HK1204809B - Autopilot and methods - Google Patents

Abstract

A helicopter autopilot system includes an inner loop for attitude hold for the flight of the helicopter including a given level of redundancy applied to the inner loop. An outer loop is configured for providing a navigation function with respect to the flight of the helicopter including a different level of redundancy than the inner loop. An actuator provides a braking force on a linkage that serves to stabilize the flight of the helicopter during a power failure. The actuator is electromechanical and receives electrical drive signals to provide automatic flight control of the helicopter without requiring a hydraulic assistance system in the helicopter. The autopilot can operate the helicopter in a failed mode of the hydraulic assistance system. A number of flight modes are described with associated sensor inputs including rate based and true attitude modes.

Description

Autopilot and method thereof

RELATED APPLICATIONS

This application claims priority to U.S. provisional patent application nos. 61/597,555, 61/597,570, and 61/597,581, all filed on day 10/2/2012, the entire contents of which are incorporated herein by reference. The present application also claims priority from U.S. patent application nos. 13/763,574, 13/763,582 and 13/763,590, all filed 2013, 2, 8, each of which are incorporated herein by reference in their entirety.

Technical Field

The present application relates generally to flight control systems, and more particularly to rotorcraft autopilots and related methods.

Background

Helicopters are inherently unstable and often require the pilot to maintain a constant interaction with the cyclic control with one hand. Even momentary release of the cyclic can result in "chattering" of the cyclic or cyclic, with concomitant loss of control of the helicopter. This is particularly inconvenient when the driver needs to engage in two-handed activities, such as adjusting the headset or looking up a hard copy of a map. Furthermore, the need for continuous control of the cyclic control can lead to driver fatigue.

Conventional autopilots can provide several benefits, including allowing the driver to release the cyclic control to engage in two-handed tasks and reducing driver fatigue. However, the applicant has realised that the cost of conventional helicopter autopilots is very high. For example, the cost is so high compared to the cost of the helicopter itself that autopilots are difficult to see in light helicopters.

The above-described examples of prior art and limitations associated therewith are intended to be illustrative, and not exhaustive. Other limitations of the prior art will become apparent to those of skill in the art upon a reading of the specification and a study of the drawings.

Disclosure of Invention

The following embodiments and aspects thereof are described and illustrated in conjunction with systems, tools, and methods which are meant to be exemplary and illustrative, not limiting in scope. In various embodiments, one or more of the above-described problems are contemplated to be reduced or eliminated, while other embodiments are directed to other improvements.

In general, autopilot systems, related components, and methods for helicopters are described. In one aspect of the invention, the inner loop is configured to provide at least a true attitude to the flight of the helicopter, the inner loop including a given level of redundancy applied to the inner loop. An autopilot outer loop is configured to provide at least one navigation function for flight of the helicopter that includes a different level of redundancy than the inner loop.

In another aspect of the invention, the actuator device forms part of an autopilot for providing automatic control of a helicopter by actuating one or more flight controls of the helicopter. At least one electric motor includes an output shaft and a motor coil arrangement for receiving a drive current for rotating the output shaft. The actuator link is operatively connected between the output shaft of the motor and the flight control member such that rotation of the output shaft causes corresponding movement of the actuator link and the flight control member. The motor drive arrangement is for providing a drive current from the power supply during normal operation of the autopilot and at least for shorting the motor coil arrangement in response to a failure of the power supply such that the motor provides a braking force acting on the actuator linkage for stabilizing the flight of the helicopter during the power failure.

In yet another aspect of the present invention, embodiments of an autopilot system and associated method are described for a helicopter that includes a GPS unit that provides a GPS output. The sensor device is dedicated to an autopilot system and produces a set of sensor outputs that are characteristic of the flight of the helicopter. The control device receives the GPS output and the sensor output and generates an electrical drive signal in response thereto. The actuator is electro-mechanical and receives the electrical drive signal and generates a mechanical control output responsive to the electrical drive signal, the mechanical control output being mechanically coupled to the helicopter to provide automatic flight control of the helicopter without the need for hydraulic assist systems in the helicopter.

In yet another aspect of the present invention, an autopilot system and related method are described for a helicopter that includes a hydraulic assist system that receives flight control inputs from a pilot and in turn generates mechanical outputs that are mechanically coupled to the helicopter to provide pilot control of the helicopter. The sensor device generates a set of sensor outputs that are characteristic of the flight of the helicopter. The control device receives the sensor output and generates an electrical drive signal. The actuator device is electromechanical and receives the electrical drive signal and generates a control output responsive to the electrical drive signal, the control output being mechanically connected to the hydraulic assist system, and the actuator device being configured to cooperate with the control device to provide automatic flight control of the helicopter in a first normal mode with the hydraulic assist system in a normal operating condition and in a second failure mode with the hydraulic assist system in a failure operating condition to provide automatic flight control of the helicopter in each of the normal mode and the failure mode.

In yet another aspect of the present disclosure, an autopilot system and associated method are described for selectively automatically controlling forward flight of an helicopter characterized by a set of orientation parameters including a pitch orientation, a roll orientation, and a yaw orientation. In an embodiment, a MEMS triaxial rate sensor is supported by the helicopter to generate a roll rate signal, a pitch rate signal, and a yaw rate signal responsive to changes in roll orientation, pitch orientation, and yaw orientation, respectively. The MEMS triaxial accelerometer produces an accelerometer signal responsive to forward flight. The GPS receiver is supported by the helicopter for generating a course signal and a speed signal responsive to forward flight of the helicopter. The three-axis magnetometer generates magnetometer signals. The controller receives a set of inputs consisting of a pitch rate signal, a roll rate signal, a yaw rate signal, an accelerometer signal, a course signal, a magnetometer signal and a speed signal to determine a true attitude of the helicopter and generates a set of control signals to maintain a stable forward flight orientation of the helicopter in accordance with a selected course defined on the ground and a selected speed on the selected course. The actuator device receives a set of control signals to adjust forward flight of the helicopter based on the set of control signals. In one embodiment, the speed signal may be provided by GPS. In another embodiment, the speed signal may be provided by a flight speed sensor of the aircraft.

In another aspect of the invention, an autopilot system and associated method are described for selectively automatically controlling forward flight of an helicopter characterized by a set of orientation parameters including a pitch orientation, a roll orientation, and a yaw orientation. In an embodiment, a MEMS triaxial rate sensor is supported by the helicopter to generate a roll rate signal, a pitch rate signal, and a yaw rate signal responsive to changes in roll orientation, pitch orientation, and yaw orientation, respectively. The MEMS triaxial accelerometer produces an accelerometer signal responsive to forward flight. The GPS receiver is supported by the helicopter for generating a course signal, an altitude signal and a speed signal responsive to forward flight of the helicopter. The three-axis magnetometer generates a magnetometer heading signal. The controller is supported by the helicopter to receive a set of inputs consisting of a pitch rate signal, a roll rate signal, a yaw rate signal, an accelerometer signal, a course signal, an altitude signal, a magnetometer heading signal, and a speed signal to determine a true attitude of the helicopter and to generate a set of control signals to maintain a stable forward flight orientation of the helicopter in accordance with a selected course defined on the ground and a selected altitude on the selected course. The actuator device receives a set of control signals to adjust forward flight of the helicopter based on the set of control signals. In one embodiment, the speed signal and/or the altitude signal may be provided by GPS. In another embodiment, each of the speed signal and/or the altitude signal may be provided by a airspeed sensor and/or a pressure-based altitude sensor of the aircraft.

In yet another aspect of the present invention, an autopilot system and associated method are described for selectively automatically controlling the flight of a helicopter capable of flying in a hover mode, the hover being characterized by a set of orientation parameters including a pitch orientation, a roll orientation, a yaw orientation, and an above-ground position. In an embodiment, the MEMS sensor device is supported by the helicopter to generate a pitch rate signal responsive to changes in pitch orientation, a roll rate signal responsive to changes in roll orientation, a yaw rate signal responsive to changes in yaw orientation, and an acceleration signal responsive to hovering. The magnetometer generates a magnetic heading signal. The GPS receiver is supported by the helicopter to generate a position signal, a speed signal, and a course signal responsive to the hovering of the helicopter. The processing device is supported by the helicopter to receive a set of inputs consisting of a pitch rate signal, a roll rate signal, a yaw rate signal, an acceleration signal, a position signal, a speed signal, a course signal, and a magnetic heading signal to determine a true attitude of the helicopter and to generate a set of control signals to maintain a stable hover of the helicopter in accordance with the selected hover position. The actuator device is for receiving a set of control signals to adjust the hover of the helicopter based on the set of control signals. In an embodiment, a current deviation from a desired altitude may be indicated using a pressure-based altitude sensor signal or a GPS-based altitude signal of the aircraft.

In yet another aspect of the present invention, an autopilot system for a helicopter and related method are described. The inner loop is configured to provide at least a true attitude for flight of the helicopter, the inner loop including a given level of redundancy applied to the inner loop. The autopilot outer loop is configured to provide at least one navigation function for flight of the helicopter, and the inner loop and the autopilot outer loop are each configured with a triplex processor.

Drawings

Exemplary embodiments are illustrated in referenced figures of the drawings. The embodiments and figures disclosed herein are intended to be illustrative rather than restrictive.

Fig. 1 is a schematic partial perspective view of a helicopter including components of an autopilot according to the invention.

FIG. 2 is a schematic partial top perspective view of the helicopter shown in FIG. 1, further illustrating details relating to components of the autopilot system.

FIG. 3 is a schematic cut-away perspective view of an embodiment of an actuator and an embodiment of a force limiting link that can be used as a component of the autopilot of the present invention.

FIG. 4 is a schematic perspective view of an embodiment of a gear drive arrangement that can form part of the actuator shown in FIG. 3 with a redundant pair of actuator drive motors.

Fig. 5 is a block diagram illustrating an embodiment of the autopilot of the present invention.

FIG. 6 is a schematic diagram of an embodiment of a voting section that receives votes made by a set of triplex processors.

FIG. 7 is a flow chart illustrating an embodiment of a method for operation of the inner and outer control loops of the autopilot of the present invention.

FIG. 8 is a schematic diagram illustrating one embodiment of a dynamic braking system that can form part of the autopilot of the present invention.

FIG. 9 is a schematic diagram illustrating another embodiment of a dynamic braking system that can form part of the autopilot of the present invention.

