1. Field of the Invention This invention relates to an apparatus and method for"locking out" electrical power to particular electronic subsystems to avoid inadvertent power turn-on and possible shock hazard and/or short-circuiting. More particularly, this invention relates to a system that generates a matrix designating an operational status of each of a plurality of electrical circuits, the matrix being capable of overriding operator commands. The matrix is stored in non-volatile memory to prevent modification of the matrix by electric power interruption or shut down.

2. Brief Description of the Art Maintenance on high voltage electrical circuits under electrical power, either known to be powered or not-known to be powered, presents a significant safety hazard. Electrocution, severe electrical shock injury, or fire can result when an electrical circuit that is thought not to be receiving electrical current actually is receiving electrical current. In less severe cases, burned wires, damaged connectors and internally damaged electrical components or circuits can result from such a situation.

For this reason it is highly desirable that circuits under maintenance be known to be in an unpowered or de-energized state, such that re-application of power cannot occur without a deliberate action by authorized personnel.

In conventional technology vehicles, such as helicopters, electrical circuits for vehicle subsystems are protected by mechanical circuit breakers that can be manually turned"OFF"for maintenance. These electrical circuits are also further protected by mechanically locking them out with plastic cable ties or tie wraps placed around the circuit breaker shafts. Also, since the electronic circuits require manual activation they had to be located within the cockpit area for immediate accessibility where flight crew personnel could see those circuits with tie wraps. The tie wraps prevent flight crew personnel in the vehicle from inadvertently reapplying electrical power to the subsystems that are in a maintenance mode and, therefore, should not receive electrical power. The tie wraps also act as visual indicators of electronic circuits that are intentionally turned"OFF" (pulled out) to protect circuits which are in maintenance mode.

In more advanced vehicles, electrical circuits are protected by solid state power controllers (SSPCs) that act as circuit breakers, as well as control power to associated subsystems. These solid state devices are generally remotely located and controlled through software. The SSPCs are designed to turn"OFF"power to down stream wiring and subsystems when they sense an electrical fault within the system architecture. Internal to the SSPC is fault sensing circuitry that can be tailored for various fault conditions.

Additionally, the SSPCs contain circuitry that provides advanced features such as current limitina. self-test and status monitoring. After electrical power is applied to SSPCs they have the ability to be controlled"ON/OFF"via a system controller. Upon application of electrical power the system controller will set the start- up SSPCs to an"ON"state, which provides electrical power for critical start-up loads.

Only after the initial start-up loads have been turned"ON"can the pilot manually (via a computer interface) turn them"OFF"or reconfigure the start-up load configuration. If during this power"ON"period the system controller loses power (power interrupt) it will revert back to turning"ON"the start up SSPCs. Hence, the present state of the art solid state circuit breaker system does not provide the capability to permanently turn SSPCs"OFF"for maintenance. This presents a serious problem since the operators of a vehicle may not be aware of the operational status of the subsystems of the vehicle.

Also, a power interruption may change the operational status of the subsystems, which presents a hazardous condition for maintenance personnel and flight crew personnel since they may not be aware of those electrical circuits being re-energized after the interrupt period.

What is needed is an advance in the state-of-the-art that would raise the level of safety during maintenance and operation of a vehicle by providing a non- varying operational status of vehicle subsystems and providing information regarding that status to flight crew personnel.

BRIEF SUMMARY OF THE INVENTION The instant invention provides a solution to the above-noted problems by providing a system for establishing the operational status of electronic circuits and, thus, an associated vehicle subsystem. The operational status data is stored in a limited-access, non-volatile memory, thereby preventing modification of the operational status data by unauthorized personnel and/or electrical power interruption.

The instant invention also has the capability to output data relating to the operational status of the vehicle subsystems to flight crew personnel.

Accordingly, one embodiment of the instant invention is directed to an apparatus for controlling the operational state of one or more electrical circuits. This apparatus includes a power source capable of providing electrical power to each of the electrical circuits and an input module that is used to generate status data relating to an operational status of each of the electrical circuits. A control module is coupled to the power source, and each of the electrical circuits. The control module receives the status data from the input module and stores the status data in a non-volatile storage medium so that the status data is maintained when electrical power is interrupted. The control module prevents particular electrical circuits, which have been designated as non- operational, from receiving electrical power from the power source. The status data is modified by the input module.

