Redundancy control method, arbitration unit, flight control system and storage medium

Abstract

The present invention discloses a redundancy control method, an arbitration unit, a flight control system, and a storage medium. By adding an arbitration unit, the arbitration unit receives the control instructions and check codes of each flight control computer, and then determines whether a flight control computer has a fault based on the control instructions and check codes. When it is determined that a certain flight control computer has a fault, the signal output of the faulty flight control computer is cut off, and the normally operating flight control computer is controlled to send the received control instructions to the actuator processor to achieve the control of the actuator processor. Compared with the prior art, since the arbitration unit of the present application only needs to determine whether a flight control computer has a fault based on the current control instructions and check codes of the flight control computer and perform corresponding control, the computational pressure on the arbitration unit during the fault detection process of the redundant flight control computer is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of aircraft, and in particular, to a redundancy control method, an arbitration unit, a flight control system, and a storage medium. Background Art

[0002] With the development of the design technology, manufacturing technology, and related supporting industries of small aircraft, the functions, performance, and output of small aircraft have gradually become stable and mature, and the operation of small aircraft has gradually developed towards civil aviation fields such as logistics transportation and manned transportation. However, due to the particularity of the flight platform itself, new challenges have been posed to the safety of the aircraft.

[0003] In related technologies, when performing performance and fault detection on two flight control computers, the single-chip microcomputer arbitration unit receives the status information output by the two flight control computers and makes a prediction of the next state based on the historical status information. If the output of the next state of a certain flight control computer does not match the prediction range of the arbitration unit, it is determined that the flight control computer has failed. However, the arbitration unit needs to analyze the historical status information and predict the next output range of the flight control computer, which requires a high computing ability of the arbitration unit. Summary of the Invention

[0004] Embodiments of the present application provide a redundancy control method, an arbitration unit, a flight control system, and a storage medium, aiming to reduce the computing pressure on the arbitration unit during the fault detection of redundant flight control computers.

[0005] Embodiments of the present application provide a redundancy control method for a flight control system applied to an arbitration unit. The redundancy control method of the flight control system includes:

[0006] Receiving control information from at least two flight control computers, where the control information includes a control instruction and a check code;

[0007] Determining whether a flight control computer has a fault according to the control information;

[0008] Cutting off the signal output of the flight control computer with a fault;

[0009] Controlling the normally operating flight control computer to send the received control instruction to the actuator processor.

[0010] In addition, to achieve the above object, the present invention also provides an arbitration unit, which includes: a memory, a processor, and a redundancy control program of the flight control system stored on the memory and executable on the processor. When the redundancy control program of the flight control system is executed by the processor, the steps of the above redundancy control method of the flight control system are implemented.

[0011] In addition, to achieve the above object, the present invention further provides a flight control system, and the flight control system includes an arbitration unit.

[0012] In addition, to achieve the above object, the present invention further provides a computer-readable storage medium, on which a redundancy control program of the flight control system is stored. When the redundancy control program of the flight control system is executed by a processor, the steps of the redundancy control method of the above flight control system are implemented.

[0013] The technical solution of a redundancy control method, an arbitration unit, a flight control system, and a storage medium provided in the embodiments of the present application, by adding an arbitration unit, which receives the control instructions and check codes of each flight control computer, and then determines whether there is a fault in the flight control computer according to the control instructions and check codes. When it is determined that a certain flight control computer has a fault, the signal output of the faulty flight control computer is cut off, and the normally operating flight control computer is controlled to send the received control instruction to the actuator processor to achieve the control of the actuator processor. Compared with the prior art, since the arbitration unit of the present application only needs to determine whether there is a fault in the flight control computer according to the current control instruction and check code of the flight control computer, and perform corresponding control, the calculation pressure on the arbitration unit in the process of detecting the fault of the redundant flight control computer is reduced. Description of the Drawings

[0014] Figure 1 It is a schematic flowchart of the first embodiment of the redundancy control method of the flight control system of the present invention;

[0015] Figure 2 It is a schematic flowchart of the second embodiment of the redundancy control method of the flight control system of the present invention;

[0016] Figure 3 It is a schematic hardware structure diagram of the arbitration unit of the present invention;

[0017] Figure 4 It is a schematic structure diagram of the flight control system of the present invention.

[0018] The realization of the object of the present application, functional features, and advantages will be further described in conjunction with the embodiments with reference to the drawings. The above drawings are only diagrams of one embodiment, rather than all of the invention. Detailed Embodiments

[0019] In view of the problem in the related art that the arbitration unit needs to analyze historical state information and predict the next output range of the flight control computer, which requires high computing power and storage capacity of the arbitration unit, the present application proposes a redundancy control method for a flight control system. The present application adds an arbitration unit. The arbitration unit detects the output of the flight control computer. Each flight control computer should attach a set of check codes when outputting instructions to prove that it is still working properly. The arbitration unit determines whether there is a fault by comparing the output control instructions of the flight control computer and checking the check codes. If it is determined that the check code output by one flight control computer is faulty, the output control signal of that flight control computer is disconnected, and the output control signal of another flight control computer is selected; if it is determined that the output control instructions of the two flight control computers do not match, the output control signals of all flight control computers are cut off, and a manual control instruction control signal is obtained to reduce the computing pressure on the arbitration unit during the fault detection of the redundant flight control computer and improve the flight safety of the aircraft.

[0020] To better understand the above technical solution, the exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be fully conveyed to those skilled in the art.

[0021] As Figure 1 shown, in the first embodiment of the present application, the redundancy control method of the flight control system of the present application is applied to an arbitration unit, which is used to determine whether there is a fault in the flight control computer and determine the corresponding control strategy according to the judgment result, so that the aircraft can fly safely. The redundancy control method of the flight control system includes the following steps:

[0022] Step S110, receiving control information of at least two flight control computers, where the control information includes control instructions and check codes.

[0023] In this embodiment, the flight control computer of the present application can be set to be redundant. That is, in the flight control system, there can be two or even more flight control computers, and the number of flight control computers can be set according to the actual usage and specific application scenarios. When all flight control computers are working properly, different flight control computers can be used to execute different control functions. When a certain flight control computer fails, a normally working flight control computer can be used to replace the failed flight control computer to execute the control function of the failed flight control computer. Suppose there are two flight control computers, namely the first flight control computer and the second flight control computer. When both the first flight control computer and the second flight control computer are normal, the first flight control computer is used to control the operation of the control surface, and the second flight control computer is used to control the operation of the tilt unit. When the first flight control computer fails, the second flight control computer can be used to control the control surface and the tilt unit. Similarly, when the second flight control computer fails, the first flight control computer can be used to control the control surface and the tilt unit.

