Flight control method, flight control system, and aircraft

Abstract

The present disclosure relates to a flight control method, a flight control system and an aircraft. The method is applied to any flight control computer in the flight control system. The flight control computer comprises a calculation module and a management module. The method comprises: the calculation module obtaining an actual running state parameter of a first function module, judging whether the first function module has a fault according to the actual running state parameter, and outputting a fault signal to the management module when the fault occurs; the management module receiving a fault signal from a second function module and a fault signal from the calculation module, and determining a failure state signal according to all the received fault signals. When the failure state signal is output to the calculation module and the second function module, the calculation module and the second function module process the fault according to the failure state signal. The method can realize the redundant design of flight control, can cover the possible failure state of the aircraft, and can improve the reliability and safety of the aircraft.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of avionics, and in particular to a flight control method, a flight control system and an aircraft. BACKGROUND

[0002] An electric vertical take-off and landing (eVTOL) aircraft refers to an aircraft that can take off and land vertically by relying on electric power. Aviation electrification is the current development direction, and the vertical take-off and landing function is a functional requirement of the aircraft for various complex tasks.

[0003] Due to the vertical take-off and landing requirement, an eVTOL aircraft generally has multiple lift-providing subsystems and multiple rudder control subsystems. In theory, to ensure compliance with aviation regulations, the aircraft needs to be redundantly designed so that in the event of failure of part of the lift-providing subsystems (or part of the rudder control subsystems), a catastrophic accident is not allowed. Therefore, how to optimize the redundant design to make the aircraft have higher reliability and safety has become a research hotspot in the field. SUMMARY

[0004] In view of this, the present disclosure provides a flight control method, a flight control system and an aircraft. According to the flight control method of the present disclosure, a redundant design of flight control can be achieved, which can cover possible failure states of the aircraft and improve the reliability and safety of the aircraft.

[0005] According to an aspect of the present disclosure, a flight control method is provided, which is applied to any flight control computer in a flight control system, the flight control system comprising a plurality of flight control computers and a plurality of functional modules controlled by the flight control computers, the flight control computer comprising a computing module and a management module, the method comprising: the computing module obtaining an actual running state parameter of a first functional module, the first functional module being at least one functional module in the plurality of functional modules controlled by the computing module; the computing module determining whether the first functional module has a fault according to the actual running state parameter, and outputting a fault signal to the management module when a fault occurs, the fault signal indicating the functional module having a fault and a fault type; the management module receiving a fault signal from a second functional module and a fault signal from the computing module, the second functional module being at least one functional module in the plurality of functional modules not controlled by the computing module; the management module determining a failure state signal according to all the received fault signals, the failure state signal being output to the computing module and the second functional module, so that the computing module and the second functional module process the fault according to the failure state signal.

[0006] In a possible implementation, before the computing module acquires the actual running state parameters of the first functional module, the method further includes: the computing module outputs a target instruction to the first functional module; and the computing module determines whether the first functional module has a fault according to the actual running state parameters, including: for any functional module in the first functional module, when the actual running state parameter of the functional module under the target instruction is consistent with the expected running state parameter of the functional module under the target instruction, it is determined that the functional module has no fault; and when the actual running state parameter of the functional module under the target instruction is inconsistent with the expected running state parameter of the functional module under the target instruction, it is determined that the functional module has a fault.

[0007] In a possible implementation, the flight control computer is further configured to acquire and / or process actual acceleration, actual speed, actual position, actual angular speed, actual angular acceleration and actual attitude as inputs of the computing module, and the method further includes: when the failure state signal is received, the computing module determines an expected speed, an expected position and a first expected attitude; the computing module determines an expected acceleration and a second expected attitude according to the expected speed, the expected position, the actual acceleration, the actual speed and the actual position; the computing module determines an expected angular acceleration according to the first expected attitude, the second expected attitude, the actual angular speed, the actual angular acceleration and the actual attitude; and the computing module determines a target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration and outputs the target instruction to the first functional module.

[0008] In a possible implementation, the computing module determines a target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration and outputs the target instruction to the first functional module, including: the computing module determines the target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration; the computing module performs instruction smoothing processing and / or anti-windup processing on the target instruction to obtain a processed target instruction; and the computing module outputs the processed target instruction to the first functional module.

[0009] In a possible implementation, the computing module determines an expected acceleration and a second expected attitude according to the expected speed, the expected position, the actual acceleration, the actual speed and the actual position, including: the computing module determines the expected acceleration and the second expected attitude according to the expected speed, the expected position, the actual acceleration, the actual speed, the actual position and a target instruction obtained last time.

[0010] In a possible implementation, the computing module determines target instructions corresponding to the first functional module according to the expected acceleration and the expected angular acceleration and outputs the target instructions to the first functional module, including: the computing module determines target instructions corresponding to the first functional module according to the expected acceleration and the expected angular acceleration, so that total power required when the first functional module executes the target instructions is minimum; and the computing module outputs the determined target instructions to the first functional module.

[0011] In a possible implementation, the computing module determines target instructions corresponding to the first functional module according to the expected acceleration and the expected angular acceleration and outputs the target instructions to the first functional module, including: the computing module determines target instructions corresponding to the first functional module according to the expected acceleration and the expected angular acceleration, so that a resource margin not occupied by the target instructions is maximum when the first functional module executes the target instructions; and the computing module outputs the determined target instructions to the first functional module.

[0012] In a possible implementation, the functional module has a self-detection function, and the fault signal from the functional module is obtained by the functional module executing the self-detection function.

[0013] In a possible implementation, the first functional module includes one or more of a motor and a steering engine, and the motor and the steering engine are used to drive a propeller; and the second functional module includes one or more of a propeller state sensor, a high-voltage battery manager, and an avionics core computer.

[0014] According to another aspect of the present disclosure, there is provided a flight control system including a plurality of flight control computers and a plurality of functional modules, the flight control computers executing the flight control method according to any one of the above.

[0015] In a possible implementation, the types of the first functional modules include lift power type, control surface type and thrust power type, the types of the flight control computers include normal type and backup type, wherein the number of the flight control computers of the normal type is three or more, and the number of the flight control computers of the backup type is one or more; for each flight control computer of the normal type, the flight control computer of the normal type is connected to a plurality of normal high-speed communication buses, and the number of the normal high-speed communication buses is greater than or equal to the maximum value of the number of the lift power type functional modules, the number of the control surface type functional modules and the number of the thrust power type functional modules; each lift power type functional module is connected to a normal high-speed communication bus, each control surface type functional module is connected to a normal high-speed communication bus, and each thrust power type functional module is connected to a normal high-speed communication bus; for each flight control computer of the backup type, the flight control computer of the backup type is connected to a backup high-speed communication bus, and the number of the backup high-speed communication buses is greater than or equal to the number of the flight control computers of the backup type; each functional module in the first functional modules is connected to each backup high-speed communication bus.

[0016] In a possible implementation, in the flight control system, the flight control computers of the normal type communicate with each other through dedicated high-speed communication buses, each flight control computer of the normal type acquires actual running state parameters of at least one lift power type functional module, at least one control surface type functional module and at least one thrust power type functional module through the normal high-speed communication buses, and obtains a failure state signal and a target instruction according to the acquired actual running state parameters; each flight control computer of the backup type acquires actual running state parameters of each lift power type functional module, each control surface type functional module and each thrust power type functional module through the backup high-speed communication buses, and obtains a failure state signal and a target instruction according to the acquired actual running state parameters; when the first functional module does not receive the target instruction from the flight control computer of the normal type within a preset time period, the first functional module executes the target instruction from the flight control computer of the backup type with the highest priority; when the second functional module does not receive the failure state signal from the flight control computer of the normal type within a preset time period, the second functional module executes the failure state signal from the flight control computer of the backup type with the highest priority.

[0017] In a possible implementation, in the flight control system, each flight control computer of the normal type stores a current priority list of the flight control computers of the normal type, and the flight control computer of the normal type with the highest priority in the current priority list sends the target instruction to the normal high-speed communication bus.

[0018] According to another aspect of the present disclosure, there is provided an aircraft comprising the flight control system of any one of the above.

