A fly-by-wire flight control system control surface protection method and apparatus

Abstract

A fly-by-wire flight control system control surface protection method and apparatus is disclosed. In one embodiment, the flight control system can be degraded from normal mode to direct mode when the flight control system is below a minimum acceptable control (MAC) condition, with the control surfaces being directly controlled by actuator electronic control units. In a preferred embodiment, a failed actuator control channel can be reset to return the flight control system to normal mode when the actuator control channel returns to normal. The present invention provides further safety protection by attempting to restore system control when the flight control system condition is below a minimum acceptable control.

Description

Technical Field

[0001] This invention relates to aircraft, and more particularly to a method and apparatus for protecting the control surfaces of a fly-by-wire flight control system. Background Technology

[0002] According to the safety design requirements for fly-by-wire flight control systems of civil aircraft, the probability that the redundancy configuration of flight control actuators on each control axis is lower than the "Minimum Acceptable Control (MAC)" should be less than 1E-9 / FH. Although the probability of failure is extremely unlikely, if it does occur, the aircraft's flight attitude will be out of control, inevitably leading to catastrophic consequences.

[0003] Currently, fly-by-wire flight control systems in the domestic and international civil aircraft development field have comprehensively configured energy redundancy such as hydraulics and power supply, as well as actuator control channels. They consider various combined failures and minimum acceptable control (MAC) requirements, achieving multi-level failure-safe design. This type of architecture design can guarantee the minimum acceptable control of the aircraft under special scenarios. However, once the aircraft falls below the minimum acceptable control, it will lose control, and there is currently no further protection mechanism.

[0004] Therefore, there is a need in the field for an improved method and apparatus for protecting the control surfaces of a fly-by-wire flight control system. Summary of the Invention

[0005] This invention proposes an improved method and device for protecting the control surfaces of a fly-by-wire flight control system, enabling the flight control system to attempt to resume actuator operation when the control level is below the "minimum acceptable control" threshold, thereby allowing the aircraft to continue safe flight and landing.

[0006] According to one embodiment of the present invention, when the flight control computer detects that the system state is below the "Minimum Acceptable Control (MAC)", it will force the fly-by-wire flight control system into direct mode, where the actuator electronic control unit directly controls the control surfaces. In a further embodiment, the flight control computer cyclically detects and resets the actuator electronic internal monitor, sum monitor, and internal health monitor of the actuation system equipment, continuously issuing reset signals until it detects that the system is at or above the MAC. After the fault is cleared, the flight control system can recover to a state at or above the minimum acceptable control within a short time, immediately maintaining the aircraft attitude and achieving continuous safe flight and landing. Assuming that the system experiences a transient failure or a monitor malfunction causing the system to fall below the MAC under unexpected extreme conditions, the system can reset the internal monitor of the actuation system using this technology, allowing the system to reach the minimum acceptable control state after the system fault is recovered.

[0007] In one embodiment of the present invention, a method for protecting control surfaces of a fly-by-wire flight control system is provided, comprising: detecting the control surface control state during flight control system operation; determining, based on the control surface control state, whether the flight control system is below the minimum acceptable control (MAC) state; and if the flight control system is below the MAC state, degrading the flight control system from a normal mode to a direct mode, wherein in the normal mode, the flight control computer of the flight control system generates control surface commands according to a closed-loop control law and sends the generated control surface commands to an actuator electronic control unit to control the corresponding control surfaces, and in the direct mode, the actuator electronic control unit generates control surface commands according to a stick-to-rudder control law to control the corresponding control surfaces.

[0008] On one hand, the fly-by-wire flight control system control surface protection method further includes: detecting a fault signal generated by a monitor corresponding to an actuator control channel, the fault signal indicating that the corresponding actuator control channel has failed; resetting the failed actuator control channel to detect whether the actuator control channel has returned to normal.

[0009] In one aspect, the fly-by-wire flight control system control surface protection method further includes: if the actuator control channel returns to normal, determining whether the flight control system is still below the MAC state; if the flight control system is still below the MAC state, continuing to operate in the direct mode; and if the flight control system is at or above the MAC state, switching the flight control system from the direct mode to the normal mode.

