Abstract
A method of operating an aircraft with multiple actuators, such as propulsion units, preferably electrically powered propulsion units, is provided and includes the steps of: i) monitoring an operational state of said multiple actuators; ii) when detecting a malfunctioning or failure of any one of said actuators, indicating said malfunctioning or failure to a pilot in command (2b) of the aircraft; iii) controlling a human machine interface (2ab) of the aircraft to display and enable a limited choice of possible operating measures in connection with said malfunctioning or failure to the pilot in command (2b); and iv) programming at least one control element (2ae) in association with said one actuator to perform said measures when actuated by the pilot in command (2b).
Claims
1. A method of operating an aircraft (1) with multiple actuators, the method comprising: i) monitoring an operational state of said multiple actuators (3); ii) when detecting a malfunctioning or failure of any one of said actuators (3), indicating said malfunctioning or failure to a pilot in command (2b) of the aircraft (1); iii) controlling a human machine interface (2ab) of the aircraft (1) to display and enable a limited choice of possible operating measures in connection with said malfunctioning or failure to the pilot in command (2b); and iv) programming at least one control element (2ae, 2ae.sup.1, 2ae.sup.2) in association with said one actuator (3) to perform said measures when actuated by the pilot in command (2b).
2. The method of claim 1, wherein in a first mode, step iii) is performed automatically upon detection of said malfunctioning or failure.
3. The method of claim 2, wherein in a second mode, step iii) is performed upon selection of said one actuator (3) by at least one of a user or the pilot in command (2ab).
4. The method of claim 3, further comprising selecting said first mode or said second mode by a user input.
5. The method of claim 1, wherein step iii) comprises at least the possible operating measure of powering down said one actuator (3) by a user, in particular by programming of said control element (2ae.sup.1) in step iv).
6. The method of claim 5, wherein in a first mode, step iii) is performed automatically upon detection of said malfunctioning or failure, and step iii) additionally comprises at least the possible operating measure of powering up a plurality of said actuators (3), by a user.
7. The method of claim 5, wherein in a second mode, step iii) is performed upon selection of said one actuator (3) by at least one of a user or the pilot in command (2ab), and step iii) additionally comprises at least the measure of powering up said one actuator (3) by the at least one of the user or the pilot in command.
8. A control panel architecture (2a) in an aircraft (1) with multiple actuators, the control panel architecture comprising: a) a respective monitoring unit (4) associated with each said actuator (3) configured for monitoring a condition thereof; b) a data acquisition and processing unit (2aa) in connection with said monitoring units (4) configured for acquiring and processing condition data of said multiple actuators (3); and c) a human machine interface unit (2ab) in connection with said data acquisition and processing unit (2aa), comprising: ca) a display (2ac) controllable by said data acquisition and processing unit (2aa) configured to display a limited choice of possible operating measures in accordance with said condition data to a pilot in command (2b) of the aircraft (1); and cb) at least one control element (2ae, 2ae.sup.1, 2ae.sup.2) associable with at least one said actuator (3) and controllable by said data acquisition and processing unit (2aa) to perform said measures when actuated by the pilot in command (2b).
9. The control panel architecture (2a) of claim 8, wherein said at least one control element (2ae.sup.1) is a power control element comprising a power-down element for the at least one actuator (3).
10. The control panel architecture (2a) of claim 9, further comprising a relay unit (2af) in connection at least with said multiple actuators (3) configured for controlling an operational state thereof in accordance with actuation of said at least one control element (2ae, 2ae.sup.1, 2ae.sup.2).
11. The control panel architecture (2a) of claim 8, wherein the at least one control element comprises at least first and second ones of the control elements (2ae.sup.1, 2ae.sup.2), the first control element being configured for powering down the at least one actuator (3), and the second control element being configured for powering up the at least one actuator (3) or for powering up a plurality of said actuators (3).
12. The control panel architecture (2a) of claim 8, further comprising a selecting element (2ad) in connection with said data acquisition and processing unit (2aa) configured for selecting an operational mode thereof, wherein in a first operational mode said display (2ac) according to feature ca) and said at least one control element (2ae, 2ae.sup.1, 2ae.sup.2) according to feature cb) is set up automatically, and wherein in a second operational mode said display according (2ac) to feature ca) and said at least one control element (2ae, 2ae.sup.1, 2ae.sup.2) according to feature cb) is set up in accordance with a state of said selecting element (2ad).
