Abstract:
The invention relates to an electric circuit suitable for cutting off an electric power supply of an electrical device, said electric circuit receiving as input at least two discrete electrical signals, the values of which condition the power supply of the electrical device, the discrete electrical signals having a high state if the electrical device needs to be supplied: the electric circuit including a voltage source; a first cut-off unit connected between the electrical device and the voltage source, the first cut-off unit having an open or closed state in accordance with the discrete electrical signals; a second cut-off unit connected to the intersection between the electrical device and the first cut-off unit, and to an earth line, the second cut-off unit having a state that complements the first cut-off unit if the discrete electrical signals are in identical states, said first and second cut-off units being controlled such as to generate a short-circuit in the event of a divergence between the discrete electrical signals.

Description:
GENERAL TECHNICAL FIELD 
       [0001]    The invention relates to the security field for controlling systems or equipment, especially electronic ones and more particularly those on board of an aircraft. 
       STATE OF THE ART 
       [0002]    An electrical system can be controlled once a condition is checked. 
         [0003]    A known solution is to connect the power supply of the electric system to an electric circuit configured to test discrete signals indicating that a condition is true. 
         [0004]    For example, in the case of an aircraft, some of electrical equipment should be cut-off in flight, such as, in the case of avionic data acquisition, processing and communication systems, the wireless transmission radio module has to be cut in order to avoid disturbing the aircraft functioning. 
         [0005]    By means of logic gates AND connected to switches, it is possible to simply turn off the power of the radio module if necessary. 
         [0006]    Such a solution is however not satisfactory when safety levels particularly high are required. For instance, the levels of reliability needed to supply electrical equipment presenting catastrophic risk, that is to say potentially leading to loss of human life, are around 10 −9  per hour flight. 
       PRESENTATION OF THE INVENTION 
       [0007]    The invention proposes to overcome at least one of these disadvantages. 
         [0008]    For this purpose, the invention provides an electric circuit adapted to cut-off a power supply of an electric device, said circuit receiving as input at least two discrete electrical signals of which values determine the power supply of the electric device, the discrete electrical signals presenting a high state if the electric device is to be power supplied,
       the electric circuit comprises a voltage source;   a first cut-off unit connected between the electric device and the voltage source, the first cut-off unit having an open or closed state depending on the discrete electrical signals;   a second cut-off unit connected to the intersection between the electric device and the first cut-off unit, and a ground line, the second cut-off unit having a complementary state to the first cut-off unit if the discrete electrical signals are in a same state, the second cut-off unit comprises a parallel arrangement of at least two switches, the said parallel circuit being connected to the power source, the state of each of both switches is a function of a discrete electrical signal, the switches being in the same state when the discrete electrical signals are in the same state, the said first and second cut-off units being controlled to generate a short-circuit in case of divergence between the discrete electrical signals, at least two switches of the second cut-off unit having divergent states one from another so as to generate the said short-circuit.       
 
         [0012]    The invention is advantageously completed by the following characteristics, taken alone or in any technically possible combination:
       the second cut-off unit comprises a parallel arrangement of at least two switches, the parallel arrangement being connected to the power source, the state of each of the two switches is a function of a discrete electrical signal, the second cut-off unit comprising as many switches as discrete electrical signals;   the switches of the parallel connection have an open or closed state depending on an electric control signal, the switches being in the open state if the electric control signal has a “high” state and in the closed state if the electric control signal has a “low” state;   the first cut-off unit comprises a first switch having an open or closed state depending on an electric control signal based on discrete electrical signals, the first switch is in the open state if the electric control signal has a “low” state and is in the closed state if the electric control signal has a “high” state;   the first switch is controlled by a logical function of discrete signals of the type OR logic;   the first cut-off unit comprises a second switch, this second switch having an open or closed state depending on an electric control signal based on discrete electrical signals, the second switch being in the open state if the electric control signal has a “down” state and is in the closed state if the electric control signal has a “high” state, the said second switch being suitable to isolate the voltage source of the electric power supply if the discrete electrical signals are on the low state;   the second switch is controlled by a logical function of discrete electrical signals of the type ‘AND’ logic;   it comprises at least one fuse to isolate, in case of short-circuit, the voltage source of elements of the said electric circuit;   it includes a test unit for detecting a failure of at least one circuit component and optionally controlling the first and second switching units to generate a short-circuit;   the test unit is adapted to implement the steps of: isolating the electrical equipment of the electric circuit; controlling the second cut-off unit so as to have this latter in the closed state; measuring a voltage between the first cut-off unit and the second cut-off unit in order to check that the second cut-off unit is adapted to generate a short-circuit;   the test unit is adapted to implement the steps of: controlling the first cut-off unit so that this latter is in the closed state; measuring a voltage at the terminals of the second cut-off unit, a voltage equal to the voltage supplied by the voltage source indicating that the first cut-off unit is operating; controlling the first cut-off unit so that the latter is in the open state; measuring a voltage at the terminals of the second cut-off unit, a zero voltage indicating that the first cut-off unit is operating;   the test unit is implemented by means of programmable logic components or by means of microcontrollers which can incorporate means of analog voltage measurements to enhance the circuit supervision level.       
 