FIG. 10 is a block diagram of another embodiment of an autopilot including a fail-function design configuration that uses a triplex architecture in both the inner and outer loops.

FIG. 11 is a table showing autopilot flight patterns described by various sensor inputs employed for control purposes.

Detailed Description

The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. Various modifications to the described embodiments will be readily apparent to those skilled in the art, and the generic principles taught herein may be applied to other embodiments. Thus, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features described herein, including modifications and equivalents. It is noted that the drawings may not be to scale and are diagrammatic in nature in a manner that is deemed best to illustrate the target feature. For the various views provided in the drawings, descriptive terminology may be employed for the purpose of enhancing the reader's understanding, but is in no way intended to be limiting.

FIG. 1 is a partial perspective view of a helicopter 10 intended to illustrate various components of an embodiment of an autopilot system 12 associated with the helicopter. It will be appreciated that most of the physical structure of the helicopter itself is made invisible in fig. 1 for clarity of illustration, but it will be understood that such structures are present. The autopilot of the present invention is electromechanical and is capable of providing flight control of a helicopter without the need for a hydraulic flight control system. By way of non-limiting example, the helicopter may be a Robinson R22 helicopter. However, the teachings disclosed herein can be readily adapted for use with any suitable helicopter, whether an existing helicopter or a helicopter yet to be developed. For example, the autopilot of the present invention can be used with helicopters having a hydraulic cyclic pitch assist device, as will be described further below.

Helicopter 10 includes a control lever or cyclic (cyclic) 14 having a control handle or control grip 18 configured to engage the hand of the pilot. As understood by those of ordinary skill in the art, the joystick 14 is capable of moving back and forth (toward and away from the instrument console 20) to control the pitch of the helicopter and is capable of moving laterally to control the roll (roll) of the helicopter in a coordinated manner that produces controlled flight. The pilot provides additional control input through a pair of pedals to control the yaw orientation of the helicopter by changing the pitch angle of the tail rotor. It is noted that for the sake of clarity of illustration, these yaw orientation control components are not shown, but should be understood to be present. In an embodiment, the driver is also able to control the collective pitch lever and throttle setting of the helicopter. However, the autopilot of the present invention is capable of applying full authority control to the joystick 14 by moving the joystick in any direction, thereby limiting its travel in appropriate circumstances. The joystick 14 passes under the deck 24 of the helicopter and engages the pitch and roll links of the helicopter in a manner familiar to those of ordinary skill in the art to control the cyclic actuation of the main rotor of the helicopter. The term "cyclic pitch" refers to the change in the pitch angle of the rotor blades of a helicopter on a per-revolution basis. In this regard, cyclic control may refer to the manipulation of a joystick, or the joystick itself may be referred to as a cyclic joystick. An Autopilot Display Processor Unit (ADPU)28 may be mounted to the instrument console 20 to provide instructions to the driver as well as to provide processing and other capabilities, as will be further described.

The cyclic 14 (specifically, the handle 18) includes a switch module assembly 26 that can be mounted as shown. Details of the handle 18 are shown in a further enlarged inset. The switch module may include switches such as an engage disconnect switch 29a and a trim mode "top hat" switch 29b (4-way). The top hat switch allows the driver to adjust course, speed, position and altitude. Pressing the top hat switch to actuate more than one switch simultaneously can select the highlighted mode. There may be a timeout function in the autopilot's processor to prevent a switch failure or wiring failure from causing a continuous adjustment. The mode switch is capable of selecting and canceling the altitude hold mode, the speed hold mode, the hover hold mode, or the position hold mode based on the current flight state. It is noted that for the purposes of the present invention, hover mode may be interchangeably referred to as position hold mode, as there is no mandatory requirement for an autopilot to control the collective joystick and/or foot pedal of a helicopter.

Still referring to fig. 1, the autopilot 12 implements cyclic pitch control through a number of components suitably located on the helicopter. The autopilot main unit 30 is located below the main deck of the helicopter. In this embodiment, the main unit 30 includes an L-shaped housing 31, the housing 31 supporting electronics and pitch and roll control actuator links 32a, 32b, which may be generally or collectively referred to by the reference numeral 32. Each of these links includes an actuator located within the main unit housing, as will be further described. The distal end of each link engages the lowermost end of the joystick 14 to implement a so-called parallel control system. In this regard, it should be appreciated that the original cyclic control links of helicopter 10 between the joystick 14 and the rotor remain intact. That is, inputs from the helicopter pilot and autopilot are input directly to the joystick. Details regarding the pitch control links and roll control links are provided for the parallel control input device. In contrast, a serial type autopilot control system requires disconnection of the original cyclic control link of the helicopter between the joystick and the rotor so that the autopilot actuator can be inserted into the disconnection. It should be appreciated that the teachings herein can be readily adapted to serial control input embodiments.

Turning to FIG. 2, the components of the helicopter and autopilot are shown in a top perspective view. In this view, it can be seen that pitch actuator 60a and roll actuator 60b (which may be generally or collectively referred to by reference numeral 60) are located within an L-shaped housing 31, with the cover of the housing being transparent. The main unit electronics 66 are located within the housing and are suitably electrically connected to the exterior and to the actuator (not shown).

Referring to fig. 3, it can be seen in perspective that throughout the present invention, an embodiment of an actuator 60 that can be used for pitch and roll actuators is mounted within the housing 31 and connected to the control link 32. Each actuator includes a housing 82 with a gear arrangement, further shown, within the housing, a dual motor (motor a and motor B) and a clutch arrangement 84 for selectively engaging and disengaging the motors to rotate an output shaft not visible on the opposite side of the housing 82. It will be seen that the gearing arrangement allows both motor a and motor B to drive the output shaft simultaneously or either motor to drive the output shaft individually. In this embodiment, motor a and motor B are brushless dc motors having a wye-connected stator winding configuration that requires coordinated inputs to drive the phases of the motors in a particular sequence. Likewise, the motors do not run away under their own power. The motor includes a hall effect sensor for metering the time of an electrical drive pulse to the stator of the motor. Further details regarding the motor and associated drive scheme are provided at one or more appropriate nodes below. Although the invention has been described in terms of using a brushless dc motor having Y-connected stator coils by way of example, it will be appreciated that any suitable type of motor may be used.

Fig. 4 shows an embodiment of a gear drive 100 that can be used in the actuator shown in fig. 3. First, it is noted that the gear drive is a multi-stage reduction drive, for example, with a reduction ratio of about 1750: 1. Additionally, although gear teeth are not shown on some of the gears to be described, it should be understood that they are present. Other embodiments may not require gears with gear teeth. Motor a and motor B have output shaft support gears that engage gear 102 on first shaft 104. The other end of the shaft 104 supports a smaller gear 106 that drives a gear 110, the gear 110 being supported on a second shaft 112, the second shaft 112 also supporting a smaller gear 114 (which is partially hidden from view in the drawings). Notably, the shaft 112 may include a clutch shaft that is laterally movable to selectively engage or disengage the actuator motor with the remaining gears of the gear drive. One suitable clutch arrangement is described, for example, in U.S. patent No.7,954,614, which is incorporated herein by reference. The clutch device relies on the movement of the clutch shaft along its elongation axis by the use of a permanent magnet mounted on the distal end of the shaft. A clutch actuator 113 (fig. 3) is capable of selectively moving (e.g., rotating) another permanent magnet relative to the clutch shaft to which the permanent magnet is mounted such that the clutch shaft is magnetically biased to move between an engaged position and a disengaged position. The clutch shaft is maintained in the current operating position regardless of a power failure. In turn, the gear 114 selectively drives a gear 120 supported on a third shaft 122. The third shaft 122 also supports a smaller gear 124, and the gear 124 drives a gear 130 supported on a fourth shaft 132. The fourth shaft 132, in turn, supports a smaller gear 134, the gear 134 being arranged to rotate an output gear 140 supported on an output shaft 142 of the actuator. The output gear is configured to provide sufficient rotation to move the rod 14 through its full range of motion. In an embodiment, the actuator of the invention is sufficiently strong in terms of the level of generation of the actuation force to be able to control the pitch horn of a helicopter using the hydraulic equipment of the failed hydraulic system. In this embodiment, the actuator is capable of generating a torque of 600 inch-pounds or 50 foot-pounds. Further, in an embodiment, a 2 inch actuator arm is used, which can provide the ability to apply up to 300 pounds of force on the bottom of the cyclic stick. While the present embodiment is designed to provide this level of actuation force, it will be appreciated that in another embodiment, significantly higher or lower forces may be provided by varying the following variables: the output torque of the motor, the reduction ratio of the drive train, or the length of the actuator arm. As shown in fig. 1 and 2, the force of the actuator is applied to the bottom of the cyclic, while the force of the driver is applied to the top of the cyclic. Thus, the driver has a mechanical advantage due to the different lever arm lengths. On an R22 helicopter, the mechanical advantage the pilot has at the top of the mast is approximately 7:1 compared to the bottom of the mast with the actuator attached. In this case 300 pounds of force applied by the actuator is equivalent to 43 pounds of force applied by the driver. Similarly, while actuators can produce very large forces, the force limiting links described below generally do not transmit such an order of magnitude of force to the ground base of the cyclic control unless a stiffer force limiting link is installed.

In one embodiment, the autopilot is capable of determining whether the state of the hydraulic control system of the helicopter is in a normal mode or a fault mode based on the input of the sensor. In the normal mode, the inner loop is capable of generating a control signal for the actuator motor based on a first normal set of parameters. In the failure mode, the autopilot is capable of generating control signals for the actuator motor based on the second set of failure parameters. The fault parameter may account for any control variation introduced by the loss of hydraulic assist for cyclic stick actuation. For example, compensation for dead or lag zones can be adjusted. As another example, compensation may be introduced in view of extreme cycling that may occur in dead zones such as auto-dithering. These parameter sets, etc. may be suitably stored in a memory accessible to the MCP, which will be discussed below.

