Control system of airborne air management system controller and control method thereof

Abstract

The invention provides a control system of an airborne air management system controller and a control method of the control system. The system comprises local side AMSC equipment and opposite side AMSC equipment. Hardware of the side AMSC device is completely consistent with hardware of the opposite side AMSC device, the side AMSC device is connected with the opposite side AMSC device through a CAN bus and an RS422 bus, and information interaction is carried out between an internal device of the side AMSC device, an internal device of the opposite side AMSC device and the side AMSC device and between the side AMSC device and the opposite side AMSC device in a data synchronization and status bit counting mode. Information interaction between two control objects is realized, and the security technical requirements of different levels and different functions of the system are met; according to the control system and the control method thereof, the hardware platform architecture design of the AMSC controller is improved, and an FPGA is abandoned, so that the airworthiness difficulty and the research and development cost are reduced, the development difficulty can be reduced, and the development period can be shortened.

Description

Technical Field

[0001] The present invention relates to the technical field of civil aircraft, and in particular to a control system of an airborne air management system controller and a control method thereof. Background Art

[0002] AMSC (Air Management System Controller, referred to as AMSC) is the control core of AMS (Air Management System, referred to as AMS, air management system). It mainly controls the air source system to realize engine air induction and adjust the compressed air temperature and pressure, controls the anti-icing system to complete hot air anti-icing; controls the environmental control system to realize fresh air flow control; realizes the ambient temperature control and recirculation fan control in the cockpit and cabin; realizes the ventilation control of the cabin, kitchen and bathroom; controls the cabin pressure system to realize the control of cabin pressure altitude and change rate.

[0003] At present, the AMSC controller equipment installed in domestic civil aircraft is mainly imported with foreign products. It mainly adopts DSP (High-speed Digital Signal Process) plus PPC (PowerPC, Performance Optimization With Enhanced RISC-Performance Computing, a central processing unit with a reduced instruction set architecture) architecture with FPGA (Field Programmable Gate Array, abbreviated as FPGA, field programmable logic gate array) logic control as a hardware technology solution, and carries out airworthiness certification in accordance with civil aircraft airworthiness standards.

[0004] The AMSC controller in the prior art mainly has the following problems: 1. The existing AMSC control system is usually based on the FPGA (Field Programmable Gate Array) hardware platform, which makes development difficult, hardware airworthiness certification cost high, and development cycle long.

[0005] 2. Most of the existing AMSCs use a single bus for status monitoring and data synchronization, which is prone to common mode failures and cannot further improve the safety and reliability of civil aircraft airborne systems, especially cannot meet the requirements of Class A civil aircraft airborne system equipment. Summary of the invention

[0006] In order to solve the problems in the prior art, the present invention provides a control system and a control method for an airborne air management system controller, which can realize the startup management, data synchronization, status monitoring and other functions of the left and right controllers of the AMS system. At the same time, the internal and external monitoring and control mechanisms of the AMS system adopt a redundant backup design, which effectively supports improving the reliability and safety of the system and can be applied to the status data format definition of the interactive monitoring mechanism. The present invention can reduce the development difficulty and shorten the development cycle by improving the hardware platform architecture design of the AMSC controller and abandoning FPGA to reduce the airworthiness difficulty and R&D cost.

[0007] To achieve the above-mentioned object, the present invention provides the following technical solutions: a control system of an airborne air management system controller, comprising an AMSC device on this side and an AMSC device on the opposite side; the hardware of the AMSC device on this side is completely consistent with that of the AMSC device on the opposite side, the AMSC device on this side is connected to the AMSC device on the opposite side by using a CAN bus and an RS422 bus, and the internal devices of the AMSC device on this side, the internal devices of the AMSC device on the opposite side, and the AMSC device on this side and the AMSC device on the opposite side all use data synchronization and status bit counting to perform information interaction, thereby realizing information interaction between two control objects and meeting the safety technical requirements of different levels and different functions of the system; The AMSC device on this side and the AMSC device on the opposite side are respectively connected to the external motor system, airborne power system, and avionics system, and the AMSC device on this side and the AMSC device on the opposite side are connected with a debugging interface through the RS232 bus; the debugging interface is used for software debugging, software upgrading, software data loading and transceiver control; the airborne power system is used to provide DC power to the AMSC device on this side and the AMSC device on the opposite side; the motor system interacts with the AMSC device on this side and the AMSC device on the opposite side for analog signals, digital signals, discrete signals, and optocoupler signals; the avionics system interacts with the AMSC device on this side and the AMSC device on the opposite side for data transmission through the ARINC429 bus.

[0008] In a preferred technical solution, the local AMSC device and the opposite AMSC device respectively include: an A channel module, a B channel module, an S channel module, a motherboard module, and a connector module; The hardware of the A channel module and the B channel module are completely consistent, and adopt the DSP hardware architecture. The A channel module and the B channel module back up each other and adopt the CAN bus synchronization circuit working state; The S channel module adopts the hardware architecture of MCU, and the hardware of the S channel module is independent and dissimilar to the hardware of the A channel module and the B channel module; the S channel module is a safety channel, and uses the I2C bus (Inter-Integrated Circuit, referred to as I2C bus, also known as: two-wire serial bus) to monitor the status of the A channel module and the B channel module at all times; if both the A channel module and the B channel module fail, the S channel module takes over all control functions to achieve stable and safe output and interaction of the motor system; The motherboard module is used to provide the power delivered by the onboard power system to the A channel module, the B channel module, the S channel module, and the connector module, and is also used for signal isolation and signal buffering of each interface and signal distribution to each channel; The connector module is used as an external interface.

[0009] The preferred technical solution is that if ultra-low voltage power supply occurs, the S channel module takes over all control functions and provides stable and safe output and interaction for the motor system.

