EVTOL control system and control method

Abstract

The invention belongs to the technical field of aircraft control, and relates to an eVTOL control system and control method.The system comprises a main control device, a main control controller, an auxiliary control device and an auxiliary control controller; the main control device is connected with the main control controller, and the main control device is used for generating a main control instruction and transmitting the main control instruction to the flight control computer through the main control controller; the auxiliary control device is connected with the auxiliary control controller, and the auxiliary control device is used for generating an auxiliary control instruction and transmitting the auxiliary control instruction to the flight control computer through the auxiliary control controller; the auxiliary control device is provided with a main control cut-off switch; an external power supply is connected with the main operation controller through the main operation cut-off switch and supplies power to the main operation controller; and the power supply of the main operation controller is actively cut off through the main operation change-over switch, so that the active switching of the control authority is realized.

Description

Technical Field

[0001] The present invention belongs to the technical field of aircraft control and relates to an eVTOL control system and a control method. Background Art

[0002] With the rapid development of science and technology, electric vertical take-off and landing aircraft (eVTOL) have shown great potential in urban transportation, tourism, logistics and transportation. However, the existing eVTOL control system still has some significant problems and challenges in practical application.

[0003] The control system of traditional aircraft usually uses multiple control devices such as side sticks, pedals, and throttle platforms to achieve multi-axis control of the aircraft. For civil aircraft and helicopters with higher safety, a double-cabin control system layout is usually used, resulting in high complexity, large size, heavy weight, and high cost of the overall control system. For eVTOL, such a control system not only increases the load of the aircraft, affecting its flight performance and energy efficiency, but also limits the internal space layout and payload of the aircraft to a certain extent. This has limited the widespread application of manned eVTOL to a certain extent, especially in scenarios such as urban transportation and tourism, which require simple, intuitive, small size and weight, reliable and low-cost control systems to meet user needs.

[0004] In the existing eVTOL control system, the control device is often single and lacks effective auxiliary control means. Once the control device fails or fails, the safety of the aircraft will be seriously threatened, which greatly affects the airworthiness certification and commercial application of eVTOL. Summary of the invention

[0005] The present invention provides an eVTOL control system and control method, which can meet the application of eVTOL and have the advantages of high safety, high reliability, small size and weight, simplicity, and low cost.

[0006] The technical solution adopted by the present invention to solve its technical problem is:

[0007] Technical solution 1:

[0008] An eVTOL control system includes a main control device, a main control controller, an auxiliary control device and an auxiliary control controller, and has a four-axis high-safety control function.

[0009] The main control device is equipped with command elements including a longitudinal sensor, a lateral sensor, a heading sensor, a vertical sensor and a talk switch. The longitudinal sensor uses a magnetoresistive sensor to accurately sense the longitudinal control displacement of the main control device as a control command for the forward / backward movement of the aircraft. The longitudinal sensor adopts an electrical double-redundancy configuration under the limitation of space size to increase the safety of the longitudinal control of the main control device. The lateral sensor uses a magnetoresistive sensor to sense the lateral control displacement of the main control device as a control command for the left / right movement of the aircraft. The lateral sensor adopts an electrical double-redundancy configuration under the limitation of space size to increase the safety of the lateral control of the main control device. The heading sensor uses a magnetoresistive sensor to sense the heading control displacement of the main control device as a control command for the left / right turn of the aircraft. The heading sensor adopts an electrical double-redundancy configuration under the limitation of space size to increase the safety of the heading control of the main control device. The vertical sensor uses a potentiometer to sense the vertical control displacement of the main control device as a control command for the ascent / descent movement of the aircraft. The vertical sensor adopts a mechanical dual-redundancy configuration under the space size limit to increase the safety of the vertical control of the main control device. The call switch is a call request switch between the driver and the ground base station. It is a single-redundancy configuration. After pressing, it is connected. The driver can talk and communicate with the ground base station personnel.

