset lines extending from the three controllers 11, 12, 13. The first latch circuit 61 returns to an initial state when latch clear signals are supplied thereto from all the three controllers 11, 12, 13 through the reset lines.
Similarly to the first output line 91, a second switch 42, a second pull-down resistor 52, and a second latch circuit 62 are connected in the second output line 92. Further, a third switch 43, a third pull-down resistor 53, and a third latch circuit 63 are also connected in the third output line 93.
A first switch control unit 81 is connected to the first switch 41. The first switch control unit 81 is formed of an OR circuit. The first switch control unit 81 receives the comparison signals C from the second comparison circuit 32 and the third comparison circuit 33, and outputs a switch signal K to the first switch 41 based on the comparison signals C. Specifically, the second comparison output terminal 32B of the second comparison circuit 32 is connected to one input terminal of the first switch control unit 81. As described above, the second comparison output terminal 32B outputs the comparison signal C based on the comparison between the second status signal N2 and the first status signal N1. Further, the second comparison output terminal 33B of the third comparison circuit 33 is connected to the other input terminal of the first switch control unit 81. As described above, the second comparison output terminal 33B outputs the comparison signal C based on the comparison between the third status signal N3 and the first status signal N1.
The first switch control unit 81 outputs the high voltage H as the switch signal K when the high voltage H indicating a match between the second status signal N2 and the first status signal N1 is inputted to the first switch control unit 81 from the second comparison output terminal 32B of the second comparison circuit 32, or when the high voltage H indicating a match between the third status signal N3 and the first status signal N1 is inputted to the first switch control unit 81 from the second comparison output terminal 33B of the third comparison circuit 33. The first switch control unit 81 outputs the low voltage L as the switch signal K when the low voltage L indicating a mismatch between the second status signal N2 and the first status signal N1 is inputted to the first switch control unit 81 from the second comparison output terminal 32B of the second comparison circuit 32 and the low voltage L indicating a mismatch between the third status signal N3 and the first status signal N1 is inputted to the first switch control unit 81 from the second comparison output terminal 33B of the third comparison circuit 33. As described above, the high voltage H is the switching signal K that switches the first switch 41 to the connected state, and the low voltage L is the switching signal K that switches the first switch 41 to the disconnected state.
A second switch control unit 82 identical to the first switch control unit 81 is connected to the second switch 42. One input terminal of the second switch control unit 82 is connected to the first comparison output terminal 31A of the first comparison circuit 31 that outputs a result of comparison between the first status signal N1 and the second status signal N2. The other input terminal of the second switch control unit 82 is connected to the first comparison output terminal 33A of the third comparison circuit 33 that outputs a result of comparison between the third status signal N3 and the second status signal N2. The second switch control unit 82 outputs the high voltage H as the switch signal K when the high voltage H indicating a match between the first status signal N1 and the second status signal N2 is inputted to the second switch control unit 82 from the first comparison output terminal 31A of the first comparison circuit 31, or when the high voltage H indicating a match between the third status signal N3 and the second status signal N2 is inputted to the second switch control unit 82 from the first comparison output terminal 33A of the third comparison circuit 33. The second switch control unit 82 outputs the low voltage L as the switch signal K when the low voltage L indicating a mismatch between the first status signal N1 and the second status signal N2 is inputted to the second switch control unit 82 from the first comparison output terminal 31A of the first comparison circuit 31 and the low voltage L indicating a mismatch between the third status signal N3 and the second status signal N2 is inputted to the second switch control unit 82 from the first comparison output terminal 33A of the third comparison circuit 33.
