Abstract:
A method and apparatus are disclosed for disabling on-board pilot operation of an aircraft and transferring aircraft operation to an alternate source of control. The aircraft has at least one manually actuated control device for controlling at least one mechanical actuator, with the actuator causing movement of an aircraft attitude control surface or an aircraft engine throttle. The control device is mechanically connected to the actuator(s). The alternate source of control may be one or more of an autopilot, a flight control system and an off-aircraft human pilot. The method and apparatus for disabling on-board pilot operation provides for (a) receiving a signal indicative of an emergency condition requiring the disabling of on-board pilot control of the aircraft; (b) disconnecting the one or more control devices from their respective actuator(s) in response to the receipt of the emergency condition signal; and (c) connecting the actuator(s) to the alternate source of control.

Description:
CROSS REFERENCE TO RELATED PATENTS AND PATENT APPLICATIONS 
     The subject matter of this application is related to that disclosed in the U.S. Pat. No. 6,917,863, issued Jul. 12, 2005 and entitled “SYSTEM FOR ASSUMING AND MAINTAINING SECURE REMOTE CONTROL OF AN AIRCRAFT”, which patent is incorporated herein by reference. The subject matter of this application is also related to that of the U.S. patent application Ser. No. 10/919,169, filed Aug. 16, 2004, and entitled “METHOD AND SYSTEM FOR CONTROLLING A HIJACKED AIRCRAFT”. This application was published on Feb. 16, 2006 under the Publication No. US2006/0032978, which publication is also incorporated herein by reference. 
     This application claims priority from U.S. Provisional Application No. 60/661,563, filed Mar. 14, 2005 and U.S. Provisional Application No. 60/668,329, filed Apr. 5, 2005. 
    
    
     BACKGROUND OF THE INVENTION 
     The present invention relates to a method and apparatus for assuming and maintaining secure control of an aircraft in the event of an intended, attempted or actual attack upon, or incapacity of, the pilot(s) of the aircraft. As is well known, terrorists and hijackers sometimes attempt to assume control of an aircraft by intimidating either the passengers and/or the crew. Once the attacker (terrorist or hijacker) takes control of an aircraft, he or she may cause it to fly to an inappropriate destination or may even cause the aircraft to crash. 
     The U.S. Pat. No. 6,917,863 discloses a method and system for assuming and maintaining secure remote control of an aircraft in the event of an actual or potential aircraft hijacking or incapacity of the pilot(s) due to illness or injury. The U.S. Patent Publication No. U.S. 2006/0032978 discloses a number of scenarios which may arise, in the event of a hijacking or other incapacity of the pilot(s), which entail an early autopilot/flight management computer control phase, followed by a later remote pilot control phase, whereby personnel on the ground or in another aircraft can assist in bringing the aircraft down for a safe landing at a desired location. 
     While the aforementioned patent and published patent application disclose various methods of interrupting on-board pilot control of the aircraft, and operating the aircraft either automatically, with the aid of an autopilot and/or flight control system, or by a remote off-board (off-aircraft) human pilot, they do not disclose how the on-board operation of the aircraft may be disabled, and how control by either automated equipment or by a remote pilot may be maintained, in every type of aircraft. In the event of a hijacking, it is imperative that, once an emergency condition is declared, no one on board the aircraft (including the attackers) be allowed to influence or control the flight path of the aircraft. 
     Some aircraft are entirely electronically controlled—that is, so-called “fly-by-wire” aircraft—in which substantially all of the control devices operated manually by the on-board pilot(s)—e.g. the control yoke, control knobs, rudder pedals and engine controls—generate electronic control signals that are supplied to the various mechanical actuators that cause movement of the aircraft attitude control surfaces—e.g. the ailerons, flaps, elevator, rudder and trim tabs—and the aircraft engines—e.g. throttle control, mixture control and fuel source controls. With such fly-by-wire aircraft, pilot operation can be disabled by interrupting or preventing the transmission of the electronic control signals generated by the manually operated control devices on the flight deck. 
     The majority of aircraft, however, are not “fly-by-wire” and instead entail a mechanical connection between the manually operated pilot control devices on the flight deck and the mechanical actuators which cause movement of the aircraft attitude control surfaces, aircraft engine components and the like. These mechanical connections are made by a variety of means including rods, levers and cables which transmit mechanical motion from one device to another or by hydraulic or pneumatic tubes and/or hoses which transmit fluid pressure to the mechanical actuators. 
     SUMMARY OF THE INVENTION 
     It is therefore an object of the present invention to provide a method and apparatus for disabling on-board pilot operation of a non-fly-by-wire aircraft and transferring aircraft operation to an alternate source of control, such as an autopilot, a flight control system or an off-aircraft human pilot. 
     It is a further, more particular object of the present invention to provide a method and apparatus for disabling on-board pilot operation of an aircraft which has one or more manually actuated control devices, such as a control yolk, rudder pedals and/or one or more engine controls, which are mechanically coupled to mechanical actuators that cause movement of aircraft attitude control surfaces, such as ailerons, flaps, trim tabs, elevator, rudder, and/or to the aircraft engines, respectively. 
     These objects, as well as further objects which will become apparent from the discussion that follows, are achieved, in accordance with the present invention, by providing a method and apparatus in a non-fly-by-wire aircraft for (a) receiving a signal indicative of an emergency condition requiring the disabling of on-board pilot control of the aircraft; (b) in response to the emergency condition signal, disconnecting at least one of the control devices from at least one of the actuators; and (c) in response to the emergency condition signal, connecting the disconnected actuator(s) to the alternate source of control. 