[0010] In one aspect, the monitor includes one or more of the following: a sum monitor that monitors the sum of input signals to the cockpit control devices; an actuation control electronics internal monitor that monitors signals in the actuator electronic control unit; and an actuation system health monitor that monitors the actuator status of the actuation system.

[0011] On the one hand, resetting a faulty actuator control channel includes one or more of the following: setting the validity signal generated by the monitor corresponding to the faulty actuator control channel to valid; or resetting the self-recovery capability of the monitor associated with the faulty actuator control channel.

[0012] In one aspect, the minimum acceptable control MAC state includes the flight control actuator redundancy configuration state on the control axis, which includes one or more of the roll axis, pitch axis, and yaw axis.

[0013] On one hand, the closed-loop control law includes redundancy management and sensor signal voting; and on the other hand, the stick-to-rudder control law does not include redundancy management and sensor signal voting.

[0014] In one embodiment of the present invention, a fly-by-wire flight control system control surface protection device is provided, comprising: a control surface control state detection module configured to detect the control surface control state during flight control system operation and determine, based on the control surface control state, whether the flight control system is below the minimum acceptable control (MAC) state; and a mode change module configured to, if the flight control system is below the MAC state, degrade the flight control system from a normal mode to a direct mode, wherein in the normal mode, the flight control computer of the flight control system generates control surface commands according to a closed-loop control law and sends the generated control surface commands to an actuator electronic control unit to control the corresponding control surfaces, and in the direct mode, the actuator electronic control unit generates control surface commands according to a stick-to-rudder control law to control the corresponding control surfaces.

[0015] On one hand, the fly-by-wire flight control system control surface protection device further includes: a fault monitoring module configured to detect a fault signal generated by a monitor corresponding to an actuator control channel, the fault signal indicating that the corresponding actuator control channel has failed; and a fault reset module configured to reset the failed actuator control channel to detect whether the actuator control channel has returned to normal.

[0016] On one hand, if the actuator control channel returns to normal, the control surface control status detection module determines whether the flight control system is still below the MAC state; if the flight control system is still below the MAC state, it continues to operate in the direct mode; and if the flight control system is at or above the MAC state, the mode change module switches the flight control system from the direct mode to the normal mode.

[0017] In one aspect, the monitor includes one or more of the following: a sum monitor that monitors the sum of input signals to the cockpit control devices; an actuation control electronics internal monitor that monitors signals in the actuator electronic control unit; and an actuation system health monitor that monitors the actuator status of the actuation system.

[0018] On the one hand, resetting a faulty actuator control channel includes one or more of the following: setting the validity signal generated by the monitor corresponding to the faulty actuator control channel to valid; or resetting the self-recovery capability of the monitor associated with the faulty actuator control channel.

[0019] In one aspect, the minimum acceptable control MAC state includes the flight control actuator redundancy configuration state on the control axis, which includes one or more of the roll axis, pitch axis, and yaw axis.

[0020] On one hand, the closed-loop control law includes redundancy management and sensor signal voting; and on the other hand, the stick-to-rudder control law does not include redundancy management and sensor signal voting.

[0021] In one embodiment of the present invention, a fly-by-wire flight control system is provided, which includes a fly-by-wire flight control system control surface protection device as described in any of the preceding claims. Attached Figure Description

[0022] Figure 1 This is a schematic block diagram of a fly-by-wire flight control system according to an embodiment of the present invention.

[0023] Figure 2 This is a flowchart of a fly-by-wire flight control system control surface protection method according to an embodiment of the present invention.

[0024] Figure 3 This is a schematic block diagram of a monitor architecture for rudder surface control according to an embodiment of the present invention.

[0025] Figure 4 This is a block diagram of a fly-by-wire flight control system control surface protection device according to an embodiment of the present invention. Detailed Implementation

[0026] The present invention will be further described below with reference to specific embodiments and accompanying drawings, but this should not be construed as limiting the scope of protection of the present invention.