Having described the mechanical components of the autopilot in detail above, it is now appropriate to describe the autopilot in terms of the relationship between the above-described components and the associated control electronics. Specifically, fig. 5 is an embodiment of a block diagram of the autopilot 12. In this regard, the main unit 30 includes a housing 31, a pitch and roll actuator 60, and electronics 66, and the main unit 30 may be referred to hereinafter as a Motor Control Processor Unit (MCPU) or an autopilot main unit 30. The MCPU includes three microprocessors, each of which may be referred to as a Motor Control Processor (MCP). There are three MCPs, labeled MCP a, MCP B, and MCP C, respectively. These processor units each access a dedicated sensor suite of MEMS triaxial rate sensors and MEMS triaxial accelerometers, which are designated by reference numerals 142a, 142b and 142c, respectively. In the present embodiment, each of these sensor packages is constructed identically. The MCP is used to provide the inner loop of the overall control system with an inner control loop and an outer control loop. The MCP provides commands to motors a and B of the brushless DC motors, pitch actuator 60a and roll actuator 60B, to drive the helicopter's control system. All inter-processor communication can be performed over a serial bus provided by each processor itself. For example, the integrity of the data can be protected by using a Cyclic Redundancy Check (CRC) incorporated into the data stream.

The federal aviation administration certifies the on-board system software under version DO-178. At the time of the transcription of the software, DO-178C has been released. This document specifies a Design Assurance Level (DAL) based on the criticality of software failures in a given system. For example, DAL a is designated as "devastating" and is assigned to situations where a fault may cause a crash. As another example, DAL C is designated as "severe" and is assigned to a situation where the fault is important and may cause occupant discomfort or increase staff load. In this embodiment, each of the three MCPs is capable of executing the same DAL a software to form a triple redundant system. The motor control processors are interconnected so that they can share data. Each processor reads its sensor suite and compares its data to sensor data from the other two processors for consistency purposes, and each motor control processor calculates an average of all the respective sensors for further processing. In another embodiment, a median value can be determined as opposed to an average value. The sensor data determined to be erroneous is culled so as not to affect the mean value. Generally, fault detection of the sensors can be achieved by removing noise by low pass filtering the sensor data from each of the three sensor suites (as opposed to the presence of random noise). The filtered outputs are compared to each other for consistency, and if one filtered result is significantly different from the other two (e.g., outside of a predetermined threshold), the sensor associated with that data can be declared to have failed. Failure detection of the rate gyroscope can be achieved in a similar manner to the additional step of passing the gyroscope data through a washout filter before passing through a low pass filter, thereby removing the effects of drift or drift. Once processed through the two filters, the gyroscope data outputs can be compared to each other for consistency, and any gyroscope that produces an out-of-range value can be declared to have failed. The acoustic and/or optical warning signals may be sent to an Autopilot Display Processor Unit (ADPU)28 (fig. 1) on the instrument panel 20. Tactile feedback such as joystick shaking can be used alone or in combination with other alarm signaling devices. In an embodiment, the annunciation 150 may include status lights (which are best shown in the enlarged inset view of the ADPU in fig. 1, and include green (normal), yellow (warning), and red (fault) lights) and a dual alarm horn that provides an indication of the system condition. The alarm horn also provides system condition notification and alerts along with status lights. Both the status light and the horn are directly connected to the MCP. In some embodiments, sounds and/or warnings can be transmitted via the audio system of the helicopter so that notifications can be heard by the driver's headset and issued from the ADPU. A means to supplement the status lights and horn is a display that provides current autopilot system settings such as engaged status, course, dependent gyro heading, ground speed, and any warning messages. A test button is also provided on the panel to initiate an existing self-test (IBIT).

The autopilot 12 may be configured to generate actuator control signals based on a set of sensor signals used by the MCP to control the flight of the helicopter in one of a plurality of flight modes selected by the pilot. The MCP can further generate slave gyroscope output signals based solely on the same set of sensor outputs. As will be seen, the autopilot display can be configured to display autopilot flight mode information to the driver while displaying the output of the slave gyroscope to the driver based on the output signal of the slave gyroscope. The autopilot display can be provided on a single screen that simultaneously displays the autopilot flight mode information and the output of the slave gyroscope, but this is not required. In one embodiment for generating an output of a slave gyroscope, the sensor arrangement comprises a yaw rate gyroscope generating a yaw rate output. The MCP is configured to integrate the yaw rate output to produce a yaw heading. Because yaw rate gyroscopes exhibit significant drift, especially when using MEMS rate sensors, MCP periodically updates the yaw heading to compensate for the yaw rate drift. In an embodiment, the sensor device includes a GPS that generates a GPS course, and the processing device periodically updates the yaw course based on the GPS heading. In another embodiment, the sensor device includes a magnetometer device that generates a magnetic signal heading, and the processing device periodically updates the yaw heading based on the magnetic signal heading.

In another embodiment for generating an output of a slave gyroscope, the sensor device comprises a three-axis rate gyroscope and a three-axis accelerometer, and the processing device is configured to generate a helicopter attitude comprising a yaw heading. The attitude can be determined by the inner ring using a set of sensor outputs on a substantially instantaneous basis. In one embodiment, the pose can be monitored or tracked by an inner loop based on integration of the output of the rate sensors. In another embodiment, the inner loop is capable of determining helicopter attitude based on a direction cosine matrix. The direction cosine matrix can be interchangeably referred to as a rotation matrix, which characterizes one reference coordinate system with respect to the other according to the rotation. The output of the rate sensor gyroscope is used as an integral input to determine the attitude of the helicopter. In this regard, all determinations can be made from vector cross-products and dot-products. In another embodiment, quaternions may be used to determine the attitude of the helicopter. In either case, since the determined yaw heading is affected by the yaw rate drift exhibited by the three-axis rate gyroscope, the processing device is configured to at least periodically adjust the yaw heading to compensate for the yaw rate drift and generate an output of the slave gyroscope. The yaw heading can be periodically updated based on the magnetic heading or the GPS heading.

The MCP can also read hall sensor data from the actuator motors, which can be used to indicate the current position of each actuator as well as command signals from an Autopilot Display Processor (ADP) that forms part of the ADPU. In this regard, the ADPU acts as an outer control loop that provides command signals to the inner loop. With all of these data, each MCP calculates control signals for the motor based on PWM (pulse width modulation) and direction of rotation. Each processor also uses the hall sensor data to control the power connection to the armature of the brushless motor to which it is assigned. Each MCP uses its PWM command signals and rotational direction for the pitch and roll actuators to compare with the commands generated by the other two MCPs for consistency. Since all processors use the same data to calculate the motor commands, they should produce the same output signal. Signals for coincidence or non-coincidence with the other two processors are sent to a voting section (determination section) 200, and the voting section 200 will disable the control input capability of any MCP that is not coincident with the other two MCPs. In the present embodiment, the voting section 200 is implemented in hardware, however, a software embodiment can also implement the voting section 200.

With reference to fig. 3, attention is now directed to further details regarding actuator 60. It should be appreciated that for gear ratio 1750:1, one rotation of motor A and/or motor B rotates the actuator output shaft only about 0.2 degrees. Essentially, this rotation is sufficient for monitoring the output position of the actuator. For example, a magnet mounted on the shaft may be used to detect rotation of the motor shaft, as is well known to those skilled in the art. However, in embodiments, hall sensor data from the motors may be used to determine incremental positions of the actuator output shafts of the respective actuators. In this regard, each actuator motor includes 3 hall sensors. The hall sensor pulse may act as an incremental up/down counter. The position of the arm/output shaft relative to the reference point can be continuously tracked. For example, a zero reference position of the actuator output shaft may be defined when the actuator is engaged via clutch 84. Such zero reference position tracking can be used for certain faults, where the best approach is to restore the actuator shafts to their average position before the fault occurs. Since each motor includes 3 hall sensors and 4 magnetic poles, there are 12 hall state changes per rotation of the respective motor. Notably, by monitoring the Hall state change, the resolution can be increased by a factor of 12, providing a resolution of about 0.017 degrees at the output shaft of the actuator. In an embodiment, the corresponding movement at the top of the rod in fig. 1 may be about 0.004 inches.

As described above, each individual motor is controlled by one MCP. Each individual motor is controlled by one MCP. Thus, only MCP a and MCP B control the motor. Specifically, MCP a controls motor a in each of pitch actuator 60a and roll actuator 60B, while MCP B controls motor B in each of pitch actuator 60a and roll actuator 60B. Mcpc (third processor) does not control the motor, but performs all calculations that produce joystick commands as if it were controlling the motor. In this regard, a third motor may be readily added to each actuator (see fig. 4), which would engage gear 102 in the same manner as motor a and motor B, but which would respond to mcpc. However, the MCP C votes in the same way as the other two processors. For example, if MCP A and MCPC agree on pitch motor control and MCP B disagrees, MCP B will be denied permission to no longer control its pitch motors, and MCP B will still control its roll motors unless MCP A and MCP C also vote that MCPB is no longer controlling its motors. On the other hand, if MCP C is rejected, then none of the actuator motors is affected, but the warning lights and speakers will be actuated, as is the case with the MCP controlling the motors. Further details regarding this architecture will be provided below.

The actuators are designed so that either motor a or motor B can drive the actuators independently to control the helicopter. The output shaft of the failed motor will be rotated by the remaining motors. If one of MCP A or MCP B is rejected, the autopilot can continue to function despite the fact that each of these MCPs controls the motors. As described above, there may be a brief sounding of a warning light and horn to notify the driver of a non-critical malfunction of the autopilot.

MCPs have full authority and speeds of about 5 inches per second are limited only by the natural response of the system. MCP controls are the only part of the autopilot that can generate critical or major dangerous faults due, at least in part, to the speed of joystick motion. Thus, the MCPU is designed to be triple redundant, such that the DAL a of the designated software is used to operate the inner loop of the autopilot. These factors greatly reduce the likelihood of critical failures. However, applicants have recognized that the software corresponding to the outer ring can be distinguished from the inner ring software in a manner that allows the outer ring software to be specified with a different design level guarantee than the inner ring. In this embodiment, a lower DAL C certification is applied to the outer loop software, since the latter will not cause a serious failure. In this regard, the outer control loop retains more limited control authority than the inner loop. That is, the outer ring can only command only small fast actuator movements and slow large actuator movements. In contrast, the inner loop can change rapidly in response to gusts and other sudden changes in attitude, while the changes in the outer loop are designed to maintain the navigation target parameters and the requirements for adjustment. In this regard, the frequency responses of the inner and outer control loops are separated from each other so that the two loops do not interact to produce oscillation. That is, even if the outer ring fails, the helicopter continues to maintain attitude (which is a benign failure), with appropriate warnings issued by speakers and lights. In another embodiment, the outer loop software can authenticate under DAL a conditions, as the inner loop software. Furthermore, we will see that the outer loop of the present embodiment includes a lower level of hardware redundancy.