Another embodiment of the instant invention is directed to a method, which is stored on a computer-readable medium, for providing information relating to the operational state of a plurality of electronic circuits. This method includes generating status data in accordance with an operational state of each electronic circuit.

The status data is stored in a non-volatile memory medium that prevents modification of the status data when power is interrupted. The status data is transmitted to a processor that prevents electrical power transmission to electronic circuits that are designated as non-functional.

Yet another embodiment is directed to an apparatus for controlling an operational status of a plurality of helicopter subsystems. The apparatus includes an external input module, adapted to modify the operational status of helicopter subsystems and generate operational status data. A processing module receives the operational status data and stores the operational status data in a non-volatile storage medium that prevents modification of the operational status data. A plurality of power control circuits are coupled to the processing module and the control circuits receive the status data. Each power control circuit operates according to the operational status data. A plurality of helicopter subsystems, each of which is coupled to an associated power control circuit, operates according to the operational state of the associated power control circuit. The operational state of the control circuit is either ON, OFF or LOCKED-OUT. The helicopter subsystems that have been designated as LOCKED- OUT will not receive electrical power until the operational status has been changed to ON or OFF by input from the external input module.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 shows a system architecture for one embodiment of the instant invention.

FIG. 2 shows a flow chart of the steps to"LOCK-OUT"designated electrical circuits.

FIG. 3 shows a display of the operational status of subsystems of a vehicle.

FIG. 4 shows a display of subsystems that have been"LOCKED-OUT".

FIGs. 5A and 5B show a flowchart of steps to implement the instant invention.

FIG. 6 shows a detailed view of an electrical circuit.

FIG. 7 shows gate array logic for the instant invention.

FIG. 8 shows a helicopter coupled to an external maintenance computer.

Like reference numbers and designations in the several views indicate like elements.

DETAILED DESCRIPTION OF THE INVENTION The instant invention provides a system to control the operational status of electrical circuits, which as discussed herein are either power control circuits, or subsystems, or a power control circuit and an associated subsystem. The system outputs maintenance mode display data indicating the operational status of the electrical circuits. Power control circuits, such as solid state power control devices (SSPCs), are controlled by programmable maintenance mode capabilities. Once a designated SSPC has been"LOCKED-OUT"through this maintenance mode it will be kept"LOCKED- OUT"until the system is reprogrammed to allow it to be turned"ON"or"OFF".

An"ON"operational state permits operation of the subsystem. An "OFF"operational state permits the subsystem to be turned"ON". A"LOCKED-OUT" operational state prevents operation of the particular subsystem. Usually, only authorized maintenance personnel are permitted to program the SSPCs to"LOCKED- OUT"state,"OFF"and"ON"states can be commanded by either the maintenance personnel or the flight crew. An output display will allow flight crew personnel to receive a list of the operational status of each electrical circuit during power up or on demand. During power outages, the system will retain a prior lock out operational status of an electrical circuit and shall return the electrical circuit to that state when power is restored.

FIG. 1 shows the components of system 10, which includes an external maintenance computer 164 and components of a vehicle electrical system 170. The external maintenance computer 164 is coupled to the vehicle electrical system 170 by a bidirectional data bus 168. The vehicle electrical system 170, as shown, includes an air vehicle interface computer system module (AVICS) 160, mission computer cluster (MCC) 166, crew station display module 108, electric power supply 104, and power system control module 112. It is apparent to those skilled in the art that vehicle electrical system 170 could function with less than all of the components shown.

