214 to achieve such goal in one embodiment can be determined using the theory of complete graphs or bipartite graphs (see FIG. 4A) depending on whether one or more types of RTXs are used in the architecture. See FIG. 4A, decision block 280. If the RTXs 214 are all of the same type, the theory of complete graphs can be used. See FIG. 4A block 282 and FIG. 4B. A simple graph with n vertices is said to be complete if there is an edge between every pair of vertices. If two different types of RTXs 214 are used, the theory of bipartite graphs can be used. See FIG. 4A block 284 and FIG. 4C. A bipartite graph is a graph in which the vertices can be partitioned into two disjoint sets V and W such that each edge is an edge between a vertex in V and a vertex in W

3. In the first branch of the second configuration, the minimum number of RTXs 214 is determined by the maximum number of controllers of the same category. The effector actuation means or effector actuators may be grouped in categories which may be for example the category of surface actuators, the category of motor controllers, or any other meaningful category. If E is the maximum number of controllers of the category with greater number of elements, then, if n is the minimum number of RTXs 214, according to the theory of complete graphs of FIG. 4B, it can be determined by finding the value of n that results in the minimum value of K such that K is greater or equal to E, where K=n*(n−1)/2.

4. In a second branch of the second configuration, the minimum number of RTXs 214 is also determined by the maximum number of controllers of the same category. If E is the maximum number of controllers of the category with a greater number of elements, then, if m is the minimum number of RTXs 214 of a first type and n is the minimum number of RTXs of a second type, according to the theory of bipartite graphs of FIG. 4C, the values of m and n can be determined by finding any combination in which the values of m and n result in the minimum value of K such that K is greater than or equal to E, where it is given by Km,n=m*n. In this case, more than one solution is possible and therefore more or less RTXs 214 of a first type may be used depending e.g., on the number of RTXs of the second type to be used.

The Below-Described Features of Example Non-Limiting Embodiments May Be Used Individually or Together in Any Combination of the following:

A first Flight Control system configuration, and the method to obtain such first configuration, has controllers of effector actuation means or effector actuators able to receive commands directly from at least three Flight Control Computers (FCCs).

Each of the three FCCs is directly linked to each of the controllers, being only one FCC active at a time.

Each FCC has a command lane to send commands to the controllers and a monitor lane to check command integrity.

Two of the three FCCs are of the same part number and one of the three FCCs being of a backup of dissimilar part number; or the three FCCs are of the same part number to reduce complexity of the solution.

Each of the three FCCs are connected to some or to all of independent sensors located on the surfaces, propellers and or mechanisms of the effectors; or each of the three FCCs receives sensor information from at least one Sensor interface module (SIM).

Each sensor interface module has a single lane to read at least one of independent sensors located on the surfaces, propellers and or mechanisms of the effectors.

At least one of the three FCCs receives instructions from at least one Avionics computer. The Avionics computer(s) is responsible to send high level instructions to the FCCs, including at least one of the following: navigation commands, Autonomous commands, commands from a remote controller, commands from a touch screen display.

Alternatively or in conjunction with the above, each of the three FCCs is connected to flight deck inceptors, where each FCC is directly connected to at least one sensor of each axis of control of flight deck inceptors.

Alternatively or in conjunction with the above, each of the three FCCs receives sensor information from at least one sensor interface module (SIM). Each sensor interface module has a single lane to read at least one sensor of each axis of control of the flight deck inceptors.

Each FCC exchanges, with the other FCCs, part or all of its processed information and/or the information received from other components which include at least one of the following: the flight deck inceptors and/or effector sensors, as well as mode and state information, among other information, to allow data voting and mode coordination among the FCCs.

The effector actuation means or effector actuator is classified in: surface actuators, tilt mechanism actuators, and propeller electric motors. The controllers of surface actuators and tilt mechanisms have a single lane that receives the commands from the FCCs and executes the command from the active FCC if the command is considered fresh and valid by the actuator, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.

The surface actuators and tilt mechanisms receive each a link from the FCCs that enables or disables each actuator based on high integrity criteria implemented at the FCCs. Alternatively or in combination, each surface actuator and tilt mechanism is energized/de-energized by a relay commanded by the FCCs.

The controllers of propeller electric motors have a single lane that receives the commands from the FCCs and executes the command from the active FCC if the command is considered fresh and valid by the controller, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.

The propeller electric motors controllers receive each a link from the FCCs that enables or disables each motor based on criteria implemented at the FCCs.

Alternatively, each propeller electric motor controller is energized/de-energized by a contactor commanded by the FCCs.

Alternatively, the controllers of propeller electric motors have a control lane and a monitor lane that receives the commands from the FCCs and execute the command from the active FCC if the command is considered fresh and valid by the controller, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.

A further Flight Control system configuration, and the method to obtain such second configuration, has retransmitters (RTX) that receive commands from the three FCCs and then retransmit to the controllers of effector actuation means or effector actuators.

The term RTX may refer to many different types of units depending on which function they perform such as voting, source selection, etc. Some examples are Remote Electronic Unit (REU), Remote Data Concentrator (RDC), Inceptor Interface Module (IIM), Input Output Module (IOM), etc.

At least one RTX receives commands from each of the three FCCs. At least one RTX receives the commands from the FCCs and retransmits the command from the active FCC if the command is considered fresh and valid, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.

Alternatively to or in conjunction, at least one RTX receives the commands from the three FCCs and retransmits all of them. Alternatively to or in conjunction, at least one RTX receives commands from each of the three FCCs and votes the commands for retransmitting a voted value.

Alternatively, some of the RTXs are also FCCs, reducing the number of LRUs.

Each of the three FCCs is indirectly linked to each of the controller of effector actuation means or effector actuator.

At least one FCC has a command lane to process and send commands to the controllers and a monitor lane to check command integrity.

Alternatively to or in conjunction, at least one FCC has a single lane to process and send commands to the controllers.

Each of the three FCCs is of dissimilar part numbers. Or the three FCCs are of the same part number to reduce complexity of the solution.

Each of the three FCCs are connected to some or to all of independent sensors located on the surfaces, propellers and or mechanisms of the effectors.

Alternatively to or in conjunction, each of the three FCCs receives sensor information from at least one Sensor interface module (SIM). Each sensor interface module has a single lane to read at least one of independent sensors located on the surfaces, propellers and or mechanisms of the effectors.

At least one of the three FCCs receives instructions from at least one Avionics computer The Avionics computer(s) is responsible to send high level instructions to the FCCs, including at least one of the following: navigation commands, Autonomous commands, commands from a remote controller, commands from a touch screen display.

