A fault recovery method for a redundant flight control system

Abstract

The application belongs to the technical field of flight control system, and discloses a kind of redundancy flight control system fault recovery method, comprising: S1, determine fault signal recovery sequence;S2, when recoverable fault occurs, flight control computer lights up recovery request lamp to prompt pilot that there is recoverable fault;Whether to request recovery fault and when to request recovery fault are decided by pilot according to the task executed and aircraft state;The recovery request switch is a redundant switch;S3, according to the fault signal recovery sequence, try to recover fault signal one by one;S4, determine whether fault signal is recovered successfully, realize the ordered recovery of a variety of faults of the redundant flight control system, reduce system transient change, improve signal availability;Even if recovery fails, the safety of the system can still be ensured, and more serious consequences can not be caused.

Description

Technical Field

[0001] This invention belongs to the field of flight control system technology, and in particular relates to a fault recovery method for a redundant flight control system. Background Technology

[0002] In a redundant flight control / management system, the flight control / management computer, as the core control component, is responsible for redundancy management. Redundancy management is responsible for fault detection, isolation, and reconfiguration of various components and subsystems within the system. Simultaneously, to enhance the availability of components and subsystems, the system needs to inspect faulty components. If a previously faulty component or subsystem has recovered, the system can resume operation at an appropriate time.

[0003] The process of reintegrating previously faulty components or subsystems into the normal signal is called recovery. Fault recovery inevitably involves the reconfiguration of the monitor, at which point it is crucial to ensure that recovery does not cause large transient changes in the system. Recovery may succeed or fail, but even if recovery fails, it should not create problems more severe than the original fault. Therefore, the timing and conditions of recovery need to be considered; when multiple faults coexist, the order of recovery needs to be considered; and in redundant systems, the consistency of recovery across channels also needs to be considered. Summary of the Invention

[0004] The technical problem solved by this invention is as follows: This invention proposes a fault recovery method for a redundant flight control system, which can realize the orderly recovery of various faults in the redundant flight control system, reduce system transient changes, and improve signal availability; even if the recovery fails, the system safety can still be ensured and no more serious consequences will occur.

[0005] To achieve the above objectives, the present invention employs the following technical solution.

[0006] A method for fault recovery of a redundant flight control system, the method being applied to an architecture comprising: a flight control computer and a recovery request switch and a recovery request light installed in the aircraft cockpit; the method includes:

[0007] S1, determine the fault signal recovery sequence;

[0008] S2, When a recoverable fault occurs, the flight control computer illuminates the recovery request light to alert the pilot that a recoverable fault exists; the pilot decides whether and when to request recovery based on the mission being performed and the aircraft status; the recovery request switch is a redundant switch;

[0009] S3, attempt to recover the fault signals one by one according to the fault signal recovery sequence;

[0010] S4, determine whether the fault signal has been successfully recovered.

[0011] Furthermore, S1 specifically refers to:

[0012] S11, the dependent signal should be placed before the dependent signal to ensure that all recoverable signals can be recovered in the same request; the determined recovery sequence is: signal 1, signal 2, ..., signal N; N is the total number of signals;

[0013] S12, only one signal can be recovered at a time. The determined signal recovery sequence is: signal 1.A, signal 1.B... signal 1.M, signal 2.A, signal 2.B... signal 2.M, signal 3.A, signal 3.B... signal 3.M, ..., signal NA, signal NB... signal NM; where M is the redundancy number.

[0014] Furthermore, S3 specifically refers to:

[0015] S31, check if signal 1.A is faulty. If signal 1.A is not faulty, check the next signal 1.B; otherwise, try to restore it according to the type of signal 1. If several attempts are successful, it is considered that 1.A has been restored successfully, and the reconstructed monitor adds signal 1.A to the monitor; if the attempt fails, the restoration of this signal fails; regardless of success or failure, the restoration of this signal ends.

[0016] S32, check if signal 1.B is faulty. If signal 1.B is not faulty, check the next signal 1.C; otherwise, try to recover according to the type of signal 1. If several attempts are successful, it is considered that 1.B has been successfully recovered, and the monitor is reconstructed to add 1.B to the monitor; if the attempt fails, the recovery of this signal fails; regardless of success or failure, the recovery of this signal ends.

[0017] S33, and so on, continue searching until the last redundancy of signal 1;

[0018] S34, and so on, continue to check whether each redundancy of signal 2 is faulty, then check whether each redundancy of signal 3 is faulty, until the last redundancy of the last signal.

