# US 4,159,444 A · Fail operational dual electromechanical servo actuator for aircraft with model monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 4,159,444 A - Document ID: US4159444A - Status: Granted - Kind: A - Application number: 05/888,713 - Filed: 1978-03-21 - Granted: 1979-06-26 - Earliest claimed: 1978-03-21 - Assignees: Sperry Rand Corporation - Inventors: Larry A. Bartlett; Curtis M. Campbell; Ronald I. Tesdal - Web page: https://patentgrep.com/patent/US4159444A ## CPC - G05B 9/03: with multiple-channel loop, i.e. redundant control systems - G05D 1/0077: {using redundant signals or controls} - G05B 2219/42307: Compare actual feedback with predicted, simulated value to detect run away - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - G05D: SYSTEMS FOR CONTROLLING OR REGULATING NON-ELECTRIC VARIABLES ## Abstract The dual electromechanical servo actuator comprises two electric servo motors coupled through differential gearing to position an output member in accordance with an input signal. Tachometer generators coupled to the respective output shafts of the servo motors, (and normally integral with the motors) provide rate feedback signals to the respective inputs of the servo amplifiers driving the respective motors. An electronic model of the dual servo actuators responsive to the input signal provides a rate signal simulating the tachometer responses to the input signal. A monitor compares the two tachometer signals and provides a failure signal when the difference therebetween exceeds a predetermined threshold. The monitor also simultaneously compares the model rate ouptut with the individual tachometer signals to determine which of the two servo channels has failed. The monitor circuits apply a brake to the servo motor output shaft of the failed channel. The remaining channel continues to properly position the output member through the differential gearing. For certain applications of the invention the monitor continues to compare the model rate output with the tachometer signal from the operating channel so as to detect a failure of the second channel and provide a fail passive condition. ## Claims ### Claim 1 An electromechanical servo actuator system having dual redundant servo channels for positioning a positionable load in response to input command means, comprising first and second electromechanical servo loop means responsive to said input command means having first and second electric servo motor means respectively and differential means having two inputs coupled to receive the respective outputs of said first and second electric servo motor means and having an output for positioning said positionable load, and first and second brake means respectively for arresting movement of said respective servo motor inputs to said differential means, first and second sensor means associated respectively with said first and second servo loop means for providing first and second parameter signals representative of a predetermined servo loop characteristic, electronic model means for electronically simulating the electromechanical characteristics of said servo loop means in response to said input command means and for providing a model parameter signal representative of the simulated predetermined servo loop characteristic, and monitor means responsive to said first and second parameter signals and said model parameter signal for providing a failure signal, indicative of a failed channel, to said brake means of said failed channel, thereby arresting the movement of said failed channel and permitting the operative servo actuator channel to continue positioning said load through said differential means. ### Claim 2 (depends on 1) The actuator system of claim 1 in which said first and second sensor means comprise first and second tachometer generator means for providing first and second actuator rate signals in accordance with the rate outputs of said servo motor means respectively, and said simulated servo loop characteristic comprises simulated actuator rate. ### Claim 3 (depends on 2) The actuator system of claim 2 in which said actuator rate signals are applied in said respective servo loop means as rate feedback signals therefor. ### Claim 4 (depends on 1) The actuator system of claim 1 in which said monitor means includes first comparator means for providing a first failure indication signal when the difference between said first parameter signal and said model parameter signal exceeds a predetermined threshold, second comparator means for providing a second failure indication signal when the difference between said second parameter signal and said model parameter signal exceeds a predetermined threshold, third comparator means for providing a failure detection enabling signal when the difference between said first and second parameter signal exceeds a predetermined threshold, and enabling means responsive to said first and second failure indication signals and said failure detection enabling signal for rendering said first and second failure indication signals effective in accordance with said failure detection enabling signal thereby providing said failure signal to actuate said brake means of said failed channel. ### Claim 5 (depends on 4) The actuator system of claim 4 in which said enabling means comprises first and second AND gate means both responsive to said failure detection enabling signal and respectively responsive to said first and second failure indication signals for transmitting said failure indication signals in accordance with said failure detection enabling signal whereby providing said failure signal. ### Claim 6 (depends on 5) The actuator system of