A method and architecture for preventing non-instruction based on mechanical system irrelevancy

Abstract

The application belongs to the technical field of automatic control of electromechanical systems of large aircraft, and particularly relates to a non-instruction prevention method and architecture based on mechanical system irrelevance, comprising: a core controller collecting working operation data of a first execution mechanism, a second execution mechanism, a third execution mechanism and a fourth execution mechanism, and then generating bottom event control instructions under the same top event according to automatic control logic; the core controller simultaneously sending the mechanical system irrelevant bottom event control instructions to a first driver, a second driver, a third driver and a fourth driver; judging whether each controller is abnormal according to whether the controlled object stops running under the mechanical system irrelevant instructions through simultaneous judgment of all mechanical system irrelevant bottom event control instructions of the first driver, the second driver, the third driver and the fourth driver, without increasing additional cost, and improving the safety of the system.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of automatic control of electromechanical systems of large aircraft, and particularly relates to a non-command prevention method and architecture based on mechanical system irrelevance. BACKGROUND

[0002] An aircraft electromechanical system includes dozens of subsystems such as power supply, hydraulic pressure, environmental control, fuel, landing gear, etc. With the improvement of the integration level of the aircraft, the control design of each electromechanical system is considered uniformly to form an electromechanical integrated control architecture. According to the safety requirements of the aircraft electromechanical system, a double-redundancy design is generally adopted. At the same time, in order to meet the high safety requirements of the system, one manual button is generally retained to form a "2+1" non-similar redundancy for meeting the Class I and Class II safety requirements of the aircraft. In recent years, due to the improvement of the intelligence level of the aircraft, and the existence of the ejection channel of the combat aircraft, the cockpit space is compressed, and the layout of the switch panel is reduced, which limits the original design method of the electromechanical system that relies on the non-similar manual redundancy to achieve high safety requirements. For the control system, the most harmful one among them is the non-command output, which makes the system move when it should not move. For example, non-command shutdown of all hydraulic pumps makes the aircraft lose all hydraulic energy; non-command shutdown of all fuel supply cut-off valves makes all engines of the aircraft lose fuel supply, etc., which will lead to Class I events such as aircraft crash and casualties.

[0003] Therefore, under the current constraint of simplifying the cockpit layout, it is necessary to propose a new non-command prevention design method to meet the requirements of the intelligence of the aircraft while ensuring the safety of the system. SUMMARY

[0004] The purpose of the present application is to provide a non-command prevention method and architecture based on mechanical system irrelevance to solve the problem that the safety of the existing system does not meet the requirements.

[0005] The technical solution of the present application is: a non-command prevention method based on mechanical system irrelevance, comprising:

[0006] The core controller collects the working operation data of the first, second, third and fourth execution mechanisms, and then generates bottom event control instructions under the same top event according to the automatic control logic;

[0007] The core controller sends the bottom event control instructions of the mechanical system irrelevance to the first, second, third and fourth drivers at the same time;

[0008] The first driver, the second driver, the third driver and the fourth driver judge the received all mechanical system irrelevant bottom event control instruction, when all mechanical system irrelevant instruction requires to stop the running of the controlled object, then judge that the first controller and the second controller run abnormally, no longer respond to the control instruction of the first controller and the second controller, the first driver to the fourth driver still run according to the last state instruction.

[0009] Preferably, the bottom event control instruction includes:

[0010] When the first controller and / or the second controller detects that the first execution mechanism has a fault, the automatic control instruction of closing the first execution mechanism is sent;

[0011] When the first controller and / or the second controller detects that the second execution mechanism has a fault, the automatic control instruction of closing the second execution mechanism is sent;

[0012] When the first controller and / or the second controller detects that the third execution mechanism has a fault, the automatic control instruction of closing the third execution mechanism is sent;

[0013] When the first controller and / or the second controller detects that the fourth execution mechanism has a fault, the automatic control instruction of closing the fourth execution mechanism is sent.