[0019] Furthermore, when the redundant flight control system is a quadruple-redundant centralized architecture flight control system, S1, determine the fault signal recovery sequence, specifically: horizontal stabilizer command - channel A, horizontal stabilizer command - channel B, horizontal stabilizer command - channel C, horizontal stabilizer command - channel D; rudder command - channel A, rudder command - channel B, rudder command - channel C, rudder command - channel D; pitch stick command - channel A, pitch stick command - channel B, pitch stick command - channel C, pitch stick command - channel D; pedal command - channel A, pedal command - channel B, pedal command - channel C, pedal command - channel D; roll rate - channel A, roll rate - channel B, roll rate - channel C, roll rate - channel D; yaw rate - channel A, yaw rate - channel B, yaw rate - channel C, yaw rate - Channel D; Normal acceleration - Channel A, Channel B, Channel C, Channel D; Lateral acceleration - Channel A, Channel B, Channel C, Channel D; Wheel load switch - Channel A, Channel B, Channel C, Channel D; Leveling switch - Channel A, Channel B, Channel C, Channel D; Angle of attack - Channel A, Channel B, Channel C, Channel D; Dynamic pressure - Channel A, Channel B, Channel C, Channel D; Actuator electronic fault - Channel A, Channel B, Channel C, Channel D; Actuator hydraulic fault.

[0020] Furthermore, when the redundant flight control system is a quadruple-redundant centralized architecture flight control system, S3, the fault signals are attempted to be restored one by one according to the fault signal recovery sequence, specifically as follows:

[0021] Check if the signal tail command-A channel is faulty. If it is not faulty, check the next signal tail command-B channel. Otherwise, try to recover it according to the type of signal 1. If several attempts are successful, the tail command-A channel is considered to have been successfully recovered. The reconstructed monitor adds the tail command-A channel to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends.

[0022] Check if the signal tail command-B channel is faulty. If it is not faulty, check the next signal tail command-C channel. Otherwise, try to recover it according to the type of signal 1. If several attempts are successful, the tail command-B channel is considered to have been successfully recovered. The monitor is reconstructed and the tail command-B channel is added to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends.

[0023] Continue searching in this manner until you reach the flat-tail instruction -D channel;

[0024] Continue checking for faults in each redundancy of the rudder command, then check for faults in each redundancy of the pitch control, until a hydraulic fault occurs in the actuator.

[0025] Furthermore, S4 determines whether the fault signal has been successfully recovered, specifically:

[0026] Output command types include horizontal stabilizer commands and rudder commands; the recovery success criterion is: the difference between the channel measurement value of the output command for 600ms consecutively and the first voting value is less than 3% of the full scale; the first voting value is the result of the redundant output command signal after selection calculation;

[0027] Analog inputs include pitch stick commands, pedal commands, dynamic pressure, angle of attack, yaw rate, roll rate, normal acceleration, and lateral acceleration. The successful recovery criterion is: the CPU of this channel is active for 450ms continuously and the difference between the channel measurement value and the value of the second vote is less than 8% of the full scale; the second vote value is the result of the redundant analog input signal after selection calculation.

[0028] Discrete input types include wheel-mounted switches and leveling switches; the successful recovery criterion is: the cross-link data link transmission of this channel is valid for 300ms continuously and the channel measurement value is the same as the third voting value; the third voting value is the result of the redundant discrete input signal after selection calculation;

[0029] Actuator malfunctions include actuator electronic malfunctions and actuator hydraulic malfunctions. The recovery method is to send an actuator reset command. The recovery success criterion is to read the actuator validity after 150ms. If it is valid, the recovery is successful; otherwise, the recovery fails.

[0030] Furthermore, when the redundant flight control system is a triple-redundant distributed architecture, S1, the fault signal recovery sequence is determined, specifically as follows: horizontal stabilizer command - channel A, horizontal stabilizer command - channel B, horizontal stabilizer command - channel C; rudder command - channel A, rudder command - channel B, rudder command - channel C; pitch stick command - channel A, pitch stick command - channel B, pitch stick command - channel C; pedal command - channel A, pedal command - channel B, pedal command - channel C; roll rate - channel A, roll rate - channel B, roll rate - channel C; yaw rate - channel A. Yaw rate - channel B, yaw rate - channel C; normal acceleration - channel A, normal acceleration - channel B, normal acceleration - channel C; lateral acceleration - channel A, lateral acceleration - channel B, lateral acceleration - channel C; wheel switch - channel A, wheel switch - channel B, wheel switch - channel C; leveling switch - channel A, leveling switch - channel B, leveling switch - channel C; angle of attack - channel A, angle of attack - channel B, angle of attack - channel C; dynamic pressure - channel A, dynamic pressure - channel B, dynamic pressure - channel C; actuator controller malfunction; electric throttle controller malfunction.

[0031] Furthermore, when the redundant flight control system is a triple-redundant distributed architecture, S3, the fault signals are attempted to be restored one by one according to the fault signal recovery sequence, specifically as follows:

[0032] Check if the signal tail command-A channel is faulty. If it is not faulty, check the next signal tail command-B channel. Otherwise, try to recover it according to the type of signal 1. If several attempts are successful, the tail command-A channel is considered to have been successfully recovered. The reconstructed monitor adds the tail command-A channel to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends.

[0033] Check if the signal tail command-B channel is faulty. If it is not faulty, check the next signal tail command-C channel. Otherwise, try to recover it according to the type of signal 1. If several attempts are successful, the tail command-B channel is considered to have been successfully recovered. The monitor is reconstructed and the tail command-B channel is added to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends.

