Redundant System

Abstract

This disclosure shows several forms of multiple channel redundant signal transmission systems which are capable of continued operation in spite of failures of individual transmission elements or channel elements. The redundancy is applied to a multiple channel system as a whole, rather than to individual channels. For example, one additional channel may be used as a redundant backup for two, three or more individual channels to provide continued operation of all channels in spite of a failure in any single channel including the additional channel. The approach is believed to offer significant economics over the more conventional approach of providing separate redundant or backup channels for each individual signal channel.

Parent Case Text

This application is a continuation of my copending application Ser. No. 466,928, filed June 25, 1965 for Redundant System, now abandoned.

Description

This invention relates to redundant systems which achieve high reliability through the duplication and/or paralleling of functions, subsystems and/or components within a system. More particularly, it relates to methods and means whereby the reliability advantages of redundancy may be realized with less paralleling and less equipment than would be required with conventional redundancy techniques.

It is often important to provide system reliabilities which are higher than the probable reliabilities of certain components or subsystems within the system. For example, the reliable operation of radio communication, instrumentation, and flight control systems is of obvious extreme importance for the safety of an aircraft or space vehicle and its crew. Malfunctions of industrial process control systems may cause economic losses far in excess of the value of the process control equipment.

Redundant systems achieve high reliability by duplicating or paralleling transmission channels, components, subsystems and/or functions of a system. In the event of failure of a particular section of the system, the functions of that section are performed at least in part by parallel or duplicate sections of the system. Because of this duplicating and/or paralleling, redundant systems will normally require a larger number of components than corresponding nonredundant systems.

Multiengine aircraft and the use of several radio sets at a communication center are familiar examples of the use of redundancy to achieve high reliability. Most multiengine aircraft can remain in flight after losing power from one or more engines. Communication through a center with several radio sets may be delayed but will not be entirely cut off by failure of an individual radio set. However, in these two examples, there is the implied assumption that a human operator will notice a malfunction and take appropriate corrective action. In the multiengine aircraft case, it is generally necessary to feather the dead propeller or otherwise shut down a dead engine. In the radio communications center example, the operator notices the malfunction and thereafter routes all messages through the functioning equipment. The present invention is concerned primarily with systems which compensate or adapt for internal failures without external monitoring and/or correction.

Before going further, it is convenient to define two types of failures, namely, zero-output and worst-case-type failures. In a zero-output-type failure an amplifier, motor, or other component or subsystem fails in such a manner that its output is some small value equal to or near zero. The zero output might be zero voltage, zero current, zero torque or zero motion, depending upon the particular device. Reliable operation in the presence of a zero-output-type failure may normally be achieved through the use of one additional duplicate or parallel channel. For example, various types of electromechanical servosystems have been built which employ two essentially duplicate parallel channels. A zero-output-type failure of one channel does not disable the entire system, as the necessary forces and motions are provided by the remaining channel. Thus, system reliability in the presence of possible zero-output-type failures may be achieved at the penalty of approximately doubling the complexity of the system.

In a worst-case-type failure, the output from a malfunctioning amplifier, motor or other system element may have any possible value including a maximum amplitude signal of opposite polarity from that of the desired signal. The simple duplication of channels, components, subsystems or functions does not provide reliable operation in the presence of worst-case-type failures. For example, in the case of an electromechanical servosystem, one channel may fail so as to generate a maximum negative force. A parallel channel providing a maximum positive force may reduce the sum or average of the two output signals to zero, but will be unable to generate a net output signal of positive value. Several forms of triple redundant systems have been developed to provide reliability in the presence of possible worst-case-type failures. In one form of redundant feedback control system, the system output is taken as a sum or average of the outputs of three similar parallel subsystems. In the event of a worst-case-type failure of one channel, the remaining two channels can compensate for the erroneous output of the malfunctioning channel and still provide a correct output signal of either polarity over a limited range. An alternate approach is to use two channels plus a monitor to transfer control from one channel to the other. If either channel malfunctions, the monitor will transfer control to the other channel. If the monitor should malfunction, the system will continue to operate, as it will make no difference which of the two properly functioning channels is selected. If the monitor is assumed to have a complexity comparable to that of one channel, the monitor system is comparable in complexity to a triple redundant system. Thus, reliability in the presence of possible worst-case-type failures may be achieved at the penalty of approximately tripling the complexity of the system.

An object of this invention is to provide methods and means for the design, construction, and operation of redundant systems incorporating parallel transmission paths so that failures or malfunctions of individual transmission channels, components, subsystems and/or system functions will not entirely disable the system. A further object is to allow the design, construction, and operation of such redundant systems with a lesser penalty of additional parallel or duplicate equipment than required with conventional techniques.

In a particular form of the present invention, a redundant system of three amplifiers is arranged for the amplification of two independent voltage signals. A first amplifier drives a first output terminal so that its voltage tends to correspond to a first input voltage; a second amplifier drives a second output terminal so that its voltage tends to correspond to a second input voltage; and a third amplifier drives both the first and second output terminals so that the average of their voltages tends to correspond to the average of the two input voltages. Such a redundant system will continue to operate and amplify both voltage signals in spite of a zero-output-type failure of any one of the three amplifiers.

This system is illustrated in FIG. 1 of the drawings and will be subsequently described in greater detail.

In the drawings:

FIG. 1 is a schematic illustration of a first form of the invention in which a redundant system of three feedback amplifiers is arranged for the amplification of two independent voltage signals in spite of a zero-output-type failure of any one amplifier;

FIG. 2 is a schematic illustration of a second form of the invention generally resembling the system of FIG. 1 but showing a system in which the individual system signal transmission channels are of distinctly different dynamic characteristics;

FIG. 3 is a schematic illustration of a third form of the invention in which a redundant system of six feedback amplifiers is arranged for the amplification of three independent voltage signals in spite of a worst-case-type failure of any one amplifier;

FIG. 4 is a diagram illustrating a fourth form of the invention arranged for the transmission of two independent mechanical signals in spite of a disconnection of any one mechanical transmission link;

FIG. 5 is a pictorial and schematic illustration of a fifth form of the invention arranged for the damping of pitch and yaw motions of an aircraft in spite of a zero-output-type failure of any one component or subsystem; and

FIG. 6 is a schematic illustration of a sixth form of the invention arranged for the accurate conversion of electrical signals from analog into digital form in spite of a worst-case-type failure of any one converter or other circuit element.

