Fail operational dual electromechanical servo actuator for aircraft with model monitoring

The dual electromechanical servo actuator comprises two electric servo motors coupled through differential gearing to position an output member in accordance with an input signal. Tachometer generators coupled to the respective output shafts of the servo motors, (and normally integral with the motors) provide rate feedback signals to the respective inputs of the servo amplifiers driving the respective motors. An electronic model of the dual servo actuators responsive to the input signal provides a rate signal simulating the tachometer responses to the input signal. A monitor compares the two tachometer signals and provides a failure signal when the difference therebetween exceeds a predetermined threshold. The monitor also simultaneously compares the model rate ouptut with the individual tachometer signals to determine which of the two servo channels has failed. The monitor circuits apply a brake to the servo motor output shaft of the failed channel. The remaining channel continues to properly position the output member through the differential gearing. For certain applications of the invention the monitor continues to compare the model rate output with the tachometer signal from the operating channel so as to detect a failure of the second channel and provide a fail passive condition.

BACKGROUND OF THE INVENTION 
1. Field of the Invention 
The invention relates to dual electromechanical servo actuators with model 
monitoring to provide fail operational characteristics. 
2. Description of the Prior Art 
Dual electromechanical servo actuators are known in the art and are 
exemplified by those disclosed in Applicant' assignee's pending U.S. 
patent application Ser. No. 811,653 entitled "Fail Passive Dual Servo With 
Continuous Motor Speed and Acceleration Monitoring" by M. T. DeWalt, filed 
June 30, 1977; Applicants' assignee's U.S. Pat. No. 4,035,705 entitled 
"Fail-Safe Dual Channel Automatic Pilot With Maneuver Limiting" By H. 
Miller issued July 12, 1977 and applicants' assignee's U.S. Pat. No. 
3,504,248 entitled "Dual Channel Servo System Having Torque Equalization" 
by H. Miller issued Mar. 31, 1970. 
These dual electromechanical servo actuators comprise two channels each 
including an electric servo motor driven by a servo amplifier. The motor 
output shafts are coupled through differential gearing to drive the output 
member. A tachometer generator, normally an integral part of each motor, 
provides an output shaft rate feedback signal to the input of the 
associated servo amplifier. A brake is included on the output shaft of 
each servo motor to clamp the shaft thereby disabling the channel. 
These prior art electromechanical servo actuators exhibit fail passive or 
fail safe characteristics in that should one of the channels fail, various 
means are provided in the prior art arrangements for applying the brake of 
the defective channel permitting the operative channel to continue to 
position the output member through the differential gearing. In a 
commercial aviation environment, a second failure (such as a hardover) in 
the remaining channel could result in catastrophic loss of the aircraft. 
Thus, commercial aviation regulatory agencies require that after the first 
failure has occurred, the flight control system, of which the servo 
actuator is a part, be disengaged with manual control assumed by the 
pilot. 
Although the above discussed dual electromechanical servo actuators 
adequately provide the intended performance as fail safe actuators, it is 
desirable under certain circumstances to provide fail operational 
performance with such actuators without an attendant increase in 
complexity, expense, bulk or weight. 
As discussed in said Ser. No. 811,653, it is desirable to detect failures 
as rapidly as possible and quickly advise the pilot of the failed channel 
even though during the detection and advisory period the control surface 
will not significantly deflect due to the torque transmission 
characteristic of the differential. Although the servo actuator of said 
Ser. No. 811,653 adequately achieves this particular objective, the servo 
of Ser. No. 811,653 is fail passive rather than fail operative. Thus, not 
only is rapid failure detection desirable, but a high probability of 
detecting the failures and isolating the failures is also desirable, 
particularly for servo actuators for positioning aircraft primary control 
surfaces. Fast detection of failure and high reliability as therefore 
desiderata of the present invention. 
SUMMARY OF THE INVENTION 
The above desiderata and objectives of the present invention are achieved 
by dual electromechanical servo channels including first and second 
electromechanical servo actuators coupled through differential gearing to 
drive a common positionable load. Each electric servo motor includes a 
brake for clamping the output thereof. An electronic model is included to 
simulate an output characteristic of the servo channels in response to the 
actuator input signal. A monitor compares the simulated characteristic 
from the model with the actual characteristics from each of the servo 
channels and provides a signal to actuate the brake of the channel whose 
characteristic differs from the simulated characteristic with respect to a 
predetermined threshold. 
Preferably each channel includes a tachometer for providing the actual 
channel rate characteristic which is compared in the monitor with the 
simulated rate characteristic provided by the model.

