Airplane autopilot control logic safety evaluation method

Abstract

The invention belongs to the technical field of aircraft flight control systems, and particularly relates to an aircraft autopilot control logic safety evaluation method, which comprises the following steps: acquiring all safety factors, and dividing all safety factors into first-level safety factors, second-level safety factors, third-level safety factors and necessary safety factors; when the safety factor meets the condition, assigning 1, otherwise assigning 0; adding different coefficients to the first-level safety factor and the second-level safety factor, and accumulating the coefficient of each safety factor and the assigned value to obtain a safety evaluation value; when any necessary safety factor does not meet the condition, assigning 0 to the safety evaluation value; safety evaluation is carried out on the control logic of the autopilot based on the safety evaluation value, the safety of the system is improved, and aircraft accidents caused by the design of the autopilot can be eliminated.

Description

Technical Field

[0001] This application belongs to the technical field of aircraft flight control systems, and particularly relates to a method for evaluating the safety of an aircraft autopilot control logic. Background Art

[0002] During long endurance or complex mission operations, pilots need to rely on the autopilot to perform flight operation tasks to relieve fatigue and allocate more energy to execute tasks. If the control logic of the autopilot is not reasonably and adequately designed, it may lead to flight safety problems and even aircraft accidents. Summary of the Invention

[0003] To solve the above problems, this application provides a method for evaluating the safety of an aircraft autopilot control logic, including:

[0004] Obtain all safety factors, and classify all safety factors into primary safety factors, secondary safety factors, tertiary safety factors, and necessary safety factors;

[0005] When a safety factor meets the conditions, assign a value of 1, otherwise assign a value of 0;

[0006] Add different coefficients to the primary safety factors, secondary safety factors, and tertiary safety factors, and add the product of the coefficient of each safety factor and the assigned value to obtain a safety evaluation value;

[0007] When any necessary safety factor does not meet the conditions, assign a value of 0 to the safety evaluation value;

[0008] Based on the safety evaluation value, conduct a safety evaluation of the autopilot control logic.

[0009] Preferably, the primary safety factors include: whether the crew can always obtain autopilot information, whether it can avoid receiving crew input and autopilot input simultaneously, and whether it issues audible and visual warnings for unexpected operations;

[0010] The secondary safety factors include: whether the autopilot does not have full-authority control surface manipulation or full-envelope manipulation, whether all inputs have redundancy, whether there are no noticeable transients when turning on and off the autopilot, whether the crew has a separate button to turn off the autopilot, whether the landing mode includes two control modes of azimuth and glide; whether all crew inputs are non-ambiguous, and whether the autopilot is set with conditions for modal disconnection.

[0011] Preferably, for the safety factor of whether the crew can always obtain autopilot information, assign a value of 1 when all of the following conditions are met, otherwise assign a value of 0;

[0012] The conditions include: the display information is displayed through the HUD, and the display information includes at least pitch, roll, and aircraft mode.

[0013] Preferably, when the safety factors for whether it is possible to avoid simultaneously receiving crew inputs and autopilot inputs all meet the following conditions, assign 1; otherwise, assign 0;

[0014] The specific conditions include: when in the autopilot mode for reducing pilot workload, there is a dead zone to avoid frequent non-command disconnections caused by crew inputs; for safety-related autopilot modes, there is a limit set to prevent the auto-trim from continuously operating up to the maximum authority; when the crew enters a potential dangerous state, there is a module to prompt the crew by increasing the control force or reducing the effective control.

[0015] Preferably, when the safety factors for whether to issue audible and visual warnings for unexpected operations all meet the following conditions, assign 1; otherwise, assign 0;

[0016] The specific conditions include: there are advisory-level warnings for non-command disconnections, unexpected mode transitions, and non-command activations;

[0017] For expected mode transitions or activating incompatible modes, there are audible and flashing indications;

[0018] When the autopilot cannot be activated, there is an alarm function;

[0019] When the aircraft state exceeds the operating range of the autopilot, the autopilot disconnects and displays the reason for the disconnection.

