Non-instruction prevention method and framework based on mechanical system irrelevance

Abstract

The invention belongs to the technical field of electromechanical system automatic control of large airplanes, and particularly relates to a non-instruction prevention method and framework based on mechanical system irrelevance, and the method comprises the steps that a core controller collects work operation data of a first execution mechanism, a second execution mechanism, a third execution mechanism and a fourth execution mechanism, generating a bottom event control instruction under the same top event according to the automatic control logic; the core controller sends unrelated bottom event control instructions of the mechanical system to the first driver, the second driver, the third driver and the fourth driver at the same time; according to the method, all mechanical system irrelevant bottom event control instructions are simultaneously judged for the first driver, the second driver, the third driver and the fourth driver, whether the controllers are abnormal or not is judged according to whether the controlled objects stop running under the mechanical system irrelevant instructions or not, extra cost is not increased, and the safety of the system is improved.

Description

Technical Field

[0001] The present application belongs to the technical field of automatic control of electromechanical systems of large aircraft, and in particular to a method and architecture for preventing non-instructions based on irrelevance of mechanical systems. Background Art

[0002] The aircraft electromechanical system includes dozens of subsystems such as power supply, hydraulic pressure, environmental control, fuel, and landing gear. With the improvement of the integration of aircraft, the control design of each electromechanical system is considered uniformly, forming an electromechanical integrated control architecture. According to the safety requirements of the aircraft electromechanical system, it is generally a dual-redundancy design. At the same time, in order to meet the high safety requirements of the system, a manual button is generally retained to form a "2+1" non-similar redundancy to meet the aircraft Class I and Class II safety requirements. In recent years, due to the improvement of the intelligence level of aircraft, and the existence of ejection channels, the cockpit space of combat aircraft has been compressed, and the layout of switch panels has been reduced, resulting in the restriction of the original design method of electromechanical system that relies on non-similar manual redundancy to achieve high safety requirements. For the control system, the most harmful of these is non-command output, which makes the system act when it should not act, such as non-command shutdown of all hydraulic pumps, causing the aircraft to lose all hydraulic energy; non-command shutdown of all fuel cut-off valves, causing all engines of the aircraft to lose fuel supply, etc., which will lead to Class I events of aircraft destruction and death.

[0003] Therefore, under the current constraints of simplifying the cockpit layout, it is very necessary for us to propose a new design method to prevent non-instructions, while meeting the requirements of aircraft intelligence and ensuring the safety of the system. Summary of the invention

[0004] The purpose of this application is to provide a method and architecture for preventing non-instructions based on the irrelevance of mechanical systems, so as to solve the problem that the existing system safety does not meet the requirements.

[0005] The technical solution of the present application is: a method for preventing non-instructions based on the irrelevance of a mechanical system, comprising:

[0006] The core controller collects the working data of the first actuator, the second actuator, the third actuator and the fourth actuator, and then generates the bottom event control instructions under the same top event according to the automatic control logic;

[0007] The core controller sends the bottom event control instructions unrelated to the mechanical system to the first driver, the second driver, the third driver and the fourth driver simultaneously;

[0008] The first driver, the second driver, the third driver and the fourth driver judge all the received mechanical system irrelevant bottom event control instructions. When all the mechanical system irrelevant instructions require stopping the operation of the controlled object, it is judged that the first controller and the second controller are operating abnormally, and no longer respond to the control instructions of the first controller and the second controller. The first driver to the fourth driver still operate according to the previous state instruction.

[0009] Preferably, the bottom event control instruction includes:

[0010] When the first controller and / or the second controller detects that the first actuator has a fault, an automatic control instruction to close the first actuator is issued;

[0011] When the first controller and / or the second controller detects that the second actuator has a fault, an automatic control instruction to close the second actuator is issued;

[0012] When the first controller and / or the second controller detects that the third actuator has a fault, an automatic control instruction to close the third actuator is issued;

[0013] When the first controller and / or the second controller detects that the fourth actuator has a fault, an automatic control instruction to close the fourth actuator is issued.

