Device and method for automatically generating a control order for an aircraft control surface

1. A device for automatically generating a control order of at least one control surface of an aircraft, said device comprising:

at least one sensor for generating at least one control order;

a bus for issuing such a control order to a user;

a monitoring unit for monitoring the control order generated by said at least one sensor, so as to check whether it has a correct value or a wrong value, a wrong value representing a suspected deficiency, and should such a suspected deficiency be detected, in order to check whether said control order has a wrong value during a predetermined confirmation time, so as to confirm the deficiency; and

an inhibitor or inhibiting the control order issue when a deficiency is confirmed,

characterized in that it further comprises:

a determining unit for determining, as soon as a suspected deficiency is detected, an auxiliary control order, summing the latest generated control order before such a detection and a predetermined order value illustrating a tolerated error margin; and

a transmitter for automatically transmitting to said bus, with a view to its issue as a control order:

said control order generated by said at least one sensor, in the absence of a deficiency and a suspected deficiency; and

said auxiliary control order determined by said determining unit, as soon as a suspected deficiency is detected, and this, until the end of said confirmation time, from which:

if the deficiency is confirmed, the issue of the control order is inhibited;

otherwise, said control order generated by said at least one sensor is issued again.

2. A device according to claim 1 , characterized in that it comprises two computing units, each of which generates a control order, one of said computing units comprising said at least one sensor, and said monitoring unit intended to monitor the control order generated by the at least one sensor, are formed so as to simultaneously use the control orders generated by such two computing units.

3. A device according to claim 1 , characterized in that said monitoring unit comprise at least one monitoring unit being integrated into one of said computing units and comprising:

a computing element calculating the difference between the control orders generated by said two computing units;

a comparison element comparing the difference calculated by said computing element to a predetermined value representing said tolerated error margin, a suspected deficiency being detected as soon as said difference is higher than said predetermined value; and

a confirmation element for checking, as soon as such a suspected deficiency is detected, whether said difference remains higher than said predetermined value during said confirmation time, in order to confirm the deficiency.

4. A device according to claim 3 , characterized in that it comprises two monitoring units, one of which is integrated into one of said computing units and the other one is integrated into the other computing unit.

5. A device according to claim 1 , characterized in that said determining unit and the transmitter are part of a computing assembly comprising:

a first element for determining an intermediary order, from control orders generated by two computing units;

a second element for adding said tolerated error margin to said intermediary order;

a third element for subtracting said tolerated error margin from said intermediary order; and

a voter receiving the values determined by said first, second and third elements, selecting the median value of the thus received values, and transmitting the selected median value to said bus so as to issue it as a control order.

6. A device according to claim 5 , characterized in that said first element is formed so as to determine as an intermediary value:

in the absence of detection of a suspected deficiency and in the absence of a deficiency, the most delayed control order of both control orders generated by said two computing units; and

should a suspected deficiency be detected, the last generated control order before such a detection.

7. A device according to claim 1 , characterized in that it further comprises an auxiliary monitoring unit being integrated into one of said computing units and comprising:

a computing element calculating the difference between control orders respectively issued by said two computing units;

a comparison element comparing the difference calculated by said computing element to a predetermined auxiliary value; and

a confirmation element for checking, as soon as said difference is higher than said predetermined auxiliary value, whether it remains so for an auxiliary confirmation time.

8. A system for automatically controlling at least one aircraft control surface, characterized in that it comprises:

at least one actuator of said control surface being able to automatically move the latter;

one device such as that specified in any of claims 1 to 7 , for automatically generating a control order, and for automatically issuing such a control order to slaving unit; and

said slaving unit automatically applying such a control order to said actuator of the control surface.

9. A method for automatically generating a control order of at least one aircraft control surface, wherein: A/ at least one control order is generated; and B/ such a control order is issued to a user, wherein, in addition, the following operations are performed:

said control order generated in step A/ is monitored, in order to check whether it has a correct value or a wrong value, a wrong value representing a suspected deficiency, and if such a suspected deficiency is detected, in order to check whether said control order has a wrong value during a predetermined confirmation time, in order to confirm the deficiency; and

when a deficiency is confirmed, issuing said control order of step B/ is inhibited,

characterized in that furthermore, the following operations are performed:

as soon as a suspected deficiency is detected, an auxiliary control order is determined, summing the last generated control order before such a detection and a predetermined order value illustrating a tolerated error margin; and

in step B/, there is issued to the user, as a control order:

said control order generated in step A/, in the absence of a deficiency and a suspected deficiency; and

said auxiliary control order as soon as a suspected deficiency is detected, and this, until the end of said confirmation time, from which:

if the deficiency is confirmed, the issue of the control order is inhibited;

otherwise, said control order generated in step A/ is issued again.

10. A method for automatically controlling at least one aircraft control surface, characterized in that:

a control order is automatically generated, implementing a method according to claim 9 ;

such a control order is automatically issued to a slaving unit; and

such a control order is automatically applied to at least one actuator of said control surface, by means of said slaving unit.

11. A device for automatically generating a control order of at least one control surface of an aircraft, said device comprising:

at least one sensor for generating at least one control order;

a bus for issuing such a control order to a user;

a monitoring unit for monitoring the control order generated by said at least one sensor, so as to check whether it has a correct value or a wrong value, a wrong value representing a suspected deficiency, and should such a suspected deficiency be detected, in order to check whether said control order has a wrong value during a predetermined confirmation time, so as to confirm the deficiency; and

an inhibitor for inhibiting the control order issue when a deficiency is confirmed,

characterized in that it further comprises:

a determining unit for determining, as soon as a suspected deficiency is detected, an auxiliary control order, summing the latest generated control order before such a detection and a predetermined order value illustrating a tolerated error margin; and

a transmitter for automatically transmitting to said bus, with a view to it issue as a control order:

said control order generated by said at least one sensor, in the absence of a deficiency and a suspected deficiency;

said auxiliary control order determined by said determining unit, as soon as a suspected deficiency is detected, and this, until the end of said confirmation time, from which:

if the deficiency is confirmed, the issue of the control order is inhibited;

otherwise, said control order generated by said at least one sensor is issued again; and

two computing units, each of which generates a control order, one of said computing units comprising said at least one sensor, and said monitoring unit intended to monitor the control order generated by the at least one sensor, are formed so as to simultaneously use the control orders generated by such two computing units.