[0024] In this embodiment, during the flight, each flight control computer will send control instructions to the actuator processor in real time, so that the actuator processor can control the actuator based on the control instructions sent by the flight control computer. Since various emergencies may occur during the flight, resulting in the flight control computer being unable to work properly, in order to improve the flight safety performance, it is also necessary to send the control information of each flight control computer to the arbitration unit, and the arbitration unit is used to judge in real time whether the flight control computer has a failure, and determine the corresponding control strategy according to the judgment result to control the actuator processor, thereby improving the flight safety.

[0025] Optionally, the control information of each flight control computer can be synchronously sent to the arbitration unit at preset time intervals to avoid inaccurate failure judgment caused by asynchronous data transmission, thereby affecting the stability of the aircraft.

[0026] Optionally, each flight control computer will output a corresponding control instruction, and the control instruction is an instruction for controlling the operation of motors, control surfaces, throttles, etc. The control instruction includes, for example, throttle instruction, rudder deflection instruction, motor speed instruction, motor torque instruction, etc.

[0027] Optionally, each flight control computer will output a check code, and the check code is used to check and judge whether the flight control computer fails. The format of the check code can be preset according to different aircraft models.

[0028] Step S120, determine whether the flight control computer has a failure according to the control information.

[0029] In this embodiment, when each flight control computer outputs a control instruction, a set of check codes is attached to prove that it is still working properly. The arbitration unit determines whether there is a fault in the flight control computer by comparing the control instructions output by each flight control computer and checking the check codes.

[0030] Optionally, a preset check code is pre-set in the arbitration unit, and the format and type of the preset check code should be the same as those of the check code sent by the flight control computer. That is, after the arbitration unit receives the check codes of each flight control computer, it will perform format matching and type matching on the received check codes of each flight control computer with the preset check code respectively. If the check code of the flight control computer does not match the preset check code, the flight control computer that does not match is determined to be a faulty flight control computer, that is, a failed flight control computer. Optionally, a flight control computer with no signal output or garbled output can also be determined to be a faulty flight control computer. Optionally, when the flight control computer outputs control instructions at a constant frequency, if the arbitration unit detects that the output frequency is disconnected, the flight control computer is determined to be a faulty flight control computer.

[0031] For example, assume there is a first flight control computer and a second flight control computer. Assume that when the check code of the first flight control computer does not match the preset check code, the first flight control computer is determined to be a faulty flight control computer; if the check code of the second flight control computer does not match the preset check code, the second flight control computer is determined to be a faulty flight control computer; assume that the check codes of the first flight control computer and the second flight control computer both do not match the preset check code, then both the first flight control computer and the second flight control computer are determined to be faulty flight control computers.

[0032] Optionally, when there are at least two matching flight control computers, the error between the control instructions received by the matching flight control computers is determined. The flight control computers with an error greater than the preset error are all determined to be faulty flight control computers.

[0033] Optionally, the control instructions include multiple types, which can be discrete control instructions, continuous control instructions, Boolean control instructions, etc. The preset errors set for different types of control instructions are different. For example: for discrete control instructions, such as the throttle instruction: 10% of its own value range; for continuous control instructions, such as the rudder deflection instruction: 5% of its own value range; for Boolean control instructions, such as the takeoff instruction: 0 (i.e., zero tolerance).

[0034] For example, assume that the flight control computers with matching check codes are the first flight control computer and the second flight control computer. And the types of control instructions adopted by the first flight control computer and the second flight control computer are both discrete types. Then, the error between the control instructions of the first flight control computer and the control instructions of the second flight control computer can be calculated. When the error is greater than 10% of its own value range, it is determined that both the first flight control computer and the second flight control computer are faulty flight control computers. When the error is less than 10% of its own value range, it is determined that both the first flight control computer and the second flight control computer are flight control computers operating normally.

[0035] Step S130, cut off the signal output of the faulty flight control computer.

[0036] Optionally, each flight control computer is connected to the arbitration unit and the actuator processor through a signal switch. The default state of this signal switch is the closed state. When the arbitration unit detects that a flight control computer fails, a disconnection signal is sent to the signal switch connected to the faulty flight control computer, thereby cutting off the signal output of the faulty flight control computer.

[0037] Step S140, control the flight control computer operating normally to send the received control instruction to the actuator processor.

[0038] In this embodiment, if it is determined that the check code output by one of the flight control computers is faulty, the control instruction output by this flight control computer is disconnected, and the control instruction output by another flight control computer operating normally is selected and sent to the actuator processor.

[0039] Optionally, in addition to the flight control computer, the actuator processor of the present application can also be redundantly set. There are at least two actuator processors in the present application. When all flight control computers are operating normally, each flight control computer can control the corresponding actuator processor through the corresponding signal switch. However, when one of the flight control computers fails, the flight control computer operating normally can be controlled to control all actuator processors. Optionally, the signal switch corresponding to the flight control computer operating normally can be controlled to close, so that the signal switch is connected to all actuator processors.

[0040] For example, assume that it is detected that the first flight control computer fails and the second flight control computer is normal. Then, the arbitration unit sends a disconnection signal to the signal switch connected to the first flight control computer, thereby cutting off the signal output of the first flight control computer. A closing signal is sent to the signal switch corresponding to the second flight control computer, so that the signal switch corresponding to the second flight control computer can be connected to all actuator processors, and then control the second flight control computer to send the received control instruction to all actuator processors. Thus, all actuators can be controlled by this second flight control computer.

[0041] Optionally, when all flight control computers fail, cut off the signal output of all flight control computers, connect the signal channel between the joystick and the actuator processor, and then send the control signal output by the joystick to the actuator processor, so as to control in the manual control mode to avoid affecting the flight safety of the aircraft when all flight control computers fail.

[0042] When the check codes of all flight control computers do not match the preset check codes, the signal channel between the joystick and the actuator processor can be connected, and then the control signal output by the joystick can be sent to the actuator processor, so as to control in the manual control mode to avoid affecting the flight safety of the aircraft when all flight control computers fail.

[0043] When the check codes of all flight control computers match the preset check codes, but the error between the control commands received by the matched flight control computers is greater than the preset error, the signal channel between the joystick and the actuator processor can be connected, and then the control signal output by the joystick can be sent to the actuator processor, so as to control in the manual control mode to avoid affecting the flight safety of the aircraft when all flight control computers fail.

