A flight control system pressure signal fault monitoring and processing method and system

Abstract

The present application relates to a method and system for monitoring and processing pressure signal faults in a flight control system. The method includes: receiving a first voltage signal output by a pressure sensor in an actuator extension chamber, and a second voltage signal output by a pressure sensor in an actuator retraction chamber, and processing the first voltage signal and the second voltage signal respectively to obtain a first pressure signal and a second pressure signal; monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty; if the first pressure signal is less than a preset pressure signal lower threshold, and the duration exceeds a time delay threshold, the pressure sensor in the extension chamber is determined to be faulty, and the corresponding first fault type is output. The present application can not only quickly determine the fault of the pressure sensor, but also accurately output the corresponding fault type.

Description

Technical Field

[0001] The present application relates to the field of flight control technology, and in particular to a method and system for monitoring and processing pressure signal faults in a flight control system. Background Art

[0002] Electro-hydraulic servo actuators are widely used control surface actuators in flight control systems. Typically, each primary flight control surface is equipped with two to three actuators working together to achieve rapid and precise control of the control surface's deflection. Multiple actuators control the movement of a single control surface. Under certain conditions, inconsistent actuator motion can cause forces to develop between two actuators, a phenomenon known in the industry as force contention. Severe force contention can lead to structural fatigue and loss of control capability, jeopardizing flight safety. To address this issue, pressure sensors are typically installed within the actuators to monitor the pressure differential between the two actuators in real time. Force contention is then eliminated through control algorithms within the flight control computer. If force contention becomes excessive and cannot be eliminated, the actuators are disconnected to ensure system and flight safety. However, if a pressure sensor malfunctions and outputs an erroneous pressure signal, the control surface may be incorrectly disconnected, degrading system control capabilities.

[0003] Therefore, it is necessary to provide a new technical solution to improve one or more problems existing in the above solutions.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of this application, and therefore may include information that does not constitute prior art known to ordinary technicians in this field. Summary of the Invention

[0005] The purpose of this application is to provide a method and system for monitoring and processing pressure signal faults in a flight control system, thereby overcoming one or more problems caused by the limitations and defects of related technologies, at least to a certain extent.

[0006] According to a first aspect of an embodiment of the present application, a method for monitoring and processing pressure signal faults in a flight control system is provided, the method comprising:

[0007] receiving a first voltage signal output by a pressure sensor in a cavity when the actuator is extended and a second voltage signal output by a pressure sensor in a cavity when the actuator is retracted, and processing the first voltage signal and the second voltage signal respectively to obtain a first pressure signal and a second pressure signal;

[0008] monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty;

[0009] If the first pressure signal is less than a preset pressure signal lower threshold and lasts longer than a time delay threshold, it is determined that the pressure sensor in the extension chamber is faulty and a corresponding first fault type is output; wherein the first fault type is a high-side open circuit fault or a high-side short circuit fault;

[0010] If the second pressure signal is less than the preset pressure signal lower threshold and the duration exceeds the delay threshold, it is determined that the pressure sensor in the retraction chamber is faulty and a corresponding second fault type is output; wherein the second fault type is the same as the first fault type;

[0011] The first fault type is latched, and the first pressure signal is set to a corresponding fail-safe value according to the first fault type; and the second fault type is latched, and the second pressure signal is set to a corresponding fail-safe value according to the second fault type.

[0012] In an embodiment of the present application, after the step of monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the following steps are included:

[0013] If the first pressure signal is greater than a preset upper pressure signal threshold and lasts longer than the time delay threshold, it is determined that the pressure sensor in the extension chamber is faulty and a corresponding third fault type is output; wherein the third fault type is a low-end open circuit fault or a low-end short circuit fault;

[0014] If the second pressure signal is greater than the preset pressure signal upper threshold and the duration exceeds the delay threshold, the pressure sensor in the retraction chamber is determined to be faulty and the corresponding fourth fault type is output; wherein the fourth fault type is the same as the third fault type.

[0015] In an embodiment of the present application, after the step of determining that the pressure sensor in the extension chamber is faulty and outputting a corresponding third fault type if the first pressure signal is greater than a preset pressure signal upper threshold and the duration exceeds the delay threshold, the method further includes:

[0016] latching the third fault type, and setting the first pressure signal to a corresponding fail-safe value according to the third fault type;

[0017] After the step of determining that the pressure sensor in the retraction chamber is faulty and outputting a corresponding fourth fault type if the second pressure signal is greater than the preset pressure signal upper threshold and the duration exceeds the delay threshold, the method further includes:

[0018] The fourth fault type is latched, and the second pressure signal is set to a corresponding fail-safe value according to the fourth fault type.

[0019] In an embodiment of the present application, after the step of monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the following steps are included:

[0020] If the absolute value of the difference between the pressure difference between the two chambers of the actuator and the reference pressure difference exceeds the error threshold, and the duration exceeds the delay threshold, it is determined that the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are both faulty, and the corresponding fifth fault type is output; wherein the pressure difference between the two chambers is the difference between the first pressure signal and the second pressure signal, and the fifth fault type is a signal drift fault.

[0021] In an embodiment of the present application, after the step of determining that both the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty and outputting a corresponding fifth fault type if the absolute value of the difference between the pressure difference between the two chambers of the actuator and the reference pressure difference exceeds the error threshold and the duration exceeds the delay threshold, the method further includes:

[0022] The fifth fault type is latched, and according to the fifth fault type, the first pressure signal is set to a corresponding fail-safe value, and the second pressure signal is set to a corresponding fail-safe value.

[0023] In the embodiment of the present application, the calculation formula of the reference pressure difference is as follows:

[0024] (1)

[0025] Where, represents the reference pressure difference, Indicates the hydraulic source pressure, Indicates the displacement change of the actuator piston, Indicates the servo valve slide position, Represents the scale factor.