A third switch control unit 83 identical to the first switch control unit 81 and the second switch control unit 82 is connected to the third switch 43. One input terminal of the third switch control unit 83 is connected to the second comparison output terminal 31B of the first comparison circuit 31 that outputs a result of comparison between the first status signal N1 and the third status signal N3. The other input terminal of the third switch control unit 83 is connected to the first comparison output terminal 32A of the second comparison circuit 32 that outputs a result of comparison between the second status signal N2 and the third status signal N3. The third switch control unit 83 outputs the high voltage H as the switch signal K when the high voltage H indicating a match between the first status signal N1 and the third status signal N3 is inputted to the third switch control unit 83 from the second comparison output terminal 31B of the first comparison circuit 31, or when the high voltage H indicating a match between the second status signal N2 and the third status signal N3 is inputted to the third switch control unit 83 from the first comparison output terminal 32A of the second comparison circuit 32. The third switch control unit 83 outputs the low voltage L as the switch signal K when the low voltage L indicating a mismatch between the first status signal N1 and the third status signal N3 is inputted to the third switch control unit 83 from the second comparison output terminal 31B of the first comparison circuit 31 and the low voltage L indicating a mismatch between the second status signal N2 and the third status signal N3 is inputted to the third switch control unit 83 from the first comparison output terminal 32A of the second comparison circuit 32.
The following describes operations in the present embodiment.
(A) Circuit Operation when the Three Controllers 11, 12, 13 Operate Normally
It is assumed that all three controllers 11, 12, and 13 operate normally. In this case, the first status signal N1, the second status signal N2, and the third status signal N3 match with each other. Thus, to the first switch control unit 81, the high voltage H indicating the match between the second status signal N2 and the first status signal N1 is inputted from the second comparison output terminal 32B of the second comparison circuit 32, and the high voltage H indicating the match between the third status signal N3 and the first status signal N1 is inputted from the second comparison output terminal 33B of the third comparison circuit 33. Since both of the two comparison signals C inputted to the first switch control unit 81 have the high voltage H, the switch signal K output from the first switch control unit 81 has the high voltage H. As a result, the first switch 41 is controlled to the connected state. Here, the first comparison output terminal 31A of the first comparison circuit 31 outputs the high voltage H indicating the match between the first status signal N1 and the second status signal N2, the second comparison output terminal 31B outputs the high voltage H indicating the match between the first status signal N1 and the third status signal N3, so that the high voltage H is output to the first output line 91 from the abnormality output terminal 21A of the first control circuit 21. Since the first switch 41 is connected, this high voltage H is supplied to the majority voting circuit 70 through the first output line 91.
Since the first status signal N1, the second status signal N2, and the third status signal N3 match with each other, like the first switch control unit 81, the high voltage H indicating the match between the status signals are inputted to the second switch control unit 82 from both the first comparison output terminal 31A of the first comparison circuit 31 and the first comparison output terminal 33A of the third comparison circuit 33. Thus, the high voltage H is outputted from the second switch control unit 82 as the switch signal K. As a result, the second switch 42 is controlled to the connected state. Then, like the first comparison circuit 31, the high voltage H indicating the match between the status signals is outputted from both the two comparison output terminals 32A and 32B of the second comparison circuit 32, so that the high voltage H is outputted from the abnormality output terminal 22A of the second control circuit 22 to the second output line 92. Since the second switch 42 is connected, this high voltage H is supplied to the majority voting circuit 70 through the second output line 92.
Like the first switch control unit 81 and the second switch control unit 82, the high voltage H indicating the match between the status signals are inputted to the third switch control unit 83 from both the second comparison output terminal 31B of the first comparison circuit 31 and the first comparison output terminal 32A of the second comparison circuit 32. Thus, the high voltage H is outputted from the third switch control unit 83 as the switch signal K. As a result, the third switch 43 is controlled to the connected state. The high voltage H indicating the match between the status signals is outputted from both the two comparison output terminals 33A and 33B of the third comparison circuit 33, so that the high voltage H is outputted from the abnormality output terminal 23A of the third control circuit 23 to the third output line 93. Since the third switch 43 is connected, this high voltage H is supplied to the majority voting circuit 70 through the third output line 93.
As described above, since the three output lines 91, 92, 93, supply the high voltage H to the majority voting circuit 70, the majority voting circuit 70 outputs the high voltage H as the final output signal F. Consequently, the control signal P outputted by the control circuit is enabled, and the first hydraulic circuit 320 is controlled based on the control signal P. That is, the first actuator 300 is in the active mode.