[0014] Preferably, the specific process of sending the bottom event control instructions simultaneously is:

[0015] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the first driver at the same time;

[0016] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the second driver at the same time;

[0017] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the third driver at the same time;

[0018] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the fourth driver at the same time.

[0019] Preferably, the specific method for the first driver to judge all the irrelevant bottom event control instructions of the mechanical system is: the first driver receives the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and if the automatic control instructions are all to stop working, the first driver does not respond to the current instruction, and maintains the previous state;

[0020] The first driver determines the validity of the automatic control instructions of the first actuator sent by the first controller and the second controller. When both are valid, if the instructions of the first controller and the second controller are both to stop working, the first actuator is turned off. If the instruction of any controller is to work normally, the first actuator continues to be driven to work normally.

[0021] Preferably, the first driver determines the validity of the automatic control instructions on the first actuator sent by the first controller and the second controller, and when only one controller's instructions are valid, the first actuator is driven according to the automatic control instructions of the controller.

[0022] Preferably, the first driver determines the validity of the automatic control instructions on the first actuator sent by the first controller and the second controller. When both are invalid, the first driver controls the first actuator according to the previous state.

[0023] Preferably, the first actuator, the second actuator, the third actuator and the fourth actuator are four devices that are completely unrelated mechanically within the system.

[0024] As a specific implementation, a non-instruction prevention architecture based on mechanical system irrelevance includes a dual-redundancy automatic control logic solving module, a power drive channel and a controlled object; the dual-redundancy automatic control logic solving module includes a first controller and a second controller; the power drive channel is used to convert digital instructions from the controller into power output, including a first driver, a second driver, a third driver and a fourth driver; the controlled object includes a first actuator, a second actuator, a third actuator and a fourth actuator; the dual-redundancy automatic control logic solving module and the power drive channel are bidirectionally interconnected, the first driver is connected to the first actuator, the second driver is connected to the second actuator, the third driver is connected to the third actuator, and the fourth driver is connected to the fourth actuator.

[0025] Preferably, the bottom event control instruction includes:

[0026] When the first controller and / or the second controller detects that the first actuator has a fault, an automatic control instruction to close the first actuator is issued;

[0027] When the first controller and / or the second controller detects that the second actuator has a fault, an automatic control instruction to close the second actuator is issued;

[0028] When the first controller and / or the second controller detects that the third actuator has a fault, an automatic control instruction to close the third actuator is issued;

[0029] When the first controller and / or the second controller detects that the fourth actuator has a fault, an automatic control instruction to close the fourth actuator is issued.

[0030] Preferably, the specific process of sending the bottom event control instructions simultaneously is:

[0031] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the first driver at the same time;

[0032] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the second driver at the same time;

[0033] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the third driver at the same time;

[0034] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the fourth driver at the same time.

[0035] Preferably, the specific method for the first driver to judge all the irrelevant bottom event control instructions of the mechanical system is: the first driver receives the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and if the automatic control instructions are all to stop working, the first driver does not respond to the current instruction, and maintains the previous state;

[0036] The first driver determines the validity of the automatic control instructions of the first actuator sent by the first controller and the second controller. When both are valid, if the instructions of the first controller and the second controller are both to stop working, the first actuator is turned off. If the instruction of any controller is to work normally, the first actuator continues to be driven to work normally.

[0037] Preferably, the first driver determines the validity of the automatic control instructions on the first actuator sent by the first controller and the second controller, and when only one controller's instructions are valid, the first actuator is driven according to the automatic control instructions of the controller.

[0038] Preferably, the first driver determines the validity of the automatic control instructions on the first actuator sent by the first controller and the second controller. When both are invalid, the first driver controls the first actuator according to the previous state.

[0039] Preferably, the first actuator, the second actuator, the third actuator and the fourth actuator are four devices that are completely unrelated mechanically within the system.