[0027] Figure 1 This is a schematic block diagram of a fly-by-wire flight control system 100 according to an embodiment of the present invention. The fly-by-wire flight control system 100 may include control devices 110, actuator electronic control units 120, flight control computer 130, actuators 140, etc. The control devices 110 may be located in the cockpit and include, for example, a control stick, control wheel, rudder pedals, etc. The pilot generates control commands for controlling the actuators 140 by operating various control devices 110. The actuators 140 drive corresponding control surfaces according to the control commands, and the control surfaces include, for example, elevators, ailerons, rudders, spoilers, etc.

[0028] When the pilot operates the control device 110, sensors detect the corresponding control commands and convert them into analog signals, which are then sent to the respective actuator electronic control units 120. After processing by the actuator electronic control units 120, the analog control commands are sent to the flight control computer 130 via a data bus. Simultaneously, the actuator electronic control units 120 also receive digital signals from external sensors (e.g., sensors located at various locations on the aircraft), which are also sent to the flight control computer 130 via the bus. The flight control computer 130 processes the received signals, performs control law calculations to generate control commands, and sends the generated control commands to the actuator electronic control units 120. The actuator electronic control units 120 output the control command signals to the actuators 140 via the bus to drive the corresponding control surface movements.

[0029] The fly-by-wire flight control system 100 has two operating modes: normal mode and direct mode. In normal mode, the control surface commands are calculated by the flight control computer 130. This mode provides complete redundancy management and sensor signal voting. In normal mode, aircraft sensor data (e.g., attitude, attitude rate, acceleration, airspeed, angle of attack, flap / slat position, etc.) are available and participate in the closed-loop control law calculation in the flight control computer 130, enabling complete calculation functions.

[0030] In direct mode, there is no system-level sensor voting; all three axes of the aircraft use direct command control surfaces. Gain adjustment is achieved using discrete slat signals, providing stability enhancement in both longitudinal and yaw directions. Control surface commands are calculated by the actuator electronic control unit 120, using direct mode rate sensors as stability enhancement signals. For example, the control law used in direct mode is a stick-to-rudder control law, which calculates the body rate damping and adjusts the gain based on the slat position and the direct mode rate sensor. In direct mode, cockpit operating device signals are simply calculated by the actuator electronic control unit 120 to generate commands to control the control surfaces. Taking longitudinal control as an example: the pilot manipulates the side stick, which generates elevator commands through command shaping and forward gain adjustment. The command shaping loop provides stick quantity control capability, enabling precise control with small stick quantities and rapid aircraft response with large stick quantities. The forward gain is a proportional element that converts side stick commands into elevator commands; the forward gain is adjusted according to the slat position. Generally, when the slats are retracted, the airspeed is often higher than when they are deployed, resulting in greater dynamic pressure. Therefore, it is necessary to limit the maximum upward deflection angle of the elevator when the slats are retracted to avoid excessive pitching moment under the same control. The elevator command and the feedback channel stabilization command are combined and then processed through a limiting stage to form the final elevator deflection command. The feedback channel stabilization command uses a filtered pitch rate signal for longitudinal stabilization, generating a stabilization command with stabilization function. The pitch rate is provided by the direct mode rate sensor and filtered to obtain the filtered pitch rate signal.

[0031] In fly-by-wire flight control systems, multiple levels of monitoring and voting surfaces are set up along the entire link from pilot commands to actuator outputs. Based on the comparison results of various signals, erroneous input channels are identified, and fault isolation and reporting are performed. Invalid channels and isolated erroneous channels will not participate in signal selection output. If some signal transmission channels fail due to system failure, it may cause the system to fall below the minimum acceptable control level. Existing fly-by-wire flight control systems do not have a mechanism to actively attempt recovery, and the aircraft will remain below the minimum acceptable control level, losing the ability to continue safe flight and landing.

[0032] This invention proposes a method and apparatus for protecting the control surfaces of a fly-by-wire flight control system, and more particularly a method and apparatus for protecting the minimum controllable control surfaces of a fly-by-wire flight control system, which may include one or more of the following two functions:

[0033] 1. Automatic Degradation Function: When the flight control computer detects that the flight control system status is lower than the "Minimum Acceptable Control (MAC)", it will force the fly-by-wire flight control system into direct mode through the automatic degradation function. In direct mode, there is no voting from system-level sensors, and basic stick-to-rudder control will be maintained; reducing redundant control of the system and improving system availability.

