Redundancy control method, actuator processing module, flight control system and storage medium

Abstract

The present invention discloses a redundancy control method, an actuator processing module, a flight control system and a storage medium. The method includes: a first actuator processor receives a verification flight control instruction sent by a first flight control computer, and compares the verification flight control instruction with the main flight control instruction of the first flight control computer received by a second actuator processor. When the main flight control instruction does not match the verification flight control instruction, it indicates that the second actuator processor has a fault. At this time, a disconnection signal is sent to the power switch corresponding to the second actuator processor, and a locking signal is sent to the locking mechanism, so that the first actuator processor can synchronously control the actuators locked together. Thus, when one actuator processing module discovers that another actuator processing module has a fault, the power output of the other party can be cut off in time, and the normal actuator processing module is used to control all the actuators, protecting the maneuverability of the overall actuators and improving flight safety.

Description

Technical Field

[0001] The present invention relates to the technical field of aircraft, and particularly to a redundancy control method, an actuator processing module, a flight control system and a storage medium. Background Art

[0002] With the development of the design technology, manufacturing technology and related supporting industries of small aircraft, the functions, performances and production volumes of small aircraft have gradually become stable and mature, and the operation of small aircraft has gradually developed towards civil aviation fields such as logistics transportation and manned transportation. However, due to the particularity of the flight platform itself, new challenges have been posed to the safety of the aircraft. In related technologies, the flight control computer adopts dual redundancy or multi-redundancy control. However, it only provides protection when a fault occurs at the flight control computer level. If a fault occurs in the actuator module or the actuator, it will also pose a great threat to flight safety. Summary of the Invention

[0003] Embodiments of the present application provide a redundancy control method, an actuator processing module, a flight control system and a storage medium, aiming to solve the problem of flight insecurity caused by a fault in the actuator module or the actuator.

[0004] Embodiments of the present application provide a redundancy control method for a flight control system applied to a first actuator processor. The redundancy control method of the flight control system includes:

[0005] Receiving a verification flight control instruction sent by a first flight control computer;

[0006] Obtaining a main flight control instruction received by a second actuator processor, where the main flight control instruction is sent by the first flight control computer to the second actuator processor;

[0007] When the main flight control instruction does not match the verification flight control instruction, sending a disconnection signal to a power switch corresponding to the second actuator processor;

[0008] Sending a locking signal to a locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the locked actuators.

[0009] In addition, to achieve the above object, the present invention also provides an actuator processing module. The actuator processing module includes: a memory, an actuator processor, and a redundancy control program of a flight system stored on the memory and operable on the actuator processor. When the redundancy control program of the flight system is executed by the processor, the steps of the redundancy control method of the above flight control system are implemented.

[0010] In addition, to achieve the above object, the present invention further provides a flight control system, and the flight control system includes an actuator processing module.

[0011] In addition, to achieve the above object, the present invention further provides a computer-readable storage medium, on which a redundancy control program for a flight system is stored. When the redundancy control program for the flight system is executed by a processor, the steps of the redundancy control method for the above-mentioned flight control system are implemented.

[0012] In the technical solution of a redundancy control method, an actuator processing module, a flight control system, and a storage medium provided in the embodiments of the present application, a first actuator processor in the present application receives a verification flight control instruction sent by a first flight control computer, and compares the verification flight control instruction with the main flight control instruction of the first flight control computer received by a second actuator processor. When the main flight control instruction does not match the verification flight control instruction, it indicates that the second actuator processor has a fault. At this time, a disconnection signal is sent to the power switch corresponding to the second actuator processor, and a locking signal is sent to the locking mechanism, so that the first actuator processor can synchronously control the actuators locked together. Thus, when one actuator processor finds that the other actuator processor has a fault, the power output of the other party can be cut off in time, and the normal actuator processor is used to control all the actuators, protecting the manipulability of the overall actuators and improving flight safety. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 It is a schematic flowchart of the first embodiment of the redundancy control method for the flight control system of the present invention;

[0014] Figure 2 It is a schematic flowchart of the second embodiment of the redundancy control method for the flight control system of the present invention;

[0015] Figure 3 It is a schematic flowchart of the third embodiment of the redundancy control method for the flight control system of the present invention;

[0016] Figure 4 It is a schematic flowchart of another embodiment of the redundancy control method for the flight control system of the present invention;

[0017] Figure 5 It is a schematic structural diagram of the flight control system of the present invention.

[0018] The realization of the object of the present application, functional features, and advantages will be further described in conjunction with the embodiments with reference to the accompanying drawings. The above accompanying drawings are only diagrams of one embodiment and not all of the invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] In the related art, in order to improve flight safety, flight control computers are usually set to be dual-redundant or multi-redundant, while the actuator processors controlled by the flight control computers are set to be single-redundant; that is, under normal circumstances, one flight control computer is connected to the actuator processor, and the actuator processor is connected to the actuator, and then the actuator drives the actuator mechanism to work. When one of the flight control computers is damaged, the normal flight control computer can be switched to replace the damaged flight control computer for control, so as to achieve flight safety. However, it only provides fault protection at the flight control computer level. When a fault occurs in the actuator processor, actuator, or actuator mechanism, it will still pose a great threat to flight safety.

[0020] Therefore, this application aims to solve the threat to flight safety caused by faults in the actuator module or actuator mechanism. This application proposes a redundant control method for a flight control system. This method protects flight safety at the actuator processor level and the actuator level. This application sets the actuator processor and the actuator to be redundant. The first actuator processor of this application receives the verification flight control instruction sent by the first flight control computer, and compares the verification flight control instruction with the main flight control instruction of the first flight control computer received by the second actuator processor. When the main flight control instruction does not match the verification flight control instruction, it indicates that the second actuator processor has a fault. At this time, a disconnection signal is sent to the power switch corresponding to the second actuator processor, and a locking signal is sent to the locking mechanism, so that the first actuator processor can synchronously control the actuator mechanisms locked together. Thus, when one device detects a fault in the other device, it can timely cut off the power output of the other party, and use the normal device to control all actuator mechanisms, protect the maneuverability of the overall actuator mechanism, and improve flight safety.

[0021] To better understand the above technical solution, the exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be fully conveyed to those skilled in the art.

