Braking interlock for an electric brake system of an aircraft

An electric brake system for an aircraft includes a power interlock mechanism that prevents inadvertent (uncommanded) application of brakes. The interlock removes operating power from the brake mechanisms whenever the brake system sensor data does not indicate a legitimate brake application condition. The interlock processing occurs in parallel with the brake command processing such that even if an inadvertent brake command is generated, the brake mechanisms will be unable to act upon the inadvertent brake command.

TECHNICAL FIELD

Embodiments of the present invention relate generally to an electric brake system for an aircraft. More particularly, embodiments of the present invention relate to a brake interlock mechanism for an electric brake system of an aircraft.

BACKGROUND

Many aircraft utilize brake systems having brake mechanisms that are controlled by direct cable or hydraulic control architectures. Modern aircraft are beginning to replace conventional cable actuated and hydraulic actuated aircraft brake systems with electrically actuated and electrically controlled brake systems. Such electric brake systems are colloquially referred to as “brake by wire” systems. An aircraft brake system should be designed with safety features that prevent inadvertent braking (i.e., the application of brakes in the absence of a legitimate braking command from the pilot or an automated aircraft system). Moreover, an aircraft brake system should include sufficient processing redundancy to provide reliable brake control and robustness.

BRIEF SUMMARY

An electric brake system suitable for use with an aircraft includes an interlock arrangement that controls whether or not operating power is provided to the electric brake actuators that govern wheel braking. The interlock arrangement utilizes a hardware-based power control architecture that regulates operating power for brake mechanisms in parallel with a software-based command architecture that generates brake mechanism control signals. In one embodiment, a plurality of such interlock arrangements are employed in an independent manner for a plurality of wheel brakes (or for a plurality of wheel brake groups), thus providing reliability and robustness.

The above and other aspects of embodiments of the invention may be carried out by a control arrangement for an electric brake system of an aircraft. The control arrangement includes a brake actuator power control architecture configured to enable/disable operating power for a brake mechanism of the electric brake system, and a brake actuator command architecture in parallel with the brake actuator power control architecture. The brake actuator command architecture is configured to process brake mechanism control signals for the brake mechanism, the brake actuator power control architecture is capable of preventing actuation of the brake mechanism independently of the brake actuator command architecture, and the brake actuator command architecture is capable of preventing actuation of the brake mechanism independently of the brake actuator power control architecture.

The above and other aspects of embodiments of the invention may be carried out by a method for providing an interlock for an electric brake system of an aircraft. The method involves receiving brake actuation data, processing the brake actuation data, and, if the brake actuation data does not indicate a brake application condition, regulating operating power for a brake mechanism to temporarily disable the brake mechanism. Concurrently with and independent of this power management scheme, the method generates brake mechanism control signals in response to the brake actuation data and controls actuation of the brake mechanism with the brake mechanism control signals.

The above and other aspects of embodiments of the invention may be carried out by an electric brake system for an aircraft. The electric brake system includes a brake mechanism for a wheel of the aircraft and a brake control architecture coupled to the brake mechanism. The brake control architecture includes a brake command control configured to generate brake mechanism control signals for the brake mechanism in response to brake actuation data, and an interlock mechanism configured to regulate operating power for the brake mechanism in response to the brake actuation data, concurrently with operation of the brake command control, and independent of the brake command control.

DETAILED DESCRIPTION

The following detailed description is merely illustrative in nature and is not intended to limit the embodiments of the invention or the application and uses of such embodiments. Furthermore, there is no intention to be bound by any expressed or implied theory presented in the preceding technical field, background, brief summary or the following detailed description.

An aircraft as described herein employs an electric brake system, which may be powered by any suitable power supply, such as an active aircraft power supply that is operational when the aircraft engine(s) are running or a main aircraft battery. The electric brake system includes an interlock feature that is independent of the brake command feature that generates the various brake mechanism control signals. The interlock feature is suitably configured to prevent inadvertent application of the aircraft brakes by removing the actuation power from the electric brake actuators. Thus, even if the actuators are commanded to apply brakes, the lack of actuation power renders them unable to respond to the inadvertent brake commands.