Referring now to the drawings, FIG. 1 includes operational amplifiers 11, 12 and 13. The term "operational amplifier " is used in this specification to describe amplifiers which have a large negative gain. The frequency response may or may not extend down to and include zero frequency DC. Such amplifiers are well known and in use in applications such as analog computing, simulation and control. They are referred to as operational amplifiers because they may perform operations such as addition, subtraction, integration and differentiation when suitable passive impedances are connected into their input, output and/or feedback paths. The output of amplifier 11 on line 14 connects through resistor 15 and line 16 to output terminal 17. Voltmeter 18 is connected between output terminal 17 and ground 19. Input terminal 20 connects through resistor 21 and line 22 to the input of amplifier 11. Resistor 23 connects from line 16 to line 22. Similarly, the output of amplifier 13 on line 24 connects through resistor 25 and line 26 to output terminal 27. Voltmeter 28 is connected between output terminal 27 and ground 29. Input terminal 30 connects through resistor 31 and line 32 to the input of amplifier 13. Resistor 33 connects from line 26 to line 32. The output of amplifier 12 on line 34 connects through resistor 35 and line 36 to line 16 and output terminal 17. The output of amplifier 12 also connects from line 34 through resistor 37 and line 38 to line 26 and output terminal 27. Resistor 39 connects from input terminal 20 to line 40 and the input of amplifier 12. Resistor 41 connects from input terminal 30 to line 40. Resistor 42 connects from line 36 to line 40, and resistor 43 connects from line 38 to line 40. Arm 44 of three-position, rotary switch 45 connects to a first end of potentiometer 46, the second end of which connects to ground 47. The variable arm of potentiometer 46 connects to input terminal 20. The three stationary contacts of switch 45 are identified as contacts 48, 49 and 50. Similarly, arm 51 of three-position, rotary switch 52 connects to a first side of potentiometer 53, the second side of which connects to ground 54. The variable arm of potentiometer 53 connects to input terminal 30. The three stationary contacts of switch 52 are identified as contacts 55, 56 and 57. Line 58 connects from contacts 48 and 55 to the positive side of battery 59. The negative side of battery 59 connects to ground 60 and to the positive side of battery 61. The negative side of battery 61 connects through line 62 to contacts 50 and 57.

The circuit of FIG. 1 is essentially that of a model which was constructed to demonstrate a first form of the invention. The voltage sources and voltmeters shown in FIG. 1 represent the voltage sources and voltage-measuring devices used in the model. It is evident that a wide variety of signal sources and/or load devices may be used with such systems. In the model, rectifier-type power supplies were used in place of batteries 59 and 61 to furnish positive and negative voltages of essentially 25 volts' magnitude. By manipulation of switches 45 and 52 and potentiometers 46 and 53, the voltages on input terminals 20 and 30 could be independently adjusted to any desired values not exceeding 25 volts in magnitude. Amplifiers 11, 12 and 13 were high-gain inverting amplifiers of the type used in analog computing and simulation circuits, and were capable of providing output voltages of either polarity and of magnitudes up to slightly more than 100 volts. Resistors 21, 31, 39, and 41 were each 1 megohm; resistors 15, 25, 35 and 37 were each 100,000 ohms; and resistors 23, 33, 42, and 43 were each 1 megohm.

In examining the operation of the circuit of FIG. 1 let us first ignore amplifier 12 and its associated circuit elements. A positive voltage on input terminal 20 will tend to drive the voltage on line 22 in a positive direction. A positive signal on line 22 will cause amplifier 11 to generate a large negative voltage on line 14, thereby transmitting a negative signal to line 16 and output terminal 17. The negative signal on line 16 will be fed back through resistor 23 thereby reducing the positive voltage on line 22. Operational amplifiers typically have gains of the order of several thousand or higher. Hence, we may assume that the voltage on line 22 remains essentially zero while the output voltage of amplifier 11 on line 14 varies through its full range. The result will be that line 16 and output terminal 17 will be driven by amplifier 11 so that the voltage on terminal 17 is of equal magnitude but opposite polarity to the voltage on terminal 20. If resistors 21 and 23 were not equal, the magnitudes of the voltages on terminals 20 and 17 would be of a different ratio. Again neglecting the presence of amplifier 12 and its associated circuit elements, amplifier 13 will similarly tend to drive output terminal 27 to a voltage which is of equal magnitude but opposite polarity to the voltage on input terminal 30.

Now let us consider the effect of amplifier 12 and its associated circuit elements. The input to amplifier 12 through resistors 39 and 41 will be essentially an average of the voltages on input terminals 20 and 30. The output of amplifier 12 is connected equally to both of output terminals 17 and 27. The feedback connections through resistors 42 and 43 supply a feedback signal which is essentially an average of the voltages on terminals 17 and 27. Hence, amplifier 12 will operate as a feedback amplifier which tends to drive output terminals 17 and 27 so that the average of their voltages is of equal magnitude but opposite polarity to the average of the voltages on input terminals 20 and 30.

With all three of amplifiers 11, 12 and 13 operating, the effect of an individual amplifier may be viewed as tending to drive one or more output terminals so as to achieve a particular condition. Amplifier 11 tends to drive output terminal 17 so that its voltage is equal and opposite to the voltage on terminal 20. Amplifier 13 tends to drive terminal 27 so that its voltage is equal and opposite to the voltage on terminal 30. Amplifier 12 tends to drive both terminals 17 and 27 so that the average of their voltages is equal and opposite to the average of the voltages on terminals 20 and 30. Since these three conditions are consistent, the overall result of the operation of all three amplifiers will be to maintain an equal magnitude but opposite polarity relationship between the voltages on terminals 17 and 20, and between the voltages on terminals 27 and 30.

Now let us consider a zero-output-type failure of one of the amplifiers of FIG. 1. A zero-output-type failure of amplifier 12 will leave amplifiers 11 and 13 functioning properly. Under these conditions amplifier 11 will drive output terminal 17 to the proper voltage, and amplifier 13 will drive output terminal 27 to the proper voltage. Hence, the system of FIG. 1 will continue to function in spite of a zero-output-type failure of amplifier 12. With a zero-output-type failure of amplifier 13, amplifier 11 will drive output terminal 17 to the proper voltage. Amplifier 12 will drive output terminals 17 and 27 so that their average voltage is of the proper value. Since both the voltage on terminal 17 and the average of the voltages on terminals 17 and 27 will be of the proper value, it follows that the voltage on terminal 27 must be of the proper value. Hence, the system of FIG. 1 will continue to function in spite of a zero-output-type failure of amplifier 13. Because of the circuit symmetry the same reasoning may be used to show that the system will continue to function in spite of a zero-output-type failure of amplifier 11.