[0026] In an embodiment of the present application, the preset upper threshold of the pressure signal is set to the upper limit of the normal operating range of the actuator hydraulic pressure plus a margin;

[0027] The preset pressure signal lower threshold is set to the lower limit of the normal operating range of the actuator hydraulic pressure minus the margin.

[0028] In the embodiment of the present application, the calculation formula of the margin is as follows:

[0029] (2)

[0030] Where, represents the margin, Indicates the pressure sensor accuracy error coefficient, represents the acquisition error coefficient, represents the signal transmission noise error coefficient, Indicates the full-scale pressure value of the pressure sensor.

[0031] In an embodiment of the present application, after the step of monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the following steps are included:

[0032] If the first pressure signal is greater than or equal to the preset pressure signal lower threshold and less than or equal to the preset pressure signal upper threshold, and the duration exceeds the delay threshold, it is determined that the pressure sensor in the extension chamber is normal, and the corresponding first pressure signal is output;

[0033] If the second pressure signal is greater than or equal to the preset pressure signal lower threshold and less than or equal to the preset pressure signal upper threshold, and the duration exceeds the delay threshold, it is determined that the pressure sensor in the retraction chamber is normal, and the corresponding second pressure signal is output.

[0034] According to a second aspect of an embodiment of the present application, a flight control system pressure signal fault monitoring and processing system is provided, which is applied to the flight control system pressure signal fault monitoring and processing method described in any of the above embodiments, and the system includes:

[0035] a receiving and processing module, configured to receive a first voltage signal output by a pressure sensor in the actuator extension cavity and a second voltage signal output by a pressure sensor in the actuator retraction cavity, and process the first voltage signal and the second voltage signal respectively to obtain a first pressure signal and a second pressure signal;

[0036] a fault monitoring module, configured to monitor the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty;

[0037] a first fault monitoring submodule, configured to determine that the pressure sensor in the extension chamber is faulty and output a corresponding first fault type if the first pressure signal is less than a preset pressure signal lower threshold and the duration exceeds a time delay threshold; wherein the first fault type is a high-side open circuit fault or a high-side short circuit fault;

[0038] a second fault monitoring submodule, configured to determine that the pressure sensor in the retraction chamber is faulty and output a corresponding second fault type if the second pressure signal is less than the preset pressure signal lower threshold and the duration exceeds the delay threshold; wherein the second fault type is the same as the first fault type;

[0039] A first fault latching module is used to latch the first fault type and set the first pressure signal to a corresponding fault-safe value according to the first fault type; and a second fault latching module is used to latch the second fault type and set the second pressure signal to a corresponding fault-safe value according to the second fault type.

[0040] The technical solutions provided by the embodiments of the present application may have the following beneficial effects:

[0041] In one embodiment of the present application, the above-described method, on the one hand, monitors the first pressure signal within the actuator extension chamber and the second pressure signal within the actuator retraction chamber in real time to determine whether the pressure sensors within the extension chamber and the retraction chamber are faulty. During the fault determination process, if the first pressure signal is less than a preset pressure signal lower threshold and persists for a period exceeding a time delay threshold, the pressure sensor within the extension chamber is determined to be faulty, and the corresponding first fault type is accurately output. If the second pressure signal is less than a preset pressure signal lower threshold and persists for a period exceeding a time delay threshold, the pressure sensor within the retraction chamber is determined to be faulty, and the corresponding second fault type is accurately output. This application not only allows for rapid determination of pressure sensor faults but also accurately outputs the corresponding fault type. Furthermore, by setting the first pressure signal to a corresponding fail-safe value based on the first fault type and the second pressure signal to a corresponding fail-safe value based on the second fault type, the application can prevent pressure sensor faults from spreading and causing more serious loss of flight control system functionality.

[0042] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The accompanying drawings are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification, are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and those skilled in the art can derive other drawings based on these drawings without inventive effort.

[0044] Figure 1 A flowchart schematically illustrates a method for monitoring and processing a pressure signal fault in a flight control system in an exemplary embodiment of the present application;

[0045] Figure 2 Schematically illustrates a functional principle diagram of a flight control system pressure signal fault monitoring and processing system in an exemplary embodiment of the present application;

[0046] Figure 3 A block diagram of a flight control system pressure signal fault monitoring and processing system in an exemplary embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0047] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be embodied in many forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete and will fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0048] This example embodiment first provides a method for monitoring and processing pressure signal failures in a flight control system. Figure 1 As shown in , the method may include: steps S101 to S105.

[0049] Among them, step S101: receiving a first voltage signal output by a pressure sensor in a cavity when the actuator is extended, and a second voltage signal output by a pressure sensor in a cavity when the actuator is retracted, and processing the first voltage signal and the second voltage signal respectively to obtain a first pressure signal and a second pressure signal.

[0050] Step S102: monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension cavity and the pressure sensor in the retraction cavity are faulty.

[0051] Step S103: If the first pressure signal is less than the preset pressure signal lower threshold and the duration exceeds the delay threshold, it is determined that the pressure sensor in the extension cavity is faulty and the corresponding first fault type is output; wherein the first fault type is a high-end open circuit fault or a high-end short circuit fault.

[0052] Step S104: If the second pressure signal is less than the preset pressure signal lower threshold and the duration exceeds the delay threshold, it is determined that the pressure sensor in the retraction chamber is faulty, and a corresponding second fault type is output; wherein the second fault type is the same as the first fault type.

[0053] Step S105: latching the first fault type and setting the first pressure signal to a corresponding fail-safe value according to the first fault type; and latching the second fault type and setting the second pressure signal to a corresponding fail-safe value according to the second fault type.