The outer loop software is processed by an ADP (autopilot display processor) in the ADPU 28. The MCP converts requested autopilot commands from the ADP into actuator control signals capable of driving the actuator motors within defined operating limits. In this regard, it should be appreciated that DAL A software is processed by the triple redundant MCP, while DAL C (i.e., the outer loop software) is processed by a completely different processor. By way of further illustration, a single executable software is run on each MCP. The MCP, which may be referred to as a triplexer, is capable of executing equivalent software. Thus, the autopilot control law distinguishes between ADP and triplex processors. ADP processes outer loop dynamics and autopilot mode, while triplex MCP processes inner loop dynamics. The outer-loop control law relates to navigation functions, while the inner-loop control law relates to attitude control on an at least approximately instantaneous basis. The ADP further provides a driver graphics and test interface to the autopilot and executes the autopilot control law to determine actuator commands based on sensor and GPS data. Thus, the processor interfaces directly with the GPS and the three-axis magnetometer and indirectly with the three-axis accelerometer and the three-axis rate gyroscope of the MCP providing roll rate, roll attitude, pitch rate, pitch attitude, position, altitude, ground speed, course, yaw rate, acceleration, and heading data. ADP monitors the health of these sensors, but does not verify the validity of the data. The IBIT test switch is also connected to ADP. In another embodiment, which has not been described in detail, the ADP can be designed in the same way as the MCPU with triple redundancy. When both MCPU and ADP are in a triple redundant configuration, the autopilot can tolerate a single failure in either or both units and still function properly. When a triple redundancy design is employed in both the inner and outer rings, a fail-function design results. Thus, elements in the inner loop, such as MCP (triplex processor), or elements in the outer loop, such as triplex ADP processor, may fail and the autopilot may still function properly.

MCP accepts data from ADPs, which can include instructions as well as data from external GPS. Each MCP may screen the data to detect errors or faults. The control instructions are rate-shifts limited by the MCP. MCP does not allow instructions from ADP to produce dangerous responses from the helicopter. The GPS data is used for ADP. Both the GPS data and the magnetometer data are used for the MCP to remove drift errors associated with the rate sensors of each sensor suite and to determine roll, pitch, and heading. Error checking can also be performed on the GPS data.

The MCP constantly monitors for internal and external faults. In the case of ADP failure, either MCP can immediately recognize this situation based on the update rate and the compliance of the control signals. In response, in one embodiment, the MCPU then causes the inner ring to hold the helicopter steady flat flight. In another embodiment, the MCPU can function in the manner of an SAS (stability enhancement system) or dead reckoning system and control the helicopter based on the internal rate signal. The MCP will attempt to maintain attitude and also actuate the horn and lights to indicate a fault. Experience has shown that helicopters can maintain extended flight times with MCP control alone, providing more time for the pilot to take control measures and disengage the autopilot. The ability to detect excessive autopilot response is in triple motor control, as will be described in detail herein. The triplex processor monitors the sensors and also checks to confirm that the calculated response is within limits. The pitch and roll instructions from the ADP are limited based on filtering of the pitch and roll instructions from the ADP by the respective triplexers. Each triplex processor is capable of detecting whether a limit has been exceeded and of initiating a safe shutdown of the autopilot. It is also possible to monitor the pitch axis command and the roll axis command using different limits. The monitor is dynamic; that is, the limit may be frequency/rate dependent. Redundant management features for each axis may include joystick rate limiting and body rate monitoring.

Each MCP processor may be provided with an independent power supply. An overall power failure of the helicopter's power system can result in the locking of the actuator in place for about five seconds using the dynamic braking feature described in detail below. This five second period is sufficient for the driver to take over control. In this regard, the autopilot does not allow the cyclic stick to suddenly flutter by releasing control in response to a power failure of the autopilot. However, even if the actuators are locked, the operator is still able to control the helicopter because an override or force limiting link 300a (pitch, see fig. 1) and 300b (roll, see fig. 1 and 2) is provided between each actuator and the cyclic control. These links are rigid for forces below the unseating value and flexible at higher forces, allowing the pilot to safely maneuver and land the helicopter even if separation of the system is not possible. Experience has shown that the pilot is able to control the helicopter, including hovering and landing, with both actuators in a so-called "locked" state. The locked state is provided by shorting all windings of the actuator motor and is used in the dynamic braking embodiment described below. An override linkage is described in detail in U.S. application (attorney docket number HTK-4), commonly owned by the same owner and having the same filing date as the present application, and incorporated herein by reference. In helicopters that do not use a hydraulic interface connected to the cyclic control, vibration isolators 302a (pitch) and 302b (roll) of the cyclic control may be positioned on the output shaft of each actuator. The vibration isolators may optionally be used with helicopters having hydraulic cyclic control, as hydraulic systems typically provide damping of cyclic oscillations. Vibration isolators dampen both rotary oscillatory motions in each rotary oscillatory motion are present in the control links of R22 rotorcraft and other lightweight helicopters to prevent rotary-wing aircraft controlled vibration loads and increase actuator component fatigue life. Cyclic-pitch vibration isolators are described in detail in separate patent applications.

As shown in FIG. 5, the sensor suite of each MCP may also include a memory, such as an EEPROM or other suitable memory. If during operation the MCP detects an error, an error code can be stored in the EEPROM of the sensor suite associated with the MCP. Subsequently, the EEPROM is read in the context of determining the cause of the failure. The EEPROM can also contain parameters specific to the model of the autopilot-mounted helicopter, such as control loop constants, sensor bias and gain. As another example, the EEPROM may store different sets of parameters for operation during normal hydraulic assist cycle control and for operation in response to detection that the hydraulic assist system has failed.

Fig. 6 is a schematic diagram of an embodiment of the voting section 200 of fig. 5. It should be appreciated that a software version may be readily implemented by one of ordinary skill in the art based on the illustrated hardware configuration. The main unit electronics 66 (fig. 2 and 5) includes separate drivers for motor a and motor B of each actuator. Specifically, the first motor driver 600 drives the motor B of the roll actuator 60B, the second motor driver 602 drives the motor B of the pitch actuator 60a, the third motor driver 604 drives the motor a of the roll actuator 60B, and the fourth motor driver 606 drives the motor a of the pitch actuator 60 a. In this regard, each MCP generates separate instructions for pitch and roll (targeted to pitch and roll actuators 60a, 60 b), respectively. For example, MCP a provides pitch actuation to motor a of actuator 60a and roll actuation to motor a of actuator 60 b. For purposes of the present invention, a logic high signal on the disable input 610 (shown as 610 a-610 d, respectively) of each driver will result in disabling that driver, although any suitable logic scheme may be employed. During normal operation, these drivers operate in a manner familiar to those of ordinary skill in the art with respect to driving the armature windings of a brushless dc motor in a timed coordinated manner. It will be seen that the state of a given motor is determined independently based on independent pitch and roll voting indications made by the MCP that does not control the given motor.

Still referring to FIG. 6, the disable inputs 610 a-610 d of each motor drive are electrically connected to a respective output of one of the sets of two-input and gates 614 a-614 d. In addition, each AND gate 614 receives voting indications from two MCPs that are not associated with the particular motor driver connected to each AND gate. For example, the AND gate 614a of the drive 600 of motor B, which is capable of disabling the roll actuator 60B, receives a first roll voting indication from MCP A, denoted as "MCP A vs B roll vote", to indicate that the vote made by MCP A approves or disapproves the command produced by MCP B. Similarly, the AND gate 614a receives a second side-roll voting indication from MCP C, denoted as "MCP C vs B side-roll voting," to indicate that the vote made by MCP C approves or disapproves of the instruction produced by MCP B. Thus, the roll votes by MCP a and MCP C are separate indications by the two MCPs that the current roll bar motion instruction generated by each of MCP a and MCP C approves or disapproves of the current roll bar motion instruction generated by MCPB. In this embodiment, the feature that the vote by MCP a or MCP C opposes or disfavors the roll command of MCP B is a logic high level, and if only one of MCP a and MCP C votes against the roll control of MCP B, only one and gate 614a input is a logic high level, so that the output of and gate 614a remains a logic low level, which does not disable the driver 600, thereby maintaining the motor B of actuator 60B in a normal operating state. On the other hand, if both MCP a and MCP C vote against the roll control of MCP B, then the and gate 614a will output a logic high that disables the motor drive 600 in order to disable motor B of the roll actuator 60B. As shown in fig. 6, control of each of the remaining three motors is accomplished in a manner consistent with the foregoing description.

Attention is now directed to further details regarding the inner and outer control rings of the present invention. In an embodiment, the inner loop may be configured to provide control of one or more selected orientation parameters of the helicopter, for example including a given level of redundancy and/or attitude retention applied to software certification (e.g., DAL a) of the inner loop. It is noted that such a pose maintenance embodiment is interchangeably referred to as a true pose embodiment, as will be further described. The outer loop of the autopilot may be configured to provide at least one navigational function to the flight of the aircraft, including different levels of redundancy (e.g., a single processor as compared to the triplex processor of the inner loop) and/or software authentication (e.g., a DALC as compared to DAL A for the inner loop). The level of redundancy and/or authentication applied to the inner ring may be higher than the level of redundancy and/or authentication applied to the outer ring. Any suitable combination of mechanical redundancy and software authentication may be used to implement the inner and outer control loops based on the teachings disclosed herein. In this regard, embodiments that employ triple redundancy processing in the inner and outer control loops are described in detail below. It should be appreciated that the architecture of the autopilot embodiments described herein provides upgrades that can be limited to replacing less important portions of the system. For example, the ADPU 28 of fig. 5 serves as the outer loop and can be authenticated as DAL C. The ADPU can be replaced or upgraded without affecting the inner ring. For example, an upgraded ADPU may add additional autopilot navigation modes and/or levels of hardware redundancy and/or levels of software authentication.

