Device for constructing and securing a low altitude flight plan path intended to be followed by an aircraft

[0001] The present invention relates to a device for constructing and securing a low altitude flight path intended to be followed by an aircraft, in particular a military transport aircraft.

[0002] In the context of the present invention, the term low altitude flight path means a flight path which allows an aircraft to follow the flown-over terrain very closely, in particular for preventing it from being spotted, whilst eliminating all risk of collision with a part of said terrain. Such a flight path is generally situated at a predetermined height above the terrain, for example at 500 feet (about 150 meters).

[0003] From the document FR-2 870 607, there is known a method and a device for constructing such a low altitude flight path.

[0004] Because of the proximity to the ground, it is necessary that the low altitude flight path is compatible with the capabilities of the aircraft, that is to say that the latter is capable of following it. In fact, an excessive deviation with respect to that flight path would be able to have catastrophic consequences, in particular with a large risk of collision with the terrain flown over or with a construction or an object situated on said terrain. In order to overcome this disadvantage, from the document FR-2 870 604 there is known a device and a method for securing such a low altitude flight of an aircraft, in order to obtain a sufficient degree of safety making it possible to eliminate all risk of collision of the aircraft with the terrain flown over.

[0005] The purpose of the present invention is to construct such a low altitude flight path and also to secure it, that is to say to ensure that the aircraft is able to fly this flight path.

[0006] As an automatic low altitude flight function which uses such a flight path can lead to the loss of the aircraft in the case of failure, this function must be certified by demonstrating the highest level of integrity. In particular, the database or databases used for constructing and securing the low altitude flight path must be qualified at the required level of integrity. This can only be done by applying very strict standards with regard to the representativeness and the integrity of the recorded data. Such requirements have negative consequences, in particular with regard to the cost of the database or databases. Moreover, the low altitude flight function must be robust with respect to a failure of an engine of the aircraft, such a failure being considered as always possible.

[0007] The purpose of the present invention is to overcome these disadvantages. It relates to a device for constructing and securing a low altitude flight path intended to be followed by an aircraft, which makes it possible both to secure the flight path with respect to an engine failure of the aircraft and to ensure the representativeness of at least one model used with respect to the certified performance of the aircraft.

[0008] For this purpose, according to the invention, said device comprises:

• • [0009] a first processing unit which has a DAL C requirement level and which is formed in such a way as to determine said flight path, making use of data coming from a first database;
  • [0010] said first database, which is qualified according to a DPAL2 standard and which contains precalculated performance of the aircraft, making it possible to provide a maximum climb gradient flyable by the aircraft, with all of the engines functioning, depending on a plurality of parameters including the speed of the aircraft, this performance being saturated on the best climb gradient flyable by the aircraft with one failed engine;
  • [0011] a second processing unit which has a DAL A requirement level and which is formed in such a way as to check the flight path determined by said first processing unit, using data coming from a second database; and
  • [0012] said second database, which is qualified according to a DPAL1 standard and which contains precalculated regulation and certified performance of the aircraft, making it possible to provide a maximum climb gradient flyable by the aircraft with one failed engine and to do so uniquely for a best gradient speed.

[0013] Thus, due to the invention, the functions used by said device are carried out by two separate processing units, each of which is associated with a special database. One of said processing units carries out the construction and the other one carries out the securing. The association of these two processing units allows the construction of a low altitude flight path which is secured with respect to the failure of an engine, but for which the operational speed range is not degraded in terms of maximum climb gradient. This makes it possible to use the full performance of the aircraft when it is following said low altitude flight path.

[0014] It is known that the safety analysis leads to classifying the functions (or the software) according to the risk that a malfunction of said function (or of said software) would cause the aircraft to run. In the present invention, the function used is classified as “catastrophic”. This type of classification (in this instance “catastrophic”) imposes a certain level of development rules (“A” in this instance): the term DAL A is then used. The link between the level of criticality and the development requirements is defined by a document entitled “RTCA-EUROCAE DO-178b/ED-12b” which is the standard approved by the aeronautical community. This document was drawn up by the organizations RTCA (Requirements and Technical Concepts for Aviation) and EUROCAE (European Organisation for Civil Aviation Equipment).