DESCRIPTION OF THE PREFERRED EMBODIMENT 
The dual electromechanical servo actuator of the present invention may be 
embodied utilizing a single model monitor and equalizer to provide in 
effect a third channel to achieve the fail operational performance. This 
embodiment is responsive to a single input command and is illustrated in 
FIG. 1. The invention may also be embodied with dual redundant models, 
monitors and equalizers and may be responsive to either dual redundant 
input command source or to a common command source. The embodiment is 
illustrated in FIG. 5. Both the embodiments of FIG. 1 and FIG. 5 may be 
configured in a fail operational, unmonitored mode whereby a first failure 
disables the defective channel permitting the operative channel to 
continue providing proper control but in an unmonitored mode. 
Alternatively the embodiments may be arranged in a fail operational, 
monitored mode whereby after the first failure and disablement of the 
first channel the second channel continues to operate in a monitored mode 
so that a second failure results in a fail passive condition. 
Referring now to FIG. 1, the dual electromechanical servo actuator 
embodiment utilizing a single model, monitor and equalizer is illustrated. 
Since the basic dual actuator is substantially the same as that described 
in said U.S. Pat. Nos. 4,035,705 and 3,504,248 as well as in said Ser. No. 
811,653, the actuator, per se, will only be briefly described herein in 
continuity. 
The actuator of FIG. 1 comprises dual channels 10 and 11 respectively, the 
channels being substantially identical with respect to each other. The 
servo channel 10 includes an electric servo motor 12 whose output shaft 13 
is coupled through suitable gearing 14 as one input to a mechanical 
differential 15. A tachometer generator 16 is included to provide a servo 
rate signal on a lead 17. The tachometer generator 16, normally an 
integral part of motor 12, provides the servo rate signal on the lead 17 
and therefore may be considered as being coupled to the motor output shaft 
13. A brake 20 is coupled to the output of the servo motor 12 to 
selectively arrest motion of the servo channel 10 and hence clamp the one 
differential input. The brake 20 is preferably of the spring loaded 
variety whereby removal of a control signal on a lead 21 causes engagement 
of the brake. The output from the tachometer generator 16 is applied with 
a gain K.sub.RATE in negative feedback fashion to a summing input 22 of a 
servo amplifier 23. The output of the servo amplifier 23 is applied to 
drive the servo motor 21 thereby forming a closed loop servo with rate 
feedback. Position feedback is also provided in a manner to be described. 
The summing input 22 of the servo amplifier 23 is also responsive to an 
input command signal on a lead 24 for positioning the servo motor 12, such 
command signals including attitude, attitude rate and maneuver commands. 
In a similar manner to that described with respect to the servo actuator 
channel 10, the channel 11 is comprised of servo motor 12' whose output 
13' is applied through suitable gearing 14' as the other input to the 
differential 15. Tachometer generator 16' coupled to the servo motor 
output shaft 13' provides the servo channel rate feedback signal to the 
summing input 22' of the servo amplifier 23'. Position feedback is also 
provided in a manner which will be described. The summing input 22' of the 
servo amplifier 23' is responsive to the common input command 24 for 
positioning the servo motor 12'. In the manner described above with 
respect to the brake 20, brack 20' is actuated to clamp the servo channel 
output upon removal of the signal from the line 21' thereby clamping the 
other differential input. 
The output from the differential 15 is applied through suitable gearing 25 
to a clutch 26 and drum 27 which in turn positions an output member or 
control surface 30 of an aircraft either directly or through a 
conventional hydraulic boost operator. As described in the referenced 
DeWalt application and Miller patent, due to the inherent torque transfer 
characteristics of the differential 15, a malfunction in either servomotor 
channel will result in an almost simultaneous large differential velocity 
between the two differential inputs without producing significant motion 
of the control surface. 
Substantially identical position transducers 31 and 31' (such as synchros, 
linear resolvers or potentiometers) provide negative position feedback 
signals to the summing inputs 22 and 22' of the servo amplifiers 23 and 
23' with gains K.sub.POS thereby closing the servo loans. The position 
transducers 31 and 31' are geared to the output of the differential 15 
through suitable gearing 32 and 32'. The position feedback outputs of 
transducers 31 and 31' represent the sum of the position outputs from the 
servo channels 10 and 11 as provided by the differential 15. It will be 
appreciated that if the position transducers 31 and 31' are synchro or 
linear resolver devices, demodulation circuits are utilized to convert the 
a.c. signals to the d.c. feedback signals required by the servo amplifiers 
23 and 23'. Where transducers 31 and 31' are potentiometers, then the d.c. 
signal output from the transducer is fed back to servo amplifiers thereby 
tightening the loop by eliminating any time delays associated with 
demodulation circuits. 
