Flight control system and method of aircraft

Abstract

The invention relates to a flight control system which comprises three flight control computers, and each flight control computer comprises an I / O board used for receiving input signals of one path of a cockpit control device signal and a sensor signal of a cross-linked interface system and outputting the input signals of the other path of the cockpit control device signal and the sensor signal of the cross-linked interface system; after the input signals are simply processed, the processed input signals are forwarded to the computing board, the backup board and other flight control computers, meanwhile, remaining cockpit control device signals and interface signals sent by other computers are received, and control instructions are output to actuators of corresponding control surfaces; the three calculation boards are used for calculating a corresponding control instruction based on a control law according to the received input signal and forwarding the control instruction to the I / O board; the backup board is used for entering a pre-position state when the computing board of the flight control computer fails; wherein when the backup boards of all the flight control computers enter the pre-position state, the flight control system enters the backup mode, and the backup boards calculate backup control instructions and transmit the backup control instructions to the actuators of the corresponding control surfaces.

Description

Technical Field

[0001] This application relates to the flight control field of aircraft, in particular to a flight control solution for a (large) aircraft. Background Art

[0002] During the entire life cycle of the design, research, development, manufacturing, and operation of large aircraft, safety always takes the leading position. The flight control system is a critical flight system, and its safety is even more crucial.

[0003] Existing aircraft manufacturers have each specifically designed various types of flight control system architecture systems for various models of large aircraft they developed.

[0004] However, the design of the existing flight control systems of aircraft has always had the following problems:

[0005] 1) There is a risk of common mode failure in the flight control system computer, which may cause all redundant computers to fail, leaving the aircraft in an uncontrollable state and unable to fly and land safely. During the airworthiness certification process, the common mode problem has always been highly regarded by the regulatory authorities, and how to solve this problem has always been the focus of their attention.

[0006] Specifically, the common mode problem of the flight control system refers to the phenomenon that due to the same reason or the same design error, some faults or errors in the flight control system simultaneously affect multiple redundant channels or subsystems, resulting in the simultaneous failure of the multiple redundant channels or subsystems. This failure mode will destroy the redundancy of the system, causing the system to be unable to detect or correct errors through redundant design, rendering the redundant design originally used to improve reliability ineffective, thus triggering serious safety hazards.

[0007] There are various reasons for the occurrence of the common mode problem, but one important reason is a design defect, that is, multiple redundant channels share the same hardware or software design, which causes the same error to affect all channels simultaneously. For example, all channels use the same sensors, processors, or algorithms.

[0008] In order to prevent the common mode problem, additional detection and protection mechanisms need to be added to the system design, increasing the complexity of the system.

[0009] 2) On the other hand, with the rapid development of digital technology and chips, the degree of computer integration is getting higher and higher, and flight control computers also tend to develop towards high integration. The original low-integration flight control architecture is no longer very suitable for today's industry development, and there is an urgent need to propose a new flight control system architecture suitable for today's industry development.

[0010] 3) Currently, these several types of flight control system architectures respectively have the disadvantages of complex redundancy / reconfiguration relationships or weak backup capabilities.

[0011] For example, in some fly-by-wire control system architectures, the primary and secondary computers adopt complex redundancy configurations and fault reconstruction logics, but do not adopt a complete dissimilar design or backup design.

[0012] In terms of more-electric design in some fly-by-wire system architectures, only the actuators of some spoilers and horizontal stabilizers adopt power fly-by-wire actuation technology, and minimum control cannot be achieved only by these actuators. When all hydraulic systems fail, the safe flight and landing of the aircraft cannot be guaranteed.

[0013] There are also some existing fly-by-wire system architectures that adopt the form of multiple primary / secondary computers stacked with a backup control module (BCM, Backup Control Module). Their control logics such as fault reconstruction are extremely complex, and the number of devices is relatively large. Moreover, the introduction of the backup computer will bring many problems such as an increase in the redundancy of cockpit sensors, an increase in weight, and a complex system switching logic.

[0014] For the above reasons, there is a need to provide an aircraft fly-by-wire control system and method with a simplified structure and backup control capabilities. Summary of the Invention

[0015] The present application proposes a new triple-redundancy, dissimilar, backup control-capable flight control system (also simply referred to as "fly-by-wire control system"). Three-channel flight control computers are designed, and three dissimilar computing modules (computing boards) are designed inside each flight control computer for calculating control laws in normal mode and auxiliary mode. At the same time, the primary computer integrates a backup control module, which not only solves the common-mode problem of flight control computers, but also reduces the number of LRU devices, improves the integration level and safety level of flight control computers, and conforms to the development trend of future fly-by-wire control systems. Moreover, the fly-by-wire control system proposed in the present application can achieve the minimum acceptable control of the aircraft in each control mode, ensuring the safe flight and landing of the aircraft.