The external maintenance computer 164 is an intelligent maintenance aid, used to transmit data into a bidirectional data communication interface 168, such as a 1553 data bus. The external maintenance computer 164 is typically a portable PC, such as a lap-top computer, with application software to act as a maintenance aid and perform test procedures on the vehicle electrical system 170. The external maintenance computer 164 is used to generate a list of all vehicle subsystems 146 (a)... (n) (where n is any suitable number that comports with the design specifications of system 10) and an operational status of each of the subsystems 146 (a)... (n). Vehicle subsystems 146 (a)... (n) are also referred to generally as 146 herein. The external maintenance computer 164 has software that enables an operator to scroll through a listing of each subsystem 146 (a)... (n) and establish an operational state of"LOCKED-OUT"for each subsystem 146, and corresponding power control circuit, undergoing maintenance action. Typically the maintenance personnel, also referred to as operators herein, will be required to enter an access code prior to modifying the operational status of any electronic circuits. This access code is suitably a user password.

Once the lock out status of each subsystem 146 (a)... (n), and associated power control circuit 116 (a)... (n), has been determined, the operator saves the data in memory as a lock-out matrix and exits that application of the maintenance program.

Although the data is described herein as being stored in a lock-out matrix, it is apparent to those skilled in the art that the data could be stored as a spreadsheet or listing. The matrix configuration is used as an efficient way to store a particular electronic circuit 116 and a status for that circuit and corresponding subsystem 146. The external maintenance computer 164 transmits the stored information through the bidirectional data communication interface (e. g., data bus) 168 to MCC computer 166, which forwards the data to an intermediate computer, such as an air vehicle interface computer system module (AVICS) 160, which is part of vehicle electrical system 170. In general, the AVICS 160 would not need to be an essential part of a system 170. Upon completion of maintenance procedures, the external maintenance computer 164 is de- coupled from the vehicle electrical system 170 and the vehicle (not shown) can be operated.

The vehicle electrical system 1. 70 includes an AVICS module 160, mission computer cluster 166, crew display output module 108, power system control (PSC) module 112. electric power supply 104 and electronic subsystems 146 (a)... (n), referred to generally herein as numeral 146. The vehicle electrical system 170 is suitably coupled to the external maintenance computer 164 through data bus 168.

The mission computer cluster (MCC) module 166 serves as the central data bus traffic controller for the system 170. It retrieves data and status from all system components during precise, periodic time intervals, performs computations and logic on the data in accordance with preprogrammed directions, and issues commands or displays information back to the components of the system 170 at other precise time intervals. All items connected to data bus 168 thus communicate to the MCC 166, and MCC 166 then forwards data as appropriate. Further, MCC 166 organizes and formats information and status for presentation in a user-desirable format on display 108.

The crew display output module 108 receives and transmits data to and from the MCC module 166. The crew display output module 108 provides output data visually on display screen 132 that shows the present operational state of power control circuits 116 (a)... (n) and thus the operational status of the associated electronic subsystems 146 (a)... (n), respectively of the vehicle electrical system 170. The crew display output module 108 is typically located in the cockpit of the vehicle, where it is readily accessible by flight crew personnel during operation of the vehicle. The crew uses display 108 to input power control commands to the system 170. The display 108 provides a scroll control and power switch to allow each component of system 170 in the vehicle to receive commands. Locked-out systems 146 are indicated and no crew control is available for those systems.

The AVICS module 160 receives data such as the lock-out matrix from the external maintenance computer 164, via data bus 168, which is a bidirectional data communication interface. The AVICS module 160 then transmits the operational status data i. e. lock-out matrix to the PSC module 112, via data bus 148. Data bus 148 is suitably a bidirectional data communication interface, such as an RS-422 data bus.

AVICS module 160 also suitably receives data from the PSC module 112 and transmits that data to the mission computer cluster 166 and external maintenance computer 164, if the external maintenance computer 164 is coupled to vehicle electrical system 170.

Thus, MCC 166, output display 108 and AVICS 160 are in bi-directional communication with one another.

Power system control (PSC) module 112 is in bidirectional communication with AVICS module 160 via bidirectional data communication interface 148, which is suitably an RS-422 data bus. The PSC module 112 comprises a PSC processor module 120, non-volatile memory module 144, gate array module 114, and a plurality of electrical power control circuits 116 (a)... (n) (n is any suitable number that comports with the design of system 10) for example, a typical helicopter has 120 power control circuits 116 (a)... (n). The PSC module 112 controls power distribution to vehicle subsystems 146 (a)... (n) via wires 176 (a)... (n), respectively.