Equalization circuits 33 responsive to the servo rate outputs from the 
tachometer generators 16 and 16' provide equalization signals to the 
summing inputs 22 and 22' of the servo amplifiers 23 and 23'. For reasons 
similar to those discussed in said U.S. Pat. Nos. 3,504,248 and said 
4,035,705 as well as in said Ser. No. 811,653, the equalization circuit 33 
tends to reduce long term differences in servo motor rates with respect to 
the servo motors 12 and 12' during normal operation. Because of 
differences in servo drive and servo amplifier transfer characteristics, 
the servo motors 12 and 12' do not necessarily attain zero steady rates 
but may maintain some small non-zero steady state rate. Because, in a 
manner to be described, the motor rates are utilized for failure detection 
and isolation, any steady state rate would offset failure comparison 
thresholds thereby increasing susceptibility to false failure detection. 
The equalization circuit 33 subtracts the output of the tachometer 
generator 16 from the output of the tachometer generator 16' and provides 
an equalization signal in subtractive fashion to the summing input 22 and 
in additive fashion to the summing input 22', thereby reducing the 
difference in rate between the tachometer generators 16 and 16' to force a 
zero steady state. The detailed circuitry for the equalization circuit 33 
will be discussed below with respect to FIG. 2. 
The dual electromechanical servo actuator of FIG. 1, in accordance with the 
invention, includes electronic model circuitry 34 responsive to the common 
input command 24. The model 34 simulates the transfer function of the dual 
closed loop servo providing a simulated servo rate response on a lead 35, 
in response to the input command 24, in accordance with the closed loop 
dynamic response of the servo. Since the channels 10 and 11 are 
substantially identical, the model 34 of the single model embodiment of 
FIG. 1 provides only one simulated rate output on the lead 35. For 
purposes of simplicity the model 34 does not include simulation of 
variations in actuator loads since the failure detection procedure to be 
later described compensates for false failure detection caused by actuator 
load variations. It will be appreciated, however, that this parameter 
could also be simulated in the model 34. Detailed circuitry for the model 
34 will be described below with respect to FIG. 3. 
The dual servo actuator of FIG. 1 further includes, in accordance with the 
invention, a monitor circuit 36 responsive to the model rate signal on the 
lead 35. The monitor 36 is also responsive to the servo rate signals from 
the tachometer generators 16 and 16'. The monitor detects a failure by 
comparing the rate outputs from the tachometer generators 16 and 16' with 
respect to each other, providing a failure detection enabling signal when 
the difference therebetween exceeds a predetermined threshold. The monitor 
circuit 36 also determines which of the servo channels has failed by 
comparing the servo rate output of each tachometer generator with the 
simulated rate output from the model 34 thereby isolating the failure with 
respect to the failed channel. The monitor 36 then disables the failed 
channel by applying a failure signal to the appropriate lead 21 or 21' to 
actuate the appropriate servo channel brake. 
Upon detecting a failure the monitor 36 disables the equalization circuit 
33 via a lead 37 for reasons to be discussed. Depending upon the mode in 
which the system is being utilized, the monitor 36 may reduce the gain of 
the model 34 via a lead 40 and may either temporarily disable itself so as 
to prevent erroneous brake actuation of the valid channel during the 
braking procedure of the failed channel or may permanently disable itself 
for reasons to be discussed. Thus the monitor 36 compares servo channel 
rates to evaluate actuator integrity and compares servo channel and model 
rates to evaluate individual channel performance. A failure is detected 
and channel isolation enabled when the channel rates differ with respect 
to each other in excess of a threshold. The failed channel is then 
isolated when its rate differs from the model rate in excess of a 
threshold. Detailed circuitry of the monitor 36 will be discussed below 
the respect to FIG. 4. 
Referring now to FIG. 2, a detailed block diagram of the rate equalization 
circuit 33 is illustrated. The outputs from the tachometer generators 16 
and 16' are applied to a summing junction 50 wherein the rate output from 
the tachometer generator 16 is subtracted from that of the tachometer 
generator 16'. The difference signal is applied through a gain K.sub.EL 
which establishes the equalizer sensitivity. The rate error signal is 
applied to an equalization lag circuit 51 via a limiter 52. The time 
constant .tau..sub.E of equalization lag circuit 51 and the value of 
limiter 52 are chosen to equalize long term rate errors which minimizing 
the effects of equalization during normally commanded short term actuator 
transients. The output of the equalization lag circuit 51 is applied 
through a magnitude limiter 53 and a gain K.sub.E2 to provide the 
equalizer correction signals to summing inputs 22 and 22' (FIG. 1). The 
limiter 52 and the passive gain K.sub.E2 prevent large input errors from 
causing equalization over-compensation prior to failure detection. This 
minimizes transients caused by disabling the equalization circuitry when 
the system is switched to single channel mode in a manner to be explained. 
