Honeywell International Inc.

Honeywell G.m.b.h.

Gm Global Technolgoy Operations, Inc.

Launchpoint Energy and Power LLC

Sperry Corporation

Larry James Yount

Willard Ahart Blevins

John C Todd

Andrew H Leutheuser

Andrew K Chandler

Richard F Hess

William F Potter

Arthur D Beutler

Joseph W Jackson

Clarence S Smith

Brendan Hall

Casey Hanlon

Andrew T Johnson

Nicholas J Wilt

Devesh Bhatt

Jeffrey W Hegg

Timothy D Mahoney

Kent Stange

Dale D Davidson

Gerald B Kelley

Alan Bruce Hickman

Karen Brack

Inder Jit Verma

Eric Christianson

Bryan H Hill

Robert D Girts

John Teager

Donald A Peterson, Jr

Philip E Rose

Welsh C Pond

Kurt A Liebel

Scot E Griffiths

William M McMahon

Rick H Hay

Kent A Stange

A sensor arrangement and method that may be used with a variety of different energy storage devices, including battery packs found in hybrid vehicles, battery electric vehicles, and other types of vehicles. An exemplary sensor arrangement includes a number of sensor units, a controller, and several connections, wherein two or more sensor units are coupled to each node of the battery pack and are coupled to the controller over different connections. An exemplary method is divided into two aspects: an error detection aspect and an error resolution aspect. Because the sensor arrangement provides multiple sensor readings for each node being evaluated, the method can enable the sensor arrangement to continue operating accurately and with redundancy even if it experiences a loss of one or more sensor units.

Sensor arrangement and method of using the same

Modeling and testing are used to characterize consequences of a first lithium-ion cell having an internal short. The vulnerability of a second lithium-ion cell being induced into thermal runaway by the energy released by the first cell undergoing an internal short is quantified. Characteristics of the packaging of Li-ion cells within a battery pack are analyzed. Combined, these analyses determine the robustness required of a cell in order to withstand a nearby cell's internal short given that the battery is maintained within the specified operational envelope by a BMS and this envelope is modified in real-time as required to meet the safety requirement. Robustness factors are: age, history of charging/discharging, as well as immediate state of charge and environment. In operation, the cell's operational history is incorporated into a model. When the model indicates cell robustness at a predetermined lower limit, operation of the cell is ceased or limited.

Method and system for safe operation of large lithium-ion batteries

A fault tolerant battery management system includes redundancy, with applications including electric vehicles. Portions of its circuitry are constituted in distinct fault domains with control, monitoring, and balancing of cells circuitry fault-effect-isolated from the circuitry associated with built-in real-time testing. Built-in tests are orchestrated in fault domains isolated from the functional circuitry being verified. These built-in tests provide test stimulus unique for each cell measurement. Cell balancing is performed in a fault tolerant manner. It takes at least two independent faults, in two mutually distinct fault domains, to negatively affect balancing capability or to interfere with a redundant circuit's ability to operate. The built-in tests allow operation without the requirement for data cross-compare between redundant measuring electronic elements. Testing and balancing functions are interlocked through encoded enabling methodologies and transmit enables on serial buses. The circuitry is divided into mutually fault-isolated modules, each responsible for a subset of the cells.

Fault-tolerant battery management system, circuits and methods

A sensor arrangement and method that may be used with a variety of different energy storage devices, including battery packs found in hybrid vehicles, battery electric vehicles, and other types of vehicles. Some battery monitoring systems, such as those designed to monitor and/or control lithium-ion battery packs, may require individual voltage readings for each and every cell. If a battery monitoring system component&#x2014;even one that provides just one of these sensor readings&#x2014;malfunctions or otherwise experiences a fault condition, then it may be necessary to bring the entire vehicle in for service. The exemplary sensor arrangement and method may be used to control a series of balancing switches in the sensor arrangement in such a way that enables the vehicle to detect fault conditions and to continue operating successfully in the event that such fault conditions occur.

Sensor arrangement for an energy storage device and a method of using the same

A distributed engine control system is provided. The engine control system includes first and second engine data concentrators. Each of the first and second engine data concentrators include a processor module, a signal conditioning module coupled to the processor module, a data transfer module coupled to the processor module, and a data bus coupled between the first and second engine data concentrators and a hydro-mechanical unit (HMU).

Distributed engine control system

An aircraft flight surface control system and method simultaneously provides the benefits of both an active/active system architecture and in active/standby system architecture. The system is preferably implemented using hydraulic actuator assemblies and electromechanical actuator assemblies coupled to the same flight control surface. During normal system operations the electromechanical actuator assemblies are energized to supply a relatively minimal force to associated flight control surfaces. In effect, the electromechanical actuators, although energized, may be pulled along by the associated hydraulic actuator assemblies, until needed. Thus, the electromechanical actuator assemblies are controlled in a manner that closely resembles the active/standby architecture.