[0019] According to the flight control method of the present embodiment, the actual running state parameters of at least one of the functional modules, i.e., the first functional module, controlled by the computing module are obtained by the computing module, so that the computing module can determine whether the functional module controlled by the computing module has a fault according to the actual running state parameters; when a fault occurs, the computing module outputs a fault signal to the management module, the fault signal indicating the functional module having the fault and the fault type, so that the management module can determine the fault information of the functional module controlled by the computing module; and the management module also receives the fault signal from at least one of the functional modules, i.e., the second functional module, not controlled by the computing module, so that the management module can determine the fault information of the plurality of functional modules controlled by the flight control computer. The management module determines the failure state signal according to all the received fault signals, so that when the failure state signal is output to the computing module and the second functional module, the computing module and the second functional module process the fault according to the failure state signal, thereby controlling the flight. The flight control method of the present embodiment can cover possible failure states caused by functional module faults and respond in time to process the faults, thereby improving the reliability and safety of the flight process; and the flight control method of the present embodiment can be applied to any flight control computer in the flight control system, the flight control system can include a plurality of flight control computers, so that the redundancy design of flight control can be realized, thereby further improving the reliability and safety of the flight process.

[0020] Other features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the present disclosure and serve to explain the principles of the present disclosure.

[0022] Figure 1 An exemplary application scenario of the flight control method according to the present embodiment is shown.

[0023] Figure 2 A structural schematic diagram of the flight control computer according to the present embodiment is shown.

[0024] Figure 3 A flowchart of the flight control method according to the present embodiment is shown.

[0025] Figure 4 A schematic diagram of an exemplary method in which the computing module controls each first functional module according to the failure state signal is shown.

[0026] Figure 5 FIG. 16 shows a schematic diagram illustrating an exemplary method of the computing module controlling each first function module according to the failure state signal according to an embodiment of the present disclosure.

[0027] Figure 6 FIG. 17 shows a schematic diagram illustrating an exemplary method of the computing module obtaining a target instruction according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0028] Various exemplary embodiments, features, and aspects of the present disclosure will be described herein below with reference to the accompanying drawings. The same reference numbers in different drawings indicate the same or similar elements. Although various aspects of the embodiments are illustrated in the drawings, the drawings are not necessarily drawn to scale unless specifically indicated.

[0029] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any implementation described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other implementations.

[0030] In addition, for the purpose of convenience and brevity, detailed descriptions of well-known functions and structures incorporated in the present disclosure can be omitted. It will be appreciated that the present disclosure can be practiced with the exact details as other implementations can omit some of the details described.

[0031] The aviation electrification is the development trend in recent years. The electric vertical take-off and landing aircraft using the electric propulsion system instead of the internal combustion engine power can obtain many advantages and unique qualities. The most prominent advantage is energy saving and environmental protection, high efficiency, low energy consumption, and close to zero emission, low noise and vibration level, and good ride comfort, which is a truly environment-friendly aircraft. The vertical take-off and landing makes the application scenarios of the electric vertical take-off and landing aircraft similar to the helicopters, and no longer needs the airport and runway. In addition, the electric vertical take-off and landing aircraft also has the characteristics of safety and reliability (no fuel explosion and fuel leakage), simple structure, easy operation and use, good maintainability and low cost, and good economy. There are also many advantages in design: flexible overall layout, optimal layout and unconventional / innovative layout can be adopted; the aircraft with super performance can be designed to meet special purpose requirements, etc.

[0032] The requirement for redundant control in aviation has a long history. Section 1309, part of aviation regulations, is fundamental to aircraft and system safety. It sets general requirements for the installation of aircraft systems and equipment, the probability of failure states of varying severity, and fault warnings. Since 1965, Section 1309 has undergone multiple revisions. It reinforces the "fail-safe" design philosophy and proposes a probabilistic approach to defining acceptable safety levels. With the increasing complexity of aircraft and systems, structured safety analysis and assessment techniques developed from Section 1309, such as Fault Hazard Analysis (FHA), Fault Tree Analysis (FTA), and Comprehensive Meta-Analysis (CMA), as well as development assurance techniques, have been widely applied in the design and certification of new aircraft. Section 1309 requires that the probability of a catastrophic failure state be extremely improbable, meaning that catastrophic failure states cannot be caused by a single point of failure.

[0033] Electric vertical take-off and landing (EVTL) aircraft generally have multiple lift-providing subsystems due to their vertical take-off and landing requirements. In theory, to ensure compliance with aviation regulations, these aircraft need to be designed so that partial lift failure cannot lead to catastrophic accidents. Therefore, electric vertical take-off and landing (EVTL) aircraft generally include multiple propellers or multiple ducted fans. However, in addition to redundant designs for the lift-providing systems, redundant designs are also required for the control mechanisms of the flight control system and the flight control computer. The existing technology does not have a targeted design for redundant control of the flight control system and the flight control computer, and still uses traditional proportional-integral-derivative (PID) control, treating the failed lift-providing subsystem as an external load for inner-loop and outer-loop control. However, this approach will increase power consumption, reduce the aircraft's flight range, and may lead to dangerous saturation of individual lift-providing subsystems.

[0034] In view of this, the present disclosure proposes a flight control method, a flight control system and an aircraft. According to the flight control method of the present disclosure, a redundant design of flight control can be achieved, which can cover possible failure states of the aircraft and improve the reliability and safety of the aircraft.

[0035] Figure 1 An exemplary application scenario of the flight control method according to an embodiment of the present disclosure is shown.

[0036] like Figure 1As shown, the flight control method can be executed by a flight control computer (FCC) disposed in a flight control system. Figure 1 In an example, the flight control system includes 4 FCCs. In the example, FCCs 1-3 are normal type FCCs, and FCC 4 is a backup type FCC. The backup type FCC and the normal type FCCs have non-similar redundancy characteristics. The normal type FCCs are configured to satisfy safety and reliability requirements of an application scenario, and the normal type FCCs are configured to perform real-time redundant computation through cross-checking. The backup type FCC is configured to serve as a backup and not participate in cross-checking. Figure 1

[0037] As shown, the flight control system can further include n lift power subsystems (collectively referred to as a lift power system, n being an integer greater than 1, Figure 1 in an example, n is greater than 3), configured to provide lift for the aircraft; k thrust power subsystems (collectively referred to as a thrust power system, k being an integer greater than 1, Figure 1 in an example, k is greater than 3), configured to provide thrust for the aircraft; m control surface subsystems (collectively referred to as a control surface system, m being an integer greater than 1, Figure 1 in an example, m is greater than 3), configured to change an angle of the aircraft; a plurality of normal high-speed communication buses (4 buses are shown in the figure as an example) and at least one backup high-speed communication bus (1 bus is shown in the figure as an example), configured to connect the lift power subsystems, the thrust power subsystems, the control surface subsystems, and the FCCs.

[0038] The lift power system, the thrust power system, and the control surface system are actuators of the aircraft, configured to execute instructions and / or signals from the FCCs. For ease of description, in the following, the lift power subsystems, the thrust power subsystems, and the control surface subsystems are written as “function modules”, and it should be understood by those skilled in the art that the functions of different function modules can be different. Alternatively, the lift power system and the thrust power system can also be the same, i.e., the lift power system can also serve as the thrust power system, and the thrust power system can also serve as the lift power system, if hardware conditions permit. Therefore, the flight control system can include n lift power subsystems and m control surface subsystems, or include k thrust power subsystems and m control surface subsystems, and the disclosure does not limit the specific structure of the flight control system. For clarity of description, in the following, the flight control system is still taken as an example including n lift power subsystems, k thrust power subsystems, and m control surface subsystems.

[0039] ​The normal type of flight control computer communicates with each functional module through multiple normal high-speed communication buses. Each normal type of flight control computer is connected with all normal high-speed communication buses, but only one normal type of flight control computer outputs instructions at each moment. Each functional module can be selectively connected to different normal high-speed communication buses, wherein each normal high-speed communication bus is connected to one functional module of each type, for example, connected to one lift power subsystem, one thrust power subsystem, and one rudder control subsystem, to ensure redundant control. At the same time, each functional module is also connected to a standby high-speed communication bus and communicates with a standby type of flight control computer. For each functional module, the instructions and / or signals from the normal type of flight control computer are preferentially executed; when no instructions and / or signals from the normal type of flight control computer are received within a preset time, the instructions and / or signals from the standby type of flight control computer can be executed.