The limiter 53 restricts the maximum possible equalization output. The 
equalizer output is applied to the summing input 22 in subtractive fashion 
and to the summing input 22' in additive fashion, thereby tending to 
reduce rate differences between the outputs of the tachometer generators 
16 and 16' to zero. After detection of failure the equalizer 33 is 
disabled by the monitor circuit 36 via a signal on the lead 37 by 
grounding the equalizer output through an equalization disable switch 54. 
It will be appreciated that equalizers utilizing a lag circuit rather than 
integrators provide an advantage in that integrators tend to drift as long 
as there is a residual small input thereto whereas a log circuit attains a 
steady state condition. Additionally, an equalizer utilizing a lag circuit 
tends to response faster than equalizers utilizing integrators. 
Referring now to FIG. 3, a detailed schematic block diagram of the 
electronic model 34 utilized, in accordance with the invention, in the 
dual electromechanical servo actuator of FIG. 1 is illustrated. The model 
34 is responsive to the input command on the line 24 to simulate the 
closed loop dynamic transfer function of the dual servo actuator. Means 
are also included to change the model gain to simulate single channel 
operation after a failure. While in the illustrated embodiment the model 
34 is a fifth-order model that includes non-linearities associated with 
motor breakout and rate limit, it will be understood that models of 
greater or lesser orders may be employed depending upon the particular 
application. The model 34 provides a single rate output on the line 35 
representing the rate response of both servo channels 10 and 11. 
The servo amplifier circuitry of the dual servo actuator is simulated by a 
servo amplifier gain and lag simulation circuit 60 having the transfer 
function indicated by the legend. The input command signal transmitted 
through the simulation circuit 60 is applied to a non-linear circuit 61 
simulating servo motor rate limit. The output of the motor rate limit 
simulator 61 is applied to a non-linear motor breakout simulator 62 whose 
output is in turn applied through a summing junction 63 to components 
simulating the motor transfer function. A motor rate bias signal is summed 
into the summing junction 63 to simulate the differences between motor 
rate characteristics in the clockwise and counter clockwise directions of 
rotation. 
The motor transfer function is simulated by a gain and lag circuit 64 and a 
switch selectable integrator 65 or 65a. The output of the motor transfer 
function simulation circuits 64 and 65, 65a, is applied through a position 
limit simulation circuit 66 to demodulator filter simulation circuits 67 
and 68. The rate limit and position limit circuits 61 and 66 respectively 
simulate the inherent servo motor rate limit of the servo actuator and the 
output member control surface limiting device (not shown). The demodulator 
filter simulation circuits 67 and 68 simulate the demodulators that are 
utilized with the sychro position pick offs 31 and 31' as discussed above. 
The output of the demod filter 68 provides the model servo position 
simulation output which is applied in negative feedback fashion to a 
summing junction 71 which receives the input command from the line 24 and 
provides the input to the servo amplifier simulation circuit 60. 
A switch selectable differentiating circuit 72 or 72a is coupled to the 
position output from the position limit block 66 to provide the simulation 
for the tachometer generators 16 and 16' thereby providing the model rate 
signal on the lead 35. The output of the tachometer generator simulation 
circuit 72 is also applied through a gain K.sub.E in negative feedback 
fashion to the summing junction 71. 
As discussed above, the signal on the lead 40 from the monitor 36 is 
applied to the switch blocks 123 and 124 in a manner to select the reduced 
gain parameter 0.5 K.sub.C. This provision is utilized for model gain 
adjustments with respect to a first detected failure for simulating the 
dual servo prior to the failure and the remaining valid channel after the 
failure. The signal on line 40 selects the appropriate gain for matching 
the model to the dynamic response of the actuator when operating in both 
the dual channel and single channel modes. It is appreciated that other 
gain changing arrangements may be utilized to the same effect. 
Thus the purpose of the electronic model 34 is to provide a theoretical 
actuator with outputs that can be compared with the basic dual actuator 
outputs for failure detection, isolation and recovery. The model 34 does 
not simulate actuator loads and this provision is accounted for to prevent 
false failure detection caused by actuator load variations in a manner to 
be described with respect to the monitor 36. It will be appreciated that 
although a single channel model is illustrated in FIG. 3, a dual channel 
model may also be utilized in a manner to be described with respect to 
FIG. 5. The single channel model in effect provides a third servo channel 
commanded by the single input command common to the model and both servo 
channels with the model output being compared to both channel outputs. 