[0044] When the output frequency of the control commands of all flight control computers fluctuates, the signal channel between the joystick and the actuator processor can be connected, and then the control signal output by the joystick can be sent to the actuator processor, so as to control in the manual control mode to avoid affecting the flight safety of the aircraft when all flight control computers fail.

[0045] Optionally, the flight control system of the present application further includes a display. The arbitration unit can send the determination result of the faulty flight control computer to the display for display. The determination result is which specific flight control computer fails, which can be the serial number of the faulty flight control computer. Optionally, the arbitration unit will also send the reason for the fault determination to the display, and the reason for the fault determination can be inconsistent check codes, the error between control commands is greater than the preset error, etc.

[0046] Optionally, in addition to controlling the actuators or actuating mechanisms connected to the actuator processor through the flight control computer, the present application can also switch to the manual control mode, connect the signal channel between the joystick and the actuator processor, and send the control signal output by the joystick to the actuator processor, so as to control the actuator or actuating mechanism. When all flight control computers fail, the actuator or actuating mechanism can be controlled in the manual control mode, improving the flight safety of the flight system.

[0047] Optionally, a signal switch is connected between the joystick and the actuator processor, and the default state of the signal switch is the off state. When the arbitration unit sends a closing signal to the signal switch, it indicates that an arbitration intervention instruction has been received. At this time, the arbitration unit will cut off the signal output of all flight control computers. Additionally, when the signal switch is closed, the signal channel between the joystick and the actuator processor will be connected, so as to send the control signal output by the joystick to the actuator processor. The specific control methods include but are not limited to the following methods:

[0048] Example 1: The operator can select at any time in what way to control the aircraft. It can be that when all flight control computers are working properly and an arbitration intervention instruction is received, the control output of all flight control computers is cut off, and the signal channel between the joystick and the actuator processor is connected, so as to send the control signal output by the joystick to the actuator processor.

[0049] Example 2: It can also be that when all flight control computers have faults or a certain flight control computer has a fault and an arbitration intervention instruction is received, the control output of all flight control computers is cut off, and the signal channel between the joystick and the actuator processor is connected, so as to send the control signal output by the joystick to the actuator processor.

[0050] Example 3: It can be that when it is detected that the check code of a certain flight control computer does not match the preset check code, an arbitration intervention instruction is received, the control output of all flight control computers is cut off, and the signal channel between the joystick and the actuator processor is connected, so as to send the control signal output by the joystick to the actuator processor.

[0051] Example 4: It can also be that when it is detected that the error of the control instructions of each flight control computer is greater than the preset error, an arbitration intervention instruction is received, the control output of all flight control computers is cut off, and the signal channel between the joystick and the actuator processor is connected, so as to send the control signal output by the joystick to the actuator processor.

[0052] According to the above technical solution, in this embodiment, an arbitration unit is added. The arbitration unit receives the control instructions and check codes of each flight control computer, and then determines whether there is a fault in the flight control computer according to the control instructions and check codes. When it is determined that a certain flight control computer has a fault, the signal output of the faulty flight control computer is cut off, and the normally operating flight control computer is controlled to send the received control instruction to the actuator processor to achieve the control of the actuator processor. Compared with the prior art, since the arbitration unit of this application only needs to determine whether there is a fault in the flight control computer according to the current control instruction and check code of the flight control computer, and perform corresponding control, the computational pressure on the arbitration unit in the process of detecting faults in redundant flight control computers is reduced. In addition, when it is detected that all flight control computers have faults, the system switches to manual control.

[0053] In one embodiment, in the flight control system of this application, the flight control computers, actuator processors, and actuators can be set to two or even more, and the number of flight control computers, actuator processors, and actuators can be set according to the actual usage and specific application scenarios. This application takes the flight control computers, actuator processors, and actuators with dual redundancy settings as an example.

[0054] Before the actuator accepts control, the actuator processor needs to convert the main control instruction sent by the flight control computer into output current to the actuator. In order to be able to control normally, it is necessary to ensure that the actuator processor can work normally. Therefore, this application adopts a mechanism in which the actuator processors supervise each other. Each actuator processor will receive the control instructions of all flight control computers. One of the control instructions is its own main control instruction, which is used to output to the actuator to drive the actuator; the control instruction of another flight control computer has the function of verifying whether another actuator processor is normal. When a single actuator processor fails, another normally operating actuator processor is allowed to intervene to cut off the output of the faulty actuator processor, and at the same time lock the two separated actuators so that the normally operating actuator can control all actuators.

[0055] Furthermore, each actuator processor processes two tasks in parallel with two threads. The first thread task is to convert the main flight control instruction to the corresponding actuator motor, and the second thread is to check whether the output is reasonable according to the input and output of the other actuator processor. The reason for adopting the dual-thread design is to avoid conflicts between the checking process and the main computing work.

[0056] Further, the verification algorithm is executed in the second thread, including the input verification algorithm and the output verification algorithm. First, the input verification algorithm is executed. The input verification algorithm is as follows: Determine whether the main flight control instruction received by the other party matches the verification flight control instruction received by this processor. If they do not match, inform the main flight control computer of the actuator processor of the other party of this error and cut off the power output of the actuator processor of the other party. If they match, the output verification algorithm is performed. The output verification algorithm is as follows: When the verification shows that the output of the actuator processor of the other party is unreasonable, an off signal is output to the power switch of the actuator of the other party. At the same time, a locking signal is output to the locking mechanism between the actuators, so that one's own actuator can control the two actuators simultaneously.

[0057] Since the present application adopts the mutual detection method of dual-redundancy actuator processors, the dual-redundancy mutual monitoring should allow the two actuator processors to share all data, including the data output from the flight control computer to the actuator processor, the output data of the actuator processor, and the feedback data of the sensors corresponding to the actuators. When one actuator processor finds that the input or output of the other actuator processor does not match, the power output of the other party is cut off, thereby protecting the maneuverability of the overall actuator. In addition, the mutual detection of the two actuator processors is to judge whether the other actuator processor outputs an error through a parallel verification algorithm, so as to avoid using the main drive algorithm to verify the input and output of another actuator processor. The verification algorithm is independent of the main drive. Even if the main drive algorithm has problems, the separate verification algorithm will not be affected. Another actuator processor will immediately shut down the output to the faulty actuator processor, thereby improving flight stability and safety.

