High-reliability redundancy control system applied to aircraft electric network system

Abstract

The invention relates to a high-reliability redundancy control system applied to an aircraft electric network system, and belongs to the technical field of aviation power supply control. According to the invention, a dual-redundancy architecture mode of DSP + dual-path FPGA is adopted, dual-redundancy control is realized by using dual-path FPGA chips D1 and D2 as a main control module and a standby control module, and state monitoring of the dual-path FPGA and switching control of main / standby enabling are realized by using a DSP micro-processing chip D3 as a third-party monitoring end. When the system works normally, rapid logic control response can be realized, and competitive output of the dual-redundancy control module is effectively avoided; when any one module or multiple modules break down, the system safety state can be stabilized, and the situation that the bus bar is powered off is avoided. The control system is clear in architecture and simple and reliable in state monitoring and main / standby enabling control logic, and is a dual-redundancy architecture mode with good use and popularization values.

Description

Technical Field

[0001] The invention belongs to the technical field of aviation power supply control, and in particular relates to a high-reliability redundant control system applied to an aircraft electrical network system. Background Art

[0002] The aircraft power grid is generally composed of multiple main buses and multiple power supplies. During operation, the power supply processor needs to switch the aircraft power supply mode according to different working scenarios of the aircraft, realize the power supply conversion between the ground power supply, emergency power supply and main power supply of the aircraft power grid, and realize the connection control and overcurrent protection of the two main buses and the emergency bus; through power supply status analysis, control the power supply status of high-power load equipment on the main bus, realize the reasonable distribution of electric energy, and reduce the risk of power system overload. At the same time, in order to ensure the normal operation of airborne equipment, the power supply grid can achieve a control response time of no more than 10ms when switching the power supply, so as to meet the standard requirement that the power-off time on the aircraft power bus is no more than 50ms.

[0003] Therefore, it is necessary to design a high-reliability redundant control system architecture for the power supply processor, which can simultaneously meet the requirements of rapid response of the aircraft power supply system control logic and extremely high power supply reliability and safety. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] The technical problem to be solved by the present invention is to design a redundant control system according to the power supply reliability and safety requirements of the aircraft power supply system.

[0006] (II) Technical solution

[0007] In order to solve the above technical problems, the present invention provides a high-reliability redundant control system design method for an aircraft electrical network system. The method designs a redundant control system through a dual-redundancy architecture mode of DSP+dual-channel FPGA control module. The dual-channel FPGA control module is a dual-redundancy A and B control module, including a main control module and a backup control module. DSP acts as a third-party monitoring terminal to realize status monitoring of the dual-channel FPGA control module and switching between the main control module and the backup control module.

[0008] The present invention also provides a high-reliability redundant control system designed by the method and applied to an aircraft electrical network system.

[0009] The present invention also provides an aircraft power supply grid designed based on the system.

[0010] (III) Beneficial effects

[0011] The present invention adopts a dual-redundancy architecture mode of DSP+dual-channel FPGA. The dual-channel FPGA chips D1 and D2 are used as the main control module and the backup control module to realize dual redundant control. The DSP microprocessor chip D3 is used as a third-party monitoring terminal to realize the state monitoring of the dual-channel FPGA and the switching control of the main / backup enable. When the system is working normally, it can achieve fast logic control response and effectively avoid the competition output of the dual-redundancy control module; when any module or multiple modules fail, it can stabilize in the system safety state to avoid the occurrence of bus power failure. This control system has a clear architecture, and the state monitoring and main / backup enable control logic are simple and reliable. It is a dual-redundancy architecture mode with great use and promotion value. The system has been applied in the control system circuit of a certain type of aircraft power supply processor, with good control effect, stable system operation, high reliability, and great promotion value. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a schematic diagram of the redundant control system architecture designed by the present invention and applied to a power supply processor. DETAILED DESCRIPTION

[0013] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0014] The present invention proposes a high-reliability redundant control system applied to an aircraft electrical network system. It is a redundant control design method proposed based on the aircraft power supply system's requirements for power supply reliability and safety. Its goals are to, first, increase the power supply control redundancy; second, minimize the serious damage to the system caused by controller failure. The core point is that the aircraft bus bar cannot be powered off.