[0010] The preferred technical solution is that the local AMSC device and the opposite AMSC device both use data synchronization and status bit counting to exchange information, so as to realize information interaction between the two control objects and meet the security technical requirements of different levels and functions of the system. The specific process is as follows: 1) Before the local AMSC device communicates with the opposite AMSC device, they first determine whether the working status of each other is normal; When the following conditions are met at the same time, the AMSC device on this side determines that the working status of the AMSC device on the other side is normal, otherwise it is abnormal; a) The AMSC device on the local side monitors that the discrete interface status of the AMSC device on the opposite side is "open"; b) The synchronization status monitoring data of the AMSC device on the local side monitored by the AMSC device on the opposite side is normal; Similarly, when the following conditions are met at the same time, the AMSC device on the other side determines that the working status of the AMSC device on the local side is normal, otherwise it is abnormal; a) The AMSC device on the other side monitors that the discrete interface status of the AMSC device on the local side is "open"; b) The synchronization status monitoring data of the AMSC device on the opposite side monitored by the AMSC device on the local side is normal; 2) When the local AMSC device and the opposite AMSC device determine that the working status is normal, the following communication processing mechanism is adopted: a) Periodically send synchronization status monitoring data to each other; b) continuously monitor each other's discrete interface status; c) Continuously monitor the synchronization status monitoring data sent by each other; 3) When the local AMSC device and the opposite AMSC device mutually determine that one of them is in an abnormal working state, the following communication processing mechanism is adopted: If the normal AMSC device detects that the discrete interface of the abnormal AMSC device is "off", then: a) The normal AMSC equipment stops processing any data sent by the abnormal AMSC equipment; b) The normal AMSC equipment stops sending any data to the abnormal AMSC equipment; c) The normal AMSC equipment records the fault event of the abnormal AMSC equipment shutting down; If the normal AMSC device detects that the discrete interface of the abnormal AMSC device is "open" and the synchronization status monitoring data is abnormal, the following communication processing mechanism is adopted: a) The normal AMSC equipment stops processing other data except the synchronization status monitoring data sent by the abnormal AMSC equipment until the synchronization status monitoring data becomes normal; b) The normal AMSC equipment stops sending any data except synchronization status monitoring data to the abnormal AMSC equipment; c) The normal AMSC device records the fault event corresponding to the abnormal synchronization status monitoring data of the abnormal AMSC device; d) The normal AMSC equipment continuously monitors the synchronization status monitoring data of the abnormal AMSC equipment; e) The normal AMSC equipment gives a prompt of abnormal AMSC equipment failure.

[0011] A preferred technical solution is that when the normal AMSC device continuously monitors that the synchronization status monitoring data sent by the abnormal AMSC device is normal for eight consecutive cycles, it re-determines that the corresponding abnormal AMSC device is in a normal working state and restarts the communication processing mechanism when the working state is normal.

[0012] The preferred technical solution is that the internal devices of the AMSC device on this side use data synchronization and status bit counting to exchange information, realize information interaction between two control objects, and meet the specific process of security technical requirements of different levels and functions of the system as follows: 1) The A channel module and the B channel module have the functions of mutual monitoring, mutual control, mutual switching, and mutual redundancy backup; first, the A channel module and the B channel module determine whether each other's working status is normal; When the following conditions are met at the same time, the A channel module determines that the working status of the B channel module is normal, otherwise it is abnormal; a) The discrete interface status of the A-channel module monitored by the B-channel module is "open"; b) The synchronization status monitoring data of the A channel module to the B channel module is normal; Similarly, when the following conditions are met at the same time, the B channel module determines that the working status of the A channel module is normal, otherwise it is abnormal; a) The B channel module monitors the discrete interface status of the A channel module as "open"; b) The synchronization status monitoring data of the A channel module monitored by the B channel module is normal; 2) When the A channel module and the B channel module mutually determine that the working status is normal, the following communication processing mechanism is adopted: a) Periodically send synchronization status monitoring data to each other; b) continuously monitor each other's discrete interface status; c) Continuously monitor the synchronization status monitoring data sent by each other; 3) When the A channel module and the B channel module mutually determine that the working status of one of them is abnormal, the following communication processing mechanism is adopted: If the normal channel module detects that the discrete interface of the abnormal channel module is "off", then: a) The normal channel module stops processing any data sent by the abnormal channel module; b) The normal channel module stops sending any data to the abnormal channel module; c) The normal channel module records the fault event of the abnormal channel module being shut down; If the normal channel module detects that the discrete interface of the abnormal channel module is "open" and the synchronous status monitoring data is abnormal, the following communication processing mechanism is adopted: a) Start the three-second timer, and the normal channel module stops processing other data except the synchronization status monitoring data sent by the abnormal channel module until the synchronization status monitoring data is normal; b) The normal channel module stops sending any data except synchronization status monitoring data to the abnormal channel module; c) The normal channel module records the fault event corresponding to the abnormal synchronization status monitoring data of the abnormal channel module; d) The normal channel module continuously monitors the synchronization status monitoring data of the abnormal channel module; e) When the three-second timing is completed, if the synchronization status monitoring data is normal, the communication processing mechanism with normal working status is adopted, otherwise, the normal channel module gives a prompt of abnormal channel module failure.

[0013] A preferred technical solution is that the S channel module serves as a safety channel. When the S channel module monitors that both the A channel module and the B channel module are abnormal, the S channel module takes over all control functions to achieve stable and safe output and interaction of the motor system. Otherwise, the S channel module does not perform any processing.