[0034] Continue searching in this manner until you reach the flat-tail instruction - C channel;

[0035] Continue checking for faults in each redundancy of the rudder command, then check for faults in each redundancy of the pitch control, until the electric throttle controller malfunctions.

[0036] Furthermore, S4 determines whether the fault signal has been successfully recovered, specifically:

[0037] Output command types include horizontal stabilizer commands and rudder commands; the recovery success criterion is: the difference between the channel measurement value of the output command for 600ms consecutively and the first voting value is less than 3% of the full scale; the first voting value is the result of the redundant output command signal after selection calculation;

[0038] Analog inputs include pitch stick commands, pedal commands, dynamic pressure, angle of attack, yaw rate, roll rate, normal acceleration, and lateral acceleration. The successful recovery criterion is: the CPU of this channel is active for 450ms continuously and the difference between the channel measurement value and the value of the second vote is less than 8% of the full scale; the second vote value is the result of the redundant analog input signal after selection calculation.

[0039] Discrete input types include wheel-mounted switches and leveling switches; the successful recovery criterion is: the cross-link data link transmission of this channel is valid for 300ms continuously and the channel measurement value is the same as the third voting value; the third voting value is the result of the redundant discrete input signal after selection calculation;

[0040] For secondary controller faults, including actuator controllers and electric throttle controllers, the recovery method is to send a reset command to the secondary controller. The recovery success criterion is to read the validity of the relevant fault of the secondary controller after 240ms. If it is valid, the recovery is successful; otherwise, the recovery fails.

[0041] This invention solves the challenge of fault recovery in flight control / flight management systems through a system-level hardware and software collaboration approach. It employs a rigorously defined fault recovery sequence to ensure the determinism of the recovery process; the design of the recovery sequence addresses the dependencies between signals, thereby achieving high efficiency in the recovery process; the recovery search process ensures that at most one signal is recovered at a time, reducing system transient changes / jitter; setting corresponding recovery methods and criteria for different types of signals demonstrates the flexibility of the recovery strategy; and the human-machine interface design considers the diversity of flight scenarios, giving pilots ample choice and reflecting respect and care for them. Attached Figure Description

[0042] Figure 1 This is a schematic diagram of the recovery sequence design results provided in an embodiment of the present invention;

[0043] Figure 2 This is a schematic diagram of the recovery process provided in an embodiment of the present invention;

[0044] Figure 3 The present invention provides various signal types, their recovery methods, and success criteria for embodiments of the present invention. Detailed Implementation

[0045] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0046] This invention provides a fault recovery method for a redundant flight control system, specifically including:

[0047] 1) Architecture Design. This invention requires the joint development of aircraft cockpit switches, flight control / flight management computer hardware, and flight control / flight management computer software.

[0048] 1.1) Install a "Recovery Request Switch" and a recovery request light in the aircraft cockpit. This switch should be a redundant switch.

[0049] 1.2) The flight controller / flight management computer hardware needs to complete the acquisition and transmission of the "recovery request switch" signal;

[0050] 1.3) The flight control / flight management software performs redundancy management on the "recovery request switch" to determine its effectiveness; illuminates the recovery request light at an appropriate time; and controls the recovery process according to the method defined in this invention.

[0051] 2) Human-Machine Interaction Design. When a recoverable fault occurs, the flight control computer should illuminate the recovery light to alert the pilot. Whether and when to request recovery will be determined by the pilot based on the mission being performed and the aircraft's status. When the pilot needs to perform fault recovery, they must press the recovery request switch. The flight control / flight management software will recognize this, initiate the recovery process, and extinguish the recovery request light.

[0052] 3) Determine the fault signal recovery sequence.

[0053] 3.1) The relationships between the signals to be recovered need to be considered. The dependent signals should precede the relying signals to ensure that all recoverable signals can be recovered in a single request. The determined recovery sequence is: Signal 1, Signal 2, Signal 3… Signal N, where N is the number of signals.

[0054] 3.2) Considering the relationship between different redundancies of the same signal, only one signal can be attempted to be recovered at a time. The determined recovery sequence is: signal 1.A, signal 1.B... signal 1.M, signal 2.A, signal 2.B... signal 2.M, signal 3.A, signal 3.B... signal 3.M, ... signal NA, signal NB... signal NM. Where M is the total number of redundancies.

[0055] Figure 1 A schematic diagram of the design results for the recovery sequence.

[0056] 4) Attempt to recover the fault signals one by one according to the predefined recovery sequence, as follows:

[0057] 4.1) Check if signal 1.A is faulty. If signal 1.A is not faulty, check the next signal 1.B. Otherwise, if signal 1.A is faulty, try to recover it according to the type of signal 1. If several attempts are successful, it is considered that 1.A has been successfully recovered, and the reconstructed monitor adds signal 1.A to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends.