FIG. 1is a schematic representation of an example embodiment of an electric brake system100for an aircraft. In the example embodiment shown inFIG. 1, the aircraft employs a left electric brake subsystem architecture102and a right electric brake subsystem architecture104, which are similarly configured. The terms “left” and “right” refer to the port and starboard of the aircraft, respectively. In practice, the two subsystem architectures102/104may be independently controlled in the manner described below. For simplicity, only left electric brake subsystem architecture102is described in detail below. It should be appreciated that the following description also applies to right electric brake subsystem architecture104.

For this example deployment, left electric brake subsystem architecture102generally includes: a brake pedal106; other brake actuation mechanisms108; a brake system control unit (BSCU)110coupled to brake pedal106and to other brake actuation mechanisms108; an outboard electric brake actuator control (EBAC)112coupled to BSCU110; an inboard EBAC114coupled to BSCU110; an outboard wheel group that includes a fore wheel116and an aft wheel118; an inboard wheel group that includes a fore wheel120and an aft wheel122; electric brake mechanisms (reference numbers124,126,128, and130) coupled to the EBACs, and remote data concentrators (reference numbers132,134,136, and138). Each electric brake mechanism includes at least one electric brake actuator that is controlled by the respective EBAC. The electric brake mechanisms and the remote data concentrators correspond to each wheel of left electric brake subsystem architecture102. Although not shown inFIG. 1, an embodiment may have more than one electric brake mechanism and more than one remote data concentrator per wheel.

Electric brake system100can be applied to any number of electric braking configurations for an aircraft, and electric brake system100is depicted in a simplified manner for ease of description. An embodiment of electric brake system100as deployed may include any number of BSCUs, any number of EBACs coupled to and controlled by each BSCU, and any number of brake mechanisms for each wheel (or for each group of wheels). In operation, electric brake system100can independently generate and apply brake actuator control signals for each wheel of the aircraft or concurrently for any group of wheels.

The elements in left electric brake subsystem architecture102can be coupled together using a data communication bus or any suitable interconnection arrangement or architecture. For example, a digital data communication bus or buses may be configured to communicate EBAC control signals from BSCU110to the EBACs, to communicate brake mechanism control signals (e.g., actuator control signals) from the EBACs to the electric brake actuators, etc. Briefly, BSCU110reacts to manipulation of brake pedal106and generates control signals that are received by EBACs112/114. In turn, EBACs112/114generate brake mechanism control signals that are received by electric brake mechanisms124/126/128/130. In turn, the electric brake actuators engage to impede or prevent rotation of the respective wheels. These features and components are described in more detail below.

Brake pedal106is configured to provide pilot input to electric brake system100. The pilot physically manipulates brake pedal106, resulting in deflection or movement (i.e., some form of physical input) of brake pedal106. This physical deflection is measured from its natural position by a hardware servo, one or more brake pedal sensors, or any equivalent component, converted into a BSCU pilot command control signal by a transducer or an equivalent component, and sent to BSCU110. The BSCU pilot command control signal may convey brake pedal sensor data that may include or indicate the deflection position for brake pedal106, the deflection rate for brake pedal106, a desired braking condition for brake mechanisms124/126/128/130, or the like.

Other brake actuation mechanisms108may include one or more of the following, without limitation: a thrust lever for the aircraft and any associated sensors and processing logic; a parking brake lever for the aircraft and any associated sensors and processing logic; a landing gear up/down lever for the aircraft and any associated sensors and processing logic; and any other device, component, or subsystem of the aircraft that may have an impact on the operation of the aircraft brake mechanisms. Other brake actuation mechanisms108may control the application of brakes even in the absence of pilot manipulation of brake pedal106. For example, electric brake system100(and BSCU110in particular) may be configured to prevent the application of brakes if the thrust lever is not at idle. As another example, electric brake system100(and BSCU110in particular) may be configured to enable the brake mechanisms whenever the parking brake lever is engaged. As yet another example, electric brake system100(and BSCU110in particular) may be configured to disable the brake mechanisms when the landing gear lever is in an “up” state (i.e., the landing gear of the aircraft are retracted). In practice, a gear retract braking feature may allow electric brake system100to apply the brakes while the landing gear is being retracted and/or for a short time after the landing gear has retracted.

An embodiment of electric brake system100may use any number of left BSCUs110. For ease of description, this example includes only one left BSCU110. BSCU110is an electronic control unit that has embedded software that digitally computes EBAC control signals that represent braking commands. The electrical and software implementation allows further optimization and customization of braking performance and feel if needed for the given aircraft deployment.