[0014] The preferred technical solution is that the internal device of the opposite AMSC device uses data synchronization and status bit counting to perform information interaction, realizes information interaction between the two control objects, and achieves the specific process of security technical requirements of different levels and functions of the system as follows: 1) The A channel module and the B channel module have the functions of mutual monitoring, mutual control, mutual switching, and mutual redundancy backup; first, the A channel module and the B channel module determine whether each other's working status is normal; When the following conditions are met at the same time, the A channel module determines that the working status of the B channel module is normal, otherwise it is abnormal; a) The discrete interface status of the A-channel module monitored by the B-channel module is "open"; b) The synchronization status monitoring data of the A channel module to the B channel module is normal; Similarly, when the following conditions are met at the same time, the B channel module determines that the working status of the A channel module is normal, otherwise it is abnormal; a) The B channel module monitors the discrete interface status of the A channel module as "open"; b) The synchronization status monitoring data of the A channel module monitored by the B channel module is normal; 2) When the A channel module and the B channel module mutually determine that the working status is normal, the following communication processing mechanism is adopted: a) Periodically send synchronization status monitoring data to each other; b) continuously monitor each other's discrete interface status; c) Continuously monitor the synchronization status monitoring data sent by each other; 3) When the A channel module and the B channel module mutually determine that the working status of one of them is abnormal, the following communication processing mechanism is adopted: If the normal channel module detects that the discrete interface of the abnormal channel module is "off", then: a) The normal channel module stops processing any data sent by the abnormal channel module; b) The normal channel module stops sending any data to the abnormal channel module; c) The normal channel module records the fault event of the abnormal channel module being shut down; If the normal channel module detects that the discrete interface of the abnormal channel module is "open" and the synchronous status monitoring data is abnormal, the following communication processing mechanism is adopted: a) Start the three-second timer, and the normal channel module stops processing other data except the synchronization status monitoring data sent by the abnormal channel module until the synchronization status monitoring data is normal; b) The normal channel module stops sending any data except synchronization status monitoring data to the abnormal channel module; c) The normal channel module records the fault event corresponding to the abnormal synchronization status monitoring data of the abnormal channel module; d) The normal channel module continuously monitors the synchronization status monitoring data of the abnormal channel module; e) When the three-second timing is completed, if the synchronization status monitoring data is normal, the communication processing mechanism with normal working status is adopted, otherwise, the normal channel module gives a prompt of abnormal channel module failure.

[0015] The preferred technical solution is that the data stream format definition of all synchronization status monitoring data adopts the following standards: Data byte 1 and data byte 2 are byte frame headers, and the data is designed to be 0x55, indicating the start of the data stream; Data byte 3 to data byte 14 are byte status monitoring data. Only one byte in the data is 1. The data stream gradually decreases from the low byte to the high byte in a cycle. When it shifts to the 14th byte, it shifts again from the 9th byte. Data byte 15 and data byte 16 are the byte frame tail, and the data is designed to be 0xAA, indicating the end of the data stream.

[0016] Another object of the present invention is to provide a control method of an onboard air management system controller, which comprises the following steps: First, perform initialization and self-test. During the initialization and self-test process, a ten-second time window is set. During this ten-second time window, the following processing is continuously performed: 1) Before the local AMSC device communicates with the opposite AMSC device, they first determine whether the working status of each other is normal; When the following conditions are met at the same time, the AMSC device on this side determines that the working status of the AMSC device on the other side is normal, otherwise it is abnormal; a) The AMSC device on the local side monitors that the discrete interface status of the AMSC device on the opposite side is "open"; b) The synchronization status monitoring data of the AMSC device on the local side monitored by the AMSC device on the opposite side is normal; Similarly, when the following conditions are met at the same time, the AMSC device on the other side determines that the working status of the AMSC device on the local side is normal, otherwise it is abnormal; a) The AMSC device on the other side monitors that the discrete interface status of the AMSC device on the local side is "open"; b) The synchronization status monitoring data of the AMSC device on the opposite side monitored by the AMSC device on the local side is normal; 2) When the local AMSC device and the opposite AMSC device determine that the working status is normal, the following communication processing mechanism is adopted: a) Periodically send synchronization status monitoring data to each other; b) continuously monitor each other's discrete interface status; c) Continuously monitor the synchronization status monitoring data sent by each other; 3) When the local AMSC device and the opposite AMSC device mutually determine that one of them is in an abnormal working state, the following communication processing mechanism is adopted: If the normal AMSC device detects that the discrete interface of the abnormal AMSC device is "off", then: a) The normal AMSC equipment stops processing any data sent by the abnormal AMSC equipment; b) The normal AMSC equipment stops sending any data to the abnormal AMSC equipment; c) The normal AMSC equipment records the fault event of the abnormal AMSC equipment shutting down; If the normal AMSC device detects that the discrete interface of the abnormal AMSC device is "open" and the synchronization status monitoring data is abnormal, the following communication processing mechanism is adopted: a) The normal AMSC equipment stops processing other data except the synchronization status monitoring data sent by the abnormal AMSC equipment until the synchronization status monitoring data becomes normal; b) The normal AMSC equipment stops sending any data except synchronization status monitoring data to the abnormal AMSC equipment; c) The normal AMSC device records the fault event corresponding to the abnormal synchronization status monitoring data of the abnormal AMSC device; d) The normal AMSC equipment continuously monitors the synchronization status monitoring data of the abnormal AMSC equipment; e) Normal AMSC equipment gives a prompt of abnormal AMSC equipment failure; f) When the normal AMSC device continuously monitors that the synchronization status monitoring data sent by the abnormal AMSC device is normal for eight consecutive cycles, it re-determines that the corresponding abnormal AMSC device is in a normal working state, and restarts the communication processing mechanism when the working state is normal.

[0017] Compared with the prior art, the control system and method of the airborne air management system controller of the present invention have the following beneficial effects: 1. The present invention can realize the functions of startup management, data synchronization, status monitoring, etc. of the left and right controllers of the AMS system. At the same time, the internal and external monitoring and control mechanisms of the AMS system adopt redundant backup design, which effectively supports improving the reliability and safety of the system and can be applied to the status data format definition of the interactive monitoring mechanism. The present invention can reduce the development difficulty and shorten the development cycle by improving the hardware platform architecture design of the AMSC controller and abandoning FPGA to reduce the airworthiness difficulty and R&D cost.