[0040] Figure 2 A structural schematic diagram of a flight control computer according to an embodiment of the present disclosure is shown.

[0041] As shown in Figure 2 , the flight control computer can include a control calculation module, a management module, and modules such as a flight warning system (FWS), vertical guidance, horizontal guidance, perception information fusion calculation (360°DAA Fusion Detection), avoidance and air-route recovery, mission management, performance calculation, flight data record (FDR), cyber security, mode management, a three-dimensional map database (3D MDB), a performance database (PDB), redundancy management, etc. based on the prior art. When each of the above modules works, data of an inertial navigation unit (IMU), a global navigation satellite system (GNSS), an air data system (ADS), a magnetometer, etc. based on the prior art are also needed. In addition, communication with the ground through a 2.4G radio (2.4G Radio) based on the prior art is also needed.

[0042] The flight control computer can execute the flight control method of the embodiments of the present disclosure, for example, using the above-mentioned computing module and management module to execute, according to the actual running parameters of each functional module and the data information of the sensors of the above-mentioned prior art, to control the aircraft, for example, to perform optimal control in real time during flight, and to perform emergency control in real time when each functional module fails during flight.

[0043] Figure 3 A flowchart of a flight control method according to an embodiment of the present disclosure is shown.

[0044] As shown in Figure 3 , the present disclosure proposes a flight control method applied to any flight control computer in a flight control system, the flight control system comprising a plurality of flight control computers and a plurality of functional modules controlled by the flight control computers, the flight control computer comprising a computing module and a management module, the method comprising steps S21-S24:

[0045] Step S21, the computing module obtains the actual running state parameter of the first functional module, the first functional module being at least one functional module controlled by the computing module among the plurality of functional modules.

[0046] Wherein, the functional module may, for example, include motors, rudders, propeller state sensors, high-voltage battery managers, power calculation devices and other devices or instruments on the aircraft, and the first functional module may include motors and rudders controlled by the computing module. Wherein, the motors can be arranged in the lift power subsystem and the thrust power subsystem in Figure 1 , the rudders can be arranged in the rudder control subsystem in Figure 1 , and the propeller state sensor, high-voltage battery manager, and power calculation device can be devices arranged outside the lift power subsystem, thrust power subsystem, and rudder control subsystem. The actual running state parameter of the first functional module can be a state parameter in the actual running of the first functional module, such as actual power, actual angle, etc. The computing module obtaining the actual running state parameter of the first functional module can be the computing module outputting an information acquisition signal to the first functional module, causing the first functional module to send its actual running state parameter to the computing module, and the computing module can use the obtained actual running state parameter of the first functional module when executing step S22.

[0047] Step S22, the computing module determines whether the first functional module has failed according to the actual running state parameter, and outputs a fault signal to the management module when a fault occurs, the fault signal indicating the functional module that has failed and the fault type.

[0048] The fault type that the computing module can determine can be a running state abnormal type, for example, the actual running state parameter of the first functional module exceeds the range of the expected running state parameter under the received instruction (for example, the target instruction described below). The expected running state parameter can be the running state parameter that the functional module is expected to reach under the ideal condition after executing the instruction (for example, the target instruction described below) for a period of time. For example, when the computing module determines that the actual running state parameter of the lift power subsystem 1 exceeds the range of the expected running state parameter under the received instruction (for example, the target instruction described below), the computing module can output a fault signal indicating that the lift power subsystem 1 has a running state abnormal type fault to the management module.

[0049] In step S23, the management module receives the fault signal from the second functional module and the fault signal from the computing module. The second functional module is at least one functional module in the plurality of functional modules that is not controlled by the computing module.

[0050] Each functional module can have a self-detection function. When a fault is detected in the functional module, a fault signal can be sent to the management module, so that the management module receives the fault signal from each functional module. The functional modules include the first functional module controlled by the computing module and the second functional module not controlled by the computing module, such as the propeller state sensor, the high-voltage battery manager, the power calculation device, and the like. The fault of the first functional module can be determined by the computing module. Therefore, the management module can be configured to obtain at least the fault signal detected by the second functional module itself, so that when the management module receives the fault signal from the computing module and the fault signal from the second functional module, the fault information of each functional module can be determined.

[0051] In step S24, the management module determines a failure state signal according to all the received fault signals. When the failure state signal is output to the computing module and the second functional module, the computing module and the second functional module process the fault according to the failure state signal.

[0052] The management module can be configured to monitor the health status of each functional module (for example, each functional module actively or passively reports a fault signal to the management module). For example, the management module can be internally provided with a database for recording the correspondence between possible fault signals and their corresponding failure states. The failure state can refer to the state in which part of the functional module of the aircraft fails due to a fault, and the corresponding failure state is different when the fault occurs in different functional modules or at different fault positions of the same functional module. The database can also store the working mode of part or all of the functional modules in different failure states. On this basis, after receiving all the fault signals, the management module can determine the failure state of the aircraft at the current time according to the database in the management module, and then send a failure state signal (for example, an aircraft fault code and / or a flight mode switching signal) to the computing module. The failure state signal can be used to indicate the failure state of the aircraft at the current time. At the same time, the management module can also send the failure state signal to the second functional module, so that the computing module and the second functional module can process the fault according to the failure state signal.

[0053] According to the flight control method provided in the embodiments of the present disclosure, the actual running state parameters of at least one functional module, i.e., the first functional module, in the plurality of functional modules controlled by the computing module are obtained by the computing module, so that the computing module can determine whether the functional module controlled by the computing module has a fault according to the actual running state parameters. When a fault occurs, the computing module outputs a fault signal to the management module, and the fault signal indicates the functional module having the fault and the fault type, so that the management module can determine the fault information of the functional module controlled by the computing module. In addition, the management module also receives a fault signal from at least one functional module, i.e., the second functional module, which is not controlled by the computing module, so that the management module can determine the fault information of the plurality of functional modules controlled by the flight control computer. The management module determines a failure state signal according to all the received fault signals, so that when the failure state signal is output to the computing module and the second functional module, the computing module and the second functional module process the fault according to the failure state signal, thereby controlling the flight. The flight control method provided in the embodiments of the present disclosure can cover possible failure states caused by faults of the functional modules, and timely respond to process the fault, thereby improving the reliability and safety of the flight process. In addition, the flight control method provided in the embodiments of the present disclosure can be applied to any flight control computer in a flight control system, and the flight control system can include a plurality of flight control computers, so that the redundancy design of flight control can be realized, and the reliability and safety of the flight process are further improved.

[0054] In a possible implementation, before step S21, the method further includes:

[0055] The computing module outputs a target instruction to the first functional module;

[0056] Step S22 comprises:

[0057] For any one of the first function modules, if the actual running state parameter of the function module under the target instruction is consistent with the expected running state parameter of the function module under the target instruction, it is determined that the function module does not have a fault; if the actual running state parameter of the function module under the target instruction is not consistent with the expected running state parameter of the function module under the target instruction, it is determined that the function module has a fault.

[0058] For example, the first function modules are function modules controlled by the computing module. When the computing module wants to make the aircraft be in a certain expected running state (such as a certain expected height, etc.), the expected running state parameters of each first function module can be determined, such as the expected power and expected voltage of the motor, and the expected angle of the steering engine, etc. The computing module can determine the target instruction and the expected running state parameter under the target instruction according to the running state of the aircraft obtained last time (such as the actual speed, actual acceleration, actual position, etc. below), and output the target instruction to each first function module respectively. The exemplary determination method of the target instruction is shown in formulas (1)-(6) and Figures 4-6 Further description is given.

[0059] If each first function module has no fault, and each second function module also has no fault, after each first function module executes the received target instruction and runs for a certain time, the actual running state parameter of each first function module can be consistent with the expected running state parameter under the target instruction, such as the difference between the actual power and the expected power of the motor, and the difference between the actual voltage and the expected voltage are all less than a certain threshold value; at this time, the actual running state of the aircraft can also be consistent with the expected running state, such as the difference between the actual height and the expected height of the aircraft is less than a certain threshold value.

