DE3906846A1 - Redundant computer arrangement for control systems - Google Patents

Abstract

A plurality of computers are provided which are in redundant arrangement. The computers receive inputs from input-output units, so that the computers can monitor each other, and failed computers can be eliminated. The input-output units (116, 118, 120, 122, 124, 126) are in the form of separate components from the computers. At least some of the input-output units (116, 118, 120, 122, 124, 126) are connected directly to more than one computer (98, 100; 102, 104). One computer (89) is also connected to a plurality of input-output units (116, 118, 120). A high degree of redundancy can thus be achieved with a minimum of hardware cost. <IMAGE>

Description

Technical field

The invention relates to a redundant computer arrangement for control systems containing

• a) a plurality of computers in a redundant arrangement, those with inputs from input-output units are acted upon, by mutual Monitoring the computers failed computers can be eliminated.

Underlying state of the art

Flight control systems become highly reliable demanded. If one component fails, the flight must control system still remain functional. For some Functions of the flight control system necessary for the flightability of the aircraft are vital, that is also required after two or three components fail, the function capability of the flight control system is still guaranteed. For this reason, components are used in such flight tax systems multiply. One speaks of a redundant Arrangement.  

Similar problems also occur with other tax systems on where a failure of the tax system is severe can have serious consequences, for example with robots or at nuclear power plants.

This requirement for functionality after a failure Component also applies to computers in such a Control system can be used. For digitally working However, computers still have a special problem: The computers work on a rather complicated Program. It cannot be ruled out that a such a program has errors that only occur with a whole certain combination of states in appearance to step. It is not possible to be error-free Programs to prove. Testing a program at all conceivable states are as impossible as, for example playing through all possible game progressions Chess game. So if two computers of the same type (Hardware) redundantly provided with the same programs would then be an error caused by an error of the Program is due to both computers at the same time occur. Such an error would be despite redundant Arrangement of the computers can not be noticed.

This problem is solved by having two each other monitoring computers independently of each other, usually with different programming languages and from different programming teams can be programmed. There the operations required on many different Ways are feasible through programs, and so are the different programming languages different Conditional programming is the likelihood of that a software error in both computers at the same time occurs, extremely low. In addition, other pairs of monitoring computers provided by the  aforementioned computers also in the type (hardware) deviate and also independently of these and are programmed from each other.

In the case of known redundant computer arrangements, an input-output unit for each computer. This forms part of the calculator. It is used to store data, e.g. obtained from sensors, process and output data of the computer also prepared accordingly e.g. Actuators to feed. The two Each pair's computers monitor each other. At a Error in one of the computers, if the output data do not match, the entire pair is switched off. There are several such pairs. If one fails Pair is switched to another pair. Example A total of four can be used for a certain function Pairs of computers can be provided. Then at one Failure of a first pair of computers to switch to a second pair, and if the second pair fails, too a switch to a third pair and, if that third pair fails, switching to the fourth and last couple. Such a system "survives" three times falls and still remains functional. A fourth failure would shut down the system. For this function are a total of eight computers with one input each Output unit required.

A determined failure of a computer can be caused by a Defect or error of the actual computer caused or due to a defect in the input-output Unit. This is the case with the known control systems, e.g. Flight control systems, indistinguishable.  

Various functions of the control system different requirements regarding the Reliability posed. Some functions also need after failure of several components, e.g. Calculator, received stay. A lower degree is sufficient for other functions of redundancy. This is the case with a flight control system Flight regulations, including the attitude of the flight attitude and the damping of attitude vibrations as well as the regulation and monitoring the servomotors, a function that is used for the flightability of the aircraft is vital. For this flight regulation must also after three computers fail or computer pairs, as described above, another computer be functional. Other functions like that Flight guidance, i.e. the specification of course, climb or Sink rate, are generally for that Aircraft flightability less vital. they can be taken over by the pilot and need if necessary therefore possibly no redundancy. Usually are but computers for such functions are also redundant available. There is therefore a considerable effort for achieving the required reliability. The increases the space, weight and cost of the Flight control system.