13. The control panel architecture (2a) of claim 12, wherein the selecting element (2ad) is configured to allow selecting between an automatic mode and a further mode for selecting any one of said multiple actuators (3), and said automatic mode corresponds to said first mode and said further mode corresponds to said second mode.
14. The control panel architecture (2a) of claim 8, further comprising an additional display (2ag) configured for displaying malfunctioning or failure of any one actuator (3) to the pilot in command (2b).
15. An aircraft (1) with multiple actuators comprising the control panel architecture (2a) according to claim 8.
16. The aircraft of claim 15, wherein the multiple actuators are propulsion units (3).
17. The aircraft of claim 16, wherein the propulsion units are electrically powered propulsion units.
Description
BRIEF DESCRIPTION OF THE DRAWINGS
[0042] Further advantages and details of the present invention will now be described in connection with exemplary embodiments as shown in the appended drawings.
[0043] FIG. 1 shows an embodiment of an aircraft in accordance with the present invention;
[0044] FIG. 2 shows a general overview of a control panel architecture in accordance with the present invention;
[0045] FIG. 3 shows a first embodiment of the control panel architecture in accordance with the present invention in a first operational state;
[0046] FIG. 4 shows the embodiments of FIG. 3 in a second operational state;
[0047] FIG. 5 shows the embodiment of FIG. 3 in a third operational state;
[0048] FIG. 6 shows another embodiment of the control panel architecture in accordance with the present invention in a first operational state;
[0049] FIG. 7 shows the embodiment of FIG. 6 in a second operational state; and
[0050] FIG. 8 shows the embodiment of FIG. 6 in a third operational state.
DETAILED DESCRIPTION
[0051] FIG. 1 shows a possible configuration of the aircraft according to the invention as a multirotor eVTOL (electrically powered vertical take-off and landing) aircraft 1 with 18 drive or propulsions units (electrical propulsion unis—EPUs) 3, of which only one is explicitly designated in FIG. 1. Each propulsion unit 3 comprises an electric motor 3a and a propeller 3b as shown in the illustration. According to the design of aircraft 1 in FIG. 1, the drive units, in particular the propellers 3b, cannot be swivelled. x, y and z denote reference axes of aircraft 1; L, M and N denote the corresponding (control) moments.
[0052] Said propulsion units mentioned here and in the following are a typical example for the more generic term “actuator” used throughout the specification and claims. However, the invention is by no means restricted to actuators in the form of (electrically powered) propulsions units, but also encompasses other actuator types, such as actuated wings, flaps, winches, or other payload-related actuators. In the following, the term “unit” may also be used instead to designate all kinds of actuators.
[0053] Aircraft 1 has a flight control unit at reference number 2, which is described in more detail below in FIGS. 2 through 8. Flight control unit 2 comprises a control panel architecture 2a according to the present invention which can be operated—without restriction—by a (human) pilot in command 2b. Reference number 4 designates, as an example, a sensor unit which is associated with propulsion unit 3 and operatively connected to the flight control unit 2 and to the control panel architecture 2a; flight control unit 2 will generally be connected with a large number of such sensor units 4 which are particularly designed and suitable for determining a (current) state of the associated propulsion unit 3. Preferably, every propulsion unit 3 has at least one such sensor 4. Human pilot 2b may transmit his/her control requirements to the aircraft 1, e.g., via a control stick or the like (not shown). Within the scope of the invention, however, the aircraft 1 is in particular also capable of flying without a human pilot 2b, i.e., by means of an autopilot or the like. The flight control unit 2 may also use a physical model of the aircraft 1 to determine a system state from sensor data, which is not further illustrated in FIG. 4. The flight control unit 2 may control the aircraft 1 along a predicted and/or real-time adjusted trajectory by appropriate commanding of the propulsion units 3, as known to the skilled person.