Alternatively or in conjunction, each of the three FCCs is connected to flight deck inceptors. Each FCC is directly connected to at least one sensor of each axis of control of flight deck inceptors.

Alternatively or in conjunction, each of the three FCCs receive sensor information from at least one sensor interface module (SIM). Each sensor interface module has a single lane to read at least one sensor of each axis of control of the flight deck inceptors.

At second configuration, each controller of effector actuation means or effector actuators receives command from at least two RTXs.

The controllers of surface actuators and tilt mechanisms have a single lane that receives the commands from the RTXs and executes the source with highest priority if the command is considered fresh and valid by the controller, otherwise switching to the other(s) source(s) with highest priority if fresh and valid.

The surface actuators and tilt mechanisms receive at least a link from the RTXs that enables or disables each controller based on high integrity criteria implemented at the RTXs.

Alternatively, the surface actuators and tilt mechanisms receive at least a link from the FCCs that enables or disables each controller based on high integrity criteria implemented at the FCCs.

Alternatively or in conjunction, each surface actuator and tilt mechanism is energized/de-energized by a relay commanded by the RTXs.

The controllers of propeller electric motors have a single lane that receives the commands from the RTXs and executes the command from the source with highest priority if the command is considered fresh and valid by the controller, otherwise switching to the other(s) source(s) with highest priority if fresh and valid.

The propeller electric motors controllers receive at least a link from the RTXs that enables or disables each motor based on criteria implemented at the RTXs. Alternatively or in conjunction, the controllers of propeller electric motors receive at least a link from the FCCs that enables or disables each controller based on high integrity criteria implemented at the FCCs.

Alternatively or in conjunction, each propeller electric motor controller is energized/de-energized by a contactor commanded by the RTXs.

Alternatively to or in conjunction, the controllers of propeller electric motors have a control lane and a monitor lane that receive the commands and execute the command with highest priority if the command is considered fresh and valid by the controller, otherwise switching to the other(s) source(s) with highest priority if fresh and valid.

A method to obtain the architecture with the minimum number of RTXs of second configuration is determined using either the theory of complete graphs or bipartite graphs depending on whether one or more types of RTXs are used in the architecture. The minimum number of RTXs of second configuration, if all RTXs are all of the same type, is determined by the theory of complete graphs. The minimum number of RTXs of second configuration, if two different types of RTXs are used, is determined by the theory of bipartite graphs. The architecture with minimum number of RTXs is determined by the maximum number of controllers of the same category. The controllers may be grouped in categories which may be, for example, the category of surface actuators, the category of motor controllers, or any other meaningful category.

On a first branch, if E is the maximum number of controllers of the category with greater number of elements, then, if n is the minimum number of RTXs, according to the theory of complete graphs, it can be determined by finding the value of n that results in the minimum value of K such that K is greater or equal to E, where K=n*(n−1)/2.

On a second branch, the architecture with minimum number of RTXs is also determined by the maximum number of controllers of the same category. If E is the maximum number of controllers of the category with greater number of elements, then, if m is the minimum number of RTXs of a first type and n is the minimum number of RTXs of a second type, according to the theory of bipartite graphs, the values of m and n can be determined by finding any combination in which the values of m and n result in the minimum value of K such that K is greater than or equal to E, where it is given by Km,n=m*n. In this case, more than one solution is possible and therefore it can be used more or less RTXs of a first type depending on the number of RTXs of the second type.

A further Flight Control system configuration, and the method to obtain such third configuration, is a hybrid configuration.

In the hybrid configuration, the controllers of propeller electric motors receive commands directly from at least three Flight Control Computers (FCCs). Each of the three FCCs is directly linked to at least one of the controllers of propeller electric motors, being only one FCC active at a time.

The controller(s) of propeller electric motor(s) has a single lane that receives the commands from the FCCs and executes the command from the active FCC if the command is considered fresh and valid by the controller, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.

The controller(s) of propeller electric motor(s) receives each a link from the FCCs that enables or disables each motor based on criteria implemented at the FCCs.

Alternatively, each propeller electric motor controller is energized/de-energized by a contactor commanded by the FCCs. Alternatively, the controller(s) of propeller electric motor(s) have a control lane that receive the commands from the FCCs and execute the command from the active FCC if the command is considered fresh and valid by the controller, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.

A monitor lane forces safe state of the respective controller of propeller electric motor in case of misbehavior of the control lane.

The hybrid configuration has retransmitters (RTX) that receive commands from the three FCCs and then retransmit to the remaining controllers of effector actuation means or effector actuators. Each remaining controller receives command from at least two RTXs.

The method to obtain the architecture with the minimum number of RTXs is determined using either the theory of complete graphs or bipartite graphs depending on whether one or more types of RTXs are used in the architecture. Alternatively, some of the RTXs are also FCCs, reducing the number of LRUs.

NON-LIMITING EXAMPLES

To exemplify the use of such configuration, an eVTOL such as shown in FIG. 1 has the following effectors: 8 propellers 102 on the top called lifters; 2 propellers 108 on the back for forward thrust called pushers; four longitudinal actuators, four roll actuators and two rudder actuators to drive flight control surfaces such as rudder 106.

Example 1

As an example of use of the first configuration for the eVTOL, each controller of the effector actuation means or effector actuator is able to receive three sources of input, and each of the three FCCs 202 is directly connected to each controller.

FIG. 5 shows an example using the first configuration to control the propellers of an eVTOL. In a further refinement, this FIG. 5 shows FCC1 202(1) and FCC2 202(2) of the same type and using a Command/Monitor architecture to provide data at high integrity for the controllers. By receiving high integrity data, the controllers do not need to vote received data, but just verify that the source is valid before using the data for commanding. In this way, the controllers can implement a simple source selector instead of a voting algorithm. In case of loss of invalid data from FCC1 202(1) and FCC2 202(2), the controllers use data from the backup FCC3 202(3), which in this embodiment is another type of computer different from the types of computers used to implement FCC1 and FCC2 and is also based on the Command/Monitor architecture.

FIG. 6 shows the same three FCCs 202 of FIG. 5. FIG. 6 shows just the connection of the FCCs with example Flight Control System (FCS) actuators that control the aerodynamic control surfaces 180 such as rudder 106, tilt mechanisms, and other flight control effectors.

