More electric aircraft DC power supply high voltage GCU dual backup arbitration system

Abstract

The present invention relates to the field of aviation technology, and discloses a dual-backup arbitration system for a DC power supply high-voltage GCU of a multi-electric aircraft, including a pulse missing detection module, an I / O state detection module, an arbitration control logic module and a redundant switching circuit module; the pulse missing detection module is used to generate a timing pulse using a 555 timer, and detect whether the pulse signal output by the 555 timer is continuous; the I / O state detection module is used to detect the level state of the I / O port in real time, and judge whether it is a low level, a high level or a high impedance state; the arbitration control logic module is used to process the I / O port state data using a gate circuit, and decide to use a main microprocessor or a backup microprocessor; the redundant switching circuit module is used to automatically switch to the backup microprocessor when a main microprocessor fails according to the arbitration control logic. The present invention has the advantage of high reliability.

Description

Technical Field

[0001] The present invention relates to the field of aviation technology, in particular to a dual-backup arbitration system for a DC power supply high-voltage GCU of a multi-electric aircraft. Background Art

[0002] The aircraft's generator controller (GCU) is the core control and protection device of the AC generator. It can realize intelligent regulation and monitoring of the power supply during flight to ensure normal power supply and provide high-quality power. The GCU is crucial to the normal and reliable operation of the generator. It can not only stabilize the power output, but also protect the generator from electrical faults such as overload and short circuit, thereby ensuring the stable operation of many electronic equipment on the aircraft. The GCU must be inspected and maintained regularly to timely discover and deal with potential fault hazards, thereby ensuring the continuous and reliable operation of the generator controller and meeting the power supply needs of airborne equipment.

[0003] However, in the dual redundant system, the GCU microprocessor control system faces the problem of arbitration switching. The microprocessor needs to arbitrate between the main and standby systems to determine the priority of the current working microprocessor to ensure the effectiveness and reliability of the redundant design. However, in actual operation, the microprocessor I / O port may be abnormal, resulting in redundancy disorder, which in turn affects the normal operation of the power supply system. Therefore, it is necessary to design a high-reliability multi-electric aircraft DC power supply high-voltage GCU dual backup arbitration system. Summary of the invention

[0004] In view of the deficiencies in the prior art, the present invention provides a multi-electric aircraft DC power supply high-voltage GCU dual backup arbitration system, which has the advantage of high reliability and solves the problems in the above-mentioned background technology.

[0005] In order to achieve the above-mentioned high reliability purpose, the present invention provides the following technical solutions: a dual-backup arbitration system for a DC power supply high-voltage GCU of a multi-electric aircraft, including a pulse missing detection module, an I / O state detection module, an arbitration control logic module, and a redundant switching circuit module;

[0006] The pulse missing detection module is used to generate a timing pulse using a 555 timer and detect whether the pulse signal output by the 555 timer is continuous;

[0007] Preferably, the pulse missing detection module further includes using a 555 timer set to a monostable mode or a Schmitt trigger mode to generate a timing pulse signal of a specific frequency and width, connecting the output of the 555 timer to a pulse monitoring circuit, using a D flip-flop to capture the output state change of the 555 timer, the clock input of the D flip-flop is connected to the pulse signal, setting a timer to monitor the continuity of the pulse signal, and if the number of pulses received within the set time is less than a predetermined number, it is considered that a pulse missing has occurred.

[0008] The I / O state detection module is used to detect the level state of the I / O port in real time and determine whether it is a low level, a high level or a high impedance state;

[0009] The arbitration control logic module is used to process the I / O port status data using gate circuits to determine whether to use the main microprocessor or the standby microprocessor;

[0010] Preferably, the arbitration control logic module is responsible for evaluating the signals from each detection module, making decisions according to preset rules, and evaluating the operating status of each microprocessor.

[0011] The redundant switching circuit module is used to automatically switch to the standby microprocessor when a main microprocessor fails according to arbitration control logic.

[0012] Preferably, the redundant switching circuit module further includes determining the probability of failure through pulses and IO states, and comparing the probability of failure with a corresponding threshold to determine whether to perform a switching operation, and using an evaluation model constructed by a Logistic regression analysis method to perform an overall risk evaluation on arbitration control;

[0013] The exponential equation of Logistic is: ,

[0014] In the formula, is the probability of failure occurring, Is the pulse continuous or not, Is the I / O at a low level? Is the I / O high level? Is the I / O in high impedance state? , , , is the regression coefficient of each variable, and b is a constant term.