[0054] In one embodiment of the present application, the above-described method, on the one hand, monitors the first pressure signal within the actuator extension chamber and the second pressure signal within the actuator retraction chamber in real time to determine whether the pressure sensors within the extension chamber and the retraction chamber are faulty. During the fault determination process, if the first pressure signal is less than a preset pressure signal lower threshold and persists for a period exceeding a time delay threshold, the pressure sensor within the extension chamber is determined to be faulty, and the corresponding first fault type is accurately output. If the second pressure signal is less than a preset pressure signal lower threshold and persists for a period exceeding a time delay threshold, the pressure sensor within the retraction chamber is determined to be faulty, and the corresponding second fault type is accurately output. This application not only allows for rapid determination of pressure sensor faults but also accurately outputs the corresponding fault type. Furthermore, by setting the first pressure signal to a corresponding fail-safe value based on the first fault type and the second pressure signal to a corresponding fail-safe value based on the second fault type, the application can prevent pressure sensor faults from spreading and causing more serious loss of flight control system functionality.

[0055] Below, we will refer to Figure 1 and Figure 2 Each step of the above method in this exemplary embodiment is described in more detail.

[0056] In step S101, the actuator includes an extension chamber and a retraction chamber. Pressure sensors are installed in both the extension chamber and the retraction chamber. The pressure sensor in the extension chamber is used to collect a first voltage signal from the extension chamber, while the pressure sensor in the retraction chamber is used to collect a second voltage signal from the retraction chamber. After collecting the first voltage signal from the extension chamber, the pressure sensor in the extension chamber outputs the first voltage signal to the receiving and processing module 210. After collecting the second voltage signal from the retraction chamber, the pressure sensor in the retraction chamber outputs the second voltage signal to the receiving and processing module 210. A power supply module is typically used to power the pressure sensors, enabling them to collect and output voltage signals.

[0057] After receiving the first voltage signal output by the pressure sensor in the actuator extension cavity and the second voltage signal output by the pressure sensor in the actuator retraction cavity through the receiving and processing module 210, the first voltage signal and the second voltage signal are processed respectively through the receiving and processing module 210 to obtain the first pressure signal and the second pressure signal.

[0058] Furthermore, since the receiving and processing module 210 includes an AD acquisition module and a dimensional conversion module, when the first voltage signal and the second voltage signal are received by the receiving and processing module 210 and the first voltage signal and the second voltage signal are processed, the first voltage signal and the second voltage signal are specifically received by the AD acquisition module, and the first voltage signal is further converted into a first digital quantity and the second voltage signal is converted into a second digital quantity by the AD acquisition module. Then, through the dimensional conversion module, according to the relationship between voltage and pressure defined by the pressure sensor, the first digital quantity is converted into a first pressure signal and the second digital quantity is converted into a second pressure signal. The present application can accurately obtain the first pressure signal and the second pressure signal by converting and processing the first voltage signal and the second voltage signal.

[0059] In step S102, after the first voltage signal and the second voltage signal are processed by the receiving and processing module 210 to obtain the first pressure signal and the second pressure signal, the first pressure signal and the second pressure signal are transmitted to the fault monitoring module 220. The fault monitoring module 220 then monitors the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the actuator extension chamber and the pressure sensor in the retraction chamber are faulty. By monitoring the first pressure signal and the second pressure signal in real time, the present application can determine whether the pressure sensor in the actuator extension chamber and the pressure sensor in the retraction chamber are faulty, so that corresponding processing can be performed accordingly based on whether the pressure sensor is faulty.

[0060] In step S103, when judging whether the pressure sensor in the extension chamber of the actuator is faulty, when the first pressure signal is less than the preset pressure signal lower threshold and the duration exceeds the time delay threshold, the pressure sensor in the extension chamber of the actuator is judged to be faulty, and the first fault type of the pressure sensor in the extension chamber is output. Among them, the first fault type is a high-end open circuit fault or a high-end short circuit fault. When the fault of the pressure sensor in the extension chamber of the actuator is the first fault type, the pressure sensor in the extension chamber of the actuator is a high-end open circuit fault or a high-end short circuit fault. The present application can quickly judge whether the pressure sensor in the extension chamber of the actuator is faulty by comparing the first pressure signal with the preset pressure signal lower threshold and the duration exceeds the time delay threshold, and output the corresponding first fault type.

[0061] In step S104, when judging whether the pressure sensor in the actuator retraction chamber is faulty, when the second pressure signal is less than the preset pressure signal lower threshold and the duration exceeds the time delay threshold, the pressure sensor in the actuator retraction chamber is judged to be faulty, and the second fault type of the pressure sensor in the retraction chamber is output. Furthermore, the second fault type is the same as the first fault type. When the fault of the pressure sensor in the actuator retraction chamber is the second fault type, the pressure sensor in the actuator retraction chamber has a high-end open circuit fault or a high-end short circuit fault. The present application can quickly judge whether the pressure sensor in the actuator retraction chamber is faulty by comparing the second pressure signal with the preset pressure signal lower threshold and the duration exceeds the time delay threshold, and output the corresponding second fault type.

[0062] It should be noted that the delay threshold is determined based on the fault impact and the monitor measurement of the fault monitoring module 220. Taking the first pressure signal as an example: the delay threshold should generally be less than the minimum value of the monitor delay related to the first pressure signal, and greater than twice the signal acquisition and transmission period. For example, if the delay of monitor 1 for monitoring the first pressure signal is 100ms, the delay of monitor 2 for monitoring the first pressure signal is 150ms, and the signal acquisition and transmission period is 25ms, then the delay threshold should be greater than 50ms and less than 100ms.

[0063] Similarly, taking the second pressure signal as an example: the delay threshold should usually be less than the minimum value of the delay of the monitor related to the second pressure signal, and greater than twice the signal acquisition and transmission period. For example, the delay of monitor 1 used to monitor the second pressure signal is 100ms, the delay of monitor 2 used to monitor the second pressure signal is 150ms, and the signal acquisition and transmission period is 25ms, then the delay threshold should be greater than 50ms and less than 100ms. It should be noted that monitor 1 and monitor 2 are both monitors in downstream functions. Monitor 1 mainly monitors the first pressure signal in the extension chamber of the actuator, and monitor 2 mainly monitors the second pressure signal in the retraction chamber of the actuator to identify specific faults of the actuator system, such as: rudder force disputes, rudder oscillations, etc.

