Digital Remote Control System

This invention relates to means for controlling electronic equipment which is remotely located from the point of control and in particular to such means which operate on digital principles and are failsafe.

In order to overcome space limitations in control points or rooms which might otherwise have a high equipment to space ratio such as the cockpits of commercial and heavy general aviation aircraft, electronic instruments normally have control units and readouts located at the control point, for example, on the cockpit instrument panel, and the body of the instrument located in remote radio racks. Not only does this arrangement overcome the aforementioned control point space limitations but it also facilitates maintenance of the equipment by making the body of the equipment easily accessible at the remote location.

The control of remote equipment from a centralized control point presents some special requirements, especially in aircraft applications. Specifically:

1. The control system must use a minimum of interconnecting cable in order to reduce the weight and the cost of the interconnection.

2. The reliability and integrity of the control system must be high.

3. The time delay introduced by the control system must be short.

4. The control system must be failsafe.

The first three of the above requirements are readily satisfied by serial digital remote control systems. Types of these digital remote control systems are well known in the prior art. The last requirement, that the control system be failsafe can be, and has been, in the prior art, met by any one of the following three means and methods.

According to the first of these methods, an audible identification signal (voice or Morse code) is transmitted, by a ground based facility in the case of aircraft applications. When the system operator hears the correct identification he is assured that the remote unit is actually tuned to the desired channel or mode of operation and that his control system is operating properly. If the identification signal is lost or otherwise no longer heard by the system operator, he knows that a fault has occurred and the instrument is no longer reliably operable. This method is used in VORTAC and ILS systems. Unfortunately, this method increases the operator workload, especially when a Morse code identification signal is used.

According to the second method, the remote unit generates a code signal in response to a control signal received from the control unit. The code signal is transmitted via the control system back to the control unit. The code signal energizes a special display at the control point thereby visually identifying the control signal and verifying for the operator that the remote unit and the control system are operating properly. The cost of implementing this method is relatively high and the reliability and integrity of the control point display introduce other problems.

According to the third method the remote unit generates a code signal (a so-called "ECHO") in response to a control or command signal received from the control unit as was done according to the second method described above. Here, however, the ECHO is compared electronically in the control unit with the original control signal. Any discrepancy between the two signals activates a warning device or otherwise indicates a fault in the system. Implementation of this third method comprises the means of the present invention. In addition, since switch malfunction is relatively common and contributes heavily to control system failure, the preferred embodiment of the invention uses redundant control switches.

It is an object of this invention to provide a failsafe control system for equipment remotely located from a control point or unit.

FIG. 1 is a block diagram of the invention.

FIG. 2 is a block diagram which shows the invention in greater detail.

Referring first to FIG. 1, a control unit 10 controls the operation of a remote unit 12 by transmitting a control or command signal to the remote unit 12 via cable 20a. In response to the received command signal remote unit 12 alters its tuning or mode of operation, generating a response "ECHO" code identifying its new state or condition and transmits the "ECHO" code back to control unit 10 via cable 12a. More particularly, control unit 10 is comprised of a switch means 15, normally a stack of switch wafers of the type known to those skilled in the art. The switch wafers are preferably divided into two redundant sets 16 and 18 which are manipulated simultaneously, usually manually by the system operator. In response to a command set into the switch wafers by the system operator, each switch wafer set generates a code, which in this embodiment are parallel-by-bit digital codes which are identical to one another, these parallel-by-bit digital codes being generated on lines 16a and 18a respectively. The code on lines 16a is applied to an encoder 20 which in response thereto generates a corresponding serial-by-bit command code which is transmitted via line 20a to remote unit 12. It is preferable, especially in aircraft applications to transmit the command code from the control unit to the remote unit in serial-by-bit code so that only a single wire or line 20a is needed thus saving material and weight. For the same reasons the "ECHO" code generated by remote unit 12 and transmitted via line 12a to control unit 10 is a serial-by-bit code, thus requiring the "ECHO" code to be decoded in a decoder 22 for conversion to an equivalent parallel-by-bit code which is compared by comparator 24 against the code from wafer set 18. In the event the two inputs thereto do not compare favorably, comparator 24a generates an output on line 24a which is used to generate an alarm.

It can be seen that the use of redundant switch wafer sets 16 and 18 is particularly effective in guarding against undetected control system faults. For example, assume only a single wafer set were used and the code output therefrom was applied to encoder 20 and comparator 24. In the event a fault occurred in the switch it is possible and likely that a recognizable but false command code would be transmitted to remote unit 12 which would accordingly obey the command and return the appropriate "ECHO" to control unit 10 and no alarm would be provided in spite of the fact that the remote unit response was not in accordance with the intended command since the command was altered at the switch. However, according to the present control system it is highly unlikely that both switch wafers would fail simultaneously and almost impossible that the specific failure would be identical in both wafer sets. Thus, where the response of remote unit 12 is not in accordance with the command set into switch 15 an alarm is invariably provided.