[0054] FIG. 2 shows the overall architecture of a control panel architecture 2a according to the present invention as comprised, e.g., in the aircraft 1 according to FIG. 1 (reference number 2a). In FIG. 2, said control panel architecture 2.1 is denoted by means of a dashed box. The control panel architecture 2a comprises a data acquisition and processing unit 2aa which can advantageously be implemented in the form of a PLD—programmable logic device, which is an electronic component used to build reconfigurable digital circuits. Unlike integrated circuits (IC) which consists of logic gates and have a fixed function, a PLD has an undefined function at the time of manufacture. Before the PLD can be used in a circuit, it must be programmed (reconfigured) by using a specialized program. The term PLD comprises logic IC technologies like PAL, PLA, GAL, CPLD and newer technologies like FPGAs (field programmable gate arrays). Control panel architecture 2a further comprises an HMI (human-machine interface) 2ab, which in turn comprises a display 2ac, a selector or selecting element 2ad, and power controls 2ae. In the embodiment of FIG. 2, said power controls 2ae are devised—without limitation—in the form of two power controls (or power control elements), as denoted by means of the two vertical arrows that originate from said power controls 2ae. The control panel architecture 2a of FIG. 2 further comprises a relay or relay unit 2af, which relay unit 2af is arranged between said power controls 2ae and motor units 3a.
[0055] The motor units of FIG. 2 correspond to the electric motors 3a of the propulsion units 3 as shown in FIG. 1. Each motor unit 3a has an associated condition monitoring unit (“condition monitoring”), which corresponds to the sensor units 4 mentioned in connection with FIG. 1. An output of said condition monitoring units 4 serves as input to the data acquisition and processing unit 2aa. For reason of intelligibility, only two motor units 3a and corresponding sensor units 4 are shown in FIG. 2. In the case of aircraft 1 according to FIG. 1, there would be 18 such motor units 3a with corresponding condition monitoring units 4 (which are symbolized by means of horizontal arrows pointing toward data acquisition and processing unit 2aa in FIG. 2).
[0056] The data acquisition and processing unit 2aa is operatively connected with the HMI 2ab for controlling the display 2ac and the power controls 2ae thereof. Selector 2ad is operatively connected with the data acquisition and processing unit 2aa for controlling an operational state or operational mode thereof. Both power controls 2ae and data acquisition and processing unit 2aa are operatively connected with relay 2af for controlling a configuration thereof (in the case of data acquisition and processing unit 2aa) and for providing an actuation signal to the relay 2af (in the case of power controls 2ae), which actuation signal is then forwarded to the motor units 3a in accordance with said configuration of relay 2af.
[0057] In principle, relay 2af is in operative connection with all motor units 3a for forwarding corresponding power control signals that are input through HMI 2ab by pilot in command 2b by means of said power controls 2ae. Pilot in command 2b observes display 2ac and operates selector 2ad and power controls 2ae, respectively. In the case of FIG. 2, pilot in command 2b is a human pilot. However, the present invention also functions with pilot in command 2b being an autopilot or a remote operator.
[0058] The gist of the present invention results in the fact that HMI 2ab, by means of a display 2ac and power controls 2ae, only presents a limited choice of operational measures to the pilot in command 2b such that the latter is less prone to making operational mistakes. This will now be explained in more detail by means of the embodiments shown in FIGS. 3-8.
[0059] In the following Figures, the same reference numbers are used to designate identical or at least functionally identical elements as in previous FIGS. 1 and 2.
[0060] Reference number 4 designates the aforementioned sensor units or condition monitoring units which function as a monitoring system, as described earlier. Arrow CAS denotes a so-called crew alerting system, which is used to pass on the sensor or monitoring information from monitoring system 4 to the control panel architecture 2a.