[0016] According to the first aspect of the present application, a flight control system is provided, including:

[0017] Three flight control computers, where each flight control computer includes:

[0018] An I / O board configured to receive an input signal of one of the cockpit control device signals and the sensor signals of the cross-linked interface system, forward the processed input signal to the computing board, the backup board, and other flight control computers after simple processing, receive the remaining cockpit control device signals and interface signals sent by other flight control computers, and output control instructions to the actuators of the corresponding control surfaces;

[0019] Three computing boards configured to calculate corresponding control instructions based on the received input signals according to the control laws and forward the control instructions to the I / O board; and

[0020] A backup board, configured to enter an armed state when the computing board of the flight control computer fails;

[0021] Wherein, when the backup boards of all flight control computers enter the armed state, the flight control system enters a backup mode, and the backup board calculates backup control commands and transmits them to the actuators of the corresponding control surfaces.

[0022] According to a second aspect of the present application, there is provided a flight control method, including:

[0023] At each flight control computer in a flight control system having three flight control computers:

[0024] Receive an input signal of one of the cockpit control device signals and the sensor signals of the cross-linked interface system;

[0025] Receive input signals of the other two cockpit control signals and the sensor signals of the cross-linked interface system from all other flight control computers;

[0026] Perform signal voting, monitoring, and calculate control commands based on a control law according to the received input signals;

[0027] Output the control commands to the actuators of the corresponding control surfaces;

[0028] The actuator drives the corresponding control surface associated therewith to perform a corresponding movement according to the received control command;

[0029] Wherein, the flight control method further includes:

[0030] When the computing board of the flight control computer fails, the backup board of the flight control computer enters an armed state;

[0031] When the backup boards of all flight control computers enter the armed state, the flight control system enters a backup mode, and the backup board calculates backup control commands and transmits them to the actuators of the corresponding control surfaces.

[0032] This summary is provided to introduce in a simplified form some concepts that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. Description of the Drawings

[0033] To describe the manner in which the above and other advantages and features of the present application can be obtained, a more specific description of the present application briefly described above will be presented by referring to specific embodiments of the present application shown in the accompanying drawings. It is understood that these drawings only depict typical embodiments of the present application and are therefore not considered to limit its scope. The present application will be described and explained by using the drawings and by utilizing additional features and details. In the drawings:

[0034] Figure 1 An example structural diagram of a flight control system of a (large) aircraft according to an embodiment of the present application is shown.

[0035] Figure 2 A schematic diagram showing the configuration of aircraft control surfaces according to an embodiment of the present application is shown.

[0036] Figure 3 An example flowchart of a flight control method of a (large) aircraft according to an embodiment of the present application is shown.

[0037] Figure 4 Three working modes of a flight control system according to an embodiment of the present application and their interrelationships are shown.

[0038] Figure 5 A logic control diagram of the flight control system under normal operating conditions is shown.

[0039] Figure 6 A logic control diagram of the flight control system in an auxiliary mode after degradation when part of the interface signals or cockpit signals are lost is shown.

[0040] Figure 7 A logic control diagram of the flight control system when the computing board of flight control computer 1 fails is shown.

[0041] Figure 8 A logic control diagram of the flight control system when the computing boards of flight control computers 1 and 2 fail is shown.

[0042] Figure 9 A logic control diagram of the flight control system when the computing boards of all three flight control computers fail is shown.

[0043] Figure 10 A logic control diagram of the flight control system when a type of REU fails is shown. Detailed Description of the Embodiment

[0044] This application proposes a new flight control scheme with backup control capabilities, which can avoid the common mode problem of flight control computers, and the main computer integrates backup control capabilities, which can reduce the number of LRUs (Line Replaceable Units) while also enhancing the backup capabilities.

[0045] The following will further elaborate on this solution in conjunction with the accompanying drawings and embodiments. However, the disclosed content is merely provided for illustrative purposes and does not serve as a basis for any restrictions on this application.

[0046] In Figure 1 is shown an example structural diagram of a flight control system of a (large) aircraft according to an embodiment of the present application.