Thus, the system of FIG. 1 is capable of continued proper operation in spite of a zero-output-type failure of any one of amplifiers 11, 12 and 13. A more conventional approach to redundancy for reliable operation in the presence of zero-output-type failures would have required two amplifiers per individual voltage signal or a total of four amplifiers. An advantage of the system shown in FIG. 1 is that it achieves the same kind of immunity to zero-output-type amplifier failures with only three amplifiers. To generalize these statements, conventional paralleling or duplication redundancy requires a minimum of 2N subsystems or signal transmission paths for immunity to zero-output-type failures, where N is the number of independent signals. A system such as that shown in FIG. 1 requires a minimum of N+1 subsystems or signal transmission paths. For a single channel system, 2N is equal to N+1 and there is no particular advantage in the method shown in FIG. 1. However, for the control or transmission of two or more independent signals, techniques such as those shown in FIG. 1 may offer significant economies and other advantages.

It may be noted that in redundant systems such as the system of FIG. 1, a particular combination of system output voltages does not imply a unique combination of individual amplifier output voltages. For example, in the circuit of FIG. 1, zero output voltages on terminals 17 and 27 would result form zero amplifier output voltages on lines 14, 24 and 34. However, amplifier outputs of +10 volts on lines 14 and 24, and -10 volts on line 34, would also result in zero system output voltages on terminals 17 and 27. Hence, the combination of amplifier output voltages required to generate a particular combination of system output voltages is by no means unique. A similar indeterminacy exists for other output voltage combinations and for other redundant systems such as those described subsequently in this specification.

Reference is now made to FIG. 2 which is a schematic illustration of a second form of the invention arranged for the redundant amplification of three independent voltage signals and providing distinctly different dynamic characteristics in the three individual channels. FIG. 2 includes operational amplifiers 71, 72, 73 and 74. Input terminal 75 connects through resistor 76 to line 77 and the input of amplifier 71. The output of amplifier 71 on line 78 connects through resistor 79 and line 80 to output terminal 81. Resistor 82 connects from line 80 to line 77. Input terminal 83 connects through resistor 84 to line 85 and the input of amplifier 72. The output of amplifier 72 on line 86 connects through resistor 87 and line 88 to output terminal 89. Resistor 90 connects from line 88 to line 85. Input terminal 91 connects through resistor 92 to line 93 and the input of amplifier 73. The output of amplifier 73 on line 94 connects through resistor 95 and line 96 to output terminal 97. Resistor 98 and capacitor 99 connect in parallel from line 96 to line 93. Resistor 100 connects from input terminal 75 to line 103 and the input of amplifier 74. Similarly, resistor 101 connects from input terminal 83 to line 103, and resistor 102 connects from input terminal 91 to line 103. The output of amplifier 74 on line 104 connects through resistor 105 and line 108 to line 80 and output terminal 81. Line 104 similarly connects through resistor 106 and line 109 to line 88 and output terminal 89, and through resistor 107 and line 110 to line 96 and output terminal 97. Resistors 111 and 112 connect from line 108 and 109 respectively, to line 103. Resistor 113 and capacitor 114 connect in parallel from line 110 to line 103.

The system of FIG. 2 generally resembles the system of FIG. 1 except for the addition of a third channel of different dynamic characteristics. For convenience, voltage sources and load circuits such as shown in FIG. 1 are not specifically shown in FIG. 2. In an experimental model of the system of FIG. 2, resistors 76, 84, 92, 100, 101, and 102 were of 1 megohm each; resistors 82, 90, 98, 111, 112 and 113 were of 1 megohm each; and resistors 79, 87, 95, 105, 106 and 107 were of 100,000 ohms each. Capacitors 99 and 114 were 1.0 microfarad each.

If we assume that the response time of amplifiers 71, 72, 73 and 74 is short with respect to the rate of variation of the input signals, the output voltages on terminals 81 and 89 will follow the input voltages on terminals 75 and 83 with no significant time lag. However, the feedback path around amplifier 73 is such as to give that channel distinctly different dynamic characteristics. Amplifier 73 will tend to drive line 96 and output terminal 97 such that the amplifier input voltage on line 93 remains at a small value. Since operational amplifiers are normally high-input-impedance devices, this implies that the sum of the currents flowing into line 93 through resistors 92 and 98 and capacitor 99 must be essentially zero. The current through resistor 92 will be proportional to the input voltage on terminal 91. The total feedback current will be a sum of a feedback current through resistor 98 proportional to the voltage on line 96 and a current through capacitor 99 proportional to the time rate of change of the voltage on line 96. Thus, the equilibrium voltage on line 96 plus a quantity proportional to its rate of change will be of equal magnitude and opposite polarity to the input voltage on terminal 91. The response of the voltage on terminal 97 to a step change in the voltage on terminal 91 will be an exponential function of time which will approach a limiting value of equal magnitude and opposite polarity to the voltage on terminal 91. With the values stated for the experimental model, the time constant of this exponential function will be 1 second.

When the system of FIG. 2 is placed in operation, amplifier 71 will tend to drive output terminal 81 to a voltage equal to and opposite the voltage on terminal 75. Amplifier 72 will similarly tend to drive output terminal 89 to a voltage equal to and opposite the voltage on input terminal 83. Amplifier 73 will tend to drive the voltage on output terminal 97 so that the sum of that voltage and its time rate of change will be equal to and opposite the voltage on input terminal 91. Amplifier 74 will simultaneously tend to drive output terminals 81, 89 and 97 such that the sum of the three output voltages on output terminals 81, 89 and 97 and the time rate of change of the voltage on terminal 97 is equal to and opposite the sum of the input voltages on terminals 75, 83 and 91. Following the reasoning applied to the system of FIG. 1, it may be seen that the system of FIG. 2 will continue to operate properly in spite of a zero-output-type failure of any one of amplifiers 71, 72, 73 and 74.

It is noteworthy that this redundant capability is achieved with only four amplifiers for three independent voltage signals and that the different dynamic characteristics of the channels are preserved in spite of zero-output-type amplifier failures.