[0058] 4.2) Check if signal 1.B is faulty. If signal 1.B is not faulty, check the next signal 1.C; otherwise, try to recover according to the type of signal 1. If several attempts are successful, it is considered that 1.B has been successfully recovered, and the reconstructed monitor adds 1.B to the monitor; if the attempt fails, the recovery of this signal fails; regardless of success or failure, the recovery of this signal ends.

[0059] 4.3) Continue searching in this manner until the last redundancy of signal 1. Check if signal 1.M is faulty. If it is not faulty, check the next signal 2.A; otherwise, try to recover it according to the type of signal 1. If several attempts are successful, it is considered that 1.M has been successfully recovered, and the reconstructed monitor adds 1.M to the monitor; if the attempt fails, the recovery of this signal fails; regardless of success or failure, the recovery of this signal ends.

[0060] 4.4) Continue to check whether each redundancy of signal 2 is faulty, then check whether each redundancy of signal 3 is faulty, until the last redundancy of the last signal.

[0061] 4.5) Check if signal NM is faulty. If it is not faulty, end the current recovery process. Otherwise, try to recover according to the type of signal N. If several attempts are successful, MM is considered to have been recovered successfully, and the monitor is reconstructed to add NM to the monitor. If the attempt fails, the signal recovery fails. Regardless of success or failure, the signal recovery ends and the current recovery process ends.

[0062] Figure 2 This is a schematic diagram of the recovery process.

[0063] 5) Design suitable recovery methods and success criteria for each type of signal: Recovery Method 1, Recovery Method 2, ..., Recovery Method N; Success Criterion 1, Success Criterion 2, ..., Success Criterion N; These methods and criteria can be applied to signal type 1, signal type 2, ..., signal type N respectively. For example... Figure 3 As shown.

[0064] 6) Handling distributed systems.

[0065] 6.1) When designing the recovery sequence, include the secondary controller that needs to be recovered;

[0066] 6.2) Design corresponding recovery methods and recovery criteria for secondary controller failures;

[0067] 6.3) If a recoverable fault exists in the secondary controller, a recovery request must be sent to the primary controller, and the controller must wait for instructions from the primary controller.

[0068] 6.4) After receiving a recovery request from the secondary controller, the primary controller illuminates the recovery request light to alert the pilot; at the same time, it marks the secondary controller as faulty.

[0069] 6.5) After the pilot presses the recovery switch to start the recovery, the system searches according to the predefined recovery sequence. After the secondary controller fault recovery is started, the system issues a recovery command to the secondary controller according to the pre-designed secondary controller recovery method and success criteria.

[0070] 6.6) After receiving the instruction from the primary controller, the secondary controller cooperates to complete the recovery operation.

[0071] Implementation Method 1: Fault Recovery Method for Quad-Redundant Centralized Architecture Flight Control / Flight Management System

[0072] 1) Architecture Design. This invention requires the joint development of aircraft cockpit switches, flight control / flight management computer hardware, and flight control / flight management computer software.

[0073] 1.1) Install a "Recovery Request Switch" and a recovery request light in the aircraft cockpit. This switch should be a redundant switch.

[0074] 1.2) The flight controller / flight management computer hardware needs to complete the acquisition and transmission of the "recovery request switch" signal;

[0075] 1.3) The flight control / flight management software performs redundancy management on the "recovery request switch" to determine its effectiveness; illuminates the recovery request light at an appropriate time; and controls the recovery process according to the method defined in this invention.

[0076] 2) Human-machine interaction design. When a recoverable fault occurs, the flight control computer should illuminate the recovery light to alert the pilot that a recoverable fault exists; whether to request recovery and when to request recovery will be determined by the pilot based on the mission being performed and the aircraft's status.

[0077] 3) Determine the fault signal recovery sequence. The specific sequence is as follows:

[0078] Horizontal stabilizer commands - Channel A, Channel B, Channel C, Channel D; Rudder commands - Channel A, Channel B, Channel C, Channel D; Pitch stick commands - Channel A, Channel B, Channel C, Channel D; Pedal stick commands - Channel D, Channel C, Channel D; Pedal pedal commands - Channel A, Channel B, Channel C, Channel D; Roll rate - Channel A, Channel B, Channel C, Channel D; Yaw rate - Channel A, Channel B, Channel C, Channel D; Normal acceleration - Channel A, Channel B. Normal acceleration - Channel C, Normal acceleration - Channel D, Lateral acceleration - Channel A, Lateral acceleration - Channel B, Lateral acceleration - Channel C, Lateral acceleration - Channel D, Wheel-mounted switch - Channel A, Wheel-mounted switch - Channel B, Wheel-mounted switch - Channel C, Wheel-mounted switch - Channel D, Leveling switch - Channel A, Leveling switch - Channel B, Leveling switch - Channel C, Leveling switch - Channel D, Angle of attack - Channel A, Angle of attack - Channel B, Angle of attack - Channel C, Angle of attack - Channel D, Dynamic pressure - Channel A, Dynamic pressure - Channel B, Dynamic pressure - Channel C, Dynamic pressure - Channel D, Actuator electronic fault - Channel A, Actuator electronic fault - Channel B, Actuator electronic fault - Channel C, Actuator electronic fault - Channel D, Actuator hydraulic fault.