[0047] Generally speaking, in the solution of the present application, taking the rudder surface configuration of a typical single-channel large aircraft as an example (configured with 1 pair of ailerons, 1 pair of elevators, 1 rudder, 1 horizontal stabilizer, 5 pairs of spoilers, and 3 sets of hydraulic systems), the energy and computer control of the 3 control channels of the flight control system can be allocated. It should be understood that this embodiment is merely given as an example for the explanation and illustration of this solution. For other channel configuration methods with more rudder surfaces, or aircraft with other configurations such as using 2 sets of hydraulic systems and one electric propulsion system (where hydraulic energy is replaced by electrical power), they can also be adaptively adjusted as needed based on this example to implement the said solution.

[0048] According to the invention content and corresponding design features of the present application, the example physical architecture of the flight control system is as Figure 1 shown:

[0049] Figure 1 In, the flight control system is divided into three control channels, corresponding to three flight control computers (Flight Control Computer 1, Flight Control Computer 2, Flight Control Computer 3). Each flight control computer is internally provided with three non-similar computing boards, a backup board, and an I / O board.

[0050] Specifically, this solution provides a flight control system, including:

[0051] Three flight control computers, where each flight control computer includes:

[0052] An I / O board, configured to receive an input signal of one of the cockpit control device signals and the sensor signals of the cross-linked interface system, forward the processed input signal to the computing board, the backup board, and other flight control computers after simple processing, receive the remaining cockpit control device signals and interface signals sent by other flight control computers, and output control instructions to the actuators of the corresponding rudders.

[0053] Three computing boards, configured to calculate corresponding control commands based on a control law according to received input signals and forward the control commands to the I / O board; and

[0054] A backup board, configured to enter an armed state when the computing board of the flight control computer fails;

[0055] Wherein, when the backup boards of all flight control computers enter the armed state, the flight control system enters a backup mode, and the backup board adopts direct control from the stick to the rudder, and transmits the control command to the actuator of the corresponding rudder surface.

[0056] Due to the existence of three control channels, the signals of the cockpit control devices and the sensors of the cross-linked interface system are divided into three paths. Each control channel receives approximately 1 / 3 of the data signals, and the I / O boards in each flight control computer perform analog-to-digital conversion and signal processing on the received part of the signals. Subsequently, each I / O board forwards the processed signals to its own computing board and backup board respectively on the one hand, and also forwards them to the I / O boards of other flight control computers on the other hand. For example, 1 / 3 of the data signals received by the I / O board of flight control computer 1 will be forwarded to flight control computer 2 and flight control computer 3, and so on. Therefore, under normal circumstances, each flight control computer finally obtains complete input signals.

[0057] Flight control computer 1, flight control computer 2, and flight control computer 3 can adopt the master / master / master working mode, or the master / backup / backup working form (one is the master at the same time, and the rotation is carried out according to calendar days or flight sorties), and respectively control approximately 1 / 3 of the actuators and their REUs. In particular, in a typical flight control architecture, the horizontal stabilizer and the elevators on the left and right sides form a complete pitch control. As long as two of the horizontal stabilizer and the left and right elevators work normally, the requirements for safe flight can be met. Therefore, in this architecture, flight control computer 2 only needs to control two elevator rudder surfaces and is not connected to the REU of the horizontal stabilizer. In this way, even if the control of the horizontal stabilizer fails after the failure of flight control computers 1 and 3, the aircraft can still fly safely under the operation of the left and right elevators controlled by flight control computer 2.

[0058] Each flight control computer I / O board card outputs a voted control command and supplies pressure to the controlled actuator associated with an independent hydraulic system on the aircraft.

[0059] The flight control computers 1, 2, and 3 adopt the same design and can be interchanged; the three computing boards inside each flight control computer and the REUs of the actuators adopt dissimilar designs (for example, two types of REUs are used) to mitigate the common-mode impact. The dissimilar design can be understood in combination with the avionics system standard ARP4754. That is to say, two design teams and two sets of requirements can be adopted at the entire design process level; two different types of chips or processors, etc. can be adopted at the hardware level; and different editors and logics, etc. can be adopted at the software level.

[0060] The flight control system is divided into three control channels by three flight control computers. According to the design features of this application, the channel configurations of each control surface are as Figure 2 shown.

[0061] Here, it is only taken as an example. In principle, any flight control computer control channel can ensure the safe flight and landing of the aircraft.