Example 2

FIGS. 7 & 8 show an example of use of the second branch of the second configuration for the eVTOL, where each controller of the effector actuation means or effector actuator is able to receive two sources of input, and each of the three FCCs 202 would be directly connected to two types of RTXs 214. The effector actuation means or effector actuator can be grouped into categories such as the category of lifters with eight elements 102(1)-102(8), the category of pushers with two elements 104(1), 104(2), the category of latero-directional actuators with six elements 180(1)-180(6) and the category of longitudinal actuators with four elements 180(7)-180(10). In this grouping, E which is the maximum number of controllers of the category with a greater number of elements is equal to eight. Considering m as the minimum number of RTXs 214 of a first type (in this example 214(1)-214(3)) and n as the minimum number of RTXs 214 of a second type (in this example 214(4)-214(6)), there are some possible combinations of m and n which make K greater than or equal to E, such as m=3 and n=3. Using this combination, each RTX 214 receives commands from the three FCCs 202 and each of the eight lifters 102 receive command from an exclusive combination of an RTX 214 of a first type and an RTX 214 of a second type. In case of loss of any two FCCs 202 or any two RTXs 214, no more than one lifter 102 would be lost.

FIG. 7 shows the connections from the three FCCs 202 to Motor Controllers in this example, each motor controller being connected to or part of a lifter motor that rotates a lifter 102 or pusher 104.

FIG. 8 shows the same three FCCs 202 of FIG. 7. FIG. 8 shows just the connection of the FCCs 202 with Flight Control System (FCS) actuators.

Example 3

Depending on Safety Assessment results, to provide additional redundancy it may be necessary to provide more complexity to the vehicle architecture, such as using two motor controllers for each lifter 102. This architecture is shown in FIG. 9. In this case, the previous example would be modified to consider E=16. There are some possible combinations of m and n which make K greater than or equal to E, such as m=4 and n=4. Using this combination, each RTX receives commands from the three FCCs and each of the sixteen lifter motor controllers receive commands from an exclusive combination of an RTX of a first type and an RTX of a second type. In case of loss of any two FCCs or any two RTXs, no more than 1 lifter motor controller would be lost.

FIG. 9 shows the connections from the three FCCs 202 to the Motor Controllers in this example.

FIG. 10 shows the same three FCCs of FIG. 9. FIG. 10 shows just the connection of the FCCs 202 with Flight Control System (FCS) actuators.

Example 4

FIGS. 11 and 12 show an example of use of the first branch of the second configuration for the eVTOL, where each controller of the effector actuation means or effector actuator is able to receive two sources of input, and each of the three FCCs 202 is directly connected to one type of RTX 214. The effector actuation means or effector actuator can be grouped into categories such as the category of motor controller of propellers with ten elements, the category of latero-directional actuator controllers with six elements and the category of longitudinal actuator controllers with four elements. In this grouping, E which is the maximum number of controllers of the category with greater number of elements, is equal to ten. Considering n as the minimum number of RTXs 214, five is the value of n that results in the minimum value of K such that K is greater than or equal to E. Using this combination, each RTX 214 receives commands from the three FCCs 202 and each of the ten motor controllers (see FIG. 9) receives commands from an exclusive combination of two RTXs. In case of loss of any two FCCs 202 or any two RTXs 214, no more than 1 propeller would be lost.

FIG. 11 shows the connections from the three FCCs 202 to the Motor Controllers in this example.

FIG. 12 shows the same three FCCs 202 of FIG. 11. FIG. 12 shows just the connection of the FCCs 202 with Flight Control System (FCS) actuators for effectors 180.

Example 5 (Hybrid)

FIG. 13 show another example which uses a hybrid configuration. If either the motor controllers of the lifter propellers 102 receive three sources of command and the actuators and pusher 104 motor controllers receive two sources of command, each lifter motor controller can receive commands directly from each of the three FCCs 202, and each of the actuator and pusher motor controllers can receive commands indirectly via the RTXs 214, as already presented in previous examples.

Alternatively, such hybrid configuration may be used if the actuators receive three sources of commands and the motor controllers receive two sources of commands, or in any other possible combination of different types of motor controllers and actuators, receiving different number of inputs.

FIG. 13 thus shows an example of a possible hybrid configuration. This configuration has the advantage of a direct link to reduce the delay of commands from FCCs 202 to the lifter 102 motor controllers, which improves vehicle controllability. It allows high availability on controllers that just receive commands from two sources. It also reduces the number of outputs from each FCC 202 as the RTXs 214 take care of the retransmission to the actuators and pusher 104 motor controllers.

The controllers that receive inputs from two sources can be grouped into categories such as the category of pushers 104 with two elements, the category of latero-directional actuators 180 with six elements and the category of longitudinal actuators 180 with four elements. In this grouping, E (which is the maximum number of controllers of the category with the greater number of elements) is equal to six. Considering m as the minimum number of RTXs 214 of a first type and n as the minimum number of RTXs 214 of a second type, there are some possible combinations of m and n which make K greater than or equal to E, such as m=2 and n=3 for a total of five RTXs 214(1)-214(5). But another example embodiment shown in FIG. 13 uses 3 RTXs 214(1)-214(3) of type A and 3 RTXs 214(4)-214(6) of type B to achieve a symmetric distribution of LRUs.

Example 6

FIGS. 14 & 15 show another example based on example 2, where some of the RTXs 1214 can perform the function of an FCC 202 (i.e. acting as a combined RTX and FCC providing functions of each), therefore reducing the number of LRUs. This example uses the second branch of the second configuration for an eVTOL. Refer to example 2 for more details on the number of RTXs 214 of example 6.

FIG. 14 shows the connections from the three RTX/FCCs 1214 to the Motor Controllers in this example.

FIG. 15 shows the same three RTX/FCCs 1214 of FIG. 14. FIG. 15 shows just the connection of the RTX/FCCs 1214 with Flight Control System (FCS) actuators.

Example 7

FIGS. 16 and 17 show another example based on example 4, in which some of the RTXs 1214 can perform the function of an FCC 202 (i.e. acting as a combined RTX and FCC providing functions of each) therefore reducing the number of LRUs. This example uses the first branch of the second configuration for the eVTOL. Refer to example 4 for more details on the number of RTXs of example 7.

FIG. 16 shows the connections from the three RTX/FCCs 1214 to the Motor Controllers 102, 104 in this example.

FIG. 17 shows the same three RTX/FCCs 1214 of FIG. 16. FIG. 17 shows just the connection of the RTX/FCCs 1214 with Flight Control System (FCS) actuators 180.