[0022] As Figure 1As shown in the figure, in the first embodiment of the present application, the redundancy control method of the flight control system of the present application is applied to the first actuator processor. The first actuator processor is used to verify whether the other actuator processor fails, and cut off the signal output of the other actuator processor when the other actuator processor fails. The first actuator processor is further used to send a disconnection signal to the actuator connected to itself and a locking signal to the locking mechanism when it verifies that the actual manipulation amount of the actuator does not match the theoretical manipulation amount of the main flight control instruction, so that the second actuator can synchronously control all actuators, enabling the aircraft to fly safely. The redundancy control method of the flight control system includes the following steps:

[0023] Step S110: Receive the verification flight control instruction sent by the first flight control computer.

[0024] Step S120: Obtain the main flight control instruction received by the second actuator processor, where the main flight control instruction is sent by the first flight control computer to the second actuator processor;

[0025] Step S130: Determine whether the main flight control instruction matches the verification flight control instruction;

[0026] Step S140: When the main flight control instruction does not match the verification flight control instruction, send a disconnection signal to the power switch corresponding to the second actuator processor;

[0027] Step S150: Send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

[0028] In this embodiment, the flight control computer, actuator processor, and actuator of the present application can all be set to be redundant. That is, in the flight control system, the flight control computer, actuator processor, and actuator can be set to two or even more, and the number of the flight control computer, actuator processor, and actuator can be set according to the actual usage situation and specific application scenario. The present application takes the flight control computer, actuator processor, and actuator with dual redundancy settings as an example.

[0029] Before the actuator accepts control, the actuator processor needs to convert the main control instruction sent by the flight control computer into an output current to the actuator. In order to be able to control normally, it is necessary to ensure that the actuator processor can work properly. Therefore, this application adopts a mechanism in which actuator processors supervise each other. Each actuator processor will receive all the control instructions from the flight control computer. One of the control instructions is its own main control instruction, which is used to output to the actuator to drive the actuator; the other flight control computer control instruction is used to verify whether the other actuator processor is normal. When a single actuator processor fails, another normally operating actuator processor intervenes to cut off the output of the faulty actuator processor and at the same time lock the two separated actuators, so that the normally operating actuator can control all the actuators.

[0030] Furthermore, each actuator processor processes two tasks in parallel with two threads. The first thread task is to convert the main flight control instruction to the corresponding actuator motor, and the second thread is to check whether the output is reasonable according to the input and output of the other actuator processor. The reason for adopting the two-thread design is to avoid conflicts between the checking process and the main calculation work.

[0031] Furthermore, the checking algorithm is executed in the second thread, including the input checking algorithm and the output checking algorithm. First, the input checking algorithm is executed. Among them, the input checking algorithm is: judge whether the main flight control instruction received by the other party matches the checking flight control instruction received by this processor. If they do not match, inform the main flight control computer of the other actuator processor of this error and cut off the power output of the other actuator processor. If they match, the output checking algorithm is performed. Among them, the output checking algorithm is: when it is checked that the output of the other actuator processor is unreasonable, an off signal is output to the power switch of the other actuator, and at the same time, a locking signal is output to the locking mechanism between the actuators, so that one's own actuator can control the two actuators at the same time.

[0032] Since the present application adopts a mutual detection method for dual-redundancy actuator processors, the dual-redundancy mutual monitoring should allow the two actuator processors to share all data, including the data output from the flight control computer to the actuator processors, the output data of the actuator processors, and the feedback data of the sensors corresponding to the actuators. When one actuator processor finds that the input or output of the other actuator processor does not match, the output power of the other is cut off, thereby protecting the maneuverability of the overall actuator. In addition, the mutual detection of the two actuator processors is to judge whether the other actuator processor outputs an error through a parallel verification algorithm, so as to avoid verifying the input and output of the other actuator processor with the main drive algorithm. The verification algorithm is independent of the main drive. Even if the main drive algorithm has problems, the separate verification algorithm will not be affected. The other actuator processor will also immediately close the output to the faulty actuator processor, thereby improving flight stability and safety.

[0033] Optionally, when the redundancy control method of the flight control system of the present application is applied to the first actuator processor, when the first actuator processor and the second actuator processor are working properly, the first actuator processor can accept all control instructions from the flight control computers, including the verification flight control instructions sent by the first flight control computer and the main flight control instructions sent by the second flight control computer. Similarly, the second actuator processor can also accept all control instructions from the flight control computers, including the verification flight control instructions sent by the second flight control computer and the main flight control instructions sent by the first flight control computer. The first actuator processor and the second actuator processor can send their own main flight control instructions to the other actuator processor to verify whether the other actuator processor can work properly.

[0034] Optionally, the present application takes the execution of the input verification algorithm in the first actuator processor as an example. For the first actuator processor, in order to verify whether the second actuator processor can work properly, the first actuator processor can obtain the main flight control instruction sent by the second actuator processor, and this main flight control instruction is sent by the first flight control computer to the second actuator processor. The second actuator processor sends this main flight control instruction to the first actuator processor to verify the second actuator processor with the first actuator processor. Optionally, the first actuator processor will match this main flight control instruction with its own verification flight control instruction. When the main flight control instruction does not match the verification flight control instruction, it means that the first actuator processor calculates that the second actuator processor may have a fault. At this time, a disconnection signal will be sent to the power switch corresponding to the second actuator processor, and at the same time, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

[0035] Similarly, the redundancy control method of the flight control system of the present application is equally applicable to the second actuator processor, and the input verification algorithm can be executed in the second actuator processor. Optionally, for the second actuator processor, in order to verify whether the first actuator processor can work properly, the second actuator processor can obtain the main flight control instruction sent by the first actuator processor, and the main flight control instruction is sent by the second flight computer to the first actuator processor. The first actuator processor sends the main flight control instruction to the second actuator processor for the second actuator processor to verify the first actuator processor. Optionally, the second actuator processor will match the main flight control instruction with its own verification flight control instruction. When the main flight control instruction does not match the verification flight control instruction, it means that the second actuator processor calculates that the first actuator processor may have a fault. At this time, the second actuator processor will send a disconnection signal to the power switch corresponding to the first actuator processor, and at the same time, the second actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the actuators locked together.

[0036] Optionally, the present application can also set a third-party monitoring module, and the input verification algorithm can also be executed in the third-party monitoring module. The redundancy control method of the flight control system of the present application is equally applicable to the third-party monitoring module. A verification algorithm is set in the third-party monitoring module, which can obtain the verification flight control instruction sent by the first flight computer to the first actuator processor and at the same time obtain the main flight control instruction sent by the first flight computer to the second actuator processor.