[0015] When it is determined that a switch operation is to be performed, the arbitration control logic module begins to evaluate the priority of the redundancy strategy, selects the corresponding mode switch according to the priority, sets multiple core indicators, and defines scoring rules for each indicator. The indicators include reliability requirements, tolerance for downtime, performance requirements, mission criticality, and resource utilization. The indicators may have different priority weights. The priority weights are determined through the hierarchical analysis method:

[0016] Calculate the total score S:

[0017] In the formula, , , , , is the weight, R is the reliability requirement score, T is the downtime tolerance score, P is the performance requirement score, K is the mission criticality score, and U is the resource utilization score.

[0018] A dual backup arbitration method for a DC power supply high voltage GCU of a multi-electric aircraft includes the following steps:

[0019] S1: Select 555 timer as the core component of pulse missing detection, and connect the output pulse signal of GCU to the trigger end of 555 timer;

[0020] S2: Use gate circuits to monitor the state of the I / O port, distinguish between low level, high level and high impedance states, and design a monitoring circuit for each state;

[0021] Preferably, the S2 further comprises a low level state monitoring circuit: using a NOT gate and a comparator, the I / O port signal is connected to the input of the NOT gate, the output of the NOT gate is connected to the input of the comparator, when the I / O port signal is at a low level, the output of the NOT gate is at a high level, and the comparator detects a high level, indicating that the I / O port is in a low level state;

[0022] High level state monitoring circuit: Use an AND gate and a comparator, connect the I / O port signal to one input of the AND gate, connect the other input to a positive voltage, and connect the AND gate output to the comparator input. When the I / O port signal is high level, the AND gate output is high level, and the comparator detects the high level, indicating that the I / O port is in a high level state.

[0023] High-impedance state monitoring circuit: Use an operational amplifier configured as a comparator and combine it with a resistor divider network. The I / O port signal is connected to the non-inverting input of the operational amplifier through a high-impedance resistor, and the inverting input is grounded. In the high-impedance state, the output of the operational amplifier will be uncertain. Set a fault threshold. When the I / O port is in a high-impedance state, the output of the operational amplifier will remain at a low level. Connect the output of the operational amplifier to the subsequent logic circuit to indicate the high-impedance state.

[0024] S3: Use gate circuits and discrete devices to build arbitration control logic and design logic circuits according to preset priority weights;

[0025] S4: Use a trigger to lock the detected level signal and design a switching circuit to switch to the backup system when the main system fails.

[0026] Preferably, S4 further includes using a D flip-flop to lock the level signal, connecting the signal to be detected to the D input of the flip-flop, the clock signal is generated by a timer or other event trigger, and the output Q is used to control the switching circuit. When Q is at a high level, it indicates that the main system is working normally; when Q is at a low level, it indicates that it is necessary to switch to the backup system;

[0027] Use a comparator or voltage monitoring circuit to detect the status of the main system and set a fault threshold. When the voltage is lower than this value, it indicates that the main system has failed. The output of the comparator is connected to the reset input of the trigger.

[0028] A multiplexer or relay is used to realize signal switching. The outputs of the main system and the backup system are connected to the input of the multiplexer. The selection signal of the multiplexer is controlled according to the output of the trigger. When the trigger is locked, the selection signal is output to the main system. When the main system fails, the selection signal is switched to the backup system output.

[0029] Compared with the prior art, the present invention provides a multi-electric aircraft DC power supply high voltage GCU dual backup arbitration system, which has the following beneficial effects:

[0030] 1. Use the trigger to lock the detected level signal and design the switching circuit to switch to the backup system when the main system fails. This ensures that when the main system fails, it can reliably switch to the backup system, thereby achieving reliable operation of GCU voltage regulation dual backup and improving the reliability of the entire system.

[0031] 2. The redundant switching circuit module automatically identifies different failure modes by setting thresholds and conditions, determines multiple redundancy strategies, and sets priorities for each strategy. It can adapt to various failure modes in real time without human intervention and intelligently switch between multiple redundancy strategies.