[0010] The main control controller is an independent dual-redundancy redundant channel configuration (channel A and channel B), and each redundant channel includes a digital processing module, a signal interface and processing module, a main CAN bus interface module, a main programming interface module and a main power supply module. Taking a certain redundant channel as an example, the signal interface and processing module supplies power to the longitudinal sensor, the lateral sensor, the heading sensor and the vertical sensor, receives the four-axis voltage command analog signal provided by the longitudinal sensor, the lateral sensor, the heading sensor and the vertical sensor, and converts the analog signal into a digital signal through the control of the main digital control module, and sends it to the main digital control module. The main digital control module receives the command data from the signal interface and processing module and the command data of another redundant channel, obtains the four-axis control command through internal data calculation, comparison and processing, and sends the four-axis control command to the external CANFD / CAN bus through the main CAN bus interface module. The main programming interface module provides a programming interface for the processor in the main digital control module, which is convenient for program downloading and debugging. The main power supply module receives two external DC power supplies, and after power supply integration, filtering, conversion and other processing, it supplies power to each module of the redundant channel of the main control controller.

[0011] The auxiliary control device is an extremely simple control device. In order to improve the basic reliability of the auxiliary control device, the command elements configured include a forward switch, a reverse switch, a left turn switch, a right turn switch, an ascending switch, and a descending switch. In addition, a main control cut-off switch is also configured. The forward switch and the reverse switch are discrete control commands for the forward / reverse movement of the aircraft. They are both single-pole single-throw self-reset buttons, which are kept in a normally open state. When pressed, they are in a closed state, indicating the control action of the control axis. The left turn switch and the right turn switch are discrete control commands for the left / right turn movement of the aircraft. They are both single-pole single-throw self-reset buttons, which are kept in a normally open state. When pressed, they are in a connected state, indicating the control action of the control axis. The ascending switch and the descending switch are discrete control commands for the ascending / descending movement of the aircraft. They are both single-pole single-throw self-reset buttons, which are kept in a normally open state. When pressed, they are in a connected state, indicating the control action of the control axis. The main control cut-off switch is the power cut-off switch of the main control controller, which can directly cut off / connect the two-way DC power supply of the main control controller to perform a mandatory transfer of control authority.

[0012] The auxiliary control controller is a simple single-redundancy channel configuration to improve the basic reliability of the auxiliary control controller, including a digital processing module, a discrete signal interface and processing module, an auxiliary CAN bus interface module, an auxiliary programming interface module and an auxiliary power supply module. The discrete signal interface and processing module receives discrete control instructions provided by the forward switch, the reverse switch, the left turn switch, the right turn switch, the up switch and the down switch. The auxiliary digital control module receives the instruction data from the discrete signal interface and processing module, and after internal data processing, sends the discrete control instructions to two external CAN buses through the auxiliary CAN bus interface module. The auxiliary programming interface module provides a programming interface for the processor in the auxiliary digital control module, which is convenient for program downloading and debugging. The main power supply module receives two external DC power supplies, and after power integration, filtering, conversion and other processing, it supplies power to each module of the auxiliary control controller.

[0013] Preferably, the main digital control modules contained in the two channels of the main control controller may use different processor solutions (non-similar solutions) or the same processor solution. The processor type may be a microprocessor solution or a programmable logic device solution.

[0014] Preferably, the two redundant channels of the main control controller exchange data with each other via a channel-to-channel data link (CCDL).

[0015] Technical solution 2:

[0016] A method for controlling an eVTOL control system, wherein the control authority transfer logic is applied to the control system as described in technical solution 1, and the control authority transfer logic is:

[0017] S1. After the operating system is powered on, the operating authority is on the main operating controller by default;

[0018] S2. If any of the longitudinal sensor, lateral sensor, yaw sensor, and vertical sensor in the main control device fails and has been detected by the main control controller, the main control controller determines that the corresponding channel has a sensor failure, and sets the command sent to the flight control computer to a safe value and the corresponding fault flag position is invalid. The main control controller continues to send control commands to the flight control computer through another normal channel, and the control authority is not transferred;