Example 8 (Hybrid)

FIG. 18 shows a hybrid configuration that may be used in which some of the RTXs 1214 can perform the function of an FCC 202 as well as the function of an RTX, therefore reducing the number of LRUs. If the motor controllers of the lifter propellers 102 receive three sources of command and/or the actuators and pusher 104 motor controllers receive two sources of command, each lifter motor controller can receive commands directly from each of the three RTX/FCCs 202, and each of the actuator and pusher motor controller can receive commands indirectly via the RTXs 214, as already presented on previous examples.

Alternatively, such hybrid configuration may be used if the actuators receive three sources of command and the motor controllers receive two sources of command, or in any other possible combination of different types of motor controllers and actuators, receiving different numbers of inputs.

FIG. 18 thus shows an example of a possible hybrid configuration. This configuration has the advantage of a direct link to reduce the delay of commands from RTX/FCCs 1214 to the lifter 102 motor controllers, which improves vehicle controllability. It allows high availability on controllers that receive command from just two sources. It also reduces the number of outputs from each RTX/FCC 1214 as the RTXs 214 take care of the retransmission to the effector actuators and pusher motor controllers.

The controllers that receive inputs from two sources can be grouped into categories such as the category of pushers 104(1)-102(2) with two elements, the category of latero-directional actuators 180(1)-180(6) with six elements and the category of longitudinal actuators 180(7)-180(10) with four elements. In this grouping, E (which is the maximum number of controllers of the category with the greater number of elements) is equal to six. Considering m as the minimum number of RTXs 214 of a first type and n as the minimum number of RTXs 214 of a second type (whether or not combined with FCCs, since in this embodiment RTX/FCCs 1214(1) and 1214(2) are combined FCCs with RTXs of a Type A, and RTX/FCC 1214(3) is a combined FCC with an RTX of a different Type B), there are some possible combinations of m and n which make K greater than or equal to E, such as m=2 and n=3.

Example 9 (Inceptors)

Besides the examples of connection with the effectors, the links with the flight deck inceptors is also presented here and shown in FIG. 19.

In this example, each FCC 202 is directly connected to one sensor of each axis of control of flight deck inceptors 206. The figure shows two inceptors 206(1), 206(2) to control the axes of Pitch, Roll, Yaw and Throttle, each axis having three sensors. The FCCs 202 read the information from their respective set of inceptor sensors 206 and retransmit to the other FCCs 202.

In this example, the three FCCs 202 may be of the same type, or each one may be of a different type. They may have a single lane or dual lane in a Command/Monitor FCC 202 configuration.

Example 10 (Inceptors)

Another example of connection with the flight deck inceptors is shown in FIG. 20.

The figure shows two inceptors 206(2), 206(4) to control the axes of Pitch, Roll, Yaw and Throttle, each axis having four sensors.

In this example, each FCC 202 is directly connected to one sensor of each axis of control of flight deck inceptors 206. There are two types of FCC 202 which are dissimilar: type A and type B. Each FCC 202 is of a traditional Command/Monitor lanes architecture. There is also one Sensor Interface Module (SIM) 2000 to read the fourth set of sensors of the inceptors 206. The FCCs 202 and the SIM 2000 read the information from their respective set of inceptor sensors 206 and retransmit to the other FCCs 202.

Besides what is presented in these examples, there may be more SIMs 2000 to perform the function of reading sensors and retransmitting to the FCCs 202.

Example 11 (Relays and Contactors)

Besides examples of connection with the effectors and flight deck inceptors 206, there is also the possibility to include relays or contactors 212 in the architecture to disengage specific actuators and/or motor controllers in case of misbehavior. In this context, relays and contactors may comprise electromechanical devices that comprise electromagnetic coils that when energized and deenergized cause an armature or the like to move and thus cause electrical contacts to make or break electrical connections, and may also include so-called “semiconductor” or “solid state” or opto-isolated relays or contactors which use triacs or FETs to make or break electrical connections, or other devices having the same or similar functionality. Such devices are often used to switch high current and/or high power while isolating digital systems such as FCCs 202 from such high current and/or power.

In this example, each FCC 202 is directly connected to the control inputs of relays and contactors 212. The relays 212R are responsible for energizing or de-energizing the actuators. The contactors 212C are responsible for energizing or de-energizing the motor controllers. The relays and/or contactors 212 can be standalone LRUs or can be grouped in some LRUs. Each relay 212R energizes an effector actuator if at least one FCC 202 commands energization. The contactor 214C energizes the motor controller if at least one FCC commands energization.

In this example, the three FCCs 202 may be of the same type, or each one may be of a different type. They may have a single lane or dual lane in a Command/Monitor FCC 202 configuration.

FIG. 21 shows the connections from the three FCCs 202 to one of the contactors 212C.

FIG. 22 shows the same three FCCs 202 of FIG. 21. FIG. 22 shows just the connection of the FCCs 202 with one of the relays.

Example 12 (Relays and Contactors)

Besides examples of connection with the effectors and flight deck inceptors, there is also the possibility to include relays or contactors 214 in the architecture to disengage specific actuators and/or motor controllers in case of misbehavior.

In this example, each FCC 202 is connected to the relays and contactors 212 via RTXs 214. The relays 212R are responsible for energizing or de-energizing the actuators. The contactors 212C are responsible for energizing or de-energizing the motor controllers. The relays and/or contactors 212 can be standalone LRUs or can be grouped in some LRUs. The relay 212R energizes the actuator if at least one RTX 214 commands energization. The contactor 212C energizes the motor controller if at least one RTX 214 commands energization.

In this example, the three FCCs 202 may be of the same type, or each one may be of a different type. They may have a single lane or dual lane in a Command/Monitor FCC 202 configuration. Also, the RTXs 214 may be of the same type, or of different types.

FIG. 23 shows the connections from the three FCCs 202 to one of the contactors via RTXs 214.

FIG. 24 shows the same three FCCs 202 of FIG. 23. FIG. 24 shows just the connection of the FCCs with one of the relays via RTXs.

Example Non-Limiting Control Functions

FIGS. 25-30 show example control functions that the systems described above may perform. These control functions may be performed by executing software and/or by executing firmware and/or performed by hardware circuits.

FIG. 25 is a block logic diagram showing an example priority decision function 302. In the example shown, there are three flight control computer capabilities that may be performed by different flight control computers 202. For example, a first flight control computer 202(1) may provide a first flight control computer capability 304(1), a second flight control computer 202(2) may provide a second flight control computer capability 304(2), and a third flight control computer 202(3) may provide a third flight control computer capability 304(3). In some embodiments, these three flight control computer capabilities 304(1), 304(2), 304(3), may be provided by the same flight control computer 202, or they may be provided by different flight control computers.