PSC processor module 120 receives operational status data from the external maintenance computer 164 via the MCC166, and typically via AVICS module 160. Alternatively, the PSC processor module 120 could receive the operational status data from the external maintenance computer 164 without the AVICS module 160. Bus 148 is used to transmit data from the AVICS module 160 to PSC processor module 120. PSC processor module 120 stores the operational status data in a limited access, non-volatile memory module 144 via bus 152. Alternatively, the non-volatile memory could be located within PSC processor module 120. The memory module 144 is limited access because in order to modify the contents of the memory module 144, a user password or access code is required. This limited access prevents unauthorized modification of the operational status of power circuits 116. The location of the non- volatile memory is a design choice and is not critical to understanding the invention.

This non-volatile memory is suitably EEPROM memory that stores the operational status data as a lock-out matrix 124 so that the lock-out matrix 124 is not modified by or during power interruption. System programming prevents unauthorized modification of the lock-out matrix 124. Once the external maintenance computer 164 is removed from the vehicle electrical system 170, the maintenance memory module 144 stores the operational status data, shown as lock-out matrix 124, and the processor 120 does not permit modification of the lock-out matrix 124 until external maintenance module 164 is reattached and an authorized password is provided. This typically occurs when the next maintenance or repair procedure takes place, which suitably requires coupling the external maintenance computer 164 to vehicle electrical system 170.

The PSC processor module 120 then retrieves the lock-out matrix 124 from memory module 144 and transmits the lock-out matrix 124, which represents the operational status of all the electronic circuits 116 (a)... (n), to gate array module 114 via bus 152.

Gate array module 114 is suitably a field programmable gate array (FPGA) module that comprises logic and a flip-flop gates, shown as gate logic modules 115 (a)... (n) (where n is any suitable number that comports with the design of the system 10), which correspond to an associated power control circuit 116 (a)... (n). (The power control circuits 116 are also referred to as solid state power controllers, or SSPCs.) The gate array module 114 is coupled to power control circuits 116 (a).. (n) by command lines 186 (a)... (n), respectively. The lock-off state for each SSPC 116 is loaded into the gate array 114 such that each SSPC flip-flop control is either held in a'clear"or"off" state for"LOCKED-OFF"of SSPCs so they can not be energized;ornot-clear so they are controllable. Gate logic module 115 is illustrated in FIG. 7.

As shown in FIG. 7, each gate logic module 115 (a)... (n), (shown generally as numeral 115) shown in FIG. 1 comprises a lock-off input, shown as line 702, which is received by flip-flop 1 (FF1), shown as numeral 706. A second lock-off input is transmitted through gate 704 to FF1, 706. A first output"Q"is transmitted to gate 714 via wire 710. A second output"Q"is transmitted from FF1, 706 to gate 720 via wire 708. Gate 714 also receives off input via wire 712 and outputs a signal via line 716 to flip-flop 2 (FF2), 724. Gate 720 receives on input via line 722 and outputs an input to FF2, 724 via wire 718. FF2, 724 transits an output to the power control circuit via wire 186. The lock-off state is designated"logic 1"sets FF1, which introduces a "clear"input to FF2 and disables the"set"inputs and gate. This prevents an"on" command from any source passing into the PSC and energizing the associated SSPC over output line 186.

Referring back to FIG. 1, the power control circuits 116 (a)... (n) are each coupled to an associated electronic subsystem 146 (a)... (n), via power delivery lines 176 (a)... (n), respectively. The PSC processor module 120 also generates information that is transmitted to mission computer cluster 166 via bus 148 and bus 168 for display on module 108. The output module 108, which is shown as a crew station display. provides crew members information relating to those subsystems 146 that have been designated as"LOCKED-OUT", and those that are otherwise either"OFF"or"ON".

The lock off list can be in the form of an informational status Notice regarding lock-off systems which can be displayed on a screen 132 of output module 108. The mission computer cluster 166 retrieves the"LOCKED-OtTT"status from PSC 112 via AVICS 160 and organizes them into a special warning message on Notice. Then the MCC 166 forwards the Notice to display 108 for immediate visual indication to the flight crew.