[0032] 3. Design fault switching logic, combine thresholds to judge main system faults, define multi-level thresholds, combine threshold judgment with fault tree analysis, implement threshold monitoring, and trigger the corresponding nodes in the fault tree when the main system parameters exceed the threshold. Through fault tree analysis, identify the cause of the fault, and formulate corresponding response measures based on the results of the fault tree analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a schematic diagram of the structure of the present invention;

[0034] Figure 2 Schematic diagram of the method of the present invention. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] The present invention provides a technical solution: a dual-backup arbitration system for a DC power supply high-voltage GCU of a multi-electric aircraft, including a pulse missing detection module, an I / O state detection module, an arbitration control logic module, and a redundant switching circuit module;

[0037] The pulse missing detection module is used to generate timing pulses using the 555 timer and detect whether the pulse signal output by the 555 timer is continuous;

[0038] The I / O status detection module is used to detect the level status of the I / O port in real time and determine whether it is low level, high level or high impedance state;

[0039] The arbitration control logic module is used to process the I / O port status data using gate circuits to decide whether to use the main microprocessor or the backup microprocessor;

[0040] The redundant switching circuit module is used to automatically switch to the backup microprocessor when a main microprocessor fails according to arbitration control logic;

[0041] Design the fault switching logic, combine the threshold to judge the main system fault, define multi-level thresholds, evaluate the thresholds and system status, combine the threshold judgment with the fault tree analysis, implement threshold monitoring, and trigger the corresponding node in the fault tree when the main system parameters exceed the threshold, including the following steps:

[0042] Use sensors to obtain main system parameters, transmit data to the real-time monitoring system, make threshold judgments, use graphical modeling tools to build a fault tree, and define the mapping relationship between each node and threshold monitoring. When the threshold is exceeded, a trigger is used to activate the corresponding fault tree node.

[0043] The logic of using sensors to obtain the main system parameters and dividing the system into normal operation and abnormal operation according to the main system parameter values ​​is as follows:

[0044] Obtain the parameter value of the main system, and then compare it with the preset operating status division threshold. If the system parameter value is equal to the preset operating status division threshold, the system is classified as a normal operating state. If the system parameter value exceeds or is lower than the preset operating status division threshold, the system is classified as an abnormal operating state.

[0045] Identify the causes of failures, including hardware failures and software errors, through fault tree analysis;

[0046] Identify hardware failures: For each basic event, set the corresponding threshold judgment. Verify the accuracy of the threshold judgment through simulation or actual testing. If the threshold judgment is inaccurate, adjust the threshold or re-analyze the fault tree. Combine statistical analysis methods and establish a feedback loop to form a dynamic threshold adjustment process. Adjust the threshold based on feedback results and statistical analysis, and update the judgment logic. Adjust the warning threshold range and fault threshold according to load and environmental changes to solve the false alarm or missed alarm caused by fixed thresholds. Set the maximum amplitude of threshold adjustment. The threshold after each adjustment cannot be more than 10% larger or smaller than the original one.

[0047] Identify software errors: Analyze the operating status of the software system based on the threshold judgment results, and formulate corresponding countermeasures based on the fault tree analysis results.

[0048] The redundant switching circuit module automatically identifies different failure modes by setting thresholds and conditions, determines multiple redundant strategies, and sets priorities for each strategy, including:

[0049] 1. Fault mode identification includes:

[0050] Setting monitoring parameters

[0051] Temperature monitoring: Set the normal operating temperature range, for example, 0℃ to 70℃.

[0052] Voltage monitoring: Set the voltage range, for example, 5V±10%.

[0053] I / O status monitoring: monitors the logical status of the signal.

[0054] The present invention adopts the evaluation model constructed by Logistic regression analysis method to conduct overall risk evaluation of arbitration control;

[0055] The exponential equation of the Logistic of the present invention is: ,

[0056] In the formula, is the probability of failure occurring, Is the pulse continuous or not, Is the I / O at a low level? Is the I / O high level? Is the I / O in high impedance state? , , , is the regression coefficient of each variable, and b is a constant term.