FIG. 7 is a flow diagram, indicated generally at 700, illustrating an embodiment of a method for operating an inner ring 702 and an outer ring 704 and the interaction between the rings. The method starts at 710 and proceeds to step 712 where the ADP instruction passed from the outer loop is read at step 712 as will be further described. At present, it is sufficient to note that the acquired ADP instruction is used for each iteration through the inner loop. In step 713, an ADP instruction filtering decision is made as to whether the ADP instruction is within acceptable limits, such as described above. If the instruction is acceptable, operation proceeds to step 714. On the other hand, if the instructions are not acceptable, operation proceeds to a fault process 716, which may initiate issuing a warning and/or shutting down the autopilot. In step 714, each MCP reads the sensors of its sensor suite (fig. 5) at the same time that the ADP reads the ADP sensor 718 and GPS 719. In step 720, ADP sensor data is shared with MCP. In step 722, the MCPs share MCP sensor suite data with each other (fig. 5) to form a set of average sensor data used by the individual MCPs and shared with the ADP. Other suitable embodiments may determine the median set of sensor data. Further, as indicated by connection line 724, MCP determines the attitude of the helicopter that is also shared with the ADP. In step 726, each MCP determines actuator motor commands. In step 728, voting is performed based on the instruction, for example using the hardware implementation of FIG. 6 or a software equivalent. In step 729, the voting results are compared. In the event of a processor dispute, operation proceeds to failure process 716. Any suitable action may be considered fault handling based on the voting results. For example, as described above, if control of one motor of a particular actuator is denied, that motor may be deactivated. Appropriate warnings may be issued. If a voting dispute is not identified at step 729, operation proceeds to step 730, where the motors are actuated based on the vote at step 730.

Still referring to FIG. 7, attention is now directed to further details regarding the operation of the outer ring 704. Notably, the inner loop 702 and the outer loop 704 are executed in parallel. In this regard, in step 740, the outer loop determines ADP commands based on the current flight mode and control law for the particular rotorcraft for which the autopilot is installed. The control laws and associated parameters can be customized on a per-rotor basis. With the data from the ADP sensor 718 and GPS 719 combined, the attitude of the helicopter generated at step 722, based at least in part on the rate data from the MCP and the inner circle, is determined. In step 760, instruction filtering is applied to limit the ADP instructions from being subsequently used by the inner loop. The current ADP instruction is filtered and then read by step 712. In this regard, it should be appreciated that step 726 applies instructions limited to ADP instructions, as described above.

FIG. 8 is a drawing of a drawing illustrating a motion generally indicated by reference numeral 800Schematic illustration of an embodiment of a dynamic braking system that may be used, for example, with the actuator 60 of FIG. 3. As described above, each motor may include a star-connected stator. Specifically, each motor includes three stator coils, designated A1-A3 for motor A and B1-B3 for motor B. For purposes of the present invention, it is noted that the motor is selected to characteristically exhibit a resistance to rotation of the drive shaft of the motor in response to the drive coil being open or grounded. For example, as shown in FIG. 6, the sets of motor driver lines 802, 804 are connected to respective motor drivers. Each stator coil is also electrically connected to the drain terminal D of one of a set of 6N-channel enhancement MOSFETs, respectively designated 806a-f and which may be collectively referred to as MOSFETs 806. The source terminal S of each of these transistors is connected to ground 810. Thus, a positive voltage on the gate terminal G of these MOSFETs turns on the respective MOSFET so that the drain to source is substantially shorted in order to act as a switch to connect or short the associated stator to ground. Drive circuit 820 receives input power from the helicopter (denoted as V)_in) And may also include battery power from the helicopter for the purpose of powering the autopilot. It should be appreciated that V_inShould reflect or match any failure of the power supply that provides power to the autopilot. For drive circuit 820, the input power for proper operation may range from 9-32 volts DC. When the power is turned on, the zener diode D2 regulates the voltage to 9 volts during normal operation of the helicopter, thereby biasing the voltage of the gate terminal of the P-channel depletion MOSFET830 to 9 volts. Current flows through diode D1 and the 1K ohm resistor to the other zener diode D3, zener diode D3 biases the voltage at the source terminal of MOSFET830 to 7 volts, also charging capacitor C1 to 7 volts. Thus, V of MOSFET830_GSA 2 volt direct current, so that the transistor is biased in the off state. Since MOSFET830 is in the OFF state, the voltage at the drain terminal of the MOSFET is zero volts, biasing the gate of each MOSFET 806 to zero volts, so that each of these transistors is also in the OFF stateStatus. It will be seen that capacitor C1 acts as a power storage device, providing V in response_inThe failure of the power supply acts as a dynamic power supply.

Still referring to FIG. 8, in response to a power failure (where V_inTo zero volts) the gate voltage of MOSFET830 drops to zero volts that turns on the transistor. After MOSFET830 is turned on, it provides a discharge path for capacitor C1 to a 100K ohm resistor R3. This discharge current causes a positive gate voltage to be applied to each MOSFET 806, causing these transistors to conduct, thereby connecting the stator coils of motor a and motor B to ground when capacitor C1 discharges through R3. Thus, MOSFET 806 will remain in the on state based on the RC time constant, which is primarily determined by capacitor C1 and resistor R3. In this example, the time constant is about 4.7 seconds. In practice, MOSFET 806 will remain on for about 4 seconds. Although this time period may be varied by the choice of element values, it should be chosen to provide a time period that is: this time period is sufficient for the driver to take over the manual control of the autopilot. As described above and shown in fig. 1 and 2, the pilot can take over and maintain control of the helicopter even during periods when the brakes are applied due to the presence of the force limiting links 300a, 300 b. Those skilled in the art will recognize that the circuit of fig. 8 may be readily modified and adjusted for specific device considerations. Although the present embodiments have been described in terms of the use of MOSFETs, it should be appreciated that other embodiments may employ any suitable type of transistor using one transistor type or a suitable combination of different types of transistor types. By way of non-limiting example, suitable transistor types include bipolar transistors, junction field effect transistors, insulated gate field effect transistors, and the like.

Referring to fig. 5 in conjunction with fig. 8, it will be appreciated that two examples of the circuit of fig. 8 are used. That is, one example of the circuit of fig. 8 is connected to the motors of each roll actuator and pitch actuator. Based on the time constant, the motor coils are temporarily short-circuited to ground, thereby generating resistance to rotation of the output shaft of each motor. The degree of resistance is amplified by the gearing of the actuator, so that a considerable force is required to move the rod from the position where the power failure occurred. Empirical results indicate that the stick will not suddenly jump in response to a power failure of the autopilot, while allowing ample time for the driver to take over the autopilot to control the helicopter. It should be appreciated that dynamic braking, as taught herein, may be used for any motor that exhibits resistance in response to at least shorting selected drive coils.

FIG. 9 illustrates another embodiment of a dynamic braking system, indicated generally by the reference numeral 900, which may be used, for example, with the actuator 60 of FIG. 3. In the present embodiment, the motor windings are each denoted NC₁、NC₂And NC₃One terminal of the normally closed contact of (1) is connected. The other terminal of each NC contact is connected to ground 810. Each of the first relay 902 and the second relay 904 includes a relay composed of V_inA driven relay coil. While the present example illustrates the use of 3-pole single throw relays (having only normally closed contacts) associated with each motor, it should be appreciated that any suitable type of relay may be used. During normal operation, V_inIs applied to each relay coil so that the normally closed contacts are in an open state. However, if V is lost_inThen the normally closed contacts are closed to connect the respective stator coil to ground, thereby applying dynamic braking as described above. As described above and shown in fig. 1 and 2, since the electric motor remains in the braking state in response to a power failure, the pilot can also take over and operate the helicopter due to the presence of the force limiting links 300a, 300 b.

While the above-described dynamic braking embodiments have been described in the context of applying a braking force to a cyclic stick, it should be appreciated that the braking force may be applied, without limitation, to any suitable control linkage mechanically coupled to an actuator motor. For example, dynamic braking may be applied to the tail rotor pedals of a helicopter. As another example, dynamic braking may be applied to the collective lever. Further, some embodiments may employ dynamic braking without the use of actuators as part of an autopilot system.

Attention is now directed to fig. 10, which is a block diagram illustrating another embodiment of the autopilot of the present invention and is generally referred to by the reference numeral 1000. In the case where the autopilot 1000 corresponds to the aforementioned autopilot 12 of fig. 5, the description of the same components will not be repeated for the sake of brevity. The main difference with respect to the autopilot 1000 is that a triple ADP processing section is provided as a part of the ADPU 28', and the triple ADP processing section is denoted by reference numerals 1002, 1004, and 1006. MCPU 30' still includes a triplex processor or MCP, but is otherwise configured to cooperate with a triplex ADP. Each triple ADP processing section includes a dedicated sensor set denoted by 1010, 1012, and 1014, respectively. Like the ADP processing section of fig. 5, the triple ADP operates based on, for example, a control law relating to a navigation mode, and the MCP processes a control law relating to instantaneous attitude control in cooperation with the triple ADP to realize various navigation control modes. In this embodiment, each sensor package includes a three-axis magnetometer. Further, in the present embodiment, each triplex processing section receives GPS input from a dedicated GPS unit. In other embodiments, both GPS units may be used in combination with other suitable data sources that provide data such as airspeed and pressure-based altitude. In this regard, an embodiment may accept an instruction from another navigation unit. Such instructions may include, for example, roll and maneuver instructions. In some embodiments, more than three GPS units may be used. In another embodiment, a single GPS unit may be used in combination with other sensors for the purpose of providing redundancy. By way of non-limiting example, the pressure-based altitude may be used in place of the GPS altitude from the second redundant GPS by sensing static pressure for the pressure-based altitude. For the purpose of controlling the annunciation section 150, an annunciation voting section 1020 may be provided, and the annunciation section 150 may include a dual alarm horn; a green normal light; a yellow warning light and a red fault light. In a similar manner to the aforementioned voting section 200 of fig. 5 with respect to MCP motor control, voting section 1020 may vote to cause the annunciation control of either the triplex processor or the MCP (which disfavor the other two triplex processors) to be overruled. Each triplex ADP is in dedicated data communication with each MCP such that each MCP receives control commands from one ADP for the MCP generating the motor control signals. The individual ADP and MCP pairs can be run according to the flow chart of fig. 7. In this way, ADP commands generated by each ADP affect the motor control signals of its associated MCP, such that voting, as described above, causes the MCP associated with the failed ADP to overrule control of the motors. Of course, as described above, triplex ADP C does not serve the motor control capabilities associated with MCP C, but rather votes for comparison purposes. In another embodiment, as described above, the voting section 200 may operate based on the vote made by the ADP (which is generated in the same manner as the vote made by the MCP). Based on the above discussion, it should be appreciated that the embodiment of fig. 10 may be viewed as having fault tolerance as a failure function. That is, the autopilot can still function properly despite a complete failure of either triplex ADP processor or of either triplex MCP processor. Of course, a warning may be issued to indicate to the driver that a fault exists, but the autopilot may continue to operate without driver intervention.