Priority calculators 306(1), 306(2), and 306(3) may determine and decide which flight control computer capability 304 has priority over which other flight control computer capability. For example, priority calculator 306(1) may receive as an input A the flight control computer capability 304(1) and as input B the flight control computer capability 304(2) (i.e., “FCC1 capability” and “FCC2 capability”), and in response, determine which flight control computer capability has priority. In the example shown, the first flight control computer capability FCC1 304(1) has priority higher than the second flight control computer capability FCC2 304(2). The priority calculator 306(1) thus provides an output 308(1) that gives the first flight control computer capability FCC1 304(1) a higher priority than the second flight control computer capability FCC2 304(2). For example, if both flight control computer capabilities FCC1 and FCC2 are present and active, the priority calculator 306(1) may act as a multiplexer to select the first flight control computer capability FCC1 (304(1)) instead of or over the second flight control computer capability FCC2 (304(2)). On the other hand, if the first flight control computer capability FCC1 is not present or active, then the priority calculator 306(1) may act as a multiplexer to select the second flight control computer capability FCC2 for output to 308(1). In this way, the priority calculator 306(1) prevents inconsistent control outputs or contradictory control outputs by selecting only one of its two flight control computer capabilities when both of the flight control computer capabilities FCC1, FCC2 are active and present.

FIG. 25 further shows a second priority calculator 306(2) that receives inputs from the second flight control computer capability FCC2 (304(2)) at an “A” input and a third flight control computer capability FCC3 (304(3)) at a “B” input. The priority calculator 306(2) gives a higher priority to the second flight control computer capability FCC2 (304(2)) then the third flight control computer capability FCC3 (304(3)) when both the second and third flight control computer capabilities are present and active.

FIG. 25 further shows a third priority calculator 306(3) connected to receive the first flight control computer capability FCC1 (304(1)) on its “A” input and the third flight control computer capability FCC3 (304(3)) on its “B” input. The third priority calculator 306(3) gives the first flight control computer capability FCC1 a priority higher than the third flight control computer capability FCC3 when both of these flight control computer capabilities are active and present, thereby preventing conflicting or contradictory results when or if the outputs of the different flight control computer capabilities are active.

While three flight control computer capabilities 304(1), 304(2), 304(3) are shown in FIG. 25, there may be any number of flight control computer capabilities (as indicated by the ellipses) and any number of priority calculators 306. Furthermore, the priority calculators 306 may accept any number of inputs and perform any of a variety of priority determining calculations, computations or logic functions in order to select one or the other of its inputs or even to combine inputs together or parts of inputs together in order to reflect a priority determination that avoids conflict and contradictory results.

For example, FIG. 26 shows a further logic function diagram that combines the priority decision outputs 308(1), 308(2), 308(3) using example boolean logic functions or circuits such as two-input AND, OR and NOT (inverter) (or in some cases NAND and NOR). In the example shown, if FCC1 priority higher than FCC2 priority is true and FCC1 priority higher than FCC3 priority is true, the FIG. 26 logic circuit determines that FCC1 has the highest priority at 310(1). On the other hand, if FCC2 priority higher than FCC3 priority is true and FCC1 priority higher than FCC2 priority is false, then the FIG. 26 logic circuit determines that FCC2 has the highest priority at 310(2). Furthermore, if FCC1 priority higher than FCC3 priority is not true and FCC2 priority higher than FCC3 priority is also not true, then the FIG. 26 logic circuit determines that FCC3 has the highest priority at 310(3).

FIG. 26 is just an example of the type of boolean or other logic functions that may be performed. Other logic and/or mathematical functions could be used as well as 3, 4 or 5 or more input gates. Furthermore, while the FIG. 26 logic may be implemented using conventional logic gates and logic circuits, it might also be implemented by a state machine, a software or firmware program, or any other desired implementation.

FIG. 27 shows a further example non-limiting logic diagram that determines second priorities 312. In this example, further logic circuitry added to the FIG. 26 logic circuitry uses additional NOT, AND and OR logic functions to determine which flight control computer capabilities have second priority. For example, if FCC1 with highest priority 310(1) is false, and FCC1 priority is higher than FCC3 priority or FCC1 priority is higher than FCC2 priority (308(3), 308(1)), then the FIG. 27 logic circuit determines that FCC1 has second priority 312(1). Similarly, if FCC2 priority higher than FCC3 priority is true and FCC1 priority higher than FCC2 priority is also true OR FCC1 priority higher than FCC2 priority is not true and FCC2 priority higher than FCC3 priority is also not true, then the FIG. 27 logic circuit determines that FCC2 has second priority 312(2). Similarly, if FCC3 with highest priority is not true and either FCC1 priority higher than FCC3 priority is not true or FCC2 priority higher than FCC3 priority is not true, then FCC3 is declared to have second priority 312(3).

Dual Lane Flight Control Computer

Dual lane flight control computers 202 are discussed above. FIG. 28 shows an example block diagram of a non-limiting dual lane flight control computer 400 architecture. In the example shown, a COM (command) lane command is generated (block 402) and is CRC-encoded (block 404) to protect the command from errors and transmission. The CRC-encoded command is provided to a further block for enabling/disabling the command (block 410). A feedback loop at the output of CRC-encoding block 404 decodes the encoded command (block 406), and a MON (monitor) lane computation and comparison 408 analyzes the command for effect and provides feedback input to the enabling/disabling block 410. If the monitor lane computation and comparison 408 detects that the command is harmful or otherwise should not be performed, block 410 can disable the command instead of sending it to a consumer such as an actuator for an effector. FIG. 28 further shows that at a consumer, a first block 412 decodes the command using the CRC and checks the command for freshness and validity. The freshness check may be performed in a variety of ways including, for example, by including sequence numbers and/or time stamps in each command. If the command is determined to be fresh and valid, then the command (block 414) may be passed along to an actuator for an effector. In addition, the block 412 may update a state in a memory or other store with respect to command freshness and validity (block 416) so that further received commands can be checked to ensure they are not out of sequence or out of time.