[0057] The fault risk assessment quantitative model used in arbitration control of the present invention is composed of four logical factors: one is the index, that is, the risk factor used in arbitration control; the second is the weight of these indexes, that is, the proportion of each risk factor in arbitration control; the third is the operation equation, that is, through what kind of mathematical operation process to obtain the risk result; the fourth is the risk result, that is, the result obtained by calculating the indexes with their respective weights through the operation equation. The steps of constructing the risk level assessment quantitative model during arbitration control include four steps: first, the various evaluation factors collected in the sample are converted and processed into a data language that can be recognized by computer software; second, these evaluation factors are subjected to Logistic regression analysis using SPSS software to screen out factors and their weights that have important correlation with the results; third, the evaluation factors and weights are substituted into the Logistic regression equation for operation to obtain the result; finally, the risk level is defined according to actual needs to determine whether there is a need for prompt alarm.

[0058] Set a preset threshold, depending on the actual application scenario. You can define:

[0059] Low failure probability threshold: When the failure probability is lower than this threshold, the system is considered to be working properly.

[0060] High failure probability threshold: When the failure probability exceeds this threshold, the system is considered to be in a serious failure state and a switching operation must be performed immediately.

[0061] Intermediate transition zone: If the failure probability is between the low threshold and the high threshold, different redundancy strategies can be selected, such as degraded operation or partial failover.

[0062] Compare the calculated failure probability with the preset threshold. Determine the switching action to be taken based on the comparison result:

[0063] If the failure probability is lower than the low threshold: the system is considered normal and no switching action is performed.

[0064] If the failure probability is greater than the high threshold: perform a full switchover action to the backup system.

[0065] If the failure probability is between the low threshold and the high threshold: select degradation operation or partial switch based on demand.

[0066] 2. Redundancy strategy definition

[0067] a. Redundancy strategy type

[0068] Active-backup mode: When the system requires high reliability and the fault recovery time is very fast. In this mode, the main microprocessor is always working and the backup microprocessor is in standby state.

[0069] Advantages: Once the main microprocessor fails, it can quickly switch to the backup microprocessor, reducing system downtime.

[0070] Disadvantage: The spare processors are idle and resource utilization is low.

[0071] Load balancing mode: When the system requires high performance and the task load is large, the active and standby microprocessors share the task and the load is dynamically distributed as needed.

[0072] Advantages: The two processors jointly process tasks, improving resource utilization and avoiding performance bottlenecks caused by excessive load on a single microprocessor.

[0073] Disadvantages: When a microprocessor fails, recovery time is longer and load transfer may not be as efficient as other modes.

[0074] Failover mode: When the system has moderate requirements for fault recovery time and can tolerate a certain amount of downtime, failover mode is a suitable choice.

[0075] Advantages: Ensures that the system can smoothly switch to the backup processor when a failure occurs, ensuring system reliability.

[0076] Disadvantages: Failure recovery takes a long time, and there may be downtime or performance degradation during the recovery process.

[0077] b. Priority settings, from high to low:

[0078] High priority: Failover mode ensures that the system switches quickly in case of failure, ensuring minimal downtime;

[0079] Priority Medium: Active-backup mode, suitable for systems with high reliability requirements.

[0080] Low priority: Load balancing mode, suitable for systems with high performance requirements, but the fault recovery time is longer.

[0081] The setting of priority rules can be determined by the following quantitative means, mainly based on the system's reliability requirements, tolerance for downtime, performance requirements, etc. to determine the priority of the redundancy strategy.

[0082] Priority High: Failover Mode

[0083] Priority judgment criteria: If the system's failure recovery time requirement is less than a certain threshold and the tolerated downtime is very small, the failover mode can be set to high priority.

[0084] Priority Medium: Active-Backup Mode

[0085] Priority judgment criteria: When the tolerable downtime and fault recovery time do not need to be extremely fast, for example, within 10 seconds, you can choose the active-backup mode.

[0086] Low priority: load balancing mode

[0087] Priority judgment criteria: If the system performance requirement is the most important indicator and longer downtime is tolerated, then the load balancing mode is the lowest priority option.

[0088] To quantify the priority of different redundancy strategies, a comprehensive scoring model can be used, combining the following factors:

[0089] 1. Reliability Requirements Scoring

[0090] 0-10 points: The score based on the system's reliability requirements. A higher score means that the system has higher requirements for availability and is more inclined to choose failover mode.