(B) Circuit Operation when the First Controller 11 Fails
It is assumed that the first controller 11 fails from the state where the three controllers 11, 12, and 13 operate normally. In this case, since the first controller 11 is out of order, the output signal T outputted from the abnormality output terminal 21A of the first control circuit 21 cannot be defined, and the output signal T may have the low voltage L or high voltage H as shown in
Since the first controller 11 is out of order, the second status signal N2 and the third status signal N3 match with each other while the first status signal N1 does not match them. Thus, to the first switch control unit 81, the low voltage L indicating mismatch between the second status signal N2 and the first status signal N1 is inputted from the second comparison output terminal 32B of the second comparison circuit 32, and the low voltage L indicating mismatch between the third status signal N3 and the first status signal N1 is inputted from the second comparison output terminal 33B of the third comparison circuit 33. Since both of the two comparison signals C inputted to the first switch control unit 81 have the low voltage L, the switch signal K output from the first switch control unit 81 has the low voltage L. Therefore, the first switch 41 is controlled to the disconnected state. In this case, the low voltage L is supplied to the first output line 91 from the first pull-down resistor 51. Then, the first latch circuit 61 latches the low voltage L and continues to output the low voltage L. Consequently, the low voltage L is inputted to the majority voting circuit 70 from the first output line 91.
To the second switch control unit 82, the low voltage L or the high voltage H is inputted from the first comparison output terminal 31A of the failed first comparison circuit 31, and the high voltage H indicating the match between the third status signal N3 and the second status signal N2 is inputted from the first comparison output terminal 33A of the third comparison circuit 33. Since the high voltage H is inputted to the second switch control unit 82 at least from the first comparison output terminal 33A of the third comparison circuit 33, the switch signal K outputted from the second switch control unit 82 has the high voltage H. As a result, the second switch 42 is controlled to the connected state. Here, the high voltage H indicating the match between the second status signal N2 and the third status signal N3 is outputted from the first comparison output terminal 32A of the second comparison circuit 32, and the low voltage L indicating the mismatch between the second status signal N2 and the first status signal N1 is outputted from the second comparison output terminal 32B. Accordingly at least one of the comparison output terminals of the second comparison circuit 32 outputs the high voltage H, so that the high voltage H is outputted to the second output line 92 from the abnormality output terminal 22A of the second control circuit 22. Since the second switch 42 is connected at this time, this high voltage H is supplied to the majority voting circuit 70 through the second output line 92.
To the third switch control unit 83, the low voltage L or the high voltage H is inputted from the second comparison output terminal 31B of the failed first comparison circuit 31, and the high voltage H indicating the match between the second status signal N2 and the third status signal N3 is inputted from the first comparison output terminal 32A of the second comparison circuit 32. Since the high voltage H is inputted to the third switch control unit 83 at least from the first comparison output terminal 32A of the second comparison circuit 32, the switch signal K outputted from the third switch control unit 83 has the high voltage H. As a result, the third switch 43 is controlled to the connected state. Here, the high voltage H indicating the match between the third status signal N3 and the second status signal N2 is outputted from the first comparison output terminal 33A of the third comparison circuit 33, and the low voltage L indicating the mismatch between the third status signal N3 and the first status signal N1 is outputted from the second comparison output terminal 33B. Accordingly, similar to the abnormality output terminal 22A of the second control circuit 22, the high voltage H is outputted to the third output line 93 from the abnormality output terminal 23A of the third control circuit 23. Since the third switch 43 is connected at this time, this high voltage H is supplied to the majority voting circuit 70 through the third output line 93.
As described above, the low voltage L is inputted to the majority voting circuit 70 from the first output line 91 while the second output line 92 and the third output line 93 input the high voltage H to the majority voting circuit 70. Thus, the majority voting circuit 70 outputs the high voltage H as the final output signal F. Consequently, the control signal P outputted by the normal second control circuit 22 and the normal third control circuit 23 are enabled, and the first hydraulic circuit 320 is controlled based on the control signal P.