[0034] 2. Self-recovery function: When the flight control computer detects that the flight control system status is below the minimum acceptable control, it can continuously reset the fault monitor. When the fault disappears, the monitor status is restored, the flight control computer's control over the control surfaces is restored, and the system is brought to or above the minimum acceptable control, that is, the normal mode of the control law calculated by the flight control computer 130 is restored.

[0035] Figure 2 This is a flowchart of a fly-by-wire flight control system control surface protection method 200 according to an embodiment of the present invention. The fly-by-wire flight control system control surface protection method 200 can be derived from, as shown in the reference... Figure 1 The described fly-by-wire flight control system or its components (e.g., flight control computer) execute, or may be executed by a device such as a computer, processor, integrated circuit, etc. In one embodiment, the fly-by-wire flight control system control surface protection method 200 can be implemented during pilot flight operations and during automatic flight, such as when the aircraft is in the air.

[0036] In optional step 202, the fly-by-wire flight control system can operate in normal mode. For example, the flight control computer performs closed-loop control law calculations to generate control surface commands and provides complete redundancy management and sensor signal voting.

[0037] In step 204, the control surface status can be detected during flight control system operation. For example, the flight control computer continuously monitors the control status of the aircraft's three-axis control surfaces and determines in real time whether the control surfaces are controllable.

[0038] In step 206, when the flight control system loses control of the control surfaces, it is determined whether the flight control system is below the MAC state. The flight control system has control surface position monitors installed at the control surface locations. The flight control computer receives control surface position sensor signals and compares them with command signals. When there is a difference between the command signal and the control surface position signal, the corresponding control channel is considered faulty and can be isolated. It can also be determined that control over the corresponding control surface has been lost (or partially lost). If multiple control surfaces are lost (e.g., multiple faulty channels), the flight control system may fall below the MAC state, meaning it does not reach the required number of normal control channels for the MAC state.

[0039] In one embodiment, by way of example and not limitation, assume that the Minimum Acceptable Control (MAC) is defined as follows:

[0040] a) Roll axis:

[0041] 1) When all spoilers are unavailable, one aileron on the left and one on the right will actuate.

[0042] The device is available, or;

[0043] 2) When only one pair of spoilers is available, there is one actuator on the left aileron or the right aileron.

[0044] Available.

[0045] b) Pitch axis:

[0046] 1) When the horizontal stabilizer is unavailable, there is one elevator on both the left and right sides.

[0047] An actuator is available, or;

[0048] 2) When the horizontal stabilizer is available, one of the left or right elevators will actuate.

[0049] The device is available.

[0050] c) Yaw axis: Only one rudder actuator is available.

[0051] If the flight control system is not below the MAC state, return to step 202 to continue operating in normal mode, and in step 204, continue to check the control surface status.

[0052] If the flight control system is below the MAC state, then in step 208, the flight control system is degraded from normal mode to direct mode. In direct mode, the actuator electronic control unit uses stick-to-rudder control laws to calculate control surface commands, without providing redundancy management or sensor signal voting. In one embodiment, in response to the flight control system being below the MAC state, all three axes of the aircraft can be put into direct mode.

[0053] In optional step 210, the faulty actuator control channel is reset. Further, after resetting the faulty channel, the status of the control surface can be checked to determine if the channel has returned to normal.

[0054] As an example and not a limitation, the monitor in flight control electronics typically refers to a set of monitoring logic, such as the sum monitoring of side sticks. Each side stick has four pitch signals, or four channels. The monitor compares these four pitch signals. If the difference between any signal and the specified channel exceeds a threshold, the monitor sets that signal as a fault signal, the corresponding channel becomes a fault channel, and the fault signal is set to 1, while the validity signal is set to 0, thus isolating the corresponding signal channel. According to one embodiment of the present invention, when the flight control system falls below the MAC level, the flight control computer can reset the validity signal of the fault channel (e.g., set the validity signal to 1) to allow that channel to participate in the monitoring logic. If the channel remains in a faulty state, it will still be deemed invalid after resetting due to the detected fault. Conversely, if the channel fault disappears, the validity signal will remain valid after resetting, allowing the corresponding channel to participate in normal operation.