[0015] The power supply grid of a twin-engine aircraft generally consists of one emergency bus and two main buses; the corresponding power supplies are one emergency power supply (main battery) and two main power supplies. In addition, the aircraft is generally powered by the airport ground power supply on the ground. The power supply processor is the power control center of the electrical subsystem. It is responsible for realizing the power supply conversion between the ground power supply, emergency power supply and two main power supplies of the aircraft power grid according to different working scenarios of the aircraft, and realizing the connection control and overcurrent protection of the two main buses and the emergency bus; through power supply status analysis, it controls the power supply of high-power load equipment on the main bus, realizes the reasonable distribution of electric energy, and reduces the overload risk of the power supply system. Therefore, it is necessary to design a high-reliability redundant control system architecture for the power supply processor to meet the extremely high power supply reliability and safety requirements of the aircraft power supply system.

[0016] The factors involved in different working scenarios of the aircraft include: power switch, power network contactor status, engine speed, power supply and bus voltage and other information, which are mainly discrete, analog and frequency signals. The control system needs to consider the characteristics of signal acquisition; in addition, the conversion control response time of the aircraft power system should ensure that the power-off time on the power bus is no more than 50ms (of which the contactor connection time in the aircraft power grid is no more than 35ms), and the power supply processor should ensure that its internal control response time is no more than 10ms. The control system architecture design needs to start from the above two requirements, meet the signal acquisition accuracy, and realize fast signal acquisition and fast response of control logic.

[0017] The present invention realizes a redundant control system architecture through a dual-redundancy architecture mode of DSP+dual-channel FPGA, the dual-channel FPGA is a dual-redundancy A and B control channel, FPGA1 is a main control module, FPGA2 is a standby control module, and DSP is a third-party monitoring terminal to realize state monitoring of the dual-channel FPGA and switching of the main / standby enable. When the control module switches control, the state change of the control signal output circuit is not allowed to occur.

[0018] FPGA is a hardware logic circuit with a response time of ns. Using FPGA as a control module can achieve fast response of system power supply control and meet the control response requirement of no more than 10ms. DSP, as a third-party monitoring terminal, can monitor the working status of the two control modules through status acquisition, and realize the enable control of the main / standby control modules through two GPIOs. At the same time, it can execute other functions unrelated to power network control, such as serial bus communication.

[0019] The present invention provides a high-reliability redundant control system architecture applied to an aircraft electrical network system, comprising three parts: dual-channel FPGA control modules D1 and D2 and a third-party monitoring end DSP microprocessor chip D3; D1 and D2 respectively implement main control and backup control, the main control module D1 enjoys control priority, and the backup control module D2 implements dual-redundancy power supply control in a hot backup manner; D3, as a third-party monitoring end, implements status monitoring of the dual-channel FPGA control module and switching of main / backup enable.

[0020] The third-party monitoring terminal D3 is connected to the GPIO ports of the dual-channel FPGA control modules D1 and D2 respectively through the two GPIO ports "GPIO1 and GPIO2", so as to realize the master / standby enable switching control of the dual-channel FPGA control modules D1 and D2 by D3. When the status of the two GPIO ports is "01", D1 is valid, and when the status of the two GPIO ports is "10", D2 is valid. In other states, D1 and D2 are invalid. D1 and D2 respectively collect the status of the two GPIO ports and work according to the collection results.

[0021] The third-party monitoring terminal D3 is also connected to the GPIO ports of the FPGA control modules D1 and D2 through two GPIO ports "XT-A and XT-B", XT-A is the heartbeat signal of the control module D1, and XT-B is the heartbeat signal of the control module D2. D3 realizes real-time monitoring of the working status of D1 and D2 by collecting the status of "XT-A and XT-B"; when D1 fails, D3 switches the output status of the enable signal "GPIO1 and GPIO2" to enable D2 to work; when both D1 and D2 fail, D3 switches the output status of the enable signal "GPIO1 and GPIO2" to make the two FPGA control modules D1 and D2 not work. At this time, the aircraft electrical network system is in a state where the main generator and the battery are both online.

[0022] The third-party monitoring terminal D3 is also connected to the two FPGA control modules D1 and D2 through the chip select enable CS pin, read and write enable RE and WE pins, and the data bus D[15:0] and the address bus A[21:0]; the two FPGA control modules D1 and D2 respectively collect information such as the system power supply switch, the aircraft electrical network system contactor status, the engine speed, the power supplies and the bus voltage, and send the collected information and the logic control results to D3, which realizes the unified sorting and reporting of the system working status.

[0023] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments:

[0024] 1) Third-party monitoring end DSP microprocessor chip D3

[0025] D3 is designed with DSP microprocessor chip JDSPF28335, and the 17th and 19th pins of the chip are selected as the output pins of "GPIO1 and GPIO2", and the 62nd and 63rd pins are used as the input pins of monitoring the heartbeat signals "XT-A and XT-B" respectively sent by D1 and D2. Due to the pin multiplexing of DSP chip, it is necessary to set the 17th, 19th, 62nd and 63rd pins as the ordinary GPIO port functions first.