[0062] Specifically, this application designs a new flight control system architecture configured with multiple control channels (in this example, "three channels", also known as "triple redundancy"). Each of the three control channels is configured with a flight control computer. These three flight control computers respectively receive cockpit sensor signals and external interface system signals, and communicate with each other to ensure that the instructions received by each flight control computer are complete. Each flight control computer calculates control instructions based on the received all signals according to the corresponding control law and transmits them to the I / O (input / output) interface board. The I / O interface board transmits the control instructions to the corresponding control surface actuator, thereby driving the control surface to move.

[0063] In addition, a backup board is integrated inside each flight control computer to implement the backup control function. Moreover, an aircraft rate sensor is integrated in the flight control computer architecture of this application. It is equivalent to a backup of the inertial navigation data and can provide the attitude information necessary for aircraft control in the backup mode.

[0064] When two or three branches of a single flight control computer fail, the backup board of this flight control computer enters the armed state. The armed state means that this computer no longer outputs instructions and at the same time waits for other computers to also enter the armed state.

[0065] When all the backup boards of the three flight control computers enter the armed state, the flight control system enters the backup mode. In this backup mode, the backup boards of each flight control computer are activated and start to take over flight control. The backup board first receives the input signal of the path connected to it and the signal of the aircraft rate sensor, and then based on the signals, adopts a simple direct control from stick to rudder, transmits the control command to the corresponding control surface, and realizes simple control of the aircraft, ensuring that the aircraft can still fly and land safely after the normal mode or the auxiliary mode fails.

[0066] Meanwhile, in order to avoid the common mode phenomenon, the redundant remote electronic unit (REU) in the actuation system adopts a dissimilar design ( "dissimilar" means "different hardware structures, or the same hardware executes different operation logics", etc.) to prevent the same error from affecting the work of all REUs simultaneously.

[0067] It should be understood that the specific structure of the flight control system disclosed in the embodiments of the present application is only given as an example and is not limited thereto. For example, the flight control system may have more control channels (redundancies), that is, more flight control computers, such as four control channels (quadruple redundancy) or more. And the flight control computer may have more branches (computing boards). However, the number "three" is the most preferred solution because less than three cannot implement the voting mechanism, and more than three will cause waste in hardware and is not economical enough. What is disclosed in the embodiments is only the preferred configuration, and flight control systems with other configurations can also apply the solution of the present application and also belong to the scope protected by the present application.

[0068] First of all, from a functional perspective, the flight control system proposed in the present application is mainly composed of three parts: "control signal input", "flight control computer", and "actuation system". The functions of each part are specifically described as follows:

[0069] 1) "Control signal input" part: The input signals received by the flight control system mainly include the input signals of the cockpit control devices and the sensor signals input by the interface system cross-linked with the flight control system. The cockpit control devices mainly include side sticks (or stick wheels), pedals, speed brake levers, trim switches, etc. These devices provide basic pilot input commands for three-axis control. The flight control system interface system mainly includes avionics systems (atmospheric data systems, inertial navigation systems, display and crew alerting systems, etc.), energy systems (power systems, hydraulic energy systems), and mechanical systems (landing gear systems and brake systems, etc.). These systems provide corresponding sensor signals and power to the flight control computer, and provide hydraulic energy to the actuators, which are used to support the flight control system to realize three-axis control of the aircraft;

[0070] 2) "Flight Control Computer": The flight control computer proposed in this application includes three non-similar computing boards (referred to as "computing boards"), a backup control board (referred to as "backup board"), and an input / output interface board (referred to as "I / O board"). Each computing board forms a control branch. The specific design of the flight control computer is as follows:

[0071] a) The three-channel (redundant) flight control architecture proposed in this application is configured with three flight control computers

[0072] The two machines can communicate with each other to perform signal processing, voting, integration and control instruction resolution. Each flight control computer is equipped with three non-similar computing boards ("non-similar" means "different hardware structures, or the same hardware executing different operating logic", etc.). Each computing board contains complex electronic hardware (such as processors, FPGAs, etc.) and software. Its design is complex and highly integrated. It can provide various flight control systems with pitch / roll / yaw control, envelope protection, stabilization and other functions, achieving high-quality flight control. For example, some common flight control systems, such as APM and PIX, usually use computing boards of specific models and configurations. For example, the APM flight control system may use APM2.5 or newer computing boards, while the PIX flight control system may use Pixhawk PRO and other models of computing boards.