[0079] 4) Attempt to recover the fault signals one by one according to the predefined recovery sequence, as follows:

[0080] 4.1) Check if the signal tail command-A channel is faulty. If it is not faulty, check the next signal tail command-B channel. Otherwise, try to recover according to the type of signal 1. If several attempts are successful, the tail command-A channel is considered to have been successfully recovered. The reconstructed monitor adds the tail command-A channel to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends.

[0081] 4.2) Check if the signal tail command-B channel is faulty. If it is not faulty, check the next signal tail command-C channel. Otherwise, try to recover according to the type of signal 1. If several attempts are successful, the tail command-B channel is considered to have been successfully recovered. The reconstructed monitor will add the tail command-B channel to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends.

[0082] 4.3) Continue the search in this manner until the horizontal stabilizer command -D channel is reached. Check if the horizontal stabilizer command -D signal is faulty. If it is not faulty, check the next signal, the rudder command -A channel; otherwise, attempt to restore it according to the type of horizontal stabilizer command. If several attempts are successful, the horizontal stabilizer command -D channel is considered to have been successfully restored, and the monitor is reconfigured to add the horizontal stabilizer command -D channel to the monitor; if the attempt fails, the restoration of this signal fails; regardless of success or failure, the restoration of this signal ends.

[0083] 4.4) Continue to check for faults in each redundancy of the rudder command, then check for faults in each redundancy of the pitch control, until the actuator hydraulic system fails.

[0084] 4.5) Check if the actuator hydraulic system is faulty. If it is not faulty, end the current recovery process. Otherwise, try to recover the actuator hydraulic system according to its type. If several attempts are successful, the actuator hydraulic system is considered to have been successfully recovered, and the monitor will be reconstructed. If the attempt fails, the signal recovery fails. Regardless of success or failure, the signal recovery ends, and the current recovery process ends.

[0085] 5) Design suitable recovery methods and successful recovery criteria for each type of signal.

[0086] 5.1) Output command types, including horizontal stabilizer commands and rudder commands. The successful recovery criterion is: the difference between the channel measurement value and the voting value of the output command over 600ms is less than 3% of the full scale; the voting value is the result of the redundant output command signal after selection calculation.

[0087] 5.2) Analog inputs, including pitch stick commands, pedal commands, dynamic pressure, angle of attack, yaw rate, roll rate, normal acceleration, and lateral acceleration. The successful recovery criterion is: the CPU is active on this channel for 450ms consecutively, and the difference between the channel measurement value and the voting value is less than 8% of full scale; the voting value is the result of selection calculation for redundant analog input signals.

[0088] 5.3) Discrete input types, including wheel-mounted switches and leveling switches. The successful recovery criterion is: the current channel's CCDL (Cross Data Link Transmission) must be valid for 300 consecutive ms, and the channel measurement value must be the same as the voting value. The voting value is the result of selection calculation for the redundant discrete input signal.

[0089] 5.4) Actuator faults, including actuator electronic faults and actuator hydraulic faults. The recovery method is to send an actuator reset command; the recovery success criterion is to read the actuator validity after 150ms. If it is valid, the recovery is successful; otherwise, the recovery fails.

[0090] 2. Implementation Method Two: Fault Recovery Method for Tri-Redundant Distributed Architecture Flight Management / Control System

[0091] 1) Architecture Design. This invention requires the joint development of aircraft cockpit switches, flight control / flight management computer hardware, and flight control / flight management computer software.

[0092] 1.1) Install a "Recovery Request Switch" and a recovery request light in the aircraft cockpit. This switch should be a redundant switch.

[0093] 1.2) The flight controller / flight management computer hardware needs to complete the acquisition and transmission of the "recovery request switch" signal;

[0094] 1.3) The flight control / flight management software performs redundancy management on the "recovery request switch" to determine its effectiveness; illuminates the recovery request light at an appropriate time; and controls the recovery process according to the method defined in this invention.

[0095] 2) Human-machine interaction design. When a recoverable fault occurs, the flight control computer should illuminate the recovery light to alert the pilot that a recoverable fault exists; whether to request recovery and when to request recovery will be determined by the pilot based on the mission being performed and the aircraft's status.

[0096] 3) Determine the fault signal recovery sequence. The specific sequence is as follows:

[0097] Horizontal stabilizer commands - Channel A, Horizontal stabilizer commands - Channel B, Horizontal stabilizer commands - Channel C, Rudder commands - Channel A, Rudder commands - Channel B, Rudder commands - Channel C, Pitch stick commands - Channel A, Pitch stick commands - Channel B, Pitch stick commands - Channel C, Pedal commands - Channel A, Pedal commands - Channel B, Pedal commands - Channel C, Roll rate - Channel A, Roll rate - Channel B, Roll rate - Channel C, Yaw rate - Channel A, Yaw rate - Channel B, Yaw rate - Channel C, Normal acceleration Angle of attack - Channel A, Normal acceleration - Channel B, Normal acceleration - Channel C, Lateral acceleration - Channel A, Lateral acceleration - Channel B, Lateral acceleration - Channel C, Wheel switch - Channel A, Wheel switch - Channel B, Wheel switch - Channel C, Leveling switch - Channel A, Leveling switch - Channel B, Leveling switch - Channel C, Angle of attack - Channel A, Angle of attack - Channel B, Angle of attack - Channel C, Dynamic pressure - Channel A, Dynamic pressure - Channel B, Dynamic pressure - Channel C, Actuator controller fault, Electric throttle controller fault.