[0061] As shown in FIG. 3, control panel architecture 2a further comprises an additional display 2ag, which shows a functional operating state of the individual aircraft's propulsion units that are marked by corresponding numbers 1-18 (cf. aircraft 1 of FIG. 1). Display 2ac comprises an indicator for each motor unit 3a, only one of which indicators is denoted by means of reference number 3a′ in FIG. 3. Each of said indicators 3a′ potentially also functions as a control element 2ae.sup.1 for powering down a corresponding motor unit 3a. A button marked “START” in the centre of display 2ac, which button is denoted by reference number 2ae.sup.2, serves to power up all of the motor units (propulsion units) 3a at once. To this end, selector 2ad is positioned at “AUTO”, as shown. Display 2ac can be devised as a touch-sensitive display which allows free configuration. However, the invention is not limited in this way. For instance, display 2ac could also be configured with physical (hardware) buttons and switches, e.g., a dial switch for selector 2ad and push buttons for the control elements 2ae.sup.1. As shown on the right-hand side of display 2ac, individual EPU controls 3a″ are shown that correspond or are linked to the individual control elements 3a′, 2ae.sup.1 mentioned earlier. In other words, every control element 2ae.sup.1 that corresponds to a particular propulsion unit or motor unit 3a is linked to a corresponding EPU control 3a″. From each EPU control 3a″ to a corresponding propulsion unit or motor unit 3a there are two physical connections 3c, 3d, each comprising a switching element 3ca, 3da, wherein at least said switching elements 3ca, 3da constitute the relay unit 2af. An operational state of the switching elements 3ca, 3da is controlled by the data acquisition and processing unit 2aa, as shown. For reason of intelligibility, this is only shown in detail for one motor unit or propulsion unit 3a.
[0062] As stated before, FIG. 3 shows a nominal state of operation. CAS is fully functional, and no propulsion unit 3a experiences any failure or malfunctioning. Accordingly, further display 2ag does not display any particular state for any one of the propulsion units 3a. None of the control elements 2ae.sup.1 is lit or highlighted, which would otherwise indicate an active state of said control element 2ae.sup.1. Selector 2ad is set to “AUTO” mode. Data acquisition and processing unit 2aa controls relay 2af such that the switching elements 3ca are in an open state, while switching elements 3da are in a closed state. Switching elements 3ca correspond to the individual control elements 2ae.sup.1 and can be used for shutting down or powering down a corresponding propulsion unit 3a by means of corresponding control elements 2ae.sup.1, if active. In the case of FIG. 3, none of the control elements 2ae.sup.1 are active, and consequently all switching elements 3ca are in an open state. No propulsion unit 3a can be powered down.
[0063] In contrast, control element 2ae.sup.2 is active and can be used to power up all propulsion units 3a at once with a single actuation of said control element 2ae.sup.2. Consequently, all of the switching elements 3da used for powering up of the propulsion units 3a are in a closed state.
[0064] A pilot in command (not shown in FIG. 3) can therefore power up all of the propulsion units 3a at once by pressing or otherwise actuating control element 2ae.sup.2, while he/she cannot power down any of the propulsion units 3a by actuating control elements 2ae.sup.1 since the latter are not activated.
[0065] FIG. 4 shows the case in which EPU 2 (denoted “2” or “UNIT2”) experiences a failure or malfunctioning. This is indicated on further display 2ag and is further indicated by means of highlighting corresponding control element 2ae.sup.1 on display 2ac. Consequently, in the selected “AUTO” mode, data acquisition and processing unit 2aa controls relay 2af to additionally close switching element 3ca′ that is comprised in physical connection with propulsion unit 3a′ that corresponds to EPU 2. Furthermore, the highlighted control element 2ae.sup.1 that corresponds to EPU 2 is activated. The user, e.g., a pilot in charge can now actuate the highlighted control element 2ae.sup.1 to individually power down EPU 2 via switching element 3ca′. No other propulsion unit 3a can be powered down. On the other hand, all switching elements 3da remain closed so that control element 2ae.sup.2 can still be used to power up all propulsion units 3a with a single actuation gesture.
[0066] According to FIG. 4, CAS is (fully) functional so that control panel architecture 2a receives all monitoring signals from sensor units (or monitoring system) 4.
[0067] According to FIG. 4, there can be additional output to the user at reference number 2ah, e.g., in text form, which informs user of said failure or malfunctioning. There can be explicit reference to failure or malfunctioning of EPU 2.
[0068] As shown, element 2ah may not only display a warning massage but a message that is specific to the type of failure experienced by the propulsion unit 3a in question, e.g., overheating or the like (“UNIT2 OVERTEMP”).