     Since there are numerous different configurations of aircraft control systems, various different methods and means must be provided to implement the present invention in practice. Such methods and means form different preferred embodiments of the present invention. Such preferred embodiments are set forth in the description below and are illustrated in the accompanying drawings. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a block diagram of various elements in the control system of an aircraft indicating a number of “interruptible links” in accordance with the present invention. 
         FIGS. 2A ,  2 B,  2 C,  2 D and  2 E are representational diagrams illustrating various devices for disabling a mechanical link. 
         FIGS. 3A and 3B  are representational diagrams illustrating a device for severing a mechanical cable. 
         FIG. 3C  is a representational diagram illustrating a device for blocking fluid passage in a hydraulic or pneumatic line. 
         FIGS. 4A and 4B  are representational diagrams illustrating a device for coupling and de-coupling two coaxial, rotatable axles. 
         FIGS. 5A and 5B  are representational diagrams illustrating a device for connecting and disconnecting pairs of rotatable pulleys. 
         FIGS. 6A and 6B  are representational diagrams illustrating a device for coupling and de-coupling pairs of pulleys to a common axle. 
         FIGS. 7A and 7B  are representational diagrams illustrating a tensioning device for mechanical cables. 
         FIGS. 8A and 8B  are representational diagrams illustrating clutch devices for coupling and de-coupling rotatable mechanical members. 
         FIGS. 9A and 9B  are representational diagrams illustrating a transmission device for coupling and de-coupling rotatable mechanical members. 
         FIGS. 10A and 10B  are representational diagrams showing additional embodiments of a transmission device and a clutch device for coupling and de-coupling rotatable mechanical members. 
         FIG. 11  is a block diagram of still another device for connecting alternate sources of control to a mechanical actuator. 
         FIG. 12  is a block diagram illustrating another device for connecting alternate sources of control to a rotatable mechanical coupling element. 
     
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     The preferred embodiments of the present invention will now be described with reference to  FIGS. 1-12  of the drawings. Identical elements in the various figures are designated with the same reference numerals. 
       FIG. 1  shows one preferred embodiment of the invention as described herein. It indicates how, in an aircraft where there are one or more mechanical linkages between the pilot&#39;s flight deck control and each of the associated control valves and throttles, control may be switched from the flight deck to either the autopilot/autothrottle/flight management computer or to a remote pilot. 
     In  FIG. 1 , the flight deck includes all elements shown above boundary line  100 . Items on the flight deck include button press  102 , pilot input and display  103  for electrically controlled flight elements, autopilot input and display  104 , auto-throttle input and display  105 , flight management computer input and display  106  and pilot&#39;s movable control elements  107  and  108 . Element  108  may include the control wheel (including both roll and pitch control components), the rudder pedals, or any other moving element whose motion is transmitted—either directly or indirectly—to a control surface of the aircraft. Element  107  may include one or more throttle members or other engine control devices, or any other moving elements whose motion is transmitted—either directly or indirectly—to one or more throttles or other engine-related mechanical actuators. 
     Element  107  is linked to mechanical linkage  97  (the portion of the linkage between  107  and  98 ), which is linked to  98  (the portion of the linkage controlled by interruptible link  115 ), which is linked to  99 , which transmits mechanical force to throttle  113 . Each of linkages  97 ,  98  and  99  may be a control rod, a cable system, a chain with multiple links, a hydraulic or pneumatic line, or combinations of these, or any mechanical system for transmission of force, as is known in the art. 
     Element  108  is linked to mechanical linkage  109  (the portion of the linkage between  108  and  110 ), which is linked to  110  (the portion of the linkage controlled by interruptible link  116 ), which is linked to  111 , which transmits mechanical force to control valve  114 . Each of linkages  109 ,  110  and  111  may be a control rod, a cable system, a chain with multiple links, a hydraulic or pneumatic line, or combinations of these, or any mechanical system for transmission of force, as is known in the art. 
     In the event of an attempted aircraft hijacking or pilot incapacity, the pilot, designated crew member or some combination thereof may activate the system via button press  102 . Hereinbelow, the term “hijacking” is intended to include both of (a) pilot incapacity and other emergency situations in which the pilot(s) is (are) incapable of flying the aircraft, and (b) hijacking situations in particular. Button press may also occur off-aircraft, as described in the aforementioned patent and patent application. Button press results in the removal of aircraft control from the flight deck (and, from any person on the aircraft) by interrupting all mechanical and electrical links from the flight deck to any controllable item on the aircraft. Button press results in transmission of an electrical signal from  112 A to each of:
           112 B which activates mechanical linkage interrupting apparatus  115  (which interrupts mechanical linkage  98 ), and mechanical linkage interrupting apparatus  116  (which interrupts mechanical linkage  110  [see  FIG. 2 , below]);     112 C which activates linkage interrupting apparatus  118  and  120 , interrupting on-board pilot connection to the autopilot and flight management computer;     112 D which signals flight management computer  122  (e.g. to select from a preset menu of emergency destinations) and may enable T/R (transmitter/receiver) equipment  124  (thereby allowing a remote pilot to communicate with and control the hijacked aircraft. In an alternate embodiment of the invention, the receiver is always enabled [to allow for the receipt of a take-over signal from an off-aircraft location], in which case the button press signal at  112 D enables the transmitter.);     112 E which activates electrical-linkage interrupting apparatus  121 , causing the interruption of electrical links between the flight deck and any device  123  which moves an aircraft control surface (e.g. horizontal stabilizer controls); and     112 F which activates linkage interrupting apparatus  117 , and thereby prevents autothrottle  119  access from the flight deck.       