         [0024]    And the invention also relates to an avionic data acquisition, processing and communication system comprising a radio module connected to an electric circuit according to the invention. 
         [0025]    The circuit of the invention comprising several components, the safety level of circuit is in the order of 10 −9 . Furthermore, by using several stages that may interact according to their state ensures that the system is robust to failures that may affect components while enabling to supply the electrical equipment only in the case it should be. 
         [0026]    Thus, we obtain a circuit which can destruct itself in the event of failure of the components. 
         [0027]    The reached reliability level is such that it is not necessary to monitor preventively the good functioning of the circuit because the level of redundancy is such that it is statistically impossible that the whole failures resulting in power setting of electrical equipment, unwanted, can occur over a period of thirty years and more. 
     
    
     
       PRESENTATION OF FIGURES 
         [0028]    Other features, aims and advantages of the invention will appear from the following description, which is purely illustrative and non-limiting and should be read with reference to the appended drawings in which: 
           [0029]      FIG. 1  illustrates an avionic data acquisition, processing and communication system in accordance with an embodiment of the invention; 
           [0030]      FIG. 2  illustrates a scheme diagram of an electric circuit in accordance with a first embodiment of the invention, 
           [0031]      FIG. 3  illustrates a scheme diagram of an electric circuit in accordance with a second embodiment of the invention; 
           [0032]      FIG. 4  illustrates a scheme diagram of an electric circuit in accordance with one embodiment of the invention. 
       
    
    
       [0033]    Among all these figures, the similar elements share identical references. 
       DETAILED DESCRIPTION OF THE INVENTION 
       [0034]    In relation to  FIG. 1 , an avionic data acquisition, processing and communication system includes:
       an acquisition unit (not represented) of discrete electrical signals x 1 , x 2  indicating a state of the aircraft;   a radio module  2  adapted to transfer the avionic data of the system towards a remote station;   a voltage power source +Vpp of the radio module  2 , and   a power electric circuit  1  of the radio module  2  which enables cutting off the power of the radio module when the aircraft is in flight.       
 