[0055] In optional step 212, it can be determined whether the faulty channel has been restored. If the faulty channel remains in a faulty state, the flight control computer can continuously monitor and cyclically reset the faulty channel in step 210.

[0056] If the faulty channel is restored, it can be determined again in step 206 whether the flight control system is still below the MAC state. If the flight control system is still below the MAC state, then in step 208, operation continues in direct mode. Conversely, if the flight control system is at or above the MAC state, the flight control system can be switched from direct mode to normal mode, and the flight control computer will restore the faulty channel and realize control of the control surfaces.

[0057] Taking the yaw axis as an example, the rudder of current mainstream civil aircraft adopts a distributed architecture with three actuators. According to the MAC definition, when only one actuator of the rudder is controllable, it is in MAC state. When the rudder is completely uncontrollable, the system will be below MAC state. According to this invention, the flight control system can enter direct mode. As another example, suppose all RVDTs and value monitors on the pedals detect that all RVDTs are faulty. At this time, the pedal control signal will fail, the rudder surface will be uncontrollable, the system will be below MAC state, and the flight control system can enter direct mode according to this invention. If the RVDT continues to fail, the flight control computer will continuously send RVDT reset signals. If the RVDT fault state disappears, the flight control computer will reset the RVDT to a valid state, restore the pedals' control of the rudder, and cause the system to exit the below MAC state, restoring control of the aircraft's yaw (normal mode).

[0058] Figure 3This is a schematic block diagram of a monitor architecture for rudder surface control according to an embodiment of the present invention.

[0059] The flight control system is equipped with multiple and various types of monitors. When abnormal operating states and faults are detected in the internal and external interfaces of the actuation control electronics (i.e., the actuator electronic control unit), the corresponding actuator control channel of the actuation control electronics will enter a safe state, including invalidating the faulty partition and cutting off communication between the actuators associated with the fault. Figure 3 As shown, multiple and various types of monitors can be set. As an example and not a limitation, a sum value monitor 301 can be set at the input end of the actuator electronic control device, an internal actuator control electronic monitor 302 can be set in the actuator electronic control device, and an actuator system health monitor 303 can be set in the actuator system, etc.

[0060] According to one embodiment of the present invention, when the flight control computer detects that the system is below the minimum acceptable control level, the sum monitor 301, the monitor 302 inside the actuation control electronics, and the monitor 303 of the actuation system can be cyclically detected and reset. The monitors to be reset and the monitoring reset process are as follows:

[0061] a) Sum Value Monitor

[0062] The actuation control electronics can monitor the sum of input signals (e.g., RVDT sensor inputs) of each redundant side stick, foot pedal, and other cockpit control devices. Sensor inputs with sums outside the normal range will be invalidated. Once the sum monitor 301 is triggered, the corresponding control device will lose control of the corresponding control surface.

[0063] When the flight control computer detects that the system is below the minimum acceptable control level, it will issue a reset command to reset the monitor (for example, to enable the validity signal of the corresponding control channel) and enable sensor inputs whose sums are restored to the normal range, in order to restore control of the control surfaces until it is restored to or above the minimum acceptable control level.

[0064] b) Internal monitoring system for actuation control

[0065] The internal monitors of the actuation control electronics include various monitoring functions, such as monitoring the internal power supply, data frame rate synchronization, flight configuration, and direct mode command comparison. As an example, and not a limitation, some monitor reset procedures are as follows:

[0066] 1) Triggering of the internal power supply monitoring and data frame rate synchronization monitor of the actuation control electronics (ACE) can cause the system to lose control of the actuators associated with the ACE. After the monitor is triggered, the ACE will automatically recover. The internal strike counter of the ACE limits the number of self-recovery attempts. According to one embodiment of the present invention, when the flight control computer detects that the system is below the minimum acceptable control level, it can reset the monitor's self-recovery capability to restore the ACE until it recovers to the minimum acceptable control level or higher.

[0067] 2) Triggering of the actuation control electronics (ACC) flight configuration monitor can cause the ACC to lose its direct mode control function, resulting in a direct loss of control over the control surfaces. This is a type of "below MAC". According to one embodiment of the present invention, when the flight control computer detects that the system is below the minimum acceptable control, it may attempt to restore the ACC's direct mode control to restore control over the control surfaces until it is restored to or above the minimum acceptable control.

