Patent Description:
Hoists used in rescue or similar operations typically wind or unwind a cable in order to raise or lower persons or cargo from a flying platform. For example, a rescue hoist may be mounted to a frame or support structure of an aircraft, such as, for example, a helicopter. The rescue hoist may include a cable drum to which the cable is attached. The cable drum rotates in one direction to spool the cable onto the drum and in the other direction to spool the cable off the drum, with one end of the cable attached to the cable drum and the other end, which may include a hook or other device, freely deployed. The hoist typically includes a gear reduction mechanism disposed between a motor and the cable drum to provide a desired rotational speed of the cable drum during operation. The gear reduction mechanism typically includes several shafts arranged to induce large torques or radial loads, thus necessitating robust bearings and other supporting components within the hoist. A load brake or clutch may be incorporated into the hoist to control operation of the cable drum during the raising or lowering of loads via the cable.

Certifying authorities typically expect control systems used to operate rescue hoists on aircraft possess a quality assurance level sufficient to guarantee safety of the aircraft and the personnel operating the aircraft. One standard and well-recognized quality assurance level is often referred to as Design Assurance Level ("DAL"). Current specifications relating to the DAL level of the control systems used in aircraft are provided in <NPL>) or ED-12C (the European equivalent of DO178C). The DAL level specifications for the control systems used to operate a rescue hoist are typically considered to fall within the DAL-B category, which specifies the rescue hoist be generally safe from failures that have a potential for negatively impacting the safety or performance of the aircraft or for reducing the ability of the crew to operate the aircraft. However, certain sub-systems of a rescue hoist, such as, for example, a cable-cut mechanism, are subject to the more stringent DAL-A standard, while other subsystems, such as, for example, data storage devices, are subject to the less stringent DAL-C standard. Hoist control systems are disclosed in the <CIT>, <CIT>, <CIT>, <CIT> and <CIT>.

A control system for a component of a rescue hoist attached to an aircraft is provided as defined by claim <NUM>.

In various embodiments, the first bus comprises one of a first CAN-Bus or a first ARINC429-Bus and defines a DAL-C level of reliability. In various embodiments, the second bus comprises one of a second CAN-Bus or a second ARINC429-Bus and defines the DAL-C level of reliability. In various embodiments, the control system defines a DAL-A level of reliability. In various embodiments, the component is a cable cutter. In various embodiments, a storage device is coupled to the control module via a third bus and configured to store a command signal generated by the control input device, the command signal embodied in the first signal and the second signal.

A rescue system for an aircraft is provided as defined by claim <NUM>.

In various embodiments, the first bus defines a DAL-C level of reliability and the second bus defines the DAL-C level of reliability. In various embodiments, a control system comprising the first bus, the second bus and the hardwire defines a DAL-A level of reliability. In various embodiments, a storage device is coupled to the control module via a third bus and configured to store the command signal.

A method of controlling a component of a rescue hoist for an aircraft is provided as defined by claim <NUM>.

While these various embodiments are described in sufficient detail to enable those skilled in the art to practice the disclosure, it should be understood that other embodiments may be realized and that changes may be made without departing from the scope of the invention as defined by the claims.