(C) Circuit Operation when the First Controller 11 and the Second Controller 12 Fail
It is assumed that the second controller 12 further fails from the state where the first controller 11 has failed. In this case, not only in the first controller 11 but also in the second controller 12, the output signal T outputted from the abnormality output terminal 22A of the second control circuit 22 is indefinite as shown in
Since both the first controller 11 and the second controller 12 are out of order, the third status signal N3 does not match with the first status signal N1 and the second status signal N2. Thus, to the first switch control unit 81, the low voltage L or the high voltage H is inputted from the second comparison output terminal 32B of the failed second comparison circuit 32, and the low voltage L indicating the mismatch between the third status signal N3 and the first status signal N1 is inputted from the second comparison output terminal 33B of the third comparison circuit 33. The switch signal K from the first switch control unit 81 can have either the low voltage L or the high voltage H depending on the output from the second comparison output terminal 32B of the second comparison circuit 32, so that the first switch 41 can be in the connected state or the disconnected state. However, in either case, since the low voltage L is latched by the first latch circuit 61 at the time of failure of the first controller 11 described in the above (B), the low voltage L is supplied to the majority decision circuit 70 from the first output line 91.
To the second switch control unit 82, the low voltage L or the high voltage H is inputted from the first comparison output terminal 31A of the failed first comparison circuit 31, and the low voltage L indicating the mismatch between the third status signal N3 and the second status signal N2 is inputted from the first comparison output terminal 33A of the third comparison circuit 33. In this case, the switch signal K from the second switch control unit 82 can have either the low voltage L or the high voltage H depending on the output from the first comparison output terminal 31A of the first comparison circuit 31. Thus, the second switch 41 can be in the connected state or the disconnected state. When the second switch 42 is controlled to the disconnected state, the low voltage L is supplied to the second output line 92 from the second pull-down resistor 52, and the second latch circuit 62 latches the low voltage L. Consequently, the low voltage L is inputted to the majority voting circuit 70 from the second output line 92. When the second switch 42 is controlled to the connected state, the low voltage L or the high voltage H is outputted from the abnormality output terminal 22A of the failed second control circuit 22, so that the low voltage L or the high voltage H is inputted to the majority voting circuit 70 from the second output line 92. As discussed above, the signal inputted from the second output line 92 to the majority voting circuit 70 is indefinite.
To the third switch control unit 83, the low voltage L or the high voltage H is inputted from the second comparison output terminal 31B of the failed first comparison circuit 31, and the low voltage L or the high voltage H is inputted from the first comparison output terminal 32A of the failed second comparison circuit 32. In this case, the switch signal K from the third switch control unit 83 can have either the low voltage L or the high voltage H. Thus, the third switch 43 can be in the connected state or the disconnected state. Here, the case where the third switch 43 is controlled to the connected state is considered. The first comparison output terminal 33A of the third comparison circuit 33 outputs the low voltage L indicating the mismatch between the third status signal N3 and the second status signal N2, the second comparison output terminal 33B also outputs the low voltage L indicating the mismatch between the first status signal N1 and the third status signal N3, so that the low voltage L is outputted to the third output line 93 from the abnormality output terminal 23A of the third control circuit 23. Since the third switch 43 is connected, this low voltage L is supplied to the majority voting circuit 70 through the third output line 93. Next, the case where the third switch 43 is controlled to the disconnected state is considered. In this case, the low voltage L is supplied to the third output line 93 from the third pull-down resistor 53, and the third latch circuit 63 latches the low voltage L. Consequently, the low voltage L is inputted to the majority voting circuit 70 from the third output line 93. As described above, the low voltage L is inputted to the majority voting circuit 70 from the third output line 93 regardless of whether the third switch 43 is in the connected state or in the disconnected state.
As described above, the low voltage L is inputted to the majority voting circuit 70 from the first output line 91 and the third output line 93 while the second output line 92 inputs the low voltage L or the high voltage H to the majority voting circuit 70. Thus, the majority voting circuit 70 outputs the low voltage L as the final output signal F. Consequently, the control signal P outputted by the normal third control circuit 23 is disabled. Accordingly, in the first hydraulic circuit 320, the mode switching valve 550 is switched to the bypass mode. That is, the first actuator 300 enters the standby mode.
Advantageous effects of the embodiment will be now described.