[0068] 3) A direct mode command comparison monitor triggering will cause the actuation control electronics to lose its direct mode control function, resulting in a direct loss of control over the control surfaces. This is a type of "below MAC". The monitor triggering will automatically restore the actuation control electronics to direct mode, but the internal strike counter of the actuation control electronics limits the number of self-recoveries. According to one embodiment of the present invention, when the flight control computer detects that the system is below the minimum acceptable control, it resets the monitor's self-recovery capability to restore the direct mode control of the actuation control electronics until it recovers to or exceeds the minimum acceptable control.

[0069] c) Actuation system health monitor

[0070] Triggering the actuator health monitor will cause the system to lose control of the corresponding actuator. According to one embodiment of the invention, when the flight control computer detects that the system is below the minimum acceptable control, the system can reset the monitor to restore control of the actuator until it is restored to or above the minimum acceptable control.

[0071] Figure 4 This is a block diagram of a fly-by-wire flight control system control surface protection device 400 according to an embodiment of the present invention. The fly-by-wire flight control system control surface protection device 400 may be provided by, as shown in the reference... Figure 1 The described fly-by-wire flight control system or its components (e.g., flight control computer) can be implemented, or may be implemented by devices such as computers, processors, and integrated circuits. The fly-by-wire flight control system control surface protection device 400 can be integrated into the flight control system 420, or can be implemented separately from the flight control system 420.

[0072] The fly-by-wire flight control system control surface protection device 400 may include, for example, a control surface control status detection module 402, a mode change module 404, a fault monitoring module 406, a fault reset module 408, etc.

[0073] The control surface status detection module 402 can be configured to detect the control surface status during flight control system operation and determine whether the flight control system is below the minimum acceptable control (MAC) state based on the control surface status. The minimum acceptable control (MAC) state includes the flight control actuator redundancy configuration state on the control axes, which include one or more of the roll axis, pitch axis, and yaw axis.

[0074] The mode-changing module 404 can be configured to degrade the flight control system from normal mode to direct mode if the flight control system is below MAC state. In normal mode, the flight control computer generates control surface commands based on the closed-loop control law and sends these commands to the actuator electronic control unit (ECU) to control the corresponding control surfaces. In direct mode, the ECU generates control surface commands based on the stick-to-rudder control law to control the corresponding control surfaces. The closed-loop control law may include redundancy management and sensor signal voting, while the stick-to-rudder control law may not include redundancy management and sensor signal voting.

[0075] The fault monitoring module 406 can be configured to detect fault signals generated by the monitor corresponding to the actuator control channel, the fault signals indicating a fault in the corresponding actuator control channel. The monitor includes one or more of the following: a sum monitor that monitors the sum of input signals from the cockpit control devices; an actuator control electronics internal monitor that monitors signals in the actuator electronic control unit; and an actuator system health monitor that monitors the actuator status of the actuator system.

[0076] The fault reset module 408 can be configured to reset a faulty actuator control channel to detect whether the actuator control channel has returned to normal. Resetting the faulty actuator control channel includes one or more of the following: activating the validity signal generated by the monitor corresponding to the faulty actuator control channel; or resetting the self-recovery capability of the monitor associated with the faulty actuator control channel. By way of example and not limitation, the fault monitoring module 406 and the fault reset module 408 can be implemented separately or in combination.

[0077] In one embodiment, if the actuator control channel returns to normal, the control surface control status detection module 402 can determine whether the flight control system is still below the MAC state. If the flight control system is still below the MAC state, it continues to operate in direct mode. If the flight control system is at or above the MAC state, the mode change module 404 can switch the flight control system from direct mode to normal mode.

[0078] The protection method and apparatus for the minimum controllable control surfaces of the fly-by-wire flight control system according to the present invention have one or more of the following functions:

[0079] a) Automatic degradation: When the system status drops below MAC during flight, the flight control mode is downgraded to direct mode, enabling direct control from stick to rudder.

[0080] b) Self-recovery function: When the system status drops below MAC during flight, the fault monitor is continuously reset in a loop. When the fault disappears, the monitor status is restored, control of the control surfaces is restored, and the system is at or above MAC.