[0073] The computation board receives input signals from cockpit controls and sensor signals from the interface system, as well as signals from the I / O boards of the two flight control computers. It then performs signal voting, monitoring, and calculations. The signals from the three computation boards are compared and voted on by the I / O board before being sent to the corresponding actuators. The actuators then drive the control surfaces according to the received control commands.

[0074] To improve system reliability and safety, flight control computers often employ redundant hardware, such as a three-branch computing board. This redundant hardware provides multiple signal outputs. To select the correct and reliable signal from these signals, the flight control computer employs a comparison and voting mechanism.

[0075] The core concept of the comparative voting mechanism is to compare and analyze the signals output by multiple branches, using pre-set voting logic to determine which signal or signals are valid. This typically involves evaluating the signal's consistency, accuracy, and reliability. If a branch's signal differs significantly from other branch signals or falls outside a pre-set range, it is deemed invalid and isolated to prevent adverse effects on flight control.

[0076] In the design of the voting mechanism of the flight control computer in this embodiment, a three-branch (voting among three computing cards) voting logic is adopted. However, it should be understood that this is only given as an example and not limited thereto. The selection of the number of branches of the voting logic depends on the requirements of the aircraft / system for signals and the trade-off of factors such as hardware cost and architecture complexity. Through reasonable voting logic design, the availability and integrity of signals can be maximally improved, thus ensuring flight safety. For example, a flight control computer with four branches and hybrid redundancy is also applicable to this application.

[0077] b) The computing board executes different control law calculations according to the integrity of the received input signals. The control law is a control algorithm implemented inside the computer, which calculates the controller output based on the real-time system state and reference signals (such as pilot input or autopilot instructions).

[0078] These control instructions will be sent to the actuators (such as servos, motors, etc.) to achieve precise control of the aircraft attitude, heading, speed, etc. Among them, if the voting of the received key interface signals is successful, the normal control instructions are calculated according to the control law in the normal mode; when the voting of the received key interface signals fails, the computing board calculates the auxiliary control instructions based on the control law in the auxiliary mode, and the flight quality achieved is lower than that in the normal mode.

[0079] Among them, the normal control instructions generated in the normal mode are full-function control instructions, including basic

[0080] (three-axis) control functions, envelope protection, stability augmentation, and other functions. The auxiliary control instructions in the auxiliary mode only include basic control functions and do not have the latter several functions, and can only achieve basic control

[0081] The auxiliary control law is not as complex as the normal control law in the normal mode.

[0082] c) A backup board is integrated inside the flight control computer. Generally speaking, its design is simpler than that of the computing board, it may not have software on it, and it is completely independent of the computing board in function. When two or three computing boards fail, the backup board of this flight control computer enters the armed state. At this time, the signals received by the I / O board of this flight control computer are normally sent to other flight control computers, but this flight control computer will not output control instructions to the actuators.

[0083] Among them, any effective flight control computer can achieve the minimum acceptable control of the aircraft, because each flight control computer can control about 1 / 3 of the actuators and corresponds to an independent hydraulic system on the aircraft. Therefore, even if the computing boards of two flight control computers fail simultaneously, the flight control system can still complete the flight control of the control surfaces.

[0084] After the backup boards of all flight control computers enter the armed state, the entire flight control system enters the backup mode. In this mode, each flight control computer only uses the cockpit sensor signals received by its own I / O board (such as side stick and pedal sensor signals) to calculate the backup control commands of the flight control system and control the movement of the rear actuators. At this time, the handling quality is slightly reduced, but it can still meet the requirements of safe flight and landing.

[0085] d) Rate sensors are integrated inside the flight control computer, which can provide inputs for the auxiliary mode and backup mode to ensure the calculation of control commands in the auxiliary mode and backup mode and achieve the control of the control surfaces in the degraded mode.

[0086] 3) "Actuation system" part: Each control surface actuator receives the control commands sent by the flight control computer and drives the control surface to move according to the received control commands. To improve safety, the remote electronic unit (REU) that controls each control surface actuator adopts a redundant design. In the original technical solution, since the redundant REUs use the same software and hardware, common mode phenomena are likely to occur.

[0087] However, this application designs two different types of REUs, both of which adopt a dissimilar design of the command / monitoring architecture inside. The development assurance level of the complex electronic hardware and software is A (the "development assurance level (DAL)" is a key safety level concept in avionics systems and can be found in relevant content in DO-178C and DO-254 standards), which is used to mitigate the common mode impact of the actuation system and ensure the high integrity of the signals output to the actuators.