[0014] Preferably, the specific process of simultaneous sending of the bottom event control instruction is:

[0015] The first controller and / or the second controller packs the automatic control instruction of the first execution mechanism, the second execution mechanism, the third execution mechanism and the fourth execution mechanism, and simultaneously sends to the first driver;

[0016] The first controller and / or the second controller packs the automatic control instruction of the first execution mechanism, the second execution mechanism, the third execution mechanism and the fourth execution mechanism, and simultaneously sends to the second driver;

[0017] The first controller and / or the second controller packs the automatic control instruction of the first execution mechanism, the second execution mechanism, the third execution mechanism and the fourth execution mechanism, and simultaneously sends to the third driver;

[0018] The first controller and / or the second controller packs the automatic control instruction of the first execution mechanism, the second execution mechanism, the third execution mechanism and the fourth execution mechanism, and simultaneously sends to the fourth driver.

[0019] Preferably, the specific method of the first driver judging all mechanical system irrelevant bottom event control instructions is that the first driver receives automatic control instructions of the first, second, third and fourth actuators, if all the automatic control instructions are stop working, the first driver does not respond to the current instruction, and the first driver maintains the last state;

[0020] The first driver judges the validity of the automatic control instructions of the first actuator from the first controller and the second controller, when they are valid at the same time, if the instructions of the first controller and the second controller are both stop working, the first actuator is closed, if the instruction of any controller is normal working, the first actuator continues to work normally.

[0021] Preferably, the first driver judges the validity of the automatic control instructions of the first actuator from the first controller and the second controller, when only one controller instruction is valid, the first actuator is driven according to the automatic control instruction of the controller.

[0022] Preferably, the first driver judges the validity of the automatic control instructions of the first actuator from the first controller and the second controller, when both are invalid, the first actuator is controlled according to the last state by the first driver.

[0023] Preferably, the first, second, third and fourth actuators are four devices completely irrelevant in mechanical system.

[0024] As a specific embodiment, a non-instruction architecture based on mechanical system irrelevance includes a dual-redundancy automatic control logic solving module, a power drive channel and a controlled object; the dual-redundancy automatic control logic solving module includes a first controller and a second controller; the power drive channel is used for converting digital instructions from the controller into power output, including a first driver, a second driver, a third driver and a fourth driver; the controlled object includes a first actuator, a second actuator, a third actuator and a fourth actuator; the dual-redundancy automatic control logic solving module and the power drive channel are bidirectionally interconnected, the first driver is connected with the first actuator, the second driver is connected with the second actuator, the third driver is connected with the third actuator, and the fourth driver is connected with the fourth actuator.

[0025] Preferably, the bottom event control instructions include:

[0026] When the first controller and / or the second controller detects that the first actuator has a fault, the first actuator sends an automatic control instruction to close the first actuator;

[0027] When the first controller and / or the second controller detects that the second actuator has a fault, an automatic control instruction to shut down the second actuator is sent out;

[0028] When the first controller and / or the second controller detects that the third actuator has a fault, an automatic control instruction to shut down the third actuator is sent out;

[0029] When the first controller and / or the second controller detects that the fourth actuator has a fault, an automatic control instruction to shut down the fourth actuator is sent out.

[0030] Preferably, the specific process of sending out the bottom event control instruction simultaneously is as follows:

[0031] The first controller and / or the second controller packs the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator and sends them out to the first driver simultaneously;

[0032] The first controller and / or the second controller packs the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator and sends them out to the second driver simultaneously;

[0033] The first controller and / or the second controller packs the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator and sends them out to the third driver simultaneously;

[0034] The first controller and / or the second controller packs the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator and sends them out to the fourth driver simultaneously.

[0035] Preferably, the specific method of the first driver judging all the mechanical system irrelevant bottom event control instructions is as follows: the first driver receives the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, if all the automatic control instructions are to stop working, the first driver does not respond to the current instruction and maintains the last state.

[0036] The first driver judges the effectiveness of the automatic control instructions of the first actuator sent by the first controller and the second controller, when they are both effective, if the instructions of the first controller and the second controller are both to stop working, the first actuator is shut down, if the instructions of any one of the controllers is to work normally, the first actuator continues to work normally.

[0037] Preferably, the first driver judges the effectiveness of the automatic control instructions of the first actuator sent by the first controller and the second controller, when only one of the controllers has an effective instruction, the first actuator is driven according to the automatic control instruction of the controller.