     Embodiments of the invention which accommodate aircraft with a plurality of autopilots, of autothrottles and of flight management computers are possible. Hereinabove and hereinbelow, all references to “autopilot,” to “autothrottle” and to “flight management computer” are intended to include embodiments of the invention with one or more autopilot, one or more autothrottle and one or more flight management computer. In the case of a plurality of flight management computers, each flight management computer may be linked to one or more other flight management computers, and flight management computer is linked to one or more autothrottles and autopilots. 
     Button press will result in the setting of any priority circuits—i.e. circuits which allow the pilot to override the autopilot—to autopilot or remote pilot control. 
     Button press may also: 
     (a) result in the nullification/ cancellation of any restriction on autopilot control which may have been imposed when there is no force applied to the control wheel; 
     (b) remove—either completely or partially—one or more autopilot-imposed constraints on either the position or on the rate of change of a position of an aircraft control surface; and 
     (c) deactivate so-called artificial-feel systems. 
     Elements  117 ,  118 ,  120  and  121  each consist of one or more electrical switches or switching circuits. Elements  117 ,  118  and  120  may alternatively be mechanical linkages as described hereinbelow. In the event of hijacking, it is desirable to interrupt the display of any flight management information on the flight deck and it is necessary to prevent any input from the flight deck to autothrottle  119 , autopilot  126  and flight management computer  122 . 
     During normal—i.e. non-hijacking/emergency conditions, mechanical forces from the pilot&#39;s movement: 
     (a) of  108  are transmitted via  109 / 110 / 111  to control valve  114 . This hydraulic valve, as is known in the art, couples the pilot&#39;s mechanical action to the movement of a control surface (e.g. ailerons, elevator, rudder) on the aircraft. Electrical autopilot input to the control valve is via a transfer valve, as is known in the art (transfer valve not separately shown in this FIG.). The control valve causes force to be applied to the aircraft control surface via an actuator (known in the art, not shown) whose force is applied to the control surface  128  via mechanical linkage  130 . Linkage  130  may be a control rod, a cable system, a chain with multiple links, or combinations of these, or of any other force transmitting system, as is known in the art; and 
     (b) of  107  are transmitted via  97 / 98 / 99  to throttles  113 . These throttles may also be controlled by autothrottle  119 , which may be controlled by (i) the pilot, from input  105  (via interruptible link  117 ); or (ii) the flight management computer  122 . 
     The set of elements  108 ,  109 ,  110 ,  111 ,  114 ,  116 ,  128  and  130  are duplicated for each of the plurality of control valves that control movable aircraft surfaces. 
     The set of elements  97 ,  98 ,  99 ,  107 ,  113  and  115  may be duplicated for each of the throttles. 
     During a hijacking, following the interruption of links to the flight deck, the hijacked aircraft is controlled by either: 
     (a) control signals which originate off-aircraft, i.e. control signals from the remote pilot, and/or 
     (b) control signals which originate on-board the hijacked aircraft from one or more of the flight management computer(s), the autopilot(s) and the autothrottle(s). 
     The aforementioned (a) and (b) are, hereinbelow, referred to as the alternate source of control. Hereinbelow, any or all of the following will be referred to as a controlled component: 
     (i) a controlled surface on the aircraft, 
     (ii) a controlled surface actuator, 
     (iii) a control valve corresponding to a controlled surface, 
     (iv) a throttle, and 
     (v) an engine-related mechanical actuator. 
     The means by which the alternate source of control signals manipulate the controlled component include: 
     (a) remote pilot signals, transmitted from an off-aircraft location are received by  124  and (after decryption and decoding, as discussed in U.S. Pat. No. 6,917,863) then sent directly to the controlled component. Electrical-to-mechanical conversion of the signals is via transfer valve or other means as is known in the art; 
     (b) remote pilot signals, transmitted from an off-aircraft location are received by  124  and then sent to ( 1 ) autopilot  126 , then to control valve  114 , which controls  128 , and ( 2 ) autothrottle  119 , which controls  113 ; 
     (c) remote pilot signals, transmitted from an off-aircraft location are received by  124  and then transmitted to flight management computer(s)  122 , and then sent to (1) autopilot  126 , then to control valve  114 , which controls  128 , and (2) autothrottle  119 , which controls  113 ; 
     (d) signals originating in flight management computer  122  (triggered by button press, and without the necessity of remote pilot) are sent to (1) autopilot  126 , then to control valve  114 , which controls  128 , and (2) autothrottle  119 , which controls  113 ; 
     (e) the autopilot(s) controls the aircraft control surfaces and the autothrottles control the throttles; and 
     (f) signals originating in flight management computer  122  (triggered by button press, and without the necessity of remote pilot) are sent directly to the controlled component. 
     Aforementioned hijacking management methods (a)-(e) are illustrated in  FIG. 1 ; Method (f) is not shown. Embodiments of the invention are possible based on each of the aforementioned methods. Embodiments of the invention are possible which use different methods for different controlled components. Embodiments of the invention are possible which use different methods for a single controlled component. 
     Some or all of the flight deck elements shown may be duplicated for control by a first officer. In the event of button press, each corresponding first officer mechanical and electrical link would be interrupted, and each additional button press-related action described hereinabove would apply to first officer-related control links. 