[0088] In this schematic structural framework of the flight control system, as long as any one of the three flight control computers exists, it can control 1 / 3 of the flight control actuators of the whole aircraft, meet the minimum acceptable control of the aircraft, and ensure the safe flight and landing of the aircraft. The three flight control computers form the core of the three control channels of the flight control system, and each control channel corresponds to an independent hydraulic system. The redundant computing boards and REUs adopt a dissimilar design to avoid the occurrence of common mode phenomena.

[0089] After describing the specific schematic structure of the flight control system of this application, the following combines the attached Figure 3 Describe an example process of a flight control method for a (large) aircraft according to an embodiment of this application.

[0090] First, as shown in the figure, at each flight control computer in a flight control system with three flight control computers (i.e., three control channels or three redundancies):

[0091] In step 31, receive the input signal of either the cockpit control device signal or the sensor signal of the cross-linked interface system.

[0092] Meanwhile, in step 320, the flight control computer receives the other two cockpit control signals from all other flight control computers and the sensor signals of the cross-linked interface system.

[0093] Subsequently, in step 330, the computing board of the flight control computer performs signal voting and monitoring based on the received signals and calculates control commands based on the corresponding control laws.

[0094] Next, in step 340, the flight control computer sends its own control commands to the corresponding actuators.

[0095] Finally, in step 350, the actuator drives the associated control surface to perform corresponding movements according to the received control commands.

[0096] Among them, the control commands may include: functions such as pitch / roll / yaw control of various flight control systems, envelope protection, stability augmentation, and display warning, etc., to achieve high-quality flight control. And, as described above, the control commands may include three types: normal control commands, auxiliary control commands, and backup control commands.

[0097] Specifically, in the embodiment of the present application, each flight control computer includes three branches, that is, 3 dissimilar computing boards. In order to screen out correct and reliable signals from the signals of these branches, in step 330, the flight control computer will adopt the following comparison and voting mechanism.

[0098] The comparison and voting mechanism includes voting among the input signals received by these computing boards (the signals received by itself and the signals received from other flight control computers). If the voting of the received key interface signals is successful, the normal control commands are calculated according to the control laws in the normal mode; when the voting of the received key interface signals fails, the computing board calculates the auxiliary control commands based on the control laws in the auxiliary mode, and at this time, the flight quality achieved is lower than that in the normal mode.

[0099] The comparison and voting mechanism also includes voting among the control commands output by these computing boards. When the voting of the control commands of two or three computing boards fails, the backup board of this flight control computer enters the armed state. At this time, the input signals received by the I / O board of this flight control computer are still normally sent to other flight control computers for voting, but this flight control computer will not output control commands to the actuators.

[0100] Among them, any effective flight control computer can achieve the minimum acceptable control of the aircraft, because each flight control computer can control approximately 1 / 3 of the actuators and corresponds to an independent hydraulic system on the aircraft. Therefore, even if the computing boards of two flight control computers fail simultaneously, the flight control system can still complete the normal flight control of the control surfaces with the remaining one effective flight control computer.

[0101] When all the computing boards of the flight control computers fail (i.e., the backup boards of all flight control computers enter the armed state due to the failure of the computing boards), the entire flight control system enters the backup mode to execute the backup function. In this backup mode, this flight control computer only uses the cockpit sensor signals received by this I / O board (sensor signals such as side sticks and pedals) to calculate the backup control commands of the flight control system and control the movement of the rear actuators. At this time, simple / direct flight control is achieved. Therefore, the handling quality is reduced, but it can still meet the requirements of safe flight and landing.

[0102] Among them, the REUs of each control surface actuator adopt dissimilar designs, and instruction channels and monitoring channels are arranged inside, which can achieve high integrity.

[0103] In summary, combined with the design features of this application, there are three working modes and their interrelationships in the flight control system of this solution, as Figure 4 shown.

[0104] As shown in the figure, when the system is working properly, the flight control computer can receive complete input signals through the I / O board, calculate normal control commands, and send the normal commands to the corresponding REUs of the corresponding actuators to drive the control surfaces to move.

[0105] When the received input signal fails (for example, the key interface signal voting fails), the flight control computer enters the auxiliary mode. When all the computing boards of all (three in this example) flight control computers fail, the flight control system enters the backup mode. Therefore, the flight control system of this application can perform fault reconstruction using the multiple working modes according to the surviving devices, and after reconstruction, it is ensured that the system can meet the requirements of a single-failure system operation and still be safe in case of two failures.