Disclosure of the invention

The invention has for its object in a redundant computer arrangement for control systems of the type defined at the outset for a certain degree of Reliability to reduce effort required.  

According to the invention, this object is achieved in that

• b) the input-output units as from the computers separate components are formed and
• c) at least part of the input-output units are directly connected to more than one computer.

It can then use the input-output units signals obtained either by one or by the other computer are processed. It can an increase in redundancy without increasing the hardware effort can be achieved.

It is also advantageous to have at least one computer connected to several input / output units. Then can the calculator performs the function of the input-output units monitor and failed input-output units switch off.

A particularly advantageous solution is that

• a) at least a first and a second pair of Computers are provided with the same inputs are acted upon by input-output units, if there is a deviation in the expenditure of one and the other calculator of the first pair one Switch to the computers of the second pair he follows,
• b) the two pairs of computers three of the computers separate input-output units are assigned,
• c) each of the input-output units with each of the Computer is connected and  
• d) the computers for detecting and eliminating one Input-output unit are set up whose Signals from those of the other two input Output units differ noticeably.

The input-output units are thus from the computers Cut. This makes it possible to use the three input-output Units simultaneously both the one, initially operational pair of computers as well as the other, to assign standby pair of computers. If one of the input / output units fails the computers can determine by majority observation which of the three input-output units has failed and switch it off. With three input-output units if one of these units is defective, deliver the two others still matching, from the signal of the defective Unit deviating signals. From this, the defective Unit can be recognized. There is a switchover of the computers so not required yet. If the calculator of the first Couple determine a deviation from each other and are switched off, the computers of the second pair put into operation instead.

With such an arrangement the same degree results of security like an arrangement with two pairs of Computers, each of which is an input-output unit having. However, this will be three instead of four Input-output units reached. With an arrangement with a total of four pairs of computers there is one Saving two input / output units.  

Another saving results from the fact that

• a) first calculator for a first function with high Redundancy requirements are provided,
• b) second computer for a function with less Redundancy requirements are provided,
• c) the second computer additionally for the first function are programmed
• d) the second computer also with the input-output Units of the first computers are connected and
• e) at least one if a first computer fails second computer with the first function can be switched on is.

For example, two pairs of first computers can be used be provided for the first function "flight control" are programmed. Likewise, there are two pairs of second Computers provided for the less critical second "Flight guidance" function are programmed. The second But computers are also for the function "Flight control" programmed and also for these purposes applicable. Both functions are therefore dual redundant due to pairs of computers monitoring each other occupied. If a first pair of first computers fails, its function is performed by the second pair of first computers. This pair also falls from first computers, there is a switch to a pair from second computers. This pair of second computers is now operated with the "Flight Control" program. The "flight guidance" is now only with a pair of  Computers occupied. Now there is redundancy of the computers for flight guidance is mandatory in certain cases, for example for a landing approach in the fog. Such However, conditions can generally be avoided. in the Emergency, in the event of failure of the third pair of the second Computers can also use the fourth pair of second computers be used for flight control. The function of the The pilot must then take over flight control by hand.

This type of "dynamic redundancy" is used during the flight control system by allowing the input-output Units are separated from the computers so that different computers, possibly different reasons function with common input-output units can work together.

Two embodiments of the invention are below with reference to the accompanying drawings explained.

Brief description of the drawings

Fig. 1 schematically shows an aircraft having a flight control system, are provided in which computer redundant.

Fig. 2 shows the vertical tail of the aircraft.

Fig. 3 is a block diagram of a flight control system.

Figure 4 is a block diagram of an aircraft flight control system for military applications.