[0064] In step S105, after the first fault type is output, the first fault latch module 250 latches the first fault type and sets the first pressure signal to a corresponding fail-safe value based on the first fault type. After the second fault type is output, the second fault latch module 260 latches the second fault type and sets the second pressure signal to a corresponding fail-safe value based on the second fault type. The fail-safe values corresponding to the first and second pressure signals are transmitted to the system control and monitoring module of the flight control computer via the communication interface between the actuator control electronics and the flight control computer. These functions serve as inputs for the force dispute mitigation function and the force dispute oscillation monitoring function, enabling force dispute balancing control and force dispute oscillation monitoring of the corresponding actuator.

[0065] In one embodiment, after the step of monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the method further includes:

[0066] If the first pressure signal is greater than the preset upper pressure signal threshold and lasts longer than the delay threshold, the pressure sensor in the extension chamber is determined to be faulty and a corresponding third fault type is output; wherein the third fault type is a low-end open circuit fault or a low-end short circuit fault;

[0067] If the second pressure signal is greater than the preset pressure signal upper threshold and the duration exceeds the delay threshold, the pressure sensor in the retraction chamber is determined to be faulty and the corresponding fourth fault type is output; wherein the fourth fault type is the same as the third fault type.

[0068] In one embodiment, if the first pressure signal is greater than a preset upper pressure signal threshold and the duration exceeds a time delay threshold, then after determining that the pressure sensor in the extension chamber is faulty and outputting a corresponding third fault type, the method includes:

[0069] latching the third fault type and setting the first pressure signal to a corresponding fail-safe value according to the third fault type;

[0070] If the second pressure signal is greater than the preset upper pressure signal threshold and the duration exceeds the time delay threshold, it is determined that the pressure sensor in the retraction chamber is faulty and the corresponding fourth fault type is output, and the following steps are included:

[0071] The fourth fault type is latched, and the second pressure signal is set to a corresponding fail-safe value according to the fourth fault type.

[0072] It is understandable that when determining whether the pressure sensor in the actuator extension chamber is faulty, in addition to being able to determine based on the first pressure signal and the preset pressure signal lower threshold, it is also possible to determine based on the first pressure signal and the preset pressure signal upper threshold. Specifically, when the first pressure signal is greater than the preset pressure signal upper threshold and the duration exceeds the delay threshold, the pressure sensor in the extension chamber is determined to be faulty, and the third fault type of the pressure sensor in the extension chamber is output. The third fault type is a low-end open circuit fault or a low-end short circuit fault. When the fault of the pressure sensor in the actuator extension chamber is the third fault type, the pressure sensor in the actuator extension chamber is a high-end open circuit fault or a high-end short circuit fault.

[0073] When the fault of the pressure sensor in the actuator extension cavity is the third fault type, the third fault type is latched by the third fault latch module, and the first pressure signal is set to a corresponding fail-safe value according to the third fault type. The fail-safe value corresponding to the first pressure signal under the third fault type is sent to the system control and monitoring module of the flight control computer through the communication interface between the actuator control electronics and the flight control computer, and is used as an input for the force dispute mitigation function and the force dispute oscillation monitoring function, thereby realizing force dispute balancing control and force dispute oscillation monitoring of the corresponding actuator.

[0074] It can also be understood that when judging whether the pressure sensor in the actuator retraction chamber is faulty, in addition to judging by the second pressure signal and the preset pressure signal lower threshold, it can also be judged by the second pressure signal and the preset pressure signal upper threshold. Specifically, when the second pressure signal is greater than the preset pressure signal upper threshold, and the duration exceeds the time delay threshold, the pressure sensor in the retraction chamber is judged to be faulty, and the fourth fault type of the pressure sensor in the retraction chamber is output. Among them, the fourth fault type is the same as the third fault type. When the fault of the pressure sensor in the actuator retraction chamber is the fourth fault type, the pressure sensor in the actuator retraction chamber has a high-end open circuit fault or a high-end short circuit fault. The present application can quickly judge whether the pressure sensor in the actuator retraction chamber has a fault and output the corresponding fault type by comparing the second pressure signal with the preset pressure signal upper threshold and judging whether the duration exceeds the time delay threshold.

[0075] When the fault of the pressure sensor in the actuator retraction chamber is a fourth fault type, the fourth fault type is latched by the fourth fault latch module, and the second pressure signal is set to a corresponding fail-safe value according to the fourth fault type. The fail-safe value corresponding to the second pressure signal under the fourth fault type is sent to the system control and monitoring module of the flight control computer through the communication interface between the actuator control electronics and the flight control computer, and is used as an input for the force dispute mitigation function and the force dispute oscillation monitoring function, thereby realizing force dispute balancing control and force dispute oscillation monitoring of the corresponding actuator.

[0076] In one embodiment, after the step of monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the method further includes:

[0077] If the absolute value of the difference between the pressure difference between the two chambers of the actuator and the reference pressure difference exceeds the error threshold, and the duration exceeds the delay threshold, it is determined that both the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, and the corresponding fifth fault type is output; wherein the pressure difference between the two chambers is the difference between the first pressure signal and the second pressure signal, and the fifth fault type is a signal drift fault.

[0078] In one embodiment, if the absolute value of the difference between the pressure difference between the two chambers of the actuator and the reference pressure difference exceeds an error threshold and the duration exceeds a delay threshold, then after determining that both the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty and outputting a corresponding fifth fault type, the method includes:

[0079] The fifth fault type is latched, and according to the fifth fault type, the first pressure signal is set to a corresponding fail-safe value, and the second pressure signal is set to a corresponding fail-safe value.

[0080] It is understandable that when judging whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the absolute value of the difference between the pressure difference between the two chambers of the actuator and the reference pressure difference can also be compared with the error threshold, and at the same time, combined with the condition that the duration exceeds the delay threshold, it is judged whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty. Specifically, when the absolute value of the difference between the pressure difference between the two chambers of the actuator and the reference pressure difference exceeds the error threshold, and the duration exceeds the delay threshold, it is judged that both the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, and the fifth fault type of the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber is output. Among them, the fifth fault type is a signal drift fault. The error threshold can be determined based on tolerance analysis and engineering experience, and the error threshold can be specifically 1Mpa.