[0018] 2. The bus of the present invention has multiple modules, and different modules adopt different data communication forms to perform status monitoring and data synchronization, which can further improve the reliability and safety indicators of airborne equipment.

[0019] 3. The processing boards of the AMSC controller of the present invention adopt different architectures, such as different forms of DSP architecture and MCU architecture, so that the reliability and security indicators of the system of the present invention are improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a schematic diagram of external interaction of a control system of an airborne air management system controller according to Embodiment 1 of the present invention.

[0021] Figure 2 This is a schematic diagram of the internal interactions of a control system of an airborne air management system controller according to Example 1 of the present invention.

[0022] Figure 3 This is a schematic diagram of the data stream format of the synchronization status monitoring data in Example 1 of the present invention. DETAILED DESCRIPTION

[0023] Reference Figure 1-3 The control system and control method of an airborne air management system controller of the present invention are further described.

[0024] Embodiment 1

[0025] like Figure 1As shown: a control system of an airborne air management system controller, including an AMSC device on this side and an AMSC device on the opposite side; the hardware of the AMSC device on this side is completely consistent with that of the AMSC device on the opposite side, the AMSC device on this side is connected to the AMSC device on the opposite side by using a CAN bus and an RS422 bus, and the internal devices of the AMSC device on this side, the internal devices of the AMSC device on the opposite side, and the AMSC device on this side and the AMSC device on the opposite side all use data synchronization and status bit counting to perform information interaction, thereby realizing information interaction between two control objects and meeting the safety technical requirements of different levels and different functions of the system; The AMSC device on this side and the AMSC device on the opposite side are respectively connected to the external motor system, airborne power system, and avionics system, and the AMSC device on this side and the AMSC device on the opposite side are connected with a debugging interface through the RS232 bus; the debugging interface is used for software debugging, software upgrading, software data loading and transceiver control; the airborne power system is used to provide DC power to the AMSC device on this side and the AMSC device on the opposite side; the motor system interacts with the AMSC device on this side and the AMSC device on the opposite side for analog signals, digital signals, discrete signals, and optocoupler signals; the avionics system interacts with the AMSC device on this side and the AMSC device on the opposite side for data transmission through the ARINC429 bus.

[0026] The external cross-linking relationship of the control system of the airborne air management system controller is as follows Figure 1 As shown, the AMSC equipment on this side and the AMSC equipment on the opposite side are connected to the electromechanical system through analog interfaces, discrete interfaces, and digital bus interfaces respectively, connected to the airborne power system through a DC power interface, and connected to the avionics system through an ARINC429 bus (digital information transmission system interface bus); the AMSC equipment on this side and the AMSC equipment on the opposite side are connected through a CAN bus (Controller Area Network AMSC, equipment local area network bus) and an RS422 bus (balanced voltage digital interface bus).

[0027] The main functions of the control system of the airborne air management system controller are designed as follows: a) Signal acquisition function: Receive analog signals, optocoupler signals, and discrete signals from other system devices such as motors and sensors through analog interfaces and discrete interfaces, and digitize and store the signals through analog-to-digital circuit conversion.

[0028] b) Digital bus communication control function: The AMSC equipment on this side communicates with the motor system and avionics system through the CAN, RS422, and ARIINC429 digital buses respectively, and transmits data through the transceiver bus.

[0029] c) Motor control function: The analog interface outputs the motor drive analog signal and the status indication discrete signal through the digital-to-analog conversion circuit to realize the motor related control functions.

[0030] d) Software loading and debugging function: It has the function of sending and receiving control and software loading data through the RS232 bus interface to realize software debugging, software upgrading and other functions.

[0031] The hardware platform of the AMSC device on this side or the AMSC device on the other side adopts the hardware architecture of DSP plus DSP architecture with MCU, and the internal communication of the device is carried out through the redundant backup mode of CAN bus and I2C bus. For the specific architecture design, see Figure 2 As shown, the main functions of the components of the AMSC device on this side or the AMSC device on the other side are as follows: a) A channel module / B channel module: The hardware design of A channel module and B channel module is completely consistent, using DSP hardware architecture, mainly realizing the control function under normal conditions. A channel module and B channel module back up each other and use CAN bus synchronization circuit working state. As long as one of the channels has no hardware fault, the equipment can work normally.

[0032] b) S channel module: The S channel module adopts the hardware architecture design of MCU, which is independent and dissimilar to the hardware of A channel module / B channel module, and can effectively avoid common mode failure. The S channel module is a safety channel, which constantly monitors the status of A channel module / B channel module through I2C bus data. If both A channel module / B channel module fail or extreme conditions such as ultra-low power supply voltage occur, the S channel module takes over all control functions to achieve stable and safe output of motor system control signals, ensuring that there are no extreme conditions such as unconventional, erroneous, and beyond-boundary conditions.

[0033] c) Motherboard module: mainly used for signal isolation and caching of each interface, and distribution of signals or instructions to each channel, while providing power for the circuits of each channel.

[0034] d) Connector module: used as external interface.

[0035] The interactive monitoring process between the local AMSC and the remote AMSC is as follows: The interaction between the local AMSC device and the opposite AMSC device, the internal interaction of the local AMSC device or the internal interaction of the opposite AMSC device are all realized by the synchronous state monitoring mechanism. The so-called synchronous state monitoring mechanism is to realize the information interaction between the two control objects by means of data synchronization and state bit counting, so as to meet the security technical requirements of different levels and functions of the system.

[0036] 1) The opposite side AMSC equipment status monitoring and processing mechanism Before the local AMSC device communicates with the opposite AMSC device, it needs to determine the working status of the opposite device first.

[0037] When the following conditions are met at the same time, the local AMSC device determines that the working status of the opposite AMSC device is normal: a) The AMSC device on this side detects that the discrete interface status of the AMSC device on the other side is "on", indicating that the AMSC device on the other side has been powered on; b) The AMSC device on this side detects that the synchronization status monitoring data sent by the AMSC device on the other side is normal.

