The present invention relates to a dual controller system for analyzing a control signal received from two dual controllers, both of which operate in an active state, to check whether an error occurs in the controllers and to perform operation with a controller in a normal state. A dual controller system according to the present invention includes a plurality of lower-layer modules performing respective functions, and first and second controllers for controlling each of the plurality of lower-layer modules, wherein the first and second controllers transmit control signals to the plurality of lower-layer modules, and the lower-layer modules determine whether an error occurs in the two received control signals, remove an erroneous control signal and perform a function according to a normal control signal.

A flight management assembly of an aircraft and method of monitoring the flight management assembly. The assembly includes two flight management systems, and a monitoring and backup unit, each of the flight management systems configured for generating data including a trajectory and a prediction of a parameter of the aircraft, one of the flight management systems being active and the other being passive, the monitoring and backup unit configured for carrying out monitoring of at least one of the items of data generated by the active flight management system in order to verify if the item of data is valid, the flight management assembly carrying out, in case of validation of the monitored item of data, a synchronization of the monitoring and backup unit and of the passive flight management system, with data called synchronization data of the active flight management system, namely a flight plan and/or a flight trajectory.

A method for controlling a system consisting of at least two control units, namely a first control unit and a second control unit. The system includes least one actuator and at least one sensor. The control units generate control data for the actuator on the basis of the information from the sensor. The method includes receiving, with the actuator, both the control data of the first control unit and the control data of the second control unit. The method also includes deciding, with the actuator, whether to use the control data of the first or second control unit to carry out an actuator function with the actuator.

Disclosed is a redundant hot standby control system including K industrial personal computers, with a plurality of virtual control devices being established thereon respectively, at least one of the plurality of virtual control devices being established on each IPC as a main control device; and the other virtual control devices being standby control devices. Each of the standby control devices corresponds to a virtual control device, which serves as the main control device on another IPC, except for the IPC to which the standby control device itself belongs. A procedure, which is the same as that operated on the main control device corresponding thereto, is operated on the standby control device. A control bus of the system is used for connecting a plurality of the M IPCs; and a field bus is used for connecting the M IPCs and a plurality of field devices.

Disclosed is a redundant hot standby control system including K industrial personal computers, with a plurality of virtual control devices being established thereon respectively, at least one of the plurality of virtual control devices being established on each IPC as a main control device; and the other virtual control devices being standby control devices. Each of the standby control devices corresponds to a virtual control device, which serves as the main control device on another IPC, except for the IPC to which the standby control device itself belongs. A procedure, which is the same as that operated on the main control device corresponding thereto, is operated on the standby control device. A control bus of the system is used for connecting a plurality of the M IPCs; and a field bus is used for connecting the M IPCs and a plurality of field devices.

The present invention relates to a dual controller system for analyzing a control signal received from two dual controllers, both of which operate in an active state, to check whether an error occurs in the controllers and to perform operation with a controller in a normal state. A dual controller system according to the present invention includes a plurality of lower-layer modules performing respective functions, and first and second controllers for controlling each of the plurality of lower-layer modules, wherein the first and second controllers transmit control signals to the plurality of lower-layer modules, and the lower-layer modules determine whether an error occurs in the two received control signals, remove an erroneous control signal and perform a function according to a normal control signal.

A flight management assembly of an aircraft and method of monitoring the flight management assembly. The assembly includes two flight management systems, and a monitoring and backup unit, each of the flight management systems configured for generating data including a trajectory and a prediction of a parameter of the aircraft, one of the flight management systems being active and the other being passive, the monitoring and backup unit configured for carrying out monitoring of at least one of the items of data generated by the active flight management system in order to verify if the item of data is valid, the flight management assembly carrying out, in case of validation of the monitored item of data, a synchronization of the monitoring and backup unit and of the passive flight management system, with data called synchronization data of the active flight management system, namely a flight plan and/or a flight trajectory.