[0060] Therefore, in step S22, for any one of the first function modules, if the computing module determines that the actual running state parameter of the function module under the target instruction is consistent with the expected running state parameter of the function module under the target instruction, it is determined that the function module does not have a fault. If the computing module determines that the actual running parameter of the function module under the target instruction is not consistent with the expected running state parameter of the function module under the target instruction, such as the difference between the actual power and the expected power of the motor is greater than or equal to a certain threshold value, it is determined that the function module has a fault. At this time, the actual running state of the aircraft can also be inconsistent with the expected running state, such as the difference between the actual height and the expected height of the aircraft is greater than or equal to a certain threshold value, so the fault needs to be handled.

[0061] In this way, the computing module can determine whether each function module controlled by it has a fault.

[0062] In a possible implementation, the flight control computer is further configured to acquire and / or process actual acceleration, actual speed, actual position, actual angular speed, actual angular acceleration and actual attitude as inputs of the computing module, and the method further comprises:

[0063] Upon receiving the failure state signal, the computing module determines expected speed, expected position and first expected attitude;

[0064] The computing module determines expected acceleration and second expected attitude according to the expected speed, the expected position, the actual acceleration, the actual speed and the actual position;

[0065] The computing module determines expected angular acceleration according to the first expected attitude, the second expected attitude, the actual angular speed, the actual angular acceleration and the actual attitude;

[0066] The computing module determines target instructions corresponding to the first functional module according to the expected acceleration and the expected angular acceleration and outputs the target instructions to the first functional module.

[0067] For example, in the failure state of the aircraft, the actual operating state is inconsistent with the expected operating state, and the greater the gap, the higher the risk of flight. Therefore, the computing module is needed to control each first functional module according to the failure state signal to make the actual operating state of the aircraft reach the expected operating state.

[0068] Figure 4 A schematic diagram showing an exemplary method of the computing module controlling each first functional module according to the failure state signal according to an embodiment of the present disclosure is shown.

[0069] As shown in Figure 4 First, the flight control computer can acquire actual acceleration, actual speed, actual position, actual angular speed, actual angular acceleration and actual attitude of the aircraft in real time. The acquired actual acceleration, actual speed, actual position, actual angular speed, actual angular acceleration and actual attitude can be directly used as inputs of the computing module, or can be further processed by filtering, denoising and the like to obtain more accurate actual acceleration, actual speed, actual position, actual angular speed, actual angular acceleration and actual attitude, which are then used as inputs of the computing module. Moreover, upon receiving the failure state signal, the computing module can determine expected speed, expected position and first expected attitude in the expected operating state. The expected speed and the first expected attitude can be ideal speed and ideal attitude of the aircraft when the aircraft is in the expected position. The expected speed, the expected position and the first expected attitude can be given by the pilot operation or can be pre-set flight route information, and the present disclosure does not limit this.

[0070] The computing module can perform position loop and speed loop control calculation according to the expected speed, the expected position, the actual acceleration, the actual speed and the actual position, to determine the expected acceleration and the second expected attitude. The position loop and speed loop control calculation manner in different failure states can be different; the position loop and speed loop control calculation manner in the failure state can also be different from that in the normal state. Assuming that each failure state signal corresponds to a position loop and speed loop control calculation manner, the computing module can determine the i-th position loop and speed loop control calculation according to the i-th received failure state signal, and the calculation result can include the expected acceleration and the second expected attitude of the aircraft. The second expected attitude can be determined on the basis of the real-time running state of the aircraft. Due to the influence of various environmental factors, the actual flight situation can be different from the theoretical situation, and therefore the second expected attitude can be different from the first expected attitude.

[0071] The computing module can perform attitude loop control calculation according to the first expected attitude, the second expected attitude, the actual angular velocity, the actual angular acceleration and the actual attitude, to determine the expected angular acceleration. The attitude loop control calculation manner in different failure states can be different; the attitude loop control calculation manner in the failure state can also be different from that in the normal state. Assuming that each failure state signal corresponds to an attitude loop control calculation manner, the computing module can determine the i-th attitude loop control calculation according to the i-th received failure state signal, and the calculation result can include the expected angular acceleration of the aircraft.

[0072] The computing module can perform module control distribution according to the expected acceleration and the expected angular acceleration, to determine the target instructions corresponding to the first functional modules. The module control distribution manner in different failure states can be different; the module control distribution manner in the failure state can also be different from that in the normal state. Assuming that each failure state signal corresponds to a module control distribution manner, the computing module can determine the i-th module control distribution according to the i-th received failure state signal, and the distribution result can be the target instructions corresponding to the first functional modules. The target instructions can indicate the running manner and / or the running state parameter of the functional modules. The computing module can output the determined instructions to each first functional module respectively, so that each first functional module outputs force and torque accordingly, to act on the aircraft, so that the aircraft can approach the normal state.

[0073] In this way, the flight control computer can respond differently to different failure states, thereby ensuring the actuation response quality of the aircraft in the normal state and the failure state.

[0074] In a possible implementation, the computing module determines target instructions corresponding to the first function modules according to the expected acceleration and the expected angular acceleration and outputs the target instructions to the first function modules, comprising:

[0075] The computing module determines target instructions corresponding to the first function modules according to the expected acceleration and the expected angular acceleration.

[0076] The computing module performs instruction smoothing processing and / or anti-saturation processing on the target instructions to obtain processed target instructions.

[0077] The computing module outputs the processed target instructions to the first function modules.

[0078] Figure 5 A schematic diagram showing an exemplary method of controlling each first function module according to a failure state signal by a computing module according to an embodiment of the present disclosure.

[0079] For example, the computing module determines target instructions of the corresponding first function modules according to the expected acceleration and the expected angular acceleration. When directly output to each first function module, the target instructions may cause over-saturation. Therefore, as shown in Figure 5 the target instructions are first subjected to instruction smoothing processing and / or anti-saturation processing to obtain processed target instructions before being output to the first function modules. The instruction smoothing processing and the anti-saturation processing can be implemented based on existing technologies respectively. Instruction smoothing means that when a function module receives a certain target instruction, the running mode and / or the running state parameter indicated by the target instruction may be quite different from the current running mode and / or the running state parameter of the function module. In order to protect the safety of each component of the function module, the running mode and / or the running state parameter needs to be adjusted in a smooth manner to reach the running mode and / or the running state parameter indicated by the target instruction, i.e., the work completed by the instruction smoothing processing.

[0080] Anti-saturation means that when a function module receives a certain target instruction, the running mode and / or the running state parameter indicated by the target instruction may exceed the allowable running mode and / or the running state parameter of the function module, i.e., over-saturation. How to process the target instruction so that the processed target instruction received by the function module is within the allowable running mode and / or the running state parameter range and the execution of the processed target instruction and the execution of the unprocessed target instruction can achieve the same effect is the work completed by the anti-saturation processing.

[0081] When the aircraft is in a failure state, one or more functional modules are malfunctioning and cannot work normally, the output of the remaining functional modules that can work normally can be adjusted, or even the functional modules that cannot complete all normal work can be partially output, to complete the control of the aircraft or perform an emergency landing with minimum danger expected. In the failure state, anti-saturation design can also be performed to ensure that a functional module does not reach the limit output too quickly and lose the ability to adjust and control.

[0082] In this way, the accuracy of the target instruction output to the first functional module can be improved.

[0083] In a possible implementation, the calculation module determines the expected acceleration and the second expected attitude according to the expected speed, the expected position, the actual acceleration, the actual speed, and the actual position.

[0084] The calculation module determines the expected acceleration and the second expected attitude according to the expected speed, the expected position, the actual acceleration, the actual speed, and the actual position, and the target instruction obtained last time.