[0038] Similarly, when the following conditions are met at the same time, the AMSC device on the other side determines that the working status of the AMSC device on the local side is normal, otherwise it is abnormal; a) The AMSC device on the other side monitors that the discrete interface status of the AMSC device on the local side is "open"; b) The synchronization status monitoring data of the AMSC device on the other side monitored by the AMSC device on the local side is normal.

[0039] When any of the following situations occurs, the AMSC device on this side determines that the AMSC device on the other side is abnormal (the same applies to the AMSC device on the other side determining that the AMSC device on this side is abnormal): a) The AMSC device on this side monitors that the discrete interface status of the AMSC device on the other side is "off", indicating that the AMSC device on the other side has been shut down; b) The AMSC device on this side detects that the synchronization status monitoring data of the AMSC device on the other side is abnormal.

[0040] The switching conditions for the local AMSC to determine whether the opposite AMSC is normal or abnormal are as follows: When the following situations occur simultaneously, the local AMSC device can switch the status of the abnormal opposite AMSC device to normal status (the same applies to the opposite AMSC device's identification of the local AMSC device): a) The AMSC device on this side detects that the discrete interface status of the AMSC device on the other side is "open"; b) The AMSC device on the local side receives correct synchronization status monitoring data continuously transmitted from the AMSC device on the opposite side for at least 8 consecutive cycles.

[0041] When any of the following situations occurs, the local AMSC device may switch the status of the normal opposite AMSC device to an abnormal status (the same applies to the opposite AMSC device's identification of the local AMSC device): a) The AMSC device on this side detects that the discrete interface status of the AMSC device on the other side is "off"; b) The AMSC device on this side detects that the synchronization status monitoring data sent by the AMSC device on the other side are all 0; c) The AMSC device on this side detects that the position of "1" in the synchronization status monitoring data sent by the AMSC device on the other side is incorrect; d) The AMSC device on the local side detects that multiple "1"s appear in the synchronization status monitoring data sent by the AMSC device on the opposite side; e) The AMSC device on this side does not receive the synchronization status monitoring data sent by the AMSC device on the other side for three seconds.

[0042] The communication processing mechanism between the local AMSC device and the remote AMSC device in a normal state is as follows: In the normal synchronization state, the AMSC equipment on this side should: a) The local AMSC device periodically sends synchronization status monitoring data to the opposite AMSC device; b) The local AMSC device continuously monitors the discrete interface status of the opposite AMSC device; c) The AMSC device on this side continuously monitors the periodic synchronization status monitoring data sent by the AMSC device on the other side.

[0043] The communication processing mechanism between the local AMSC device and the remote AMSC device under abnormal conditions is as follows: First, if the discrete interface status of the opposite AMSC device is "off" (that is, the opposite AMSC device is powered off), the local AMSC device should: a) The AMSC device on this side stops processing any data from the AMSC device on the other side; b) The AMSC device on this side stops sending any data to the AMSC device on the other side; c) The AMSC device on this side records the fault event of "the AMSC device on the opposite side is shut down"; d) The AMSC device on this side continuously monitors the discrete interface status of the AMSC device on the other side.

[0044] Secondly, when the local AMSC device monitors that the discrete interface status of the opposite AMSC device is "on" (that is, the opposite AMSC device is not shut down), but detects that the synchronization status monitoring data of the opposite AMSC device is abnormal, the local AMSC device should: a) The AMSC device on the local side stops processing other data except the synchronization status monitoring data sent by the AMSC device on the opposite side until the synchronization status monitoring data becomes normal; b) The AMSC device on the local side stops sending any data except synchronization status monitoring data to the AMSC device on the opposite side; c) The AMSC device on this side records the fault event corresponding to abnormal synchronization status monitoring data of the AMSC device on the other side; d) The AMSC equipment on this side continuously monitors the synchronization status monitoring data of the AMSC equipment on the other side; e) The AMSC equipment on this side gives a prompt that the AMSC equipment on the other side is faulty.

[0045] like Figure 2 As shown in the figure, the hardware of the AMSC device on this side and the AMSC device on the other side are completely the same. The AMSC device on this side or the AMSC device on the other side respectively includes: A channel module, B channel module, S channel module, motherboard module, connector module (because Figure 2 The internal hardware of the AMSC device on the other side is exactly the same as that of the AMSC device on this side. Figure 2 The internal hardware architecture of the opposite AMSC device is omitted in the figure). The internal interaction principles of the local AMSC device or the opposite AMSC device are as follows: 1) The A channel module and the B channel module have the functions of mutual monitoring, mutual control, mutual switching, and mutual redundancy backup; first, the A channel module and the B channel module determine whether each other's working status is normal; When the following conditions are met at the same time, the A channel module determines that the working status of the B channel module is normal, otherwise it is abnormal; a) The discrete interface status of the A-channel module monitored by the B-channel module is "open"; b) The synchronization status monitoring data of the A channel module to the B channel module is normal; Similarly, when the following conditions are met at the same time, the B channel module determines that the working status of the A channel module is normal, otherwise it is abnormal; a) The B channel module monitors the discrete interface status of the A channel module as "open"; b) The synchronization status monitoring data of the A channel module monitored by the B channel module is normal; 2) When the A channel module and the B channel module mutually determine that the working status is normal, the following communication processing mechanism is adopted: a) Periodically send synchronization status monitoring data to each other; b) continuously monitor each other's discrete interface status; c) Continuously monitor the synchronization status monitoring data sent by each other; 3) When the A channel module and the B channel module mutually determine that the working status of one of them is abnormal, the following communication processing mechanism is adopted: If the normal channel module detects that the discrete interface of the abnormal channel module is "off", then: a) The normal channel module stops processing any data sent by the abnormal channel module; b) The normal channel module stops sending any data to the abnormal channel module; c) The normal channel module records the fault event of the abnormal channel module being shut down; If the normal channel module detects that the discrete interface of the abnormal channel module is "open" and the synchronous status monitoring data is abnormal, the following communication processing mechanism is adopted: a) Start the three-second timer, and the normal channel module stops processing other data except the synchronization status monitoring data sent by the abnormal channel module until the synchronization status monitoring data is normal; b) The normal channel module stops sending any data except synchronization status monitoring data to the abnormal channel module; c) The normal channel module records the fault event corresponding to the abnormal synchronization status monitoring data of the abnormal channel module; d) The normal channel module continuously monitors the synchronization status monitoring data of the abnormal channel module; e) When the three-second timing is completed, if the synchronization status monitoring data is normal, the communication processing mechanism with normal working status is adopted, otherwise, the normal channel module gives a prompt of abnormal channel module failure.