FIG. 29 is an additional block diagram showing an example non-limiting command processor that receives three commands from the FIG. 28 circuit: FCCx with highest priority (block 502), FCCy with second priority (block 506), and FCCz (which is the lowest priority). The FIG. 29 circuit also receives the confirmation in each case from the command freshness and validity state or store 416 of FIG. 28 indicating that the respective command is fresh and valid (block 504, 508, 510). FIG. 29 shows that if the FCCx command with highest priority is received and it is fresh and valid, AND decision 512 will determine to use that command (block 522). If, however, the above is false (as indicated by NOT inverter 514) AND the FCCy command with second priority is both received and is fresh and valid (as tested for by the AND gate 516), then the FCCy command will be used (block 524). Alternatively, if both of the above are not true (in this case, AND gates 512, 516, 520 are cascaded with respective inverters 514, 518 to provide essentially a NAND type circuit that produces a TRUE only when FCCx with highest priority and FCCx command fresh and valid is not true and FCCy with second priority and FCCy command fresh and valid is not true but the FCCz command fresh and valid is true, then the FIG. 29 circuit determines to use the fresh and valid command FCCz (block 526). Alternatively if the above is not true (as tested for by inverter 530) such that FCCz is not fresh and valid either, the FIG. 29 circuit does not use any of the inputs but instead performs a default action (block 528) which in some instances might be to do nothing.

FIG. 30 shows an additional block diagram circuit including an RTX voter decision. In this case, an FCC1 command 602 and FCC2 command 604 and an FCC3 command 606 are voted on by a voter 608 and the “voted command” result of the voting 610 is used to control an actuator and/or effector. Voting may be performed based on a variety of different known voting functions that can be based on magnitude, duration, particular values, priorities, etc. as is well known to those skilled in the art.

Non-Limiting Description/Statement of Additional Combinations of Features of Various Embodiments