[0085] For example, the actual acceleration, actual speed, actual position, actual angular speed, actual angular acceleration, and actual attitude of each first functional module after executing the target instruction obtained last time (processed) can be obtained by the flight control computer, and therefore, as shown in FIG. 2, the expected acceleration and the second expected attitude can be determined according to the expected speed, the expected position, the actual acceleration, the actual speed, and the actual position. Figure 4 and Figure 5As shown, when determining the desired acceleration and the second desired attitude according to the desired speed, the desired position, the actual acceleration, the actual speed and the actual position, the desired acceleration and the second desired attitude can be determined in combination with the last obtained (processed) target instruction and the desired speed, the desired position, the actual acceleration, the actual speed and the actual position. For example, if the last obtained (processed) target instruction can make the speed of the aircraft reach a certain preset threshold if executed normally, but the actual speed of the aircraft has not reached the preset threshold after the execution of the (processed) target instruction, it can be considered that the aircraft needs to be provided with greater thrust, and when determining the desired acceleration, the determined desired acceleration can be increased by a certain threshold on the basis of the desired acceleration determined based on the desired speed and the actual speed. Wherein the desired acceleration determined based on the desired speed and the actual speed can adopt a proportional-integral-derivative method, so that the difference between the desired acceleration and the actual acceleration can satisfy a certain preset condition, for example, the integral value of the difference is less than a certain threshold, and the like. Since the acceleration and the speed of the aircraft are associated with the attitude of the aircraft, the second desired attitude of the aircraft also changes accordingly with the desired acceleration and the desired speed, and since the desired acceleration is determined by considering the running state trend of the aircraft after the execution of the last obtained target instruction, the second desired attitude is also associated with the running state of the aircraft after the execution of the last obtained target instruction. The desired acceleration and the second desired attitude determined in this way are more accurate.

[0086] The above takes the ith failure state signal as an example, and those skilled in the art should understand that the calculation module can also receive the jth failure state signal (j≠i) or receive the normal state signal, and then the calculation module can obtain the target instruction in the position ring speed ring control calculation mode, the attitude ring control calculation mode and the module control distribution mode corresponding to the jth failure state signal or the normal state signal. Figure 6 A schematic diagram of an exemplary method for obtaining a target instruction by the calculation module according to an embodiment of the present disclosure is shown. The present disclosure does not limit the specific position ring speed ring control calculation mode, attitude ring control calculation mode and module control distribution mode used by the calculation module to obtain the target instruction.

[0087] The exemplary method for implementing module control distribution by the calculation module according to an embodiment of the present disclosure is introduced below in combination with formulas (1)-(6).

[0088] In the flight control method of the present embodiment, the module control distribution mode has the greatest impact on redundant control. The calculation module of the present embodiment supports multiple module control distribution modes, such as the most economical distribution mode, the fastest response distribution mode, the largest margin distribution mode, and the like. The most economical distribution mode and the largest margin distribution mode are taken as examples for introduction below.

[0089] For an electric vertical take-off and landing aircraft, taking the composite wing (multi-rotor and fixed-wing) configuration as an example, its 6-DOF equilibrium equation is as follows:

[0090]

[0091]

[0092]

[0093]

[0094]

[0095]

[0096] Among them, L is the lift of the aircraft, D is the total drag of the aircraft, Y is the lateral force of the aircraft, DY is the lateral drag of the aircraft, AOA is the angle of attack of the aircraft, Mg is the gravity vector, Lbg is the rotation matrix of the gravity vector rotated to the body coordinate system, M y is the pitching moment caused by aerodynamic forces, M z is the yaw moment generated by aerodynamic force. F i , i = 1, 2, ..., n are design optimization variables, i.e., the output of the lift power subsystem. i∈x+ represents the set of propellers in the positive direction of the x-axis, and i∈y+ represents the set of propellers in the positive direction of the y-axis. Parameters a and β represent the spatial angle of the lift, α is the angle between the projection of the lift on the xy plane and the negative direction of the x-axis, and β is the angle between the lift and the positive direction of the z-axis. i and d i are the distances from each propeller to the y-axis and x-axis, h is the distance from the center of gravity of the aircraft to the center of lift, T f is the torque-to-force ratio coefficient, which is a fixed value for a given propeller. In theory, the relationship between propeller thrust and speed is F=C T ω 2 , where C T is the pull coefficient, ω is the speed. The relationship between the propeller torque and speed is τ=C Q ω 2 , where C Q Torque coefficient. Therefore, the tension and torque are linearly proportional, that is,

[0097] Eq.1, eq.2, and eq.3 are the force balance equations in the z, x, and y directions, respectively. The right side of the equation is the resultant force or torque obtained by summing the forces or torques output by the various functional modules of the aircraft, including the aircraft lift and aircraft drag, and the left side of the equation is the z-axis acceleration a z , x-axis acceleration a x, y-axis acceleration a y The product of the weight of the aircraft M.

[0098] eq.4, eq.5, and eq.6 are the moment balance equations in the pitch direction, the moment balance equations in the roll direction, and the moment balance equations in the yaw direction, respectively. The right side of the equation is the resultant force or moment obtained by summing the forces or moments output by each functional module of the aircraft, including the aircraft lift and aircraft drag, and the left side is the pitch angular acceleration. Roll angular acceleration Yaw acceleration and the pitch direction moment of inertia I yy , moment of inertia in the rolling direction I xx , yaw direction moment of inertia I zz The product of .

[0099] After the aerodynamic force and torque of the aircraft are expressed by the control amount of each control surface and the speed and the known parameters related to the aircraft, the above formula can also be sorted into formula (1):

[0100]

[0101] where δ i , i = 1, 2, ..., n is the control quantity of each rudder surface, that is, the output of each rudder surface control subsystem.

[0102] From the principles of algebra, we know that for Ax=b, if R(A)=R(A|b) <n,则有通解x=A - b+(EA - A)ξ, constitutes the solution space. A - is the generalized inverse of matrix A. If A - is the Moore-Penrose generalized inverse, that is, A - =A + , then in the solution space of the compatible linear equations x=A + b+(EA + A)ξ, x=A + b is the only minimum norm solution, that is, the least squares solution.

[0103] The A matrix at this time describes the degrees of freedom of the aircraft (z-axis acceleration a z , x-axis acceleration a x , y-axis acceleration a y , pitch angular acceleration Roll angular acceleration Yaw acceleration The A matrix is referred to as a control distribution matrix in the embodiments of the present disclosure. The A matrix can be preset before the aircraft is delivered from the factory, as long as the correspondence between the degrees of freedom of the aircraft and the outputs of the functional modules is met, and the specific setting manner of the A matrix is not limited in the present disclosure.

[0104] Under the determined degrees of freedom of the aircraft, that is, the z-axis acceleration a z , the x-axis acceleration a x , the y-axis acceleration a y , the pitch angle acceleration , the roll angle acceleration , and the yaw angle acceleration , the outputs (F1, F2, ···, F n , δ1, δ2, ···, δ n ) of the functional modules can have infinite combinations, that is, there are infinite solutions in the solution set space x=A + b+(E-A + A)ξ, where x corresponds to F1, F2, ···, F n , δ1, δ2, ···, δ n , and b corresponds to a z , a x , a y , In this case, a suitable module control distribution manner can be determined according to the application scene requirement, and then the optimal solution of F1, F2, ···, F + , δ1, δ2, ···, δ n is searched from the solution set space x=A + b+(E-A n A)ξ based on the module control distribution manner.

[0105] Next, an exemplary manner of searching for the optimal solution under the most economic distribution manner is described in combination with formulas (2)-(4).

[0106] In a possible implementation, the computing module determines a target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration, and outputs the target instruction to the first functional module, including:

[0107] The computing module determines a target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration, so that the total power required when the first functional module executes the target instruction is minimum; and the computing module outputs the determined target instruction to the first functional module.

[0108] For example, each functional module needs to consume the energy of the aircraft to output force and torque, and in the solution space, an optimal solution can be found, which makes the total input power of each functional module executing the target instructions corresponding to the solution minimum, so that the aircraft can fly longer and farther when performing tasks, and thus the solution can be the optimal solution under the most economic allocation.

[0109] For the most economic allocation, generally, the input work power of the functional module is proportional to the square of its output. As shown in equation (2):

[0110] W 升i =k i ·F i 2 or W 舵i =k i ·δ i 2 (2)

[0111] wherein k i is a proportional coefficient, W 升i is the input work power of the motor, W 舵i is the input work power of the rudder, F i and δ i are the output of the functional module, and for the same type of functional module, the k i coefficient can be the same.