Load optimized redundant flight control surface actuation system and method

An aircraft flight control surface actuation control system includes an actuator control unit and a flight control module. The actuator control unit includes at least two independent actuator control channels to generate limited authority flight control surface actuator commands based on pilot inceptor position signals and flight control augmentation data. The flight control module supplies the flight control augmentation data to each of the independent actuator control channels, determines operability of each of the actuator control channels and, based on the determined operability of each independent actuator control channel, selectively prevents one of the independent actuator control channels from supplying the limited authority flight control surface actuator commands. The flight control module may also generate full authority flight control surface actuator commands for supply to flight control surface actuators.

Limited authority and full authority mode fly-by-wire flight control surface actuation control system

Methods and systems are provided for redundancy management of a fly-by-wire avionics system. A control module for producing a control signal is provided comprising a common processing partition for receiving a flight input signal and at least one first mode input signal, a first processing partition coupled to the common processing partition and configured to receive the first mode input signals and flight input signal from the common processing partition, and a second processing partition coupled to the common processing partition. The first processing partition produces a first mode output signal in response to one of the first mode input signals and flight input signal. The second processing partition generates a second mode signal in response to the flight input signal when the first processing partition fails. The common processing partition produces the control signal in response to one of the first mode output signal and second mode signal.

System and method of redundancy management for fault effect mitigation

A fly-by-wire (FBW) system () is coupled to cockpit controls () of an aircraft for controlling the aircraft, and an automatic flight control system (AFCS) () is coupled to the FBW system for maintaining the aircraft in stable flight. An unauthorized-flight detector () is coupled to the FBW system and coupled to the AFCS, and is arranged to carry out () a transfer of control of the FBW system from the cockpit controls to the AFCS, in response to a predetermined event.

Method and apparatus for preventing an unauthorized flight of an aircraft

Methods and apparatus are provided for more reliably transferring operational control for various aircraft flight control surfaces from a first sub-system to a second sub-system. The present invention provides an Actuator Control Electronics (ACE) wrap-back module that monitors the output of the normal mode control module and switches control to the direct control module based upon the detection of an error condition. The switching function is controlled by a monitoring system that monitors the output from an integrated heartbeat module that emits a pre-programmed signal. The pre-programmed signal is encoded and sent over a communication bus where it is then decoded and validated by comparing the decoded signal to the expected results. Any irregularity in the heartbeat signal automatically triggers a change of control from the first flight control sub-system to the second flight control sub-system.

Methods and apparatus for error-tolerant wrap-back ACE monitor

A flight control module with integrated actuator spoiler control electronics, where the flight control functions have been integrated into the integrated modular avionics through the use of a flight control module (&ldquo;FCM&rdquo;), the FCM being configured to contain spoiler actuator control electronics (&ldquo;ACE&rdquo;). The spoiler ACE is used to control the roll functions of the spoiler. The spoiler ACE is configured to be separate from the FCM, even though it is located within the same modules and receives its power independent of the power supply for the FCM. In the event of a failure of the primary flight control surfaces of an airplane, the spoilers can be used to control the roll of the aircraft because the spoiler ACE is independent of the ACE used to control the primary flight control surfaces. The spoiler ACE can also be used in the event of a failure of the FCM because the spoiler ACE is independent of the FCM.

Flight control module with integrated spoiler actuator control electronics

The present invention is a method that allows controllable devices attached to a vehicle's surface (such as, for example, controllable actuators on an aircraft) to be controlled by a processor or like device in an active-active mode and when a malfunction is detected in one of the controllable devices, the processor will switch to control the controllable devices in an active-standby mode.

Method for controlling actuators on a vehicle

In an aircraft using fly-by-wire technology, the flight control functions have been integrated into the integrated modular avionics (&ldquo;IMA&rdquo;). The new flight control module (&ldquo;FCM&rdquo;) resides on the same data bus as the other modules in the IMA and receives power from the same power supply. In addition, the FCM is also connected to a separate power supply to add redundancy to the system. Several benefits arise from this configuration of an FCM. There is no longer a separate chassis needed for the flight control functions, thus resulting in a reduction in weight. In addition, the FCM now has access to all of the data on the IMA bus, instead of a limited amount of data over an ARINC 629 bus. The FCM provides augmentation signals to the actuator control electronics (&ldquo;ACE&rdquo;) to aid in the flying of the aircraft. In the event of a failure of the FCM, the ACE still provides enough control to fly the airplane.

Flight control module merged into the integrated modular avionics

The present invention, Layered Detection Architecture (&ldquo;LDA&rdquo;) is useful to enhance the detection of command control processing errors and also facilitate survivorship among properly functioning flight critical Core Processing Modules (&ldquo;CPM&rdquo;) while eliminating faulty CPM responsible for processing execution errors. LDA is contemplated for use with lock-step execution verification schemes and other result comparison command-processing error detection methods also implementing redundant independent processing units.

Growing community of inventors

Scottsdale, AZ, United States of America

Larry James Yount