[0058] Optionally, when the redundancy control method of the flight control system of the present application is applied to the first actuator processor, when the first actuator processor and the second actuator processor are working properly, the first actuator processor can accept all control instructions of the flight control computer, including the verification flight control instruction sent by the first flight control computer and the main flight control instruction sent by the second flight control computer. Similarly, the second actuator processor can also accept all control instructions of the flight control computer, including the verification flight control instruction sent by the second flight control computer and the main flight control instruction sent by the first flight control computer. The first actuator processor and the second actuator processor can send their own main flight control instructions to the other actuator processor to verify whether the other actuator processor can work properly.

[0059] Optionally, this application takes the execution of the input verification algorithm in the first actuator processor as an example. For the first actuator processor, in order to verify whether the second actuator processor can work properly, the first actuator processor can obtain the main flight control instruction sent by the second actuator processor, and this main flight control instruction is sent by the first flight control computer to the second actuator processor. The second actuator processor sends this main flight control instruction to the first actuator processor to use the first actuator processor to verify the second actuator processor. Optionally, the first actuator processor will match this main flight control instruction with its own verification flight control instruction. When the main flight control instruction does not match the verification flight control instruction, it means that the first actuator processor calculates that the second actuator processor may have a fault. At this time, a disconnection signal will be sent to the power switch corresponding to the second actuator processor, and at the same time, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

[0060] Similarly, the redundancy control method of the flight control system of this application is also applicable to the second actuator processor, and the input verification algorithm can be executed in the second actuator processor. Optionally, for the second actuator processor, in order to verify whether the first actuator processor can work properly, the second actuator processor can obtain the main flight control instruction sent by the first actuator processor, and this main flight control instruction is sent by the second flight control computer to the first actuator processor. The first actuator processor sends this main flight control instruction to the second actuator processor to use the second actuator processor to verify the first actuator processor. Optionally, the second actuator processor will match this main flight control instruction with its own verification flight control instruction. When the main flight control instruction does not match the verification flight control instruction, it means that the second actuator processor calculates that the first actuator processor may have a fault. At this time, the second actuator processor will send a disconnection signal to the power switch corresponding to the first actuator processor, and at the same time, the second actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the actuators locked together.

[0061] Optionally, this application can also set a third-party monitoring module, and the input verification algorithm can also be executed in the third-party monitoring module. The redundancy control method of the flight control system of this application is also applicable to this third-party monitoring module. A verification algorithm is set in this third-party monitoring module, which can obtain the verification flight control instruction sent by the first flight control computer to the first actuator processor, and at the same time obtain the main flight control instruction sent by the first flight control computer to the second actuator processor.

[0062] Optionally, the third-party monitoring module will match the verified flight control instruction and the main flight control instruction. When the main flight control instruction does not match the verified flight control instruction, it indicates that a fault may exist in the second actuator processor. At this time, the first actuator processor will send a disconnection signal to the power switch corresponding to the second actuator processor. At the same time, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

[0063] Similarly, the third-party monitoring module will also obtain the verified flight control instruction sent by the second flight control computer to the second actuator processor, and at the same time obtain the main flight control instruction sent by the second flight control computer to the first actuator processor. Optionally, the third-party monitoring module will match the verified flight control instruction and the main flight control instruction. When the main flight control instruction does not match the verified flight control instruction, it indicates that a fault may exist in the first actuator processor. At this time, the second actuator processor will send a disconnection signal to the power switch corresponding to the first actuator processor. At the same time, the second actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the actuators locked together.

[0064] Optionally, when executing the above input calculation algorithm, if the main flight control instruction does not match the verified flight control instruction, the main flight control computer of the other actuator processor will be informed of this error, and the power output of the other actuator processor will be truncated.

[0065] Optionally, for the first actuator processor, when the first actuator processor determines that the main flight control instruction of the second actuator processor does not match its own verified flight control instruction, an error message including the mismatch between the main flight control instruction and the verified flight control instruction can be generated, and the error message will be sent to the main flight control computer of the second actuator processor, that is, the first flight control computer, so that the error message can be timely fed back and corresponding rectifications can be made in a timely manner to avoid flight accidents.

[0066] Similarly, for the second actuator processor, when the second actuator determines that the main flight control instruction of the first actuator processor does not match its own verified flight control instruction, an error message including the mismatch between the main flight control instruction and the verified flight control instruction can be generated, and the error message will be sent to the main flight control computer of the first actuator processor, that is, the second flight control computer, so that the error message can be timely fed back and corresponding rectifications can be made in a timely manner to avoid flight accidents.

[0067] Optionally, if both the first actuator processor and the second actuator processor detect a fault in the other party. To avoid all actuator processors being shut down, resulting in the inability to control the actuators or actuators, and further causing the aircraft to be unable to fly normally, the present application also provides a limiter. The limiter is connected to the actuator processor and the power switch, and is used to control the power switch connected to at least one actuator processor to close when receiving the disconnection signals sent by all actuator processors, or to control at least one actuator processor to send a locking signal to the locking mechanism when receiving the disconnection signals sent by all actuator processors. That is, to ensure that at least one actuator processor can perform normal control.

[0068] Optionally, to improve the accuracy of the verification result, it is necessary to ensure the synchronization of the verification of the first actuator processor and the second actuator processor, that is, to control the first actuator processor and the second actuator processor to execute the verification algorithm simultaneously.

[0069] Optionally, if both the first actuator processor and the second actuator processor detect an input fault in the other party, the output of the actuator of the other actuator processor of the actuator processor that first detects the fault in the other party can be disconnected. For example, if the first actuator processor first calculates that the second actuator processor has a fault, then a disconnection signal can be sent to the power switch corresponding to the second actuator processor. Optionally, a disconnection signal is sent to the limiter to avoid disconnecting the power switch corresponding to the first actuator processor when the second actuator processor also calculates that the first actuator processor has an input fault.

[0070] Optionally, if both the first actuator processor and the second actuator processor detect an input fault in the other party, a disconnection signal can also be sent to the power switch corresponding to the actuator server that meets the conditions of the most historical fault times, the least historical usage frequency, and the lowest service quality.