Reference is now made to FIG. 3 which is a schematic illustration of a third form of the invention arranged for the amplification of three independent voltage signals in spite of a worst-case-type failure of any one of the system amplifiers. FIG. 3 includes operational amplifiers 121, 122, 123, 124, 125 and 126. Input terminal 127 connects through resistor 128 to line 129 and the input of amplifier 121. The output of amplifier 121 on line 130 connects through resistor 131 to line 132 and output terminal 133. Resistor 134 connects from line 132 to line 129. Input terminal 135 connects through resistor 136 to line 137 and the input of amplifier 123. The output of amplifier 123 on line 138 connects through resistor 139 and line 140 to output terminal 141. Resistor 142 connects from line 140 to line 137. Input terminal 143 connects through resistor 144 to line 145 and the input of amplifier 125. The output of amplifier 125 on line 146 connects through resistor 147 and line 148 to output terminal 149. Resistor 150 connects from line 148 to line 145. Resistor 151 connects from input terminal 127 to line 152 and the input of amplifier 122. Resistor 153 connects from input terminal 135 to line 152. The output of amplifier 122 on line 154 connects through resistor 155 to line 132 and output terminal 133, and through resistor 156 to line 140 and output terminal 141. Resistor 157 connects from line 132 to line 152, and resistor 158 connects from line 140 to line 152. Resistor 159 connects from input terminal 135 to line 160 and the input of amplifier 124. Resistor 161 connects from input terminal 143 to line 160. The output of amplifier 124 on line 162 connects through resistor 163 to line 140 and output terminal 141, and through resistor 164 to line 148 and output terminal 149. Resistor 165 connects from line 140 to line 160, and resistor 166 connects from line 148 to line 160. Resistor 167 connects from input terminal 143 to line 168 and the input of amplifier 126. Resistor 169 connects from input terminal 127 to line 168. The output of amplifier 126 on line 170 connects through resistor 171 to line 148 and output terminal 149, and through resistor 172 to line 132 and output terminal 133. Resistor 173 connects from line 148 to line 168, and resistor 174 connects from line 132 to line 168.

In a representative circuit constructed along the lines of FIG. 3, resistors 128, 151, 153, 136, 159, 161, 144, 167 and 169 may be of 1 megohm each; resistors 134, 157, 158, 142, 165, 166, 150, 173 and 174 may be of 1 megohm each; resistors 131, 139 and 147 may be of 100,000 ohms each; and resistors 155, 156, 163, 164, 171 and 172 may be of 140,000 ohms each.

As shown previously, the systems of FIGS. 1 and 2 will continue to operate in spite of a zero-output-type failure of any one amplifier. The system of FIG. 3 will continue to operate in spite of a worst-case-type failure of any one amplifier. Hence, the system of FIG. 3 will also continue to operate in spite of a zero output or other less than worst case failure of any one amplifier. The system will also continue to operate in spite of an open circuit, short circuit, or change of value of any one circuit resistor.

In analyzing the operation of the system of FIG. 3, it should be remembered that a particular set of system output voltages does not imply a unique set of amplifier output voltages. It is convenient to describe the operation of the system in terms of amplifier output voltages which will produce a desired set of system output voltages. However, these amplifier output voltages may or may not be the actual values which would be measured in a working model. In operation, amplifier 121 will tend to drive output terminal 133 so that its voltage is equal and opposite to the voltage on input terminal 127. Amplifiers 123 and 125 will similarly tend to drive output terminals 141 and 149 so that their voltages are equal and opposite to the input voltages on terminals 135 and 143 respectively. Amplifier 122 tends to drive both output terminals 133 and 141 so that the average of their voltages is equal and opposite to the average of the voltages on input terminals 127 and 135. Similarly, amplifier 124 drives output terminals 141 and 149, and amplifier 126 drives output terminals 133 and 149. It may be noted that the system of FIG. 3 has a triple symmetry. Each of the three independent input signals passes through one amplifier whose function is to amplify only that particular signal. For example, the signal from input terminal 127, and only that input signal, passes through amplifier 121. In addition, each of the three combinations of two input signals passes through an amplifier associated with that particular pair of input signals. For example, signals from input terminals 127 and 135 pass through amplifier 122.

With all six amplifiers functioning properly, the system of FIG. 3 will operate as a three-channel amplifier system. A zero-output-type failure of one or more of amplifiers 122, 124 and/or 126 will not cause system failure, as the set of amplifiers 121, 123 and 125 form a simple nonredundant amplifier system which will continue to operate as desired.

A zero output failure of amplifier 121 will not directly affect the voltages on output terminals 141 and 149. With the resistor values previously stated, and no external current load, the output voltage on terminal 133 will be 0.37 times the voltage on line 130 plus 0.26 times the voltage on line 154 plus 0.26 times the voltage on line 170. Now let us assume that we wish to generate an output of +10 volts on terminal 133 in spite of a zero output failure of amplifier 121. One combination of amplifier output voltages which would generate this system output would be +19.2 volts from each of amplifiers 122 and 126, -19.2 volts from amplifier 124 and zero volts from amplifiers 121, 123 and 125. The mixing of the outputs of amplifiers 122 and 126 would result in the desired +10-volt signal on terminal 133. The mixing of the equal magnitude, opposite polarity signals from amplifiers 122 and 124 would result in a zero output voltage on terminal 141. The output voltage on terminal 149 would similarly be zero.

If nonzero output voltages were desired on terminals 141 and 149, they could be generated by amplifiers 123 and 125 without affecting the voltage on terminal 133. Hence, the system of FIG. 3 will continue to operate in spite of a zero output failure of amplifier 121. From symmetry, the system will also continue to operate in spite of a zero output failure of either of amplifiers 123 or 125. Hence, the system of FIG. 3 will continue to operate in spite of a zero-output-type failure of any one amplifier.

Now let us examine the operation of the system of FIG. 3 with a worst-case-type amplifier failure. We will assume that the maximum amplifier output signal of either polarity is 100 volts and that a particular amplifier has failed by generating a fixed +100-volt output signal. First, let us assume that amplifier 121 is generating an erroneous +100-volt signal on line 130. If the voltages on input terminals 127, 135 and 143 are all zero, the remaining five amplifiers will attempt to maintain the voltages on output terminals 133, 141 and 149 at zero. One combination of amplifier output voltages which will accomplish this is an output of -71 volts from amplifiers 122 and 126, an output of +71 volts from amplifier 124, and zero outputs from amplifiers 123 and 125. As will be seen shortly, it is significant that a maximum erroneous output from amplifier 121 may be opposed without requiring a maximum output from any of the remaining five amplifiers.

As a second example, we assume a +100-volt erroneous output signal from amplifier 122 on line 154. Zero system output voltages may then be maintained with outputs of -70 volts from amplifiers 121 and 123, and zero outputs from amplifiers 124, 125 and 126. Again it may be noted than an erroneous maximum value amplifier output signal may be opposed to maintain the system output voltages on terminals 133, 141 and 149 at zero without requiring maximum output voltages from any of the remaining five amplifiers. From the symmetry of the system of FIG. 3, the above reasoning implies that a worst-case-type failure of any one amplifier may be opposed so that the system output terminal voltages remain at zero without requiring maximum outputs from any of the remaining five amplifiers.