[0040] The non-instruction prevention method and architecture based on mechanical system irrelevance of the present application simultaneously judges all mechanical system irrelevant bottom event control instructions for the first driver, the second driver, the third driver and the fourth driver, and judges whether each controller is abnormal based on whether the controlled object stops running under the mechanical system irrelevant instructions, without adding additional costs, thereby improving the safety of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solution provided by the present application, the following is a brief introduction to the accompanying drawings. Obviously, the accompanying drawings described below are only some embodiments of the present application.

[0042] Figure 1 This is a schematic diagram of the overall flow of the method for preventing non-instructions in this application;

[0043] Figure 2 A flowchart for preventing the use of non-instruction methods for this application;

[0044] Figure 3 This is the overall system architecture diagram for preventing non-instruction architecture for this application.

[0045] In the figure, 1, first controller; 2, second controller; 3, first driver; 4, second driver; 5, third driver; 6, fourth driver; 7, first actuator; 8, second actuator; 9, third actuator; 10, fourth actuator. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] A method to prevent non-commands based on the irrelevance of mechanical systems, such as Figure 1-Figure 2 As shown, the following steps are included:

[0048] In step S1 , the core controller collects the working data of the first actuator, the second actuator, the third actuator and the fourth actuator, and then generates the bottom event control instruction under the same top event according to the automatic control logic.

[0049] Specific bottom event control instructions include:

[0050] When the first controller and / or the second controller detects that the first actuator has a fault, an automatic control instruction to close the first actuator is issued;

[0051] When the first controller and / or the second controller detects that the second actuator has a fault, an automatic control instruction to close the second actuator is issued;

[0052] When the first controller and / or the second controller detects that the third actuator has a fault, an automatic control instruction to close the third actuator is issued;

[0053] When the first controller and / or the second controller detects that the fourth actuator has a fault, an automatic control instruction to close the fourth actuator is issued.

[0054] Step S2, the core controller sends the mechanical system irrelevant bottom event control instructions to the first driver, the second driver, the third driver and the fourth driver at the same time; wherein the first actuator, the second actuator, the third actuator and the fourth actuator are four completely irrelevant devices in the system, and the probability of their simultaneous failure is much less than 10e -9 .

[0055] Preferably, the specific process of sending the bottom event control instructions simultaneously is:

[0056] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the first driver at the same time;

[0057] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the second driver at the same time;

[0058] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the third driver at the same time;

[0059] The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the fourth driver at the same time.

[0060] In step S3, the first driver, the second driver, the third driver and the fourth driver judge all the received control instructions of the irrelevant bottom event of the mechanical system. When all the irrelevant instructions of the mechanical system require stopping the operation of the controlled object, it is judged that the operation of the first controller and the second controller is abnormal, and the control instructions of the first controller and the second controller are no longer responded. The first driver to the fourth driver still operate according to the previous state instruction.

[0061] Preferably, taking the first driver as an example, the specific method for judging all irrelevant event control instructions of the mechanical system is:

[0062] The first driver receives the automatic control instructions from the first actuator, the second actuator, the third actuator and the fourth actuator. If the automatic control instructions are all to stop working, the first driver does not respond to the current instruction and maintains the previous state. Otherwise, it goes to the next step.

[0063] The first driver determines the validity of the automatic control instructions of the first actuator sent by the first controller and the second controller. When both are valid, if the instructions of the first controller and the second controller are to stop working, the first actuator is turned off. If the instruction of any controller is to work normally, the first actuator continues to be driven to work normally. Otherwise, it goes to the next step.

[0064] The first driver determines the validity of the automatic control instructions of the first actuator sent by the first controller and the second controller. When only one controller's instruction is valid, the first actuator is driven according to the automatic control instruction of the controller. Otherwise, the process proceeds to the next step.

[0065] The first driver determines the validity of the automatic control instructions on the first actuator sent by the first controller and the second controller. When both are invalid, the first driver controls the first actuator according to the previous state.