[0019] S3. If any of the longitudinal sensors, lateral sensors, yaw sensors and vertical sensors in the main control device fails and cannot be detected by the main control controller, during the operation of the main control device, the command values ​​obtained by the two channels of the main control controller will be greatly different. The main control controller will determine that a failure has occurred, set the command sent to the flight control computer to a safe value and the corresponding fault flag position to invalid, and the flight control computer will transfer the control authority to the auxiliary control controller, which will provide the control command;

[0020] S4. If a short circuit or open circuit occurs in the cable between the sensor in the main control device and the main control controller, during the operation of the main control device, there will be a large difference in the command values ​​obtained by the two channels of the main control controller. The main control controller determines that a fault has occurred and sets the command sent to the flight control computer to a safe value and the corresponding fault flag position is invalid. The flight control computer transfers the control authority to the auxiliary control controller, which provides the control command.

[0021] S5. If any of the main digital control module, signal interface and processing module, main CAN bus module, main power supply module or CANFD / CAN bus of a channel inside the main control controller fails, the corresponding channel of the flight control computer will not receive instructions or receive wrong instructions. The flight control computer will transfer the control authority to the auxiliary control controller, which will provide the control instructions.

[0022] S6. If the main control controller inter-channel data link transmission (CCDL) fails, the two channels of the main control controller cannot obtain data from the other channel, and the main control controller determines that a failure has occurred, and sets the command sent to the flight control computer to a safe value and the corresponding fault flag position is invalid, and the flight control computer transfers the control authority to the auxiliary control controller, which provides the control command;

[0023] S7. If a certain external power supply of the main control controller loses power, the main power module will still work normally and the control authority will not be transferred;

[0024] S8. If a common mode fault occurs in the main control device, the main control controller or the cable, the flight control computer cannot identify the fault through the fault mark on the bus, and the pilot determines whether there is a fault based on the control command and the aircraft response. The pilot manually controls the main control switch on the auxiliary control controller to cut off the power supply to the main control stick, so that the main control controller stops sending data to the bus. After the flight control computer detects that the main control controller stops sending data, it transfers the control authority to the auxiliary control controller, and the auxiliary control controller provides control commands;

[0025] S9. If the main control device, main control controller or cable is normal, when the main control switch is manually operated, the main control controller loses power, and the flight control computer detects that the main control controller stops sending data, and then transfers the control authority to the auxiliary control controller, which provides control instructions;

[0026] S10. If the control authority has been transferred to the auxiliary control controller, in the event of manual reset of the main control switch, if the main control device, the main control controller or the cable are all normal, the control authority will be transferred to the main control controller, and the main control controller will provide control instructions; if any one of the main control device, the main control controller or the cable fails, the control authority will not be transferred, and the auxiliary control controller will still provide control instructions.

[0027] The advantages of the present invention are:

[0028] (1) High safety. The present invention provides two independent control modes and designs the control authority transfer logic, which effectively prevents the risk of loss of control instructions due to failure of one control mode and greatly improves the safety of the control system. (2) Strong fault detection capability. The present invention adopts two redundantly configured sensors and two redundantly configured main control controller hardware. When any component of the main control device sensor and the main control controller fails, it can be determined whether the fault occurs by comparing the two-channel data. It has strong fault detection capability and reduces the risk of outputting wrong control instructions. (3) High task reliability. On the one hand, the main control controller and the main control device sensor are configured with two redundancy. If any one of them fails, the auxiliary control controller will provide the control instruction. , ensuring that the control task is not lost and improving the task reliability; on the other hand, the present invention adopts a non-similar processor and bus, which reduces the impact of common-mode interference on the control system and improves the task reliability; (4) Low cost, the auxiliary control of the present invention adopts a simple control form. Compared with the traditional control system, it has lower cost and better commercial prospects while ensuring safety; (5) High control accuracy, the main control device adopts a magnetoresistive sensor as a displacement sensor, which can provide high-precision angular displacement measurement in a limited volume, thereby improving the accuracy of the control command; (6) Small space occupancy, the internal space of the eVTOL aircraft cockpit is small, and the present invention adopts a combination of less main control margin and small-volume auxiliary control to realize the layout of the main and auxiliary control systems in a small space. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 It is a block diagram of the components of the operating system.