[0071] Optionally, for the redundancy control of the entire flight control system, when all flight control computers are operating normally, different flight control computers can be used to execute different control functions. When a certain flight control computer fails, a normally operating flight control computer can be used to replace the failed flight control computer and execute the control functions of the failed flight control computer. Similarly, when all actuator processors are operating normally, different actuator processors can be used to execute different data processing functions and control the connected actuators. When a certain actuator processor fails, a normally operating actuator processor can be used to replace the failed actuator processor and control the actuators connected to the failed actuator processor. Similarly, when all actuators are operating normally, different actuators can be used to drive their corresponding actuating mechanisms. However, when a certain actuator fails, the actuator processor connected to the normally operating actuator can send a locking signal to the locking mechanism, so that the normally operating actuator processor can synchronously control the actuating mechanisms locked together.

[0072] Optionally, assume that the flight control computer, actuator processor, and actuator are all set to dual redundancy. The flight control computer includes a first flight control computer and a second flight control computer; the actuator processor includes a first actuator processor and a second actuator processor; the actuator includes a first actuator and a second actuator; the actuating mechanism includes a first actuating mechanism and a second actuating structure. Then there are, but are not limited to, the following situations:

[0073] First, for the situation where all flight control computers, all actuator processors, and all actuators are operating normally. The control process is as follows: The first flight control computer sends the main flight control instruction to the first actuator processor; the first actuator processor converts the main control instruction into a current signal and sends it to the first actuator, and the first actuator then sends the current signal to the first actuating mechanism, thereby realizing the drive of the first actuating mechanism by the first flight control computer. At the same time, the second flight control computer sends the main flight control instruction to the second actuator processor; the second actuator processor converts the main control instruction into a current signal and sends it to the second actuator, and the second actuator then sends the current signal to the second actuating mechanism, thereby realizing the drive of the second actuating mechanism by the second flight control computer. Thus, in the case where all devices are operating normally, each device can perform its own functions, enabling the aircraft to operate normally.

[0074] Second, for the situation where the first flight control computer fails or the second flight control computer fails while all actuator processors are working normally. The control process for the failure of the first flight control computer is as follows: The second flight control computer sends the main flight control instructions to the first actuator processor and the second actuator processor simultaneously. This enables the first actuator processor and the second actuator processor to perform their respective controls. Optionally, the main flight control instructions of the second flight control computer can also be sent only to the second actuator processor connected to it, and this second actuator processor is used to control all actuators and actuating mechanisms. Similarly, for the control process of the second flight control computer failure: The first flight control computer sends the main flight control instructions to the first actuator processor and the second actuator processor simultaneously. This enables the first actuator processor and the second actuator processor to perform their respective controls. Optionally, the main flight control instructions of the first flight control computer can also be sent only to the first actuator processor connected to it, and this first actuator processor is used to control all actuators and actuating mechanisms. This allows, when a certain flight control computer fails, the normally working flight control computer to control all normally working actuators and actuating mechanisms, improving flight safety.

[0075] Third, for the situation where all flight control computers are normal but the first actuator processor or the second actuator processor fails. The control process for the failure of the first actuator processor is as follows: The second flight control computer sends the main control instructions to the second actuator processor. The second actuator processor converts the main control instructions into current signals and sends them to the second actuator. At the same time, the second actuator processor sends a locking signal to the locking mechanism to lock the actuating mechanism and sends a disconnection signal to the power switch corresponding to the first actuator processor, enabling the normally working flight control computer to control all actuating mechanisms through the second actuator processor. Similarly, for the control process of the second actuator processor failure: The first flight control computer sends the main control instructions to the first actuator processor. The first actuator processor converts the main control instructions into current signals and sends them to the first actuator. At the same time, the first actuator processor sends a locking signal to the locking mechanism to lock the actuating mechanism and sends a disconnection signal to the power switch corresponding to the second actuator processor, enabling the normally working flight control computer to control all actuating mechanisms through the first actuator processor. This allows, when one of the actuator processors fails, the normally working flight control computer to control the normally working actuator processor to control all actuating mechanisms, improving flight safety.

[0076] Fourth, for the situation where all flight control computers are abnormal but the first actuator processor and / or the second actuator processor is normal, the manual control mode can be switched to and manual operation can be used for control to avoid affecting the flight safety of the aircraft when all flight control computers fail.

[0077] In summary, relative redundancy controls are designed at three levels: the flight control computer, the actuator processor, and the actuator output. An arbitration unit is set at the flight control computer level to determine whether a flight control computer fails, and a solution strategy is determined according to the failure situation. At the actuator processor level, the actuator processors supervise and detect each other. When the output of the other actuator processor does not match the input, the output of the other actuator will be cut off. Therefore, when one device detects a fault in the other device, it can timely cut off the power output of the other device, use the normal device to control all actuators, protect the maneuverability of the overall actuators, and improve flight safety.

[0078] In one embodiment, when it is determined by the input verification algorithm that the main flight control instruction received by the other party matches the verification flight control instruction received by this actuator processor, the output verification algorithm is further executed. The output verification algorithm is as follows: when it is verified that the output of the other actuator processor is unreasonable, a disconnection signal is sent to the power switch of the other actuator, and at the same time, a locking signal is sent to the locking mechanism between the actuators, so that its own actuator can control the two actuators simultaneously.

[0079] Optionally, this application takes the execution of the output verification algorithm in the first actuator processor as an example. For the first actuator processor, in order to further verify whether the second actuator processor can work properly, when the first actuator processor verifies that the main flight control instruction matches the verification flight control instruction, after obtaining the first output instruction generated by the first actuator processor according to the verification flight control instruction and the second output instruction generated by the second actuator processor according to the main flight control instruction, the executed output verification algorithm is: matching the first output instruction with the second output instruction. When the first output instruction does not match the second output instruction, it indicates that the first actuator processor calculates that there may be a fault in the output of the second actuator processor. At this time, a disconnection signal is sent to the power switch corresponding to the second actuator processor, and at the same time, the first actuator processor also sends a locking signal to the locking mechanism to lock the corresponding actuators, so that the first actuator processor can synchronously control the actuators locked together.

[0080] Similarly, the present application can execute an output verification algorithm in the second actuator processor. Optionally, for the second actuator processor, in order to verify whether the output of the first actuator processor is normal and thus verify whether the first actuator processor can work properly, when the second actuator processor verifies the matching of the main flight control instruction and the verification flight control instruction, after obtaining the second output instruction generated by the second actuator processor according to the verification flight control instruction and the first output instruction generated by the first actuator processor according to the main flight control instruction, the output verification algorithm executed is: matching the first output instruction with the second output instruction. When the first output instruction does not match the second output instruction, it indicates that the second actuator processor may calculate a fault in the output of the first actuator processor. At this time, a disconnection signal will be sent to the power switch corresponding to the first actuator processor, and at the same time, the second actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the actuators locked together.