Although a particular model configuration was chosen for the described 
embodiment of the invention, other model arrangements may be utilized in 
practicing the invention. 
Referring now to FIG. 4, a schematic block diagram of the monitor 36 is 
illustrated. The failure monitor 36 is utilized to detect a servo actuator 
failure, to isolate the failure to the proper channel and to deactivate 
the failed channel. In order to accomplish these functions the monitor 36 
evaluates actuator performance during transient states while remaining 
insensitive to actuator load variations. The failure detection and 
isolation functions are performed by comparing servo channel rates in 
order to evaluate actuator integrity and by comparing servo channel and 
model rates to evaluate individual channel performance. A failure is 
detected and channel isolation enabled when the channel rates differ in 
excess of a threshold. After enablement of the monitor 36, the failed 
channel is isolated when its rate differs from the model rate in excess of 
a threshold. Thereafter an appropriate channel failure discrete signal is 
latched on and the failed channel disabled permitting continued single 
servo motor operation. The monitor 36 is configured to perform continuous 
monitoring during dynamic actuator operation and to minimize false 
detection resulting from load variations by requiring channel rate 
disagreement before a failure is recognized. 
The monitor 36 comprises a rate comparison section, a fault logic section 
and a mode switching section as indicated by the legends. The rate 
comparison section compares model and actuator rates, evaluates the rate 
differences and provides appropriate status discrete output signals. The 
fault logic section provides the criteria for failure recognition and the 
mode switching section provides the required control signals for servo 
actuator mode selection. 
The rate comparison section includes summing junctions 80 and 81 responsive 
to the model rate and to the outputs from tachometers 16 and 16' 
respectively to provide rate error signals with respect to the comparison 
between the model rate and the rates from channels 10 and 11 respectively. 
The rate comparison section also includes a summing junction 82 responsive 
to the outputs of the tachometers 16 and 16' to provide a rate error 
signal with respect to the rate differences between the two channels. The 
error signals representing the rate differences between channels 10 and 11 
and the model 34 are provided respectively by the summing junctions 80 and 
81 and are applied through respective amplifiers 83 and 84 and respective 
absolute value circuits 85 and 86 to respective comparators 87 and 88. The 
amplifiers 83 and 84 have gain constants K.sub.M1 which establishes the 
error monitor gain and lag T.sub.L which establishes the error monitor lag 
time constant. The absolute value circuits 85 and 86 take the absolute 
values of the outputs from the respective amplifiers 83 and 84 and apply 
these signals as inputs to the respective threshold comparators 87 and 88. 
Additionally each of the comparators 87 and 88 receives as an input a 
threshold signal V.sub.TH1 and provides an output when the associated 
input signal from the associated absolute value circuit exceeds the 
threshold. The outputs from the comparators 87 and 88 are applied through 
d.c.-d.c. converters 91 and 92 respectively to provide status discrete 
outputs indicating whether or not the respective error signal is within 
its threshold. The d.c.-d.c. converters 91 and 92 are utilized for logic 
level matching between the rate comparison circuitry and the fault logic 
circuitry. Thus the outputs of the converters 91 and 92 provide status 
discrete signals representing respective rate comparisons between channel 
10 and model 34 and channel 11 and the model 34 indicating a failure in 
the respective channel when the respective error signal exceeds the 
threshold V.sub.TH1. 
The rate error signal from the summing junction 82 representing the rate 
difference between the two channels is applied through an amplifier 93, an 
absolute value circuit 94, a comparator 95 and a d.c.-d.c. converter 96 in 
a manner similar to that described with respect to the error signals from 
the summing junctions 80 and 81. The amplifier 93 has a gain of K.sub.M1 
and a lag of T.sub.L which establishes the monitor gain and lag time 
constant as described above. The comparator 95 additionally receives a 
threshold input signal V.sub.TH2 and provides an output when the signal 
from the absolute value circuit 94 exceeds the threshold. The d.c.-d.c. 
converter 96 is utilized for logic level matching as discussed above and 
provides a status discrete signal indicating whether or not the 
inter-channel rate comparison error is within the threshold V.sub.TH2. The 
threshold V.sub.TH2 is set significantly lower than the threshold 
V.sub.TH1 to minimize false detection resulting from load variations in a 
manner to be explained. 