claim 5 in which said monitor means further includes first and second latch means coupled to receive the respective outputs of said first and second AND gate means for latching into a set state upon transmission of the associated failure indication signal through the associated AND gate means thereby providing said failure signal. ### Claim 7 (depends on 4) The actuator system of claim 4 in which said predetermined thresholds associated with said first and second comparator means are equal to each other and greater than said predetermined threshold associated with said third comparator means. ### Claim 8 (depends on 5) The servo actuator system of claim 5 in which said monitoring means further includes monitor disable control means responsive to said failure signal for disabling said AND gate means upon detection of a failure when operating in a first mode and for momentarily disabling said AND gate means when operating in a second mode. ### Claim 9 (depends on 1) The actuator system of claim 1 in which said electronic model means includes motor transfer function circuit means for simulating the transfer function of said servo motor means, motor breakout circuit means for simulating the breakout characteristics of said servo motor means, motor rate limit circuit means for simulating the rate limit of said servo motor means, and motor rate bias means for providing a bias signal for simulating the differing rate responses of said servo motor means with respect to signals commanding clockwise and counterclockwise rotation thereof. ### Claim 10 (depends on 9) The actuator system of claim 9 in which said sensor means comprise tachometer generator means for providing actuator rate signals representative of servo motor rate, said actuator rate signals being utilized to provide negative feedback for damping said servo loop means, said actuator rate signals providing said first and second parameter signals, and said system further includes actuator position sensor means for providing negative position feedback closing said servo loop means. ### Claim 11 (depends on 10) The actuator system of claim 10 in which said electronic model means further includes circuit means for providing a feedback path around said electronic model means for simulating said actuator position feedback of said servo actuator system, and rate circuit means for providing a rate feedback path around said electronic model means for simulating said rate feedback of said actuator system, said rate circuit path means providing said model parameter signal. ### Claim 12 (depends on 1) The actuator system of claim 1 in which said monitor means further includes model mode control means responsive to said failure signal for providing a gain control signal to said electronic model means for changing the gain thereof to simulate single channel operation of said actuator system after braking said failed channel. ### Claim 13 (depends on 11) The actuator system of claim 11 in which said monitor means further includes model mode control means responsive to said failure signal for providing a gain changing signal to said motor transfer function circuit and said rate circuit of said model means for changing the gain thereof to simulate single channel operation of said actuator system after braking said failed channel. ### Claim 14 (depends on 1) The actuator system of claim 1 in which said first and second sensor means comprise first and second tachometer generator means for providing first and second actuator rate signals representative of the rate of said servo loop means respectively, said first and second actuator rate signals providing rate feedback around said first and second servo loop means respectively. ### Claim 15 (depends on 14) The actuator system of claim 14 further including equalization means responsive to said first and second actuator rate signals for providing signals to said first and second servo loop means in a manner tending to render said actuator rates equal to each other. ### Claim 16 (depends on 15) The actuator system of claim 15 in which said equalization means comprises difference means responsive to said first and second actuator rate signals for providing the difference therebetween, lag circuit means response to said difference signal, and means for coupling the output of said lag circuit means to said first and second servo loop means with polarities tending to render the rates of said first and second servo loop means equal to each other. ### Claim 17 (depends on 15) The servo actuator system of claim 15 in which said monitor means further includes equalization disabling means responsive to said failure signal for providing a disabling signal to said equalization means in response to said failure signal. ### Claim 18 (depends on 1) The actuator system of claim 1 in which said positionable load comprises an aerodynamic control surface of an aircraft. ### Claim 19 (depends on 1) The actuator system of claim 1 in which said electronic model means comprises first and second electronic model means for electronically simulating the electromechanical characteristics of said servo loop means in response to said input command means and for providing first and second model parameter signals representative of the simulated predetermined servo loop characteristic, and said monitor means comprises first and second monitor means each responsive to said first and second parameter signals, said first and second monitor means being responsive to said first and second model parameter signals respectively for providing first and second failure signals respectively indicative of failure of a respective channel, said first and second