[0081] Optionally, the present application can also set a third-party monitoring module and execute the output verification algorithm in the third-party monitoring module.

[0082] Optionally, when the third-party monitoring module verifies the matching of the main flight control instruction of the first flight control computer (the main flight control instruction is sent by the first flight control computer to the second actuator processor) and the verification flight control instruction, it can further execute the output verification algorithm: obtain the first output instruction generated by the first actuator processor according to the verification flight control instruction and the second output instruction generated by the second actuator processor according to the main flight control instruction. The third-party monitoring module will match the first output instruction and the second output instruction. When the first output instruction does not match the second output instruction, it indicates that the first actuator processor may calculate a fault in the output of the second actuator processor. At this time, a disconnection signal will be sent to the power switch corresponding to the second actuator processor, and at the same time, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together.

[0083] Optionally, if both the first actuator processor and the second actuator processor detect a fault in the output of the other party. To avoid all actuator processors being shut down, resulting in the inability to control the actuators or actuators, and further causing the aircraft to malfunction during normal flight, the present application also provides a limiter. The limiter is connected to the actuator processor and the power switch and is configured to control the power switch connected to at least one actuator processor to close when receiving the disconnection signals sent by all actuator processors, or to control at least one actuator processor to send a locking signal to the locking mechanism when receiving the disconnection signals sent by all actuator processors. That is, to ensure that at least one actuator processor can perform normal control.

[0084] Optionally, to improve the accuracy of the verification results, it is necessary to ensure the synchronization of the verification of the first actuator processor and the second actuator processor, that is, to control the first actuator processor and the second actuator processor to execute the verification algorithm simultaneously.

[0085] Optionally, if both the first actuator processor and the second actuator processor detect a fault in the output of the other party, the output of the actuator of the other actuator processor of the actuator processor that first detected the output fault of the other party can be disconnected. For example, if the first actuator processor first verifies that the second actuator processor has an output fault, then a disconnection signal can be sent to the power switch corresponding to the second actuator processor. Optionally, a disconnection signal is sent to the limiter to avoid disconnecting the power switch corresponding to the first actuator processor when the second actuator processor also verifies that the first actuator processor has an output fault, resulting in all actuator processors being shut down and affecting flight safety.

[0086] Optionally, if both the first actuator processor and the second actuator processor detect a fault in the output of the other party, a disconnection signal can also be sent to the power switch corresponding to the actuator server that meets the conditions of the most historical fault times, the least historical usage frequency, and the lowest service quality.

[0087] In summary, by enabling the actuator processors to supervise and detect each other at the actuator processor level, when the output of the other actuator processor does not match the input, the output of the other actuator will be cut off and the locking mechanism will be connected, allowing another normal actuator to control both actuators simultaneously. This enables one device to promptly cut off the power output of the other device when a fault is detected in the other device, and use the normal device to control all actuators, protecting the maneuverability of the overall actuators and improving flight safety.

[0088] In one embodiment, each actuator processor processes two tasks in a dual-threaded parallel manner. The first thread task is to convert the main flight control instruction into the corresponding actuator motor. The execution process of the second thread is as described in the first embodiment and the second embodiment, which will not be elaborated here. The reason for adopting the dual-thread design is to avoid conflicts between the verification process and the main calculation work. Optionally, the second thread can be executed in real time while the first thread is being executed. In one embodiment, after the second thread is executed and no fault is determined, the first thread is executed.

[0089] Optionally, while receiving the verification flight control instruction from the first flight control computer for verification calculation, the first actuator processor can also receive the main flight control instruction from the second flight control computer for control and send the main flight control instruction to the actuator corresponding to the first actuator processor. Optionally, the first actuator processor will convert the main flight control instruction into a current signal and then send it to the first actuator. On the side of the first actuator processor, a first power switch is also provided. The first power switch connects the first actuator and the first actuator mechanism. The default state of the first power switch is the closed state, so that the current signal of the first actuator can be transmitted to the first actuator mechanism, thereby realizing the control of the first actuator mechanism.

[0090] Similarly, while receiving the verification flight control instruction from the second flight control computer for verification calculation, the second actuator processor can also receive the main flight control instruction from the first flight control computer for control and send the main flight control instruction to the actuator corresponding to the second actuator processor. Optionally, the second actuator processor will convert the main flight control instruction into a current signal and then send it to the second actuator. On the side of the second actuator processor, a second power switch is also provided. The second power switch connects the second actuator and the second actuator mechanism. The default state of the second power switch is the closed state, so that the current signal of the second actuator can be transmitted to the second actuator mechanism, thereby realizing the control of the second actuator mechanism.

[0091] In one embodiment, at the actuator level, the actuator mechanism is divided into two parts and synchronously executed by the actuator. For example, a flap control surface is cut into left and right parts, and there is a locking mechanism in the middle that can lock the two parts into one body after receiving a signal. Each actuator controls the left and right parts respectively. When the control amount feedback by one of the actuator mechanisms does not match the control output of the corresponding actuator processor, the actuator is cut off and the locking mechanism is connected, so that the other actuator controls the two actuator mechanisms at the same time.

[0092] The dual-redundancy protection at this level is to ensure that the actuator can still operate normally in case of a failure of one side's actuator motor or a failure of the actuator. The algorithm at this level is calculated by the actuator processor directly upstream of the faulty actuator. The input of the algorithm is the actual manipulation amount of the actuator detected by the sensors of the actuator, such as the actual deflection angle of the aileron. When it is detected that the actual manipulation amount of the downstream actuator does not match the instruction output by the actuator processor, it can be determined that the downstream actuator motor has failed or the actuator has a fault. The processing method is similar to the processing result of the previous level, that is, cutting off the output of the downstream actuator and transmitting a locking signal to the locking mechanism, and relying on the other side's actuator processor and actuator to control all actuators.

[0093] Optionally, on the premise that all actuator processors are working properly, the redundancy control method of the present application further includes: on the side of the first actuator processor, obtaining the actual manipulation amount of the first actuator corresponding to the second flight control computer; determining whether the actual manipulation amount matches the theoretical manipulation amount of the main flight control instruction of the second flight control computer; when the actual manipulation amount does not match the theoretical manipulation amount of the main flight control instruction of the second flight control computer, it indicates that there is a fault in the first actuator or the first actuator, and at this time, a disconnection signal is sent to the first actuator corresponding to the first actuator processor; and a locking signal is sent to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the actuators locked together. Optionally, when the actual manipulation amount matches the theoretical manipulation amount of the main flight control instruction of the second flight control computer, a closing signal is sent to the first actuator to send the main control instruction of the second flight control computer to the first actuator corresponding to the first actuator processor.