[0069] FIG. 5 shows the case in which CAS is not working. In this way, control panel architecture 2a, i.e., data acquisition and processing unit 2aa does not receive any sensor information from monitoring system (sensor units) 4. Still, additional display 2ag indicates failure or malfunctioning of EPU 2. The user, e.g., the pilot in command, can then move selector 2ad to selecting control element 2ae.sup.1 which corresponds to said malfunctioning propulsion unit 3a′ EPU 2. Note that said control element 2ae.sup.1 will not be lit or highlighted in this case. Depending on the selected state of selector 2ad, data acquisition and processing unit 2aa will then control relay 2af as shown in FIG. 5, i.e., with all switching elements open apart from switching elements 3ca′, 3da′ associated with selected EPU 2. Consequently, the user will only be able to power down EPU 2 (by actuating corresponding control element 2ae.sup.1) and to power up EPU 2 (by actuating control element 2ae.sup.2). Note that latter control element 2ae.sup.2 does no longer function to power up all propulsion units 3a since selector 2ad is no longer in “AUTO” mode.
[0070] FIGS. 6-8 show a slightly different control panel architecture 2a, which differs from FIGS. 3-5 as far as the selector 2ad and the control elements 2ae.sup.1, 2ae.sup.2 are concerned.
[0071] As can be gathered from FIG. 6, selector 2ad can still be used to select either an “AUTO” mode or individual EPUs, only nine of which are explicitly shown (“1” through “9”; the other ones are denoted with “N”). However, there are no individual control elements 2ae.sup.1 for each EPU. Furthermore, there is no central “START” control element as in FIGS. 3-5.
[0072] According to FIG. 6, there is an additional display element 2ai, and said control elements 2ae.sup.1, 2ae.sup.2 are devised in the form of two (hardware and/or software) buttons marked “ON” and “OFF”, respectively.
[0073] In the case depicted in FIG. 6, CAS and all propulsion units 3a work normally. Display 2ag indicates no failure or malfunctioning, and display 2ai is not lit. Control element 2ae.sup.1 is not active, while relay 2af is devised so that all switching elements 3da are closed and control element 2ae.sup.2 can be used to power up all of the propulsion units 3a simultaneously (selector 2ad in “AUTO” mode). In this way, the switching state of relay 2af corresponds to that shown in FIG. 3.
[0074] In the same way, the situation depicted in FIG. 7 corresponds to that shown in FIG. 4: EPU 2 experiences a malfunctioning or failure which is indicated on display 2ag and at 2ah. The “OFF” button which corresponds to control element 2ae.sup.1 is lit, thus indicating that corresponding actuation will lead to powering off EPU 2 (3a′). Correspondingly, data acquisition and processing unit 2aa controls relay 2af as shown, which implies closing switching element 3ca′ while all switching elements 3da remain closed. Therefore, control element 2ae.sup.2 can still be used to power up all propulsion units 3a. Note that selector 2ad remains in “AUTO” mode. Display 2ai indicates an identifier for the malfunctioning or failed propulsion unit EPU 2, as shown (“UNIT 2”).
[0075] Note that in case of FIG. 7, control element 2ae.sup.1 is highlighted or lights up automatically since control panel architecture 2a is in “AUTO” mode.
[0076] The situation of FIG. 8 corresponds to that depicted in FIG. 5, i.e. CAS has failed so that there is no automatic control or setup of control elements 2ae.sup.1, 2ae.sup.2, as previously explained. However, the user is still informed by means of display 2ag and warning element 2ah that a propulsion unit 3a′, presently again EPU 2, has failed or experiences a malfunction. The user can then move selector 2ad to corresponding indication “2”, upon which display 2ai will indicate the manually selected propulsion unit 3a′ (EPU 2, “UNIT 2”). As further shown in FIG. 8, the corresponding control element 2ae.sup.1 will be highlighted or lights up—however, this will only happen upon said manual selection of EPU 2. In accordance with the selected mode, data acquisition and processing unit 2aa will control relay 2af as shown, which is in accordance with FIG. 5. In other words: All switching elements 3ca, 3da are open, with the exception of switching elements 3ac′, 3da′ associated with manually selected failed/malfunctioning propulsion unit EPU 2. In this way, control element 2ae.sup.1 can be used to power down selected propulsion unit EPU 2 only, while control element 2ae.sup.2 can be used to power up selected propulsion unit EPU 2 only.
