GB2105492A - A duplicated computer control system - Google Patents

Abstract

A control system for a gas turbine engine 10 comprises a first digital computer 16 responsive to operating conditions T1, P1, P2, NH, NL, G of the engine 10, and a second computer 62 responsive to a selection of these conditions. An analog monitoring circuit 22 is also responsive to selected operating conditions to generate signals which correspond to control signals from the computer 16 and which lie within acceptable ranges of values. The circuit 22 supplies the engine 10 only with those signals which are with the acceptable ranges. A switch arrangement 71, 72, 75 is operable, in response to predetermined differences between the signals generated in the circuit 22 and the corresponding signals from the computer 16, to isolate the engine 10 from the computer 16 and to place the computer 62 in control. <IMAGE>

Description

SPECIFICATION Control system primarily responsive to signals from digital computers This invention relates to control systems in which control is primarily or wholly effected by signals from digital computers. Such systems are commonly referred to as "full authority" digital control systems. In such control systems the control activity is commonly regulated by a digital computer which is itself responsive to sensed and/or desired operating conditions of an apparatus to be controlled. The number of these operating conditions may be large, and each of the individual conditions may fall within substantial ranges of values. The combinations and sequences of the operating values will then be very large indeed, so that it will not be possible to test the system over the whole of the combined operating conditions which it may encounter in use.The problem is increased by the relative ease with which a digital control system may be reprogrammed, so that extensive tests which may have been carried out with the system under control of a superseded programme will no longer be valid.

In ability to predict the response of a full authority system under all operating conditions has lead to reluctance on the part of authorities connected with airworthiness to approve such system for use in an aircraft, particularly since an inappropriate response of the system to a combination of conditions, resulting for example from a programming fault, will not occur randomly but may, in that combination of conditions, cause malfunction of all apparatus controlled by the digital computer. It will be apparent moreover, that duplication of identically programmed processors will not overcome this problem, since each malfunction simultaneously and in the same way. The present invention provides a full authority digital control system in which the foregoing problems are overcome.

According to the invention there is provided a full authority digital control system comprising an apparatus responsive to electrical input signals, a first, digital, computer responsive to a plurality of operating conditions of said apparatus for generating first digital control signals, a second computer responsive to at least some of said operating conditions for generating second control signals, means for deriving said input signals from said first or said second control signals, a monitoring circuit responsive to at least some of said operating conditions and to said first control signals for determining acceptable values of said first control signals and for causing said input signals to be derived only from those of said first control signals whose values lie within the range of said acceptable values, and switching means operable in one of its states to cause said input signals to be derived from said first control signals, and including means responsive to a predetermined difference between any of said first control signals and its corresponding acceptable value, for isolating said apparatus from said first control signals and for causing said input signals to be derived from said second control signals.

An embodiment of the invention will now be described by way of example only, and with reference to the accompanying drawings in which~ Figure 1 is a block diagram of a full authority digital control system applied to a gas turbine, and Figure 2 is a diagram of a monitoring circuit forming part of the system of Figure 1.

A gas turbine engine 10 is responsive to analog electrical input signals on a plurality of lines 11, these signals corresponding to the required position of a fuel metering valve in the engine 10 and to requirements for variation of the engine geometry, such as the operating position of compressor guide vanes. Sensed conditions of the engine 10, for example the aforesaid engine geometry, G the speeds NH, NL of high pressure and low pressure shafts, compressor pressure P1, P2 and engine intake temperature T1 are supplied on a plurality of lines 12. The signals on the lines 12 from the engine are combined with a signal 0 corresponding to the operating position of an engine speed selector device 13, to provide analog engine operating condition signals on lines 14.The signals on lines 14 are supplied to a conditioning circuit 15 one of whose functions is to convert the analog signals on the lines 14 to digital signals for supply to a first digital computing arrangement 16. The computing arrangement 16 comprises two identical digital computers of the type available under the designation Z8002 from ZILOG Inc., of Cupertino, California, U.S.A. The two computers are each responsive to signals from the circuit 15 and are connected for bit-by-bit checking of their outputs, in a manner described in UK patent 2019622. In the event that a difference between the outputs of the computers in the arrangement 16 persists for more than a predetermined time a signal is provided on a line 17 to a switching arrangement, later to be described.The output from one of the computers in the arrangement 16 is provided on lines 18 to a digital to analog converter 19 and thence on lines 20, 21 to a monitoring circuit 22.