[0026] 2) Dual FPGA control modules D1 and D2

[0027] The dual-redundancy control module includes a main control module D1 and a backup control module D2. D1 and D2 are FPGA chips SMQ2V1000. Two IO ports are selected as input ends, which are respectively connected to the 17th and 19th pins "GPIO1 and GPIO2" of chip D3; D1 selects one IO port to connect to the 62nd pin of chip D3 as the heartbeat signal output pin of the main control module D1, and D2 selects one IO port to connect to the 63rd pin of chip D3 as the heartbeat signal output pin of the backup control module D2.

[0028] 3) Data and control pins

[0029] DSP chip D3 realizes data communication with two FPGA chips D1 and D2 through chip select enable CS pin, read / write enable RE and WE pins, data bus D[15:0], and address bus A[21:0]. The two FPGA chips D1 and D2 respectively collect information such as system power supply switch, power network contactor status, engine speed, power supply and bus voltage, and send the above corresponding information and logic control results to DSP chip D3, which realizes unified sorting and reporting of system working status.

[0030] During the power-on process of the power supply processor, since the GPIO port status of the DSP chip D3 is "11 or 00", the two FPGA control modules D1 and D2 will not output control signals, which can ensure the stability of the system power-on process.

[0031] After the DSP chip D3 is powered on and works stably, the control module D1 is enabled by default, and the heartbeat signals "XT-A and XT-B" emitted by D1 and D2 are monitored in real time to monitor the working status of D1 and D2. When D1 fails, D3 switches the output state of the enable signal "GPIO1 and GPIO2" to enable D2 to work.

[0032] After the power supply processor is powered on, when both control modules D1 and D2 fail, D3 controls the two GPIO ports "GPIO1 and GPIO2" to non-"01" and "10" states. At this time, the two FPGA control modules D1 and D2 are prohibited from outputting control signals. The system state is the same as when the power supply processor is not powered on. At this time, the two main generators and main batteries can be normally connected to the grid through the normally closed contact control of the power supply processor, avoiding bus power failure.

[0033] When the DSP chip D3 fails, the two GPIO ports "GPIO1 and GPIO2" cannot be controlled to "01" or "10" status. At this time, the two FPGA control modules D1 and D2 cannot output control signals. The system status is the same as when the power supply processor is not powered on. At this time, the two main generators and main batteries can be normally connected to the grid through the normally closed contact control of the power supply processor, avoiding bus power outages.

[0034] When the redundant control system of the power supply processor fails, the system failure mode can be locked, so that the aircraft power supply system can be in a system-controllable safe state. The aircraft power supply system sets the system safety state as the two main generators and the main battery should remain in the grid state, that is, the three contactors in the grid need to remain connected. For this design, the control signal of the three contactors in the power supply processor uses the normally closed contact output of the relay, which can ensure that the two main engines and batteries are in the grid when the power supply processor is not powered on.

[0035] Therefore, under this architecture, the enable pin states of the dual-channel FPGA are mutually exclusive, which can effectively avoid the phenomenon of competition control between the dual-channel FPGA. When any one or more of D1, D2, and D3 in the redundant control system fails, the system can be controlled in a safe state, greatly improving system security.

[0036] The dual-redundant control system architecture is a triangle mode with clear architecture, simple and reliable status monitoring and master / slave enabling control logic; it can achieve:

[0037] 1. Fast control response, logic response time in ns level, drive output in ms level;

[0038] 2. The enable pin states of the main and standby control modules are mutually exclusive to avoid competition between the dual control modules;

[0039] 3. In conjunction with the aircraft power grid safety state design, the power-on process and the state in any fault mode can be controlled, with extremely high system safety.

[0040] This dual-redundant control system architecture is highly versatile. The entire architecture design and chip selection are suitable for various onboard system control modules and have great promotion value.

[0041] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A high reliability redundant control system design method for aircraft electrical network system, characterized in that: This method designs a redundant control system through a dual-redundancy architecture mode of DSP+dual-channel FPGA control module. The dual-channel FPGA control module is a dual-redundancy A and B control module, including a main control module and a backup control module. DSP acts as a third-party monitoring terminal to realize status monitoring of the dual-channel FPGA control module and switching between the main control module and the backup control module.

2. The method according to claim 1, characterized in that The system is specifically designed to include three parts: dual-channel FPGA control modules D1 and D2 and a third-party monitoring end DSP microprocessor chip D3; among them, D1 and D2 respectively realize the main control and backup control, the main control module D1 enjoys control priority, and the backup control module D2 realizes dual redundant power supply control in a hot backup manner; D3, as a third-party monitoring end, realizes the status monitoring of the dual-channel FPGA control module and the switching of the enablement of the main control module and the backup control module.