[0081] When the faults of the pressure sensor in the extension cavity and the pressure sensor in the retraction cavity of the actuator are of the fifth fault type, the fifth fault type is latched by the fifth fault latch module, and the first pressure signal is set to the corresponding fail-safe value and the second pressure signal is set to the corresponding fail-safe value according to the fifth fault type. The fail-safe value corresponding to the first pressure signal under the fifth fault type and the fail-safe value corresponding to the second pressure signal under the fifth fault type are sent to the system control and monitoring module of the flight control computer through the communication interface between the actuator control electronics and the flight control computer, and are used as inputs of the force dispute mitigation function and the force dispute oscillation monitoring function to realize force dispute balancing control and force dispute oscillation monitoring of the corresponding actuator.

[0082] It should be noted that the pressure difference between the two chambers of the actuator is the difference between the first pressure signal of the pressure sensor in the extension chamber of the actuator and the second pressure signal of the pressure sensor in the retraction chamber of the actuator.

[0083] Furthermore, the reference pressure difference can be calculated by the following formula (1):

[0084] (1)

[0085] Where, represents the reference pressure difference, Indicates the hydraulic source pressure, Indicates the displacement change of the actuator piston, Indicates the servo valve slide position, Represents the scale factor.

[0086] It can be understood that the reference pressure difference calculated according to the above formula (1) can effectively identify system failures caused by the drift of the pressure sensor output value, and the calculation load is small, and no additional hardware support is required. It improves the safety and maintainability of the flight control system without increasing the manufacturing and operating costs of the flight control system.

[0087] The fail-safe value setting in this application helps the flight control system minimize the impact of pressure sensor failures, reducing the impact on the flight control system's control functions. This prevents sudden and large changes in the pressure signal from causing false triggering of the flight control system's load and fatigue-related monitors, leading to loss of system control functions.

[0088] Specifically, the fail-safe value can be selected according to the following method:

[0089] When the fault monitoring module 220 determines that the first pressure signal of the pressure sensor in the actuator extension cavity has a high-end open circuit fault, a high-end short circuit fault, a low-end open circuit fault or a low-end short circuit fault, the first pressure signal is set to a negative value with an absolute value of 10% of the full-scale pressure value of the pressure sensor; when the fault monitoring module 220 determines that the second pressure signal of the pressure sensor in the actuator retraction cavity has a high-end open circuit fault, a high-end short circuit fault, a low-end open circuit fault or a low-end short circuit fault, the second pressure signal is set to a negative value with an absolute value of 10% of the full-scale pressure value of the pressure sensor.

[0090] When the pressure sensor detects a drift fault in the pressure signal, it sets the pressure signal to the value of the last beat before the pressure signal failed. The value of the last beat before the pressure signal failed is the corresponding fail-safe value of the pressure signal.

[0091] In one embodiment, the preset upper threshold of the pressure signal is set to the upper limit of the normal operating range of the actuator hydraulic pressure plus a margin;

[0092] The preset pressure signal lower threshold is set to the lower limit of the normal working range of the actuator hydraulic pressure minus the margin.

[0093] It is understood that the normal operating range of the actuator hydraulic pressure is 0-21 MPa. Therefore, the lower limit of the normal operating range of the actuator hydraulic pressure is 0 MPa, and the upper limit of the normal operating range of the actuator hydraulic pressure is 21 MPa.

[0094] Furthermore, the margin can be calculated using the following formula (2):

[0095] (2)

[0096] Where, represents the margin, Indicates the pressure sensor accuracy error coefficient, represents the acquisition error coefficient, represents the signal transmission noise error coefficient, Indicates the full-scale pressure value of the pressure sensor.

[0097] It is understandable that the pressure sensor accuracy error coefficient and the acquisition error coefficient are both fixed values determined during the flight control system design phase, and the signal transmission noise error coefficient is estimated based on the actuator pressure signal background noise data. Using the above formula (2), the margin can be calculated, and then the preset pressure signal upper threshold is obtained by the calculated margin and the upper limit of the actuator hydraulic pressure working range, and the preset pressure signal lower threshold is obtained by the calculated margin and the lower limit of the actuator hydraulic pressure working range. Based on the calculated preset pressure signal upper threshold and the preset pressure signal lower threshold, combined with the first pressure signal and the second pressure signal, it is possible to accurately determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, so as to accurately locate the fault. Among them, background noise refers to a chaotic and continuous signal existing in the measurement environment.

[0098] In one embodiment, after the step of monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the method further includes:

[0099] If the first pressure signal is greater than or equal to the preset pressure signal lower threshold and less than or equal to the preset pressure signal upper threshold, and the duration exceeds the delay threshold, it is determined that the pressure sensor in the extension chamber is normal, and the corresponding first pressure signal is output;

[0100] If the second pressure signal is greater than or equal to the preset pressure signal lower threshold and less than or equal to the preset pressure signal upper threshold, and the duration exceeds the delay threshold, it is determined that the pressure sensor in the retraction chamber is normal, and the corresponding second pressure signal is output.

[0101] It is understood that when determining whether the pressure sensor in the actuator extension chamber and the pressure sensor in the actuator retraction chamber are faulty, the situation where the pressure sensors are normal is also included, namely, the situation where the pressure sensor in the actuator extension chamber is normal and the situation where the pressure sensor in the actuator retraction chamber is normal. When the first pressure signal is greater than or equal to the preset pressure signal lower threshold and less than or equal to the preset pressure signal upper threshold, and the duration exceeds the delay threshold, that is, the first pressure signal is within the range between the preset pressure signal lower threshold and the preset pressure signal upper threshold, and the duration exceeds the delay threshold, the sixth fault monitoring submodule determines that the pressure sensor in the extension chamber is normal and outputs the corresponding first pressure signal. Similarly, when the second pressure signal is greater than or equal to the preset pressure signal lower threshold and less than or equal to the preset pressure signal upper threshold, and the duration exceeds the delay threshold, that is, the second pressure signal is within the range between the preset pressure signal lower threshold and the preset pressure signal upper threshold, and the duration exceeds the delay threshold, the seventh fault monitoring submodule determines that the pressure sensor in the retraction chamber is normal and outputs the corresponding second pressure signal.