[0098] 4) Attempt to recover the fault signals one by one according to the predefined recovery sequence, as follows:

[0099] 4.1) Check if the signal tail command-A channel is faulty. If it is not faulty, check the next signal tail command-B channel. Otherwise, try to recover according to the type of signal 1. If several attempts are successful, the tail command-A channel is considered to have been successfully recovered. The reconstructed monitor adds the tail command-A channel to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends.

[0100] 4.2) Check if the signal tail command-B channel is faulty. If it is not faulty, check the next signal tail command-C channel. Otherwise, try to recover according to the type of signal 1. If several attempts are successful, the tail command-B channel is considered to have been successfully recovered. The reconstructed monitor will add the tail command-B channel to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends.

[0101] 4.3) Check the horizontal stabilizer command-C channel. Check if the horizontal stabilizer command-C signal is faulty. If it is not faulty, check the next signal, the rudder command-A channel; otherwise, attempt to restore according to the type of horizontal stabilizer command. If several attempts are successful, the horizontal stabilizer command-C channel is considered to have been restored successfully, and the monitor is reconfigured to add the horizontal stabilizer command-C channel to the monitor; if the attempt fails, the signal restoration fails; regardless of success or failure, the signal restoration ends.

[0102] 4.4) Continue to check for faults in each redundancy of the rudder command, then check for faults in each redundancy of the pitch control stick command, until the electric throttle controller malfunctions.

[0103] 4.5) Check if the electric throttle controller is faulty. If it is not faulty, end the current recovery process. Otherwise, try to recover according to the type of electric throttle controller. If several attempts are successful, the electric throttle controller is considered to have been successfully recovered. If the attempts fail, the signal recovery fails. Regardless of success or failure, the signal recovery ends and the current recovery process ends.

[0104] 5) Design suitable recovery methods and successful recovery criteria for each type of signal.

[0105] 5.1) Output command types, including horizontal stabilizer commands and rudder commands. The successful recovery criterion is: the difference between the channel measurement value and the voting value of the output command over 600ms is less than 3% of the full scale; the voting value is the result of the redundant output command signal after selection calculation.

[0106] 5.2) Analog inputs, including pitch stick commands, pedal commands, dynamic pressure, angle of attack, yaw rate, roll rate, normal acceleration, and lateral acceleration. The successful recovery criterion is: continuous 480ms of valid bus transmission on this channel and the difference between the channel measurement value and the voting value is less than 8% of full scale; the voting value is the result of selection calculation for redundant analog input signals.

[0107] 5.3) Discrete input types, including wheel-mounted switches and leveling switches. The successful recovery criterion is: continuous 300ms of valid bus transmission on this channel and the same channel measurement value as the voting value. The voting value is the result of selection calculation for the redundant discrete input signal;

[0108] 5.4) Secondary controller faults: actuator controller and electric throttle controller. The recovery method is to send a reset command to the secondary controller. The success criterion for recovery is: after 240ms, read the validity of the relevant fault in the secondary controller; if valid, recovery is successful; otherwise, recovery fails.

[0109] This invention proposes a fault recovery method for redundant flight control systems. Based on this method, orderly recovery of various faults in redundant flight control systems can be achieved, reducing system transient changes and improving signal availability; even if recovery fails, the system's safety can still be ensured and no more serious consequences will occur.

[0110] This invention solves the challenge of flight control / flight management system recovery through a system-level hardware and software collaboration approach. It employs a rigorously defined fault recovery sequence to ensure the determinism of the recovery process; the recovery sequence design addresses the dependencies between signals, thereby achieving high efficiency in the recovery process; the recovery search process ensures that only one signal redundancy is recovered at a time, reducing system transient changes / jitter; setting corresponding recovery methods and criteria for different types of signals demonstrates the flexibility of the recovery strategy; and the human-machine interface design considers the diversity of flight scenarios, giving pilots ample choice and reflecting respect and care for them.

[0111] The fault recovery method described in this invention has wide applicability. The above-mentioned implementation examples are only two specific applications of this method. By making various selections or combinations of the various steps and design considerations of this method, specific implementation schemes can be obtained, all of which should fall within the protection scope of this invention.

[0112] Specifically, this method applies to, but is not limited to, the following aspects: From the perspective of flight control system architecture, this method is applicable to both centralized and distributed architectures; from the perspective of manned and unmanned systems, this method is applicable to both manned and unmanned aircraft; from the perspective of specific signals to be recovered, this method is applicable to all signals, components, and subsystems that are considered recoverable in the system design; from the perspective of redundancy configuration, it is applicable to flight control systems with various redundancy configurations.