BSCU110may be implemented or performed with a general purpose processor, a content addressable memory, a digital signal processor, an application specific integrated circuit, a field programmable gate array, any suitable programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof, designed to perform the functions described herein. A processor may be realized as a microprocessor, a controller, a microcontroller, or a state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other such configuration. In one embodiment, BSCU110is implemented with a computer processor (such as a PowerPC 555) that hosts software and provides external interfaces for the software.

BSCU110monitors various aircraft inputs to provide control functions such as, without limitation: pedal braking; parking braking; automated braking; and gear retract braking. In addition, BSCU110blends antiskid commands (which could be generated internally or externally relative to BSCU110) to provide enhanced control of braking. BSCU110obtains pilot command control signals from brake pedal106, along with additional command control signals from other brake actuation mechanisms108. BSCU110may also receive wheel data (e.g., wheel speed, rotational direction, tire pressure, etc.) from remote data concentrators132/134/136/138. BSCU110processes its input signals and generates one or more EBAC control signals that are received by EBACs112/114. In practice, BSCU110transmits the EBAC control signals to EBACs112/114via a digital data bus. In a generalized architecture (not shown), each BSCU can generate independent output signals for use with any number of EBACs under its control.

BSCU110is coupled to EBACs112/114in this example. Each EBAC112/114may be implemented, performed, or realized in the manner described above for BSCU110. In one embodiment, each EBAC112/114is realized with a computer processor (such as a PowerPC 555) that hosts software, provides external interfaces for the software, and includes suitable processing logic that is configured to carry out the various EBAC operations described herein. Each EBAC112/114obtains EBAC control signals from BSCU110, processes the EBAC control signals, and generates the brake mechanism control signals (brake actuator signals) for its associated electric brake mechanisms.

Notably, the functionality of BSCU110and EBACs112/114may be combined into a single processor-based feature or component. In this regard, BSCU110, EBAC112, EBAC114, or any combination thereof can be considered to be a brake control architecture for electric brake system100. Such a brake control architecture includes suitably configured processing logic, functionality, and features that support the brake control operations described herein.

Each wheel may include an associated electric brake mechanism, and each brake mechanism may include one or more electric brake actuators. Consequently, braking and parking braking for each wheel may be independently and individually controlled by electric brake system100. Each electric brake actuator is suitably configured to receive actuator control signals from its respective EBAC, wherein the actuator control signals influence adjustment of the electric brake actuator. In this embodiment, each electric brake actuator in electric brake system100is coupled to and controlled by an EBAC. In this manner, EBACs112/114control the electric brake actuators to apply, release, modulate, and otherwise control the application of the wheel brakes. In this regard, EBACs112/114generate the brake mechanism control signals in response to the respective EBAC control signals generated by BSCU110. The brake mechanism control signals are suitably formatted and arranged for compatibility with the particular brake mechanisms utilized by the aircraft. Those skilled in the art are familiar with aircraft brake mechanisms and the general manner in which they are controlled, and such known aspects will not be described in detail here.

The left electric brake subsystem architecture102may include or cooperate with a suitably configured power control subsystem140. Power control subsystem140may be coupled to BSCU110, to EBACs112/114(and/or to other components of electric brake system100). In this embodiment, power control subsystem140is suitably configured to provide, apply, remove, switch, or otherwise regulate the operating power for the electric brake mechanisms and/or the electric brake actuators as needed. For example, power control subsystem140can remove power from EBACs112/114and/or other components of left electric brake subsystem architecture102as needed to provide an interlock feature for electric brake system100. As described in more detail below, power control subsystem140may be implemented with a left outboard power supply unit and a left inboard power supply unit that function in an independent manner to regulate operating power for the left outboard and left inboard electric brake components.

Right electric brake subsystem architecture104has a structure that is similar to left electric brake subsystem architecture102(common features, functions, and elements will not be redundantly described here). For this example deployment, as shown inFIG. 1, right electric brake subsystem architecture104includes: a brake pedal142that is separate and distinct from brake pedal106; other brake actuation mechanisms144; a BSCU146; an inboard EBAC148; an outboard EBAC150; and a power control subsystem152that is separate and distinct from power control subsystem140. In practice, one or more of the other brake actuation mechanisms144may be the same as one or more of the other brake actuation mechanisms108in left electric brake subsystem architecture102. Alternatively, the two sides of electric brake system100may utilize separate and distinct components for the other brake actuation mechanisms108/144. These various components of right electric brake subsystem architecture104are coupled together to operate as described above for left electric brake subsystem architecture102, however, the right-side processing is preferably independent of the left-side processing.