[0102] It should be noted that although the steps of the method of this application are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in this specific order, or that all steps must be performed to achieve the desired results. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into a single step, and / or a single step may be decomposed into multiple steps. In addition, it is also easy to understand that these steps may be executed synchronously or asynchronously, for example, in multiple modules / processes / threads.

[0103] Furthermore, in this exemplary embodiment, a flight control system pressure signal fault monitoring and processing system is provided, which is applied to the flight control system pressure signal fault monitoring and processing method of any of the above embodiments. Figure 3 As shown in , the system may include a receiving and processing module 210, a fault monitoring module 220, a first fault monitoring submodule 230, a second fault monitoring submodule 240, a first fault latch module 250 and a second fault latch module 260. Among them: the receiving and processing module 210 is used to receive the first voltage signal output by the pressure sensor in the extension chamber of the actuator and the second voltage signal output by the pressure sensor in the retraction chamber of the actuator, and process the first voltage signal and the second voltage signal respectively to obtain the first pressure signal and the second pressure signal; the fault monitoring module 220 is used to monitor the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty; the first fault monitoring submodule 230 is used to determine that the pressure sensor in the extension chamber is faulty if the first pressure signal is less than the preset pressure signal lower threshold and the duration exceeds the delay threshold, and output the corresponding A first fault type; wherein the first fault type is a high-end open circuit fault or a high-end short circuit fault; a second fault monitoring submodule 240, for determining that the pressure sensor in the retraction chamber is faulty if the second pressure signal is less than a preset pressure signal lower threshold and the duration exceeds a time delay threshold, and outputting a corresponding second fault type; wherein the second fault type is the same as the first fault type; a first fault latching module 250, for latching the first fault type, and setting the first pressure signal to a corresponding fault-safe value according to the first fault type; and a second fault latching module 260, for latching the second fault type, and setting the second pressure signal to a corresponding fault-safe value according to the second fault type.

[0104] In one embodiment, the system further comprises:

[0105] a third fault monitoring submodule, configured to determine that the pressure sensor in the extension chamber is faulty and output a corresponding third fault type if the first pressure signal is greater than a preset pressure signal upper threshold and lasts longer than a delay threshold; wherein the third fault type is a low-end open circuit fault or a low-end short circuit fault;

[0106] The fourth fault monitoring submodule is used to determine that the pressure sensor in the retraction chamber is faulty if the second pressure signal is greater than the preset pressure signal upper threshold and the duration exceeds the delay threshold, and output the corresponding fourth fault type; wherein the fourth fault type is the same as the third fault type.

[0107] In one embodiment, the system further comprises:

[0108] a third fault latching module, configured to latch a third fault type and set the first pressure signal to a corresponding fail-safe value according to the third fault type;

[0109] The fourth fault latch module is configured to latch a fourth fault type and set the second pressure signal to a corresponding fail-safe value according to the fourth fault type.

[0110] In one embodiment, the system further comprises:

[0111] The fifth fault monitoring submodule is used to determine that both the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty if the absolute value of the difference between the pressure difference between the two chambers of the actuator and the reference pressure difference exceeds the error threshold and the duration exceeds the delay threshold, and output the corresponding fifth fault type; wherein the pressure difference between the two chambers is the difference between the first pressure signal and the second pressure signal, and the fifth fault type is a signal drift fault.

[0112] In one embodiment, the system further comprises:

[0113] The fifth fault latch module is used to latch the fifth fault type and set the first pressure signal to a corresponding fail-safe value and the second pressure signal to a corresponding fail-safe value according to the fifth fault type.

[0114] In one embodiment, the system further comprises:

[0115] a sixth fault monitoring submodule, configured to determine that the pressure sensor in the extension chamber is normal and output the corresponding first pressure signal if the first pressure signal is greater than or equal to a preset pressure signal lower threshold and less than or equal to a preset pressure signal upper threshold, and the duration exceeds a delay threshold;

[0116] The seventh fault monitoring submodule is used to determine that the pressure sensor in the retraction chamber is normal and output the corresponding second pressure signal if the second pressure signal is greater than or equal to the preset pressure signal lower threshold and less than or equal to the preset pressure signal upper threshold, and the duration exceeds the delay threshold.

[0117] Regarding the system in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0118] The present application will be further described below through the following examples.

[0119] The flight control system actuator's rated oil supply pressure is 21 MPa, and the normal operating range of the actuator's hydraulic pressure is 0-21 MPa. The pressure sensor linearly outputs a first voltage signal of 10-100 mV based on the pressure within the actuator's extension chamber: 10 mV at 0 MPa and 100 mV at 21 MPa. The second voltage signal it outputs based on the pressure within the actuator's retraction chamber is 10 mV at 0 MPa and 100 mV at 21 MPa. At a certain point, when the pressure within the actuator's extension chamber is 10 MPa and the pressure within the retraction chamber is 10 MPa, the first voltage signal output by the extension chamber pressure sensor is 42.9 mV, and the second voltage signal output by the retraction chamber pressure sensor is 42.9 mV. The receiving and processing module 210 collects the first voltage signal, converts it into a first digital quantity, and converts it into a first pressure signal 10Mpa through the dimensional conversion module; the receiving and processing module 210 collects the second voltage signal, converts it into a second digital quantity, and converts it into a second pressure signal 10Mpa through the dimensional conversion module.

[0120] Set the pressure sensor accuracy error coefficient =0.01, acquisition error coefficient =0.0001, signal transmission noise error coefficient =0.005, so the margin is .