         [0039]    A state of the aircraft is, for instance, in flight, on the ground, etc. When the aircraft is on the ground, the discrete electrical signals indicating that the aircraft has landed, are for example: a signal indicating the existence of a weight of the aircraft on the wheels, or a signal indicating that the doors of the aircraft are open. 
         [0040]    The power electric circuit can be modeled by a switch controlled by a logical function of discrete electrical signals (see  FIG. 1 ). 
         [0041]    By logical function, we mean a series of operations related to one or more variables. The known logic functions are: AND, OR, XOR, etc. 
         [0042]    In relation to  FIG. 2 , the electric circuit  1  receives as input at least two discrete electrical signals, preferably three discrete electrical signals x 1 , x 2  and comprises a voltage source +Vpp. The values of the discrete electrical signals determine the power of the radio module  2 . In this case, in the embodiment of  FIGS. 2 and 3 , the discrete electrical signals must all be equal to 1 so that the radio module  2  is power supplied. 
         [0043]    Of course, one may consider an electric circuit receiving a higher number of discrete electrical signals. 
         [0044]    The electric circuit enables in normal operation to power supply the electrical power supply of the electrical equipment  2  according to the values of the discrete electrical signals. 
         [0045]    We consider, in what follows, the logic values of the discrete electrical signals; in particular, we consider that a discrete electrical signal has a high state, that is to say a logical value ‘1’ if it reflects a condition according to which the electrical equipment may be power supplied (for example, if the aircraft has landed) and it has a low state, that is to say a logical value ‘0’ if it reflects a condition that the electrical equipment should not be power supplied. 
         [0046]    In relation to  FIGS. 2 and 3 , it is considered that the discrete electrical signals need all three to be in the high state if the electrical equipment  2  has to be power supplied. 
         [0047]    As it will be described below, if a single component is used to test the values of the discrete signals, this latter has a probability of failure which is not negligible so that the electrical equipment is power supplied when it should be not. 
         [0048]    To overcome this problem, the circuit has several stages that interact with each other. At each stage, we can prevent a component failure that has an inconsistent state with the discrete signals. 
         [0049]    This reduces the probability to power supply the electrical equipment when it should not be. 
         [0050]    Indeed, the probability of the circuit failure should be around 10 −9  whereas an electronic component has a probability of failure around 10 −6 . 
         [0051]    The circuit logic 1 includes a +Vpp voltage source which power supplies the electrical equipment if all discrete signals indicate that the electrical equipment should be power supplied. For example, the aircraft has landed, the discrete signals x 1 , x 2  are both equal to ‘1’ and are equal to ‘0’ if this is not the case. 
         [0052]    A first cut-off unit Uc 1  is connected to the +Vpp voltage source and has an open state if the discrete electrical signals indicate that the electrical equipment should not be power supplied and a closed state if the discrete electrical signals indicate that the electrical equipment should be. 
         [0053]    A second cut-off unit Uc 2  is connected to the intersection between the electrical equipment  2  and the first cut-off unit Uc 1 , and a ground line. The second cut-off unit Uc 2  has a complementary state to the first cut-off unit Uc 1  if the discrete electrical signals x 1 , x 2  have an identical state. The second cut-off unit Uc 2  is connected to a ground line. 
         [0054]    However, once the discrete signals x 1 , x 2  have a divergent state, the first and second cut-off units are controlled to generate a short-circuit. 
         [0055]    In particular, the first cut-off unit Uc 1 , in case of divergence of discrete electrical signals is in a closed state and the second cut-off unit Uc 2  will generate the short-circuit. 
         [0056]    Advantageously, the first cut-off unit UC 1  comprises a first switch Q 1  having an open or closed state depending on an electric control signal based on discrete electrical signals. The first switch Q 1  is in the open state if the electric control signal has a “low” state and is in the closed state if the electric control signal has a “high” state. 
         [0057]    The first switch Q 1  is controlled by a particular logical function of discrete signals of the type ‘OR’ logic. 
         [0058]    Furthermore, the second cut-off unit Uc 2  comprises a parallel arrangement of at least two switches Q 2 L, Q 2 R, the parallel arrangement being connected to the power source, the state of each of the two switches is a function of a discrete electrical signal x 1 , x 2 . We note that the second cut-off unit Uc 2  comprises as many switches as discrete electrical signals x 1 , x 2 . 
         [0059]    Each switch Q 2 L, Q 2 R is respectively controlled by an inputted discrete electrical signal. Thus, in connection with  FIGS. 2 to 4 , the discrete electrical signal x 1  controls the switch Q 2 L and the discrete electrical signal x 2  controls the switch Q 2 R. 
         [0060]    In addition, switches Q 2 L, Q 2 R are in the same state when the discrete electrical signals x 1 , x 2  are in the same state, and the first and second cut-off units are controlled to generate a short-circuit in case of discrepancy between the discrete electrical signals x 1 , x 2 , at least two switches of the second cut-off unit have divergent states in relation to each other so as to generate the short-circuit, the first cut-off unit UC 1  being in a closed state to let pass the voltage coming from the voltage source. 
         [0061]    In a complementary way (see  FIG. 3 ), the first cut-off unit Uc 1  further comprises a second switch Q 4  controlled by a logical function of discrete electrical signals of the type “AND” logic. 
         [0062]    Finally, the electric circuit also comprises a fuse FUSE to isolate, in case of a short-circuit, the +Vpp voltage source from the elements of the logic circuit  1 . In case of short-circuit the +Vpp fuse begins to melt in order to protect the circuit. 
         [0063]    Thus, in the embodiment of  FIG. 2 , we have for example:
       If x 1 =x 2 =′ 0 ′: the switch Q 1  is open, both switches Q 2 R, Q 2 L are closed. There is no short-circuit, the electrical equipment is not power supplied.   If x 1 =x 2 =‘1’: the switch Q 1  is closed, the two switches Q 2 R, Q 2 L are open. The electrical equipment is power supplied.   If x 1 =‘0’ and x 2 =‘1’ or x 1 =‘1’ and x 2 =‘0’: there is a divergence between the discrete electrical signals, the switch Q 1  is closed, and either the Q 2 L or the Q 2 R switch is closed. There is then a short-circuit.       
 