[0038] Preferably, the first driver judges the validity of the first and second controllers on the first actuator automatic control instruction, and when both are invalid, the first driver controls the first actuator according to the last state.

[0039] Preferably, the first actuator, the second actuator, the third actuator and the fourth actuator are four devices that are mechanically completely irrelevant inside the system.

[0040] The non-instruction prevention method and architecture based on mechanical system irrelevance provided by the present application judges whether each controller is abnormal according to whether the controlled object stops running under the mechanical system irrelevant instruction by simultaneously judging all mechanical system irrelevant bottom event control instructions of the first driver, the second driver, the third driver and the fourth driver, without increasing additional cost, and improves the safety of the system. BRIEF DESCRIPTION OF DRAWINGS

[0041] In order to more clearly illustrate the technical solutions provided by the present application, the following will briefly introduce the drawings. Obviously, the drawings described below are only some embodiments of the present application.

[0042] Figure 1 The whole flowchart of the non-instruction prevention method of the present application;

[0043] Figure 2 The use flowchart of the non-instruction prevention method of the present application;

[0044] Figure 3 The whole system architecture diagram of the non-instruction prevention architecture of the present application.

[0045] In the figure, 1 is a first controller; 2 is a second controller; 3 is a first driver; 4 is a second driver; 5 is a third driver; 6 is a fourth driver; 7 is a first actuator; 8 is a second actuator; 9 is a third actuator; and 10 is a fourth actuator. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0047] A non-instruction prevention method based on mechanical system irrelevance, as shown in Figures 1-2 includes the following steps:

[0048] Step S1, the core controller collects the first actuator, the second actuator, the third actuator and the fourth actuator working operation data, and then generates the bottom event control instruction under the same top event according to the automatic control logic.

[0049] The specific bottom event control instruction includes:

[0050] When the first controller and / or the second controller detects that the first actuator has a fault, the automatic control instruction of closing the first actuator is sent out;

[0051] When the first controller and / or the second controller detects that the second actuator has a fault, the automatic control instruction of closing the second actuator is sent out;

[0052] When the first controller and / or the second controller detects that the third actuator has a fault, the automatic control instruction of closing the third actuator is sent out;

[0053] When the first controller and / or the second controller detects that the fourth actuator has a fault, the automatic control instruction of closing the fourth actuator is sent out.

[0054] Step S2, the core controller sends the mechanical system irrelevant bottom event control instructions to the first driver, the second driver, the third driver and the fourth driver at the same time; wherein the first actuator, the second actuator, the third actuator and the fourth actuator are four completely irrelevant devices on the system, and the probability of simultaneous failure is much less than 10e -9 .

[0055] Preferably, the specific process of sending the bottom event control instruction at the same time is:

[0056] The first controller and / or the second controller package the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and send them to the first driver at the same time;

[0057] The first controller and / or the second controller package the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and send them to the second driver at the same time;

[0058] The first controller and / or the second controller package the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and send them to the third driver at the same time;

[0059] The first controller and / or the second controller package the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, and send them to the fourth driver at the same time.

[0060] Step S3, the first driver, the second driver, the third driver and the fourth driver judge all mechanical system irrelevant bottom event control instructions received, when all mechanical system irrelevant instructions require to stop the controlled object running, then judge the first controller and the second controller running abnormally, no longer respond to the control instructions of the first controller and the second controller, the first driver to the fourth driver still run according to the last state instruction.

[0061] Preferably, the specific method for judging all mechanical system irrelevant bottom event control instructions is as follows, taking the first driver as an example:

[0062] The first driver receives the automatic control instructions of the first actuator, the second actuator, the third actuator and the fourth actuator, if the automatic control instructions are all stop working, then do not respond to the current instruction, the first driver maintains the last state, otherwise, go to the next step;

[0063] The first driver judges the validity of the automatic control instructions of the first actuator sent by the first controller and the second controller, when they are both valid, if the instructions of the first controller and the second controller are both stop working, then close the first actuator, if the instructions of any controller are normal working, then continue to drive the first actuator to work normally, otherwise, go to the next step;

[0064] The first driver judges the validity of the automatic control instructions of the first actuator sent by the first controller and the second controller, when only one controller instruction is valid, then drive the first actuator according to the automatic control instruction of the controller, otherwise, go to the next step;

[0065] The first driver judges the validity of the automatic control instructions of the first actuator sent by the first controller and the second controller, when they are both invalid, the first driver controls the first actuator according to the last state.