[0020] Preferably, when the safety factors for whether the autopilot does not have full-authority control surface manipulation or full-envelope manipulation all meet the following conditions, assign 1; otherwise, assign 0;

[0021] The specific conditions include:

[0022] The authority of the autopilot does not exceed 50% to 75% of the full control authority;

[0023] For large transport aircraft or civil aircraft, when the roll angle exceeds 45 degrees, the pitch angle exceeds 30 degrees, or the rate on any axis exceeds 10 degrees / second, the autopilot should disconnect.

[0024] Preferably, when the safety factors for whether all inputs have redundancy all meet the following conditions, assign 1; otherwise, assign 0;

[0025] The conditions include: the input signals of the autopilot have redundancy and are used after being processed by the input management system;

[0026] At any time, when a fault occurs in the autopilot system or the input signals, the autopilot disconnects and ensures a smaller transient;

[0027] When the system or redundant signals degrade to a single channel, the autopilot is not engaged.

[0028] Preferably, when the safety factors of engaging and disengaging the autopilot without noticeable transients are both satisfied with the following conditions, assign 1; otherwise, assign 0.

[0029] The conditions include: when the autopilot is disengaged due to a fault, the transient of sub-mode conversion is less than a set value.

[0030] The speed of the autopilot's automatic trim bias is less than a set value.

[0031] Preferably, when the safety factors that all crew inputs are not ambiguous are both satisfied with the following conditions, assign 1; otherwise, assign 0.

[0032] Each mode has a corresponding physical or virtual button, and for a specific mode, there is a unique way to engage.

[0033] Preferably, the weight of the primary safety factors accounts for 45% - 75% of the total weight.

[0034] The advantages of this application include: the safety evaluation method proposed in this patent solves the problem of the lack of evaluation criteria for the autopilot control logic, is beneficial to improving the safety of the system, and can help eliminate aircraft accidents caused by the design of the autopilot. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 is a preferred embodiment of this application DETAILED DESCRIPTION

[0036] To make the technical solutions and their advantages of this application clearer, the technical solutions of this application will be further clearly and completely described in detail below with reference to the drawings. It can be understood that the specific embodiments described herein are only partial embodiments of this application, which are only used to explain this application and are not intended to limit this application. It should be noted that for the convenience of description, only the parts related to this application are shown in the drawings, and other related parts can refer to the general design. Without conflict, the embodiments and the technical features in the embodiments of this application can be combined with each other to obtain new embodiments.

[0037] As Figure 1 shown, this application provides a method for evaluating the safety of an aircraft autopilot control logic, including:

[0038] Obtain all safety factors, and classify all safety factors into primary safety factors, secondary safety factors, tertiary safety factors, and necessary safety factors.

[0039] When the safety factor meets the condition, assign 1; otherwise, assign 0.

[0040] Add different coefficients to the primary safety factors, secondary safety factors, and tertiary safety factors, and add the product of the coefficient of each safety factor and its assigned value to obtain the safety evaluation value;

[0041] When any necessary safety factor does not meet the conditions, assign the safety evaluation value as 0;

[0042] Based on the safety evaluation value, conduct a safety evaluation of the autopilot control logic.

[0043] Preferably, the primary safety factors include: whether the crew can always obtain autopilot information, whether it can avoid receiving crew inputs and autopilot inputs simultaneously, and whether it issues audible and visual warnings for unexpected operations;

[0044] The secondary safety factors include: whether the autopilot does not have full-authority control surface manipulation or full-envelope manipulation, whether all inputs have redundancy, whether there are no noticeable transients when turning on and off the autopilot, whether the crew has a separate button to turn off the autopilot, whether the landing mode includes two control modes of azimuth and glide slope; whether all crew inputs are not ambiguous, and whether the autopilot is set with conditions for modal disconnection.

[0045] Preferably, for the safety factor of whether the crew can always obtain autopilot information, assign 1 when all the following conditions are met, otherwise assign 0;

[0046] The conditions include: the display information is displayed through the head-up display, and the display information includes at least pitch, roll, and aircraft mode.

[0047] The specific detailed descriptions include:

[0048] ① The display information should be complete and displayed separately, including but not limited to pitch and roll;

[0049] ② When the autopilot is turned on, it is prohibited to change or hide the display; the crew should not say that they don't know what mode the aircraft is in;

[0050] ③ If the aircraft is equipped with a head-up display (HUD), the information should be displayed on the HUD;

[0051] ④ Avoid using ambiguous abbreviations;

[0052] ⑤ The mode information should be made popular and avoid confusion in emergency situations.