[0077] In all embodiments, display 2ag need not be part of the control panel architecture 2a but can be separate therefrom. This is indicated in the Figures by means of a separate data connection between monitoring system 4 and display 2ag so that display 2ag can still be active even if CAS is interrupted (cf. FIGS. 5 and 8).
[0078] In all cases, based on the selected operating mode, the state of CAS and the operational states of the propulsion units 3a, the operator is presented a limited choice of operating control options by means of only two control elements 2ae.sup.1, 2ae.sup.2 such that the risk of erroneous operation can be avoided.
[0079] As will be well understood by a person skilled in the art, the present invention is not limited to the described choice of graphical representation of display 2ac and its operating elements.
[0080] In connection with the above-defined FIGS. 3-8, it has been mentioned that certain control elements can be lit or highlighted in order to indicate their active state. In FIGS. 3-5, there are connecting lines between the central control element 2ae.sup.2 (“START”) and the individual control elements 2ae.sup.1 associated with individual propulsion units, which control elements are arranged in the same geometrical pattern in which they are present within aircraft 1 (cf. FIG. 1). This serves to guide the user (pilot in command) during aircraft operation. Furthermore, said connecting lines, one of which is denoted 2aj in FIG. 5, could also be lit, highlighted or otherwise marked in order to indicate a (manual) selection of a corresponding propulsion unit 3a.
[0081] As explained in detail above, the proposed design prohibits the shutdown of all EPUs at once (preventing a so-called single point of failure). Only a simultaneous power-on of all EPUs is possible. If a specific EPU needs to be shut down, a proposed control panel architecture either automatically selects a specific EPU for which a critical condition was reported, or the user can select a specific EPU by turning or otherwise operating a control element towards this specific EPU which is then highlighted or otherwise marked and can subsequently be shut down by pressing the respective highlighted button or by actuating any other type of control element, as previously explained.
[0082] During power-on, when the pilot in command wants to start a flight, a default position of selector 2ad can be in “AUTO” mode. By pressing the “START” button or otherwise actuating a corresponding control element 2ae.sup.2, all EPUs can be powered simultaneously. This reduces the pilot's workload tremendously and reduces the time required for the power-on sequence.
[0083] In case CAS is functional, signals regarding any critical condition (e.g., overtemperature or failure) of any EPU can be transmitted to the control panel architecture, and the latter automatically highlights the critical EPU which can then be shut down by operating a corresponding control element, as explained above.
[0084] In case data transmission by the CAS is erroneous or the corresponding signal line is interrupted, a manual selection of the specific EPU is possible, and then the selected EPU can be shut down subsequently by operating the corresponding control elements.
[0085] In FIGS. 6-8, the control element marked “ON” takes over the role of the above-mentioned “START” button. Once a critical state is reported to the control panel architecture, e.g., by means of the CAS, the critical EPU is indicated on display 2ai, and the “OFF” button associated with that particular EPU is highlighted. Subsequently, the critical EPU can be shut down by pressing said “OFF” button or by operating any other control element associated with said EPU. As explained before, in case there is a problem in the transmission of this critical state to the control panel architecture, the pilot in command can also manually select one specific EPU, e.g., by turning selector 2d. The selected EPU is then indicated on display 2ai and the “OFF” button is highlighted which can subsequently be pressed for shutting down the selected EPU. Again, the aforementioned types of operating elements are only indicated in exemplary fashion. Optionally, there is another display (display 2ag) which serves only to indicate a state of all EPUs (preferably in the same geometrical arrangement as in the actual aircraft design), on which the EPUs are displayed, e.g., as green when no critical state is reported. They can turn to red once a critical state is measured, sensed or calculated.
[0086] In the above-defined Figures, said critical state has been indicated on display 2ag by means of a black dot around the number that corresponds to the critical EPU in order avoid the use of colour in the drawings.
