Dual bus and hardwire architecture for high reliability control of helicopter hoist

1. A control system for a mission-critical component of a rescue hoist attached to an aircraft, comprising:

a first controller area network bus extending between a control module of the rescue hoist and a plurality of control input devices;

a second controller area network bus extending between the control module of the rescue hoist and the plurality of control input devices; and

a hardwire bus extending between the control module of the rescue hoist and the plurality of control input devices;

wherein the first controller area network bus is configured to transmit a first signal from a first control input device of the plurality of control input devices to the control module, the second controller area network bus is configured to transmit a second signal from a second control input device of the plurality of control input devices to the control module and the hardwire bus is configured to transmit a third signal from a third control input device of the plurality of control input devices to the control module, each of the first signal, the second signal, and the third signal being generated by the first control input device, the second control input device, and the third control input device in response to a manipulation of the first control input device, the second control input device, and the third control input device,

wherein the control module is configured to compare the first signal and the second signal against the third signal,

wherein the control module is configured to respond to a command signal for the component generated by the first control input device, the second control input device and the third control input device, the command signal embodied in the first signal, the second signal, and the third signal, in response to the control module determining the first signal from the first control input device is consistent with the second signal from the second control input device and in response to the control module determining the third signal from the third control input device is consistent with the first signal from the first control input device and the second signal from the second control input device, and

wherein the control module is configured to not respond to the command signal for the component generated by the control input device generated by the first control input device in response to the control module determining the first signal from the first control input device is inconsistent with the second signal from the second control input device or in response to the control module determining the third signal from the third control input device is inconsistent with the first signal from the first control input device or the second signal from the second control input device.

2. The control system of claim 1 , wherein the mission-critical component is a cable cutter.

3. The control system of claim 2 , further comprising a storage device coupled to the control module via a third controller area network bus and configured to store a command signal generated by the control input device, the command signal embodied in the first signal and the second signal.

4. A rescue system for an aircraft, comprising:

a rescue hoist having a cable cutter;

a control input device configured to provide a command signal to the rescue hoist;

a first controller area network bus extending between a control module of the rescue hoist and the control input device;

a second controller area network bus extending between the control module of the rescue hoist and the control input device; and

a hardwire bus extending between the control module of the rescue hoist and the control input device;

wherein the first controller area network bus is configured to transmit a first signal from a first control input device of the plurality of control input devices to the control module, the second controller area network bus is configured to transmit a second signal from a second control input device of the plurality of control input devices to the control module and the hardwire bus is configured to transmit a third signal from a third control input device of the plurality of control input devices to the control module, each of the first signal, the second signal, and the third signal being generated by the first control input device, the second control input device, and the third control input device in response to a manipulation of the first control input device, the second control input device, and the third control input device,

wherein the control module is configured to compare the first signal and the second signal against the third signal,

wherein the control module is configured to respond to a command signal for the component generated by the first control input device, the second control input device and the third control input device, the command signal embodied in the first signal, the second signal, and the third signal, in response to the control module determining the first signal from the first control input device is consistent with the second signal from the second control input device and in response to the control module determining the third signal from the third control input device is consistent with the first signal from the first control input device and the second signal from the second control input device, and

wherein the control module is configured to not respond to the command signal for the component generated by the control input device generated by the first control input device in response to the control module determining the first signal from the first control input device is inconsistent with the second signal from the second control input device or in response to the control module determining the third signal from the third control input device is inconsistent with the first signal from the first control input device or the second signal from the second control input device.

5. The rescue system of claim 4 , further comprising a storage device coupled to the control module via a third controller area network bus and configured to store the command signal.

6. A method of controlling a rescue hoist having a mission critical component in an aircraft, comprising:

transmitting a first signal from a first control input device of a plurality of control input devices across a first controller area network bus extending between a control module of the rescue hoist and the plurality of control input devices;

transmitting a second signal from a second control input device of the plurality of control input devices across a second controller area network bus extending between the control module of the rescue hoist and the plurality of control input devices;

transmitting a third signal from a third control input device of the plurality of control input devices across a hardwire bus extending between the control module of the rescue hoist and the plurality of control input devices;

comparing the first signal from the first control input device against the second signal from the second control input device to determine whether the first signal from the first control input device is the same as the second signal from the second control input device; and

comparing the third signal from the third control input device against the first signal from the first control input device and the second signal from the second control input device to determine whether the third signal from the third control input device is consistent with the first signal from the first control input device and the second signal from the second control input device,

wherein the control module is configured to activate the component in response to a command signal, the command signal embodied in the first signal from the first control input device, the second signal from the second control input device, and the third signal from the third control input device, in response to the control module determining the first signal from the first control input device is consistent with the second signal from the second control input device and in response to the control module determining the third signal from the third control input device is consistent with the first signal from the first control input device and the second signal from the second control input device, and

wherein the control module is configured to not respond to the command signal in response to the control module determining the first signal from the first control input device is inconsistent with the second signal from the second control input device or in response to the control module determining the third signal from the third control input device is inconsistent with the first signal from the first control input device or the second signal from the second control input device.