It was previously shown that any group of five amplifiers in the system of FIG. 3 could generate desired independent output terminal voltages in the presence of a zero output failure of a sixth amplifier. The generation of a desired set of output terminal voltages in the presence of a worst-case-type failure may be considered as a superposition of the amplifier output voltages which maintain zero voltages at the three output terminals plus the amplifier output voltages which will generate the desired output terminal voltages in the presence of a zero output failure. Hence, the system of FIG. 3 is capable of generating a set of independent voltages on output terminals 133, 141 and 149 in spite of either a zero output or worst-case-type failure of any one amplifier. This implies that the system of FIG. 3 will continue to operate in spite of failure of any one amplifier which generates any erroneous output voltage, since an arbitrary output voltage will be no worse than a worst-case-type failure. This also implies that the system of FIG. 3 will continue to operate in or change of value of any one circuit resistance.

As mentioned previously, the conventional duplication and paralleling approach to redundancy to allow continued operation in the presence of worst-case-type failures requires a triple system for each individual channel or independent variable. A conventional triple redundant system for the amplification of three independent voltages would require nine amplifiers. An advantage of the system of FIG. 3 is that it requires only six amplifiers, a saving of three amplifiers. In general, conventional triple redundant systems require 3N subsystems, where N is the number of independent signal quantities or transmission channels. The minimum number of subsystems required for continued operation in the presence of a worst-case-type failure is N+2. As in the case of the previously considered zero-output-type failures, these two expressions are equivalent for a single channel system. However, the techniques shown in this specification offer significant economies and other advantages as the number of independent signals or transmission channels in the system increases. The system of FIG. 3 uses six amplifiers for three independent channels. It is possible to devise systems capable of amplifying three independent signals in spite of a worst-case-type failure which use only five amplifiers for three independent signals. The system of FIG. 3 was chosen for purposes of illustration as its inherent symmetry makes its operation easier to analyze and describe.

Reference is now made to FIG. 4 which is an illustration of a redundant mechanical system arranged for the transmission of two independent signals in spite of a breakage of any one transmission rod. FIG. 4 includes rods 181, 182 and 183. The left ends of rods 181 and 183 are identified as ends 184 and 185, respectively, and their right ends are identified as ends 186 and 187, respectively. Rod 181 slides in a left-right direction through supports 188 and 189. Rod 182 similarly slides through supports 190 and 191, and rod 183 slides through supports 192 and 193. Bar 194 is attached to the left end of rod 182 by pin 195 which allows rotational motion of bar 194 with respect to rod 182. Bar 194 is also attached to rod end 184 by pin 196 through slot 197 of bar 194. Bar 194 is similarly attached to rod end 185 by pin 198 through slot 199 of bar 194. Bar 200 is attached to the right end of rod 182 by pin 201. The manner of attachment of bar 200 to rod 182 allows rotation of bar 200 with respect to rod 182. Bar 200 is attached to rod end 186 by pin 202 through slot 203 of bar 200. Bar 200 is similarly attached to rod end 187 by pin 204 through slot 205 of bar 200.

The systems illustrated in FIGS. 1, 2 and 3 have been of an electrical nature. FIG. 4 is intended to illustrate the applications of the principles described in this specification to nonelectrical systems or subsystems.

The system of FIG. 4 may be used as a mechanical signal transmission system, and is a form of mechanical analog to the electrical system of FIG. 1 Rod ends 184 and 185 are the mechanical signal input elements, and signals are transmitted by moving these rod ends. Rod ends 186 and 187 are the mechanical output elements, and their positions indicate the mechanical signals being transmitted. Rods 181, 182 and 183 serve to transmit the mechanical signals over some distance. A breakage of one of rods 181, 182 or 183 will correspond to a zero-output-type failure of an amplifier in the previously described system of FIG. 1.

Breakage of rod 182 will not affect the system operation, as both mechanical signals will continue to be transmitted by rods 181 and 183 in a straightforward manner. Breakage of rod 183 will not affect the transmission of a signal from end 184 to end 186 over rod 181. With rod 183 broken, the parallelogram linkage formed by rod 181, bar 194, rod 182, and bar 200 will cause pin 204 to follow any movements of pin 198. Hence, rod end 187 will follow movements of rod end 185, and the second mechanical signal will be transmitted in spite of breakage of rod 183. Because of the symmetry the same reasoning may be used to show that the system will continue to function in spite of a breakage of rod 181.

It may be noted that rod 181 carries a first mechanical signal, rod 183 carries a second mechanical signal, and rod 182 carries an average of the two mechanical signals. Hence, breakage of any one of the three rods still transmits sufficient information to the far end to allow reconstruction of the two independent signals. A more conventional form of redundant mechanical system would have provided duplicate rods for each of the two signal transmission channels, or a total of four rods. The advantage of the system of FIG. 4 is that it requires only three rods to transmit two independent mechanical signals in spite of a breakage of any one of the rods.

An application for a system such as that shown in FIG. 4 would be the transmission of mechanical signals to the tail control surfaces of an aircraft. Rod ends 184 and 185 would be connected to the cockpit controls, and rod ends 186 and 187 would be connected to the control surfaces.

Reference is now made to FIG. 5 which is a pictorial and schematic illustration of a fifth form of the invention arranged for the damping of pitch and yaw motions of an aircraft in spite of a zero-output-type failure of any one component or subsystem. FIG. 5 shows aircraft 211 with right wing 212 and left wing 213. Rate gyros 214, 215 and 216 are located in the forward section of aircraft 211. Rate gyro 214 connects via line 217 to amplifier 218. Rate gyro 215 similarly connects via line 219 to amplifier 220, and rate gyro 216 connects via line 221 to amplifier 222. Amplifier 218 connects via link 225 to movable control surface 223 of vertical stabilizer 224. Amplifier 220 similarly connects via link 228 to movable control surface 226 of stabilizer 227, and amplifier 222 connects via link 231 to movable control surface 229 of stabilizer 230. Links 225, 228 and 231 include electromechanical actuators which are not specifically shown in FIG. 5, but which move control surfaces 223, 226 and 229 in response to signals from amplifiers 218, 220 and 222, respectively.

Aircraft 211 is of conventional design except for the tail surfaces. In a conventional aircraft with right and left horizontal tail surfaces the two movable horizontal control surfaces are mechanically linked so as to move up and down together. In the aircraft of FIG. 5 the three movable control surfaces are not linked and may be moved independently in response to control signals. Stabilizer 224 extends vertically upward from the aircraft and in general resembles a conventional vertical stabilizer. Stabilizers 227 and 230 extend outward from the aircraft tail in directions which are 60.degree. to the right and left respectively of the aircraft local vertical. Thus, stabilizers 227 and 230 are inclined at angles of 30.degree. upward from the aircraft horizontal.