[0037] Optionally, the third-party monitoring module will match the verification flight control instruction and the main flight control instruction. When the main flight control instruction does not match the verification flight control instruction, it means that the second actuator processor may have a fault. At this time, the first actuator processor will send a disconnection signal to the power switch corresponding to the second actuator processor, and at the same time, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

[0038] Similarly, the third-party monitoring module also obtains the verified flight control instructions sent by the second flight control computer to the second actuator processor, and at the same time obtains the main flight control instructions sent by the second flight control computer to the first actuator processor. Optionally, the third-party monitoring module matches the verified flight control instructions and the main flight control instructions. When the main flight control instructions do not match the verified flight control instructions, it indicates that a fault may exist in the first actuator processor. At this time, the second actuator processor sends a disconnection signal to the power switch corresponding to the first actuator processor, and at the same time, the second actuator processor also sends a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the actuators locked together.

[0039] In one embodiment, when executing the above input verification algorithm, if the main flight control instructions do not match the verified flight control instructions, the main flight control computer of the other actuator processor is informed of this error, and the power output of the other actuator processor is truncated.

[0040] Optionally, for the first actuator processor, when the first actuator processor determines that the main flight control instructions of the second actuator processor do not match its own verified flight control instructions, an error message including the mismatch between the main flight control instructions and the verified flight control instructions can be generated, and the error message is sent to the main flight control computer of the second actuator processor, that is, the first flight control computer, so that the error message can be timely feedback and corresponding rectifications can be made in a timely manner to avoid flight accidents.

[0041] Similarly, for the second actuator processor, when the second actuator determines that the main flight control instructions of the first actuator processor do not match its own verified flight control instructions, an error message including the mismatch between the main flight control instructions and the verified flight control instructions can be generated, and the error message is sent to the main flight control computer of the first actuator processor, that is, the second flight control computer, so that the error message can be timely feedback and corresponding rectifications can be made in a timely manner to avoid flight accidents.

[0042] In one embodiment, if both the first actuator processor and the second actuator processor detect faults in each other. To avoid all actuator processors being shut down, resulting in the inability to control the actuators or the actuators, and further causing the aircraft to be unable to fly normally, the present application also provides a limiter. The limiter is connected to the actuator processor and the power switch, and is used to control the power switch connected to at least one actuator processor to close when receiving the disconnection signals sent by all actuator processors, or is used to control at least one actuator processor to send a locking signal to the locking mechanism when receiving the disconnection signals sent by all actuator processors. That is, to ensure that at least one actuator processor can be normally controlled.

[0043] Optionally, to improve the accuracy of the verification results, it is necessary to ensure the synchronization of the verification by the first actuator processor and the second actuator processor, that is, to control the first actuator processor and the second actuator processor to execute the verification algorithm simultaneously.

[0044] Optionally, if both the first actuator processor and the second actuator processor detect input faults in each other, the output of the actuator of the other actuator processor of the actuator processor that first detects the fault in the other party can be disconnected. For example, if the first actuator processor first calculates that the second actuator processor has a fault, then a disconnection signal can be sent to the power switch corresponding to the second actuator processor. Optionally, a disconnection signal is sent to the limiter, so as to avoid disconnecting the power switch corresponding to the first actuator processor when the second actuator processor also calculates that the first actuator processor has an input fault.

[0045] Optionally, if both the first actuator processor and the second actuator processor detect input faults in each other, a disconnection signal can also be sent to the power switch corresponding to the actuator server that meets the conditions of the most historical fault times, the least historical usage frequency, and the lowest quality of service.

[0046] In one embodiment, for the redundancy control of the entire flight control system, when all flight control computers are working properly, different flight control computers can be used to execute different control functions. When a certain flight control computer fails, a normally working flight control computer can be used to replace the failed flight control computer to execute the control function of the failed flight control computer. Similarly, when all actuator processors are working properly, different actuator processors can be used to execute different data processing functions and control the connected actuators to work. When a certain actuator processor fails, a normally working actuator processor can be used to replace the failed actuator processor and control the actuator connected to the failed actuator processor. Similarly, when all actuators are working properly, different actuators can be used to drive their corresponding actuating mechanisms. However, when a certain actuator fails, the actuator processor connected to the normally working actuator can send a locking signal to the locking mechanism, so that the normally working actuator processor can synchronously control the actuating mechanisms locked together.

[0047] Optionally, assume that the flight control computer, the actuator processor, and the actuator are all set to dual redundancy. The flight control computer includes a first flight control computer and a second flight control computer; the actuator processor includes a first actuator processor and a second actuator processor; the actuator includes a first actuator and a second actuator; the actuating mechanism includes a first actuating mechanism and a second actuating structure. Then there are but not limited to the following situations:

[0048] First, for the case where all flight control computers, all actuator processors, and all actuators are working properly. The control process is as follows: The first flight control computer sends the main flight control instruction to the first actuator processor; the first actuator processor converts the main control instruction into a current signal and sends it to the first actuator, and the first actuator then sends the current signal to the first actuator mechanism, thereby realizing the drive of the first actuator mechanism by the first flight control computer. At the same time, the second flight control computer sends the main flight control instruction to the second actuator processor; the second actuator processor converts the main control instruction into a current signal and sends it to the second actuator, and the second actuator then sends the current signal to the second actuator mechanism, thereby realizing the drive of the second actuator mechanism by the second flight control computer. Thus, when all devices are working properly, each device can perform its own functions, enabling the aircraft to work normally.

[0049] Second, for the case where the first flight control computer fails or the second flight control computer fails, and all actuator processors are working properly. For the control process when the first flight control computer fails: The second flight control computer sends the main flight control instruction to the first actuator processor and the second actuator processor simultaneously. This enables the first actuator processor and the second actuator processor to perform their respective controls. Optionally, the main flight control instruction of the second flight control computer can also be sent only to the second actuator processor connected to it, and the second actuator processor is used to control all actuators and actuator mechanisms. Similarly, for the control process when the second flight control computer fails: The first flight control computer sends the main flight control instruction to the first actuator processor and the second actuator processor simultaneously. This enables the first actuator processor and the second actuator processor to perform their respective controls. Optionally, the main flight control instruction of the first flight control computer can also be sent only to the first actuator processor connected to it, and the first actuator processor is used to control all actuators and actuator mechanisms. Thus, when a certain flight control computer fails, the normally working flight control computer can be used to control all normally working actuators and actuator mechanisms, improving flight safety.