- 1. A first Flight Control system configuration, and the method to obtain such first configuration, having controllers of effector actuation means able to receive commands directly from at least three Flight Control Computers (FCCs).
  - 1.1. The configuration according to 1, wherein each of the three FCCs is directly linked to each of the controllers, being only one FCC active at a time.
    - 1.1.1. Each FCC of 1.1 having a command lane to send commands to the controllers and a monitor lane to check command integrity.
    - 1.1.2. Two of the three FCCs of 1.1 being of the same part number and one of the three FCCs being of a backup of dissimilar part number.
    - 1.1.3. Alternatively to 1.1.2, the three FCCs being of the same part number to reduce complexity of the solution.
    - 1.1.4. Each of the three FCCs of 1.1 being connected to some or to all of independent sensors located on the surfaces, propellers and or mechanisms of the effectors.
    - 1.1.5. Alternatively to 1.1.4, each of the three FCCs of 1.1 receiving sensor information from at least one Sensor interface module (SIM).
      - 1.1.5.1. Each sensor interface module having a single lane to read at least one of independent sensors located on the surfaces, propellers and or mechanisms of the effectors.
    - 1.1.6. At least one of the three FCCs of 1.1 receiving instructions from at least one Avionics computer
      - 1.1.6.1. The Avionics computer(s) of 1.1.6 being responsible to send high level instructions to the FCCs, including at least one of the following: navigation commands, Autonomous commands, commands from a remote controller, commands from a touch screen display.
    - 1.1.7. Alternatively or in conjunction with 1.1.6, each of the three FCCs of 1.1 being connected to flight deck inceptors.
      - 1.1.7.1. Where each FCC is directly connected to at least one sensor of each axis of control of flight deck inceptors.
      - 1.1.7.2. Alternatively or in conjunction with 1.1.7.1, each of the three FCCs of 1.1 receiving sensor information from at least one sensor interface module (SIM)
      - 1.1.7.2.1. Each sensor interface module having a single lane to read at least one sensor of each axis of control of the flight deck inceptors.
    - 1.1.8. Each FCC exchanging, with the other FCCs, part or all of its processed information and/or the information received from other components which include at least one of the following: the flight deck inceptors and/or effector sensors, as well as mode and state information, among other information, to allow data voting and mode coordination among the FCCs.
  - 1.2. The effector actuation means of 1.1 classified in: surface actuators, tilt mechanism actuators, and propeller electric motors.
    - 1.2.1. The controllers of surface actuators and tilt mechanisms of 1.2 having a single lane that receives the commands from the FCCs and executes the command from the active FCC if the command is considered fresh and valid by the actuator, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.
      - 1.2.1.1. The surface actuators and tilt mechanisms of 1.2 receiving each a link from the FCCs that enables or disables each actuator based on high integrity criteria implemented at the FCCs.
      - 1.2.1.2. Alternatively to 1.2.1.1, each surface actuator and tilt mechanism of 1.2 being energized/de-energized by a relay commanded by the FCCs.
    - 1.2.2. The controllers of propeller electric motors of 1.2 having a single lane that receives the commands from the FCCs and executes the command from the active FCC if the command is considered fresh and valid by the controller, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.
      - 1.2.2.1. The propeller electric motors controllers of 1.2 receiving each a link from the FCCs that enables or disables each motor based on criteria implemented at the FCCs.
      - 1.2.2.2. Alternatively to 1.2.2.1, each propeller electric motor controller of 1.2 being energized/de-energized by a contactor commanded by the FCCs.
    - 1.2.3. Alternatively to 1.2.2, the controllers of propeller electric motors of 1.2 having a control lane and a monitor lane that receive the commands from the FCCs and execute the command from the active FCC if the command is considered fresh and valid by the controller, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.
- 2. A second Flight Control system configuration, and the method to obtain such second configuration, having retransmitters (RTX) that receive commands from the three FCCs and then retransmit to the controllers of effector actuation means.
  - 2.1. Where the term RTX may refer to many different types of units depending on which function they perform such as voting, source selection, etc. Some examples are Remote Electronic Unit (REU), Remote Data Concentrator (RDC), Inceptor Interface Module (IIM), Input Output Module (IOM), etc.
    - 2.1.1. Where at least one RTX receive commands from each of the three FCCs.
      - 2.1.1.1. Where at least one RTX receives the commands from the FCCs and retransmits the command from the active FCC if the command is considered fresh and valid by the actuator, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.
      - 2.1.1.2. Alternatively to or in conjunction with 2.1.1.1, at least one RTX receives the commands from the three FCCs and retransmits all of them.
      - 2.1.1.3. Alternatively to or in conjunction with 2.1.1.1 and/or 2.1.1.2, at least one RTX receive commands from each of the three FCCs and vote the commands for retransmitting a voted value.
    - 2.1.2. Alternatively, some of the RTXs are also FCCs, reducing the number of LRUs.
  - 2.2. The configuration according to 2, wherein each of the three FCCs is indirectly linked to each of the controller of effector actuation means.
    - 2.2.1. At least one FCC of 2.2 having a command lane to process and send commands to the controllers and a monitor lane to check command integrity.
    - 2.2.2. Alternatively to or in conjunction with 2.2.1, at least one FCC of 2.2 having a single lane to process and send commands to the controllers.
    - 2.2.3. Each of the three FCCs of 2.2 being of dissimilar part numbers.
    - 2.2.4. Alternatively to 2.2.3, the three FCCs being of the same part number to reduce complexity of the solution.
    - 2.2.5. Each of the three FCCs of 2.2 being connected to some or to all of independent sensors located on the surfaces, propellers and or mechanisms of the effectors.
    - 2.2.6. Alternatively to or in conjunction with 2.2.5, each of the three FCCs of 2.2 receiving sensor information from at least one Sensor interface module (SIM).
      - 2.2.6.1. Each sensor interface module having a single lane to read at least one of independent sensors located on the surfaces, propellers and or mechanisms of the effectors.
    - 2.2.7. At least one of the three FCCs of 2.2 receiving instructions from at least one Avionics computer
      - 2.2.7.1. The Avionics computer(s) of 1.1.6 being responsible to send high level instructions to the FCCs, including at least one of the following: navigation commands, Autonomous commands, commands from a remote controller, commands from a touch screen display.
    - 2.2.8. Alternatively or in conjunction with 2.2.7, each of the three FCCs of 2.2 being connected to flight deck inceptors.
      - 2.2.8.1. Where each FCC is directly connected to at least one sensor of each axis of control of flight deck inceptors.
      - 2.2.8.2. Alternatively or in conjunction with 2.2.8.1, each of the three FCCs of 2.2 receiving sensor information from at least one sensor interface module (SIM)
      - 2.2.8.2.1. Each sensor interface module having a single lane to read at least one sensor of each axis of control of the flight deck inceptors.
    - 2.2.9. Each FCC exchanging, with the other FCCs, part or all of its processed information and/or the information received from other components which include at least one of the following: the flight deck inceptors and/or effector sensors, as well as mode and state information, among other information, to allow data voting and mode coordination among the FCCs.
  - 2.3. At the configuration of 2, each controller of effector actuation mean receives command from at least two RTXs.
    - 2.3.1. The controllers of surface actuators and tilt mechanisms of 2.3 having a single lane that receives the commands from the RTXs and executes the source with highest priority if the command is considered fresh and valid by the controller, otherwise switching to the other(s) source(s) with highest priority if fresh and valid.
      - 2.3.1.1. The surface actuators and tilt mechanisms of 2.3 receiving at least a link from the RTXs that enables or disables each controller based on high integrity criteria implemented at the RTXs.
      - 2.3.1.2. Alternatively or in conjunction with 2.3.1.1, the surface actuators and tilt mechanisms of 2.3 receiving at least a link from the FCCs that enables or disables each controller based on high integrity criteria implemented at the FCCs.
      - 2.3.1.3. Alternatively or in conjunction with 2.3.1.1 and 2.3.1.2, each surface actuator and tilt mechanism of 2.3 being energized/de-energized by a relay commanded by the RTXs.
    - 2.3.2. The controllers of propeller electric motors of 2.3 having a single lane that receives the commands from the RTXs and executes the command from the source with highest priority if the command is considered fresh and valid by the controller, otherwise switching to the other(s) source(s) with highest priority if fresh and valid.
      - 2.3.2.1. The propeller electric motors controllers of 2.3 receiving at least a link from the RTXs that enables or disables each motor based on criteria implemented at the RTXs.
      - 2.3.2.2. Alternatively or in conjunction with 2.3.2.1, the controllers of propeller electric motors of 2.3 receiving at least a link from the FCCs that enables or disables each controller based on high integrity criteria implemented at the FCCs.
      - 2.3.2.3. Alternatively or in conjunction with 2.3.2.1 and 2.3.2.2, each propeller electric motor controller of 2.3 being energized/de-energized by a contactor commanded by the RTXs.
    - 2.3.3. Alternatively to or in conjunction with 2.3.2, 2.3.2.1, 2.3.2.2, the controllers of propeller electric motors of 2.3 having a control lane and a monitor lane that receive the commands and execute the command with highest priority if the command is considered fresh and valid by the controller, otherwise switching to the other(s) source(s) with highest priority if fresh and valid.
  - 2.4. The method to obtain the architecture with the minimum number of RTXs of 2 is determined using either the theory of complete graphs or bipartite graphs depending on whether one or more types of RTXs are used in the architecture.
    - 2.4.1. The minimum number of RTXs of 2, if all RTXs are all of the same type, is determined by the theory of complete graphs.
    - 2.4.2. The minimum number of RTXs of 2, if two different types of RTXs are used, is determined by the theory of bipartite graphs.
    - 2.4.3. In the configuration of 2.4.1, the architecture with minimum number of RTXs is determined by the maximum number of controllers of the same category.
      - 2.4.3.1. The controllers of 2.4.3 may be grouped in categories which may be, for example, the category of surface actuators, the category of motor controllers, or any other meaningful category.
      - 2.4.3.2. At 2.4.3, if E is the maximum number of controllers of the category with greater number of elements, then, if n is the minimum number of RTXs, according to the theory of complete graphs, it can be determined by finding the value of n that results in the minimum value of K such that K is greater or equal to E, where K=n*(n−1)/2.
    - 2.4.4. In the configuration of 2.4.2, the architecture with minimum number of RTXs is also determined by the maximum number of controllers of the same category.
      - 2.4.4.1. At 2.4.4, if E is the maximum number of controllers of the category with greater number of elements, then, if m is the minimum number of RTXs of a first type and n is the minimum number of RTXs of a second type, according to the theory of bipartite graphs, the values of m and n can be determined by finding any combination in which the values of m and n result in the minimum value of K such that K is greater than or equal to E, where it is given by K_m,n=m*n. In this case, more than one solution is possible and therefore it can be used more or less RTXs of a first type depending on the number of RTXs of the second type.
- 3. A third Flight Control system configuration, and the method to obtain such third configuration, is a hybrid configuration.
  - 3.1. In the hybrid configuration of 3, the controllers of propeller electric motors receive commands directly from at least three Flight Control Computers (FCCs).
    - 3.1.1. The configuration according to 3.1, wherein each of the three FCCs is directly linked to at least one of the controllers of propeller electric motors, being only one FCC active at a time.
      - 3.1.1.1. All the sub-items of 1.1 are similarly applicable to 3.1.1, but are not repeated here for simplicity.
      - 3.1.1.2. The controller(s) of propeller electric motor(s) of 3.1.1 having a single lane that receives the commands from the FCCs and executes the command from the active FCC if the command is considered fresh and valid by the actuator, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.
      - 3.1.1.2.1. The controller(s) of propeller electric motor(s) of 3.1.1.2 receiving each a link from the FCCs that enables or disables each motor based on criteria implemented at the FCCs.
      - 3.1.1.2.2. Alternatively to 3.1.1.2.1, each propeller electric motor controller of 3.1.1.2 being energized/de-energized by a contactor commanded by the FCCs.
      - 3.1.1.3. Alternatively to 3.1.1.2, the controller(s) of propeller electric motor(s) of 3.1.1 having
      - 3.1.1.3.1. a control lane that receive the commands from the FCCs and execute the command from the active FCC if the command is considered fresh and valid by the controller, otherwise switching to the second FCC with highest priority if fresh and valid, otherwise switching to the last FCC.
      - 3.1.1.3.2. a monitor lane that forces safe state of the respective controller of propeller electric motor in case of misbehavior of the control lane.
  - 3.2. The hybrid configuration of 3 having retransmitters (RTX) that receive commands from the three FCCs and then retransmit to the remaining controllers of effector actuation means not mentioned at 3.1.
    - 3.2.1. At the configuration of 3.2, each remaining controller receives command from at least two RTXs.
    - 3.2.2. The method to obtain the architecture with the minimum number of RTXs of 3.2 is determined using either the theory of complete graphs or bipartite graphs depending on whether one or more types of RTXs are used in the architecture.
      - 3.2.2.1. All the sub-items of 2.4 are similarly applicable to 3.2.2, but are not repeated here for simplicity.
    - 3.2.3. Alternatively, some of the RTXs are also FCCs, reducing the number of LRUs.