failure signals being applied to said first and second brake means respectively to actuate said brake means of said failed channel, thereby arresting the movement of said failed channel permitting the operative servo actuator channel to continue positioning said load through said differential means. ### Claim 20 An electromechanical servo actuator system having dual redundant servo channels for positioning a positionable load in response to input command means, comprising first and second electromechanical servo loops responsive to said input command means having first and second electric servo motors respectively, differential gear means having two inputs coupled to receive said outputs of said first and second servo motors respectively and having an output for positioning said positionable load, first and second brake means respectively for clamping the respective inputs to said differential means and first and second tachometer generators coupled respectively to said first and second servo motors for providing first and second actuator rate signals respectively as rate feedback around said first and second servo loops respectively, electronic model means for electronically simulating the electromechanical characteristics of said servo loops in response to said input command means and for providing a model rate signal representative of simulated actuator rate, and monitor means for comparing said actuator rate signals with said model rate signal and for providing a failure signal, indicative of a failed channel, to actuate said brake means of said failed channel when the difference between at least one of said actuator rate signals and said model rate signal exceeds a predetermined threshold, thereby clamping said failed channel and permitting the operative servo channel to continue positioning said load through said differential gear means. ### Claim 21 (depends on 20) The actuator system of claim 20 in which said monitor means comprises first comparator means for providing a first failure indication signal for actuating said first brake means when the difference between said first actuator rate signal and said model rate signal exceeds a predetermined threshold, second comparator means for providing a second failure indication signal for actuating said second brake means when the difference between said second actuator rate signal and said model rate signal exceeds a predetermined threshold, third comparator means for providing a failure detection enabling signal when the difference between said first and second actuator rate signals exceeds a predetermined threshold, and enabling means for rendering said first and second failure indication signals effective in accordance with said failure detection enabling signal thereby providing said failure signal to actuate said brake means of said failed channel. ### Claim 22 (depends on 21) The actuator system of claim 21 in which said enabling means comprises first and second AND gate means responsive to said failure detection enabling signal and responsive respectively to said first and second failure indication signals for transmitting said failure indication signals in accordance with said failure detection enabling signal, and first and second latch means coupled to receive the respective outputs of said first and second AND gate means for latching into a set state upon transmission of the associated failure indication signal through the associated AND gate means thereby providing said failure signal to actuate said brake means of said failed channel. ### Claim 23 (depends on 22) The actuator system of claim 22 in which said monitoring means further includes monitor disable control means for disabling said AND gate means upon detection of a failure when operating in a first mode and for momentarily disabling said AND gate means when operating in a second mode. ### Claim 24 (depends on 22) The actuator system of claim 22 in which said monitor means further includes model mode control means for providing a gain control signal to said electronic model means for changing the gain thereof upon detection of a failure to simulate single channel operation of said actuator system after braking said failed channel. ### Claim 25 In a redundant dual servo actuator system of the type including first and second substantially identical servo actuators responsive respectively to first and second substantially identical control signal channels, each channel comprising a servo amplifier having an input responsive to a command signal and an output for controlling said actuator, a tachometer for providing an actuator rate feedback signal to said amplifier input and brake means for arresting movement of said actuator, differential means having input means coupled respectively to the outputs of said actuators and an output coupled to a positionable load and position feedback means responsive to said load position for supplying a position feedback signal to each of said amplifier inputs, monitoring means for said system comprising, electronic model means electronically duplicating the electromechanical chatacteristics of said servo actuator including means for producing a signal corresponding to the rate characteristics thereof, comparator means responsive to said actuator rate feedback signals and said rate characteristic signal of said model means for providing a signal indicative of a failed channel, and means for supplying said last mentioned signal to the brake means of the failed channel for arresting its movement and providing a load at its corresponding differential input whereby the operative servo actuator channel may continue to position said positionable load.