[0094] Optionally, on the premise that all actuator processors are working properly, the redundancy control method of the present application further includes: on the side of the second actuator processor, obtaining the actual manipulation amount of the second actuator corresponding to the first flight control computer; when the actual manipulation amount does not match the theoretical manipulation amount of the main flight control instruction of the first flight control computer, it indicates that there is a fault in the second actuator or the second actuator, and at this time, a disconnection signal is sent to the second actuator corresponding to the second actuator processor; and a locking signal is sent to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the actuators locked together. Optionally, when the actual manipulation amount matches the theoretical manipulation amount of the main flight control instruction of the first flight control computer, a closing signal is sent to the second actuator to send the main control instruction of the second flight control computer to the second actuator corresponding to the second actuator processor.

[0095] In one embodiment, when both the first actuator processor and the second actuator processor detect a fault in their own actuators or actuating mechanisms. To avoid the problem that all actuators or actuating mechanisms are shut down, resulting in the inability of the aircraft to fly normally, the present application further provides a limiter, which is connected to the actuator processor and the power switch. The actuator level and the actuator processor level share one limiter, which is used to limit the signal on one side that can be cut off at the same time, that is, when receiving the disconnection signals sent by all actuator processors, it controls at least one actuator processor to send a locking signal to the locking mechanism.

[0096] According to the above technical solution, in this embodiment, at the actuator output level, the actuating mechanism is divided into two parts and synchronously executed by each actuator. Each actuator controls the left and right parts respectively. When the control output corresponding to the actuator processor does not match the control output of the actuating amount fed back by one of the actuating mechanisms, the actuator is cut off, and the locking mechanism is connected so that the other actuator controls all actuating mechanisms at the same time, protecting the maneuverability of the overall actuating mechanism and improving flight safety.

[0097] Refer to Figure 2 , in one embodiment, the flight control system includes a first flight control computer, a second flight control computer, an arbitration unit, and a display. The redundancy control method includes:

[0098] First, the first flight control computer sends the first flight control instruction and its own check code to the arbitration unit. At the same time, the second flight control computer also sends the second flight control instruction and its own check code to the arbitration unit.

[0099] Next, in the arbitration unit, the arbitration unit first checks whether the check codes of the two flight control computers are correct and executes the corresponding control strategy according to the check result, which is mainly divided into the following situations:

[0100] First, when the check code of the first flight control computer is incorrect, the signal output of the first flight control computer is disconnected.

[0101] Second, when the check code of the second flight control computer is incorrect, the signal output of the second flight control computer is disconnected.

[0102] Third, when the check codes of both the first flight control computer and the second flight control computer are incorrect, the signal outputs of all flight control computers are disconnected and switched to the joystick control.

[0103] Fourth, when the check codes of the first flight control computer and the second flight control computer are correct, compare the error between the first flight control instruction of the first flight control computer and the second flight control instruction of the second flight control computer; when the error is less than the preset error, disconnect the signal output of all flight control computers and switch to joystick control; when the error is greater than the preset error, all flight control computers output normally and execute relevant control strategies.

[0104] Finally, during the execution of the arbitration unit, the arbitration information will be sent to the display for display at the same time, so that the operator can decide whether to intervene and other operations according to the arbitration information to improve flight safety.

[0105] The embodiment of the present invention provides an embodiment of the redundancy control method for a flight control system. It should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in a different order than here.

[0106] As Figure 3 shown, Figure 3 is a schematic structural diagram of the hardware operating environment of the arbitration unit of the present invention.

[0107] As Figure 3 shown, the arbitration unit may include: a processor 1001, such as a CPU, a memory 1005, a user interface 1003, a network interface 1004, and a communication bus 1002. Among them, the communication bus 1002 is used to realize the connection and communication between these components. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may optionally also be a storage device independent of the aforementioned processor 1001.

[0108] Those skilled in the art can understand that Figure 3 the arbitration unit shown in

[0109] As Figure 3 shown, as a storage medium, the memory 1005 may include an operating system, a network communication module, a user interface module, and a redundancy control program for the flight control system. Among them, the operating system is a program for managing and controlling the hardware and software resources of the arbitration unit, and the redundancy control program for the flight control system and the operation of other software or programs.

[0110] In Figure 3In the arbitration unit shown, the user interface 1003 is mainly used to connect to the terminal and communicate data with the terminal; the network interface 1004 is mainly used to connect to the background server and communicate data with the background server; the processor 1001 can be used to call the redundancy control program of the flight control system stored in the memory 1005.

[0111] In this embodiment, the arbitration unit includes: a memory 1005, a processor 1001, and a redundancy control program of the flight control system stored on the memory and executable on the processor, where:

[0112] When the processor 1001 calls the redundancy control program of the flight control system stored in the memory 1005, it performs the following operations:

[0113] Receive control information from at least two flight control computers, where the control information includes control instructions and check codes;

[0114] Determine whether a flight control computer has a fault according to the control information;

[0115] Cut off the signal output of the faulty flight control computer;

[0116] Control the normally operating flight control computer to send the received control instruction to the actuator processor.

[0117] Based on the same inventive concept, an embodiment of the present application further provides a flight control system. The flight control system includes an arbitration unit, which is used to determine whether a flight control computer has a fault and determine a corresponding control strategy according to the determination result, so that the aircraft can fly safely.

[0118] Optionally, the flight control system includes: at least two flight control computers;

[0119] At least two signal switches, which are correspondingly arranged with the flight control computers and are used to connect the flight control computers to the actuator processing module;

[0120] An arbitration unit, which is respectively connected to each of the flight control computers and the signal switches, and is used to send a disconnection signal to the signal switch corresponding to the faulty flight control computer when a flight control computer fails. The default state of the signal switch is the closed state.

[0121] Optionally, the flight control computers include: a first flight control computer 110 and a second flight control computer 120, and the signal switches include: a first signal switch 130 and a second signal switch 140; both the first signal switch 130 and the second signal switch 140 are connected to the actuator processing module 160.