The indication interrupts normal display activity so that the flight crew takes unavoidable notice of the systems locked-out at the current time. The crew is them empowered to dismiss the message and continue with normal display activity. This alert feature serves the same function here as the visual scan bv the flight crew of the circuit breaker panel (looking for tie-wrap conditions) used in a conventional vehicle system.

Power control circuits 116 (al... (n), (where n is any suitable number that comports with vehicle electrical system 170) are suitably coupled to the gate array module 114 by commend lines 186 (a)... (n), respectively. The power control circuits 116 (a)... (n), which are typically solid state devices, are used to control electrical current, or power, to an associated vehicle subsystems 146 (a)... (n), respectively, via wires 176 (a)... (n) respectively. The power control circuits 116 (a)... (n) will not provide power to the associated subsystem 146 (a)... (n) if the power control circuit is "LOCKED-OUT"by the gate array. The power control circuits, generally referred to as 116, are controlled by software, which can be running on a processor that is remotely located from the power control circuits 116. When the controller e. g. PSC processor 120 receives instructions from the lock-out matrix 124, the seiected power control circuits will transmit electrical current, i. e., provide power, to the associated electrical subsystem 146. Thus, the operational status of the particular power control circuit 116 (b) will determine whether an associated subsystem 146 (b) receives power. If the power control circuit 116 (b) is designated as"ON", the associated subsystem 146 (b) will receive electrical power. If the power control circuit 116 (b) is designated as "OFF", the associated subsystem 146 (b) will not receive electrical power unless the flight crew personnel, or another subsystem turn the power control circuit"ON". If the power control circuit 116 (b) is designated as"LOCKED-OUT", the associated subsystem 146 (b) will not receive electrical power, regardless of efforts by flight crew personnel or other vehicle subsystems (i. e., MCC 166 or AVICS 160).

Power supply 104 is either an AC or DC power source used to provide electrical power to vehicle electrical system 170. The magnitude of power supply 104 is typically 270 volts, although any suitable power supply could be used. The power supply 104 is coupled to each power control circuit 116 (a)... (n) via wires 188 (a)... (n), respectively.

Electronic subsystems 146 (a)... (n), as stated above, are each associated with a corresponding power control circuit 116 (a)... (n), respectively. These subsystems 146 (a)... (n) are, for example, utility lights, cockpit back-up fan, turret gun control and other subsystems in a helicopter. They are listed in a maintenance mode look-up table such that maintenance personnel, using external maintenance computer 164, are able to set the operational status of the associated power control circuit 116 to lock-off if desired.

FIG. 6 shows a detailed view of a particular electrical circuit 600 (a) that includes a power control circuit 116 (a) and a subsystem 146 (a). The embodiment of FIG. 6 shows that the power control circuits, generally referred to as numeral 116, and an associated subsystem, generally referred to as numeral 146 of FIG. 1 form a single unit 600 (unit 600 (a) specifically shown in FIG. 6). Power control circuit 116 (a) includes a switch 117 (a) that is controlled by an associated gate logic module 115 (a) of gate array module 114, via wire 186 (a). The switch 117 (a) controls power transmission to subsystem 146 (a) by its position.

FIG. 2 shows a flow chart 20 used to describe the functional lock-out software of the instant invention used to"LOCK-OUT"a power control circuit and the corresponding electrical subsystem. As shown in FIG. 2, following start block 206, block 208 receives a command to turn"ON"a particular power control circuit. This command is suitably received via a bidirectional data communication interface, such as an RS-422 data bus, or internally gated"ON". If the power control circuit is not commanded"ON", the operational status of the power control circuit does not need to be determined and line 210 shows the end block 222 is the next step. If the power control circuit is commanded to turn"ON", line 212 leads to block 214, which shows that a check is performed to determine whether the particular power control circuit, and thus the associated electrical subsystem, is listed as"LOCKED-OUT". In such a case, the particular power control circuit will not receive electrical power, and thus, the associated subsystem will not receive power. If the particular power control circuit is designated"LOCKED-OUT", line 216 shows that end block 222 is reached. If the particular power control circuit is not"LOCKED-OUT", the power control circuit is energized, or receives electrical power, as shown by line 218 leading to block 220.

