Virtualized aircraft control architecture and associated method
A virtualized aircraft control architecture comprises a human-machine interface configured for generating a main command for arranging a functional element into a target configuration among a plurality of configurations; and a control module for controlling the functional element between its configurations. The architecture comprises a confirmation module of the main command configured for generating an associated safety command, an interface module configured for sending the main command and the safety command to the control module; the control module moving the functional element into the target configuration when the main command and the safety command, respectively, correspond to an expected main command and an expected safety command for arranging the at least one functional element in the target configuration.
1 . A control architecture for controlling at least one functional element of an aircraft, the at least one functional element being arrangeable in a plurality of configurations, the at least one functional element being controllable by an operator for maintaining integrity of the aircraft or safety of passengers in the aircraft during flight, the control architecture comprising:
at least one human-machine interface comprising a display and a display management unit for managing the display, the display management unit being configured for generating a main command in response to an action of the operator on a screen of the display or an audio input peripheral aiming to arrange the at least one functional element in a target configuration;
at least one control module for controlling the at least one functional element to arrange the at least one functional element in the plurality of configurations thereof;
at least one interface module configured for sending the main command to the at least one control module; and
at least one main command confirmation module configured for generating a safety command associated with the main command,
the at least one interface module being configured for sending the safety command to the at least one control module,
the at least one control module determining that the main command generated in response to the action of the operator is not corrupt and arranging the at least one functional element in the target configuration specified by the main command when the main command corresponds to an expected main command for arranging the at least one functional element into the target configuration and when the safety command corresponds to an expected safety command for arranging the at least one functional element in the target configuration.
2 . The control architecture according to claim 1 , wherein the main command comprises a main byte, the expected main command comprises an expected main byte, the safety command comprises a safety byte, and the expected safety command comprises an expected safety byte,
the main byte and the expected main byte comprising N bits respectively, the safety byte and the expected safety byte comprising M bits respectively,
N and M being integers greater than 8.
3 . The control architecture according to claim 2 , wherein N and M are equal to each other.
4 . The control architecture according to claim 2 , wherein N and M are equal to 16 respectively.
5 . The control architecture according to claim 2 , wherein:
at least K bits are distinct between the expected main byte and the expected safety byte;
at least K bits are distinct between the expected main byte corresponding to the arranging of the at least one functional element into the target configuration and any expected main byte corresponding to an alternative command differing from the arranging of the at least one functional element into the target configuration;
at least K bits are distinct between the expected safety byte corresponding to the arranging of the at least one functional element into the target configuration and any expected safety byte corresponding to an alternative command differing from the arranging of the at least one functional element into the target configuration,
K being an integer less than or equal to a minimum between N and M.
6 . The control architecture according to claim 5 , wherein K is greater than or equal to 4.
7 . The control architecture of according to claim 1 , wherein the display management unit is configured for simultaneously sending the main command to the at least one interface module and to the at least one command confirmation module, the at least one interface module being configured, upon receiving the main command, for sending the main command to the at least one control module, the at least one command confirmation module generating the safety command after a delay starting when the at least one command confirmation module receives the main command.
8 . The control architecture according to claim 7 , wherein the at least one control module is configured for successively receiving a first command and a second command, the at least one control module comprising:
a main memory field configured for storing the first command;
a safety memory field configured for storing the second command;
a verification unit generating an authorization to arrange the at least one functional element into the target configuration when simultaneously the first command stored in the main memory field corresponds to the expected main command corresponding to the arranging of the at least one functional element into the target configuration and the second command stored in the safety memory field corresponds to the expected safety command corresponding to the arranging of the at least one functional element into the target configuration, the verification unit being configured for sending the authorization to arrange the at least one functional element into the target configuration to a control unit; and
the control unit, arranging the at least one functional element into the target configuration when the control unit receives the authorization to arrange the at least one functional element into the target configuration.
9 . The control architecture according to claim 1 , wherein the at least one command confirmation module is configured, upon receipt of the main command, to generate a confirmation request for confirming the main command, the display management unit being configured to display the confirmation request on the display to the operator.
10 . The control architecture according to claim 9 , wherein the confirmation request comprises a character string associated with the main command.
11 . The control architecture according to claim 9 , further comprising at least one confirmation device independent of the at least one human-machine interface and adapted to be actuated by the operator to confirm the main command when the confirmation request corresponds to a request for confirmation of arranging of the at least one functional element into the target configuration, the at least one command confirmation module generating the safety command when the at least one confirmation device is actuated to confirm the main command.
12 . The control architecture according to claim 11 , wherein the at least one confirmation device is configured to generate a confirmation when actuated to confirm the main command, the control architecture further comprising at least one auxiliary interface module configured to transmit the confirmation to the at least one command confirmation module.
13 . The control architecture according to claim 12 , wherein the confirmation comprises a single confirmation bit.
14 . The control architecture according to claim 1 , wherein the at least one control module is configured for generating information representative of a current configuration of the at least one functional element, the display management unit being configured to display said information intended for the operator, on the display.
15 . The control architecture according to claim 1 , wherein the at least one functional element is a fuel transfer device for transferring fuel between a first fuel tank of the aircraft and a second fuel tank of the aircraft, the fuel transfer device being adapted to be arranged in a configuration in which it prevents the transfer of fuel between the first tank and the second tank of the aircraft, a configuration in which it allows the transfer of fuel from the first tank to the second tank of the aircraft and a configuration in which it allows the transfer of fuel from the second tank to the first tank of the aircraft.
16 . The control architecture according to claim 15 , wherein the control module comprises a mechanical or electromechanical component able to open or close at least one valve of the fuel transfer device authorizing the transfer of fuel from the first fuel tank to the second fuel tank, from the second fuel tank to the first fuel tank, or preventing the transfer of fuel between the first and second fuel tanks.
17 . A control method for controlling at least one functional element of an aircraft, which can be arranged in a plurality of configurations using the control architecture according to claim 1 , the method comprising:
generating the main command according to an action of an operator aiming to arrange the at least one functional element in the target configuration;
sending the main command to the at least one control module and to the at least one command confirmation module;
generating by the at least one command confirmation module of the safety command associated with the main command;
sending the safety command to the at least one control module;
arranging the at least one functional element into the target configuration when the main command corresponds to the expected main command for arranging the at least one functional element into the target configuration and when the safety command corresponds to the expected safety command for arranging of the at least one functional element into the target configuration.
18 . The control method according to claim 17 , wherein the display management unit simultaneously transmits the main command to the at least one interface module and to the at least one command confirmation module, the at least one interface module transmitting the main command to the at least one control module upon receipt of the main command, the at least one command confirmation module generating the safety command after a delay starting when the at least one command confirmation module receives the main command.
19 . The control method according to claim 17 , wherein upon receipt of the main command, the at least one command confirmation module generates a confirmation request for confirming the main command, the display management unit displaying the confirmation request on the display to the operator.
20 . The control method according to claim 19 , wherein the operator actuates at least one confirmation device independent of the at least one human-machine interface to confirm the main command when the confirmation request corresponds to a request to confirm arranging the at least one functional element into the target configuration, the at least one command confirmation module generating the safety command when the at least one confirmation device is actuated to confirm the main command.