[0122] Optionally, the actuator processing module includes at least two actuator processing units, each actuator processing unit includes an actuator processor, an actuator, a power switch, and an actuator mechanism, and the power switch is connected between the actuator and the actuator mechanism;

[0123] A locking mechanism, the locking mechanism is located between the actuator mechanisms;

[0124] Each of the actuator processors is respectively connected to the corresponding power switch and the locking mechanism, and is configured to send a disconnection signal to the power switch of the faulty actuator processor and send a locking signal to the locking mechanism when it detects that the actuator processor fails; the default state of the locking mechanism is the disconnection state.

[0125] Optionally, the actuator processor includes: a first actuator processor and a second actuator processor, and both the first signal switch and the second signal switch are connected to the first actuator processor; and / or, both the first signal switch and the second signal switch are connected to the second actuator processor.

[0126] Optionally, the flight control system further includes: a limiter, the limiter is connected to the actuator processor and the power switch, and is configured to control the power switch connected to at least one actuator processor to close when receiving the disconnection signals sent by all the actuator processors, or is configured to control at least one actuator processor to send a locking signal to the locking mechanism when receiving the disconnection signals sent by all the actuator processors.

[0127] Optionally, the actuator is connected to the actuator processor, and the actuator processor is further configured to send a disconnection signal to the corresponding actuator and send a locking signal to the locking mechanism when it detects that the actuator mechanism fails.

[0128] Optionally, the flight control system further includes: a detection sensor, the detection sensor is connected to the actuator mechanism and the actuator processor, and is configured to collect the actual manipulation amount of the actuator mechanism and feedback the actual manipulation amount to the actuator processor, so that the actuator processor detects whether the actuator mechanism fails according to the actual manipulation amount.

[0129] Optionally, the actuator mechanism includes a control surface, a landing gear retraction unit, a tilting unit or a hatch.

[0130] Optionally, the actuator mechanisms are all movable components on the aircraft, and the actuator mechanisms can all include a control surface, a landing gear retraction unit, a tilting unit or a hatch. Among them, the tilting unit is a rotor tilting unit; the control surfaces include the control surfaces on the wing, the control surfaces on the vertical tail and the control surfaces on the horizontal tail.

[0131] Optionally, the flight control system further includes: a third signal switch, which is connected to the joystick and the actuator processing module;

[0132] The arbitration unit is further configured to: when all flight control computers fail, send a closing signal to the third signal switch; the default state of the third signal switch is an open state.

[0133] Optionally, the flight control system further includes a display module, which is connected to the arbitration unit and is used to display the determination result of the flight control computer with a fault.

[0134] The specific implementation manner of the flight control system of the present invention is basically the same as those of the embodiments of the redundancy control method of the above flight control system, and will not be described in detail here.

[0135] Based on the same inventive concept, an embodiment of the present application further provides a computer-readable storage medium, which stores a redundancy control program for a flight control system. When the redundancy control program for the flight control system is executed by a processor, it implements each step of the redundancy control method of the flight control system as described above, and can achieve the same technical effects. To avoid repetition, it will not be described in detail here.

[0136] Since the storage medium provided by the embodiment of the present application is the storage medium used to implement the method of the embodiment of the present application, based on the method introduced in the embodiment of the present application, those skilled in the art can understand the specific structure and deformation of the storage medium, so it will not be described in detail here. Any storage medium used in the method of the embodiment of the present application belongs to the scope to be protected by the present application.

[0137] The above are only the preferred embodiments of the present invention, and do not limit the patent scope of the present invention accordingly. Any equivalent structural transformation made under the concept of the present invention by using the content of the specification and drawings of the present invention, or directly / indirectly applied in other related technical fields, is included in the patent protection scope of the present invention.

Claims

1. A redundancy control method for a flight control system, characterized in that Applied to an arbitration unit, the method includes: Receiving control information from at least two flight control computers, the control information including control instructions and check codes; Determining whether a flight control computer has a fault according to the control information; Cutting off the signal output of the flight control computer with a fault; Controlling the normally operating flight control computer to send the received control instructions to the actuator processors, where there are at least two actuator processors, the control instructions including verification flight control instructions and main flight control instructions, the main flight control instructions being used to output to the actuators to drive the corresponding actuating mechanisms; the verification flight control instructions being used to verify whether the other actuator processors are normal, so that when a single actuator processor fails, the normally operating actuator processor intervenes to cut off the output of the faulty actuator processor.

2. The method according to claim 1, wherein The step of determining whether a flight control computer has a fault according to the control information includes: Matching the check code with a preset check code; Determining that the flight control computer with a mismatch is the flight control computer with a fault.

3. The method according to claim 2, wherein After the step of matching the check code with the preset check code, it further includes: When there are at least two of the matched flight control computers, determining the error between the control instructions received by the matched flight control computers; Determining that the flight control computers with an error greater than the preset error are all flight control computers with faults.

4. The method according to any one of claims 1 to 3, characterized in that, The method further includes: When all flight control computers have faults, cutting off the signal outputs of all flight control computers; Connecting the signal channel between the joystick and the actuator processors to send the control signal output by the joystick to the actuator processors.

5. The method according to claim 1, wherein The step of controlling the normally operating flight control computer to send the received control instructions to the actuator processors includes: Controlling the signal switch corresponding to the normally operating flight control computer to close, so that the signal switch is connected to all actuator processors.

6. The method according to claim 1, characterized in that, The step of cutting off the signal output of the flight control computer with a fault includes: Sending a disconnection signal to the signal switch corresponding to the flight control computer with a fault to cut off the signal output of the faulty flight control computer.

7. The method according to claim 1, wherein The method further includes: Sending the determination result of the flight control computer with a fault to a display module for display.

8. The method according to any one of claims 1 to 3, characterized in that The method further includes: When an arbitration intervention instruction is received, cutting off the signal outputs of all flight control computers; Connecting the signal channel between the joystick and the actuator processors to send the control signal output by the joystick to the actuator processors.

9. An arbitration unit, characterized in that, The arbitration unit includes: a memory, a processor, and a redundancy control program of a flight control system stored on the memory and executable on the processor. When the redundancy control program of the flight control system is executed by the processor, it implements the steps of the redundancy control method of the flight control system as described in any one of claims 1-8.

10. A flight control system, characterized in that, The flight control system includes the arbitration unit as described in claim 9.

11. A computer-readable storage medium, characterized in that, Stored thereon is a redundancy control program of a flight control system. When the redundancy control program of the flight control system is executed by a processor, it implements the steps of the redundancy control method of the flight control system as described in any one of claims 1-8.

Images