[0050] Third, for the situation where all flight control computers are normal and the first actuator processor or the second actuator processor fails. The control process for the failure of the first actuator processor is as follows: The second flight control computer sends the main control instruction to the second actuator processor, and the second actuator processor converts the main control instruction into a current signal and sends it to the second actuator. At the same time, the second actuator processor sends a locking signal to the locking mechanism to lock the actuator, and sends a disconnection signal to the power switch corresponding to the first actuator processor, so that the normally operating flight control computer can control all actuators through the second actuator processor. Similarly, the control process for the failure of the second actuator processor is as follows: The first flight control computer sends the main control instruction to the first actuator processor, and the first actuator processor converts the main control instruction into a current signal and sends it to the first actuator. At the same time, the first actuator processor sends a locking signal to the locking mechanism to lock the actuator, and sends a disconnection signal to the power switch corresponding to the second actuator processor, so that the normally operating flight control computer can control all actuators through the first actuator processor. Thus, when one of the actuator processors fails, the normally operating flight control computer can control the normally operating actuator processor to control all actuators, improving flight safety.

[0051] Fourth, for the situation where all flight control computers are abnormal and the first actuator processor and / or the second actuator processor are normal, the manual control mode can be switched to and manual operation can be used for control to avoid affecting the flight safety of the aircraft when all flight control computers fail.

[0052] In an embodiment, at the flight control computer level, an arbitration unit for determining whether a flight control computer fails is further provided in the flight control computer hierarchy. During flight, each flight control computer will send control instructions to the actuator processor in real time, so that the actuator processor can control the actuator based on the control instructions sent by the flight control computer. However, due to various emergencies that may occur during flight, the flight control computer may not work properly. To improve flight safety performance, the control information of each flight control computer also needs to be sent to the arbitration unit. The arbitration unit determines in real time whether a flight control computer fails and determines the corresponding control strategy according to the judgment result to control the actuator processor, thereby improving flight safety.

[0053] Optionally, the control information of each flight control computer can be synchronously sent to the arbitration unit at preset time intervals to avoid inaccurate fault judgment caused by asynchronous data transmission, thereby affecting the stability of the aircraft.

[0054] Optionally, each flight control computer outputs corresponding control instructions, which are instructions for controlling the operation of motors, control surfaces, throttles, etc. The control instructions include, for example, throttle instructions, rudder deflection instructions, motor speed instructions, motor torque instructions, etc.

[0055] Optionally, each flight control computer outputs a check code, which is used to check and determine whether the flight control computer fails. The format of the check code can be preset according to different aircraft models.

[0056] Optionally, when each flight control computer outputs control instructions, it attaches a set of check codes to prove that it is still working properly. The arbitration unit determines whether there is a fault in the flight control computer by comparing the control instructions output by each flight control computer and checking the check codes.

[0057] Optionally, a preset check code is pre-set in the arbitration unit. The format and type of the preset check code should be consistent with the format and type of the check code sent by the flight control computer. That is, after the arbitration unit receives the check codes of each flight control computer, it will perform format matching and type matching on the received check codes of each flight control computer with the preset check code respectively. If the check code of the flight control computer does not match the preset check code, the unmatched flight control computer is determined to be a faulty flight control computer, that is, a failed flight control computer. Optionally, a flight control computer with no signal output or garbled output can also be determined as a faulty flight control computer. Optionally, when the flight control computer outputs control instructions at a constant frequency, if the arbitration unit detects that the output frequency is interrupted, the flight control computer is determined to be a faulty flight control computer.

[0058] For example, assume there is a first flight control computer and a second flight control computer. Assume that when the check code of the first flight control computer is inconsistent with the preset check code, the first flight control computer is determined to be a faulty flight control computer; if the check code of the second flight control computer is inconsistent with the preset check code, the second flight control computer is determined to be a faulty flight control computer; assume that the check codes of the first flight control computer and the second flight control computer are both inconsistent with the preset check code, then both the first flight control computer and the second flight control computer are determined to be faulty flight control computers.

[0059] Optionally, when there are at least two matching flight control computers, the error between the control instructions received by the matching flight control computers is determined. The flight control computers with an error greater than the preset error are all determined to be faulty flight control computers.

[0060] Optionally, the control instructions include multiple types, which can be discrete control instructions, continuous control instructions, Boolean control instructions, etc. The preset errors set for different types of control instructions are different. For example: for discrete control instructions, such as the throttle instruction: 10% of its own value range; for continuous control instructions, such as the rudder deflection instruction: 5% of its own value range; for Boolean control instructions, such as the takeoff instruction: 0 (i.e., zero tolerance).

[0061] For example, assume that the flight control computers with matching check codes are the first flight control computer and the second flight control computer. And the types of control instructions used by the first flight control computer and the second flight control computer are both discrete types. Then, the error between the control instructions of the first flight control computer and the control instructions of the second flight control computer can be calculated. When the error is greater than 10% of its own value range, it is determined that both the first flight control computer and the second flight control computer are faulty flight control computers. When the error is less than 10% of its own value range, it is determined that both the first flight control computer and the second flight control computer are operating normally.

[0062] Optionally, each flight control computer is connected to the arbitration unit and the actuator processor through a signal switch. The default state of this signal switch is the closed state. When the arbitration unit detects that a flight control computer has a fault, it sends a disconnection signal to the signal switch connected to the faulty flight control computer, thereby cutting off the signal output of the faulty flight control computer.

[0063] Optionally, if it is determined that the check code output by one of the flight control computers is faulty, the control instructions output by this flight control computer are disconnected, and the control instructions output by another normally operating flight control computer are selected and sent to the actuator processor.

[0064] Optionally, when all flight control computers are operating normally, each flight control computer can control the corresponding actuator processor through the corresponding signal switch. However, when one of the flight control computers fails, the normally operating flight control computer can be controlled to control all actuator processors. Optionally, the signal switch corresponding to the normally operating flight control computer can be controlled to close, so that the signal switch is connected to all actuator processors.

[0065] For example, assume that it is detected that the first flight control computer is faulty and the second flight control computer is normal. Then, the arbitration unit sends a disconnection signal to the signal switch connected to the first flight control computer, thereby cutting off the signal output of the first flight control computer. A closing signal is sent to the signal switch corresponding to the second flight control computer, so that the signal switch corresponding to the second flight control computer can be connected to all actuator processors, and then the second flight control computer is controlled to send the received control instructions to all actuator processors. Thus, all actuators are controlled by the second flight control computer.