The status discrete signals from the d.c.-d.c. converters 91, 92 and 96 are 
applied to the fault logic section of the monitor 36 which provides the 
combinational logic for fault recognition and isolation. The outputs from 
the d.c.-d.c. converters 91 and 92 are applied as inputs to respective AND 
gates 100 and 101. The output of the d.c.-d.c. converter 96 is applied in 
common as a second input to each of the AND gates 100 and 101. A third 
input to each of the AND gates 100 and 101 is provided by a monitor enable 
signal on a line 102. The outputs of the AND gates 100 and 101 are applied 
as inputs to respective latches 103 and 104 which latch into a set state 
in response to the associated failure discrete signals transmitted through 
the gates 100 and 101. Once latched on, each of the latches 103 and 104 
continues to provide its output until reset by a signal on a reset line 
105. 
As explained above, the model 34 does not provide simulation for variations 
in actuator load. When a load variation is experienced by the actuator, 
the dual channels 10 and 11 both respond in the same manner providing 
similar variations in their rate outputs. The model, however, does not 
respond to the load variation and therefore its simulated rate does not 
match the actual channel rates due to the load variation. Under these 
conditions since the channel rates will track with respect to each other 
(in the absence of a failure), the threshold V.sub.TH2 of the comparator 
95 is not exceeded and thus the output of the converter 96 holds the AND 
gates 100 and 101 in a disabled condition. With the AND gates 100 and 101 
disabled, the outputs from the converters 91 and 92 which are indicative 
of channel-model rate discrepancies, will not be transmitted to the 
latches 103 and 104. A discrepancy between the channel rates in excess of 
V.sub.TH2 is first required to enable the AND gates 100 and 101 before a 
model-channel rate discrepancy can be transmitted to the latch 103 or the 
latch 104. Thus false failure detection resulting from load variations is 
minimized by requiring channel rate disagreement before recognizing a 
failure with respect to the individual channels. 
Thus a discrete output representing failure of channel 10 is set into the 
latch 103 when the monitor is enabled by a signal on the lead 102, the 
channel rate error exceeds the threshold V.sub.TH2 and the channel 
10-model rate error exceeds the threshold V.sub.TH1. Similarly a discrete 
output representing failure of channel 11 is set into the latch 104 when 
the monitor 36 is enabled by the line 102, the channel rate error exceeds 
the threshold V.sub.TH2 and the channel 11-model rate error exceeds the 
threshold V.sub.TH1. 
The mode switching section includes drivers 106 and 107 and the controls 
necessary to disable the failed channel and switch to single servo motor 
operation. The mode switching section includes brake controls 108 and 109 
for applying the brake control signals to the lines 21 and 21' 
respectively. The mode switching section further includes equalization 
disable control 110, model gain changing control 111 and monitor disable 
control 112 for providing the necessary control signals to the lines 37, 
40 and 102 respectively. The drivers 106 and 107 provide the interface 
circuitry between the input fault logic discretes and the brake, 
equalization, monitor and model gain changing controls. Diodes 113 and 114 
are included for isolation whereby a failure in either channel causes 
disablement of the equalization circuit 54, the monitor 36, model gain 
change control, and application of the appropriate brake control in 
accordance with the failed channel. The monitor disable control 112 
provides either permanent or temporary monitor disablement in accordance 
with the desired operating mode of the system. 
In operation the above described dual channel servo actuator may be 
utilized whereby after a first failure the failed channel is clamped, the 
monitoring is totally disabled with the remaining channel continuing to 
operate without monitoring. This actuator configuration may be utilized, 
for example, in remotely piloted drone aircraft. Alternatively the dual 
channel servo actuator of the present invention may be utilized in a first 
failure fail-operative, second failure fail-passive mode wherein after the 
first failure the failed channel is clamped, the equalization is disabled, 
the monitor is momentarily disabled during channel braking and the model 
gain is changed with the valid channel continuing monitored fail-passive 
control of the aircraft. When a second failure occurs the second channel 
is clamped and the system deactivated. This mode of operation may be 
utilized in commercial, general aviation, or military aircraft where fail 
operative performance is required. 
Prior to a failure and in both modes of operation the monitor disable 
control 112 provides an enabling signal to the line 102 thereby enabling 
the AND gates 100 and 101. The output from the d.c.-d.c. converter 96, 
however, maintains the AND gates 100 and 101 disabled until the channel 
rates disagree with respect to each other in excess of the threshold 
V.sub.TH2. As discussed above, this prevents false disablements due to 
load variations. When, however, a failure occurs in one of the channels, 
the cross-channel rate error will exceed the threshold V.sub.TH2 thereby 
applying an enabling signal to both of the AND gates 100 and 101. The rate 
comparison of the failed channel with respect to the model rate will 
exceed V.sub.TH1 thereby fully enabling the associated one of the AND 
gates 100 or 101 setting the associated one of the latches 103 and 104. 