While the above discussion details an embodiment of an inner control ring that provides a gesture retention function or a true gesture function (which provides for recovery from an abnormal gesture upon engagement), it should be appreciated that the inner control ring may be configured differently in other embodiments. For example, in another embodiment, the inner control loop may be a rate-based inner control loop. In such an embodiment, the inner control loop attempts to keep the rate at zero. That is, the inner rate-based control loop attempts to keep the current attitude of the helicopter at least somewhat constant regardless of the current attitude when the autopilot is engaged. In such embodiments, the inner loop is not required to correct for drift of the rate sensor in the MCP, except for, for example, a washout filter (which removes bias errors). Thus, the current attitude remains at least somewhat constant subject to drift of the rate sensor. Rate gyroscope drift can result in changes in track and pitch. Specifically, pitch drift may affect altitude hold mode and speed hold mode, while roll drift and yaw drift may affect track. In this regard, however, as described above, the outer control loop may compensate for attitude drift errors and make gradual and necessary changes to correct attitude drift errors in the same manner as errors due to, for example, long-term wind changes. For this reason, no sensors such as a tri-axial accelerometer in the inner control loop are required in this embodiment to provide correction for drift, since only rate gyro sensing is required. That is, the MCP sensor package shown in fig. 5 does not require a three-axis accelerometer. However, it should be remembered that the inner rate-based control loop is not able to determine the actual attitude or true attitude of the helicopter and therefore does not provide a reliable recovery to recover from an abnormal attitude when engaged. The term "true attitude" as used herein is intended to encompass, at least approximately, techniques that adequately characterize the attitude of an aircraft that may be subject to unavoidable errors such as, by way of non-limiting example, inaccurate measurements.

Continuing with the rate-based inner control loop embodiment, the structure of the inner control loop or the outer control loop described above may be maintained. The aforementioned accelerometers for the inner ring (fig. 5 and 10) can be moved to the outer ring and in embodiments, can also be reduced to only having a single axis for load (G) monitoring. In a rate-based system, the magnetometer remains part of the outer control loop. Since the drift of the rate gyro is indistinguishable from the drift of the wind, the outer loop control law can adjust for drift in the same way. In embodiments where an actual heading is not required as an input, a magnetometer may not be required in the ADPU, particularly when a GPS capable of providing a track output is incorporated. As described above, the inner control loop maintains full authority and limits the rate only by the response of the system. During operation, the inner loop issues the control signals needed to control the rate for the substantially instantaneous change in attitude. External control environmental protection holds more limited control rights: only small fast actuator movements and slow large actuator movements can be commanded. As with the attitude keeping embodiment, the differentiation of functionality between the inner and outer control rings provides for different stability and/or use of DAL software in both rings.

Turning attention now to fig. 11, fig. 11 is a table showing six modes of operation of the autopilot of the present invention relative to the sensor signals and values employed for each mode. The table of fig. 11 depicts 6 autopilot modes with respect to the column headings "inner loop" and "outer loop". The inner ring column header includes sub-columns divided in the following order: "modes," a "name" representing the name of each mode, "a" rate "representing an axis about which a particular rate gyro signal is measured," an "acceleration" representing an axis along which a particular accelerometer signal is measured, "a" course "representing a route or path on the ground," a "latitude/longitude" as a GPS location signal including latitude or longitude, "a" speed "representing a GPS-based speed or a sensor-based speed of the aircraft, and" magnetic strength "representing a particular axis along which a magnetometer reading is measured. The outer ring column header includes the same subcolumns as the inner ring column header, plus an "altitude" as a GPS-based altitude reading or an altitude reading determined by a pressure sensitive instrument and an "attitude" as the true attitude determined by the inner control ring.

Mode 1 is a rate-based course and speed hold mode, the inner loop of which uses a MEMS roll rate signal, a MEMS pitch rate signal, and a vertical accelerometer. The vertical axis accelerometer may be used in any mode to ensure that the load limits of the helicopter are not violated. That is, maneuvers that produce low gravity conditions for helicopters with dual-bladed rotors and maneuvers that produce high gravity conditions that exceed the structural limitations of the helicopter can be avoided. The outer loop of mode 1 uses the GPS course, MEMS yaw rate signals, and pitch rate and vertical accelerometer signals. As with any mode, the speed signal may be obtained from a GPS or provided by a flight speed sensor of the aircraft. In some embodiments, the outer loop for mode 1 may employ GPS information in place of the pitch rate signal and/or yaw rate signal.

Mode 2 is a rate-based course and altitude hold mode, the inner loop of which uses a MEMS roll rate signal, a MEMS pitch rate signal, and a vertical accelerometer. The outer loop of mode 2 may use the same signal as the outer loop for mode 1, plus the height signal. The altitude signal may be GPS-based information or obtained from a pressure-based altitude sensor.

Mode 3 is a velocity-based hover or position-hold mode, the inner loop of which uses a MEMS roll rate signal, a pitch MEMS rate signal, and a vertical accelerometer. The outer loop of mode 3 may use the same signals as for the outer loop of mode 1, plus a MEMS yaw rate signal and a GPS position signal providing latitude and longitude. Since this mode does not control the height in this embodiment, the height signal is not required. However, it should be appreciated that the altitude signal may be employed for the purpose of indicating the current altitude to the driver and/or indicating a change in the desired altitude to the driver. Horizontal magnetometer signals that can be oriented along the pitch and roll axes of the rotorcraft are also employed.

Mode 4 is a true attitude course and velocity maintenance mode, the inner loop of which uses a MEMS triaxial rate sensor, a MEMS triaxial accelerometer, and a triaxial magnetometer. The latter also utilizes GPS course signals and may use GPS speed signals. In another embodiment, the speed signal may be provided by a flight speed sensor of the aircraft. The outer loop of mode 4 uses the GPS course signal along with the pitch and yaw rate signals, the vertical accelerometer signal, the aircraft attitude estimate and the velocity signal of the inner loop. In some embodiments, the outer loop for mode 4 may employ GPS information in place of the pitch rate signal and/or yaw rate signal and/or aircraft attitude estimate.

Mode 5 is a true attitude course and altitude hold mode, the inner loop of which uses a MEMS triaxial rate sensor, a MEMS triaxial accelerometer, and a triaxial magnetometer. The latter also utilizes GPS course signals and may use GPS speed signals. In another embodiment, the speed signal may be provided by a flight speed sensor of the aircraft. The outer loop of mode 5 may use the same signal as the outer loop used for mode 4, plus a GPS signal or a pressure-based altitude signal. In some embodiments, the outer loop for mode 5 may employ GPS information in place of the pitch rate signal and/or yaw rate signal and/or aircraft attitude estimate.

Mode 6 is a true attitude hover/position hold mode, the inner loop of which uses a MEMS tri-axis rate sensor, a MEMS tri-axis accelerometer, and a tri-axis magnetometer. The latter also utilizes GPS course signals and may use GPS speed signals. In another embodiment, the speed signal may be provided by a flight speed sensor of the aircraft. The outer loop of mode 6 may use the same signals as the outer loop for mode 4, with the addition of a yaw rate signal and a GPS position signal providing latitude and longitude. In some embodiments, the outer loop for mode 6 may employ GPS information in place of the pitch rate signal, yaw rate signal, and/or roll rate signal and/or aircraft attitude estimate.

The foregoing description of the invention has been presented for purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form or forms disclosed. For example, a second example of the autopilot of the present invention in a particular installation may provide control of the collective and tail rotor pedals with appropriate software. Thus, full autopilot control can be achieved using a "first" autopilot as described above and a "second" autopilot that manages other flight controls. This variation or dual autopilot system includes four independent actuator drive shafts and may provide a mode of operation in which both speed and altitude are maintained and/or another mode of operation in which both rate of descent or ascent or speed is maintained without driver control input. Typically, in such embodiments, the inner loop of the second autopilot may use the pedal actuator to manage sideslip and the collective lever actuator to maintain the height constant. As described above, since the inner ring of the first autopilot is able to keep the pitch angle constant, the flying speed can be kept constant via pitch angle management. For this configuration, the second autopilot may manage altitude using a collective joystick actuator. For collective stick input, altitude hold or rise/fall rate requirements may be based on GPS or pressure data, for example in an outer loop control mode that manages the flight method or VNAV (vertical navigation) (there is a vertical navigation speed requirement). Accordingly, other modifications and variations are possible in light of the above teachings, wherein those skilled in the art will recognize certain modifications, permutations, additions and sub-combinations thereof.

Preferably comprising all the elements, components and steps described herein. It will be understood that any of these elements, parts and steps may be replaced by other elements, parts and steps or deleted entirely as will be apparent to those skilled in the art.

Disclosed herein are at least the following: a helicopter autopilot system includes an inner loop for providing attitude hold for the flight of a helicopter that includes a given level of redundancy applied to the inner loop. The outer loop is configured to provide navigation functionality for flight of the helicopter, and includes a different level of redundancy than the inner loop. The actuator provides a braking force acting on the linkage for stabilizing the flight of the helicopter during a power failure. The actuators are electromechanical and receive electrical drive signals to provide automatic flight control of the helicopter without the need for hydraulic assist systems in the helicopter. The autopilot system may operate the helicopter in a failure mode of the hydraulic assist system. Various flight modes, including rate-based true attitude modes, are described using relevant sensor inputs.

Conception of

Additionally, at least the following concepts are disclosed herein:

concept 1. an autopilot system for a helicopter, comprising:

an inner loop configured to provide a true attitude estimate for at least a flight of the helicopter, the inner loop including a given level of redundancy applied thereto; and

an autopilot outer loop configured to provide at least one navigation function for flight of the helicopter, the autopilot outer loop including a different level of redundancy than the inner loop.

Concept 2. the autopilot system according to concept 1, wherein the different redundancy levels of the outer loop are higher than the given redundancy level of the inner loop.

Concept 3. the autopilot system according to concept 1 or 2, wherein the inner loop is configured with a triplex processor for triple redundancy in the inner loop.

Concept 4 the autopilot system of concept 3 wherein the inner loop is further configured to cause the triplex processors to each simultaneously generate a motor control signal.