[0066] The control logic of the second driver, the third driver and the fourth driver is the same as that of the first controller, which is not described in detail.

[0067] As a specific embodiment, it also includes a non-instruction architecture based on mechanical system irrelevance, which adopts the above-mentioned non-instruction method, such as Figure 3, including a dual-redundancy automatic control logic solving module, a power drive channel and a controlled object. The dual-redundancy automatic control logic solving module includes a first controller 1 and a second controller 2. The power drive channel is used for converting digital instructions from the controller into power output, including a first driver 3, a second driver 4, a third driver 5 and a fourth driver 6. The controlled object includes a first actuator 7, a second actuator 8, a third actuator 9 and a fourth actuator 10. The dual-redundancy automatic control logic solving module and the power drive channel are bidirectionally interconnected, the first driver 3 is connected with the first actuator 7, the second driver 4 is connected with the second actuator 8, the third driver 5 is connected with the third actuator 9, and the fourth driver 6 is connected with the fourth actuator 10.

[0068] When the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10 all stop working, a Class I safety accident will occur.

[0069] Normally, the actuator should be opened in the working state, when the actuator itself is abnormal, it should be closed through the automatic control logic to avoid further spread of its failure; but the controller in the system architecture has a common mode failure, there is a possibility of non-instruction issuing to close the four actuators, therefore, the system control logic needs to be designed to prevent non-instruction.

[0070] Preferably, the bottom event control instruction includes:

[0071] When the first controller 1 and / or the second controller 2 detects that the first actuator 7 has a failure, an automatic control instruction to close the first actuator 7 is issued;

[0072] When the first controller 1 and / or the second controller 2 detects that the second actuator 8 has a failure, an automatic control instruction to close the second actuator 8 is issued;

[0073] When the first controller 1 and / or the second controller 2 detects that the third actuator 9 has a failure, an automatic control instruction to close the third actuator 9 is issued;

[0074] When the first controller 1 and / or the second controller 2 detects that the fourth actuator 10 has a failure, an automatic control instruction to close the fourth actuator 10 is issued.

[0075] Preferably, the specific process of simultaneous sending of the bottom event control instruction is:

[0076] The first controller 1 and / or the second controller 2 package the automatic control instructions of the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10, and send them to the first driver 3 simultaneously;

[0077] The first controller 1 and / or the second controller 2 package the automatic control instructions of the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10 and send them to the second driver 4 at the same time;

[0078] The first controller 1 and / or the second controller 2 package the automatic control instructions of the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10 and send them to the third driver 5 at the same time;

[0079] The first controller 1 and / or the second controller 2 package the automatic control instructions of the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10 and send them to the fourth driver 6 at the same time.

[0080] Preferably, the specific method for the first driver 3 to judge the mechanical system irrelevant bottom event control instructions is that the first driver 3 receives the automatic control instructions of the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10, if all the automatic control instructions are stop working, the first driver 3 does not respond to the current instructions and maintains the last state.

[0081] The first driver 3 judges the effectiveness of the automatic control instructions of the first actuator 7 sent by the first controller 1 and the second controller 2, when they are valid at the same time, if the instructions of the first controller 1 and the second controller 2 are both stop working, the first actuator 7 is closed, if the instructions of any controller are normal working, the first actuator 7 continues to work normally.

[0082] Preferably, the first driver 3 judges the effectiveness of the automatic control instructions of the first actuator 7 sent by the first controller 1 and the second controller 2, when only one of the controllers has valid instructions, the first actuator 7 is driven according to the automatic control instructions of the controller.

[0083] Preferably, the first driver 3 judges the effectiveness of the automatic control instructions of the first actuator 7 sent by the first controller 1 and the second controller 2, when both of them are invalid, the first actuator 7 is controlled according to the last state.