[0066] The control logic of the second driver, the third driver and the fourth driver is the same as that of the first controller, and the details are not repeated here.

[0067] As a specific implementation, it also includes a non-instruction prevention architecture based on mechanical system irrelevance, using the above non-instruction prevention method, such as Figure 3, including a dual-redundancy automatic control logic solving module, a power drive channel and a controlled object. The dual-redundancy automatic control logic solving module includes a first controller 1 and a second controller 2. The power drive channel is used to convert digital instructions from the controller into power output, including a first driver 3, a second driver 4, a third driver 5 and a fourth driver 6. The controlled object includes a first actuator 7, a second actuator 8, a third actuator 9 and a fourth actuator 10. The dual-redundancy automatic control logic solving module and the power drive channel are bidirectionally interconnected, the first driver 3 is connected to the first actuator 7, the second driver 4 is connected to the second actuator 8, the third driver 5 is connected to the third actuator 9, and the fourth driver 6 is connected to the fourth actuator 10.

[0068] When the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10 all stop working, a Class I safety accident will occur.

[0069] Under normal circumstances, the actuator should be open and in working condition. When the actuator itself is abnormal, it should be closed through automatic control logic to prevent the fault from spreading further. However, the controller in the system architecture has a common mode failure, and there is a possibility of shutting down the four actuators without a command. Therefore, the system control logic must be designed to prevent non-commands.

[0070] Preferably, the bottom event control instruction includes:

[0071] When the first controller 1 and / or the second controller 2 detects that the first actuator 7 has a fault, an automatic control instruction to close the first actuator 7 is issued;

[0072] When the first controller 1 and / or the second controller 2 detects that the second actuator 8 has a fault, an automatic control instruction to close the second actuator 8 is issued;

[0073] When the first controller 1 and / or the second controller 2 detects that the third actuator 9 is faulty, an automatic control instruction to close the third actuator 9 is issued;

[0074] When the first controller 1 and / or the second controller 2 detects that the fourth actuator 10 has a fault, an automatic control instruction to close the fourth actuator 10 is issued.

[0075] Preferably, the specific process of sending the bottom event control instructions simultaneously is:

[0076] The first controller 1 and / or the second controller 2 packages the automatic control instructions of the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10, and sends them to the first driver 3 at the same time;

[0077] The first controller 1 and / or the second controller 2 packages the automatic control instructions of the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10, and sends them to the second driver 4 at the same time;

[0078] The first controller 1 and / or the second controller 2 packages the automatic control instructions of the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10, and sends them to the third driver 5 at the same time;

[0079] The first controller 1 and / or the second controller 2 packages the automatic control instructions of the first actuator 7 , the second actuator 8 , the third actuator 9 and the fourth actuator 10 , and sends them to the fourth driver 6 at the same time.

[0080] Preferably, the specific method for the first driver 3 to judge the control instructions of all irrelevant bottom events of the mechanical system is as follows: the first driver 3 receives the automatic control instructions of the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10, and if the automatic control instructions are all to stop working, the first driver 3 does not respond to the current instruction, and maintains the previous state;

[0081] The first driver 3 determines the validity of the automatic control instructions regarding the first actuator 7 sent by the first controller 1 and the second controller 2. When both are valid, if the instructions of the first controller 1 and the second controller 2 are both to stop working, the first actuator 7 is turned off. If the instruction of any controller is to work normally, the first actuator 7 continues to be driven to work normally.

[0082] Preferably, the first driver 3 determines the validity of the automatic control instructions on the first actuator 7 sent by the first controller 1 and the second controller 2, and when only one controller's instructions are valid, the first actuator 7 is driven according to the automatic control instructions of the controller.

[0083] Preferably, the first driver 3 determines the validity of the automatic control instructions on the first actuator 7 sent by the first controller 1 and the second controller 2. When both are invalid, the first driver 3 controls the first actuator 7 according to the previous state.

[0084] Preferably, the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10 are four devices that are completely unrelated mechanically within the system.