Concept 5 the autopilot system of concept 4 wherein the inner loop is configured to receive control commands from the outer loop at each iteration of the inner loop as part of each triplex processor generating the motor control signal.

Concept 6. the autopilot system according to any of the preceding concepts, wherein the outer loop is configured to iterate one-to-one with the inner loop.

Concept 7 the autopilot system of concept 4 wherein each triplex processor is configured to compare the motor control signal generated by that triplex processor with the motor control signal generated by each of the other two triplex processors and to make a first vote to favor or disfavor a first one of the other two triplex processors and a second vote to favor or disfavor a second one of the other two triplex processors based on the comparison.

Concept 8 the autopilot system of concept 7 wherein a first given triplex processor and a second given triplex processor of the triplex processors are each in control communication with at least one actuator motor and a third triplex processor generates the motor control signal and makes the vote but the third triplex processor is not in control communication with an actuator motor.

Concept 9 the autopilot system of concept 7 further comprising a voting manager that causes a motor control signal to have no effect on a particular one of the triplex processors when the votes of both of the other two triplex processors are against the particular triplex processor to indicate a failure of the particular triplex processor.

Concept 10 the autopilot system of concept 9 wherein the inner loop and the outer loop are still fully operational in response to a failure of a single one of the triplex processors.

Concept 11 the autopilot system according to concept 4, further comprising a pitch actuator and a roll actuator for applying pitch actuation and roll actuation, respectively, to control links of the helicopter, each of the pitch actuator and the roll actuator comprising a redundant set of motors having at least a first motor and a second motor, and a first triplex processor generating first processor motor control signals for controlling the first motor of the pitch actuator and the first motor of the roll actuator, and a second triplex processor generating second processor motor control signals for controlling the second motor of the pitch actuator and the second motor of the roll actuator.

Concept 12 the autopilot system of concept 11 wherein the pitch actuator and the roll actuator each include an output shaft and are each configured such that either or both of the first motor and the second motor of a given one of the actuators can rotate the given output shaft of the given actuator to provide control link actuation.

Concept 13 the autopilot system of concept 1 wherein the inner loop is configured with triplex processors for triple redundancy in the inner loop and further comprising a set of triplex sensor suites such that each triplex processor reads one of the sensor suites dedicated to that triplex processor to generate sensor data.

Concept 14 the autopilot system of concept 13 wherein each triplex processor is configured to share the sensor data from a dedicated one of the sensor suites with the other two triplex processors.

Concept 15 the autopilot system of concept 14 wherein each triplex processor is configured to determine a set of sensor data median values based on the sensor data from all of the triplex processors and configured to determine the motor control signal based on the set of sensor data median values.

Concept 16 the autopilot system of concept 15 wherein each triplex processor is configured to reject any erroneous sensor data.

Concept 17 the autopilot system of concept 16 wherein each triplex processor is configured to identify the erroneous sensor data based at least in part on a comparison of three sensor outputs to each sensor output produced by a given sensor of each of the sensor suites.

Concept 18. the autopilot system according to any of the preceding concepts wherein the outer loop is configured to operate based on a set of control laws for a particular helicopter.

Concept 19. the autopilot system according to any of the preceding concepts, wherein the helicopter comprises a cyclic control and the system further comprises actuator means for actuating the cyclic control to provide the attitude keeping and the navigation function.

Concept 20. a method employed in an autopilot system for a helicopter, comprising:

configuring an inner loop to provide attitude hold at least for flight of the helicopter, the inner loop including a given level of redundancy applied thereto; and

configuring an autopilot outer loop to provide at least one navigation function for flight of the helicopter, the autopilot outer loop including a different level of redundancy than the inner loop.

Concept 21 an actuator apparatus as part of an autopilot for providing automatic control of a helicopter by actuating one or more flight controls of the helicopter, the actuator apparatus comprising:

at least one motor including an output shaft and a motor coil arrangement for receiving a drive current for rotating the output shaft;

an actuator link operatively connected between the output shaft of the motor and the flight control such that rotation of the output shaft causes corresponding movement of the actuator link and the flight control; and

motor drive means for supplying said drive current from a power source during normal operation of said autopilot and at least for shorting said motor coil means in response to a failure of said power source so that said motor provides a braking force acting on said actuator linkage for stabilizing flight of said helicopter during said power failure.

Concept 22 the actuator device of concept 21, wherein the motor drive device is configured to electrically short-circuit the motor coil device.

Concept 23 the actuator arrangement of concept 21 or 22, wherein the motor drive arrangement comprises at least one MOSFET arranged to at least momentarily electrically connect the motor coil arrangement to a helicopter ground in response to the power failure.

Concept 24 the actuator arrangement of concept 21, 22 or 23, further comprising a storage capacitor that is charged in response to normal operation of the power supply, and the motor drive arrangement is configured to discharge the storage capacitor in response to a failure of the power supply by biasing the MOSFET into a conductive state to at least momentarily short circuit the motor coil arrangement.

Concept 25 the actuator arrangement of concept 22, wherein the motor comprises Y-connected stator coils having three branch coils, and the motor drive arrangement comprises a set of MOSFETs arranged to cooperatively momentarily short-circuit the branch coils in response to a failure of the power supply.

Concept 26 the actuator arrangement of concept 25, wherein the set of MOSFETs are arranged to electrically connect each branch coil at least momentarily to helicopter ground in response to the power failure.

Concept 27 the actuator device of concept 25, further comprising a storage capacitor that charges in response to normal operation of the power source, and the actuator device is configured to discharge the storage capacitor in response to a failure of the power source by biasing each MOSFET of the set of MOSFETs to a conductive state to at least momentarily short circuit the branch coil.

Concept 28. the actuator arrangement according to any of the preceding concepts, wherein the motor drive arrangement comprises at least one electromechanical relay arranged to short-circuit the motor coil arrangement in response to the power failure.

Concept 29 the actuator arrangement of concept 28, wherein the electromechanical relay comprises at least one normally closed contact arranged to electrically connect the motor coil to a helicopter ground in response to a failure of the power supply.

Concept 30. a method for controlling an actuator motor forming part of a helicopter autopilot system providing automatic control of a helicopter, the actuator motor including an output shaft operatively connected to a flight control of the helicopter and a motor coil arrangement for receiving a drive current for rotating the output shaft to actuate the flight control, the method comprising:

configuring a motor drive to provide the drive current from a power source during normal operation of the autopilot system and to cause the motor drive to at least short circuit the motor coil arrangement in response to a failure of the power source such that the motor provides a braking force acting on the actuator linkage for stabilizing flight of the helicopter during the power failure.

Concept 31. an autopilot system for a helicopter, the helicopter including a GPS unit that provides a GPS output, the autopilot system comprising:

a sensor device dedicated to the autopilot system and producing a set of sensor outputs that are characteristic of the flight of the helicopter;

a control device receiving said GPS output and said sensor output and generating an electrical drive signal in response thereto; and

an actuator that is electromechanical and that receives the electrical drive signal and generates a mechanical control output responsive to the electrical drive signal, the mechanical control output being mechanically linked to the helicopter to provide automatic flight control of the helicopter without the need for hydraulic assist systems in the helicopter.

Concept 32. the autopilot system of concept 31 wherein the actuator connects the mechanical control output to the cyclic in parallel with any pilot actuation applied to the cyclic of the helicopter.

Concept 33 the autopilot system of concept 31 or 32 wherein the control arrangement includes an outer control loop configured to provide at least one navigational function to the flight of the helicopter and an inner control loop configured to provide attitude hold to at least the flight of the helicopter.

Concept 34 the autopilot system of concept 33 wherein the inner loop includes a set of three triplex processors to provide triple redundancy in the generation of the electric drive signal, each triplex processor generating a roll control signal and a pitch control signal.

Concept 35 the autopilot system of concept 34 wherein a first and second of the triplex processors issue roll control signals to the roll actuator and issue pitch control signals to the pitch actuator and a third triplex processor does not provide roll control signals and pitch control signals to the actuator.

Concept 36 the autopilot system of concept 34 wherein the inner loop is further configured such that the triplex processors each simultaneously generate at least one motor control signal.

Concept 37 the autopilot system of concept 36 wherein the inner loop is configured to receive control commands from the outer loop on each iteration of the inner loop as part of each triplex processor generating the motor control signal.

Concept 38. the autopilot system according to any of the concepts 33-37, wherein the outer loop is configured to iterate one-to-one with the inner loop.

Concept 39 the autopilot system of concept 36 further comprising a pitch actuator and a roll actuator for applying pitch actuation and roll actuation, respectively, to control links of the helicopter, each of the pitch actuator and the roll actuator comprising a redundant set of motors having a first motor and a second motor, and the first triplex processor generating first processor motor control signals that control the first motor of the pitch actuator and the first motor of the roll actuator, and the second triplex processor generating second processor motor control signals that control the second motor of the pitch actuator and the second motor of the roll actuator.

Concept 40 the autopilot system of concept 39 wherein the pitch actuator and the roll actuator each include an output shaft and are each configured such that either or both of the first motor and the second motor of a given one of the actuators can rotate the given output shaft of the given actuator to provide control link actuation.

Concept 41 the autopilot system of concept 40 wherein the output shaft of each of the pitch actuator and the roll actuator is capable of providing at least 300 pounds of force to the control link of the helicopter.

Concept 42 the autopilot system of any of concepts 31-41 wherein the helicopter includes a cyclic control and the actuator provides a mechanical input to actuate the cyclic control.

Concept 43 an autopilot system for a helicopter, the helicopter including a hydraulic assist system that receives flight input control from a pilot and in turn generates a mechanical output in mechanical communication with the helicopter to provide pilot control of the helicopter, the autopilot system comprising:

a sensor device that generates a set of sensor outputs that are characteristic of the flight of the helicopter;

a control device receiving the sensor output and generating an electrical drive signal; and

an actuator arrangement that is electromechanical and that receives the electrical drive signal and that generates a control output responsive to the electrical drive signal, the control output being mechanically linked to the hydraulic assist system, and the actuator arrangement being configured to cooperate with the control arrangement to provide automatic flight control of the helicopter in a first normal mode with the hydraulic assist system in a normal operating condition and in a second fault mode with the hydraulic assist system in a fault operating condition to provide automatic flight control of the helicopter in each of the normal mode and the fault mode.