[0066] Optionally, when all flight control computers malfunction, cut off the signal output of all flight control computers, connect the signal channel between the joystick and the actuator processor, and then send the control signal output by the joystick to the actuator processor, so as to control in the manual control mode to avoid affecting the flight safety of the aircraft when all flight control computers malfunction.

[0067] When the check codes of all flight control computers do not match the preset check codes, the signal channel between the joystick and the actuator processor can be connected, and then the control signal output by the joystick is sent to the actuator processor, so as to control in the manual control mode to avoid affecting the flight safety of the aircraft when all flight control computers malfunction.

[0068] When the check codes of all flight control computers match the preset check codes, but the error between the control commands received by the matching flight control computers is greater than the preset error, the signal channel between the joystick and the actuator processor can be connected, and then the control signal output by the joystick is sent to the actuator processor, so as to control in the manual control mode to avoid affecting the flight safety of the aircraft when all flight control computers malfunction.

[0069] When the output frequency of the control commands of all flight control computers fluctuates, the signal channel between the joystick and the actuator processor can be connected, and then the control signal output by the joystick is sent to the actuator processor, so as to control in the manual control mode to avoid affecting the flight safety of the aircraft when all flight control computers malfunction.

[0070] Optionally, the flight control system of the present application further includes a display. The arbitration unit can send the determination result of the malfunctioning flight control computer to the display for display. Wherein, the determination result is which specific flight control computer has malfunctioned, which can be the serial number of the malfunctioning flight control computer. Optionally, the arbitration unit also sends the reason for the malfunction judgment to the display, and the reason for the malfunction judgment can be inconsistent check codes, the error between control commands is greater than the preset error, etc.

[0071] Optionally, in addition to controlling the actuators or actuating mechanisms connected to the actuator processor through the flight control computer, the present application can also switch to the manual control mode, connect the signal channel between the joystick and the actuator processor, so as to send the control signal output by the joystick to the actuator processor, thereby controlling the actuator or actuating mechanism. When all flight control computers malfunction, the actuator or actuating mechanism can be controlled in the manual control mode to improve the flight safety of the flight system.

[0072] Optionally, a signal switch is connected between the joystick and the actuator processor, and the default state of the signal switch is the off state. When the arbitration unit sends a closing signal to the signal switch, it indicates that an arbitration intervention instruction has been received. At this time, the arbitration unit will cut off the signal output of all flight control computers. Additionally, when the signal switch is closed, the signal channel between the joystick and the actuator processor will be connected, so as to send the control signal output by the joystick to the actuator processor. The specific control methods include but are not limited to the following:

[0073] Example 1, the operator can select at any time in what way to control the aircraft. It can be that when all flight control computers are working properly and an arbitration intervention instruction is received, the control output of all flight control computers is cut off, and the signal channel between the joystick and the actuator processor is connected, so as to send the control signal output by the joystick to the actuator processor.

[0074] Example 2, it can also be that when all flight control computers have failures or a certain flight control computer has a failure and an arbitration intervention instruction is received, the control output of all flight control computers is cut off, and the signal channel between the joystick and the actuator processor is connected, so as to send the control signal output by the joystick to the actuator processor.

[0075] Example 3, it can be that when it is detected that the check code of a certain flight control computer does not match the preset check code, an arbitration intervention instruction is received, the control output of all flight control computers is cut off, and the signal channel between the joystick and the actuator processor is connected, so as to send the control signal output by the joystick to the actuator processor.

[0076] Example 4, it can also be that when it is detected that the error of the control instructions of each flight control computer is greater than the preset error, an arbitration intervention instruction is received, the control output of all flight control computers is cut off, and the signal channel between the joystick and the actuator processor is connected, so as to send the control signal output by the joystick to the actuator processor.

[0077] According to the above technical solution, in this embodiment, relative redundancy controls are designed at three levels: the flight control computer, the actuator processor, and the actuator output. At the flight control computer level, an arbitration unit is set to judge whether a flight control computer fails, and a solution strategy is judged according to the failure situation. At the actuator processor level, the actuator processors are made to supervise and detect each other. When the output of the other actuator processor does not match the input, the output of the other actuator will be cut off. Thus, when a device on one side finds that a device on the other side has a failure, it can timely cut off the power output of the other side, and use the normal device to control all actuators, protecting the maneuverability of the overall actuators and improving flight safety.

[0078] Such asFigure 2 As shown, based on the first embodiment. In the second embodiment of the present application, the redundancy control method of the flight control system of the present application includes the following steps:

[0079] Step S110: Receive the verification flight control instruction sent by the first flight control computer.

[0080] Step S120: Obtain the main flight control instruction received by the second actuator processor, where the main flight control instruction is sent by the first flight control computer to the second actuator processor;

[0081] Step S210: When the main flight control instruction matches the verification flight control instruction, obtain the first output instruction generated by the first actuator processor according to the verification flight control instruction, and obtain the second output instruction generated by the second actuator processor according to the main flight control instruction;

[0082] Step S220: Determine whether the first output instruction matches the second output instruction;

[0083] Step S230: When the first output instruction does not match the second output instruction, send a disconnection signal to the power switch corresponding to the second actuator processor;

[0084] Step S150: Send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

[0085] In this embodiment, when it is determined by the input verification algorithm that the main flight control instruction accepted by the other party matches the verification flight control instruction received by this actuator processor. Then the output verification algorithm is further executed. The output verification algorithm is: when it is verified that the output of the other party's actuator processor is unreasonable, then a disconnection signal is output to the power switch of the other party's actuator, and at the same time, a locking signal is output to the locking mechanism between the actuators, so that one's own actuator can control the two actuators simultaneously.