The signal from the set latch applies the brake of the failed channel via 
the associated brake control 108 or 109, in accordance with the failed 
channel. The set latch through either the diode 113 or 114, enables the 
equalization disable control 110, the model gain change control 111 and 
the monitor disable control 112. As discussed above with respect to FIG. 
2, the equalization disable control 112 applies a signal via the line 37 
to ground the output of the equalization circuit 33. In the mode wherein 
the system will thereafter operate without monitoring, the monitor disable 
control 112 applies a permanent disabling signal to the AND gates 100 and 
101. In this mode of operation since model monitoring is no longer 
utilized after the first failure, the model gain change control 111 need 
not be enabled. The equalization circuitry is disabled after failure since 
channel rate equalization will be detrimental with one of the channels 
clamped. 
In the fail operative mode the monitor disable control 112 is configured to 
temporarily disable the AND gates 100 and 101 after detection of a first 
failure so as to prevent erroneous setting of the latch associated with 
the valid channel during braking of the failed channel. In response to the 
first failure the associated latch is set and will remain set until a 
signal is applied to the reset line 105. After the braking operation is 
accomplished the monitor disable control 112 reapplies an enabling signal 
to the line 102 whereby a second failure may be detected with respect to 
the comparison between the valid channel rate and and the model rate. In 
effect, one-half of the monitor circuit 36 is disabled after the first 
failure by reason of the associated latch remaining in its set state 
irrespective of outputs from the associated AND gate. 
In the fail operative mode the equalization circuitry 33 is disabled, as 
described above, by the equalization disable control 110. In this mode the 
model gain change circuit 111 provides a signal on the line 40 which 
reduces the model gain by one-half so as to match the model response to 
the single channel operation of the actuator effected after the first 
detected failure as described with reference to FIG. 3. In effect, the 
signal on the line 40 divides the model gain constant K.sub.C (FIG. 3) by 
two. In one preferred embodiment of the invention a 0.2 second disablement 
of the monitor is, for example, utilized after detection of the first 
failure. Other time constants may, of course, be used depending upon the 
application. In a preferred embodiment of the invention the model-channel 
rate error threshold V.sub.TH1 is set to be exceeded by a rate difference 
of 100 rpm whereas the cross channel rate error threshold V.sub.TH2 is set 
whereby a 30 rpm rate difference exceeds the threshold. These velocity 
values may be selected as required by the specific application. The 
monitor 36 utilizes servo motor rate for fault isolation as well as for 
fault detection. It will be appreciated that servo position information 
could also have been utilized for fault detection. 
Thus it is appreciated that the dual servo actuator system of the present 
invention not only permits continued single channel unmonitored operation 
after a first failure, but may also include the fail-passive feature whch 
permits the system to fail operational for the first failure by continuing 
single channel monitored operation and to fail passive for a second 
failure by clamping the second failed channel. As discussed above, in 
order to incorporate the fail-passive operation the model 34 may switch 
between simulation of dual motor and single motor operation by including 
gain changing switches as at 123, 124 of FIG. 3 to select the appropriate 
value for the gain K.sub.C from blocks 65, 65a and 72 and 72a respectively 
and by including the model mode control 111 to control the model gain. In 
this mode the monitor disable command is a momentary command of, for 
example, 0.2 seconds which prevents false failure detection due to 
transients during channel braking and model mode switching. After the 
first failure the system converts to the fail-passive configuration as 
described above. 
The above described embodiment of FIG. 1 comprises a dual redundant servo 
actuator with a single model, monitor and equalizer comprising in effect a 
third servo channel, all three channels being responsive to the single 
input command. Referring now to FIG. 5 in which like reference numerals 
indicate like components with respect to FIG. 1, a fully redundant dual 
servo actuator with model, monitor and equalization circuits in each 
channel is illustrated. The two channels are responsive to dual redundant 
input command sources. It is appreciated, however, that a single input 
command source may alternatively be utilized. The configuration and 
operation of most of the components of FIG. 5 are identical to those 
similarly referenced components of FIG. 1 and only those components that 
are unlike those previously discussed will now be described. The 
embodiment of FIG. 5 includes dual redundant electronic models 120 and 
120' in channels 10 and 11 respectively. Each of the models 120 and 120' 
is identical to the model illustrated and discussed with respect to FIG. 
3. The inputs and outputs to the models 120 and 120' are also identical to 
those described above. 
The channels 10 and 11 also include respective equalization circuits 121 
and 121' which are identical to the equalization circuit illustrated and 
described with respect to FIG. 2. The inputs and outputs to the 
equalization circuits 121 and 121' are also identical to those described 
above. 
