Autonomous safety mode for distributed conrtol of turbomachines

A method of operating a distributed control system for a turbomachine, the method comprising:

• detecting, by a distributed controller communicatively coupled with a central controller, a communication failure between the central controller and the distributed controller;
• in response to the detected communication failure, operating the distributed controller in an autonomous safety mode, wherein operating the distributed controller in the autonomous safety mode comprises:
• accessing, by the distributed controller, a past command received by the distributed controller from the central controller prior to the detected communication failure, the past command indicative of a parameter value associated with a first operating parameter of the turbomachine;
• receiving, by the distributed controller from a sensor associated with the distributed controller, sensor data indicative of a parameter value associated with a second operating parameter of the turbomachine;
• determining, by the distributed controller, a control command indicative of instructions for controlling an actuator associated with the distributed controller and communicatively coupled thereto based at least in part on the accessed past command and the received sensor data;
• and
• causing, by the distributed controller, the actuator to move based at least in part on the determined control command.

A vehicle, comprising:

• a gas turbine engine;
• a distributed control system operable to control the gas turbine engine during operation, the distributed control system comprising:
• a central controller;
• a distributed control node having a distributed controller, an actuator, and a sensor, wherein the distributed controller is communicatively coupled with the central controller and the actuator and the sensor are communicatively coupled with the distributed controller, and
• wherein the distributed controller is configured to:
• detect a communication failure between the central controller and the distributed controller;
• in response to the detected communication failure between the central controller and the distributed controller, the distributed controller transitions to an autonomous safety mode in which the distributed controller is configured to:
• access a past command received by the distributed controller from the central controller, the past command being indicative of a parameter value associated with a first operating parameter of the gas turbine engine;
• receive, from the sensor, sensor data indicative of a parameter value associated with a second operating parameter of the gas turbine engine;
• and
• control movement of the actuator based at least in part on the accessed past command and the received sensor data.