[0091] 2. Tolerate downtime

[0092] 0-10 points: Evaluate the downtime that the system can tolerate. The lower the score, the lower the tolerance of the system to downtime, and the more inclined to choose failover mode.

[0093] 3. Performance requirements

[0094] 0-10 points: Evaluate the system's performance requirements. A higher score means the system requires higher performance and is more likely to choose a load balancing mode.

[0095] 4. Mission Criticality

[0096] 0-10 points: Evaluate the importance of the task. The more important the task, the more likely you are to choose failover mode.

[0097] 5. Resource Utilization

[0098] 0-10 points: Evaluate the utilization of redundant resources and whether the spare microprocessor resources are effectively utilized. If the resource utilization rate is high, the load balancing mode is preferred.

[0099] Different indicators may have different weights on priorities, and the weights are determined by the hierarchical analysis method. , assuming: (Reliability requirement): 0.4, (Tolerance downtime): 0.3, (Performance requirement): 0.25, (mission criticality): 0.2, (Resource utilization):0.1.

[0100] Calculate the total score S:

[0101] Where R is the reliability requirement score, T is the tolerance downtime score, P is the performance requirement score, K is the mission criticality score, and U is the resource utilization score.

[0102] According to the total score S, prioritize:

[0103] 7≤S≤10: High priority, failover mode.

[0104] 4≤S<7: Medium priority, active-backup mode.

[0105] 0≤S<4: low priority, load balancing mode.

[0106] A dual backup arbitration method for a DC power supply high voltage GCU of a multi-electric aircraft includes the following steps:

[0107] S1: Select 555 timer as the core component of pulse missing detection, and connect the output pulse signal of GCU to the trigger end of 555 timer;

[0108] S2: Use gate circuits to monitor the state of the I / O port, distinguish between low level, high level and high impedance states, and design a monitoring circuit for each state;

[0109] S3: Use gate circuits and discrete devices to build arbitration control logic and design logic circuits according to preset priority weights;

[0110] S4: Use a trigger to lock the detected level signal and design a switching circuit to switch to the backup system when the main system fails.

[0111] The implementation steps in the above S4 include:

[0112] 1. Configure the clock signal: set the frequency of the clock signal to ensure that the D flip-flop can work stably.

[0113] 2. Set the comparator: Adjust the comparator threshold to ensure it can accurately detect failures in the primary system.

[0114] 3. Test and Verify: First test the operation of the main system under normal conditions to ensure that the multiplexer can normally select the main system output; simulate a main system failure, such as reducing the voltage or powering off, observe the output status of the trigger, and confirm whether it automatically switches to the backup system.

[0115] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0116] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. The multi-electric aircraft DC power supply high voltage GCU dual backup arbitration system is characterized by: It includes a pulse missing detection module, an I / O state detection module, an arbitration control logic module and a redundant switching circuit module; The pulse missing detection module is used to generate timing pulses using a 555 timer and detect whether the pulse signal output by the 555 timer is continuous. The output of this module will serve as the input of the arbitration control logic module to determine whether the main microprocessor is working normally. The I / O state detection module is used to detect the level state of the I / O port in real time, determine whether it is low level, high level or high impedance state, and provide I / O port state data for processing by the arbitration control logic module; The arbitration control logic module is used to process the I / O port status data using the gate circuit, decide to use the main microprocessor or the backup microprocessor, decide whether to switch to the backup microprocessor according to the detected signal, and control the action of the redundant switching circuit module; The redundant switching circuit module is used to automatically switch to the backup microprocessor when the main microprocessor fails according to the arbitration control logic, and receives the control signal of the arbitration control logic module; The arbitration control logic module includes determining the fault probability through pulse and IO status, and comparing the probability of fault occurrence with the corresponding threshold to determine whether to perform a switching operation, and using the evaluation model constructed by the Logistic regression analysis method to perform an overall risk assessment on the arbitration control; The exponential equation of Logistic is: , In the formula, is the probability of failure occurring, Is the pulse continuous or not, Is the I / O at a low level? Is the I / O high level? Is the I / O in high impedance state? , , , is the regression coefficient of each variable, b is the constant term; When it is determined that a switch operation is to be performed, the arbitration control logic module begins to evaluate the priority of the redundancy strategy, selects the corresponding mode switch according to the priority, sets multiple core indicators, and defines scoring rules for each indicator. The indicators include reliability requirements, tolerance for downtime, performance requirements, mission criticality, and resource utilization. The indicators may have different priority weights. The priority weights are determined through the hierarchical analysis method: Calculate the total score S: In the formula, , , , , They are reliability requirement weight, downtime tolerance weight, performance requirement weight, mission criticality weight, and resource utilization weight. R is the reliability requirement score, T is the downtime tolerance score, P is the performance requirement score, K is the mission criticality score, and U is the resource utilization score.