[0085] In summary, the present application improves the safety of the system by simultaneously judging all mechanical system irrelevant bottom event control instructions for the first driver 3, the second driver 4, the third driver 5 and the fourth driver 6, and judging whether each controller is abnormal based on whether the controlled object stops running under the mechanical system irrelevant instructions, without adding any additional costs.

[0086] Finally, it should be noted that: the drawings of the embodiments disclosed in the present invention only involve structures related to the embodiments disclosed in the present invention, and other structures can refer to the general design. In the absence of conflict, the same embodiment and different embodiments of the present invention can be combined with each other;

[0087] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for preventing non-instructions based on irrelevance of mechanical systems, characterized in that: include: The core controller collects the working data of the first actuator, the second actuator, the third actuator and the fourth actuator, and then generates the bottom event control instructions under the same top event according to the automatic control logic; The core controller sends the bottom event control instructions unrelated to the mechanical system to the first driver, the second driver, the third driver and the fourth driver simultaneously; The first driver, the second driver, the third driver and the fourth driver judge all the received mechanical system irrelevant bottom event control instructions. When all the mechanical system irrelevant instructions require stopping the operation of the controlled object, it is judged that the first controller and the second controller are operating abnormally, and no longer respond to the control instructions of the first controller and the second controller. The first driver to the fourth driver still operate according to the previous state instruction.

2. The method for preventing non-instructions based on mechanical system irrelevance according to claim 1, characterized in that: The bottom event control instruction includes: When the first controller and / or the second controller detects that the first actuator has a fault, an automatic control instruction to close the first actuator is issued; When the first controller and / or the second controller detects that the second actuator has a fault, an automatic control instruction to close the second actuator is issued; When the first controller and / or the second controller detects that the third actuator has a fault, an automatic control instruction to close the third actuator is issued; When the first controller and / or the second controller detects that the fourth actuator has a fault, an automatic control instruction to close the fourth actuator is issued.

3. The method for preventing non-instructions based on mechanical system irrelevance according to claim 1, characterized in that: The specific process of sending the bottom event control instructions at the same time is: The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the first driver at the same time; The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the second driver at the same time; The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the third driver at the same time; The first controller and / or the second controller packages the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and sends them to the fourth driver at the same time.

4. The method for preventing non-instructions based on mechanical system irrelevance according to claim 1, characterized in that: The specific method for the first driver to judge the control instructions of all irrelevant bottom events of the mechanical system is as follows: the first driver receives the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and if the automatic control instructions are all to stop working, the first driver does not respond to the current instruction, and maintains the previous state; The first driver determines the validity of the automatic control instructions of the first actuator sent by the first controller and the second controller. When both are valid, if the instructions of the first controller and the second controller are both to stop working, the first actuator is turned off. If the instruction of any controller is to work normally, the first actuator continues to be driven to work normally.

5. The method for preventing non-instructions based on irrelevance of mechanical systems according to claim 4, characterized in that: The first driver determines the validity of the automatic control instructions sent by the first controller and the second controller regarding the first actuator, and when only one controller's instructions are valid, the first actuator is driven according to the automatic control instructions of the controller.

6. The method for preventing non-instructions based on irrelevance of mechanical systems according to claim 4, characterized in that: The first driver determines the validity of the automatic control instructions on the first actuator sent by the first controller and the second controller. When both are invalid, the first driver controls the first actuator according to the previous state.

7. The method for preventing non-instructions based on mechanical system irrelevance according to claim 1, characterized in that: The first actuator, the second actuator, the third actuator and the fourth actuator are four devices that are completely unrelated mechanically within the system.