[0112] Then according to the expected acceleration and the expected angular acceleration, i.e. the z-axis acceleration a z , the x-axis acceleration a x , the y-axis acceleration a y , the pitch angle acceleration the roll angle acceleration and the yaw angle acceleration and the above equations (1) and (2), the following mathematical optimization model (3) can be obtained:

[0113] Find:F i ,i=1,2,……,n;δ j ,j=1,2,……,m;

[0114]

[0115]

[0116] F i ∈(F min ,F max ),i=1,2,……,n and δ j ∈(δ min ,δ max), j = 1, 2, …, m respectively represent the output range of each functional module.

[0117] In the multi-rotor working stage, the motor working power is generally much higher than the steering engine working power, so the focus can be placed on the motor, and the above optimization model (3) can be further simplified to model (4):

[0118] Find: F i , i = 1, 2, …, n;

[0119]

[0120]

[0121] Solve the least square solution in the set space, and the least square solution is unique for the Moore-Penrose generalized inverse before, which is:

[0122]

[0123] Each functional module executes F1, F2, …, Fn that meet the above conditions. n When the corresponding target instruction is executed, the total input power of each functional module of the aircraft is minimized, that is, F1, F2, …, Fn that meet the above conditions. n It can be the optimal solution under the most economical allocation mode. Wherein, the target instruction can be obtained by F1, F2, …, Fn that meet the above conditions. n The input of the prior art algorithm model, such as the thrust motor propeller system model, the lift motor propeller system model, etc., is obtained, and the present disclosure is not limited to the specific way of obtaining the target instruction according to F1, F2, …, Fn that meet the above conditions. n The specific way of obtaining the target instruction is not limited. When each first functional module executes the obtained target instruction, it is beneficial for the aircraft to fly for a longer time, a longer distance, and achieve a more economical effect.

[0124] Next, an exemplary way of finding the optimal solution under the maximum residual allocation mode is introduced in combination with formulas (5)-(6).

[0125] In one possible implementation, the calculation module determines the target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration and outputs it to the first functional module, which includes:

[0126] The calculation module determines the target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration, so that when the first functional module executes the target instruction, the resource residual that is not occupied by the target instruction is maximized.

[0127] The calculation module outputs the determined target instruction to the first functional module.

[0128] For example, the hardware resources of each functional module are limited. If the margin of a functional module is too small, i.e., the available resources are too small when executing target instructions, such as too small memory or too large processor occupancy, etc., if the aircraft suddenly encounters an emergency situation and needs the functional module to execute more instructions, the functional module may not be able to complete the execution of the instructions in time due to the small margin, which brings great risk to the aircraft. In addition, the functional module works under a large load for a long time, and its damage risk is much higher than that in a low load scenario.

[0129] Therefore, in the entire solution space, a solution can be found, so that the margins of each functional module are as large as possible when executing the target instructions corresponding to the solution, so as to avoid that some functional modules are close to their working limits and the output is close to saturation, while other functional modules work in a state of very small output. Therefore, the solution can be the optimal solution under the maximum margin allocation mode.

[0130] In the maximum margin allocation mode, first, the output of each functional module is normalized to a value between 0 and 1, which can be expressed as formula (5):

[0131] Or

[0132] Where, F i ∈(F min ,F max ), i = 1, 2, …, n and δ j ∈(δ min , δ max ), j = 1, 2, …, m represent the output range of each functional module, F i * is the normalized output of the motor, and δ j * is the normalized output of the steering engine.

[0133] The maximum margin of the functional module is the minimum output of the functional module. When the functional module with the maximum output is in the state of the minimum output, the margins of all functional modules are maximized.

[0134] Then, according to the expected acceleration and the expected angular acceleration, i.e., the z-axis acceleration a z , the x-axis acceleration a x , the y-axis acceleration a y , the pitch angle acceleration the roll angle acceleration the yaw angle acceleration and the above formulas (1), (5), the following mathematical optimization model (6) can be obtained:

[0135] Find: F i i = 1, 2, …, n; δ j j = 1, 2, …, m;

[0136] min: Max(Max(F i ), Max(δ j ))

[0137]

[0138] The optimal solution of the F1, F2, …, F n , δ1, δ2, …, δ m that satisfy the above model (6) can be obtained by using the branch and bound method (B-&-B) of the prior art. When each functional module executes the corresponding target instruction of the F1, F2, …, F n , δ1, δ2, …, δ m that satisfy the above model (6), the margin of each functional module of the aircraft is maximized, which is beneficial to tap and develop the output capacity of the aircraft, prevent some functional modules from being saturated too quickly, optimize the working strength of each functional module, and prolong the working life of all functional modules. In particular, in extreme cases, when one or more functional modules cannot work normally, the working potential of the remaining functional modules can be fully tapped to avoid the impact of the too-quick saturation of the functional modules on the control of the aircraft. That is, the F1, F2, …, F n , δ1, δ2, …, δ m that satisfy the above model (6) can be the optimal solution in the margin maximization allocation mode. The target instruction can be obtained by inputting the F1, F2, …, F n , δ1, δ2, …, δ m that satisfy the above model (6) into an algorithm model of the prior art, such as a thrust motor propeller system model, a lift motor propeller system model, a rudder surface system model, a tilting system model, a variable-pitch propeller motor system model, and the like. The specific mode of obtaining the target instruction according to the F1, F2, …, F n , δ1, δ2, …, δ m that satisfy the above conditions is not limited in the present disclosure.

[0139] The above takes finding the optimal solution in the most economical allocation mode and the margin maximization allocation mode as an example. Those skilled in the art should understand that the module control allocation mode in the calculation module should not be limited to this, as long as the module control allocation mode meets the requirements of the application scenario. The specific implementation of the module control allocation mode is not limited in the present disclosure.

[0140] In a possible implementation, the second functional module has a self-detection function, and the failure signal from the second functional module is obtained by the second functional module performing the self-detection function.

[0141] In this way, the management module does not need to perform the task of detecting the failure of the second functional module, and only needs to receive the failure signal of the second functional module, thereby reducing the data processing cost of the management module.

[0142] In a possible implementation, the first functional module includes one or more of a motor and a rudder motor, and the motor and the rudder motor are used to drive a propeller.

[0143] The second functional module includes one or more of a propeller state sensor, a high-voltage battery manager, and an avionics core computer.

[0144] Using a motor as a functional module to drive a propeller makes the aircraft of the embodiment of the present disclosure safer than an aircraft powered by an internal combustion engine, and electric power is clean energy, which can reduce pollution generated during flight.

[0145] The present disclosure also provides a flight control system, including a plurality of flight control computers and a plurality of functional modules, and the flight control computers perform the flight control method described above. Examples of the flight control method performed by the flight control computers have been described above, and will not be described here again.

[0146] In a possible implementation, the type of the first functional module includes a lift power type, a rudder surface control type, and a thrust power type, and the type of the flight control computer includes a normal type and a backup type, where the number of flight control computers of the normal type is three or more, and the number of flight control computers of the backup type is one or more.

[0147] For each flight control computer of the normal type, the flight control computer of the normal type is connected to a plurality of normal high-speed communication buses, and the number of the normal high-speed communication buses is greater than or equal to the maximum value of the number of the lift power type functional modules, the number of the rudder surface control type functional modules, and the number of the thrust power type functional modules.

[0148] Each lift power type functional module is connected to a normal high-speed communication bus, each rudder surface control type functional module is connected to a normal high-speed communication bus, and each thrust power type functional module is connected to a normal high-speed communication bus.

[0149] For each flight control computer of the backup type, the flight control computer of the backup type is connected to a backup high-speed communication bus, and the number of the backup high-speed communication buses is greater than or equal to the number of the flight control computers of the backup type.

[0150] Each of the first functional modules is connected to each backup high-speed communication bus respectively.

[0151] At least one lift-powered functional module and at least one thrust-powered functional module provide lift and thrust for the aircraft, while at least one rudder-control functional module provides directional control. By configuring the appropriate combination of these functional modules on the aircraft, comprehensive control of the aircraft's six degrees of freedom can be achieved by adjusting the outputs of the various functional modules. This makes the flight control system adaptable to aircraft with electric vertical takeoff and landing (EVTL) and composite wing configurations.