         [0067]    In addition, in the event of failure of the switch Q 1  that can be closed when it should be open (considering discrete electrical signals x 1 , x 2 ), the second cut-off unit will cause a short-circuit, the electrical equipment will not be power supplied. Thus, as the second cut-off unit Uc 2  enables to monitor the power supply circuit, this is also the case if the first cut-off unit Uc 1  includes a second switch Q 4 . 
         [0068]    Furthermore, insofar as it is unlikely that all components of the circuit have at the same time a failure, the circuit thus prevents the failures of logic components generating the controls of the various elements of the circuit. 
         [0069]    In the embodiment of  FIG. 3 , we have for example:
       If x 1 =x 2 =‘0’: the switch Q 4  is open, the switch Q 1  is open, the two switches Q 2 R, Q 2 L are closed. There is no short-circuit, the electrical equipment is not power supplied.   If x 1 =x 2 =‘1’: the switch Q 4  is closed, the switch Q 1  is closed, both switches Q 2 R and Q 2 L are open. The electrical equipment is power supplied.   If x 1 =‘0’ and x 2 =‘1’ or x 1 =‘1’ and x 2 =‘0’: there is a divergence between the discrete electrical signals, the switch Q 4  is closed, the switch Q 1  is closed and one or the other of the switches Q 2 L or Q 2 R is closed. There is then a short-circuit.       
 
         [0073]    In a complementary manner, the electric circuit includes a test unit TEST which enables to verify the ability of the circuit to cause a short-circuit. This check can be scheduled to be run periodically when the electrical equipment  2  is not power supplied. 
         [0074]    In particular, the test unit TEST can detect a failure of at least one component of the circuit and optionally control the first and second cut-off units to generate a short-circuit. 
         [0075]    Regarding the second cut-off unit Uc 2 , the test unit is particularly adapted to implement the steps of:
       isolating the electrical equipment of the electric circuit;   controlling the second cut-off unit Uc 2  so that the latter is in the closed state;   measuring a voltage between the first cut-off unit and the second cut-off unit in order to verify that the second cut-off unit is adapted to generate a short-circuit, a zero voltage indicating that the second cut-off unit is operating.       
 
         [0079]    Regarding the first cut-off unit Uc 1 , the test unit is particularly adapted to implement the steps of:
       controlling the first cut-off unit Uc 1  for the latter to be in the closed state;   measuring a voltage at the terminals of the second cut-off unit Uc 2 , a voltage equal to the voltage supplied by the +Vpp voltage source indicating that the first cut-off unit is operating;   controlling the first cut-off unit Uc 1  for the latter is in the open state;   measuring a voltage at the terminals of the second cut-off unit Uc 2 , a zero voltage indicating that the first cut-off unit is operating.       
 
         [0084]    At last, regarding one or the other of the two cut-off units, if a failure is detected at the end of the tests, we can then monitor a short-circuit. 
         [0085]    According to one embodiment, the test unit TEST may be implemented using programmable logic components (Electronically Programmable Logic Devices, (EPLD)) or by using microcontrollers which can integrate ways of measures of analog voltages to enrich the circuit supervision level. In relation to  FIG. 4  an electric circuit according to a particular embodiment is illustrated. 
         [0086]    To generate the controls of the switches Q 2 L and Q 2 R, the electric circuit  1  includes five logic units G3, G1L, G1R, G2R, G2L. 
         [0087]    The logic units G1L and G2L are related the switch Q 2 L, the logic units G1R and G2R are related to the switch Q 2 R, the logic unit G3 being common to the switches Q 2 R and Q 2 L. 
         [0088]    The units G2R, G3, G2L are TriState (logic gates with three states). 
         [0089]    The logic unit G4 is a logic gate AND. 
         [0090]    Of course, we can consider other ways to generate the controls of the circuit. 
         [0091]    In this embodiment, the switches Q 1  and Q 4  are CMOS transistors in the closed state when the control is a logic ‘0’. 
         [0092]    The switches Q 2 L and Q 2 R are CMOS transistors in the closed state when the control is logic ‘1’.