     In one or more alternate embodiments of the invention, mechanical linkage  109 / 110 / 111  could be replaced by an electrical linkage to the flight management computers or to pilot inputs on the flight deck, which would input control valve  114  via a transfer valve. In one or more alternate embodiments of the invention, mechanical linkage  97 / 98 / 99  could be replaced by an electrical linkage to the flight management computers or to throttle controls. In the case of either of the aforementioned replacements, the corresponding interruptible mechanical link  116  and  115  would be replaced by an interruptible electrical link, similar to element  121 . 
       FIG. 2A  shows an expanded front view of one embodiment of the mechanical interruptible link shown as elements  115  and  116  in  FIG. 1 ;  FIG. 2B  shows a side view of the upper (elements  97  and  109  in  FIG. 1 ) and lower (elements  99  and  111  in  FIG. 1 ) portions of the control rod. Under normal (i.e. non-hijacked) conditions, the upper and lower portions are held together by U-shaped link  140 . The upper portion of  140  inserts into holes  146 A and  146 B; the lower portion of  140  inserts into holes  148 A and  148 B. In the event of a hijacking, button press sends a signal to  112 B ( FIG. 1 ) which activates solenoid  144 , which, via connecting link  142  pulls U-shaped link  140  out holes  146 A,  146 B,  148 A and  148 B, thereby separating the upper portion (accessible to the pilot) from the lower one (extending to the control valve or throttles). This action results in disabling of pilot control of mechanical aircraft components  113  and  128  linked to the pilot by a control rod. 
     Embodiments of the invention with different shapes and relative sizes of the control rod and the U-shaped link are possible. The entire interruptible link shown may be located anywhere between the point nearest the pilot and the point furthest from the pilot; Location at points not accessible from the flight deck are advantageous. 
     Link  140  need not be U-shaped.  FIG. 2C  shows a three-pronged version,  141 . As was the case with the U-shaped version, each protruding section passes through one of the holes in the upper control arm, and the corresponding hole in the lower control arm. 
       FIGS. 2D and 2E  show front and side views of an embodiment that uses two U-shaped links to hold the upper and lower control arms together. The presence of a second link increases safety (less chance of accidental link removal resulting in a loss of control) and control rod stability during operation. In  FIG. 2D , link  150  is in front of link  160 . The upper portion of  150  passes through holes  156 A and  156 B; The lower portion of  150  passes through holes  158 A and  158 B. The position of  150  is controlled by solenoid  154 , linked to  150  by link  152 ; Link  150  is removed from its associated control rod in a manner similar to that for link  140 , as discussed hereinabove. The upper portion of link  160  passes through holes  166 A and  166 B; The lower portion of  160  passes through holes  168 A and  168 B. The position of  160  is controlled by solenoid  164 , linked to  160  by link  162 ; Link  160  is removed from its associated control rod in a manner similar to that for link  140 , as discussed hereinabove. 
     All of the generalizations discussed with regard to link  140  are applicable to the dual link geometry discussed in conjunction with  FIGS. 2D and 2E . Furthermore, a wide range of other geometric arrangements of links are possible including: 
     (a) arrangements in which the two links are horizontally oriented (e.g. link  150  passes through holes  156 A,  156 B,  166 A and  166 B); 
     (b) arrangements in which there are three or more links; 
     (c) arrangements in which one or more links have three or more protruding elements with geometry other than that shown in  FIG. 2C ; 
     (d) arrangements in which the links have a single protruding element; and 
     (e) arrangements with explosive bolts, as are known in the art. 
     Other geometric and mechanical arrangements will be apparent to those skilled in the art. 
       FIGS. 3A and 3B  show the use of a moveable blade  172  to sever cable  171 , thereby disabling pilot control in a system which uses cables to link the pilot to the mechanically controlled component. During normal operation ( FIG. 3A ), cable pair  170  and  171  mechanically links the pilot to a controlled component (control valve, throttle, or [in the case of a small aircraft] the actual controlled aircraft surface). In the event of a hijacking, a signal (described hereinabove) via  112 B ( FIG. 1 ) and thence via wires  174  to blade controlling mechanism  173  causes the blade to move so as to sever cable  171 . The result, shown in  FIG. 3B  is that cable  171  is divided into segments  171 A and  171 B. The cable pair  170  and  171 A is no longer able to act in concert to transmit force from the pilot to the mechanically controlled component. 
     Other embodiments of this invention include: 
     (a) two blades, one for each of  170  and  171 ; 
     (b) cutting the cable with means other than a blade including:
         (i) mechanically abrasive means—mounted, for example, on a motorized drill bit which is oriented perpendicular to the cable axis; and   (ii) chemically abrasive means—e.g. a strong acid which dissolves the cable.       

       FIG. 3C  illustrates the interruption of a pneumatic or hydraulic line  175  which transmits force from a control  107 ,  108  on the flight deck. The opening of valve  177  interrupts the transmission of a control force by line  175 . Valve  177  may be controlled at  178  by an electromagnetic, hydraulic, or pneumatic actuator, or may be any other remotely operated valve configuration as is known in the art. Return line  176  is shown. The operation of a controlled component on the flight deck causes an increase in pressure in  175 , which, causes motion of a pneumatically or hydraulically controlled actuator, as is known in the art. The opening of valve  177  disables control of a controlled component from the flight deck. 
       FIGS. 4A and 4B  (normal and hijacking conditions, respectively) show a means of uncoupling pilot mechanical control by removing a link between two wheels. During normal operation, pilot mechanical motion is transmitted via cable  180  causing wheel  182  to rotate about axle  184 A,  184 B,  184 C. The rotation of axle segment  184 C causes rotation of wheel  190 , which causes axial motion of cable  192 , which transmits the pilot mechanical motion to the mechanically controlled object. 