[0046] Generally, in this embodiment, the B channel module serves as a backup channel of the A channel module. If the B channel module detects that the discrete interface state of the A channel module is "off", the B channel module takes over the control channel function.

[0047] The S channel module serves as a safety channel for the A channel module and the B channel module. If the S channel module detects that the discrete interface states of the A channel module and the B channel module are both "off", it will directly determine that the A channel module and the B channel module are both abnormal, and the S channel module will take over the control channel function. Otherwise, the S channel module will not take any action.

[0048] like Figure 3 As shown, the core interactive information of the control system of the airborne air management system controller of the present invention is realized by designing the monitoring data stream transmitted by the bus. The monitoring data stream is generated by each channel and its status data is transmitted to each channel. After being processed by the channel with the current control authority, it is distributed to the motherboard module (main board) through the connector interface for transmission. The data stream format definition standard of the synchronous status monitoring data in all the aforementioned synchronous status monitoring processes is as follows: a) Byte frame header Byte 1 and byte 2 of the synchronization status monitoring data are the byte frame header, and the data is designed to be 0x55, indicating the start of the data stream.

[0049] b) Byte status monitoring data Bytes 3 to 14 of the synchronous status monitoring data are status monitoring data, and only one byte in the data is 1. The data stream gradually shifts from the low byte to the high byte according to the cycle; when the shift reaches the 14th byte, it starts to shift again from the 9th byte.

[0050] For example, when the local AMSC receives synchronization status monitoring data of any period transmitted by the opposite AMSC, it can know the synchronization status monitoring data to be sent by the opposite AMSC in the next period, and thus can track and monitor whether the opposite AMSC is working normally.

[0051] c) Byte frame tail Bytes 15 and 16 of the synchronization status monitoring data are the byte frame tails, and the data is designed to be 0xAA, indicating the end of the data stream.

[0052] The above is the working process of the control system of the airborne air management system controller during normal operation. When the control system of the airborne air management system controller is turned on, since the entire control system needs to spend a certain amount of time to initialize and self-check, during this period of time, the synchronization status monitoring data output by both the AMSC device on this side and the AMSC device on the opposite side may be abnormal. Therefore, it is necessary to set a startup initialization self-check window period for the entire control system. In this embodiment, a ten-second time window of a special processing mechanism at startup will be set. Within this ten-second time window, the AMSC device on this side will continue to monitor the AMSC device on the opposite side, and the AMSC device on the opposite side will also continue to monitor the AMSC device on this side. If abnormality is detected during the time window period, prompts will be given to each other and monitoring will continue until the end of the ten-second window period. If it is still detected as abnormal, a fault alarm prompt will be given; if the ten-second window period ends and the monitoring is normal, the above-mentioned normal processing mechanism will be directly entered.

[0053] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. It should be pointed out that any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A control system for an onboard air management system controller, characterized in that: It includes an AMSC device on this side and an AMSC device on the opposite side; the hardware of the AMSC device on this side is completely consistent with that of the AMSC device on the opposite side, the AMSC device on this side is connected to the AMSC device on the opposite side by using a CAN bus and an RS422 bus, and the internal devices of the AMSC device on this side, the internal devices of the AMSC device on the opposite side, and the AMSC device on this side and the AMSC device on the opposite side all use data synchronization and status bit counting to perform information interaction, thereby realizing information interaction between the two control objects and meeting the security technical requirements of different levels and different functions of the system; The AMSC device on this side and the AMSC device on the opposite side are respectively connected to the external motor system, airborne power system, and avionics system, and the AMSC device on this side and the AMSC device on the opposite side are connected with a debugging interface through the RS232 bus; the debugging interface is used for software debugging, software upgrading, software data loading and transceiver control; the airborne power system is used to provide DC power to the AMSC device on this side and the AMSC device on the opposite side; the motor system interacts with the AMSC device on this side and the AMSC device on the opposite side for analog signals, digital signals, discrete signals, and optocoupler signals; the avionics system interacts with the AMSC device on this side and the AMSC device on the opposite side for data transmission through the ARINC429 bus.

2. The control system of an onboard air management system controller according to claim 1, characterized in that: The local AMSC device and the opposite AMSC device respectively include: an A channel module, a B channel module, an S channel module, a motherboard module, and a connector module; The hardware of the A channel module and the B channel module are completely consistent, and adopt the DSP hardware architecture. The A channel module and the B channel module back up each other and adopt the CAN bus synchronization circuit working state; The S channel module adopts the hardware architecture of MCU, and the hardware of the S channel module is independent and dissimilar to the hardware of the A channel module and the B channel module; the S channel module is a safety channel, and uses the I2C bus to monitor the status of the A channel module and the B channel module at all times; if both the A channel module and the B channel module fail, the S channel module takes over all control functions to achieve stable and safe output and interaction of the motor system; The motherboard module is used to provide the power delivered by the onboard power system to the A channel module, the B channel module, the S channel module, and the connector module, and is also used for signal isolation and signal buffering of each interface and signal distribution to each channel; The connector module is used as an external interface.