[0081] This invention provides at least one or more of the following advantages:

[0082] a) The system is downgraded to direct mode, enabling direct control from the stick to the rudder. When the system is below MAC, the aircraft is already in extreme danger. At this time, the voting of system signals may further reduce the availability of the aircraft and interfere with the pilot's control of the aircraft. In direct mode, the flight control system does not use system voting signals, and can achieve direct control from cockpit devices to the aircraft control surfaces, improving the pilot's control ability of the aircraft;

[0083] b) According to the safety design requirements of the fly-by-wire flight control system of civil aircraft, the probability that the redundancy configuration of the flight control actuators on each control axis is lower than the "Minimum Acceptable Control (MAC)" should be less than 1E-9 / FH. This method adds a protection mechanism to this safety design state, which is higher than the airworthiness requirements. It can attempt to restore control of the aircraft in the event of a catastrophic failure, increasing the probability that the aircraft can continue to fly and land safely.

[0084] In existing technologies, the protection method for the minimum controllable control surfaces of fly-by-wire flight control systems is a safety design feature of the flight control system and also serves as a last resort in the monitoring and protection mechanism. This invention employs a monitoring mechanism that, when the flight control computer detects that the flight control system state is below the minimum acceptable control level, attempts to restore system control, providing further safety protection.

[0085] The various steps and modules of the methods and apparatus described above can be implemented in hardware, software, or a combination thereof. If implemented in hardware, the various illustrative steps, modules, and circuits described in connection with this disclosure can be implemented or executed using a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic components, hardware components, or any combination thereof. A general-purpose processor can be a processor, microprocessor, controller, microcontroller, or state machine, etc. If implemented in software, the various illustrative steps and modules described in connection with this disclosure can be stored as one or more instructions or codes on a computer-readable medium or transmitted. Software modules implementing the various operations of this disclosure can reside in a storage medium, such as RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, removable disk, CD-ROM, cloud storage, etc. The storage medium can be coupled to a processor so that the processor can read and write information from / to the storage medium and execute corresponding program modules to implement the various steps of this disclosure. Moreover, software-based embodiments can be uploaded, downloaded, or remotely accessed through appropriate communication means. Such appropriate means of communication include, for example, the Internet, the World Wide Web, intranets, software applications, cables (including fiber optic cables), magnetic communication, electromagnetic communication (including RF, microwave and infrared communication), electronic communication, or other such means of communication.

[0086] The numerical values ​​given in the various embodiments are merely examples and are not intended to limit the scope of the invention. In practice, the specific parameters of each component can be appropriately set as needed, and are not limited to the specific values ​​given as examples herein. Furthermore, as a whole, there are other components or steps not listed in the claims or specification of this invention. Moreover, a single name for a component does not preclude other names for that component.

[0087] It should also be noted that these embodiments may be described as processes depicted as flowcharts, flow diagrams, structure diagrams, or block diagrams. Although a flowchart may describe the operations as a sequential process, many of these operations can be executed in parallel or concurrently. Furthermore, the order of these operations can be rearranged.

[0088] The disclosed methods, apparatuses, and systems should not be limited in any way. Rather, this disclosure covers all novel and non-obvious features and aspects of the various disclosed embodiments (individually and in various combinations and sub-combinations of each other). The disclosed methods, apparatuses, and systems are not limited to any particular aspect or feature or combination thereof, and no disclosed embodiment is required to have any one or more specific advantages or to solve any particular or all technical problems.

[0089] This invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other modifications based on the teachings of this invention without departing from the spirit and scope of the claims. All of these modifications are within the scope of protection of this invention.