     In the event of hijacking, button press signal  112 B causes an electrical signal to solenoid  186  through wires  188 . This results in the removal of axle link  184 B ( FIG. 4B  shows the link in the ‘removed’ position.), so that segments  184 A and  184 C are no longer mechanically linked. The result is that pilot mechanical actions are not transmitted to wheel  190 , cable  192  and the control valve or throttle that cable  192  acts upon. 
     The alternate source of control transmits rotational input to the controlled component as follows: Axial force from cable  196  (see below in conjunction with  FIG. 12 ) causes the rotation of wheel  194 , which causes the rotation of axle segment  184 C, causing the rotation of wheel  190  and axial motion of cable  192 . Embodiments of the invention are possible in which under normal (non-hijack) conditions wheels  190  and  194  are not mechanically linked; After button press, an additional insertable link is inserted which does link them. In embodiments in which the mechanical link between wheels  190  and  194  is at all times present, the rotational friction imposed by the attachment of the  194 / 196  components would be either minimized or compensated for. 
       FIGS. 5A and 5B  (normal and hijacking conditions, respectively) show a means of uncoupling pilot mechanical control by removing mechanical links between two adjacent wheels using solenoid apparatus. Under normal (i.e. non-hijacking) conditions, pilot mechanical actions cause the rotation of wheel  200 , which is transmitted to wheel  202  via rods  207  and  209 . These rods are attached to the cores of solenoids  206  and  208  respectively. Each of wheels  200 ,  202  and  204  rotates freely about axle  185 , so that under normal conditions the rotational motions of wheels  200  and  202  is not transmitted to wheel  204 . 
     During a hijacking: 
     (a) signal  112 B causes a current to flow in solenoids  206  and  208 , which causes each of rods  207  and  209  to be displaced toward the solenoid core (i.e. leftwards in the figure). Once each of the rods no longer extends into wheel  202 , pilot actions which cause the rotation of wheel  200  are no longer transmitted to wheel  202 , or to the mechanical item to which wheel  202  and its associated cable are linked. 
     (b) Alternate source of control motions are transmitted to the controlled component as follows: Rods  211  and  213  are extended (leftwards in the figure) so that wheel  202  and wheel  204  are mechanically linked. Such extension may be brought about by:
         (i) Running a current through the solenoid during normal conditions, which exerts a strong enough holding force on rods  211  and  213  to overcome the leftwards force of springs  214  and  216 . At the time of button press, the current is removed, and the springs, without the resisting force of the activated solenoid, can extend, forcing rods  211  and  213  leftwards (as shown in  FIG. 5B ), thereby mechanically linking the remote pilot actions transmitted to wheel  204 , to the controlled component through wheel  202 ;   (ii) solenoid construction, in the case of  214  and  216 , so that the application of electric current causes a repulsive force on the core, causing it to protrude (leftwards in the FIG.). In this situation, springs  214  and  216  would not be necessary.       

     Other variations of the approach shown in  FIGS. 5A and 5B  include: 
     (a) having wheels  202  and  204  mechanically linked at all times (see parallel discussion in the context of  FIG. 4 ); 
     (b) using a single pair of solenoids,  210  and  212  for all control, by:
         (i) eliminating solenoids  206  and  208 , and their associated rods  207  and  209 ;   (ii) eliminating springs  214  and  216 ;   (iii) lengthening rods  211  and  213  so that they extend far enough (to the left, in the FIG.) to reach through each of wheels  200 ,  202  and  204 .
 
Under normal conditions, no current flows through the solenoids, and all three wheels are linked. Under hijack conditions, activation of solenoids  210  and  212  pulls the rods (rightwards in the figure) so that they no longer reach wheel  200 . This de-couples pilot actions; and
       

     (c) having the number of solenoids be other than four. 
       FIGS. 6A and 6B  (normal and hijacking conditions, respectively) show a means of uncoupling pilot mechanical control, by control of whether or not the rotation of wheel  232  and of wheel  236  is linked to axle rotation. The key is wheel hubs  233  and  237 , which are such that they may be maintained in one of two states, either tightly fitting to axle  230 , or loosely fitting. In the former case, the tightly fitting wheel and the axle turn in concert; In the latter case, rotational motion of the (loosely fitting) wheel and that of the axle are de-coupled. 
     Under normal conditions, wheel  232  transmits pilot actions via its hub  233  to axle  230 . The hub maintains a tight hold on the axle, so that each degree of rotation of wheel  232  is mirrored by one degree of rotation of axle  230 . Similarly wheel  234 , with hub  235  which tightly attaches it to axle  230 , rotates exactly as does  230 . During normal conditions, hub  237  is maintained in a loosely fitting state, and rotation of axle  230  does not cause rotation of wheel  236 . 
     During a hijacking, the states of hubs  233  and  237  are reversed, i.e.  233 , becomes loosely fitting, and  237  becomes tightly fitting. The result is that on-board pilot actions which cause wheel  232  to rotate do not cause the rotation of axle  230 ; and alternate source of control actions which cause wheel  236  to rotate (see discussion of  FIG. 12 , below) do cause the rotation of axle  230  and of wheel  234 , which couples the alternate source of control to the mechanically controlled component. 