Referring now to FIG. 2 which shows the invention in greater detail, a control unit 50, mounted at the control point, is comprised of a switch 52, shift registers 58 and 64, buffer 60, comparator 66, integrator 68, OR gate 70 and timer 72. Switch 52 is similar or identical to switch 15 of FIG. 1 in that it is comprised of redundant wafer sets 54 and 56. The command set into wafer set 54 is applied in parallel bit format into shift register 58. The redundant command set into wafer set 56 is applied to comparator 66.

Control unit 50 is connected to remote unit 88 via interconnecting cables 78, which are comprised of lines 78a, 78b and 78c. Remote unit 88 is comprised of buffer 82, shift registers 84 and 89, programmer 86 and, of course, the control circuits and other circuits of the particular equipment involved. For clarity, these latter circuits are not shown. Programmer 86 periodically generates bursts of clock pulses which are applied simultaneously to shift registers 84 and 89 in remote unit 88 and shift registers 58 and 64 in control unit 50. Each shift register is the same length and there are the same number of clock pulses in each burst as there are shift register stages in a shift register. Programmer 86, at the same time it generates a burst of clock pulses also generates a direction signal of either a first or second state. As will be explained below, the direction signal when in the first state conditions the circuit elements to transmit signals from the control unit to the remote unit. This state is also called the control unit transmit state. The direction signal when in the second state conditions the circuit elements to receive signals at the control unit which are transmitted from the remote unit. This state is also called the control unit receive state. The direction signal is applied to shift register 84 and buffer 82 of remote unit 88 and via line 78b to shift register 64 and buffer 60 of control unit 50. When in a control unit transmit or first state, the direction signal isolates shift register 64 from receiving data and conditions shift register 84 to receive data from buffer 60. In a control unit receive or second state, the direction signal isolates shift register 84 from receiving data and conditions shift register 64 to receive the "ECHO" check data from buffer 82. It should be noted that buffers 60 and 82 are three state devices such as the buffer made by Texas Instruments, Inc. and designated as SN 74LS126N. The buffers can drive line 78a into a high or low state or switch to a high impedance output to permit the other buffer to control the line. These buffers eliminate the need for a dedicated return line to perform the "ECHO" check. The aforementioned high impedance output is particularly important as this feature insures that buffer 82 does not load line 78a when buffer 60 is transmitting and buffer 60 does not load the line when buffer 82 is transmitting.

Returning to a description of the operation of the invention, when the direction signal is in the first or control unit transmit state, as mentioned above, the burst of clock pulses on line 78c causes the digitally encoded command signal in shift register 58 to be strobed out in serial format through buffer 60 onto line 78a into shift register 84. Thus, the command set into switch wafer set 54 is now stored in shift register 84 in the remote unit. The command signal is applied from shift register 84 to the remote unit control circuits to effect control of the equipment. The command signal is also applied to and stored in shift register 89.

Subsequently the direction signal generated by programmer 86 goes to the second or control unit receive state. This causes buffer 60 to become inactivated, that is, it will not drive line 78a when clock pulses are applied to shift register 58. The direction signal while in this state activates buffer 82 to control line 78a. It also inactivates shift register 84 so that it does not respond to clock signals applied thereto. Thus, in response to the burst of clock pulses generated by programmer 86 when the direction signal is in the second or control unit receive state, the contents of shift register 89 are strobed out through buffer 82 onto line 78a and into shift register 64. A control cycle is thus completed with the "ECHO" signal from remote unit 88 now in shift register 64 being compared by comparator 66 with the command signal in wafer set 56.

If at any time the comparison is unfavorable comparator 66 generates an output on line 66a. Of course, during the short time that signals are being strobed into shift register 64 and until the shift register has been fully loaded, an unfavorable comparison will result. For that reason, the signal on line 66a is integrated by integrator 68 which generates an output on line 68a only if an unfavorable comparison persists for a time period in excess of the time required for the system to return "ECHO" signal to shift register 64.

The fault signal on line 68a is applied through OR gate 70 to some utilization device such as a fault indicator.

Another fault mode can occur with the system of FIG. 2 which would prevent remote unit 88 from following the manual commands entered into switch 52, but which might go undetected. Specifically, if the clock pulses fail no information is interchanged between the various shift registers but no fault is signaled since the contents of both shift registers were equal when the clock failed. To guard against such an undetected fault a renewable timer 72 is provided. Timer 72 is continually reset by the burst of clock pulses on line 78c. If timer 72 times out in between clock bursts it generates an output on line 72a which is applied through OR gate 70 as a fault signal. Thus, so long as there are bursts of clock pulses at the correct intervals on line 78b, timer 72 cannot time out and no fault is indicated thereby.

From this description of the embodiments of our invention one skilled in the art should now be able to design embodiments which, although having various alterations and modifications, would still fall within the true spirit and scope of our invention. Accordingly, the property encompassed hereby is to be limited only by the appended claims.