The purpose of the system shown in FIG. 5 is to damp yaw and pitch motions of aircraft 211. Rate gyro 214 is an angular-rate-sensing device whose output on line 217 corresponds to the rate of rotation of aircraft 211 about its vertical axis. Amplifier 218 will then move control surface 223 so as to oppose any yawing motion of aircraft 211 about its vertical axis. This subsystem is essentially a single axis yaw damper of the type sometimes used to improve the yaw stability of light aircraft in flight through turbulent air and of high-speed aircraft in supersonic flight. Rate gyro 215 is arranged with its sensitive axis perpendicular to the longitudinal axis of aircraft 211 and 60.degree. to the right of the aircraft local vertical. Rate gyro 216 is arranged with its sensitive axis perpendicular to the longitudinal axis of aircraft 211 and 60.degree. to the left of the aircraft local vertical. The subsystem including rate gyro 215, amplifier 220 and control surface 226 will damp angular motion of aircraft 211 about the sensitive axis of gyro 215. The subsystem including rate gyro 216, amplifier 222 and control surface 229 will similarly damp angular motion of aircraft 211 about the sensitive axis of gyro 216. Since the simultaneous damping of angular motions about the sensitive axes of gyros 214, 215 and 216 is not inconsistent, the overall result will be a damping of both yaw and pitch motions of aircraft 211.

Since no two of the sensitive axes of gyros 214, 215 and 216 are parallel, any combination of pitch and yaw motions of aircraft 211 will be sensed by at least two of said rate gyros. Hence, in normal operation, any combination of yaw and pitch motions of aircraft 211 will be opposed or damped by motions of at least two of control surfaces 223, 226 and 229. A nonredundant system for damping of aircraft motions about two axes would require only two angular rate sensors and two movable control surfaces. By adding a third angular rate sensor, movable control surface and intermediate coupling equipment, the system of FIG. 5 becomes a redundant system which is capable of continued operation in spite of a zero-output-type failure of any element in any one of the three subsystems.

Let us first consider a zero output failure in the subsystem extending from rate gyro 214 to control surface 223. Whether the failure is in gyro 214, line 217, amplifier 218, link 225 or control surface 223 is unimportant as long as it is a zero-output-type failure. The remaining two subsystems including control surfaces 226 and 229 are still capable of exercising full pitch and yaw control over aircraft 211. A number of aircraft, including the model 35 manufactured by the Beech Aircraft Co. of Wichita, Kansas, use only two stabilizers and control surfaces inclined approximately 60.degree. from the aircraft local vertical. The vertical stabilizer and conventional rudder are completely absent in such aircraft. Hence, the system of FIG. 5 will continue to damp both yaw and pitch motions of aircraft 211 in spite of a zero output failure of the subsystem connecting to control surface 223. If the subsystem connecting to control surface 226 should have a zero output failure, control surface 223 will function as a conventional rudder while control surface 229, being largely horizontal, will function largely as a conventional elevator surface. Hence, the system of FIG. 5 will provide damping of both yaw and pitch motions of aircraft 211 in spite of a zero output failure of the subsystem connecting to control surface 226. Because of symmetry the same reasoning may be used to show that the system will continue to function in spite of a zero output failure of the subsystem connecting to control surface 229.

The system of FIG. 5 may be compared with the system shown in FIG. 1. In FIG. 1, a first input signal is applied to a first amplifier, a second input signal is applied to a second amplifier, and an average of the two input signals is applied to a third amplifier. The output of the first amplifier is connected to a first output terminal, the output of the second amplifier is connected to a second output terminal, and the output of the third amplifier is connected to both output terminals. The system of FIG. 1 could be used for pitch and yaw damping of the form provided by the system of FIG. 5. Two rate gyros would be connected to the two input terminals of the system of FIG. 1, and its two output terminals would be connected to two electromechanical actuators and two control surfaces. However, this system would then be vulnerable to a single zero output failure of either rate gyro, either actuator or either control surface. The system of FIG. 5 illustrates the extension of the redundance techniques described in this specification to include the signal sources such as rate gyros 214, 215 and 216, and signal destinations such as control surfaces 223, 226 and 229. From the geometry of the system of FIG. 5, it may be seen that rotations sensed by gyro 214 will be an average of the rotations sensed by gyros 215 and 216. Aircraft motion due to deflection of control surface 223 will be similar to the motion due to simultaneous deflections of both surfaces 226 and 229. Hence, the system of FIG. 5 generally resembles the system of FIG. 1 except that it provides the additional immunity against zero-output-type failures of the signal sources and output load devices. Systems which are immune to worst-case-type failures and/or systems for the sensing and/or control of motion about three axes and/or translational motion may be extended in a similar manner. Redundant systems which sense and/or control quantities other than mechanical motions may also be extended to include redundant system input and/or output networks.

Reference is now made to FIG. 6 which is a block diagram illustrating a sixth form of the invention arranged for the conversion of information from analog to digital form in spite of a worst-case-type failure of an individual converter or other circuit element. In FIG. 6, input terminal 241 connects through line 242 to the input of analog to digital converter 243. The output of converter 243 on line 244 connects to a first input of digital computer 245. Input terminal 246 connects via line 247 to the input of analog to digital converter 248. The output of converter 248 on line 249 connects to a second input of digital computer 245. Line 250 connects from line 242 to a first input of mixer 251. Line 252 connects from line 247 to a second input of mixer 251. The output of mixer 251 on line 253 connects to the input of analog to digital converter 254. The output of converter 254 on line 255 connects to a third input of digital computer 245. Line 256 connects from line 242 to a first input of mixer 257. Line 258 connects from line 247 to a second input of mixer 257. The output of mixer 257 on line 259 connects to the input of analog to digital converter 260. The output of converter 260 on line 261 connects to a fourth input of digital computer 245.

The systems shown in FIGS. 1 through 5 may be regarded as various forms of feedback control systems. The systems shown in FIGS. 1, 2 and 3 employed operational amplifiers within electrical feedback loops. The system of FIG. 4 may be regarded as a form of mechanical feedback system, in that forces encountered by rod ends 186 and 187 are fed back to rod ends 184 and 185. The system of FIG. 5 is also a form of feedback system, in that the effects of motions of the various tail control surfaces are fed back into the rate gyros through motion of the entire aircraft. The system of FIG. 6 is an example of a redundant system employing the principles described in this specification for data conversion or transmission which does not employ feedback in the usual sense.

For convenience, the signals on input terminals 241 and 246 are identified respectively as A and B. The signals are assumed to be analog voltages. Signal A passes through analog to digital converter 243, where it is converted into digital form, and passes on through line 244 to digital computer 245. Signal B similarly enters digital computer 245 on line 249. Mixer 251 is an analog summing device of the type used in analog computing, simulation and control systems. Mixer 251 generates a sum of signals A and B. This sum is then converted into digital form in converter 254 and enters computer 245 via line 255. Mixer 257 similarly generates a difference of signals A and B which is converted in converter 260 and enters computer 245 via line 261. Thus, the system of FIG. 6 takes two signals, designated A and B, generates two additional combination signals, (A+B) and (A-B), converts all four signals into digital form, and enters them into digital computer 245.