[0152] For an exemplary connection method between the first functional modules of the lift power type, the control surface control type, and the thrust power type and the common type flight control computer and the backup type flight control computer, reference can be made to the above and Figure 1 The relevant description will not be repeated here. It should be noted that, for the normal high-speed communication bus, each normal type of flight control computer should be connected to each normal high-speed communication bus, and each first functional module should be connected to a normal high-speed communication bus, and one first functional module of each type should be connected to the same normal high-speed communication bus. For the spare high-speed communication bus, it should be connected to each first functional module. The connection method of the flight control computer, the high-speed communication bus, and the first functional module only needs to meet the above requirements. This application does not limit the specific connection method of the flight control computer, the high-speed communication bus, and the first functional module.

[0153] The present invention uses a low-cost high-speed communication bus to achieve the connection between the first functional module and the flight control computer. If the effect needs to be further improved, an aviation Ethernet network bus can be used instead of the high-speed communication bus to achieve higher reliability.

[0154] In one possible implementation, in the flight control system, each normal type of flight control computer communicates with each other via a dedicated high-speed communication bus.

[0155] Each normal type of flight control computer obtains actual operating status parameters of at least one lift power type functional module, at least one control surface control type functional module, and at least one thrust power type functional module through a normal high-speed communication bus, and obtains a failure status signal and a target instruction based on the obtained actual operating status parameters;

[0156] Each backup type of flight control computer obtains actual operation state parameters of each lift power type of functional module, each rudder surface control type of functional module, and each thrust power type of functional module through a backup high-speed communication bus, and obtains a failure state signal and a target instruction according to the obtained actual operation state parameters;

[0157] When the first functional module does not receive the target instruction from the normal type of flight control computer within a preset time period, the first functional module executes the target instruction from the backup type of flight control computer with the highest priority;

[0158] When the second functional module does not receive the failure state signal from the normal type of flight control computer within a preset time period, the second functional module executes the failure state signal from the backup type of flight control computer with the highest priority.

[0159] For example, in combination with Figure 1 When the aircraft is in normal operation, all normal types of flight control computers (flight control computers 1-3) obtain data (for example, the actual operation state parameters described above) from the first functional module in real time on the normal high-speed communication bus, and all backup types of flight control computers (flight control computer 4) obtain data (for example, the actual operation state parameters described above) from the first functional module in real time on the backup high-speed communication bus, and each flight control computer executes the flight control method of the embodiment of the present disclosure, processes the received data, determines the failure state signal, and determines the target instruction according to the failure state signal. According to the connection mode of the flight control computer and the high-speed communication bus, each normal type of flight control computer further obtains actual operation state parameters of at least one lift power type of functional module, at least one rudder surface control type of functional module, and at least one thrust power type of functional module through the normal high-speed communication bus, and each backup type of flight control computer obtains actual operation state parameters of each lift power type of functional module, each rudder surface control type of functional module, and each thrust power type of functional module through the backup high-speed communication bus. The exemplary determination mode of the failure state signal and the target instruction has been described above and will not be described here.

[0160] In this case, as long as one first functional module connected by a normal communication high-speed bus is normal, each normal type of flight control computer can obtain the actual operation state parameters of the first functional module through the normal communication high-speed bus, thereby ensuring that the flight control method of the embodiment of the present disclosure can be executed in the normal type of flight control computer. In this way, redundancy design is achieved, and any single point failure of the functional module is prevented from causing a catastrophic accident from the hardware and software. Even if a single point failure occurs, the aircraft can be ensured to work in a controllable state until landing, and the reliability and safety of the aircraft can be ensured.

[0161] In one possible implementation, in the flight control system, each normal type of flight control computer respectively stores a current priority list of normal type of flight control computers, and the normal type of flight control computer with the highest priority in the current priority list sends the target instruction to the normal high-speed communication bus. In this way, the accuracy of the target instruction received by the first functional module can be increased.

[0162] When the flight control system is powered on, the priority of each normal type of flight control computer can be determined in advance, which can be achieved by using the prior art. For example, a random number is calculated according to the start time, and the priority of each normal type of flight control computer is determined according to a pre-set rule, such as the size of the random number, to obtain a priority list of normal type of flight control computers. The priority list can be stored in each normal type of flight control computer. It can be considered that only the normal type of flight control computer with the highest priority has the right to send the target instruction to the normal high-speed communication bus among all normal type of flight control computers. Further, the normal type of flight control computer with the highest priority can send the target instruction only when it is determined that it is not faulty.

[0163] One example method for the normal type of flight control computer to determine whether it is faulty is the "cross-checking" mentioned in the related description of Figure 1 The example workflow of this method is introduced below.

[0164] For example, each normal type of flight control computer includes Figure 1 For example, the flight control computers 1-3 shown in FIG. 1, taking the flight control computer 1 as an example, the condition for the flight control computer 1 to determine that it is faulty is, for example, that when the flight control computer 1 judges that the flight control computer 1 is not faulty, both the flight control computer 2 and the flight control computer 3 judge that the flight control computer 1 is faulty; or when the flight control computer 1 judges that the flight control computer 1 is faulty, at least one of the flight control computer 2 and the flight control computer 3 judges that the flight control computer 1 is faulty.

[0165] Exemplarily, each normal type of flight control computer is firstly provided with a self-checking function, for example, checking the actual running state parameter obtained by itself, or for example, checking the failure state signal and / or target instruction determined by itself based on the same actual running state parameter. When the actual running state parameter and / or the failure state signal and / or the target instruction before and after the checking are the same, it can be judged that the flight control computer 1 does not appear to be faulty, and when the actual running state parameter and / or the failure state signal and / or the target instruction before and after the checking are different, it can be judged that the flight control computer 1 appears to be faulty. It should be noted that the result of the judgment is not the final result of whether the flight control computer 1 appears to be faulty, and whether the flight control computer 1 appears to be faulty needs to be determined by referring to the judgment result of whether the flight control computer 1 appears to be faulty by the flight control computer 2 and the flight control computer 3.

[0166] Each normal type of flight control computer can communicate with each other through a dedicated high-speed communication bus (not shown), and the content of the communication can be the actual running state parameter, the failure state signal determined by the flight control computer, the target instruction, and the like. Taking the target instruction as an example, the flight control computer 1 transmits the target instruction determined by itself to the flight control computer 2 and the flight control computer 3 through the dedicated high-speed communication bus, and the flight control computer 2 and the flight control computer 3 compare the target instruction determined by themselves with the target instruction received from the flight control computer 1. When the target instructions determined by the two flight control computers are the same, it can be judged that the flight control computer 1 does not appear to be faulty, and when the target instructions determined by the two flight control computers are different, it can be judged that the flight control computer 1 appears to be faulty. After the flight control computer 2 and the flight control computer 3 complete the judgment, they can output the judgment result indicating whether the flight control computer 1 appears to be faulty to the flight control computer 1 through the dedicated high-speed communication bus. The flight control computer 1 determines whether it appears to be faulty according to the judgment result of itself and the received judgment result.

[0167] Suppose that in the current priority list, the priority order from high to low is the flight control computer 1, the flight control computer 2, and the flight control computer 3 in turn, and according to the above method, if the flight control computer 1 determines that it does not appear to be faulty, the failure state signal and the target instruction determined by the flight control computer 1 will be output by the flight control computer 1. If the flight control computer 1 determines that it appears to be faulty, the priority list stored by itself can be updated, and the flight control computer 1 can be arranged at the last in the priority list. And the flight control computer 2 and the flight control computer 3 are informed to update the priority list stored by themselves through the dedicated high-speed communication bus, and the flight control computer 1 is arranged at the last in the priority list. Thereafter, the flight control computer 1 can enter the restart program. At this time, the second priority flight control computer 2 in the original priority list can become the first priority in the updated priority list. Then the failure state signal and the target instruction will be continued to be output by the flight control computer 2 to the normal high-speed communication bus.