[0084] Preferably, the first actuator 7, the second actuator 8, the third actuator 9 and the fourth actuator 10 are four devices completely irrelevant in the system.

[0085] In summary, the application judges whether each controller is abnormal according to whether the controlled object stops running under the mechanical system irrelevant instructions through the simultaneous judgment of the first driver 3, the second driver 4, the third driver 5 and the fourth driver 6 on all mechanical system irrelevant bottom event control instructions without increasing additional cost, thereby improving the safety of the system.

[0086] Finally, it should be noted that the present application discloses only the structure involved in the present application, other structures can be referred to the usual design, without conflict, the same embodiment and different embodiments of the present application can be combined with each other;

[0087] Finally: the above only for the preferred embodiments of the present application, and not for the limitation of the present application, any modification, equivalent replacement, improvement, etc. made within the spirit and principles of the present application, should be included in the protection scope of the present application.

Claims

1. A method of preventing non-instruction based on mechanical system irrelevancy, characterized by, The application relates to a control method for a mechanical system with four execution mechanisms. The core controller collects working operation data of the first, second, third and fourth execution mechanisms, and then generates bottom event control instructions under the same top event according to automatic control logic; The core controller simultaneously sends the bottom event control instructions irrelevant to the mechanical system to the first, second, third and fourth drivers; The first, second, third and fourth drivers judge the received bottom event control instructions irrelevant to the mechanical system, and when all the bottom event control instructions irrelevant to the mechanical system require stopping the controlled object from running, it is judged that the first and second controllers are abnormal, the control instructions of the first and second controllers are not responded, and the first to fourth drivers still run according to the last state instructions; The bottom event control instructions include: When the first and / or second controller detects that the first execution mechanism has a fault, the automatic control instruction of closing the first execution mechanism is sent; When the first and / or second controller detects that the second execution mechanism has a fault, the automatic control instruction of closing the second execution mechanism is sent; When the first and / or second controller detects that the third execution mechanism has a fault, the automatic control instruction of closing the third execution mechanism is sent; When the first and / or second controller detects that the fourth execution mechanism has a fault, the automatic control instruction of closing the fourth execution mechanism is sent; The specific process of simultaneously sending the bottom event control instructions irrelevant to the mechanical system is as follows: The first and / or second controller packs the automatic control instructions of the second, third and fourth execution mechanisms, and simultaneously sends the first driver; The first and / or second controller packs the automatic control instructions of the first, third and fourth execution mechanisms, and simultaneously sends the second driver; The first and / or second controller packs the automatic control instructions of the first, second and fourth execution mechanisms, and simultaneously sends the third driver; The first and / or second controller packs the automatic control instructions of the first, second and third execution mechanisms, and simultaneously sends the fourth driver.

2. The non-instruction based method of preventing according to claim 1, wherein, The specific method for the first driver to judge all the bottom event control instructions irrelevant to the mechanical system is as follows: the first driver receives the automatic control instructions of the first, second, third and fourth execution mechanisms, if all the automatic control instructions are to stop working, the current instruction is not responded, and the first driver maintains the last state; The first driver judges the validity of the automatic control instructions of the first execution mechanism sent by the first and second controllers, when the instructions are valid at the same time, if the instructions of the first and second controllers are to stop working, the first execution mechanism is closed, if the instruction of any controller is to normally work, the first execution mechanism is continuously driven to normally work.

3. The non-instruction based method of preventing according to claim 2, wherein, The first driver judges the validity of the automatic control instructions of the first and second controllers, and drives the first actuator according to the automatic control instruction of the controller when only one controller instruction is valid.

4. The non-instruction based method of preventing according to claim 2, wherein, The first driver judges the validity of the automatic control instructions of the first and second controllers, and controls the first actuator according to the last state when both the instructions are invalid.

5. The non-instruction based method of preventing according to claim 1, wherein, The first, second, third and fourth actuators are four devices that are completely irrelevant in the system.