[0030] Figure 2 It is a connection diagram between the main control controller and the main control device.

[0031] Figure 3 It is a connection diagram between the auxiliary control controller and the auxiliary control device. DETAILED DESCRIPTION

[0032] The present invention is described in detail below. Figure 1 to Figure 3 .

[0033] Embodiment 1

[0034] like Figure 1-2 As shown, an eVTOL control system includes a main control device, a main control controller, an auxiliary control device and an auxiliary control controller, and has a four-axis high-safety control function.

[0035] The main control device is equipped with command elements including a longitudinal sensor, a lateral sensor, a heading sensor, a vertical sensor and a talk switch. The longitudinal sensor uses a magnetoresistive sensor to accurately sense the longitudinal control displacement of the main control device as a control command for the forward / backward movement of the aircraft. The longitudinal sensor adopts an electrical double-redundancy configuration under the limitation of space size to increase the safety of the longitudinal control of the main control device. The lateral sensor uses a magnetoresistive sensor to sense the lateral control displacement of the main control device as a control command for the left / right movement of the aircraft. The lateral sensor adopts an electrical double-redundancy configuration under the limitation of space size to increase the safety of the lateral control of the main control device. The heading sensor uses a magnetoresistive sensor to sense the heading control displacement of the main control device as a control command for the left / right turn of the aircraft. The heading sensor adopts an electrical double-redundancy configuration under the limitation of space size to increase the safety of the heading control of the main control device. The vertical sensor uses a potentiometer to sense the vertical control displacement of the main control device as a control command for the ascent / descent movement of the aircraft. The vertical sensor adopts a mechanical dual-redundancy configuration under the space size limit to increase the safety of the vertical control of the main control device. The call switch is a call request switch between the driver and the ground base station. It is a single-redundancy configuration. After pressing, it is connected. The driver can talk and communicate with the ground base station personnel.

[0036] The main control controller is configured with dual redundant channels (channel A and channel B), and each redundant channel includes a digital control module, a signal interface and processing module, a CAN bus interface module, a programming interface module and a power supply module.

[0037] Taking channel A as an example, the signal interface and processing module A connects to the longitudinal sensor A, lateral sensor A, heading sensor A and vertical sensor A and supplies power (power supply voltage is 5VDC), receives the four-axis voltage command analog signal provided by the longitudinal sensor A, lateral sensor A, heading sensor A and vertical sensor A (each sensor outputs 2 single-ended analog signals), and converts all analog signals into digital signals through the control of the main digital control module A, and sends them to the main digital control module A. The main digital control module A receives the command data from the signal interface and processing module A and the command data of channel B, obtains the four-axis control command after internal data calculation, comparison and processing, and sends the four-axis control command to the external CANFD bus through the main CAN bus interface module A. The main programming interface module A provides a programming interface for the processor in the main digital control module A, which is in the form of a JTAG interface, which is convenient for program downloading and debugging. The main power supply module A receives two external DC power supplies (power supply voltage is +12V), and after power supply integration, filtering, conversion and other processing, it supplies power to each module of the main control controller channel A.

[0038] Taking channel B as an example, the signal interface and processing module B supplies power to the longitudinal sensor B, lateral sensor B, heading sensor B and vertical sensor B (the power supply voltage is 5VDC), receives the four-axis voltage command analog signals provided by the longitudinal sensor B, lateral sensor B, heading sensor B and vertical sensor B (each sensor outputs 2 single-ended analog signals), and converts all analog signals into digital signals through the control of the main digital control module B, and sends them to the main digital control module B. The main digital control module B receives the command data from the signal interface and processing module B and the command data of channel A, obtains the four-axis control command through internal data calculation, comparison and processing, and sends the four-axis control command to the external CAN bus through the main CAN bus interface module B. The main programming interface module B provides a programming interface for the processor in the main digital control module B, which is convenient for program download and debugging. The main power supply module B receives two external DC power supplies (the power supply voltage is +12V), and after power supply integration, filtering, conversion and other processing, it supplies power to each module of the main control controller channel B.