[0053] Preferably, for the safety factor of whether it can avoid receiving crew inputs and autopilot inputs simultaneously, assign 1 when all the following conditions are met, otherwise assign 0;

[0054] The specific conditions include: when in the autopilot mode for reducing the pilot's workload, there is a dead zone to avoid frequent non-command disconnections caused by crew inputs; for safety-related autopilot modes, there are restrictions to prevent the auto-trim from working continuously up to the maximum limit; when the crew enters a potentially dangerous state, there is a module to prompt the crew by increasing the control force or reducing the effective control.

[0055] The specific detailed descriptions include:

[0056] ① For the autopilot mode of reducing the pilot's workload, to avoid frequent non-command disconnections caused by crew inputs, a dead zone can be set for the commands, and the dead zone generally does not exceed 80% of the control force or stroke;

[0057] ② For safety-related autopilot modes (such as auto-leveling), it is impossible to avoid mixed inputs. Restrictions should be imposed on the auto-trim function or warning prompts should be given to prevent the auto-trim from working continuously up to the maximum limit, which may cause danger when disconnecting the autopilot.

[0058] ③ If the crew enters a potentially dangerous state, prompt the crew by increasing the control force or reducing the effective control.

[0059] Preferably, for unexpected operations, when the safety factors for both audible and visual warnings meet the following conditions, assign a value of 1; otherwise, assign a value of 0.

[0060] The specific conditions include: there are prompt-level warnings for non-command disconnections, unexpected mode conversions, and non-command activations.

[0061] For expected mode conversions or activating incompatible modes, there are audible and flashing indications.

[0062] When the autopilot cannot be activated, there is an alarm.

[0063] When the aircraft state exceeds the working range of the autopilot, the autopilot disconnects and displays the reason for disconnection.

[0064] The specific detailed descriptions include:

[0065] ① The alarm level should be at the prompt level.

[0066] ② For non-command disconnections, unexpected mode conversions, and non-command activations, alarms should be given, including at least 1 voice prompt such as "autopilot" and 1 visual prompt that the autopilot is no longer activated. These indications should be maintained until the crew confirms.

[0067] ③ For expected mode conversions or activating incompatible modes, there should be short (2 - 5 seconds) audible and flashing indications.

[0068] ④There should be no delayed mode engagement. If the autopilot cannot be engaged, an alarm should be given as if it were disengaged.

[0069] ⑤For general sub-mode transitions (such as from capture or selection to hold), no additional indication or modal framing is required to signal the change.

[0070] ⑥When the aircraft's state exceeds the operating range of the autopilot (such as airspeed limits), the autopilot should not switch from one mode to another but should disengage and ensure that the crew can view the status page for more detailed warnings. The description could be something like "AP disengaged due to airspeed limit", which can hold the information for a longer time without distracting the crew and inform them of the potential problem cause when they want to obtain the information.

[0071] Preferably, when the safety factors of whether the autopilot does not have full-authority control surface manipulation or full-envelope manipulation all meet the following conditions, assign a value of 1; otherwise, assign a value of 0.

[0072] The specific conditions include:

[0073] The authority of the autopilot does not exceed 50% to 75% of the full control authority.

[0074] For large transport aircraft or civil aircraft, when the roll angle exceeds 45 degrees, the pitch angle exceeds 30 degrees, or the rate on any axis exceeds 10 degrees / second, the autopilot should disengage.

[0075] The evaluation criteria include:

[0076] ①The authority of the autopilot should not exceed 50% to 75% of the full control authority.

[0077] ②For large transport aircraft or civil aircraft, if the aircraft's roll angle exceeds 45 degrees, the pitch angle exceeds 30 degrees, or the rate exceeds 10 degrees / second (on any axis), the autopilot should disengage; for aircraft with stronger maneuverability, the conditions can be appropriately relaxed.

[0078] Preferably, when all the safety factors of whether all inputs have redundancy all meet the following conditions, assign a value of 1; otherwise, assign a value of 0.