It may be noted that any two of the four signals supplied to digital computer 245 are linearly independent. Hence, given any two of these signals the remaining two may be computed. As part of the processing within digital computer 245, the four inputs on lines 244, 249, 255 and 261 are analyzed for consistency. One method of analyzing this group of signals for consistency would be to form four partial sums from the signals entered into digital computer 245.

S1=(A)+(B)-(A+B)

S2=(A)-(B)-(A-B)

S3=2(A)-(A+B)-(A-B)

S4=2(B)-(A+B)+(A-B)

Each of the above partial sums will be essentially zero if the four analog to digital converters and associated equipment are all functioning properly. The forming of these sums and subsequent steps in the analysis would be performed by digital computer 245 under the control of an appropriate program. To examine the operation of such a program in the presence of a converter malfunction, we may first assume that converter 260 is generating an erroneous output signal. Sums S2, S3, and S4 would then differ from zero by the amount of the error of converter 260. S1 would have the smallest absolute value which would imply that the correct input values should be determined from the outputs of converters 243, 248 and 254. The outputs of converters 243 and 248 could then be taken as the correct values of A and B. In the event of a failure of converter 243, sums S1, S2 and S3 would be in error due to the erroneous output of converter 243. S4 would then have the least absolute value indicating that the correct values of A and B should be determined from the outputs of converters 248, 254 and 260. The output of converter 248 could then be taken for the value of B and the difference of the outputs of converters 248 and 254 for the value of A. Erroneous outputs from converter 248 or converter 254 could be detected and compensated for in a similar manner.

Since the system of FIG. 6 will continue to function properly in spite of an erroneous signal of arbitrary magnitude from one of the analog to digital converters, it may be regarded as a redundant system which is immune to a worst-case-type failure. A more conventional redundant analog to digital conversion system would require three converters for each of the two independent signals, a total of six converters. A simple arrangement of two converters per channel would not suffice. If the outputs of the two converters disagreed there would be no clear indication as to which one would be correct. The system of FIG. 6 provides the redundant reliability of a conventional six-converter system while requiring only four converters.

The number of independent signals converted and/or transmitted by a system such as that shown in FIG. 6 may be increased as desired. The minimum number of conversion or transmission links required to insure continued operation in spite of a worst-case-type failure is N+2 where N is the number of independent signals converted or transmitted. The N+2 signals which are actually converted or transmitted must normally be chosen such that given any N of them, the remaining 2 may be determined.

Communication noise such as radio static may be considered as a form of intermittent unreliability. The problem of accurate communication in the presence of noise is closely related to the problem of constructing reliable systems from less reliable elements. Radio or other communication links may be added to the system of FIG. 6 in addition to or in place of converters 243, 248, 254 and 260. The system will continue to operate and determine the correct values of signals A and B in spite of an erroneous signal on any one of lines 244, 249, 255 or 261. The error compensation will be made regardless of whether the error is due to equipment malfunction or communication noise. Hence, systems of the order of FIG. 6 may be used for the accurate transmission of information in the presence of noise or other erroneous signals with a lesser number of transmitted channels than would be required with simple systems in which each transmission channel is duplicated or paralleled.

This specification has described systems for the control and/or transmission of a number of independent signals. The term independent as applied to such signals should be interpreted in its broad sense. For example, the system of FIG. 2 is arranged such that the output voltage on terminal 81 is an inversion of the input voltage on terminal 75; the output voltage on terminal 89 is an inversion of the input voltage on terminal 83; and the output voltage on terminal 97 is an inverted first order lag signal related to the input on terminal 91. If terminals 89 and 91 were joined, the output signal on terminal 97 would be a first order lag signal corresponding to the input voltage on terminal 83 without inversion. In some instances it may be convenient to pass a signal through a system more than once. In such cases a redundant system may amplify or otherwise process a signal at several steps in its progress instead of, or in addition to, the previously described examples of the processing of a number of essentially parallel signals.

The term "transmission" is used in the claims in phrases such as "transmission of signals." This term is intended to be interpreted in its broad sense to include amplification, recording and playback at a later time, operations such as analog to digital conversion, time and frequency domain filtering, and other operations upon signals as well as transmission from one location to another. The term "signal" is also intended in its broad sense to include electrical, mechanical, pneumatic, hydraulic and other means whereby information may be transmitted. The letter N is used in the claims to indicate a positive integer.

Claims

What is claimed is:

1. In a system for transmitting a plurality of signals each from a separate input means to a separate output means and having a plurality of independent signal transmission means, means intercoupling said signal transmission means so as to continuously provide continued usable signals at each of said output means upon failure of one of said signal transmission means, the improvement comprising at least two first signal transmission means each coupled between at least one separate input means and one separate output means, at least one second signal transmission means, the total number of said signal transmission means being at least one more than the signals to be transmitted, means continuously coupling at least one second signal transmission means to more than one input means and to more than one output means, means in each of said first signal transmission means to normally maintain the signal level at the output means to which the first signal transmission means is coupled at a preselected relationship to the signal level at the input means for the same first signal transmission means, and means in each of the second signal transmission means continuously coupled to the respective output means and normally operative to maintain a combination of the signals at the output means to which the second signal transmission means is coupled at a preselected relationship to the signals at the input means to which the same second signal transmission means is continuously coupled, whereby failure of one of said signal transmission means will not cause a change in the relationship of signals between each input means and its corresponding output means.

2. The combination as specified in claim 1 wherein said input means and output means comprise input terminals and output terminals, respectively, and wherein each of said transmission paths includes signal-amplifying means.

3. The combination as specified in claim 2 wherein said signal-amplifying means each have amplifying inputs, and said means to maintain the signal level at the output terminals at a preselected relationship to the signal level at the corresponding input terminals comprise feedback means connecting the respective output terminals to the amplifying input of the signal-amplifying means forming part of the signal transmission means connected to that respective output terminal.

4. The combination as specified in claim 2 wherein said signals are electric signals, and wherein said signal transmission means include impedance means for restricting the flow of current between each of said signal-amplifying means and its connected output terminals.

5. The system of claim 1 wherein the total number of signal transmission paths is at least two more than the signals to be transmitted, and where there are at least two second signal transmission means, each of said input means being coupled to one of said first signal transmission means, and to two of said second signal transmission means, and each of said outputs being coupled to one of said first signal transmission means and the same second signal transmission means to which the corresponding input means is connected, and each of said second signal transmission means being connected between at least two input means and at least two output means.