Referring now to the drawings, <FIG> provides a perspective view of an aircraft <NUM> and a rescue hoist <NUM> mounted to the aircraft <NUM>, while <FIG> provides a cross-sectional view of the rescue hoist <NUM>, in accordance with various embodiments. The rescue hoist <NUM> is mounted to the aircraft <NUM> by a support frame <NUM> and a cable <NUM> extends from the rescue hoist <NUM>. In various embodiments, the rescue hoist <NUM> includes a cable cutter <NUM> configured to cut the cable <NUM> in the event of an emergency endangering the aircraft <NUM> or personnel within the aircraft <NUM> or on the ground. Referring more specifically to <FIG>, in various embodiments, the rescue hoist <NUM> includes a hoist frame <NUM>, a motor <NUM>, a drive train <NUM>, a cable drum <NUM>, a level wind mechanism <NUM> and a cable cutter <NUM> (or a similar mission-critical component). The cable drum <NUM> includes a first flange <NUM>, a second flange <NUM> and a barrel <NUM>. The barrel <NUM> extends between and connects the first flange <NUM> and the second flange <NUM>. The level wind mechanism <NUM> includes a level wind gear <NUM> and a screw <NUM>. The cable <NUM> extends from the rescue hoist <NUM> and is configured to raise and lower objects to and from the aircraft <NUM>. The motor <NUM> is connected to the hoist frame <NUM> and is configured to operate the drive train <NUM>, which is configured to transmit rotational power from the motor <NUM> to the cable drum <NUM>. The level wind mechanism <NUM> extends through the cable drum <NUM> and is configured to wind or unwind the cable <NUM> onto or from the barrel <NUM> in orderly fashion between the first flange <NUM> and the second flange <NUM> by translating the cable drum <NUM> back and forth along a direction defined by a longitudinal axis A via the screw <NUM>. The cable cutter <NUM>, in various embodiments, is mounted to the hoist frame <NUM> and configured to cut or otherwise separate the cable <NUM> from the rescue hoist <NUM>.

Referring still to <FIG>, the rescue hoist <NUM> further includes a control system <NUM> configured to control operation of the rescue hoist <NUM>. In various embodiments, the control system <NUM> is coupled to a control module <NUM>, which is connected to a control input device <NUM> (or a plurality of control input devices) via a control bus <NUM>. The control module <NUM>, which in various embodiments may be considered a component of the rescue hoist <NUM>, includes circuitry configured to control operation of the rescue hoist <NUM> in response to inputs (or signals) received from the control input device <NUM>. In various embodiments, the control module <NUM> is also coupled to a storage device <NUM> via a storage bus <NUM>, with the storage device <NUM> configured to store data reflecting a record of all the control inputs received by the control module <NUM>, and to the cable cutter <NUM> via a cutter bus <NUM>. As described further below, in various embodiments, the control bus <NUM> and the storage bus <NUM> may comprise, for example, a Controller Area Network ("CAN-Bus"), a Mark <NUM> Digital Information Transfer System ("ARINC429-Bus") or a similar network system or bus. In various embodiments, for example, the control bus <NUM> comprises a Dual CAN Bus - e.g., a first controller area network bus ("a first CAN-Bus") and a second controller area network bus ("a second CAN-Bus") - that is configured to provide a DAL-B level of reliability in operation of the rescue hoist <NUM>, while the storage bus <NUM> comprises a Single CAN-Bus - e.g., a third controller area network bus ("a third CAN-Bus") - configured to provide a DAL-C level of reliability in operation of the storage device <NUM>. Similarly, in various embodiments, the control bus <NUM> comprises a Dual ARINC429-Bus - e.g., a first ARINC429 bus ("a first ARINC429-Bus") and a second ARINC429 bus ("a second ARINC429-Bus") - that is configured to provide a DAL B level of reliability in operation of the rescue hoist <NUM>, while the storage bus <NUM> comprises a Single ARINC429-Bus - e.g., a third ARINC429 bus ("a third ARINC429-Bus") - configured to provide a DAL C level of reliability in operation of the storage device <NUM>. For simplicity, in the discussion that follows, the Dual CAN-Bus and the Dual ARINC429-Bus may be referred to interchangeably as a "Dual-Bus," typically comprising a "first-Bus" (or a first bus) and a "second-Bus" (or a second bus), while the Single CAN-Bus and the Single ARINC429-Bus may be referred to interchangeably as a "Single-Bus," typically comprising a "third-Bus" (or a third bus). Further, in various embodiments, the control bus <NUM> additionally includes a hardwire (e.g., a copper or metallic wire or cable or the like) that runs together with the first-Bus and the second-Bus, the combination of which provides a DAL-A level of reliability in operation of the cable cutter <NUM>.

Language describing the various Design Assurance Levels ("DAL") discussed in this this disclosure are set forth in Federal Aviation Administration Advisory Circular AC29-C2 and summarized as follows:.