In Fig. 1, 10 denotes an aircraft. The aircraft 10 has a plurality of control surfaces which are adjustable by hydraulic servomotors. Essential control surfaces can be controlled redundantly by several servomotors. With 12 and 14 ailerons are designated. The aileron 12 is adjustable by two servomotors 16 and 18 . The aileron 14 is adjustable by two actuators 20 and 22 . The actuators of each pair 16 , 18 and 20 , 22 are connected to different hydraulic networks, which are identified by the letters "G" (green) and "B" (blue) according to the color of the hydraulic lines used for these networks. This measure is intended to ensure that a servomotor 16 or 18 or 20 or 22 remains functional in the event of a hydraulic network failure.

Spoilers 28 , 30 , 32 , 34 and 36 sit on the wing 24 . Spoilers 38 , 40 , 42 , 44 and 46 sit on the wing 26 . The spoilers are used to brake and support the ailerons when initiating a roll movement. The spoilers are adjustable by actuators 48 , 50 , 52 , 54 and 56 or 58, 60, 62, 64 and 66 . The servomotors are again connected to various hydraulic networks. In addition to the hydraulic networks G and B already mentioned, a third hydraulic network Y ("yellow") is provided.

An aileron 68 on the vertical tail 70 is controlled three times redundantly by three servomotors 72 , 74 and 76 . The three servomotors 72 , 74 and 76 are fed from the three different hydraulic networks B, G and Y. Elevators 80 and 82 are located on an elevator 78 . The elevator 80 is controlled redundantly by two servomotors 84 and 86 . Actuator 84 is fed from the hydraulic network G. Actuator 86 is fed from the hydraulic network B. The elevator 82 is fed redundantly by two servomotors 88 and 90 . The servomotor 88 is fed from the hydraulic network B. The servomotor 90 is fed from the hydraulic network Y.

A servomotor assembly 92 controls landing flaps 94 and 96 .

The servomotors are operated by computers via input-output Units controlled. The computers are in pairs intended. Two pairs of computers are three each assigned separate input-output units.

A first pair of "first" computers 98 and 100 are programmed for flight control. This includes the actual flight control, i.e. the adjustment of the aircraft to a commanded flight position and the damping of position vibrations. This also includes the control and monitoring of the servomotors. The computer regulates a servomotor in a certain position. The computer also checks whether the servomotor has also assumed a commanded position and switches off a defective servomotor if necessary. The flight control also includes flight control. The computer monitors, for example, whether the aircraft is flying sufficiently above the tear-off speed. After all, one of the tasks of "Flight Control" is "wing load reduction". If, in certain flight conditions, natural vibrations of the wings are excited, which can lead to a critical load on the wings, then such natural vibrations are damped by actuating control surfaces.

A second pair of "first" computers 102 and 104 also serve to control the flight.

A pair of "second" computers 106 and 108 are used for flight guidance ("Flight Guidance Envelope"). These include the autopilot functions, for example the specification of a specific course or a climb or descent angle. Directors ", ie the display of the deviation from a guide beam on landing, whereby this deviation is then corrected manually by the pilot. Finally, flight control includes" envelope control and monitoring, ie the guidance of the aircraft within a spatial "tolerance hose" .

The second computer is also for Function of the flight controller, like the first computers, programmed. You can use this function if necessary be switched and then the function of a failed pair of "first" computers.

Finally, a further pair of "second" computers 110 and 112 are provided.

The computers receive signals from sensors via input / output units and supply output data, for example control commands for the servomotors or information for an operating device 114 in the cockpit of the aircraft, via these input / output units. The computer pairs 98 , 100 and 106 , 108 are assigned three input-output units 116 , 118 and 120 . The computer pairs 102 , 104 and 110 , 112 are assigned three input-output units 122 , 124 and 126 . Each of the input-output units 116 , 118 and 120 is connected to each of the computers 98 , 100 , 106 and 108 . Each of the input-output units 122 , 124 and 126 is connected to each of the computers 102 , 104 , 110 and 112 . Output signals are tapped in parallel by the input / output units 118 and 120 . Output signals are also tapped from the input / output units 124 and 126 . The input-output units 116 and 122 do not provide any output signals.