Claims

1. A fault recovery method for a redundant flight control system, characterized in that, The method is applied to an architecture including: a flight control computer and a recovery request switch and a recovery request light located in the aircraft cockpit; the method includes: S1, determine the fault signal recovery sequence; S1 specifically is: S11, the dependent signal should be placed before the dependent signal to ensure that all recoverable signals can be recovered in the same request; the determined recovery sequence is: signal 1, signal 2, ..., signal N; N is the total number of signals; S12, only one signal can be recovered at a time. The determined signal recovery sequence is: signal 1.A, signal 1.B... signal 1.M, signal 2.A, signal 2.B... signal 2.M, signal 3.A, signal 3.B... signal 3.M, ..., signal NA, signal NB... signal NM; where M is the redundancy. S2, When a recoverable fault occurs, the flight control computer illuminates the recovery request light to alert the pilot that a recoverable fault exists; the pilot decides whether and when to request recovery based on the mission being performed and the aircraft status; the recovery request switch is a redundant switch; S3, attempt to recover the fault signals one by one according to the fault signal recovery sequence; S4, determine whether the fault signal has been successfully recovered; When the redundant flight control system is a quadruple-redundant centralized architecture flight control system, S1, determine the fault signal recovery sequence, specifically: horizontal stabilizer command - channel A, horizontal stabilizer command - channel B, horizontal stabilizer command - channel C, horizontal stabilizer command - channel D; rudder command - channel A, rudder command - channel B, rudder command - channel C, rudder command - channel D; pitch stick command - channel A, pitch stick command - channel B, pitch stick command - channel C, pitch stick command - channel D; pedal command - channel A, pedal command - channel B, pedal command - channel C, pedal command - channel D; roll rate - channel A, roll rate - channel B, roll rate - channel C, roll rate - channel D; yaw rate - channel A, yaw rate - channel B, yaw rate - channel C, yaw rate - channel D Channels: Normal acceleration - Channel A, Normal acceleration - Channel B, Normal acceleration - Channel C, Normal acceleration - Channel D; Lateral acceleration - Channel A, Lateral acceleration - Channel B, Lateral acceleration - Channel C, Lateral acceleration - Channel D; Wheel-mounted switch - Channel A, Wheel-mounted switch - Channel B, Wheel-mounted switch - Channel C, Wheel-mounted switch - Channel D; Leveling switch - Channel A, Leveling switch - Channel B, Leveling switch - Channel C, Leveling switch - Channel D; Angle of attack - Channel A, Angle of attack - Channel B, Angle of attack - Channel C, Angle of attack - Channel D; Dynamic pressure - Channel A, Dynamic pressure - Channel B, Dynamic pressure - Channel C, Dynamic pressure - Channel D; Actuator electronic fault - Channel A, Actuator electronic fault - Channel B, Actuator electronic fault - Channel C, Actuator electronic fault - Channel D; Actuator hydraulic fault; When the redundant flight control system is a quadruple-redundant centralized architecture flight control system, S3, the fault signals are attempted to be restored one by one according to the fault signal recovery sequence, specifically: Check if the signal tail command-A channel is faulty. If it is not faulty, check the next signal tail command-B channel. Otherwise, try to recover it according to the type of signal 1. If several attempts are successful, the tail command-A channel is considered to have been successfully recovered. The reconstructed monitor adds the tail command-A channel to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends. Check if the signal tail command-B channel is faulty. If it is not faulty, check the next signal tail command-C channel. Otherwise, try to recover it according to the type of signal 1. If several attempts are successful, the tail command-B channel is considered to have been successfully recovered. The monitor is reconstructed and the tail command-B channel is added to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends. Continue searching in this manner until you reach the flat-tail instruction -D channel; Continue checking for faults in each redundancy of the rudder command, then check for faults in each redundancy of the pitch control, until a hydraulic fault occurs in the actuator. S4, determine whether the fault signal has been successfully recovered, specifically: Output command types include horizontal tail command and rudder command; the recovery success criterion is: the difference between the channel measurement value of the output command for 600ms consecutively and the first voting value is less than 3% of the full scale; the first voting value is the result of the redundant output command signal after selection calculation; Analog inputs include pitch stick commands, pedal commands, dynamic pressure, angle of attack, yaw rate, roll rate, normal acceleration, and lateral acceleration. The successful recovery criterion is: the CPU of this channel is active for 450ms continuously and the difference between the channel measurement value and the value of the second vote is less than 8% of the full scale; the second vote value is the result of the redundant analog input signal after selection calculation. Discrete input types include wheel-mounted switches and leveling switches; the successful recovery criterion is: the cross-link data link transmission of this channel is valid for 300ms continuously and the channel measurement value is the same as the third voting value; the third voting value is the result of the redundant discrete input signal after selection calculation; Actuator malfunctions include actuator electronic malfunctions and actuator hydraulic malfunctions. The recovery method is to send an actuator reset command. The recovery success criterion is to read the actuator validity after 150ms. If it is valid, the recovery is successful; otherwise, the recovery fails.