3. The method according to claim 2, characterized in that The third-party monitoring terminal D3 is connected to the GPIO ports of the dual-channel FPGA control modules D1 and D2 through two GPIO ports "GPIO1 and GPIO2" respectively, so as to realize the master / standby enable switching control of the dual-channel FPGA control modules D1 and D2 by D3. When the status of the two GPIO ports is "01", D1 is valid, and when the status of the two GPIO ports is "10", D2 is valid. In other states, both D1 and D2 are invalid. D1 and D2 respectively collect the status of the two GPIO ports and work according to the collection results; The third-party monitoring terminal D3 is also connected to the GPIO ports of the FPGA control modules D1 and D2 through two GPIO ports "XT-A and XT-B", XT-A is the heartbeat signal of the control module D1, and XT-B is the heartbeat signal of the control module D2. D3 realizes real-time monitoring of the working status of D1 and D2 by collecting the status of "XT-A and XT-B"; when D1 fails, D3 switches the output status of the enable signal "GPIO1 and GPIO2" to enable D2 to work; when both D1 and D2 fail, D3 switches the output status of the enable signal "GPIO1 and GPIO2" to make the two FPGA control modules D1 and D2 not work, and at this time the aircraft electrical network system is in a state where the main generator and the battery are both online; The third-party monitoring terminal D3 is also connected to the two FPGA control modules D1 and D2 through the chip select enable CS pin, read and write enable RE and WE pins, and the data bus D[15:0] and the address bus A[21:0]; the two FPGA control modules D1 and D2 respectively collect information such as the system power supply switch, the aircraft electrical network system contactor status, the engine speed, the power supplies and the bus voltage, and send the collected information and the logic control results to D3, which realizes the reporting of the system working status information.

4. The method according to claim 3, characterized in that D3 is designed with DSP microprocessor chip JDSPF28335, and the 17th and 19th pins of the chip are selected as the output pins of "GPIO1 and GPIO2", and the 62nd and 63rd pins are selected as the input pins for monitoring the heartbeat signals "XT-A and XT-B" respectively emitted by D1 and D2; D3 realizes data communication with D1 and D2 through the chip select enable CS pin, read and write enable RE and WE pins, and data bus D[15:0] and address bus A[21:0].

5. The method according to claim 4, characterized in that The main control module D1 and the backup control module D2, D1 and D2 are FPGA chips SMQ2V1000, each selects two IO ports to be set as the input end, and respectively connects the 17th and 19th pins of D3 "GPIO1 and GPIO2"; D1 selects one IO port to connect to the 62nd pin of chip D3 as the heartbeat signal output pin of the main control module D1, and D2 selects one IO port to connect to the 63rd pin of chip D3 as the heartbeat signal output pin of the backup control module D2.

6. The method according to claim 5, characterized in that During the power-on process of the power supply processor, the GPIO port status of D3 is "11 or 00". At this time, D1 and D2 will not output control signals to ensure the stability of the system power-on process. After the DSP chip D3 is powered on and works stably, the default selection control module D1 works and monitors the heartbeat signals "XT-A and XT-B" sent by D1 and D2 respectively in real time. After the power supply processor is powered on, when both D1 and D2 fail, D3 controls the two GPIO ports "GPIO1 and GPIO2" to non-"01" and "10" states. At this time, the two FPGA control modules D1 and D2 are prohibited from outputting control signals. The system state is the same as when the power supply processor is not powered on. At this time, the two main generators and main batteries can be normally connected to the grid through the normally closed contact control of the power supply processor; When the DSP chip D3 fails, the two GPIO ports "GPIO1 and GPIO2" cannot be controlled to "01" or "10" status. At this time, the two FPGA control modules D1 and D2 cannot output control signals. The system status is the same as when the power supply processor is not powered on. At this time, the two main generators and main batteries can be normally connected to the grid through the normally closed contact control of the power supply processor.

7. The method according to claim 1, characterized in that As a third-party monitoring terminal, DSP monitors the working status of the two control modules through status acquisition, and enables control of the main control module and the standby control module through two GPIOs.

8. The method according to claim 1, characterized in that The DSP also performs functions not related to electrical network control, including serial bus communications.

9. A high reliability redundant control system designed by the method according to any one of claims 1 to 8 and applied to an aircraft electrical network system.

10. An aircraft power supply grid based on the system design according to claim 9.

Images