3. The control system of an onboard air management system controller according to claim 2, characterized in that: If an ultra-low voltage power supply occurs, the S channel module takes over all control functions and provides stable and safe output and interaction to the motor system.

4. The control system of the onboard air management system controller according to claim 3, characterized in that: The AMSC device on the local side and the AMSC device on the opposite side both use data synchronization and status bit counting to exchange information, realize information exchange between the two control objects, and meet the security technical requirements of different levels and functions of the system. The specific process is: 1) Before the local AMSC device communicates with the opposite AMSC device, they first determine whether the working status of each other is normal; When the following conditions are met at the same time, the AMSC device on this side determines that the working status of the AMSC device on the other side is normal, otherwise it is abnormal; a) The AMSC device on the local side monitors that the discrete interface status of the AMSC device on the opposite side is "open"; b) The synchronization status monitoring data of the AMSC device on the local side monitored by the AMSC device on the opposite side is normal; Similarly, when the following conditions are met at the same time, the AMSC device on the other side determines that the working status of the AMSC device on the local side is normal, otherwise it is abnormal; a) The AMSC device on the other side monitors that the discrete interface status of the AMSC device on the local side is "open"; b) The synchronization status monitoring data of the AMSC device on the opposite side monitored by the AMSC device on the local side is normal; 2) When the local AMSC device and the opposite AMSC device determine that the working status is normal, the following communication processing mechanism is adopted: a) Periodically send synchronization status monitoring data to each other; b) continuously monitor each other's discrete interface status; c) Continuously monitor the synchronization status monitoring data sent by each other; 3) When the local AMSC device and the opposite AMSC device mutually determine that one of them is in an abnormal working state, the following communication processing mechanism is adopted: If the normal AMSC device detects that the discrete interface of the abnormal AMSC device is "off", then: a) The normal AMSC equipment stops processing any data sent by the abnormal AMSC equipment; b) The normal AMSC equipment stops sending any data to the abnormal AMSC equipment; c) The normal AMSC equipment records the fault event of the abnormal AMSC equipment shutting down; If the normal AMSC device detects that the discrete interface of the abnormal AMSC device is "on" and the synchronization status monitoring data is abnormal, the following communication processing mechanism is adopted: a) The normal AMSC equipment stops processing other data except the synchronization status monitoring data sent by the abnormal AMSC equipment until the synchronization status monitoring data becomes normal; b) The normal AMSC equipment stops sending any data except synchronization status monitoring data to the abnormal AMSC equipment; c) The normal AMSC device records the fault event corresponding to the abnormal synchronization status monitoring data of the abnormal AMSC device; d) The normal AMSC equipment continuously monitors the synchronization status monitoring data of the abnormal AMSC equipment; e) The normal AMSC equipment gives a prompt of abnormal AMSC equipment failure.

5. The control system of the onboard air management system controller according to claim 4, characterized in that: When the normal AMSC device continuously monitors that the synchronization status monitoring data sent by the abnormal AMSC device is normal for eight consecutive cycles, it re-determines that the corresponding abnormal AMSC device is in a normal working state and restarts the communication processing mechanism when the working state is normal.

6. The control system of the onboard air management system controller according to claim 5, characterized in that: The internal devices of the AMSC device on this side use data synchronization and status bit counting to exchange information, realize information exchange between two control objects, and meet the security technical requirements of different levels and functions of the system. The specific process is as follows: 1) The A channel module and the B channel module have the functions of mutual monitoring, mutual control, mutual switching, and mutual redundancy backup; first, the A channel module and the B channel module determine whether each other's working status is normal; When the following conditions are met at the same time, the A channel module determines that the working status of the B channel module is normal, otherwise it is abnormal; a) The discrete interface status of the A channel module monitoring the B channel module is "open"; b) The synchronization status monitoring data of the A channel module to the B channel module is normal; Similarly, when the following conditions are met at the same time, the B channel module determines that the working status of the A channel module is normal, otherwise it is abnormal; a) The B channel module monitors the discrete interface status of the A channel module as "open"; b) The synchronization status monitoring data of the A channel module monitored by the B channel module is normal; 2) When the A channel module and the B channel module mutually determine that the working status is normal, the following communication processing mechanism is adopted: a) Periodically send synchronization status monitoring data to each other; b) continuously monitor each other's discrete interface status; c) Continuously monitor the synchronization status monitoring data sent by each other; 3) When the A channel module and the B channel module mutually determine that the working status of one of them is abnormal, the following communication processing mechanism is adopted: If the normal channel module detects that the discrete interface of the abnormal channel module is "off", then: a) The normal channel module stops processing any data sent by the abnormal channel module; b) The normal channel module stops sending any data to the abnormal channel module; c) The normal channel module records the fault event of the abnormal channel module being shut down; If the normal channel module detects that the discrete interface of the abnormal channel module is "open" and the synchronous status monitoring data is abnormal, the following communication processing mechanism is adopted: a) Start the three-second timer, and the normal channel module stops processing other data except the synchronization status monitoring data sent by the abnormal channel module until the synchronization status monitoring data is normal; b) The normal channel module stops sending any data except synchronization status monitoring data to the abnormal channel module; c) The normal channel module records the fault event corresponding to the abnormal synchronization status monitoring data of the abnormal channel module; d) The normal channel module continuously monitors the synchronization status monitoring data of the abnormal channel module; e) When the three-second timing is completed, if the synchronization status monitoring data is normal, the communication processing mechanism with normal working status is adopted, otherwise, the normal channel module gives a prompt of abnormal channel module failure.

7. The control system of the onboard air management system controller according to claim 6, characterized in that: The S channel module serves as a safety channel. When the S channel module detects that both the A channel module and the B channel module are abnormal, the S channel module takes over all control functions to achieve stable and safe output and interaction of the motor system. Otherwise, the S channel module does not perform any processing.