2. The fault recovery method for a redundant flight control system according to claim 1, characterized in that, S3 specifically refers to: S31, check if signal 1.A is faulty. If signal 1.A is not faulty, check the next signal 1.B; otherwise, try to restore it according to the type of signal 1. If several attempts are successful, it is considered that 1.A has been restored successfully, and the reconstructed monitor adds signal 1.A to the monitor; if the attempt fails, the restoration of this signal fails; regardless of success or failure, the restoration of this signal ends. S32, check if signal 1.B is faulty. If signal 1.B is not faulty, check the next signal 1.C; otherwise, try to recover according to the type of signal 1. If several attempts are successful, it is considered that 1.B has been successfully recovered, and the monitor is reconstructed to add 1.B to the monitor; if the attempt fails, the recovery of this signal fails; regardless of success or failure, the recovery of this signal ends. S33, and so on, continue searching until the last redundancy of signal 1; S34, and so on, continue to check whether each redundancy of signal 2 is faulty, then check whether each redundancy of signal 3 is faulty, until the last redundancy of the last signal.

3. The fault recovery method for a redundant flight control system according to claim 2, characterized in that, When the redundant flight control system is a triple-redundant distributed architecture, S1, determine the fault signal recovery sequence, specifically: horizontal stabilizer command - channel A, horizontal stabilizer command - channel B, horizontal stabilizer command - channel C; rudder command - channel A, rudder command - channel B, rudder command - channel C; pitch stick command - channel A, pitch stick command - channel B, pitch stick command - channel C; pedal command - channel A, pedal command - channel B, pedal command - channel C; roll rate - channel A, roll rate - channel B, roll rate - channel C; yaw rate - channel A, yaw rate - channel B, yaw rate - channel C; normal acceleration - channel A, normal acceleration - channel B, normal acceleration - channel C. Lateral acceleration - Channel A, Lateral acceleration - Channel B, Lateral acceleration - Channel C; Wheel-mounted switch - Channel A, Wheel-mounted switch - Channel B, Wheel-mounted switch - Channel C; Leveling switch - Channel A, Leveling switch - Channel B, Leveling switch - Channel C; Angle of attack - Channel A, Angle of attack - Channel B, Angle of attack - Channel C; Dynamic pressure - Channel A, Dynamic pressure - Channel B, Dynamic pressure - Channel C; Actuator controller malfunction; Electric throttle controller malfunction.

4. The fault recovery method for a redundant flight control system according to claim 3, characterized in that, When the redundant flight control system is a triple-redundant distributed architecture, S3, the fault signals are attempted to be restored one by one according to the fault signal recovery sequence, specifically: Check if the signal tail command-A channel is faulty. If it is not faulty, check the next signal tail command-B channel. Otherwise, try to recover it according to the type of signal 1. If several attempts are successful, the tail command-A channel is considered to have been successfully recovered. The reconstructed monitor adds the tail command-A channel to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends. Check if the signal tail command-B channel is faulty. If it is not faulty, check the next signal tail command-C channel. Otherwise, try to recover it according to the type of signal 1. If several attempts are successful, the tail command-B channel is considered to have been successfully recovered. The monitor is reconstructed and the tail command-B channel is added to the monitor. If the attempt fails, the recovery of this signal fails. Regardless of success or failure, the recovery of this signal ends. Continue searching in this manner until you reach the flat-tail instruction - C channel; Continue checking for faults in each redundancy of the rudder command, then check for faults in each redundancy of the pitch control, until the electric throttle controller malfunctions.

5. The fault recovery method for a redundant flight control system according to claim 4, characterized in that, S4, determine whether the fault signal has been successfully recovered, specifically: Output command types include horizontal tail command and rudder command; the recovery success criterion is: the difference between the channel measurement value of the output command for 600ms consecutively and the first voting value is less than 3% of the full scale; the first voting value is the result of the redundant output command signal after selection calculation; Analog inputs include pitch stick commands, pedal commands, dynamic pressure, angle of attack, yaw rate, roll rate, normal acceleration, and lateral acceleration; the successful recovery criterion is: the CPU of this channel is active for 450ms continuously and the difference between the channel measurement value and the value of the second vote is less than 8% of the full scale; The second voting value is the result of the selection calculation of the redundant analog input signal; Discrete input types include wheel-mounted switches and leveling switches; the successful recovery criterion is: the cross-link data link transmission of this channel is valid for 300ms continuously and the channel measurement value is the same as the third voting value; the third voting value is the result of the redundant discrete input signal after selection calculation; For secondary controller faults, including actuator controllers and electric throttle controllers, the recovery method is to send a reset command to the secondary controller. The recovery success criterion is to read the validity of the relevant fault of the secondary controller after 240ms. If it is valid, the recovery is successful; otherwise, the recovery fails.

Images