[0039] The main digital control module contained in the two channels of the main control controller adopts the same microprocessor solution.

[0040] The two redundant channels of the main control controller exchange data with each other through the channel data link (CCDL).

[0041] Embodiment 2

[0042] like Figure 1 and Figure 3 As shown, an eVTOL control system includes a main control device, a main control controller, an auxiliary control device and an auxiliary control controller, and has a four-axis high-safety control function.

[0043] The auxiliary control device is an extremely simple control device. In order to improve the basic reliability of the auxiliary control device, the command elements configured include a forward switch, a reverse switch, a left turn switch, a right turn switch, an ascending switch, and a descending switch. In addition, a main control cut-off switch is also configured. The forward switch and the reverse switch are discrete control commands for the forward / reverse movement of the aircraft. Both are single-pole single-throw self-resetting buttons, which remain in a normally open state. When pressed, they are in a closed state, indicating that there is a control action in the control axis. The left turn switch and the right turn switch are discrete control commands for the left / right turn movement of the aircraft. Both are single-pole single-throw self-resetting buttons, which remain in a normally open state. When pressed, they are in a connected state, indicating that there is a control action in the control axis. The ascending switch and the descending switch are discrete control commands for the ascending / descending movement of the aircraft. Both are single-pole single-throw self-resetting buttons, which remain in a normally open state. When pressed, they are in a connected state, indicating that there is a control action in the control axis. The main control cut-off switch is the power cut-off switch of the main control controller. It can directly cut off / connect the two-way DC power supply (power supply voltage is +12V) of the main control controller to perform mandatory control authority transfer.

[0044] The auxiliary control controller is a simple single-redundancy channel configuration to improve the basic reliability of the auxiliary control controller, including a digital processing module, a discrete signal interface and processing module, an auxiliary CAN bus interface module, an auxiliary programming interface module and an auxiliary power supply module. The discrete signal interface and processing module receives discrete control instructions provided by the forward switch, the reverse switch, the left turn switch, the right turn switch, the up switch and the down switch. The auxiliary digital control module receives the command data from the discrete signal interface and processing module, and after internal data processing, sends the discrete control instructions to two external CAN buses through the auxiliary CAN bus interface module. The auxiliary programming interface module provides a programming interface for the processor in the auxiliary digital control module, which is convenient for program downloading and debugging. The main power supply module receives two external DC power supplies (the power supply voltage is +12V), and after power supply integration, filtering, conversion and other processing, it supplies power to each module of the auxiliary control controller.

[0045] Embodiment 3

[0046] like Figures 1 to 3 As shown, this scheme provides an eVTOL control system control method, and the control authority transfer logic is applied to the control system as described in the technical scheme 1, and the control authority transfer logic is:

[0047] S1. After the operating system is powered on, the operating authority is on the main operating controller by default;

[0048] S2. If any of the longitudinal sensor, lateral sensor, yaw sensor, and vertical sensor in the main control device fails and has been detected by the main control controller, the main control controller determines that the corresponding channel has a sensor failure, and sets the command sent to the flight control computer to a safe value and the corresponding fault flag position is invalid. The main control controller continues to send control commands to the flight control computer through another normal channel, and the control authority is not transferred;

[0049] S3. If any of the longitudinal sensors, lateral sensors, yaw sensors and vertical sensors in the main control device fails and cannot be detected by the main control controller, during the operation of the main control device, the command values ​​obtained by the two channels of the main control controller will be greatly different. The main control controller will determine that a failure has occurred, set the command sent to the flight control computer to a safe value and the corresponding fault flag position to invalid, and the flight control computer will transfer the control authority to the auxiliary control controller, which will provide the control command;

[0050] S4. If a short circuit or open circuit occurs in the cable between the sensor in the main control device and the main control controller, during the operation of the main control device, there will be a large difference in the command values ​​obtained by the two channels of the main control controller. The main control controller determines that a fault has occurred and sets the command sent to the flight control computer to a safe value and the corresponding fault flag position is invalid. The flight control computer transfers the control authority to the auxiliary control controller, which provides the control command.