[0106] It should be understood that in the above embodiments, although the actuator uses a hydraulic mechanism, in fact, the solution of this application is also applicable to electric propulsion actuators and other types of actuators.

[0107] Example

[0108] Below, in Figures 5 - 10 is shown the schematic logic control diagram of the flight control system of this application under various working conditions.

[0109] 1) Normal mode working condition: When the received input signals (such as atmosphere / INS and other sensor signals) are complete (voting successful) and all flight control computers are working properly, the system is in the normal mode, and the computing board of the flight control computer calculates normal control commands according to the control law of the normal mode. Figure 5 Shows the logic control diagram of the flight control system under normal working conditions.

[0110] 2) Auxiliary mode operating condition: When the information part of the received input signal is lost, resulting in the loss of the key interface signal for voting or the loss of the cockpit signal, and it is insufficient to support the integrity of the normal commands of the flight control computer, the system will degrade into the auxiliary mode, and the computing board of the flight control computer will calculate the auxiliary control commands according to the control law of the auxiliary mode. Figure 6 The logic control diagram in the auxiliary mode after the degradation of the flight control system when the interface signal or the cockpit signal is partially lost is shown.

[0111] 3) The failure conditions of the computing board of the flight control computer can be divided into the following situations:

[0112] a) After any computing board of any one flight control computer fails, the other two computing boards can still output normally. At this time, the voted control commands are valid, which has no safety impact on the system, and the system still operates in the normal mode;

[0113] b) After any computing board of any two flight control computers fails, since the voted control commands are still valid, there is no safety impact on the system at this time, and the system still operates in the normal mode;

[0114] c) After any two or three computing boards (branches) of any one flight control computer fail (taking flight control computer 1 as an example here), there are no available voted control commands for this computer. According to the design logic, the backup board enters the armed state, and this computer no longer outputs control commands. It can be considered that this computer is lost. At this time, about 2 / 3 of the control surfaces of the entire flight control system are still controllable, which can meet the minimum acceptable control of the flight control. Figure 7 The logic control diagram of the flight control system when the computing board of flight control computer 1 fails is shown.

[0115] d) After the computing boards of any 2 flight control computers fail (taking flight control computer 1 and flight control computer 2 as examples), only flight control computer 3, the only remaining one among the three flight control computers in this architecture

[0116] can still control 1 / 3 of the actuators. The actuation system can receive the normal control commands issued by the only remaining flight control computer, which can still meet the minimum acceptable control of the flight control. Figure 8 The logic control diagram of the flight control system when the computing boards of flight control computer 1 and 2 fail is shown.

[0117] e) After all the computing boards of all 3 flight control computers fail, all the backup boards enter the active state from the armed state, and the system enters the backup mode. In this mode, each flight control computer only uses the cockpit sensor signals received by its own I / O board (sensors such as side sticks, pedals, etc.

[0118] No.), to implement the calculation of backup control commands for the flight control system to achieve simple stick-to-rudder control, which can still ensure the safe flight and landing of the aircraft. Figure 9 Shows the logic control diagram of the flight control system when the calculation boards of all three flight control computers fail.

[0119] 4) REU failure condition: As described above, the REU in this application adopts a dissimilar (two models) redundancy design. When all of one type of REU fails, the other type of REU can continue to control the corresponding actuator to ensure the continuous safe flight and landing of the aircraft. Here, taking the elevator actuator control as an example, when all of the Type A REUs fail, the corresponding actuator is not controlled by the system and enters the bypass mode, and the actuators controlled by the Type B REUs are still normal, and the elevator is controllable, meeting the safety requirements. Figure 10 Shows the logic control diagram of the flight control system when one type of REU fails.

[0120] In summary, this application has the following advantages:

[0121] 1) This application proposes a new flight control computer architecture integrated with a backup function. Each computer contains three branches, and each branch can independently calculate and generate control commands. As long as any one flight control computer survives, it can receive pilot commands and control the actuators on the control surfaces to achieve the safe flight and landing of the aircraft;

[0122] 2) This application proposes a flight control computer architecture integrated with an aircraft rate sensor, which can achieve backup mode control without relying on external signals in the backup mode;

[0123] 3) This application proposes a new fly-by-wire flight control system architecture, which has the ability to calculate and control normal control commands, auxiliary control commands, and backup control commands.