[0086] Optionally, this application takes the execution of the output verification algorithm in the first actuator processor as an example. For the first actuator processor, in order to further verify whether the second actuator processor can work properly, when the first actuator processor verifies the matching of the main flight control instruction and the verification flight control instruction, after obtaining the first output instruction generated by the first actuator processor according to the verification flight control instruction and the second output instruction generated by the second actuator processor according to the main flight control instruction, the output verification algorithm executed is: matching the first output instruction with the second output instruction. When the first output instruction does not match the second output instruction, it indicates that the first actuator processor verifies that there may be a fault in the output of the second actuator processor. At this time, a disconnection signal will be sent to the power switch corresponding to the second actuator processor, and at the same time, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

[0087] Similarly, this application can execute the output verification algorithm in the second actuator processor. Optionally, for the second actuator processor, in order to verify whether the output of the first actuator processor is normal and thus verify whether the first actuator processor can work properly, when the second actuator processor verifies the matching of the main flight control instruction and the verification flight control instruction, after obtaining the second output instruction generated by the second actuator processor according to the verification flight control instruction and the first output instruction generated by the first actuator processor according to the main flight control instruction, the output verification algorithm executed is: matching the first output instruction with the second output instruction. When the first output instruction does not match the second output instruction, it indicates that the second actuator processor verifies that there may be a fault in the output of the first actuator processor. At this time, a disconnection signal will be sent to the power switch corresponding to the first actuator processor, and at the same time, the second actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the actuators locked together.

[0088] Optionally, this application can also set a third-party monitoring module and execute the output verification algorithm in the third-party monitoring module.

[0089] Optionally, when the third-party monitoring module verifies that the main flight control instruction of the first flight control computer (the main flight control instruction is sent by the first flight control computer to the second actuator processor) matches the verification flight control instruction, the output verification algorithm can be further executed: obtaining the first output instruction generated by the first actuator processor according to the verification flight control instruction, and obtaining the second output instruction generated by the second actuator processor according to the main flight control instruction. The third-party monitoring module will match the first output instruction and the second output instruction. When the first output instruction does not match the second output instruction, it indicates that the first actuator processor may have detected a fault in the output of the second actuator processor. At this time, a disconnection signal will be sent to the power switch corresponding to the second actuator processor. At the same time, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

[0090] In one embodiment, if both the first actuator processor and the second actuator processor detect faults in each other's outputs. To avoid all actuator processors being completely shut down, resulting in the inability to control the actuators or the actuating mechanisms, and thus causing the aircraft to be unable to fly normally, the present application also provides a limiter. The limiter is connected to the actuator processor and the power switch, and is used to control the power switch connected to at least one actuator processor to close when receiving disconnection signals sent by all actuator processors, or is used to control at least one actuator processor to send a locking signal to the locking mechanism when receiving disconnection signals sent by all actuator processors. That is, to ensure that at least one actuator processor can perform normal control.

[0091] Optionally, to improve the accuracy of the verification result, it is necessary to ensure the synchronization of the verification by the first actuator processor and the second actuator processor, that is, to control the first actuator processor and the second actuator processor to execute the verification algorithm simultaneously.

[0092] Optionally, if both the first actuator processor and the second actuator processor detect output faults in each other, the output of the actuator of the other actuator processor of the actuator processor that first detected the output fault in the other can be disconnected. For example, if the first actuator processor first verifies that the second actuator processor has an output fault, then a disconnection signal can be sent to the power switch corresponding to the second actuator processor. Optionally, a disconnection signal is sent to the limiter to avoid disconnecting the power switch corresponding to the first actuator processor when the second actuator processor also verifies that the first actuator processor has an output fault, resulting in all actuator processors being shut down and affecting flight safety.

[0093] Optionally, if both the first actuator processor and the second actuator processor detect an output fault in the other party, a disconnection signal may also be sent to the power switch corresponding to the actuator server that meets the conditions of having the most historical fault occurrences, the least historical usage frequency, and the lowest quality of service.

[0094] According to the above technical solution, in this embodiment, the actuator processors are made to supervise and detect each other at the actuator processor level. When the output of the other actuator processor does not match the input, the output of the other actuator will be cut off, and the locking mechanism will be connected, so that another normal actuator can control both actuators at the same time. Thus, when one device detects a fault in the other device, the power output of the other party can be cut off in time, and all actuators can be controlled by using normal devices, protecting the maneuverability of the overall actuator and improving flight safety.

[0095] Refer to Figure 3 , based on the first embodiment and the second embodiment. In the third embodiment of the present application, the redundancy control method of the flight control system of the present application includes the following steps:

[0096] Step S310, receiving the main flight control instruction of the second flight control computer;

[0097] Step S320, sending the main flight control instruction to the actuator corresponding to the first actuator processor.

[0098] In this embodiment, each actuator processor processes two tasks in parallel with two threads. The first thread task is to convert the main flight control instruction to the corresponding actuator motor. The execution process of the second thread is as described in the first embodiment and the second embodiment, and will not be elaborated here. The reason for adopting the dual-thread design is to avoid conflicts between the verification process and the main calculation work. Optionally, the second thread can be executed in real time while the first thread is being executed.

[0099] Optionally, while the first actuator processor is performing verification calculations on the verification flight control instruction received from the first flight control computer, it can also receive the main flight control instruction from the second flight control computer for control, and send the main flight control instruction to the actuator corresponding to the first actuator processor. Optionally, the first actuator processor will convert the main flight control instruction into a current signal and then send it to the first actuator. On the side of the first actuator processor, a first power switch is also provided, and the first power switch is connected to the first actuator and the first actuator. The default state of the first power switch is the closed state, so that the current signal of the first actuator can be transmitted to the first actuator, thereby realizing the control of the first actuator.

[0100] Similarly, while receiving the verified flight control instructions from the second flight control computer for verification calculations, the second actuator processor can also receive the main flight control instructions from the first flight control computer for control and send the main flight control instructions to the actuator corresponding to the second actuator processor. Optionally, the second actuator processor converts the main flight control instructions into current signals and then sends them to the second actuator. On the side of the second actuator processor, a second power switch is also provided, and the second power switch connects the second actuator and the second actuator mechanism. The default state of the second power switch is the closed state, enabling the current signal of the second actuator to be transmitted to the second actuator mechanism, thereby achieving the control of the second actuator mechanism.

[0101] In one embodiment, at the actuator level, the actuator mechanism is divided into two parts and synchronously executed by the actuator. For example, a flap control surface is cut into left and right parts, and there is a locking mechanism in the middle that can lock the two parts into one body after receiving a signal. Each actuator controls the left and right parts respectively. When the control output of the corresponding actuator processor does not match the control amount feedback by one of the actuator mechanisms, the actuator is cut off and the locking mechanism is connected, enabling the other actuator to control both actuator mechanisms simultaneously.