In accordance with one embodiment of an electric brake system for an aircraft, a power interlock feature is provided to prevent inadvertent application of the wheel brakes (and to prevent inadvertent release of the wheel brakes). A control arrangement or architecture in the electric brake system can be designed to implement such an interlock feature. For example, electric brake system100may be configured to support a power interlock feature.

FIG. 2is a diagram that illustrates independent processing channels of an aircraft electric brake system configured in accordance with an embodiment of the invention. In particular,FIG. 2depicts a left outboard power control channel202, a left outboard brake command channel204, a left inboard power control channel206, a left inboard brake command channel208, a right inboard power control channel210, a right inboard brake command channel212, a right outboard power control channel214, and a right outboard brake command channel216. These processing channels may be realized in the components of electric brake system100, e.g., the BSCUs, the EBACs, the power control subsystems, etc. In practice, each processing channel may include, without limitation: hardware components; digital logic elements; processing logic; circuit components; or any suitably configured architecture, arrangement, or feature. Moreover, each processing channel is suitably configured to perform the operations described herein.

For this example, the left processing channels correspond to left-side processing of the electric brake system and the right processing channels correspond to right-side processing of the electric brake system. In this regard, the left processing channels may be fed by a left sensor data module218, which is configured to provide brake actuation data to the left processing channels. In an embodiment of an electric brake system, left sensor data module218provides the same brake actuation data to each of the left processing channels. Similarly, the right processing channels may be fed by a right sensor data module220, which is configured to provide brake actuation data to the right processing channels. In an embodiment of an electric brake system, right sensor data module220provides the same brake actuation data to each of the right processing channels. Moreover, left sensor data module218and right sensor data module220may receive, process, and/or provide common brake actuation data. For example, if the aircraft includes only one parking brake lever, then the parking brake sensor data may be shared by left sensor data module218and right sensor data module220(and, therefore, shared by all of the left and right processing channels).

Left outboard power control channel202and left outboard brake command channel204cooperate to influence the operation of left outboard brake mechanisms222. In this regard, left outboard power control channel202and left outboard brake command channel204represent a control arrangement for the left outboard architecture of the electric brake system. For this example, left outboard power control channel202is suitably configured to provide the electric brake actuator operating power for left outboard brake mechanisms222using, e.g., a 130 volt power supply224. Left outboard power control channel202functions to switch power supply224on and off as needed to enable and disable (respectively) left outboard brake mechanisms222(the switches shown inFIG. 2are conceptual in nature and are shown for ease of description). In one embodiment, left outboard power control channel202is suitably configured to regulate operating power for an EBAC coupled to left outboard brake mechanisms222.

Left outboard brake command channel204is in parallel with left outboard power control channel202. Left outboard brake command channel204is suitably configured to process brake mechanism control signals for left outboard brake mechanisms222. In one embodiment, left outboard brake command channel204is configured to generate brake mechanism control signals for execution by an EBAC coupled to left outboard brake mechanisms222. Notably, the brake mechanism control signals are effective only when left outboard brake mechanisms222are provided with adequate operating power. Accordingly, left outboard brake mechanisms222will be actuated if left outboard power control channel202enables operating power while the brake mechanism control signal indicates the application of some clamping force. In contrast, left outboard brake mechanisms222will remain in a released (non-actuated) state if left outboard power control channel202disables operating power or if the brake mechanism control signal indicates the application of no clamping force.

In a preferred embodiment, the processing channels of the electric brake system are substantially (if not totally) independent of each other. For example, left outboard power control channel202is suitably configured to prevent actuation of left outboard brake mechanisms222independently of left outboard brake command channel204. Likewise, left outboard brake command channel204is suitably configured to prevent actuation of left outboard brake mechanisms222independently of left outboard power control channel202. Although these two processing channels may share some brake actuation data, sensors, and/or sensor interfaces, the processing intelligence that determines whether left outboard brake mechanisms222are actuated is separated. In addition, the control arrangements for the left outboard brake mechanisms222, the left inboard brake mechanisms226, the right inboard brake mechanisms228, and the right outboard brake mechanisms230are substantially (if not totally) independent of each other. For example, the four control arrangements may operate concurrently with, and independent of, each other, or the left-side brake control architecture may operate concurrently with, and independent of, the right-side brake control architecture. The remaining three control arrangements depicted inFIG. 2operate as described above for the left outboard processing channels.