(1) The status signal of the failed controller does not match the status signal of the normal controller. Utilizing this characteristic, the switch control unit determines that the own controller, which is the controller for the output line provided with the switch that the switch control unit controls, is out of order and disconnects the switch when both the two comparison signals C inputted from the comparison circuits other than the own controller show the mismatch. Then, the control unit supplies the low voltage L to the disconnected output line via the pull-down resistor and the latch circuit. By disconnecting the output line of the failed controller and forcibly supplying the low voltage L thereto, if two controllers fail, the low voltage is transmitted to the majority voting circuit from the corresponding two output lines and the final output signal F assuredly becomes the low voltage L. Thereby, the first actuator 300 can be reliably switched to the standby mode when the two controllers fail. In this way, when two controllers fail, a reliable output can be obtained as the final output signal.
Moreover, the first redundancy control device 350 is formed by combinations of simple analog circuits such as the switch control units which are the OR circuits, the pull-down resistors, and the latch circuits. Since such analog circuits are less likely to fail, the failure rate of the first redundancy control device 350 can be reduced.
(2) Only the first actuator 300 is controlled to operate in the active mode during normal operation. Thus, if the two controllers in the first redundancy control device 350 fail, the first actuator 300 is switched to the standby mode, and the second actuator 400 is switched to the active mode, the number of actuators that drive the flap 600 remains the same before and after the switching so that the driving force for driving the flap 600 does not change. With such a configuration, it is not necessary to control the driving force for the other flaps and moving surfaces in accordance with the switching of the first actuator 300 to the standby mode.
The above embodiment can be modified as described below. The above embodiment and the following modifications can be implemented in combination to the extent where they are technically consistent with each other.
Further, when the comparison signals CV as described above are adopted, output signals TV outputted from the control circuit 21, 22, 23 may be changed as follows. When at least one of the comparison signals CV outputted from the two comparison output terminals of the comparison circuit has the low voltage L indicating the match between the status signals, the high voltage H is outputted as the output signal TV. Further, when both of the comparison signals CV outputted from the two comparison output terminals of the comparison circuit have the high voltage H indicating the mismatch between the status signals, the low voltage L is outputted as the output signal TV. With this configuration, the low voltage L or high voltage H is outputted as the output signal TV under the same conditions as in the above embodiment in terms of the match or mismatch between the status signals. Therefore, the handling of the final output signal FV will be the same as in the above embodiment. That is, the control signal P may be enabled when the final output signal FV has the high voltage H, and the control signal P may be disabled when the final output signal FV has the low voltage L.
In the case where the setting of the output signal TL is modified as described above, when a signal indicating an abnormality related to the aircraft's flight is supplied to each control circuit 21, 22, 23 as the command signal S from the upper-level device 700, the high voltage H may be forcibly outputted from the respective abnormality output terminals. Further, when a signal instructing the shutdown of the first redundancy control device 350 is inputted to each of the control circuits 21, 22, 23, the high voltage H may be forcibly outputted from the respective abnormality output terminals. Further, when a signal instructing the activation of the first redundancy control device 350 is inputted to each of the control circuits 21, 22, 23, the low voltage L may be forcibly outputted as the output signal T from the respective abnormality output terminals.
When the comparison signal CV and the output signal TY are modified as described above, the circuit may be configured as a combination of the above two modification examples as shown in
Further, the pull-up resistors 54, 55, 56 are connected in the respective output lines 91, 92, 93 on the majority voting circuit 70 side of the switches as shown in
The comparison circuits 31, 32, 33 may transmit and receive the respective status signals at different timings.
| Number | Date | Country | Kind |
|---|---|---|---|
| JP2020-039939 | Mar 2020 | JP | national |
| Number | Name | Date | Kind |
|---|---|---|---|
| 20050162185 | Satsukawa | Jul 2005 | A1 |
| 20180340554 | Hutchison | Nov 2018 | A1 |
| 20190004515 | Matsui | Jan 2019 | A1 |
| Number | Date | Country |
|---|---|---|
| H01-98034 | Apr 1989 | JP |
| Number | Date | Country | |
|---|---|---|---|
| 20210281265 A1 | Sep 2021 | US |