The computers in each pair, eg 98 and 100 , monitor each other. For this purpose, they are connected to one another, as shown in FIG. 3. If one computer fails so that its output data differs from that of the other computer in the pair, the entire pair of computers is switched off. Another couple takes over. The structure of the computer arrangement is shown in detail in FIG. 3.

To avoid systematic errors caused by program errors also occur due to hardware errors can and because they are on both computers of a pair would occur, could not be discovered proceeded as follows.

Two computer systems are provided for the same functions, namely here for flight control and flight control, which are shown on the left and right of dividing line 128 . These computer systems are designed for the same functions with different hardware. The computers of each pair are built with the same hardware, but different, ie with different programming languages and programmed by different programming teams. For example, the computer 98 is programmed with a program "A" for the function "flight controller" and the computer 100 with a program "B" also for the function "flight controller". The computer 108 is programmed with a program "A" for the "flight control" function and additionally for the "flight controller" function. The computer 106 is also programmed with a program “B” for the “flight guidance” function and additionally for the “flight controller” function. In the same way, with other hardware, the computer 104 is programmed with a program "C" for the "flight control" function. The computer 102 is also programmed with a program "D" for the function "flight control". The computer 112 is programmed with a program "C" for the function "flight guidance" and is additionally switchably programmed for the function "flight controller". Finally, the computer 110 is programmed with a program “D” for the “flight guidance” function and additionally for the “flight control” function. The additional function can be implemented very simply by an additional program module in the computers 108 , 106 , 112 and 110 .

The computers 98 and 100 monitor the input / output units 116 , 118 and 120 on the basis of majority considerations. If one of these units 116 , 118 or 120 fails, its input signals deviate from the input signals of the other two units by more than a predetermined tolerance range. The failed input-output unit is then switched off.

If the pair of computers 98 and 100 determine a discrepancy between the calculation results, the pair of computers 98 and 100 turns off. The function of this pair of computers is then taken over by the pair of computers 102 and 104 . These two computers 102 , 104 also monitor one another. If this pair of computers 102 , 104 fails , if the computers determine deviations in the calculation results, the pair of computers 106 and 108 takes over their function. The computers 106 and 108 are switched over to the "flight control" program. Only a pair of computers are then available for the "flight guidance" function. However, this function is generally not as safety-relevant as the flight control function. As already mentioned above, redundancy of the computers for this function is only required for special flight maneuvers, for example when approaching in the fog. Such flight maneuvers must then be avoided after computers 98 to 104 fail. Should the pair of computers 106 , 108 also fail, its function will be taken over by the pair of computers 110 , 112 again after switching to the "flight control" program. If necessary, the pilot can take over the "flight guidance" function by hand.

In normal operation, the function "flight guidance" by two pairs of mutually monitoring, dissimilar computers occupied.

Fig. 4 shows a flight control system for a combat aircraft.

The flight control system of FIG. 4 contains three computers 130 , 132 and 134 for the function "flight control". The flight control system also contains three computers 136, 138 and 140 for the function “flight guidance and air data” (“flight guidance” and “air data”). Three other computers 142 , 144 and 146 are seen for the function "inertia measuring unit", and two other computers 148 and 150 for the engine control. The computers provided three times for the same function monitor each other by majority considerations, as indicated in FIG. 4.

A separate input-output unit is assigned to each computer: An input-output unit 152 is assigned to the computer 130 . An input-output unit 154 is assigned to the computer 132 . An input-output unit 156 is assigned to the computer 134 . The input-output units 152 , 154 and 156 are connected to the servomotors.

An input-output unit 160 is assigned to the computer 138 . An input-output unit 162 is assigned to the computer 140 . The input-output units 160 and 162 are connected to a bus (MIL - BUS) of the aircraft.

An input-output unit 164 is assigned to the computer 142 . An input-output unit 166 is assigned to the computer 144 . An input / output unit 168 is assigned to the computer 146 . The input-output units 164 , 166 and 168 are connected to gyroscopes and accelerometers.