[0121] The preset pressure signal lower threshold = the lower limit of the normal operating range of the actuator hydraulic pressure - the margin. Therefore, the preset pressure signal lower threshold = 0 - 0.24 = -0.24 MPa. The preset pressure signal upper threshold = the upper limit of the normal operating range of the actuator hydraulic pressure + the margin. Therefore, the preset pressure signal upper threshold = 21 + 0.24 = 21.24 MPa.

[0122] Fault monitoring module 220 detects that the first pressure signal 10 MPa is between the preset upper and lower pressure thresholds (i.e., -0.24 MPa to 21.24 MPa), and therefore does not trigger a fault. The first pressure signal is output directly without processing for use in system control and monitoring functions within the flight control computer.

[0123] Similarly, fault monitoring module 220 detects that the second pressure signal 10 MPa is between the preset upper and lower pressure thresholds (i.e., -0.24 MPa to 21.24 MPa), and therefore does not trigger a fault. The second pressure signal is then directly output without processing for use by the flight control computer's system control and monitoring functions.

[0124] When the first voltage signal output by the pressure sensor in the actuator extension chamber jumps to -3V, the receiving and processing module 210 (with a gain of 30) outputs a first digital value of -0.333V. The dimensional conversion module then generates a first pressure signal of -80 MPa. When the fault monitoring module 220 detects that the first pressure signal is less than -0.24 MPa and persists for longer than the 60ms delay threshold, it determines that the pressure sensor in the extension chamber has a high-side open circuit fault or a high-side short circuit fault, triggering a high-side open circuit fault or a high-side short circuit fault in the extension chamber. The fault is then latched, and the first fault latch module subsequently sets the output value of the first pressure signal to the fail-safe value of -2.1 MPa.

[0125] Similarly, when the second voltage signal output by the pressure sensor in the actuator retraction chamber jumps to -3V, the receiving and processing module 210 (gain 30) outputs a second digital value of -0.333V, and the dimensional conversion module obtains a second pressure signal of -80 MPa. When the fault monitoring module 220 detects that this second pressure signal is less than -0.24 MPa and lasts longer than the 60ms delay threshold, it determines that the pressure sensor in the retraction chamber has a high-side open circuit fault or a high-side short circuit fault, triggering a high-side open circuit fault or a high-side short circuit fault in the retraction chamber. The fault is then latched, and the second fault latch module immediately sets the output value of the second pressure signal to the fail-safe value of -2.1 MPa.

[0126] When the first voltage signal output by the pressure sensor in the actuator extension chamber is 42.9 mV, the first digital value output by the receiving and processing module 210 (gain 30) is 2.145 V, and the first pressure signal obtained by the dimensional conversion module is 10 MPa. When the first voltage signal output by the pressure sensor in the actuator extension chamber jumps to 44.0 mV, the first digital value output by the receiving and processing module 210 (gain 30) is changed to 2.2 V, and the first pressure signal obtained by the dimensional conversion module is changed to 10.25 MPa. In other words, the first pressure signal of the pressure sensor in the actuator extension chamber changes from 10 MPa to 10.25 MPa.

[0127] Similarly, when the second voltage signal output by the pressure sensor in the actuator retraction chamber is 42.9 mV, the receiving and processing module 210 (gain 30) outputs a second digital value of 2.145 V, and the dimensional conversion module obtains a second pressure signal of 10 MPa. When the second voltage signal output by the pressure sensor in the actuator retraction chamber jumps to 66.1 mV, the receiving and processing module 210 (gain 30) outputs a second digital value of 3.305 V, and the dimensional conversion module obtains a second pressure signal of 15.4 MPa. In other words, the second pressure signal of the pressure sensor in the actuator retraction chamber changes from 10 MPa to 15.4 MPa.

[0128] Therefore, the pressure difference between the two chambers of the actuator is equal to 15.4-10.24=5.15 MPa. The hydraulic source pressure is 21 MPa, the displacement change of the actuator piston is 2 mm, the servo valve spool position is 0.5 mm, and the proportional coefficient is 2500. According to formula (1), the reference pressure difference is 1 MPa. Therefore, the absolute value of the difference between the pressure difference of 5.15 MPa between the two chambers of the actuator and the reference pressure difference of 1 MPa is 4.15 MPa. At this time, this absolute value of 4.15 MPa is greater than the error threshold of 1 MPa, and the duration exceeds the delay threshold of 60 ms. It is determined that both the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber have failed, that is, both have experienced signal drift failure. Afterwards, the fifth fault latch module immediately sets the first pressure signal to the corresponding fault safety value, and sets the second pressure signal to the corresponding fault safety value, that is, the fault safety value corresponding to the first pressure signal is set to the last beat of the first pressure signal before the fault is triggered, 10.24Mpa, and the fault safety value corresponding to the second pressure signal is set to the last beat of the second pressure signal before the fault is triggered, 15.3Mpa.

[0129] In this example, the method of the present application can quickly detect pressure sensor circuit breakage faults, signal drift faults, etc., can effectively cover various typical fault types of pressure sensors, improve the fault location capability of the flight control system, and at the same time set the first pressure signal to the corresponding fault safety value, and set the second pressure signal to the corresponding fault safety value, which can prevent the spread of pressure sensor faults and cause more serious loss of flight control system functions, thereby improving the availability of the flight control system.

[0130] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present invention that follow the general principles of this application and include common knowledge or customary techniques in the art that are not disclosed herein.

Claims

1. A method for monitoring and processing pressure signal faults in a flight control system, characterized in that: The method includes: receiving a first voltage signal output by a pressure sensor in a cavity when the actuator is extended and a second voltage signal output by a pressure sensor in a cavity when the actuator is retracted, and processing the first voltage signal and the second voltage signal respectively to obtain a first pressure signal and a second pressure signal; monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty; If the first pressure signal is less than a preset pressure signal lower threshold and lasts longer than a time delay threshold, it is determined that the pressure sensor in the extension chamber is faulty and a corresponding first fault type is output; wherein the first fault type is a high-side open circuit fault or a high-side short circuit fault; If the second pressure signal is less than the preset pressure signal lower threshold and the duration exceeds the delay threshold, it is determined that the pressure sensor in the retraction chamber is faulty and a corresponding second fault type is output; wherein the second fault type is the same as the first fault type; The first fault type is latched, and the first pressure signal is set to a corresponding fail-safe value according to the first fault type; and the second fault type is latched, and the second pressure signal is set to a corresponding fail-safe value according to the second fault type.