2. The multi-electric aircraft DC power supply high voltage GCU dual backup arbitration system according to claim 1 is characterized in that: The pulse missing detection module further includes using a 555 timer set to a monostable mode or a Schmitt trigger mode to generate a timing pulse signal of a specific frequency and width, connecting the output of the 555 timer to a pulse monitoring circuit, using a D flip-flop to capture the output state change of the 555 timer, the clock input of the D flip-flop is connected to the pulse signal, setting a timer to monitor the continuity of the pulse signal, and if the number of pulses received within the set time is less than a predetermined number, it is considered that a pulse missing has occurred.

3. The multi-electric aircraft DC power supply high voltage GCU dual backup arbitration system according to claim 1 is characterized in that: The arbitration control logic module is responsible for evaluating the operating status of each microprocessor.

4. A method for arbitrating a dual backup of a high voltage GCU of a direct current power supply for a more electric aircraft, applied to a dual backup arbitration system of a high voltage GCU of a direct current power supply for a more electric aircraft according to any one of claims 1 to 3, characterized in that: The following steps are involved: S1: Select 555 timer as the core component of pulse missing detection, and connect the output pulse signal of GCU to the trigger end of 555 timer; S2: Use gate circuits to monitor the state of the I / O port, distinguish between low level, high level and high impedance states, and design a monitoring circuit for each state; S3: Use gate circuits and discrete devices to build arbitration control logic and design logic circuits according to preset priority weights; S4: Use a trigger to lock the detected level signal and design a switching circuit to switch to the backup system when the main system fails.

5. The method for dual backup arbitration of a DC power supply high voltage GCU of a multi-electric aircraft according to claim 4 is characterized in that: The S2 further comprises: Low level state monitoring circuit: Use a NOT gate and a comparator, connect the I / O port signal to the NOT gate input, and the NOT gate output is connected to the comparator input. When the I / O port signal is low level, the NOT gate output is high level, and the comparator detects the high level, indicating that the I / O port is in a low level state; High level state monitoring circuit: Use an AND gate and a comparator, connect the I / O port signal to one input of the AND gate, connect the other input to a positive voltage, and connect the AND gate output to the comparator input. When the I / O port signal is high level, the AND gate output is high level, and the comparator detects the high level, indicating that the I / O port is in a high level state. High-impedance state monitoring circuit: Use an operational amplifier configured as a comparator and combine it with a resistor divider network. The I / O port signal is connected to the non-inverting input of the operational amplifier through a high-impedance resistor, and the inverting input is grounded. In the high-impedance state, the output of the operational amplifier will be uncertain. Set a fault threshold. When the I / O port is in a high-impedance state, the output of the operational amplifier will remain at a low level. Connect the output of the operational amplifier to the subsequent logic circuit to indicate the high-impedance state.

6. The method for dual backup arbitration of a DC power supply high voltage GCU of a multi-electric aircraft according to claim 4 is characterized in that: The S4 further includes using a D flip-flop to lock the level signal, connecting the signal to be detected to the D input of the flip-flop, the clock signal is generated by a timer or other event trigger, and the output Q will be used to control the switching circuit. When Q is at a high level, it indicates that the main system is working normally; When Q is low, it indicates the need to switch to the backup system; Use a comparator or voltage monitoring circuit to detect the status of the main system and set a fault threshold. When the voltage is lower than this value, it indicates that the main system has failed. The output of the comparator is connected to the reset input of the trigger. A multiplexer or relay is used to realize signal switching. The outputs of the main system and the backup system are connected to the input of the multiplexer. The selection signal of the multiplexer is controlled according to the output of the trigger. When the trigger is locked, the selection signal is output to the main system. When the main system fails, the selection signal is switched to the backup system output.

Images