Line 224 shows that decision block 221 determines whether additional power control circuits, also referred to as SSPCs, are in the array. If"YES"line 226 leads to block 208. If there are no more SSPCs, line 223 shows that end block 222 is reached.

FIG. 3 shows a maintenance mode display page 30 that displays a listing of 147 (a)... (n) each subsystem of the vehicle and the present operational status of each subsystem 302 (a)... (n). This maintenance mode display page 30 enables a user to scroll through the list to determine whether the status has been determined"ON", "OFF"or"LOCKED-OUT". Typically only maintenance personnel will have authorization, through an access code, to reconfigure the operational status of the subsystems id lock-out. This is typically done by coupling an external maintenance computer to the vehicle. Maintenance personnel, using software that produces the display page 30, scroll through the list and set the operational status of each subsystem listing 147 (a)... (n) and thus the corresponding power control circuit. They are authorized to alter the data matrix, with those subsystems needing repair designated as "LOCKED-OUT". This operational data matrix, also referred to as a lock-out matrix, is transmitted to a control module, such as the PSC module described in FIG. 1, where it is stored in limited access non-volatile memory. Typically, once the operational data matrix has been stored in memory, crew members will not be able to energize subsystems that have been"LOCKED-OUT"or otherwise modify the operational data matrix. The control buttons of the output device are shown as elements 304-322.

As shown in FIG. 4, the crew members can access the operational data matrix to obtain information related to those subsystems that have been"LOCKED- OUT"by maintenance personnel. This provides information to crew members as which subsystems cannot be energized during operation of the vehicle.

The operational data display 35 highlights only the subsystems designated as"LOCKED-OUT", thereby enabling the crew members to view only non- operational subsystems. The listing of each subsystem is shown as 147 (b)... (i) and the listing of the associated status is shown as 302 (b)... (i).

FIGs. 5A and 5B are a flow chart 40 of steps, which are suitably stored on a computer readable medium to implement the instant invention. The steps include start block 402, followed by block 404. In block 404 a maintenance mode look-up table is displayed using an external computer module. An operator, using an external computer, establishes the operational status of the subsystems, and thus, the associated power control circuits as"LOCKED-OUT"as shown in block 405. The status "LOCKED-OUT"indicates that the subsystem is not capable of receiving electrical power due to repair needs or maintenance requirements. The"LOCKED-OUT"status prevents the subsystem from receiving electrical power by placing the associated gate array power control flip-flop circuit in a"LOCKED-OUI"'or"LOCKED-OFF"state.

Thus, the power control circuit prevents the associated subsystem from receiving electrical power. The result of establishing an operational status of each subsystem is a lock-out matrix. An"ON"state means that the power control circuit is transmitting power. An"OFF"state means that although the power control circuit is not transmitting power, it is capable of being turned"ON".

As shown in block 406 electrical power is removed from circuits designated as"LOCKED-OUT". As shown in block 408, the maintenance mode look up table is logged out, thereby preventing modification of the lock-out matrix by unauthorized personnel or, alternatively, by members of the crew who wish to modify the power status of various subsystems.

As shown in block 410, lock-out matrix transmitted from the external computer module to a storage medium via a data bus. As shown in block 412, the lock- out matrix is stored in non-volatile limited access memory to prevent modification if power is interrupted in the system or other subsystems or flight crew personnel attempt to access a subsystem that has been designated as"LOCKED-OUT". This enables the lock-out matrix to maintain its present status regardless of power surges and/or power interruptions. The stability of the lock-out matrix increases the safety of the vehicle since the power control circuits associated with lockcd-out subsystems prevent electrical power from being transmitted to those subsystems. As shown in block 414, the lock-out matrix is transmitted to a gate array module. The gate array module controls the state of electronic circuits according to the lock-out matrix data.

As shown in block 416, data regarding those subsystems that have been "LOCKED-OUT"is output to an output terminal. This output terminal is typically a crew station display that enables the flight crew members to have information relating to electronic circuits that have been locked out and, thus, information relating to subsystems that are unavailable for use.