The computers 148 and 150 are connected to an input / output unit 170 and 172 , respectively. The input-output units 170 and 172 are connected to a fuel plate.

In the arrangement according to FIG. 4, most of the input / output units are connected to the assigned computer. In addition, the computers 136 , 138 , 140 and the computers 142 , 144 , 146 are connected to the input / output units 152 , 154 and 156 . The computers 132 and 134 are connected to the input-output units 160 , 162 . The computers 148 and 150 are also connected to the input / output units.

The input-output unit 158 is on standby in the event that one of the input-output units 152 , 154 or 156 fails. In a manner similar to the arrangement according to FIG. 3, this arrangement also permits "dynamic redundancy", ie the takeover of functions of a failed computer by other computers which are also redundant but perform less security-relevant functions.

Claims (10)

1. Redundant computer arrangement for control systems, containing

• a) a plurality of computers in a redundant arrangement, to which inputs from input / output units are applied, the computers failing due to mutual monitoring of the computers being able to be eliminated,

characterized in that

• b) the input / output units ( 116 , 118 , 120 , 122 , 124 , 126 ) are designed as components separate from the computers and
• c) at least some of the input / output units ( 116 , 118 , 120 , 122 , 124 , 126 ) are directly connected to more than one computer ( 98 , 100 ; 102 , 104 ).

2. Redundant computer arrangement according to claim 1, characterized in that a computer ( 89 ) with a plurality of input-output units ( 116 , 118 , 120 ) is connected. 3. Redundant computer arrangement according to claim 2, characterized in that

• a) at least a first and a second pair of computers ( 98 , 100 ; 106 , 108 ) are provided, which are subjected to the same inputs from input-output units ( 116 , 118 , 120 ), with a deviation of the outputs of the one and the other computers ( 98 , 100 ) of the first pair are switched over to the computers ( 106 , 108 ) of the second pair,
• b) the two pairs of computers ( 98 , 100 ; 106 , 108 ) are assigned three input / output units ( 116 , 118 , 120 ) separate from the computers,
• c) each of the input-output units ( 116 , 118 , 120 ) is connected to each of the computers and
• d) the computers ( 98 , 100 ) are set up to recognize and eliminate an input / output unit ( 116 , 118 , 120 ), the signals of which differ markedly from those of the other two input / output units.

4. Redundant computer arrangement according to claim 1, characterized in that

• a) first computers ( 98 , 100 , 102 , 104 ) are provided for a first function with high redundancy requirements,
• b) second computers ( 106 , 108 ; 110 , 112 ) are provided for a function with lower redundancy requirements,
• c) the second computers ( 106 , 108 ; 110 , 112 ) are additionally programmed for the first function,
• d) the second computers ( 106 , 108 ; 110 , 112 ) are also connected to the input / output units ( 116 , 118 , 120 ; 122 , 124 , 126 ) of the first computers ( 98 , 100 ; 102 , 104 ) and
• e) if a first computer ( 98 , 100 ; 102 , 104 ) fails, at least one second computer ( 106 , 108 ; 110 , 112 ) can be switched on with the first function.

5. Redundant computer arrangement according to claim 4, characterized in that several pairs of first computers ( 98 , 100 ; 102 , 104 ) and several pairs of second computers ( 106 , 108 ; 110 , 112 ) are provided, the computers of each pair check each other and, in the event of deviations from one another, trigger the pair to be switched off. 6. Redundant computer arrangement according to claim 5, characterized characterized in that each pair's calculator under are programmed differently. 7. Redundant computer arrangement according to claim 6, characterized characterized in that for each function pairs of First type computers and pairs of computers a second, of the first dissimilar type are provided. 8. Redundant computer arrangement according to claim 4, characterized characterized that the first function is the flight regulation of an aircraft includes.   9. Redundant computer arrangement according to claim 8, characterized characterized in that the second function is the Flight guidance of the aircraft includes.