2. The flight control system pressure signal fault monitoring and processing method according to claim 1, characterized in that: After the step of monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the method further includes: If the first pressure signal is greater than a preset upper pressure signal threshold and lasts longer than the time delay threshold, it is determined that the pressure sensor in the extension chamber is faulty and a corresponding third fault type is output; wherein the third fault type is a low-end open circuit fault or a low-end short circuit fault; If the second pressure signal is greater than the preset pressure signal upper threshold and the duration exceeds the delay threshold, the pressure sensor in the retraction chamber is determined to be faulty and the corresponding fourth fault type is output; wherein the fourth fault type is the same as the third fault type.

3. The method for monitoring and processing pressure signal faults of a flight control system according to claim 2, characterized in that: After the step of determining that the pressure sensor in the extension chamber is faulty and outputting a corresponding third fault type if the first pressure signal is greater than a preset pressure signal upper threshold and the duration exceeds the delay threshold, the method further includes: latching the third fault type, and setting the first pressure signal to a corresponding fail-safe value according to the third fault type; After the step of determining that the pressure sensor in the retraction chamber is faulty and outputting a corresponding fourth fault type if the second pressure signal is greater than the preset pressure signal upper threshold and the duration exceeds the delay threshold, the method further includes: The fourth fault type is latched, and the second pressure signal is set to a corresponding fail-safe value according to the fourth fault type.

4. The method for monitoring and processing pressure signal faults of a flight control system according to claim 1, wherein: After the step of monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the method further includes: If the absolute value of the difference between the pressure difference between the two chambers of the actuator and the reference pressure difference exceeds the error threshold, and the duration exceeds the time delay threshold, it is determined that the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are both faulty, and the corresponding fifth fault type is output; wherein, the pressure difference between the two chambers is the difference between the first pressure signal and the second pressure signal, and the fifth fault type is a signal drift fault.

5. The flight control system pressure signal fault monitoring and processing method according to claim 4, characterized in that: After the step of determining that both the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty if the absolute value of the difference between the pressure difference between the two chambers of the actuator and the reference pressure difference exceeds the error threshold and the duration exceeds the delay threshold, and outputting a corresponding fifth fault type, the method further includes: The fifth fault type is latched, and according to the fifth fault type, the first pressure signal is set to a corresponding fail-safe value, and the second pressure signal is set to a corresponding fail-safe value.

6. The method for monitoring and processing pressure signal faults of a flight control system according to claim 4, characterized in that: The calculation formula of the reference pressure difference is as follows: （1） Where, represents the reference pressure difference, Indicates the hydraulic source pressure, Indicates the displacement change of the actuator piston, Indicates the servo valve slide position, Represents the proportionality factor.

7. The flight control system pressure signal fault monitoring and processing method according to claim 2, characterized in that: The preset pressure signal upper threshold is set to the upper limit of the normal operating range of the actuator hydraulic pressure plus a margin; The preset pressure signal lower threshold is set to the lower limit of the normal operating range of the actuator hydraulic pressure minus the margin.

8. The method for monitoring and processing pressure signal faults of a flight control system according to claim 7, characterized in that: The margin is calculated as follows: （2） Where, represents the margin, Indicates the pressure sensor accuracy error coefficient, represents the acquisition error coefficient, represents the signal transmission noise error coefficient, Indicates the full-scale pressure value of the pressure sensor.

9. The flight control system pressure signal fault monitoring and processing method according to claim 1, characterized in that: After the step of monitoring the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty, the method further includes: If the first pressure signal is greater than or equal to the preset pressure signal lower threshold and less than or equal to the preset pressure signal upper threshold, and the duration exceeds the delay threshold, it is determined that the pressure sensor in the extension chamber is normal, and the corresponding first pressure signal is output; If the second pressure signal is greater than or equal to the preset pressure signal lower threshold and less than or equal to the preset pressure signal upper threshold, and the duration exceeds the delay threshold, it is determined that the pressure sensor in the retraction chamber is normal, and the corresponding second pressure signal is output.

10. A flight control system pressure signal fault monitoring and processing system, characterized in that: The method for monitoring and processing pressure signal faults in a flight control system as claimed in any one of claims 1 to 9 above comprises: a receiving and processing module, configured to receive a first voltage signal output by a pressure sensor in the actuator extension cavity and a second voltage signal output by a pressure sensor in the actuator retraction cavity, and process the first voltage signal and the second voltage signal respectively to obtain a first pressure signal and a second pressure signal; a fault monitoring module, configured to monitor the first pressure signal and the second pressure signal in real time to determine whether the pressure sensor in the extension chamber and the pressure sensor in the retraction chamber are faulty; a first fault monitoring submodule, configured to determine that the pressure sensor in the extension chamber is faulty and output a corresponding first fault type if the first pressure signal is less than a preset pressure signal lower threshold and the duration exceeds a time delay threshold; wherein the first fault type is a high-side open circuit fault or a high-side short circuit fault; a second fault monitoring submodule, configured to determine that the pressure sensor in the retraction chamber is faulty and output a corresponding second fault type if the second pressure signal is less than the preset pressure signal lower threshold and the duration exceeds the delay threshold; wherein the second fault type is the same as the first fault type; A first fault latching module is used to latch the first fault type and set the first pressure signal to a corresponding fault-safe value according to the first fault type; and a second fault latching module is used to latch the second fault type and set the second pressure signal to a corresponding fault-safe value according to the second fault type.

Images