Additional details of the control bus <NUM> and the storage bus <NUM> and the DAL:standards or levels of reliability they enable are provided in the following discussion.

Referring now to <FIG>, a control system <NUM> is illustrated, the control system being, in various embodiments, part of a rescue system for an aircraft. The control system <NUM> is similar to the control system <NUM> described above with reference to <FIG> and configured to control operation of a first rescue hoist 210a and, in various embodiments, a second rescue hoist 210b, both of which are similar to the rescue hoist <NUM> described above with reference to <FIG> and <FIG>. In various embodiments, one or both of the first rescue hoist 210a and the second rescue hoist 210b are configured for attachment to a support frame <NUM>, similar to the support frame <NUM> described above with reference to <FIG>. The first rescue hoist 210a is operable to raise and lower a first cable 204a and includes a first control module 252a. Similarly, the second rescue hoist 210b is operable to raise and lower a second cable 204b and includes a second control module 252b. In various embodiments, the first rescue hoist 210a includes a first cable cutter 280a and the second rescue hoist includes a second cable cutter 280b. For simplicity, the control system <NUM> is described below as configured to operate a rescue hoist <NUM> as a single unit, comprising a cable <NUM>, a cable cutter <NUM> and a control module <NUM>, each of which is similar to the like-named components described above with reference to <FIG> and <FIG>, rather than describe operation of both the first rescue hoist 210a and the second rescue hoist 210b and their related components just described.

Still referring to <FIG>, in various embodiments, the control system <NUM> includes a control bus <NUM>, similar to the control bus <NUM> described above with reference to <FIG>. The control bus <NUM> is configured to transmit control signals, bidirectionally, between a control input device <NUM>, similar to the control input device <NUM> described above with reference to <FIG>, and the control module <NUM> connected to the rescue hoist <NUM>. In various embodiments, the control input device <NUM> includes one or more of a pilot panel <NUM>, a cabin panel <NUM>, an operator pendant <NUM> and a trainee pendant <NUM>. Generally, each of the foregoing embodiments of the control input device <NUM> includes one or more input mechanisms - e.g., a push button <NUM>, a toggle switch <NUM> or a thumb wheel <NUM> - configured to control operation of the rescue hoist <NUM>. For example, the one or more input mechanisms - e.g., the push button <NUM> or the toggle switch <NUM> - may be configured to raise or lower the cable <NUM> or to stop or start raising or lowering the cable <NUM>. Likewise, in various embodiments, each of the foregoing embodiments of the control input device <NUM> includes input mechanisms configured to control operation of the support frame <NUM>, which operation may include activating a motor disposed within or proximate the support frame <NUM> to rotate a support frame arm <NUM> in a clockwise or counterclockwise direction with respect to a support frame post <NUM>. In various embodiments, one or both of the first rescue hoist 210a and the second rescue hoist 210b are secured to the support frame <NUM> or the support frame arm <NUM>.

In various embodiments, the control bus <NUM> comprises a first-Bus <NUM> and a second-Bus <NUM>, each of which is configured to couple together the rescue hoist <NUM> (or the control module <NUM>), the support frame <NUM> and the control input device <NUM>, including one or more of the pilot panel <NUM>, the cabin panel <NUM>, the operator pendant <NUM> and the trainee pendant <NUM>. Further, in various embodiments, the control bus <NUM> comprises an analog bus <NUM> - e.g., a copper wire - that couples together the rescue hoist <NUM> (or the control module <NUM>) and the control input device <NUM> and is configured, as explained further below, to take part in control of the cable cutter <NUM>. In various embodiments, the first-Bus <NUM> and the second-Bus <NUM> operate using a common protocol, thereby enabling a component to be plugged into the control bus <NUM> without the need for separate wire runs from the component to, for example, the control module <NUM> or the control input device <NUM>. For example, a searchlight <NUM> may be incorporated into the control system <NUM> by connecting the searchlight <NUM> to the first-Bus <NUM> via a first stub <NUM> and to the second-Bus <NUM> via a second stub <NUM>. Similarly, each of the rescue hoist <NUM>, the support frame <NUM> and the control input device <NUM> may be connected to the first-Bus <NUM> via a first stub <NUM> and to the second-Bus <NUM> via a second stub <NUM>. In various embodiments, the analog bus <NUM> may be connected to the various components - e.g., the rescue hoist <NUM> (or the control module <NUM>) and the control input device <NUM> - via a third stub <NUM>.