8. A non-instruction prevention architecture based on mechanical system irrelevance, using the non-instruction prevention method according to any one of claims 1 to 7, characterized in that: The invention comprises a dual-redundancy automatic control logic solving module, a power driving channel and a controlled object; the dual-redundancy automatic control logic solving module comprises a first controller (1) and a second controller (2); the power driving channel is used for converting digital instructions from the controller into power output, and comprises a first driver (3), a second driver (4), a third driver (5) and a fourth driver (6); the controlled object comprises a first actuator (7), a second actuator (8), a third actuator (9) and a fourth actuator (10); the dual-redundancy automatic control logic solving module and the power driving channel are bidirectionally interconnected, the first driver (3) is connected to the first actuator (7), the second driver (4) is connected to the second actuator (8), the third driver (5) is connected to the third actuator (9), and the fourth driver (6) is connected to the fourth actuator (10).

9. The non-instruction prevention architecture based on mechanical system irrelevance as claimed in claim 8, characterized in that: The bottom event control instruction includes: When the first controller (1) and / or the second controller (2) detects that the first actuator (7) has a fault, an automatic control instruction to close the first actuator (7) is issued; When the first controller (1) and / or the second controller (2) detects that the second actuator (8) has a fault, an automatic control instruction to close the second actuator (8) is issued; When the first controller (1) and / or the second controller (2) detects that the third actuator (9) has a fault, an automatic control instruction to close the third actuator (9) is issued; When the first controller (1) and / or the second controller (2) detects that the fourth actuator (10) has a fault, an automatic control instruction to close the fourth actuator (10) is issued.

10. The non-instruction prevention architecture based on mechanical system irrelevance as claimed in claim 8, characterized in that: The specific process of sending the bottom event control instructions at the same time is: The first controller (1) and / or the second controller (2) packages the automatic control instructions of the first actuator (7), the second actuator (8), the third actuator (9) and the fourth actuator (10), and sends them to the first driver (3) at the same time; The first controller (1) and / or the second controller (2) packages the automatic control instructions of the first actuator (7), the second actuator (8), the third actuator (9) and the fourth actuator (10), and sends them to the second driver (4) at the same time; The first controller (1) and / or the second controller (2) packages the automatic control instructions of the first actuator (7), the second actuator (8), the third actuator (9) and the fourth actuator (10), and sends them to the third driver (5) at the same time; The first controller (1) and / or the second controller (2) packages the automatic control instructions of the first actuator (7), the second actuator (8), the third actuator (9) and the fourth actuator (10) and sends them to the fourth driver (6) at the same time.

11. The non-instruction prevention architecture based on mechanical system irrelevance as claimed in claim 8, characterized in that: The specific method for the first driver (3) to judge all the irrelevant bottom event control instructions of the mechanical system is as follows: the first driver (3) receives the automatic control instructions of the first actuator (7), the second actuator (8), the third actuator (9) and the fourth actuator (10), and if the automatic control instructions are all to stop working, the first driver (3) does not respond to the current instruction, and maintains the previous state; The first driver (3) determines the validity of the automatic control instructions for the first actuator (7) sent by the first controller (1) and the second controller (2). When both are valid, if the instructions of the first controller (1) and the second controller (2) are both to stop working, the first actuator (7) is turned off; if the instructions of any controller are to work normally, the first actuator (7) continues to be driven to work normally.

12. The non-instruction prevention architecture based on mechanical system irrelevance as claimed in claim 12, characterized in that: The first driver (3) determines the validity of the automatic control instructions for the first actuator (7) sent by the first controller (1) and the second controller (2), and when only one controller's instructions are valid, the first actuator (7) is driven according to the automatic control instructions of the controller.

13. The non-instruction prevention architecture based on mechanical system irrelevance as claimed in claim 12, characterized in that: The first driver (3) determines the validity of the automatic control instructions for the first actuator (7) sent by the first controller (1) and the second controller (2); when both are invalid, the first driver (3) controls the first actuator (7) according to the previous state.

14. The non-instruction prevention architecture based on mechanical system irrelevance as claimed in claim 8, characterized in that: The first actuator (7), the second actuator (8), the third actuator (9) and the fourth actuator (10) are four devices that are completely unrelated mechanically within the system.

Images