FIG. 3is a schematic representation of a portion of an aircraft electric brake system configured in accordance with an embodiment of the invention. In particular,FIG. 3depicts components of a left electric brake subsystem architecture300(as mentioned above, the right electric brake subsystem architecture has a similar structure). The electric brake system may also be configured as described above in the context ofFIG. 1andFIG. 2. Accordingly, certain features, components, and functions of left electric brake subsystem architecture300will not be redundantly described here.

Left electric brake subsystem architecture300may include a BSCU302, an outboard electric brake power supply unit (EBPSU)304, an inboard EBPSU306, an outboard EBAC308, an inboard EBAC310, one or more outboard brake mechanisms312, and one or more inboard brake mechanisms314. Subsystem architecture300is suitably configured to receive or process brake actuation data from brake pedal sensor(s)316and/or from other brake actuation sensor(s)318.

BSCU302is generally configured as described above for BSCU110. BSCU302may include a sensor data module320, an outboard interlock decision module322, an outboard brake command control324, an inboard brake command control326, and an inboard interlock decision module328. Sensor data module320includes input nodes or ports for receiving the brake pedal sensor data and/or other brake actuation sensor data. Sensor data module320may also include one or more suitably configured sensor interfaces that facilitate communication with brake pedal sensor(s)316and other brake actuation sensor(s)318. In this example, sensor data module320makes the same brake actuation data available to outboard interlock decision module322, outboard brake command control324, inboard brake command control326, and inboard interlock decision module328. The “output” of sensor data module320depicted inFIG. 3may actually include a plurality of signals that indicate any number of different brake actuation data types.

Each interlock decision module322/328processes brake actuation data and generates, in response to the brake actuation data, a respective enable/disable control signal for a power supply (e.g., an EBPSU) of a brake mechanism. Here, outboard interlock decision module322generates one enable/disable control signal for outboard EBPSU304, while inboard interlock decision module328generates another enable/disable control signal for inboard EBPSU306. If, for example, the brake actuation data indicates a brake application condition, then each interlock decision module322/328will independently enable operating power to its respective brake mechanism(s). As used here, a “brake application condition” means any operating status, state, or configuration of the aircraft that is intended to result in the application of the brakes. For example, a brake application condition may result from: engagement of a brake pedal; setting of the parking brake lever; retraction of the landing gear (activation of gear retract braking); activation of an autobraking mode; or the like. On the other hand, if the brake actuation data does not indicate a brake application condition, then each interlock decision module322/328will independently disable operating power for its respective brake mechanism(s). This feature prevents inadvertent application of brakes, which might otherwise occur if an erroneous braking command is propagated through left electric brake subsystem architecture300.

Each interlock decision module322/328may be realized in hardware using digital logic gates and related circuitry that processes the brake actuation data to generate the respective enable/disable control signals. In this regard, an enable/disable control signal may be a binary control signal having logic high and low states. The EBPSUs304/306respond to the respective enable/disable control signals in an appropriate manner.

Each brake command control324/326is suitably configured to generate respective brake mechanism control signals in response to the brake actuation data. Here, outboard brake command control324generates brake mechanism control signals for outboard EBAC308, which in turn controls outboard brake mechanisms312, while inboard brake command control326generates independent brake mechanism control signals for inboard EBAC310, which in turn controls inboard brake mechanisms314. In practice, the brake mechanism control signals influence the actuation of the electric brake actuators in the brake mechanisms (i.e., the percentage of full clamping force imparted by the electric brake actuators). For example, a brake mechanism control signal may command the electric brake actuators to release or apply no clamping force, it may command the electric brake actuators to apply full clamping force, or it may command the electric brake actuators to apply some intermediate clamping force.

Outboard interlock decision module322and outboard brake command control324operate concurrently (yet independently) on the same brake actuation data. Likewise, inboard interlock decision module328and inboard brake command control326operate concurrently (yet independently) on the same brake actuation data. The segregation of processing architectures in this manner improves reliability and robustness of the electric brake system.