[0102] The dual-redundancy protection at this level is to ensure that the actuator mechanism can still work normally in case of a failure of one side actuator motor or the actuator mechanism. The algorithm at this level is calculated by the actuator processor directly upstream of the faulty actuator. The input of the algorithm is the actual control amount of the actuator mechanism detected by the sensor of the actuator mechanism, such as the actual deflection angle of the flap. When it is detected that the actual control amount of the downstream actuator mechanism does not match the instruction output by the actuator processor, it can be determined that the downstream actuator motor fails or the actuator mechanism has a fault. The processing method is similar to the processing result of the previous level, that is, cutting off the output of the downstream actuator and transmitting a locking signal to the locking mechanism, and relying on the other side actuator processor and actuator to control all actuator mechanisms.

[0103] Optionally, on the premise that all actuator processors are working properly, on the side of the first actuator processor, the redundant control method of the present application further includes Figure 4 steps S410 - S440 and step S150 in

[0104] Step S410, obtaining the actual control amount of the actuator mechanism corresponding to the second flight control computer;

[0105] Step S420, determining whether the actual control amount matches the theoretical control amount of the main flight control instructions of the second flight control computer;

[0106] Step S430, when the actual control amount does not match the theoretical control amount of the main flight control instructions of the second flight control computer, sending a disconnection signal to the actuator connected to the first actuator processor;

[0107] Step S150, send a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the locked actuators.

[0108] In this embodiment, when the actual manipulation amount does not match the theoretical manipulation amount of the main flight control instruction of the second flight control computer, it indicates that there is a fault in the first actuator or the first actuator mechanism. At this time, a disconnection signal is sent to the first actuator corresponding to the first actuator processor.

[0109] Step S440, when the actual manipulation amount matches the theoretical manipulation amount of the main flight control instruction of the second flight control computer, send a closing signal to the actuator connected to the first actuator processor, so as to send the main control instruction of the second flight control computer to the actuator mechanism corresponding to the first actuator processor.

[0110] In this embodiment, when the actual manipulation amount matches the theoretical manipulation amount of the main flight control instruction of the second flight control computer, a closing signal is sent to the first actuator connected to the first actuator processor, so as to send the main control instruction of the second flight control computer to the actuator mechanism corresponding to the first actuator processor.

[0111] In one embodiment, on the premise that all actuator processors are working properly, on the side of the second actuator processor, the redundancy control method of the present application further includes: obtaining the actual manipulation amount of the second actuator mechanism corresponding to the first flight control computer; when the actual manipulation amount does not match the theoretical manipulation amount of the main flight control instruction of the first flight control computer, it indicates that there is a fault in the second actuator or the second actuator mechanism. At this time, a disconnection signal is sent to the second actuator corresponding to the second actuator processor; and a locking signal is sent to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the locked actuators. Optionally, when the actual manipulation amount matches the theoretical manipulation amount of the main flight control instruction of the first flight control computer, a closing signal is sent to the second actuator corresponding to the second actuator processor, so as to send the main control instruction of the second flight control computer to the second actuator mechanism corresponding to the second actuator processor.

[0112] In one embodiment, if both the first actuator processor and the second actuator processor detect a fault in their own actuators or actuator mechanisms. To avoid the problem that all actuators or actuator mechanisms are completely shut down, resulting in the aircraft being unable to fly normally, the present application is also provided with a limiter, which is connected to the actuator processor and the power switch. The actuator level and the actuator processor level share a limiter, which is used to limit that only one side of the signal can be cut off at the same time, that is, when receiving the disconnection signals sent by all actuator processors, it is used to control at least one actuator processor to send a locking signal to the locking mechanism.

[0113] According to the above technical solution, in this embodiment, at the output level of the actuator, the actuator mechanism is divided into two parts and synchronously executed by each actuator. Each actuator controls the left and right parts respectively. When the manipulation amount feedback by one of the actuator mechanisms does not match the control output of the corresponding actuator processor, the actuator is cut off, and the locking mechanism is connected so that the other actuator can control all the actuator mechanisms simultaneously, protecting the manipulability of the overall actuator mechanism and improving flight safety.

[0114] An embodiment of the redundancy control method for a flight control system is provided in an embodiment of the present invention. It should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than here.

[0115] As Figure 5 shown, Figure 5 It is a schematic structural diagram of the hardware operating environment of the actuator processing module. The actuator processing module includes: a memory, an actuator processor, and a redundancy control program of the flight system stored on the memory and operable on the actuator processor, where:

[0116] When the actuator processor calls the redundancy control program of the flight system stored in the memory, the following operations are performed:

[0117] Receive the verification flight control instruction sent by the first flight control computer;

[0118] Obtain the main flight control instruction received by the second actuator processor, where the main flight control instruction is sent by the first flight control computer to the second actuator processor;

[0119] When the main flight control instruction does not match the verification flight control instruction, send a disconnection signal to the power switch corresponding to the second actuator processor;

[0120] Send a locking signal to the locking mechanism to lock the corresponding actuator mechanism so that the first actuator processor can synchronously control the actuator mechanisms locked together.

[0121] Based on the same inventive concept, a flight control system provided by this application includes an actuator processing module. The actuator processing module of this application includes at least two actuator processing units, and each actuator processing unit includes an actuator processor, an actuator, a power switch, and an actuator mechanism. The power switch is connected between the actuator and the actuator mechanism; a locking mechanism located between the actuator mechanisms; each actuator processor is respectively connected to the corresponding power switch and the locking mechanism, and is configured to send a disconnection signal to the power switch of the faulty actuator processor and send a locking signal to the locking mechanism when it detects that the actuator processor fails; the default state of the locking mechanism is the disconnected state.

[0122] Optionally, the flight control system includes at least two flight control computers;

[0123] At least two signal switches, arranged corresponding to the flight control computers, for connecting the flight control computers and the actuator processing module;

[0124] An arbitration unit, which is respectively connected to each of the flight control computers and the signal switches, and is configured to send a disconnection signal to the signal switch corresponding to the faulty flight control computer when a flight control computer fails. The default state of the signal switch is the closed state.

[0125] Optionally, the flight control computer includes a first flight control computer 110 and a second flight control computer 120, and the signal switches include a first signal switch 130 and a second signal switch 140; both the first signal switch 130 and the second signal switch 140 are connected to the actuator processing module 160.

[0126] Optionally, the actuator processing module includes at least two actuator processing units, and each actuator processing unit includes an actuator processor, an actuator, a power switch, and an actuator mechanism. The power switch is connected between the actuator and the actuator mechanism;

[0127] A locking mechanism located between the actuator mechanisms;

[0128] Each actuator processor is respectively connected to the corresponding power switch and the locking mechanism, and is configured to send a disconnection signal to the power switch of the faulty actuator processor and send a locking signal to the locking mechanism when it detects that the actuator processor fails; the default state of the locking mechanism is the disconnected state.