     The state of hubs  233  and  237  is determined by an electrical input to either the hub itself, or to axle  230  which reflects whether button press has occurred. The hub and axle details which allow these two states is not shown, but is known in the art. Possible mechanical arrangements included electrically controlled pins which extend out of the axle into the hub, electrically controlled pins which extend out of the hub into the axle, movable gears which allow the axle and hub to engage, and other arrangements as are known in the art. 
       FIGS. 7A and 7B  (normal and hijacking conditions, respectively) show a means of uncoupling pilot mechanical control by creating slack in the cable loop which is to be mechanically de-coupled. The length of cables  260  and  262  are greater than is needed to encompass their associated “circuits.” This extra length causes slack (as shown for cable  262  in  FIG. 7A ) so that rotation of its associated wheel ( 246  in the case of cable  262 ) is not caused by axial motion of the cable. The cable is made taut, when appropriate, by the movement of two wheels in the plane defined by the path of the cable, in an outward direction, so as to take up the slack. The position of these wheels is controlled by solenoids. 
     Under normal conditions, on-board pilot control (of a control valve or throttle, for example) is maintained by keeping cable  260  taut. This is accomplished by applying a current to solenoids  248 A and  248 B, which cause respective motion to the left (in the figure) and right (in the figure) of wheels  252 A and  252 B, through respective attaching rods  250 A and  250 B. (These aforementioned wheels would actually be located in the plane of the cable loop; a current passing through the solenoids would cause each of wheels  252 A and  252 B to move in a direction away from the inside of the loop defined by cable  260 .) When  260  is taut, pilot actions cause wheel  242  to turn;  242  is fixed to and causes identical turning of axle  240 , and causes identical turning of wheel  244 , which transmits the pilot-initiated force through cable  261  to a control valve or throttle. Although wheel  246  also turns, no force is transmitted to cable  262  because it is slack. Its associated solenoids are electrically inactive, and the positions of associated wheels  258 A and  258 B maintain the slack state of  262 . 
     Following button press, the state of each of the four solenoids reverses. The two previously active ones,  248 A and  248 B become inactive as current to them is shut off, and slack immediately develops in cable  260 , thereby de-coupling pilot control, as shown in  FIG. 7B . Simultaneously, solenoids  254 A and  254 B receive a current, their associated control rods  256 A and  256 B move associated wheels  258 A and  258 B in a direction away from the inside of the loop defined by cable  262 , allowing  262  to become taut. The result is that alternate source of control actions are transmitted to cable  261  in the same way the on-board pilot actions had been transmitted during the normal state. 
     Embodiments of the invention with different numbers of solenoids are possible. Embodiments in which spring-based arrangements are used to take up some of the slack, and prevent the “derailing” of a cable are possible, as is known in the art. 
       FIG. 8A  shows an embodiment of the invention which allows for the assignment of the source of control of a controlled component to either (a) the onboard pilot or (b) the alternate source of control. In this embodiment, a rotating wheel  304  attached to the controlled component via cable  306  can be linked to either of two other rotating (or potentially rotating [Hereinabove and hereinbelow, the term “rotating” is intended to include “actually rotating” or “potentially rotating”.]) sources: (a) element  300 , reflecting onboard pilot control, or (b) element  308  reflecting control from the alternate source of control. The transmission of onboard pilot rotational motion to the controlled component occurs when clutch  310  is engaged, such that its constituent parallel rotating elements transmit motion from one to the other. The transmission of alternate source of control rotational motion to the controlled component occurs when clutch  312  is engaged, such that its constituent parallel rotating elements transmit motion from one to the other. During onboard pilot controlled flight, clutch  310  is engaged; Clutch  312  may or may not be engaged. During a hijacking, clutch  312  is engaged and clutch  310  is irreversibly disengaged. The clutches are controlled electrically by methods that are known in the art. Irreversible disengagement of clutch  310  may be effected by electronic, mechanical or hydraulic means. 
     Element  310  constitutes one form of interruptible link  115  and  116 . 
       FIG. 8B  shows an arrangement where four clutches allow for the selection among three sources of control i.e. on-board pilot, remote pilot and autopilot/flight computer system. When the onboard pilot is in control, clutch  332  is engaged, and onboard pilot rotational motion is transmitted from  314  through  332  to axle  316 , to wheel  318 , to cable  320  to the controlled component. During a hijacking, clutch  332  is irreversibly disengaged (using methodology described hereinabove) and clutch  334  is engaged. During autopilot/flight computer control, autopilot/flight computer rotational motion is transmitted via  328  through clutch  336  (which is engaged during autopilot/flight computer control) to gear  326 , to gear  324 , to rod  322 , to engaged clutch  334 , to wheel  318 , to cable  320 , to the controlled component. During remote pilot control, remote pilot rotational motion is transmitted via  330  through clutch  338  (which is engaged during remote pilot control) to gear  326 , to gear  324 , to rod  322 , to engaged clutch  334 , to wheel  318 , to cable  320 , to the controlled component. 
     Element  332  constitutes one form of interruptible link  115  and  116 . 
       FIG. 9A  shows an embodiment of the invention in which one of three sources of control, of the controlled element is selected by an arrangement of gears. The three sources of control are (a) onboard pilot, (b) remote pilot and (c) autopilot/flight computer. The example shown in the FIG. is of remote pilot control, in which remote pilot actions are transmitted through cable  354 A to wheel  348 A, to axle  350 A, to gear  352 A, to gear  364 A, to axle  366 A to the controlled component. During onboard pilot control, gear  366 A is moved so that it meshes only with gear  344 A. Onboard pilot motion is then transmitted to the controlled component via the sequence of elements  346 A,  340 A,  342 A,  344 A,  364 A and  366 A. During autopilot/flight computer control, gear  366 A is moved so that it meshes only with gear  360 A. Autopilot/flight computer motion is then transmitted to the controlled component via the sequence of elements  362 A,  356 A,  358 A,  360 A,  364 A and  366 A [“Sequence”, hereinabove and hereinbelow is intended to indicate a spatial sequence, not a temporal one.]. 