Still referring to <FIG>, the control system <NUM> further includes or is coupled to a storage device <NUM>, which may comprise componentry typically found in a flight recorder device. In various embodiments, the storage device <NUM> is coupled to the control module <NUM> via a storage bus <NUM>, which may comprise a third-Bus <NUM>, similar to either the first-Bus <NUM> or the second-Bus <NUM> described above. In various embodiments, the storage device <NUM> and the storage bus <NUM> are similar to the storage device <NUM> and the storage bus <NUM> described above with reference to <FIG>. In various embodiments, the storage device <NUM> is configured to store data reflecting a record of all the control inputs (or signals) received by the control module <NUM> via the control input device <NUM>, including one or more of the pilot panel <NUM>, the cabin panel <NUM>, the operator pendant <NUM> and the trainee pendant <NUM>. Typically, the storage device <NUM> is configured to receive data only, thus the third-Bus <NUM> may be configured to provide unidirectional transmission of data only, though the disclosure contemplates bidirectional transmission of data, such that operability of the storage device <NUM> may be reported to an operator of the aircraft - e.g., by displaying a status signal on the pilot panel <NUM> or the cabin panel <NUM>.

During operation, the control system <NUM> is configured to provide either two or three inputs (or two or three sets of data or signal inputs) to the control module <NUM> based on the inputs sent by the control input device <NUM> in response to a manipulation (e.g., operation of the push button <NUM>, the toggle switch <NUM> or the thumb wheel <NUM>). More specifically, during control of the hoist functions other than the cable cutter <NUM>, two inputs or signals are transmitted along the control bus <NUM> to the control module <NUM>. A first signal is transmitted on the first-Bus <NUM> and a second signal is transmitted on the second-Bus <NUM>. In various embodiments, upon receipt of the two signals by the control module <NUM>, the control module <NUM> will compare the two signals and direct the rescue hoist <NUM> to either respond accordingly or take no action. For example, the pilot panel <NUM> may be manipulated - e.g., via the push button <NUM> - to command the rescue hoist <NUM> to raise the cable <NUM> by directing an appropriate command signal to the control module <NUM>. The command signal is transmitted to the control module <NUM> via a first signal on the first-Bus <NUM> and via a second signal on the second-Bus <NUM>. The control module <NUM> compares the first signal against the second signal. If the first signal and the second signal both correspond to the same command - e.g., to raise the cable <NUM> - then the control module <NUM> directs the rescue hoist <NUM> to raise the cable <NUM>. On the other hand, if the control module <NUM> determines the first signal and the second signal both do not correspond to the same command, then no action is taken by the control module <NUM>.

During operation of the cable cutter <NUM>, on the other hand, three inputs or signals are transmitted along the control bus <NUM> to the control module <NUM>. Similar to the above description, a first signal is transmitted on the first-Bus <NUM> and a second signal is transmitted on the second-Bus <NUM>. However, during operation of the cable cutter <NUM>, a third signal is transmitted via the analog bus <NUM> (e.g., the hardwire) to the control module <NUM>. In various embodiments, the third signal may comprise a voltage difference from a nominal threshold or some similar analog signal, though the disclosure contemplates the third signal comprising digital signals as well. In various embodiments, upon receipt of the first signal and the second signal by the control module <NUM>, the control module <NUM> will compare the two signals in a fashion similar to the one described above. In the event the two signals do not both indicate a command to activate the cable cutter <NUM>, then no further action is taken. However, in the event both signals indicate the same command to activate the cable cutter <NUM>, the control module <NUM> initiates a subsequent query. The subsequent query examines the signal carried by the analog bus <NUM> and determines whether that signal is consistent with the signals to activate the cable cutter <NUM> received on the first-Bus <NUM> and the second-Bus <NUM>. If all three signals indicate a command to activate the cable cutter <NUM>, then the cable cutter <NUM> is activated; otherwise, no further action is taken.