[0129] Optionally, the actuator processor includes: a first actuator processor and a second actuator processor, both the first signal switch and the second signal switch are connected to the first actuator processor; and / or, both the first signal switch and the second signal switch are connected to the second actuator processor.

[0130] Optionally, the flight control system further includes: a limiter, the limiter is connected to the actuator processor and the power switch, and is configured to control the power switch connected to at least one actuator processor to close when receiving the disconnection signals sent by all the actuator processors, or to control at least one actuator processor to send a locking signal to the locking mechanism when receiving the disconnection signals sent by all the actuator processors.

[0131] Optionally, the actuator is connected to the actuator processor, and the actuator processor is further configured to send a disconnection signal to the corresponding actuator and a locking signal to the locking mechanism when detecting a failure of the actuator.

[0132] Optionally, the flight control system further includes: a detection sensor, the detection sensor is connected to the actuator and the actuator processor, and is configured to collect the actual manipulation amount of the actuator and feedback the actual manipulation amount to the actuator processor, so that the actuator processor can detect whether the actuator fails according to the actual manipulation amount.

[0133] Optionally, the actuator includes a control surface, a landing gear retraction unit, a tilting unit or a hatch.

[0134] Optionally, the actuator is all movable components on the aircraft, and the actuator can include a control surface, a landing gear retraction unit, a tilting unit or a hatch. Among them, the tilting unit is a rotor tilting unit; the control surface includes the control surfaces on the wing, the vertical tail and the horizontal tail.

[0135] Optionally, the flight control system further includes: a third signal switch, the third signal switch is connected to the joystick and the actuator processing module;

[0136] The arbitration unit is further configured to: send a closing signal to the third signal switch when all the flight control computers fail; the default state of the third signal switch is the open state.

[0137] Optionally, the flight control system further includes a display module, the display module is connected to the arbitration unit, and is configured to display the determination result of the flight control computer with a fault.

[0138] The specific implementation manner of the flight control system of the present invention is basically the same as the embodiments of the redundancy control method of the above flight control system, and will not be described in detail here.

[0139] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a redundancy control program for a flight system. When the redundancy control program for the flight system is executed by a processor, it implements each step of the redundancy control method for the flight control system as described above, and can achieve the same technical effects. To avoid repetition, it will not be elaborated here.

[0140] Since the storage medium provided in the embodiment of the present application is the storage medium used to implement the method of the embodiment of the present application, based on the method introduced in the embodiment of the present application, those skilled in the art can understand the specific structure and variations of the storage medium. Therefore, it will not be elaborated here. Any storage medium used in the method of the embodiment of the present application belongs to the scope of protection of the present application.

[0141] The above are only the preferred embodiments of the present invention, and do not limit the patent scope of the present invention. Any equivalent structural transformation made under the concept of the present invention by using the content of the specification and drawings of the present invention, or directly / indirectly applied in other related technical fields, is included in the patent protection scope of the present invention.

Claims

1. A redundancy control method for a flight control system, characterized in that Applied to the first actuator processor, the method includes: Receiving a verification flight control instruction sent by the first flight control computer; Obtaining the main flight control instruction received by the second actuator processor, where the main flight control instruction is sent by the first flight control computer to the second actuator processor; When the main flight control instruction does not match the verification flight control instruction, sending a disconnection signal to the power switch corresponding to the second actuator processor; When the main flight control instruction matches the verification flight control instruction, obtaining the first output instruction generated by the first actuator processor according to the verification flight control instruction, and obtaining the second output instruction generated by the second actuator processor according to the main flight control instruction; when the first output instruction does not match the second output instruction, sending a disconnection signal to the power switch corresponding to the second actuator processor; Sending a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

2. The method according to claim 1, characterized in that, After the step of sending a disconnection signal to the power switch corresponding to the second actuator processor when the first output instruction does not match the second output instruction, it further includes: Sending a disconnection signal to the limiter, so that when the limiter receives the disconnection signals sent by all actuator processors, it controls the power switch connected to at least one actuator processor to close.

3. The method according to claim 1, wherein After the step of obtaining the main flight control instruction received by the second actuator processor, it further includes: When the main flight control instruction does not match the verification flight control instruction, generating an error message indicating that the main flight control instruction does not match the verification flight control instruction; Feeding back the error message to the first flight control computer.

4. The method according to claim 1, wherein The method includes: Receiving the main flight control instruction of the second flight control computer; Sending the main flight control instruction to the actuator corresponding to the first actuator processor.

5. The method according to claim 4, wherein After the step of sending the main flight control instruction to the actuator corresponding to the first actuator processor, it further includes: Obtaining the actual manipulation amount of the actuator corresponding to the second flight control computer; When the actual manipulation amount does not match the theoretical manipulation amount of the main flight control instruction of the second flight control computer, sending a disconnection signal to the actuator connected to the first actuator processor; Sending a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the actuators locked together.

6. The method according to claim 5, characterized in that, After the step of obtaining the actual manipulation amount of the actuator corresponding to the second flight control computer, it further includes: When the actual manipulation amount matches the theoretical manipulation amount of the main flight control instruction of the second flight control computer, sending a closing signal to the actuator connected to the first actuator processor to send the main control instruction of the second flight control computer to the actuator corresponding to the first actuator processor.

7. The method according to claim 5, characterized in that, After the step of sending a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the actuators locked together, it further includes: Send a disconnection signal to the limiter so that when the limiter receives the disconnection signals sent by all actuator processors, it controls at least one actuator processor to send a locking signal to the locking mechanism.

8. An actuator processing module, characterized in that, The actuator processing module includes an actuator processor, a memory, and a redundancy control program of the flight control system stored on the memory and executable on the actuator processor. When the redundancy control program of the flight control system is executed by the actuator processor, it implements the steps of the redundancy control method of the flight control system according to any one of claims 1-7.

9. A flight control system, characterized in that, The flight control system includes the actuator processing module according to claim 8.

10. A computer-readable storage medium, characterized in that, Stored thereon is a redundancy control program of the flight control system. When the redundancy control program of the flight control system is executed by a processor, it implements the steps of the redundancy control method of the flight control system according to any one of claims 1-7.

Images