     Gear  364 A may be moved so that it meshes with one of gears  344 A,  352 A and  360 A by a mechanism which is either electromagnetic, hydraulic or hybrid, as is known in the art. During a hijacking, gear  364 A is prevented from meshing with gear  344 A (thereby de-coupling onboard pilot control) by a mechanism which may be either electronic, electromagnetic, hydraulic or hybrid. 
       FIG. 9A  illustrates one form of interruptible link  115  and  116 . 
       FIG. 9B  shows an embodiment of the invention in which one of three sources of control [(a) onboard pilot, (b) remote pilot and (c) autopilot/flight computer], of the controlled element is selected by a clutch mechanism. The clutch mechanism links the rotational motion of one of wheels B 1 , B 2  or B 3  (elements  344 B,  352 B,  360 B) to wheel A (element  364 B), thereby linking axial motion of one of cables  346 B (onboard pilot control),  354 B (remote pilot control) or  362 B (autopilot/flight computer control) to axial motion of cable  370  (controlled component motion). In the case of onboard pilot control, axial movement of  346 B is transmitted via the sequence  346 B,  340 B, axle  342 B,  344 B,  364 B, axle  366 B,  368 ,  370 . In the case of remote pilot control, axial movement of  354 B is transmitted via the sequence  354 B,  348 B, axle  350 B,  352 B,  364 B, axle  366 B,  368 ,  370 . In the case of autopilot/flight computer control, axial movement of  362 B is transmitted via the sequence  362 B,  356 B, axle  358 B,  360 B,  364 B, axle  366 B,  368 ,  370 . 
     Two different formats for linking the rotation of wheel A to the rotation of one of wheels B 1 , B 2 , B 3  together include: (I) wheel A may move to touch one of the B wheels; or (II) one of the B wheels may move to touch wheel A. Another approach would be one in which both of wheel A and the selected B wheel move towards each other. Yet another approach would be one in which the position of the center of both wheel A and the B wheels is stationary, and in which there is interposition of movable intermediate elements (either solid or fluid) between wheel A and the B wheels, thereby linking the rotational motion of wheel A and the selected B wheel. 
     The movement of wheel A, the B wheels, and/or any mechanism which may be interposed between wheel A and the selected B wheel is by a mechanism which is either electromagnetic, hydraulic or hybrid, as is known in the art. During a hijacking, wheel  344 B is prevented from contacting—either directly or indirectly—wheel  364 B (thereby de-coupling onboard pilot control) by a mechanism which may be either electronic, electromagnetic, hydraulic or hybrid. 
       FIG. 9B  illustrates one form of interruptible link  115  and  116 . 
       FIG. 10A  shows an embodiment of the invention in which one of four sources of control, of the controlled element is selected by an arrangement of gears. The four sources of control are (a) onboard pilot, (b) remote pilot, (c) autopilot/flight computer and (d) restricted control. Restricted control refers to a post-landing state in which remote pilot control is in effect, but in which certain restrictions on the motion of aircraft control surfaces and throttle control are imposed to prevent a second take-off. (These are referred to in U.S. patent application Ser. No. 10/328,589, wherein they are referred to as MAC State  4 .) The example shown in  FIG. 10A  is remote pilot control, in which remote pilot actions are transmitted through cable  354 A, to gear  352 A, to gear  364 A, to axle  366 A to the controlled component. During on-board pilot control, gear  364 A is moved so that it meshes only with gear  344 A. On-board pilot motion is then transmitted to the controlled component via elements  346 A,  344 A,  364 A and  366 A. During autopilot/flight computer control, gear  364 A is moved so that it meshes only with gear  360 A. Autopilot/flight computer motion is then transmitted to the controlled component via the sequence of elements  362 A,  360 A,  364 A and  366 A. During restricted control, gear  364 A is moved so that it meshes only with gear  380 A. The restricted control format is then transmitted to the controlled component via the sequence of elements  372 A,  374 A,  376 A,  380 A,  364 A and  366 A. 
     Gear  364 A may be moved so that it meshes with one of gears  344 A,  352 A,  360 A and  380 A by a mechanism which is either electromagnetic, hydraulic or hybrid, as is known in the art. During a hijacking, gear  364 A is prevented from meshing with gear  344 A (thereby de-coupling onboard pilot control) by a mechanism which may be either electronic, electromagnetic, hydraulic or hybrid. 
       FIG. 10A  illustrates one form of interruptible link  115  and  116 . 
       FIG. 10B  shows an embodiment of the invention in which one of four sources of control [(a) onboard pilot, (b) remote pilot, (c) autopilot/flight computer and (d) restricted control], of the controlled element is selected by a clutch mechanism. The clutch mechanism links the rotational motion of one of wheels  344 B,  352 B,  360 B and  380 B to wheel  364 B, thereby linking axial motion of one of cables  346 B (on-board pilot control),  354 B (remote pilot control),  362 B (autopilot/flight computer control) or  372 B (restricted control) to axial motion of cable  370  (controlled component motion). 