As shown in block 418, electrical power can be provided to those subsystems that are designated as operational i. e. either"ON"or"OFF". As shown in block 420, electronic circuits that are operational can receive commands and function as designed.

Block 422 is a decision block that determines whether additional maintenance and/or repair actions are required. If so line 434 shows an external maintenance computer can be connected to the vehicle as shown in block 424. In order to modify the lock-out matrix, an authorized access code must be used, as shown in block 426. Line 428 shows that once an authorized access code has been received form the external maintenance computer, the look-up table rnay be modified to generate a modified lock-out matrix. The process then repeats with the modified lock-out matrix.

If additional maintenance and/or repair is not required line 430 leads to end block 432.

FIG. 8 shows a vehicle, specifically a helicopter, 800 coupled to an external maintenance computer 164, via bus 168. Once a maintenance procedure is complete, the external computer 164 is detached from the vehicle 800.

An example of the system described herein will now be discussed using reference to FIGs. 1-8. This example is merely one embodiment of the instant invention and is not intended as limiting the invention to the example discussed. It is readily apparent to those skilled in the art that the instant invention has applications to other power supply systems.

A helicopter, with a plurality of subsystems, experiences a malfunction of the turret gun subsystem (TGS). The helicopter is connected to an external module that displays a list of each subsystem (maintenance mode look-up table). (See FIG. 3) The maintenance personnel scrolls through the maintenance mode look-up table until the TGS listing is displayed. The TGS listing is toggled between"ON","OFF"and "LOCK-OUT". The maintenance personnel toggles to"LOCK-OUT"since the TGS subsystem is in need of repair. The maintenance personnel can also establish the setting of other subsystems if desired. For example, a subsystem related to the TGS, such as a TGS fan, might also be"LOCKED-OUT"to prevent operation of the TGS fan while the TGS is non-operational.

Once the maintenance personnel has established the operational status settings for the subsystems, (i. e., generated a lock-out matrix) the software program is closed and the external module is disconnected from the vehicle. The lock-out matrix is transmitted to non-volatile memory located in the vehicle electronic system to prevent modification of the matrix. This memory is typically EEPROM.

When the helicopter is started, the helicopter generators come on-line and the PSC module loads the stored lock-out matrix data into the FPGA module. At this point, each power control circuit has a designated operational state; either"ON", "OFF"or"LOCKED-OUT". An advisory display to the flight crew i. e., pilot, indicating those power control circuits that are"LOCKED-OUT". (See FIG. 4) Thus, the pilot knows which subsystems are not operational before commencing flight operations. The pilot then operates the vehicle with knowledge of subsystems that are not functioning. The pilot is aware that the"LOCKED-OUT"subsystems will not function during that operation of the helicopter. In some circumstances, flight crew personnel will be authorized to modify the operational status of electronic circuits by entering a password during vehicle operation. This would typically only be permitted in an emergency situation in which the risk of having a"LOCKED-OUT"electrical circuit receive power is necessary to prevent more serious harm.

Although the above description is described in terms of a vehicle, such as an aircraft or helicopter, it is readily apparent to those skilled in the art that this system can also be applied to any electronic system in which a power supply and electronic circuits are utilized in conjunction such that it would be desirable to maintain a particular designated operational status of particular electronic circuits. For example, such a system can be applied to a residential housing structure. In this embodiment, home appliances, such as oven. range and dishwasher would be connected to power control circuits, for example, circuit breakers. The status of the circuit breakers is stored in a processor module. A repair technician programs the status of each power control circuit prior to working on a designated appliance. This prevents the appliance from receiving electrical power until the technician programs the power control circuit from"LOCKED-OUT"to an"ON"or"OFF"state. This enables a technician to safely repair home appliances without the worry of shock or unintended electrical current shorting out an appliance under repair.

While the invention has been described above with reference to specific embodiments thereof, it is apparent that many changes, modifications and variations can be made herein. Accordingly, it is intended to embrace all such changes, modifications and variations that fall within the spirit and broad scope of the appended claims.