[0168] In extreme cases, when all normal flight control computers determine they have failed, no failure status signals or target commands may be output to the normal high-speed communication bus within a preset time period. This means that the first functional module has not received any target commands from any normal flight control computer within the preset time period. Similarly, the second functional module has not received any failure status signals from any normal flight control computer within the preset time period. However, backup flight control computers do not participate in the cross-check process, and their determined failure status signals and target commands can be normally output to the backup high-speed communication bus. Therefore, in this case, the first functional module can execute the target command from the highest-priority backup flight control computer (flight control computer 4). The second functional module can execute the failure status signal from the highest-priority backup flight control computer (flight control computer 4).

[0169] The above-mentioned method for determining whether a normal type of flight control computer determines that it has no fault is only an example. Those skilled in the art should understand that in actual applications, the number of normal types of flight control computers may be greater, and the conditions for the flight control computer to determine that it has no fault can be adaptively adjusted according to the number of flight control computers and the requirements of application scenarios. For example, when a normal type of flight control computer A determines that it has no fault, if more than half of the normal types of flight control computers determine that the flight control computer A has no fault, then it is determined that the flight control computer A has no fault, etc. Alternatively, it may not be limited to the cross-checking method. As long as the accuracy of determining whether the flight control computer has no fault can be guaranteed, the present disclosure does not limit the method for determining whether a normal type of flight control computer determines that it has no fault.

[0170] The priority list updating method described above is only an example. As long as the normal type of flight control computer can output failure status signals and target instructions, the flight control computer with the first priority in the priority list does not fail. The present disclosure does not limit the specific updating method of the priority list.

[0171] The present disclosure also provides an aircraft, comprising the flight control system described above. The aircraft of the present disclosure may be an electric vertical take-off and landing aircraft with a composite wing configuration.

[0172] While various embodiments of the present disclosure have been described above, the foregoing description is intended to be illustrative, non-exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technological improvements in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A flight control method, characterized in that: Applicable to any flight control computer in a flight control system, the flight control system comprising multiple flight control computers and multiple functional modules controlled by the flight control computers, the flight control computers comprising a computing module and a management module, the method comprising: The computing module outputs the target instruction to the first functional module; The calculation module obtains actual operating status parameters of the first functional module, where the first functional module is at least one functional module controlled by the calculation module among the multiple functional modules, and the first functional module includes one or more of a motor and a steering gear; The calculation module determines whether the first functional module has a fault based on the actual operating status parameter, and outputs a fault signal to the management module when a fault occurs, wherein the fault signal indicates the functional module having the fault and the type of the fault; The management module receives a fault signal from a second functional module and a fault signal from the calculation module, wherein the second functional module is at least one functional module among the plurality of functional modules that is not controlled by the calculation module; The management module determines a failure status signal based on all received fault signals, and when the failure status signal is output to the calculation module and the second functional module, the calculation module and the second functional module process the fault based on the failure status signal; The calculation module determines whether a fault occurs in the first functional module according to the actual operating status parameter, including: For any functional module in the first functional modules, when the actual operating status parameters of the functional module under the target instruction are consistent with the expected operating status parameters of the functional module under the target instruction, it is determined that the functional module has no fault; when the actual operating status parameters of the functional module under the target instruction are inconsistent with the expected operating status parameters of the functional module under the target instruction, it is determined that the functional module has a fault.

2. The method according to claim 1, characterized in that The flight control computer is further configured to obtain and / or process actual acceleration, actual velocity, actual position, actual angular velocity, actual angular acceleration, and actual attitude as inputs to the calculation module. The method further comprises: Upon receiving the failure status signal, the computing module determines a desired speed, a desired position, and a first desired posture; The calculation module determines an expected acceleration and a second expected posture according to the expected speed, the expected position, the actual acceleration, the actual speed and the actual position; The calculation module determines an expected angular acceleration based on the first expected posture, the second expected posture, the actual angular velocity, the actual angular acceleration, and the actual posture; The calculation module determines a target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration, and outputs the target instruction to the first functional module.

3. The method according to claim 2, characterized in that The calculation module determines, based on the expected acceleration and the expected angular acceleration, a target instruction corresponding to the first functional module and outputs the target instruction to the first functional module, including: The calculation module determines a target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration; The calculation module performs instruction smoothing processing and / or anti-oversaturation processing on the target instruction to obtain a processed target instruction; The calculation module outputs the processed target instruction to the first functional module.

4. The method according to claim 2 or 3, characterized in that The calculation module determines an expected acceleration and a second expected posture according to the expected speed, the expected position, the actual acceleration, the actual speed, and the actual position, including: The calculation module determines the expected acceleration and the second expected posture according to the expected speed, the expected position, the actual acceleration, the actual speed and the actual position, and the most recently obtained target instruction.

5. The method according to claim 2, characterized in that The calculation module determines, based on the expected acceleration and the expected angular acceleration, a target instruction corresponding to the first functional module and outputs the target instruction to the first functional module, including: The calculation module determines a target instruction corresponding to the first functional module based on the expected acceleration and the expected angular acceleration, so that the total power required by the first functional module to execute the target instruction is minimized; The calculation module outputs the determined target instruction to the first function module.

6. The method according to claim 2, characterized in that The calculation module determines, based on the expected acceleration and the expected angular acceleration, a target instruction corresponding to the first functional module and outputs the target instruction to the first functional module, including: The calculation module determines a target instruction corresponding to the first functional module according to the expected acceleration and the expected angular acceleration, so that when the first functional module executes the target instruction, a resource margin not occupied by the target instruction is maximized; The calculation module outputs the determined target instruction to the first function module.

7. The method according to claim 1, characterized in that The functional module has a self-detection function, and the fault signal from the functional module is obtained by the functional module executing the self-detection function.

8. The method according to claim 1, characterized in that The motor and the steering gear are used to drive the propeller; The second functional module includes one or more of a propeller status sensor, a high-voltage battery manager, and an avionics core computer.

9. A flight control system, characterized in that: The invention comprises a plurality of flight control computers and a plurality of functional modules, wherein the flight control computers execute the flight control method according to any one of claims 1 to 8.

10. The flight control system according to claim 9, characterized in that: The types of the first functional modules include lift power type, control surface control type and thrust power type, and the types of the flight control computers include normal type and backup type, wherein the number of the normal type flight control computers is three or more, and the number of the backup type flight control computers is one or more; For each normal type of flight control computer, the normal type of flight control computer is connected to multiple normal high-speed communication buses, and the number of the normal high-speed communication buses is greater than or equal to the maximum number of lift power type functional modules, control surface control type functional modules, and thrust power type functional modules; Each lift power type functional module is connected to a normal high-speed communication bus, each rudder control type functional module is connected to a normal high-speed communication bus, and each thrust power type functional module is connected to a normal high-speed communication bus. For each spare type of flight control computer, the spare type of flight control computer is respectively connected to a spare high-speed communication bus, and the number of the spare high-speed communication buses is greater than or equal to the number of spare type of flight control computers; Each of the first functional modules is connected to each backup high-speed communication bus respectively.

11. The flight control system according to claim 10, characterized in that: In the flight control system, each normal type of flight control computer communicates with each other through a dedicated high-speed communication bus. Each normal type of flight control computer obtains actual operating status parameters of at least one lift power type functional module, at least one control surface control type functional module, and at least one thrust power type functional module through a normal high-speed communication bus, and obtains a failure status signal and a target instruction based on the obtained actual operating status parameters; Each backup type of flight control computer obtains actual operating status parameters of each lift power type functional module, each control surface control type functional module, and each thrust power type functional module through a backup high-speed communication bus, and obtains a failure status signal and a target instruction based on the obtained actual operating status parameters; When the first functional module does not receive a target instruction from a normal type of flight control computer within a preset time period, it executes a target instruction from a backup type of flight control computer with the highest priority; When the second functional module does not receive a failure status signal from a normal type of flight control computer within a preset time period, it executes a failure status signal from a backup type of flight control computer with the highest priority.

12. The flight control system according to claim 11, characterized in that: In the flight control system, each normal type of flight control computer stores a current priority list of normal type flight control computers, and the normal type of flight control computer with the highest priority in the current priority list sends the target instruction to the normal high-speed communication bus.

13. An aircraft, characterized in that: A flight control system comprising the flight control system according to any one of claims 9 to 11.

Images