     In the case of on-board pilot control, axial movement of  346 B is transmitted via  346 B,  344 B,  364 B,  366 B,  368 ,  370 . In the case of remote pilot control, axial movement of  354 B is transmitted via  354 B,  352 B,  364 B,  366 B,  368 ,  370 . In the case of autopilot/flight computer control, axial movement of  362 B is transmitted via the sequence  362 B,  360 B,  364 B,  366 B,  368 ,  370 . In the case of restricted control, axial movement of  372 B is transmitted via the sequence  372 B,  374 B,  376 B,  380 B,  364 B,  366 B,  368 ,  370 . 
     The different formats and mechanisms for linking the rotation of wheel  364 B with the rotation of one of wheels  344 B,  352 B,  360 B and  380 B include the same ones discussed in conjunction with  FIG. 9B . During a hijacking, wheel  344 B is prevented from contacting—either directly or indirectly—wheel  364 B (thereby de-coupling on-board pilot control) by a mechanism which may be either electronic, electromagnetic, hydraulic or hybrid. 
       FIG. 10B  illustrates one form of interruptible link  115  and  116 . 
     Clutches which have been discussed hereinabove may be any one of a variety of clutches as are known in the art including friction clutches and no-slip clutches. 
     It is to be understood that the coupling and de-coupling of translational or rotational motion described in reference to  FIGS. 2-10B  may be accomplished by (a) other arrangements, (b) arrangements which include combinations of approaches presented in conjunction with  FIGS. 2-10B  and (c) combinations of (a) and (b). Any such arrangement which accomplishes the coupling and de-coupling discussed above is intended to be included in this invention. 
       FIG. 11  shows a means by which the non-disconnected segment ( 99  or  111 ) (hereinbelow referred to as the “distal” segment) of a mechanical control arm can be remotely controlled, to allow an alternate source of control to continue to perform the actions that the on-board pilot had performed prior to hijacking/button press/de-coupling of onboard pilot actions/disconnection of the upper segment ( 97  or  109 ) (hereinbelow referred to as the “proximal segment”). 
     In the event of a hijacking the distal arm is moved by a cable system which is attached by anchors  410  in hole  412  of the distal arm. The cable  408  traverses passive wheel  406  and active wheel  404 . Wheel  404  is rotated by servo motor  402 , which is controlled by servo computer  400 . Computer  400  is controlled by (a) signals from the transmitting/receiving equipment  124  on-board the hijacked aircraft (which is in communication with transmitting/receiving equipment at the site of the remote pilot) and (b) signals from the flight management computer  122 . 
     Embodiments in which movement of the distal arm does not utilize a cable system are possible, e.g. using a gear arrangement attached to one or more servo motors. Embodiments in which hydraulic, pneumatic and magnetic forces are used to move the distal arm are also possible. 
       FIG. 12  shows a means which allows an alternate source of control to continue to perform the actions that the on-board pilot had performed prior to hijacking, on an aircraft which uses a cable system for one or more mechanical controls. Alternate source of control cable  416  (analogous, for example, to cable  196  in  FIG. 4  and to cable  262  in  FIG. 7  and to corresponding cables in  FIGS. 5 and 6 ) allows the transmission of alternate source of control actions to mechanical components of the hijacked aircraft. The cable traverses wheel  414  which is rotated by servo motor  403 , which is controlled by servo motor computer  401 . Computer  401  is controlled by (a) signals from the transmitting/receiving equipment  124  on-board the hijacked aircraft and (b) signals from the flight management computer  122 . 
     In the above discussion, the de-coupling of onboard pilot control is, with the exception of the method associated with  FIG. 3 , a potentially reversible act. The possibilities for actual system design include: 
     (a) making return to on-board pilot control impossible, with the lockout (other than in the case of  FIG. 3  being electronic); 
     (b) making return to on-board pilot control fully reversible (except for  FIG. 3 ); 
     (c) making return to on-board pilot partially reversible by allowing—under certain circumstances requiring off-aircraft approval—the on-board pilot to fly the aircraft in the same way that the remote pilot does. In this case, the mechanical interruptions performed at the time of button press would be irreversible. 
     The “Master Aircraft Control” (which selects control from among three sources: on-board pilot [MAC State  1 ], remote pilot [MAC State  2 ] and autopilot [MAC State  3 ]) is discussed in the above-mentioned U.S. Pat. No. 6,917,863 (see for example  FIG. 13  of the aforementioned patent). With regard to the methods and apparatus presented herein, Master Aircraft Control may be localized, or, to varying degrees, de-localized. In  FIGS. 4 through 7  herein, for example, element  115 / 116  include means for mechanically switching between MAC States  1  and  2 , or between MAC States  1  and  3 .  FIG. 1  herein, on the other hand, shows a multiplicity of activations and deactivations at the time of button press, including each of the mechanical and electrical activations and deactivations associated with signal  112 . Based on  FIG. 1 , Master Aircraft Control may be viewed as either (a) a function (with many sub-functions), or (b) as a piece (or pieces) of hardware which performs the aforementioned function. 
     All references to aircraft are intended to include helicopters, and vehicles which may at times function as a helicopter, and at times as a non-helicopter. 
     There has thus been shown and described a novel method and apparatus for disabling pilot control of a hijacked aircraft which fulfills all the objects and advantages sought therefor. Many changes, modifications, variations and other uses and applications of the subject invention will, however, become apparent to those skilled in the art after considering this specification and the accompanying drawings which disclose the preferred embodiments thereof. All such changes, modifications, variations and other uses and applications which do not depart from the spirit and scope of the invention are deemed to be covered by the invention, which is to be limited only by the claims which follow.