The circuit 22 is responsive to the operating signals on the lines 12 and provides analog control signals on lines 23, 24 in response to the signals on lines 12 and 20, 21. Drive circuits 25 are responsive to the signals on the lines 23, 24 to provide the input signals on the lines 11 to the engine 10.

As shown in Figure 2, the circuit 22 is responsive to the speed NH of the engine high pressure shaft, to the pressure P1 and temperature T1 at the engine air intake and the position 0 of the engine speed selector 13. The circuit 22 is also responsive to analog signals on the lines 20,21 these signals corresponding respectively to desired fuel flow F and to the required angular positions g of the engine inlet guide vanes. An analog function generating circuit 30 is responsive to the speed signal NH and provides on a line 31, a signal corresponding to the required inlet guide vane position, and this signal is applied, together with the required position signal G on the line 21, to a lowest-wins circuit 32, so that the signal on line 24 cannot exceed that generated by the circuit 30.The signals on lines 21,31 are also applied to a comparator 33 which provides a signal on a line 34 to one input of an OR gate 35 if a difference between the signals on lines 21, 31 exceed a predetermined value.

The NH signal is also applied to a further function generating circuit 36 which provides an analog output signal on a line 37, this signal having the characteristic indicated in the element 36 and providing an upper limit of required fuel flow F for values of the speed NH. It will be noted that the value of F decreases sharply at a predetermined value of NH, and the signal on line 37 thus specifies fuel flow which sets an upper limit on the speed NH.

A further analog circuit 40 is responsive to the signal 6 to generate a signal corresponding to F/P1#, which has the characteristic 41 indicated by the solid line curve in the element 40. The characteristic 40 corresponds to a steady-running value of fuel flow. Above and below the characteristic 41 are curves representing permissible maximum and minimum boundaries of fuel flow for acceleration and deceleration respectively. If it is convenient to consider the acceleration curve as having a constant value AF1 above the curve 41, and the deceleration curve as having a constant value åF2 below the curve 41.

A circuit 42 generates, on a line 43, a signal corresponding to the square root of the value T1.

The signal from the circuit 40 is applied, together with the signal on line 43, to a multiplying circuit 44 and the resulting product is multiplied by the P1 signal in a further multiplying circuit 45. The resulting signal on line 46 corresponds to the desired fuel flow F for steady running of the engine 10 and for a given setting 6. A constant value, corresponding to the aforesaid acceleration increment AF1, is added by means of a circuit 47 and the sum is applied on a line 48 to a lowestwins circuit 49. The fuel demand signals on lines 20 and 37 are also applied to the lowest wins circuit 49. The fuel demand signal on a line 50 from the circuit 49 thus cannot exceed the value set by the acceleration curve indicated in circuit 40, or the NH limiting value set by the circuit 36, whichever is the lower.The signals on lines 20, 48 are supplied to a comparator 51 which provides a signal on a line 52 to the OR gate 35 if the difference between the signals on lines 20, 48 exceeds a predetermined level.

A subtracting circuit 53 is responsive to the signal on line 46 and to a constant value which corresponds to the aforesaid deceleration decrement AF2. The output signal from the circuit 53 is applied on a line 54 to a highest wins circuit 55 to which the signal on line 50 is also applied.

The output signal on line 23 from the circuit 55 thus cannot be less than the value set by the deceleration curve shown in circuit 40. The combined effect of the circuits 49, 55 and of their input signals is that the fuel demand signal on line 23 will lie between the acceleration and deceleration boundaries indicated in the circuit element 40, subject to the speed restriction imposed by the circuit 36, even if the signals from the computer arrangement 16 correspond to a fuel demand which is outside the aforesaid boundaries.

The signals on lines 50, 54 are supplied to a comparator 56 which provides an output signal to the OR gate 35 if a difference between the signals on lines 50, 54 exceeds a predetermined level.

The output of the OR gate 35 is connected to one input of an AND gate 57 and also to the trigger connection of a monostable circuit 58 whose output is connected to the other input of the AND gate 57.