[0015] Furthermore, the document SAE-ARP4754 (SAE standing for “Society of Automotive Engineers” and ARP for “Aeronautic Recommended Practices”) specifies that in a split function, in order to obtain the equivalent of a level A function, one of the two branches must be of level A and the other one at least of level C. Consequently according to this standard, the choice according to the present invention is to take the construction function to level C and the monitoring function to level A.

[0016] Moreover, the standard “RTCA-EUROCAE DO-200a/ED76” makes the link between the DAL (Design Assurance Level) level [levels A and C respectively in the present invention] and the DPAL (Data Process Assurance Level) level [1 and 2 respectively in the present invention]. The DO-200a standard also defines the requirements associated with each of the DPAL levels and the possible means of conformity in order to meet these requirements.

[0017] In the context of the present invention, the following definitions are taken into account:

• • [0018] level A (DAL A): software whose malfunction would cause or contribute to a failure of a function of a system resulting in a catastrophic failure condition for the aircraft (able to lead to the loss of the aircraft and of its occupants);
  • [0019] level C (DAL C): software whose malfunction would cause or contribute to a failure of a function of the system resulting in a major failure condition for the aircraft;
  • [0020] level 1 (DPAL1): requirement level relating to the control of the integrity, during the elaboration process, of data intended for a function or a sub-function of level A or B software (DAL A or DAL B); and
  • [0021] level 2 (DPAL2): requirement level relating to the control of the integrity, during the elaboration process, of data intended for a function or a sub-function of level C or D software (DAL C or DAL D).

[0022] It will be noted that, due to the present invention, said first database which makes it possible to model the gradients flyable by the aircraft is qualified according to the DPAL2 standard, that is to say according to a standard which it not too restrictive. The qualification efforts are therefore concentrated on the second database which is qualified according to the DPAL1 standard. The latter comprises regulation performance, that is to say performance which has already been certified by the air authorities. This considerably simplifies the work of qualification of this second database, and therefore also the work of qualification of the device according to the invention.

[0023] Said device also has other advantages described below.

[0027] The device 1 according to the invention and shown as a block diagram in FIG. 1 is intended to construct and to secure a low altitude flight path which is intended to be followed by an aircraft, a military transport aircraft in particular. The flight path determined by said device 1 can be used by a usual automatic guidance system which has not described further hereafter.

[0028] In order to do this, said device 1 comprises, according to the invention:

• • [0029] a database 2 which is qualified according to a DPAL2 standard and which contains precalculated performance data of the aircraft, making it possible to provide a maximum climb gradient flyable by the aircraft, with all of the engines functioning, according to a plurality of parameters (including the speed of the aircraft). Moreover, this performance is saturated on the best climb gradient flyable by the aircraft with one failed engine, as described below;
  • [0030] a processing unit 3 which is connected by the intermediary of a link 4 to said database 2, which has a DAL C requirement level and which is formed in such a way as to determine said flight path, using data coming from said database 2;
  • [0031] a database 5 which is qualified according to a DPAL1 standard which contains precalculated regulation and certified performance data of the aircraft, making it possible to provide a maximum climb gradient flyable by the aircraft with one failed engine, and to do this uniquely for a best gradient speed, described below; and
  • [0032] a processing unit 6 which is respectively connected by the intermediary of links 7 and 8 to said database 5 and to said processing unit 3, which has a DAL A requirement level, and which is formed in such a way as to check the flight path determined by said processing unit 3, using data coming from said database 5.

[0033] In the context of the present invention, the following definitions are taken into account:

• • [0034] level A (DAL A): software whose malfunction would cause or contribute to a failure of a function of the device 1 resulting in a catastrophic failure condition for the aircraft (able to lead to the loss of the aircraft and of its occupants);
  • [0035] level C (DAL C): software whose malfunction would cause or contribute to a failure of a function of the device 1 resulting in a major failure condition for the aircraft;
  • [0036] level 1 (DPAL 1): requirement level relating to the control of the integrity, throughout the elaboration process, of data intended for a function or a sub-function of level A or B (DAL A or DAL B) software; and
  • [0037] level 2 (DPAL 2): requirement level relating to the control of the integrity, throughout the elaboration process, of data intended for a function or a sub-function of level C or D (DAL C or DAL D) software.