The channels 10 and 11 include respective monitor circuits 122 and 122' 
which function in a manner similar to that described above with respect to 
FIG. 4. The monitor circuit 122 compares the channel rates with respect to 
each other to enable the monitor and compares the tachometer rate from 
channel 10 with the simulated model rate from the model 120 to detect 
failure with respect to channel 10 and to consequently apply the brake 20. 
The monitor 122' similarly compares the channel rates with respect to each 
other and compares the channel rate from tachometer 16' with the simulated 
model rate from the model 120' to actuate the brake 20'. Since the 
monitoring functions are performed in dual redundant fashion as compared 
to the single channel comparison described above with respect to FIGS. 1 
and 4, the monitor circuits 122 and 122' are configured somewhat 
differently from the monitor circuit 36 depicted in FIG. 4. Basically the 
monitor 122 is comprised of the upper and middle strings of components and 
the monitor 122' is comprised of the middle and lower strings of 
components illustrated in FIG. 4 with the mode switching logic being 
repeated in both monitors. 
FIG. 6 illustrates the details of the monitor circuits 122 and 122' where 
the components thereof are configured and function in a manner similar to 
that described above with respect to FIG. 4. The output of either of the 
d.c.-d.c. converters enable both AND gates so that the failure discrete 
signal from the faulty channel can set the appropriate brake. When failure 
in either channel is detected, the equalization disable controls disable 
both equalization circuits 121 and 121' in the manner and for the reasons 
discussed above with respect to FIGS. 1 and 2. 
The embodiment of FIG. 5 operates in the same functional modes as described 
above with respect to FIG. 1. When the actuator operates in the mode 
wherein after a first failure the monitoring is disabled, both of the 
monitor disable controls of FIG. 6 apply a permanent disabling signal to 
the respective AND gates. Thus in this mode after the first failure the 
defective channel is clamped and the valid channel operates unmonitored. 
In the mode wherein the actuator fails operational after the first failure 
and fails passive after the second failure, both of the monitor disable 
controls of FIG. 6 temporarily disable the respective AND gates during the 
braking of the effective channel and thereafter reapplies an enabling 
signal. The monitor (122 or 122') of the valid channel thereafter 
continues to provide monitoring for the valid channel. In this mode the 
model mode control of the monitor 122 reduces the gain of the model 120' 
and the model mode control of the monitor 122' decreases the gain of the 
model 120 after the first failure. It is appreciated, for the reasons 
discussed above, that the monitor of the failed channel is effectively 
disabled since the associated latch remains in its set condition after 
detecting the failure and thereafter is not responsive to further 
indications from its associated AND gate. The monitor of the valid 
channel, however, continues to function normally since its latch has not 
yet been set. 
It is appreciated from the foregoing that the actuator modeling and failure 
monitoring techniques described hereinabove provide an effective and 
versatile dual servo actuator system. The actuator can be adapted to 
provide either fail-operative and/or fail-passive modes of operation and 
can be utilized in the triplex (dual servo with a model and monitor) 
arrangement of FIG. 1 or in the dual-dual (dual servo with dual models and 
monitors) configuration of FIG. 5. The triplex system of FIG. 1 is less 
complex than that of FIG. 5 but the dual-dual arrangement of FIG. 5 
provides greater system reliability. 
Thus the present invention provides a dual electromechanical actuator that 
has fail operational performance, a high probability of detecting, 
isolating and recovering from failures, and the rapid recovery time 
required of actuators for use on aircraft primary control surfaces. Not 
only does the present invention provide enhanced reliability, and high 
probability of failure detection, but it also provides such extremely 
rapid recovery that only small control surface displacements occur due to 
failure. 
Although the above described embodiments of the invention were discussed in 
terms of the model illustrated in FIG. 3, it will be appreciated that 
other modeling arrangements could also be utilized. It will further be 
appreciated that although the above described embodiments of the invention 
advantageously utilize channel and model rate comparisons, other modeling 
schemes utilizing other actuator parameters (such as position or 
acceleration) may also be employed. 
The model monitoring techniques discussed above detect and isolate a 
failure when the channel rates differ, for example, by more than 30 rpm 
and when the faulty channel rate differs from the model rate by, for 
example, more than 100 rpm. The monitor then disables the failed channel 
by braking the motor. This permits continued operation utilizing the 
remaining good channel either unmonitored or in a fail passive monitored 
arrangement. The present invention may be utilized in either remotely 
piloted aircraft or in piloted military and commercial and applications 
wherein after system failure in an unmonitored mode or in a fail passive 
mode the actuator may be manually disengaged. 
While the invention has been described in its preferred embodiments, it is 
to be understood that the words which have been used are words of 
description rather than limitation and that changes may be made within the 
purview of the appended claims without departing from the true scope and 
spirit of the invention in its broader aspects.