[0079] The conditions include: The input signals of the autopilot have redundancy and are used after being processed by the input management system.

[0080] At any time, when a fault occurs in the autopilot system or the input signals, the autopilot disengages and ensures a smaller transient.

[0081] When the system or the redundant signals degrade to a single channel, the autopilot is not engaged.

[0082] The evaluation criteria include:

[0083] ① The input signals of the autopilot should have redundancy and be used after being processed by the Input Management System (ISM);

[0084] ② At any time, when a failure occurs in the autopilot system or the input signals, the autopilot should disconnect and ensure a small transient;

[0085] ③ When the system or the redundant signals degrade to a single channel, the autopilot should not be turned on.

[0086] Preferably, when the safety factors of whether turning on and off the autopilot have no noticeable transients both meet the following conditions, assign 1; otherwise, assign 0;

[0087] The conditions include: when the autopilot disconnects due to a failure, the transient of the sub-mode conversion is less than the set value;

[0088] The evaluation criteria include:

[0089] ① For abnormal disconnection, such as in case of a failure, the transient can be felt but should not be unpleasant (0.5G or 10 degrees / second); the sub-mode conversion can only cause a small, smooth and smaller transient (0.1G or 2 degrees / second);

[0090] ② The automatic trim control of the autopilot should be slow. The speed of the trim bias should not cause a noticeable transient.

[0091] When the crew has a separate button to disconnect the autopilot, assign 1 when both of the following conditions are met; otherwise, assign 0;

[0092] ① The button should be on the upper part of the control stick for easy operation and should have enough force to prevent accidental disconnection;

[0093] ② The button should be used to disconnect the pitch and roll modes of the autopilot simultaneously.

[0094] When the landing mode includes two control modes of azimuth and glide slope, assign 1 when both of the following conditions are met; otherwise, assign 0;

[0095] ① For the autonomous, microwave, and instrument landing guidance methods, the autopilot landing mode includes two control modes of azimuth (LOC) and glide slope (GS);

[0096] ② The decision height should be adjusted according to the accuracy of the navigation system and the terrain database.

[0097] When all the crew inputs are not ambiguous and the autopilot is set with the conditions for modal disconnection, assign 1 when both of the following conditions are met; otherwise, assign 0

[0098] ① Each mode should have its own physical or virtual button;

[0099] ②For important modes, there should be a unique activation method.

[0100] For the safety factor of whether the autopilot sets the condition for mode disconnection, assign 1 when all the following conditions are met, otherwise assign 0;

[0101] ①Except for altitude hold or heading / track hold, the autopilot should set the condition for mode disconnection. Because each time a mode is activated, the crew has a target point in mind. For example, when flying over the last waypoint or when the final estimated arrival time exceeds a certain value, the auto-navigation should disconnect.

[0102] Each mode has a corresponding physical or virtual button, and for a specific mode, there is a unique activation method.

[0103] Preferably, the weight of the primary safety factor accounts for 45% - 75% of the total weight.

[0104] The advantages of this application include: The safety evaluation method proposed in this patent solves the problem of the lack of evaluation criteria for the autopilot control logic, which is beneficial to improving the safety of the system and can help eliminate aircraft accidents caused by the design of the autopilot.

[0105] The necessary safety factor is a condition with a veto power, which is a safety flaw that has a decisive impact on aircraft safety.

[0106] As described above, this is only the specific implementation manner of this application, but the protection scope of this application is not limited thereto. Any changes or substitutions that can be easily thought of by those skilled in the art within the technical scope disclosed in this application should be covered by the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claimed rights.

Claims

1. A method for evaluating the safety of an aircraft autopilot control logic, characterized in that: include: Obtain all safety factors and classify them into primary safety factors, secondary safety factors, tertiary safety factors and necessary safety factors; When the safety factor meets the conditions, it is assigned a value of 1, otherwise it is assigned a value of 0; Different coefficients are added to the primary safety factor and the secondary safety factor, and the safety evaluation value is obtained by accumulating the coefficient and the assigned value of each safety factor; When any necessary safety factor does not meet the conditions, the safety evaluation value is assigned 0; A safety evaluation is performed on the autopilot control logic based on the safety evaluation value.