A further non-limiting aspect may provide a first Flight Control system comprising:

- at least three Flight Control Computers (FCCs); and
- controllers of effector actuators configured to receive commands directly from the at least three FCCs.

In this system, each of the three FCCs is directly linked to each of the controllers, being only one FCC active at a time to control the controllers.

In this system, the FCCs each comprise a command lane to send commands to the controllers and a monitor lane to check command integrity.

In this system, plural of the at least three FCCs are of the same part number and one of the at least three FCCs is a backup and has a dissimilar part number.

In this system, the at least three FCCs are of the same part number to reduce complexity.

In this system, each of the at least three FCCs is connected to some or to all of independent sensors located on surfaces, propellers and or mechanisms of effectors; or each of the at least three FCCs is configured to receive sensor information from at least one Sensor interface module (SIM); or the at least one sensor interface module comprises a single lane configured to read at least one of independent sensors located on surfaces, propellers and/or mechanisms of effectors.

In this system, at least one of the at least three FCCs is configured to receive instructions from at least one Avionics computer.

In this system, the at least one Avionics computer is configured to be responsible to send high level instructions to the FCCs, including at least one of the following: navigation commands, Autonomous commands, commands from a remote controller, and commands from a touch screen display.

In this system, each of the at least three FCCs is connected to flight deck inceptors.

In this system, each FCC is directly connected to at least one sensor of each axis of control of the flight deck inceptors.

In this system, each of the at least three FCCs are configured to receive sensor information from at least one sensor interface module (SIM).

In this system, the sensor interface module comprises a single lane to read at least one sensor of each axis of control of the flight deck inceptors.

In this system, each FCC is configured to exchange, with the other FCCs, part or all of processed information and/or the information received from other components which include at least one of the following: flight deck inceptors and/or effector sensors, as well as mode and state information, among other information, to allow data voting and mode coordination among the FCCs.

In this system, the effector actuator is classified in: surface actuators, tilt mechanism actuators, and propeller electric motors.

In this system, a controller of the surface actuators and tilt mechanisms comprise a single lane that receives the commands from the FCCs and executes the command from the active FCC if the command is considered fresh and valid by the actuator, and otherwise switches to a second FCC with highest priority if fresh and valid, and otherwise switches to a last FCC.

In this system, the surface actuators and tilt mechanisms are configured to each receive a link from the FCCs that enables or disables each actuator based on high integrity criteria implemented at the FCCs.

In this system, each surface actuator and tilt mechanism is configured to be energized/de-energized by a relay commanded by the FCCs.

This system may further include controllers of propeller electric motors comprising a single lane that receives the commands from the FCCs and executes the command from an active FCC if the command is considered fresh and valid by the controller, otherwise switching to a second FCC a highest priority if fresh and valid, and otherwise switching to a last FCC.

In this system, the controllers of propeller electric motors are configured to each receive a link from the FCCs that enables or disables each propeller electric motor based on high integrity criteria implemented at the FCCs.

In this system, each controller of propeller electric motor is configured to be energized/de-energized by a contactor commanded by the FCCs.

In another non-limiting aspect, a second Flight Control system may comprise:

- at least three Flight Control Computers (FCCs); and
- retransmitters (RTX); and
- controllers of effector actuators configured to receive commands from the at least one retransmitter.

In this system, at least on RTX receive commands from each of the three FCCs, being only one FCC active at a time to control the controllers.

In this system, the FCCs each comprise a command lane to send commands to the controllers and a monitor lane to check command integrity.

In this system, plural of the at least three FCCs are of the same part number and one of the at least three FCCs is a backup and has a dissimilar part number.

In this system, the at least three FCCs are of the same part number to reduce complexity.

In this system, each of the at least three FCCs is connected to some or to all of independent sensors located on surfaces, propellers and or mechanisms of effectors.

In this system, each of the at least three FCCs is configured to receive sensor information from at least one Sensor interface module (SIM); or the at least one sensor interface module comprises a single lane configured to read at least one of independent sensors located on surfaces, propellers and/or mechanisms of effectors; or at least one of the at least three FCCs is configured to receive instructions from at least one Avionics computer.

In this system, each of the at least three FCCs is connected to flight deck inceptors.

In this system, each FCC is directly connected to at least one sensor of each axis of control of the flight deck inceptors.

In this system, each of the at least three FCCs are configured to receive sensor information from at least one sensor interface module (SIM).

In this system, the sensor interface module comprises a single lane to read at least one sensor of each axis of control of the flight deck inceptors.