In this embodiment, BSCU302controls EBPSUs304/306to enable/disable brake mechanisms312/314as needed. Each EBPSU304/306is configured to provide the operating voltage to its respective EBAC308/310. As mentioned above in connection withFIG. 2, the nominal EBAC operating voltage for this embodiment is about 130 volts. Thus, the EBPSUs can enable/disable the brake mechanisms by providing/removing this 130 volt supply voltage to/from the EBACs.

Outboard EBAC308may employ an actuator power path330and an actuator control path332. Actuator power path330represents structure, a channel, or an architecture configured to provide the operating power from outboard EBPSU to outboard brake mechanisms312. Actuator control path332represents structure, a channel, or an architecture configured to process and transfer brake mechanism control signals from BSCU302to outboard brake mechanisms312. Inboard EBAC310also includes similarly configured actuator command and actuator power paths. In this example, these four paths are separate and independent of each other.

FIG. 4is a flow chart that illustrates an electric brake interlock process400suitable for use in connection with an aircraft electric brake system. The various tasks performed in connection with process400may be performed by software, hardware, firmware, or any combination thereof. For illustrative purposes, the following description of process400may refer to elements mentioned above in connection withFIGS. 1-3. In embodiments of the invention, portions of process400may be performed by different elements of the described system, e.g., a BSCU, an EBAC, an EBPSU, or the like. It should be appreciated that process400may include any number of additional or alternative tasks, the tasks shown inFIG. 4need not be performed in the illustrated order, and process400may be incorporated into a more comprehensive procedure or process having additional functionality not described in detail herein.

In connection with electric brake interlock process400, the electric brake system receives and processes brake actuation data (task402) in a continuous or rapidly sampled manner.FIG. 4depicts two processing branches that occur concurrently during process400. An interlock processing branch404is shown on the left side ofFIG. 4, and a brake command processing branch406is shown on the right side ofFIG. 4. Interlock processing branch404analyzes the brake actuation data to determine whether it indicates a brake application condition (query task408). If so, then process400generates a “power supply enable” control signal (task410) that enables a power supply for the brake mechanisms. In addition, process400provides operating power to the brake mechanisms to enable the brake mechanisms (task412). In other words, the brake mechanisms will be able to respond to brake mechanism control signals. In this example, process400controls an EBPSU to switch its operating power supply on such that the operating power is provided to the EBACs coupled to the EBPSU. In turn, the EBACs provide the operating power to the brake mechanisms.

If query task408does not indicate a brake application condition, then electric brake interlock process400will regulate the operating power for the brake mechanisms to temporarily disable the brake mechanisms. In this regard, process400generates a “power supply disable” control signal (task414) that disables the power supply for the brake mechanisms (as a result, process400removes operating power from the brake mechanisms). In other words, the brake mechanisms will not be able to respond to any brake mechanism control signals because they lack sufficient operating power. In this example, process400controls an EBPSU to switch its operating power supply off to remove the operating power from the EBACs coupled to the EBPSU. In turn, the EBACs no longer provide operating power to the brake mechanisms.

Concurrently with (and independent of) interlock processing branch404, brake command processing branch406generates brake mechanism control signals in response to the received brake actuation data (task418). If the brake actuation data does not indicate a brake application condition (query task420), then the brake mechanism control signals will be generated in an attempt to prevent actuation of the brake mechanisms (task424). In other words, the brake mechanism control signals will command the brake mechanisms to release or apply no clamping force. If the brake actuation data indicates a brake application condition, then the brake mechanism control signals will be generated in an attempt to control actuation of the brake mechanisms (task422). In other words, the brake mechanism control signals will command the brake mechanisms to actuate by a designated amount, resulting in some brake clamping force. As mentioned above, these brake commands will be ineffective if interlock processing branch404has removed operating power from the brake mechanisms.

In summary, an electric brake system as described herein utilizes a brake control architecture having a hardware-based interlock that provides an on/off control for the operating power of the brake mechanisms, and a software-based processing path that generates the brake commands for the brake mechanisms. With this approach, the probability of uncommanded brake application is the probability of both the hardware interlock failing and the software control failing, which is very low in practical deployments. The only components that are in common are the brake actuator motors and motor control (unlikely to command on their own) and the sensor interfaces and sensors. The sensor interfaces and sensors are duplicated for each pilot input or the inputs from other systems that cause the brakes to actuate, so that a single failure in a sensor or sensor circuit will not cause the brakes to actuate.