2. The aircraft autopilot control logic safety evaluation method according to claim 1, characterized in that: Level 1 safety factors include: whether the crew can always get autopilot information, whether it can avoid receiving crew input and autopilot input at the same time, and whether sound and visual warnings are issued for unexpected operations; Secondary safety factors include: whether the autopilot does not have full authority control surface control or full envelope control, whether all inputs are redundant, whether there are no noticeable transients when connecting and disconnecting the autopilot, whether the crew has a separate button to disconnect the autopilot, whether the landing mode includes two control modes: azimuth and descent; whether all crew inputs are unambiguous, and whether the autopilot is set with modal disconnection conditions.

3. The method for evaluating the safety of the aircraft autopilot control logic according to claim 1, characterized in that: The safety factor of whether the crew can always get the autopilot information is assigned a value of 1 when all the following conditions are met, otherwise it is assigned a value of 0; The conditions include: the display information is displayed through a head-up display, and the display information includes at least pitch, roll, and aircraft mode.

4. The method for evaluating the safety of the aircraft autopilot control logic according to claim 1, characterized in that: Whether it is possible to avoid receiving the safety factors of the crew input and the autopilot input at the same time. If the following conditions are met, the value is assigned to 1, otherwise it is assigned to 0; Specific conditions include: when in an autopilot mode that reduces the burden on the pilot, having a dead zone to avoid frequent uncommanded disconnections caused by crew input; For safety-related autopilot modes, there are limits set to prevent the automatic trim from working all the time and reaching the maximum authority; if the crew enters a potentially dangerous state, there is a module to prompt the crew by increasing control force or reducing effective control.

5. The method for evaluating the safety of the aircraft autopilot control logic according to claim 1, characterized in that: For unexpected operations, the safety factors of whether to issue sound and visual warnings are assigned a value of 1 if the following conditions are met, otherwise a value of 0 is assigned; Specific conditions include: warning level alarms for uninstructed disconnection, unexpected mode switching, and uninstructed connection; Expected mode switching or switching into an incompatible mode has audible and flashing indications; It has an alarm function when the autopilot cannot be engaged; The aircraft status exceeds the autopilot operating range, the autopilot disconnects and displays the reason for the disconnection.

6. The method for evaluating the safety of the aircraft autopilot control logic according to claim 1, characterized in that: Whether the autopilot does not have the safety factors of full authority control surface operation or full envelope operation is assigned a value of 1 when all the following conditions are met, otherwise it is assigned a value of 0; Specific conditions include: The autopilot’s authority does not exceed 50% to 75% of full control authority; The autopilot should be disconnected if the roll angle of a large transport aircraft or civil aircraft exceeds 45 degrees, the pitch angle exceeds 30 degrees, or the speed on any axis exceeds 10 degrees / second.

7. The method for evaluating the safety of the aircraft autopilot control logic according to claim 1, characterized in that: If all inputs have redundant safety factors, the value is 1 if they meet the following conditions, otherwise, the value is 0; The conditions include: the input signal of the autopilot is redundant and processed by the input management system before use; At any time, when the autopilot system or input signal fails, the autopilot is disconnected and ensures a small transient state; When the system or redundancy signal degrades to single channel, the autopilot is not engaged.

8. The method for evaluating the safety of the aircraft autopilot control logic according to claim 1, characterized in that: Whether the safety factor of turning on and off the autopilot does not have a transient state that is noticed is assigned a value of 1 when the following conditions are met, otherwise it is assigned a value of 0; The conditions include: when the autopilot is disconnected due to a fault, the transient of the sub-mode transition is less than the set value; The speed at which the autopilot automatically trims the bias is less than the set value.

9. The method for evaluating the safety of the aircraft autopilot control logic according to claim 1, characterized in that: If all the unit inputs have unambiguous safety factors and meet the following conditions, the value is 1, otherwise it is 0; Each mode has a corresponding physical or virtual button, and a unique way to connect to a specific mode.

10. The aircraft autopilot control logic safety evaluation method according to claim 1, characterized in that: The weight of the first-level safety factor accounts for 45% to 75% of the total weight.

Images