Claims

1. A method for protecting control surfaces in a fly-by-wire flight control system, characterized in that, include: Monitor the control surface status during flight control system operation; Based on the control surface state, determine whether the flight control system is below the minimum acceptable control MAC state; as well as If the flight control system is below the MAC state, then the flight control system will be downgraded from normal mode to direct mode. In the normal mode, the flight control computer of the flight control system generates control surface commands based on the closed-loop control law and sends the generated control surface commands to the actuator electronic control unit to control the corresponding control surfaces. In the direct mode, the actuator electronic control unit generates rudder surface control commands according to the stick-to-rudder control law to control the corresponding rudder surface; Detect a fault signal generated by the monitor that corresponds to the actuator control channel, the fault signal indicating that the corresponding actuator control channel has malfunctioned; The malfunctioning actuator control channel is reset to check whether it has returned to normal. If the actuator control channel returns to normal, determine whether the flight control system is still below the MAC state; If the flight control system is still below MAC state, continue operating in the direct mode; as well as If the flight control system is in or above MAC state, then the flight control system is switched from the direct mode to the normal mode.

2. The fly-by-wire flight control system control surface protection method as described in claim 1, characterized in that, The monitor includes one or more of the following: The sum monitor monitors the sum of the input signals from the cockpit control devices; An internal monitor for actuation control electronics monitors the signals in the actuator electronic control device; as well as An actuator health monitor monitors the status of the actuators in the actuator system.

3. The fly-by-wire flight control system control surface protection method as described in claim 1, characterized in that, Resetting the control channel of a malfunctioning actuator includes one or more of the following: Set the validity signal generated by the monitor corresponding to the malfunctioning actuator control channel to valid; or Reset the self-recovery capability of the monitor associated with the malfunctioning actuator control channel.

4. The fly-by-wire flight control system control surface protection method as described in claim 1, characterized in that: The minimum acceptable control MAC state includes the flight control actuator redundancy configuration state on the control axis, which includes one or more of the roll axis, pitch axis, and yaw axis.

5. The fly-by-wire flight control system control surface protection method as described in claim 1, characterized in that: The closed-loop control law includes redundancy management and sensor signal voting; and The stick-to-rudder control law does not include redundancy management or sensor signal voting.

6. A control surface protection device for a fly-by-wire flight control system, characterized in that, include: The control surface status detection module is configured to detect the control surface status during flight control system operation and determine, based on the control surface status, whether the flight control system is below the minimum acceptable control MAC state. as well as A mode-changing module is configured to degrade the flight control system from normal mode to direct mode if the flight control system is below the MAC state. In the normal mode, the flight control computer of the flight control system generates control surface commands based on the closed-loop control law and sends the generated control surface commands to the actuator electronic control unit to control the corresponding control surfaces. In the direct mode, the actuator electronic control unit generates rudder surface control commands according to the stick-to-rudder control law to control the corresponding rudder surface; A fault monitoring module is configured to detect fault signals generated by a monitor that correspond to actuator control channels, the fault signals indicating that a fault has occurred in the corresponding actuator control channels; as well as A fault reset module is configured to reset the faulty actuator control channel to detect whether the actuator control channel has returned to normal. If the actuator control channel returns to normal, the control surface control status detection module determines whether the flight control system is still below the MAC state. If the flight control system is still below MAC state, continue operating in the direct mode; as well as If the flight control system is in or above MAC state, the mode change module switches the flight control system from the direct mode to the normal mode.

7. The fly-by-wire flight control system control surface protection device as described in claim 6, characterized in that, The monitor includes one or more of the following: The sum monitor monitors the sum of the input signals from the cockpit control devices; An internal monitor for actuation control electronics monitors the signals in the actuator electronic control device; as well as An actuator health monitor monitors the status of the actuators in the actuator system.

8. The fly-by-wire flight control system control surface protection device as described in claim 6, characterized in that, Resetting the control channel of a malfunctioning actuator includes one or more of the following: Set the validity signal generated by the monitor corresponding to the malfunctioning actuator control channel to valid; or Reset the self-recovery capability of the monitor associated with the malfunctioning actuator control channel.

9. The fly-by-wire flight control system control surface protection device as described in claim 6, characterized in that: The minimum acceptable control MAC state includes the flight control actuator redundancy configuration state on the control axis, which includes one or more of the roll axis, pitch axis, and yaw axis.

10. The fly-by-wire flight control system control surface protection device as described in claim 6, characterized in that: The closed-loop control law includes redundancy management and sensor signal voting; and The stick-to-rudder control law does not include redundancy management or sensor signal voting.

11. A fly-by-wire flight control system, comprising a fly-by-wire flight control system control surface protection device as described in any one of claims 6-10.

Images