[0124] 4) This application adopts a dissimilar design for the calculation board and REU (for example, two types of REUs are used) to mitigate the common mode impact.

[0125] Although different embodiments have been described above, it should be understood that they are only examples and not limitations. Those skilled in the relevant art will appreciate that various modifications can be made in form and detail without departing from the spirit and scope of this application as defined by the appended claims. Therefore, the width and scope of this application disclosed herein should not be limited by the exemplary embodiments disclosed above, but should be defined only by the appended claims and their equivalents.

Claims

1. A flight control system, comprising: Three flight control computers, each of which includes: An I / O board configured to receive an input signal of one of the cockpit control device signals and the sensor signals of the cross-linked interface system, forward the processed input signal to the calculation board, the backup board and other flight control computers after processing it, receive the remaining cockpit control device signals and interface signals sent by other flight control computers, and output a control instruction to the actuator of the corresponding rudder surface; Three calculation boards configured to calculate corresponding control instructions based on the received input signals according to the control law and forward the control instructions to the I / O board; and A backup board configured to enter the armed state when the calculation board of the flight control computer fails; Wherein, when the backup boards of all flight control computers enter the armed state, the flight control system enters the backup mode, and the backup board calculates backup control instructions and transmits them to the actuators of the corresponding rudder surfaces.

2. The flight control system according to claim 1, characterized in that, The calculation boards adopt dissimilar designs, and each rudder surface includes multiple actuators, and the multiple actuators also adopt dissimilar designs.

3. The flight control system according to claim 1, characterized in that, The calculation board performs voting, monitoring of signals and calculates control instructions based on the received input signals: If the voting of the received critical interface signals is successful, normal control instructions are calculated according to the control law in the normal mode; If the voting of the received critical interface signals fails, auxiliary control instructions are calculated according to the control law in the auxiliary mode.

4. The flight control system according to claim 1, characterized in that, The I / O board votes among the control instructions output by the three calculation boards received, and When the voting of the control instructions output by two or three calculation boards fails, the calculation board of the flight control computer enters the failure mode; Wherein, in the failure mode, the input signals received by the I / O board of the flight control computer are still normally sent to other flight control computers and no control instructions are output to the actuators, and the backup board of the flight control computer enters the armed state.

5. The flight control system according to claim 1, wherein The flight control system further includes an aircraft rate sensor, which can provide inputs for the auxiliary mode and the backup mode to ensure the calculation of control instructions in the auxiliary mode and the backup mode.

6. The flight control system according to claim 3, characterized in that, Wherein the normal control instructions are full-function control instructions including three-axis control functions, envelope protection, stability augmentation and other functions, the auxiliary control instructions only include basic three-axis control functions, and the backup control instructions adopt direct control from the stick to the rudder.

7. A flight control method, comprising: At each flight control computer in a flight control system having three flight control computers: Receiving an input signal of one of the cockpit control device signals and the sensor signals of the cross-linked interface system Receiving input signals of the other two cockpit control signals and the sensor signals of the cross-linked interface system from all other flight control computers; Performing voting, monitoring of signals and calculating control instructions based on the received input signals according to the control law; Outputting the control instructions to the actuators of the corresponding rudder surfaces; The actuator drives the associated rudder surface to perform corresponding movements according to the received control instructions; Wherein, the flight control method further includes: When the computing board of the flight control computer fails, the backup board of the flight control computer enters the armed state; When the backup boards of all flight control computers enter the armed state, the flight control system enters the backup mode, and the backup board calculates the backup control command and transmits it to the actuator corresponding to the control surface.

8. The flight control method according to claim 7, wherein The flight control computer includes three computing boards, the three computing boards adopt dissimilar designs, and each control surface includes multiple actuators, and the multiple actuators also adopt dissimilar designs.

9. The flight control method according to claim 8, wherein, The voting, monitoring of signals according to the received input signals and calculating control commands based on the control law include: If the voting of the received critical interface signals is successful, calculate the normal control command according to the control law in the normal mode; If the voting of the received critical interface signals fails, calculate the auxiliary control command according to the control law in the auxiliary mode.

10. The flight control method according to claim 8, wherein, It also includes: Voting among the control commands output by all received computing boards, and When the voting of the control commands output by two or three computing boards fails, the computing board of the flight control computer enters the failure mode; Wherein, in the failure mode, the input signals received by the I / O board of the flight control computer are still normally sent to other flight control computers and will not output the control commands to the actuator, while the backup board of the flight control computer enters the armed state.

Images