8. The control system of an onboard air management system controller according to claim 5, characterized in that: The internal devices of the opposite AMSC device use data synchronization and status bit counting to perform information exchange, realize information exchange between the two control objects, and meet the security technical requirements of different levels and functions of the system. The specific process is as follows: 1) The A channel module and the B channel module have the functions of mutual monitoring, mutual control, mutual switching, and mutual redundancy backup; first, the A channel module and the B channel module determine whether each other's working status is normal; When the following conditions are met at the same time, the A channel module determines that the working status of the B channel module is normal, otherwise it is abnormal; a) The discrete interface status of the A channel module monitoring the B channel module is "open"; b) The synchronization status monitoring data of the A channel module to the B channel module is normal; Similarly, when the following conditions are met at the same time, the B channel module determines that the working status of the A channel module is normal, otherwise it is abnormal; a) The B channel module monitors the discrete interface status of the A channel module as "open"; b) The synchronization status monitoring data of the A channel module monitored by the B channel module is normal; 2) When the A channel module and the B channel module mutually determine that the working status is normal, the following communication processing mechanism is adopted: a) Periodically send synchronization status monitoring data to each other; b) continuously monitor each other's discrete interface status; c) Continuously monitor the synchronization status monitoring data sent by each other; 3) When the A channel module and the B channel module mutually determine that the working status of one of them is abnormal, the following communication processing mechanism is adopted: If the normal channel module detects that the discrete interface of the abnormal channel module is "off", then: a) The normal channel module stops processing any data sent by the abnormal channel module; b) The normal channel module stops sending any data to the abnormal channel module; c) The normal channel module records the fault event of the abnormal channel module being shut down; If the normal channel module detects that the discrete interface of the abnormal channel module is "open" and the synchronous status monitoring data is abnormal, the following communication processing mechanism is adopted: a) Start the three-second timer, and the normal channel module stops processing other data except the synchronization status monitoring data sent by the abnormal channel module until the synchronization status monitoring data is normal; b) The normal channel module stops sending any data except synchronization status monitoring data to the abnormal channel module; c) The normal channel module records the fault event corresponding to the abnormal synchronization status monitoring data of the abnormal channel module; d) The normal channel module continuously monitors the synchronization status monitoring data of the abnormal channel module; e) When the three-second timing is completed, if the synchronization status monitoring data is normal, the communication processing mechanism with normal working status is adopted, otherwise, the normal channel module gives a prompt of abnormal channel module failure.

9. A control system of an onboard air management system controller according to any one of claims 4 to 8, characterized in that: The data stream format definition of all synchronization status monitoring data adopts the following standards: Data byte 1 and data byte 2 are byte frame headers, and the data is designed to be 0x55, indicating the start of the data stream; Data byte 3 to data byte 14 are byte status monitoring data. Only one byte in the data is 1. The data stream gradually decreases from the low byte to the high byte in a cycle. When it shifts to the 14th byte, it shifts again from the 9th byte. Data byte 15 and data byte 16 are the byte frame tail, and the data is designed to be 0xAA, indicating the end of the data stream.

10. A control method for an onboard air management system controller, characterized in that: It includes the following steps: First, perform initialization and self-test. During the initialization and self-test process, a ten-second time window is set. During this ten-second time window, the following processing is continuously performed: 1) Before the local AMSC device communicates with the opposite AMSC device, they first determine whether the working status of each other is normal; When the following conditions are met at the same time, the AMSC device on this side determines that the working status of the AMSC device on the other side is normal, otherwise it is abnormal; a) The AMSC device on the local side monitors that the discrete interface status of the AMSC device on the opposite side is "open"; b) The synchronization status monitoring data of the AMSC device on the local side monitored by the AMSC device on the opposite side is normal; Similarly, when the following conditions are met at the same time, the AMSC device on the other side determines that the working status of the AMSC device on the local side is normal, otherwise it is abnormal; a) The AMSC device on the other side monitors that the discrete interface status of the AMSC device on the local side is "open"; b) The synchronization status monitoring data of the AMSC device on the opposite side monitored by the AMSC device on the local side is normal; 2) When the local AMSC device and the opposite AMSC device determine that the working status is normal, the following communication processing mechanism is adopted: a) Periodically send synchronization status monitoring data to each other; b) continuously monitor each other's discrete interface status; c) Continuously monitor the synchronization status monitoring data sent by each other; 3) When the local AMSC device and the opposite AMSC device mutually determine that one of them is in an abnormal working state, the following communication processing mechanism is adopted: If the normal AMSC device detects that the discrete interface of the abnormal AMSC device is "off", then: a) The normal AMSC equipment stops processing any data sent by the abnormal AMSC equipment; b) The normal AMSC equipment stops sending any data to the abnormal AMSC equipment; c) The normal AMSC equipment records the fault event of the abnormal AMSC equipment shutting down; If the normal AMSC device detects that the discrete interface of the abnormal AMSC device is "on" and the synchronization status monitoring data is abnormal, the following communication processing mechanism is adopted: a) The normal AMSC equipment stops processing other data except the synchronization status monitoring data sent by the abnormal AMSC equipment until the synchronization status monitoring data becomes normal; b) The normal AMSC equipment stops sending any data except synchronization status monitoring data to the abnormal AMSC equipment; c) The normal AMSC device records the fault event corresponding to the abnormal synchronization status monitoring data of the abnormal AMSC device; d) The normal AMSC equipment continuously monitors the synchronization status monitoring data of the abnormal AMSC equipment; e) Normal AMSC equipment gives a prompt of abnormal AMSC equipment failure; f) When the normal AMSC device continuously monitors that the synchronization status monitoring data sent by the abnormal AMSC device is normal for eight consecutive cycles, it re-determines that the corresponding abnormal AMSC device is in a normal working state, and restarts the communication processing mechanism when the working state is normal.

Images