6. A non-instruction based prevention of non- instruction architecture employing the prevention of non- instruction method of any of claims 1-5. The system comprises a double-redundancy automatic control logic solving module, a power driving channel and a controlled object. The double-redundancy automatic control logic solving module comprises a first controller (1) and a second controller (2). The power driving channel is used for converting digital instructions from the controllers into power outputs, and comprises a first driver (3), a second driver (4), a third driver (5) and a fourth driver (6). The controlled object comprises a first actuator (7), a second actuator (8), a third actuator (9) and a fourth actuator (10). The double-redundancy automatic control logic solving module and the power driving channel are bidirectionally interconnected. The first driver (3) is connected to the first actuator (7), the second driver (4) is connected to the second actuator (8), the third driver (5) is connected to the third actuator (9), and the fourth driver (6) is connected to the fourth actuator (10).

7. The non-instruction set architecture to prevent based on mechanical system irrelevancy of claim 6, wherein: The bottom event control instruction comprises: When the first controller (1) and / or the second controller (2) detects a fault of the first actuator (7), the first controller (1) and / or the second controller (2) sends an automatic control instruction to close the first actuator (7); When the first controller (1) and / or the second controller (2) detects a fault of the second actuator (8), the first controller (1) and / or the second controller (2) sends an automatic control instruction to close the second actuator (8); When the first controller (1) and / or the second controller (2) detects a fault of the third actuator (9), the first controller (1) and / or the second controller (2) sends an automatic control instruction to close the third actuator (9); When the first controller (1) and / or the second controller (2) detects a fault of the fourth actuator (10), the first controller (1) and / or the second controller (2) sends an automatic control instruction to close the fourth actuator (10).

8. The non-instruction set architecture to prevent based on mechanical system irrelevancy of claim 6, wherein: the non-instruction set architecture to prevent based on mechanical system irrelevancy is further based on a mechanical system irrelevancy of a mechanical system. The specific process of simultaneous sending of the irrelevant bottom event control instructions is as follows: ​ The first controller (1) and / or the second controller (2) packs the automatic control instructions of the second actuator (8), the third actuator (9) and the fourth actuator (10), and simultaneously sends the instructions to the first driver (3); The first controller (1) and / or the second controller (2) packs the automatic control instructions of the first actuator (7), the third actuator (9) and the fourth actuator (10), and simultaneously sends the instructions to the second driver (4); The first controller (1) and / or the second controller (2) packs the automatic control instructions of the first actuator (7), the second actuator (8) and the fourth actuator (10), and simultaneously sends the instructions to the third driver (5); The first controller (1) and / or the second controller (2) package the automatic control instructions of the first actuator (7), the second actuator (8) and the third actuator (9) and send them to the fourth driver (6) at the same time.

9. The non-command prevention architecture based on mechanical system irrelevance according to claim 6, wherein: The specific method for the first driver (3) to judge all the mechanical system irrelevant bottom event control instructions is that the first driver (3) receives the automatic control instructions of the first actuator (7), the second actuator (8), the third actuator (9) and the fourth actuator (10), if all the automatic control instructions are stop working, the first driver (3) does not respond to the current instruction and maintains the last state. The first driver (3) judges the effectiveness of the automatic control instructions of the first actuator (7) sent by the first controller (1) and the second controller (2), when they are valid at the same time, if the instructions of the first controller (1) and the second controller (2) are both stop working, the first actuator (7) is closed, if the instructions of any controller are normal working, the first actuator (7) continues to work normally.

10. The non-instruction set architecture to prevent based on mechanical system irrelevancy of claim 9, wherein: The first driver (3) judges the effectiveness of the automatic control instructions of the first actuator (7) sent by the first controller (1) and the second controller (2), when only one controller instruction is valid, the first actuator (7) is driven according to the automatic control instruction of the controller.

11. The non-instruction set architecture to prevent based on mechanical system irrelevancy of claim 10, wherein: The first driver (3) judges the effectiveness of the automatic control instructions of the first actuator (7) sent by the first controller (1) and the second controller (2), when they are both invalid, the first driver (3) controls the first actuator (7) according to the last state.

12. The non-command prevention architecture based on mechanical system irrelevance according to claim 6, wherein: The first actuator (7), the second actuator (8), the third actuator (9) and the fourth actuator (10) are four devices completely irrelevant in the system.

Images