The monostabie circuit provides an output signal which is delayed by a predetermined amount from the onset of the signal from the OR gate 35. The AND gate 57 will thus provide an output signal on a line 59 only when a predetermined difference between the input signals to any of the circuits 32, 49, 55 has persisted for the delay time of the monostable circuit 58.

Selected ones of the signals on lines 14 are supplied by lines 60 to a further conditioning circuit 61 which provides digital input signals to a self-monitoring digital computer 62 which is of the type available under the designation 9900 from Texas Instruments. The selected signals on the lines 60 are the minimum necessary to enable the computer 62 to effect safe control of the engine 10, even though this control may not provide optimum operating conditions. Digital output signals from the computer 62 are provided on lines 63 to a digital to analogue converter 64 and can be supplied from the converter 64 on lines 65 to a drive circuit 66, corresponding generally to the drive circuit 25. The drive circuit 66 can thus provide, on lines 67, control signals for the engine 10. The lines 67 are connected to those of the lines 11 which in normal use carry corresponding signals.

Switch devices 71, 72 are responsive to signals on respective lines 73, 74 from a bistable circuit 75. Switch device 71 controls application of the signals on lines 23, 24 to the drive circuit 25. Switch device 72 controls application of the signals on lines 65 to the drive circuit 66. In its first, normal state the bistable circuit 75 supplies a signal on line 71 to enable the switch device 71 to pass the signals on lines 23, 24. In this state of the circuit 75 the switch device 72 is not enabled.

The circuit 75 changes state in response to a signal on either of the lines 1 7, 59, thereby disenabling the switch device 71 and enabling the switch device 72. Thus, in response to malfunction of the computer arrangement 1 7 or detection by the monitoring circuit 22 of a predetermined and persisting discrepancy between the control signals, control of the engine 10 is shifted to the computer 62.

In a preferred embodiment the circuits 30, 36 (Figure 2) are arranged to generate signals whose limiting values are somewhat higher than those of the corresponding signals on lines 20, 21, and thereby to ensure that an error signal is not inadvertently transmitted on the line 59. Similarly the values of åF1 and åF2 are arranged to set limits to the acceleration and deceleration boundaries which are respectively slightly higher and lower than those for which the computers in the arrangement 16 will generate, for a corresponding engine operation condition.

Claims (6)

Claims

1. A full authority digital control system comprising an apparatus responsive to electrical input signals, a first, digital, computer responsive to a plurality of operating conditions of said apparatus for generating first digital control signal, a second computer responsive to at least some of said operating conditions for generating second control signals, means for deriving said input signals from said first or said second control signals, a monitoring circuit responsive to at least some of said operating conditions and to said first control signals for determining acceptable values of said first control signals, and for causing said input signals to be derived only from those of said first control signals whose values lie within the range of said acceptable values, and switching means operable in one of its states to cause said input signals to be derived from said first control signals, and including means responsive to a predetermined difference between any of said first control signals and its corresponding acceptable value, for isolating said apparatus from said first control signals and for causing said input signals to be derived from said second control signals.

2. A system as claimed in claim 1, in which said monitoring circuit comprises a plurality of means for generating first analog signals which are functions of selected operating conditions and which lie within predetermined ranges of corresponding ones of said first control signals, and a plurality of discriminator circuits each of which is responsive to one of said first analog signals and to a signal derived from a corresponding one of said first control signals, each said discriminator circuit being operable to derive respective one of said input signals from whichever of its analog and control signals has the greater difference from a predetermined limiting value.

3. A system as claimed in Claim 2 in which said monitoring circuit includes means for generating a second analog signal corresponding to a predetermined upper limit of one of said input signals, one of said discriminator circuits being responsive to said second analog signal, to an upper limiting value of one of said first analog signals and to a corresponding one of said first control signals, said one discriminator circuit including means for providing an output signal corresponding to the lowest of the three signals to which it is responsive.

4. A system as claimed in any one of claims 1 to 3, in which said first computer comprises two digital computing devices and means for comparing the output signals from said devices on a bit-by-bit basis.

5. A system as claimed in any one of the preceding claims in which said second computer is a digital computer.

6. A full authority digital control system substantially as hereinbefore described with reference to the accompanying drawings.