6. The system as specified in claim 1 wherein the input means comprise gyroscopic sensors developing outputs in response to signals from motion of an aircraft with respect to more than one of its axes and wherein the output means comprise control surfaces of said aircraft, the position of said control surfaces resulting in motion of the aircraft with respect to said axes.

7. The system of claim 1 wherein the signals at the input means comprise force signals resulting from motion of an aircraft with respect to more than one of said aircraft's axes.

8. The system of claim 1 wherein said first signal transmission means include analog to digital converters, and wherein there are two second signal transmission means each including means to mix the signals from the input means in a different algebraic manner than the other, and each including an analog to digital converter.

9. Means for determining errors in signals after transmission of said signals through a plurality of independent signal transmission means, including at least two first signal transmission means each coupled to separate input means, two second signal transmission means, the total number of said plurality of independent signal transmission means being at least two more than the signals to be transmitted, means coupling each of said second signal transmission means to more than one input means, separate means in each of said second signal transmission means combining the signals from the input means to which it is connected in a different algebraic manner from the other second signal transmission means, computer means coupled to each of said signal transmission means to receive signals from said transmission means, and means to compare each of the signals received by the computer for consistency with other signals received by the computer for consistency with other signals received from said transmission means to determine if one of the signal transmission means is transmitting an erroneous signal.

10. The method of providing a redundant analog to digital converter system wherein separate analog signals are passed from independent input means through separate analog to digital converters and then to digital computer means, comprising the steps of passing a plurality of independent signals through separate analog to digital converters into a digital computer, combining said plurality of signals in a first algebraic manner and passing the first combined signal through a separate analog to digital converter to said digital computer, combining said plurality of signals in a second different algebraic manner than the first algebraic manner of combining of signals, and passing said second combined signals through a separate analog to digital converter to said computer, programming said computer to analyze the consistency of the signals received from each of the analog to digital converters with respect to signals received from other analog to digital converters to detect erroneous signal outputs from any one of said converters.

11. The method of claim 10 wherein there are two input signals, and said first mixing step is adding said signals, and said second mixing step is subtracting said signals before they are passed through their respective analog to digital converters.

12. The combination as specified in claim 11 wherein the consistency analysis is provided by computer programming analyzing partial sums of the signals from the outputs of the separate analog to digital converters.

13. The method of providing for the transmission of signals from separate input means to corresponding separate output means including the steps of transmitting a first signal from a first input means to a first output means through a first transmission means, transmitting a second signal from a second input means to a second output means through a second signal transmission means, continuously coupling a third signal transmission means to said first and second input means and to said first and second output means to thereby transmit a combination signal from said first and second input means through said third signal transmission means, continuously maintaining the signal at said first output means proportional to the first signal at said first input means and continuously maintaining the signal at said second output means proportional to the second signal at said second input means regardless of failure of any one of the signal transmission means.

14. The method of providing for redundant control of a plurality of signals from separate input means to separate output means comprising the steps of transmitting each of the signals from a separate one of the input means to a separate one of the output means through separate first transmission, means, normally maintaining the signals at each output means at a preselected ratio to its corresponding input signal at said input means through the first transmission means, combining the signals between at least two input means and normally continuously passing the combined signal through at least one second transmission means to the corresponding output means to form a combined signal at the corresponding output means, and normally continuously maintaining the combined signal at the corresponding output means at a preselected ratio to the combined signal at the input means coupled to the second transmission means whereby failure of one of one of the first or second transmission means does not substantially affect the relationship of signals between each output means and its corresponding input means.

15. The method of providing redundant transmission of a plurality N of identifiable signals from a separate input means to a separate output means for each respective signal through signal transmission means in spite of a zero-output-type failure of a signal transmission means, passing each of said signals through more than one of said signal transmission means from the separate input means to the separate output means for that signal, normally maintaining the signals at each separate output means at a preselected relationship to the corresponding input signal at the separate input means for that signal, normally continuously passing a combination signal comprised of more than one of said signals from more than one separate input means to more than one corresponding separate output means for said signals through at least one of said signal transmission means, and continuously maintaining the combination of signals at the said more than one separate output means at a preselected relationship to the combination signals at the corresponding more than one separate input means whereby failure of one of said signal transmission means does not substantially affect the relationship of the identifiable signal between each output means and its corresponding input means.

16. A method of providing redundant transmission of a plurality N of identifiable signals from a separate input means to a separate output means for each signal through signal transmission means in spite of a worst-case-type failure of an individual transmission means, comprising the steps of providing more than N plus 1 signal transmission means, each coupled between an input means and its corresponding output means, passing each of said plurality of signals through more than two of said signal transmission means, each of the signal transmission means passing said signals being operably coupled between the separate input means and separate output means for each of the signals it passes, and passing a combination signal corresponding to more than one of said signals through at least two of said transmission means from more than one of the separate input means to more than one respective separate output means for said signals, and normally maintaining a preselected relationship for each of said signals between the separate output means and the separate input means for each of said signals to which each of the signal transmission means is coupled, whereby failure of one of the signal transmission means does not substantially affect the relationship of the signals between each separate output means and its corresponding separate input means.

17. In a control device having signal transmission means for transmitting a plurality of separately identifiable signals from separate signal input means to separate signal output means to provide continued usable identifiable signals at each of the separate output means in the case of failure of any one transmission means, thereby to provide a redundant control, the improvement comprising a plurality of signal transmission means, at least one more in number than the plurality of signals to be transmitted, each transmission means being continuously coupled to transmit at least one signal from at least one input means to a corresponding output means, at least one of said signal transmission means transmitting only a combination of said identifiable signals and being continuously coupled to the input means and output means for each of the identifiable signals forming the combination, said signal transmission means each including means to maintain the relationship of the signals each of the separate output means to which that transmission means is continuously coupled at a desired relationship to the signal at the respective separate input means continuously coupled to the same transmission means.

18. In a redundant control system for maintaining separate usable signals at a plurality of signal output means, including separate signal input means for each of a plurality of separate signals, first and second signal transmission means to transmit said signals to respective separate output means for each of said separate signals, there being at least one more transmission means than signals, the respective separate input means for each of said signals being continuously coupled to the respective output means through at least one first and one second signal transmission means, each of said signal transmission means being continuously coupled to the input means of more than one separate signal and being continuously coupled to the output means for the same signals, each of said signal transmission means including means to normally maintain a desired relationship between the separate signals at each output means to which that transmission means is continuously coupled and each corresponding input means to which the same transmission means is continuously coupled, to thereby automatically provide a continued separate signal at each output means in case of failure of one of the signal transmission means.

19. The control system of claim 18 wherein there are two signals and two first signal transmission means comprising first rods transmitting mechanical signals, and said second transmission means comprises a rod coupled to both of the first rods to transmit an average of the mechanical signals transmitted by said first rods from first to second ends thereof.