[0051] S5. If any of the main digital control module, signal interface and processing module, main CAN bus module, main power supply module or CANFD / CAN bus of a channel inside the main control controller fails, the corresponding channel of the flight control computer will not receive instructions or receive wrong instructions. The flight control computer will transfer the control authority to the auxiliary control controller, which will provide the control instructions.

[0052] S6. If the main control controller inter-channel data link transmission (CCDL) fails, the two channels of the main control controller cannot obtain data from the other channel, and the main control controller determines that a failure has occurred, and sets the command sent to the flight control computer to a safe value and the corresponding fault flag position is invalid, and the flight control computer transfers the control authority to the auxiliary control controller, which provides the control command;

[0053] S7. If a certain external power supply of the main control controller loses power, the main power module will still work normally and the control authority will not be transferred;

[0054] S8. If a common mode fault occurs in the main control device, the main control controller or the cable, the flight control computer cannot identify the fault through the fault mark on the bus, and the pilot determines whether there is a fault based on the control command and the aircraft response. The pilot manually controls the main control switch on the auxiliary control controller to cut off the power supply to the main control stick, so that the main control controller stops sending data to the bus. After the flight control computer detects that the main control controller stops sending data, it transfers the control authority to the auxiliary control controller, and the auxiliary control controller provides control commands;

[0055] S9. If the main control device, main control controller or cable is normal, when the main control switch is manually operated, the main control controller loses power, and the flight control computer detects that the main control controller stops sending data, and then transfers the control authority to the auxiliary control controller, which provides control instructions;

[0056] S10. If the control authority has been transferred to the auxiliary control controller, in the event of manual reset of the main control switch, if the main control device, the main control controller or the cable are all normal, the control authority will be transferred to the main control controller, and the main control controller will provide control instructions; if any one of the main control device, the main control controller or the cable fails, the control authority will not be transferred, and the auxiliary control controller will still provide control instructions.

[0057] The above-mentioned embodiments only express the preferred implementation modes of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present invention. It should be pointed out that, for a person skilled in the art, several modifications and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the attached claims.

Claims

1. An eVTOL control system, characterized in that: The system includes: Main control devices, main control controllers, auxiliary control devices and auxiliary control controllers; The main control device is connected to the main control controller, and the main control device is used to generate the main control command and transmit the main control command to the flight control computer through the main control controller; The auxiliary control device is connected to the auxiliary control controller, and the auxiliary control device is used to generate auxiliary control instructions and transmit the auxiliary control instructions to the flight control computer through the auxiliary control controller; The auxiliary control device is equipped with a main control cut-off switch; The external power supply is connected to the main control controller through the main control cut-off switch and supplies power to the main control controller; The power supply of the main control controller is automatically cut off through the main control switch to realize the automatic switching of control authority.

2. The system according to claim 1, characterized in that: The main control device includes: a sensor group and a talk switch; the sensor group includes a longitudinal sensor, a lateral sensor, a heading sensor, and a vertical sensor; The longitudinal sensor uses a magnetoresistive sensor to sense the longitudinal displacement of the main control device as the control instruction for the forward / backward movement of the aircraft; The lateral sensor uses a magnetoresistive sensor to sense the lateral displacement of the main control device as the control instruction for the left / right movement of the aircraft; The heading sensor uses a magnetoresistive sensor to sense the control displacement of the heading of the main control device as the control instruction for the aircraft to turn left or right; The vertical sensor uses a potentiometer to sense the vertical displacement of the main control device as the control instruction for the aircraft's ascent / descent movement; The talk switch is the talk request switch between the driver and the ground base station.

3. The system according to claim 2, characterized in that: The longitudinal sensor, lateral sensor, and heading sensor adopt electrical dual-redundancy configuration, and the vertical sensor adopts mechanical dual-redundancy configuration.