Referring now to <FIG>, a method <NUM> of controlling a rescue hoist component in an aircraft is described, the method, in various embodiments, providing a DAL-A level of reliability. In various embodiments, a first step <NUM> includes transmitting a first signal across a first bus extending between a control module of the rescue hoist and a control input device, the first bus, in various embodiments, defining a DAL-C level of reliability. Similarly, a second step <NUM>, generally carried out simultaneously with the first step, includes transmitting a second signal across a second bus extending between the control module of the rescue hoist and the control input device, the second bus, in various embodiments, defining the DAL-C level of reliability. A third step <NUM> includes transmitting a third signal across a hardwire extending between the control module of the rescue hoist and the control input device. A fourth step <NUM> includes comparing the first signal against the second signal to determine whether the first signal is the same as the second signal. A fifth step <NUM> includes comparing the third signal against the first signal or the second signal to determine whether the third signal is consistent with the first signal and the second signal.

In various embodiments, the control module is configured to activate the component in response to a command signal, the command signal embodied in the first signal, the second signal and the third signal, when the control module determines the first signal is the same as the second signal and the third signal is consistent with the first signal and the second signal. In various embodiments, the control module is also configured to not respond to the command signal generated by the control input device in response to the control module determining that the first signal is not the same as the second signal or the third signal is not consistent with the first signal or the second signal.

A Dual-Bus architecture is disclosed per the above description and in accordance with various embodiments. In various embodiments, the operation described above results in a DAL-B level of reliability of all hoist functions, excepting the cable cutter <NUM> or similar mission critical component, notwithstanding each of the first-Bus <NUM> and the second-Bus <NUM> is typically configured to provide DAL-C levels of reliability when operating as standalone buses. When combined with a separate analog or hardwire, the Dual-Bus architecture above described provides a DAL-A level of reliability of the cable cutter <NUM> (or any other mission critical component wired separately with an analog or hardwire and a first-Bus and a second-Bus). The Dual-Bus architecture provides a DAL-B level of reliability in operation of a rescue hoist with minimal wiring - e.g., by eliminating discrete wiring between the rescue hoist and the various control input devices - thereby saving weight and reducing complexity. The Dual-Bus architecture also provides a standardization in software between components, enabling components to be repaired or replaced as line replaceable units and facilitating integration of control hierarchy into the control system. The Dual-Bus architecture also provides redundancy into the system in the event one of the first-Bus or the second-Bus experiences failure or otherwise becomes compromised.

Claim 1:
A control system for a component of a rescue hoist attached to an aircraft, comprising:
a first bus (<NUM>) extending between a control module (<NUM>) of the rescue hoist (<NUM>) and a plurality of control input devices (<NUM>);
a second bus (<NUM>) extending between the control module of the rescue hoist and the plurality of control input devices; and
an analog bus extending between the control module of the rescue hoist and the plurality of control input devices;
wherein the first bus is configured to transmit a first signal from a control input device of the plurality of control input devices to the control module, the second bus is configured to transmit a second signal from the control input device of the plurality of control input devices to the control module, and the analog bus is configured to transmit a third signal from the control input device of the plurality of control input devices to the control module, each of the first signal, the second signal, and the third signal being generated by the control input device in response to a manipulation of the control input device; and wherein
the control module (<NUM>) is configured to compare the first signal and the second signal against the third signal;
wherein the control module (<NUM>) is configured to respond to a command signal for the component generated by the control input device, the command signal embodied in the first signal, the second signal, and the third signal, in response to the control module determining the first signal is the same as the second signal and in response to the control module determining the third signal is consistent with the first signal and the second signal; and
wherein the control module (<NUM>) is configured to not respond to the command signal for the component generated by the control input device in response to the control module determining the first signal is not the same as the second signal or in response to the control module determining the third signal is not consistent with the first signal or the second signal.