Concept 44 the autopilot system according to concept 43, wherein the sensor device is configured to sense an operating state of the hydraulic assistance system in one of the normal mode and the failure mode, and the control device generates the electric drive signal based on a first set of normal parameters detected in response to the normal mode of the hydraulic assistance system and a second set of failure parameters detected in response to the failure mode of the hydraulic assistance system.

Concept 45 the autopilot system of concept 43 or 44 wherein a failure of the hydraulic assist system creates a deadband for applying the mechanical control input and wherein the second set of failure parameters is configured to at least compensate for the deadband.

Concept 46. the autopilot system according to concept 43, 44 or 45, wherein the actuator device connects the control output to the cyclic control of the helicopter in parallel with any pilot actuation exerted on the cyclic control.

Concept 47. the autopilot system according to any of the concepts 43-46, wherein the helicopter comprises a cyclic control controlled by the hydraulic assistance system and the actuator arrangement provides a mechanical input to actuate the hydraulic assistance system.

Concept 48. a method for operating a helicopter including a hydraulic assist system configured to actuate at least a rotor system of the helicopter, the method comprising:

generating autopilot electrical control signals in response to flight of the helicopter; and

configuring an electromechanical actuator device to receive the autopilot electrical control signal and to connect a mechanical control output to the hydraulic assist system based on the autopilot electrical control signal, and to cooperate with a control device to provide autopilot control of the helicopter in a first normal mode with the hydraulic assist system in a normal operating condition and in a second fault mode with the hydraulic assist system in a fault operating condition to provide autopilot control of the helicopter in each of the normal mode and the fault mode.

Concept 49 the method of concept 48, further comprising sensing an operating condition of the hydraulic assist system in one of the normal mode and the failure mode, and generating the electric drive signal based on a first set of normal parameters detected in response to the normal mode of the hydraulic assist system and a second set of failure parameters detected in response to the failure mode of the hydraulic assist system.

Concept 50 the method of concept 49, wherein the failure of the hydraulic assist system creates a dead band that applies the mechanical control input, and the method includes configuring the second set of failure parameters to at least compensate for the dead band.

Concept 51. the method of concept 48, 49 or 50, further comprising connecting the mechanical control output to a cyclic of the helicopter in parallel with any pilot actuation applied to the cyclic.

Concept 52. the method of concept 48, 49, 51 or 50, wherein the helicopter includes a cyclic control controlled by the hydraulic assist system and the actuator arrangement is configured to provide a mechanical input to actuate the hydraulic assist system.

Concept 53. a flight control system for selectively automatically controlling forward flight of a helicopter, the forward flight characterized by a set of orientation parameters including a pitch orientation, a roll orientation, and a yaw orientation, the system comprising:

a MEMS triaxial rate sensor supported by the helicopter to generate a roll rate signal, a pitch rate signal and a yaw rate signal responsive to changes in the roll orientation, the pitch orientation and the yaw orientation, respectively;

a MEMS triaxial accelerometer for generating an accelerometer signal responsive to the forward flight;

a GPS receiver supported by the helicopter for generating a course signal, an altitude signal and a speed signal responsive to the forward flight of the helicopter;

a three-axis magnetometer for producing a magnetometer signal;

a controller supported by the helicopter to receive a set of inputs consisting of the pitch rate signal, the roll rate signal, the yaw rate signal, the accelerometer signal, the course signal, the magnetometer signal, the speed signal, and the altitude signal to determine a true attitude of the helicopter and to generate a set of control signals to maintain a stable forward flight orientation of the helicopter in accordance with a selected course defined on the ground and a selected altitude on the selected course; and

an actuator device that receives the set of control signals to adjust the forward flight of the helicopter based on the set of control signals.

Concept 54 the system of concept 53, wherein the GPS receiver comprises no more than one GPS antenna.

Concept 55. a flight control system for selectively automatically controlling forward flight of a helicopter, the forward flight characterized by a set of orientation parameters including a pitch orientation, a roll orientation, and a yaw orientation, the system comprising:

a MEMS triaxial rate sensor supported by the helicopter to generate a roll rate signal, a pitch rate signal and a yaw rate signal responsive to changes in the roll orientation, the pitch orientation and the yaw orientation, respectively;

a MEMS triaxial accelerometer for generating an accelerometer signal responsive to the forward flight;

a GPS receiver supported by the helicopter for generating a course signal and a speed signal responsive to the forward flight of the helicopter;

a three-axis magnetometer for producing a magnetometer signal;

a controller supported by the helicopter to receive a set of inputs consisting of the pitch rate signal, the roll rate signal, the yaw rate signal, the accelerometer signal, the course signal, and the speed signal to determine a true attitude of the helicopter and to generate a set of control signals to maintain a stable forward flight orientation of the helicopter in accordance with a selected course defined on the ground and a selected altitude on the selected course; and

an actuator device for receiving the set of control signals to adjust the forward flight of the helicopter based on the set of control signals.

Concept 56. a flight control system for selectively automatically controlling the flight of a helicopter capable of flying in a hover mode, the hover being characterized by a set of orientation parameters including a pitch orientation, a roll orientation, a yaw orientation, and an above-ground position, the system comprising:

a MEMS sensor device supported by the helicopter for generating a pitch rate signal responsive to changes in the pitch orientation, a roll rate signal responsive to changes in the roll orientation, a yaw rate signal responsive to changes in the yaw orientation, and an acceleration signal responsive to the hover;

a MEMS triaxial accelerometer for generating an accelerometer signal responsive to forward flight;

a magnetometer for generating a magnetic heading signal;

a GPS receiver supported by the helicopter to generate a position signal, a course signal, and a speed signal responsive to the hovering of the helicopter;

a processing device supported by the helicopter to receive a set of inputs consisting of the pitch rate signal, the roll rate signal, the yaw rate signal, the acceleration signal, the position signal, the course signal, the speed signal, and the magnetic heading signal to determine a true attitude of the helicopter and to generate a set of control signals to maintain a stable hover of the helicopter in accordance with a selected hover position; and

an actuator device for receiving the set of control signals to adjust the hover of the helicopter based on the set of control signals.

Concept 57. an autopilot system for a helicopter, comprising:

an inner loop configured to provide at least a true attitude to a flight of the helicopter, the inner loop including a given level of redundancy applied thereto; and

an autopilot outer loop configured to provide at least one navigation function for the flight of the helicopter, and the inner loop and the autopilot outer loop are each configured with a triplex processor.

Claims (19)

1. An autopilot system for a helicopter, the autopilot system comprising:

an inner loop configured to provide a true attitude estimate for at least the flight of the helicopter, the inner loop including a given level of stability applied to the inner loop, the stability meeting applicable certification requirements; and

an autopilot outer loop configured to provide at least one navigation function for flight of the helicopter, the autopilot outer loop including a stability level that is lower than the inner loop.

2. The autopilot system of claim 1 wherein the inner loop is configured with a triplex processor for triple redundancy in the inner loop.

3. The autopilot system of claim 2 wherein the inner loop is further configured such that the triplex processors each simultaneously generate a motor control signal.

4. The autopilot system of claim 3 wherein the inner loop is configured to receive control commands from the outer loop on each iteration of the inner loop as part of each triplex processor generating the motor control signal.

5. The autopilot system of claim 4 wherein the outer loop is configured for one-to-one iteration with the inner loop.

6. The autopilot system of claim 5 wherein each triplex processor is configured to compare the motor control signal generated by that triplex processor with the motor control signal generated by each of the other two triplex processors and to make a first vote to favor or disfavor a first one of the other two triplex processors and a second vote to favor or disfavor a second one of the other two triplex processors based on the comparisons.

7. The autopilot system of claim 6 wherein a first given triplex processor and a second given triplex processor of the triplex processors are each in control communication with at least one actuator motor and a third triplex processor generates the motor control signal and makes the vote but the third triplex processor is not in control communication with an actuator motor.

8. The autopilot system of claim 6 further comprising a voting manager that causes a motor control signal to have no effect on a particular one of the triplex processors when voting by both of the other triplex processors opposes the particular triplex processor to indicate a failure of the particular triplex processor.

9. The autopilot system of claim 8 wherein the inner loop and the outer loop remain fully operational in response to a failure of a single one of the triplex processors.

10. The autopilot system of claim 3 further including a pitch actuator and a roll actuator for applying pitch and roll actuations, respectively, to control links of the helicopter, each of the pitch and roll actuators including a redundant set of motors having at least a first motor and a second motor, and a first triplex processor generating first processor motor control signals to control the first motor of the pitch actuator and the first motor of the roll actuator and a second triplex processor generating second processor motor control signals to control the second motor of the pitch actuator and the second motor of the roll actuator.

11. The autopilot system of claim 10 wherein the pitch actuator and the roll actuator each include an output shaft and are each configured such that either or both of the first motor and the second motor of a given one of the actuators can rotate the given output shaft of the given actuator to provide control link actuation.

12. The autopilot system of claim 1 wherein the inner loop is configured with triplex processors for triple redundancy in the inner loop and further includes a set of triplex sensor suites such that each triplex processor reads one of the sensor suites dedicated to that triplex processor to generate sensor data.

13. The autopilot system of claim 12 wherein each triplex processor is configured to share the sensor data from a dedicated one of the sensor suites with the other two triplex processors.

14. The autopilot system of claim 13 wherein each triplex processor is configured to determine a set of sensor data median values based on the sensor data from all of the triplex processors and is configured to determine a motor control signal based on the set of sensor data median values.

15. The autopilot system of claim 14 wherein each triplex processor is configured to reject any erroneous sensor data.

16. The autopilot system of claim 15 wherein each triplex processor is configured to identify the erroneous sensor data based at least in part on a comparison of three sensor outputs to each sensor output produced by a given sensor of each of the sensor suites.

17. The autopilot system of claim 1 wherein the outer loop is configured to operate based on a set of control laws for a particular helicopter.

18. The autopilot system of claim 1 wherein the helicopter includes a cyclic control and the system further includes actuator means for actuating the cyclic control to provide the attitude hold and the navigation functions.

19. A method employed in an autopilot system for a helicopter, comprising:

configuring an inner loop to provide attitude hold at least for flight of the helicopter, the inner loop including a given level of stability applied to the inner loop, the stability meeting applicable certification requirements; and

configuring an autopilot outer loop to provide at least one navigation function for flight of the helicopter, the autopilot outer loop including a different level of stability than the inner loop.