4. The system according to claim 3, characterized in that: The main control controller is provided with two channels, A and B. Each channel is respectively connected to a redundancy of the sensor group, and both channels are connected to the call switch; each channel is provided with a main digital control module, a signal interface and processing module, a main CAN bus interface module, a main programming interface module and a main power supply module; The signal interface is connected to a redundant portion of the sensor group of the processing module, and is used to receive analog signals from the sensor group and convert them into digital signals before sending them to the main digital control module; The main digital control module receives the digital signal sent by the signal interface and processing module of the channel and the digital signal sent by the main digital control module of another channel; calculates and compares the digital signals from the two channels to obtain the control command, and sends the control command to the flight control computer through the main CAN bus interface; The main programming interface module is connected to the main digital control module and provides an external program download and debugging interface; The main power module is connected to the main control cut-off switch of the auxiliary control device, and receives external power to supply power to each module in the channel.

5. The system according to claim 1, characterized in that: The auxiliary control device is also provided with a control switch group, including: a forward switch, a backward switch, a left turn switch, a right turn switch, an up switch, and a down switch; The forward switch and reverse switch are discrete control commands for forward / reverse movement of the aircraft; The left turn switch and the right turn switch are discrete control commands for the aircraft's left / right turn movement; The up switch and down switch are discrete control commands for the aircraft's up / down movement; The above six switches are all single-pole single-throw self-reset buttons, which remain in a normally open state. When pressed, they are in an on state, indicating that there is an operating action of the operating axis.

6. The system according to claim 5, characterized in that: The auxiliary control controller includes: a discrete signal interface and processing module, an auxiliary digital processing module, an auxiliary CAN bus interface module, an auxiliary programming interface module and an auxiliary power supply module; The discrete signal interface and the processing module are connected to the control switch group to receive the control instructions provided by the control switch group; The auxiliary digital processing module receives the control instructions sent by the discrete signal interface and processing module, and sends them to the flight control computer through the auxiliary CAN bus interface module after processing; The auxiliary programming interface module is connected to the auxiliary digital processing module to provide an external program download and debugging interface; The auxiliary power supply module is connected to an external power supply to supply power to each internal module.

7. A method for controlling an eVTOL maneuvering system, the method being used to control the system according to any one of the preceding claims, characterized in that: The following steps are involved: S1, the system is powered on, and the control authority is in the main control controller by default; S2, the two channels of the main control controller respectively detect whether there is a fault in the sensor connected to it. If there is no fault, the state remains unchanged. If there is a fault in the sensor in its own channel, the command sent by the faulty channel to the flight control computer is set to a safe value and the fault flag position of the corresponding channel is invalid. The main control controller continues to send control commands to the flight control computer through another normal channel, and the control authority is not transferred; S3, the main control controller determines whether it has a fault. If it has no fault, the state remains unchanged. If it has a fault, the main control controller sets the command sent to the flight control computer to a safe value and the main control controller fault flag position is invalid. The flight control computer transfers the control authority to the auxiliary control controller, which provides the control command. S4: When the pilot determines that the main control device or main control controller fails, the manually controlled main control switch is disconnected, the main control controller is powered off, and the flight control computer detects that the main control controller stops sending data, and then transfers the control authority to the auxiliary control controller, which provides control instructions.

8. The method according to claim 7, characterized in that: In S3, the main control controller determines whether it has a fault, including the following scenarios: The sensor in the main control device fails and cannot be detected by the main control controller; The cable between the main control controller and the main control device is short-circuited or short-circuited; The main digital control module, signal interface and processing module, main CAN bus module or main power supply module of a channel in the main control controller fails; The data link transmission between the two channels of the main control controller failed.

9. The method according to claim 7, characterized in that: The method also includes: when the main control device and the main control controller are not faulty, the pilot manually controls the main control switch to be disconnected as needed, the main control controller is powered off, and after the flight control computer detects that the main control controller stops sending data, the control authority is transferred to the auxiliary control controller, and the auxiliary control controller provides control instructions.

10. The method according to claim 7, characterized in that: The method further includes: after the main control switch is manually reset, detecting whether the main control controller is normal, if normal, transferring the control authority from the auxiliary control controller to the main control controller, otherwise no transfer occurs.

Images