[0038] Thus, due to said architecture of the device 1 according to the invention, the gradients flyable by the aircraft can be modelled in the database 2 which is qualified according to the DPAL2 standard which is not too restrictive, and the qualification efforts are concentrated on the database 5 which is qualified according to the highly restrictive DPAL1 standard, but which advantageously comprises regulation performance data.

[0039] Moreover, as mentioned above, the precalculated performance contained in the database 2 is saturated on the best climb gradient flyable by the aircraft with one failed engine. This characteristic is shown in FIG. 2 which illustrates the variation of the maximum climb gradient P as a function of the speed V, and it does so:

• • [0040] for a curve C1 shown in dotted and dashed line, illustrating the functioning with all engines valid;
  • [0041] a curve C2 shown in full line, illustrating the functioning with one failed engine; and
  • [0042] a curve C3 in dashed line, illustrating the model used for said database 2.

[0043] Thus, in the case of failure of an engine, the aircraft has the possibility of decelerating the current speed to the equilibrium speed for maintaining the gradient of the low altitude flight path. This low altitude flight path is therefore secure with respect to the failure of an engine. Thus, the use of the whole performance potential of the aircraft is continued for the speed range ΔV for which the gradients are not saturated.

[0044] Moreover, in a particular embodiment, this speed range ΔV (which therefore exhibits a nondegraded performance and which is shown in FIG. 2) corresponds to the operational use range of a low altitude flight function.

[0045] Furthermore, as mentioned above, said database 5 contains precalculated regulation performance data making it possible to provide a maximum climb gradient flyable by the aircraft with one failed engine, and to do so uniquely for a best gradient speed V1. It is thus ensured that, in the case of the failure of an engine, the aircraft is still capable of maintaining its flight gradient, subject to decelerating. Therefore there is always an equilibrium speed point on the low altitude flight path which guarantees that the aircraft can fly that flight path and that it can do so even with one failed engine.

[0046] Moreover, as the model in said database 5 uses regulation performance data, that is to say performance certified by the air authorities, the work of qualification of that database 5 to the DPAL1 standard is considerably simplified (the initial data being valid by definition).

[0047] Furthermore, in a preferred embodiment, the best gradient speed V1 with one failed engine is a speed which is called the “Greendot” speed for aircraft of the AIRBUS type. This Greendot speed is generally that which is used for the calculation of the certified performance considered in the present invention. Furthermore, this speed is also that used in general by the speed envelope control computers in order to set the bottom limits for the speeds accessible by the aircraft in managed mode during automatic flight. Thus, during an automatic flight (under the control of an automatic pilot) along the low altitude flight path, when an engine failure occurs, in order to maintain the current flight gradient and the clearance of the aircraft with respect to the relief, the speed of the aircraft will reduce automatically in such a way as to find a new point of equilibrium (thrust of the aircraft, gradient, speed). In the case where the gradient being flown prior to the engine failure is the highest possible (curve C3 of FIG. 2), this new equilibrium speed point is the speed V1 (FIG. 2) that is to say the Greendot speed.

[0048] It will be noted that the introduction of the Greendot speed as a calculation speed for the maximum gradients flyable with a failed engine guarantees a homogeneous functioning of the function both in manual flight and in automatic flight (under the control of an automatic pilot). In fact:

• • [0049] in manual flight, the set speed in the case of an engine failure is said Greendot speed; and
  • [0050] in automatic flight, if the automatic pilot cannot simultaneously comply with gradient and speed commands, it will automatically make the aircraft decelerate down to the Greendot speed.

[0051] Moreover, as mentioned above, the Greendot speed for a failed engine is also the speed which is used for the calculation of the regulation (certified) performance. The use of this regulation performance considerably reduces the work of qualification of the database (required by said DO-200a standard) and of the associated elaboration procedure, to the DPAL1 standard.