Method for selecting control instruction of flight control computer

Abstract

The invention relates to a method for selecting flight control computer control instructions. The method includes: computing a degraded mode control instruction by a degraded mode link of a secondary computer; receiving an indication signal of an operating mode of a secondary computer adjacent to the secondary computer, wherein the indication signal is received through a communication line arranged between the adjacent secondary computer and the secondary computer and used for transmitting an operating mode state quantity; and if the neighboring secondary computer is in a normal mode, the degraded mode link of the secondary computer selects a default security instruction as a degraded mode link instruction, otherwise the degraded mode link of the secondary computer selects the degraded mode control instruction as a degraded mode link instruction.

Description

Technical Field

[0001] The present disclosure relates to fly-by-wire flight control of an aircraft, and more particularly to a method for selecting control commands for a flight control computer. Background Art

[0002] Generally speaking, the flight control system modes of an aircraft include normal mode and degraded mode. In normal mode, the control law is calculated by a main computer and sent to the actuator system through four sub-computers. There is no signal cross-linking between the four sub-computers. Under certain fault conditions, the sub-computer will enter the degraded mode from normal mode. At this time, the control law in the degraded mode is calculated by the sub-computer and sent directly to the actuator system connected to the back end of the sub-computer to control the corresponding control surface. Since several actuators of the same control surface work in a master-master or master-master-master manner and are connected to different sub-computers, if the working modes of different sub-computers connected to the same control surface are inconsistent, different actuators on the same control surface will respond to different control mode instructions, which will cause the control surface to oscillate due to mixed-mode force disputes, which will not only reduce the control performance of the aircraft, but also affect the fatigue life of the control surface and even affect the flight safety of the aircraft.

[0003] In this way, due to the current flight control system architecture, when a single secondary computer enters degraded mode, the flight control system enters a mixed mode operating scenario. This will not only cause large force disputes on the control surfaces, affecting the fatigue life of the control surfaces, but also lead to a decrease in the aircraft's controllability, making the aircraft unable to meet the CAT IIIb automatic landing "fail-to-work" requirements.

[0004] The present disclosure is improved in view of but not limited to the above-mentioned factors. Summary of the Invention

[0005] To this end, the present disclosure proposes a solution for selecting control instructions of a secondary computer in a flight control system. The solution of the present disclosure enables the secondary computer (especially its degraded mode link) to select the control instructions to be output according to the working mode of the adjacent secondary computer by adding a communication line between adjacent secondary computers. In the method of the present disclosure, the working mode status quantities are mutually transmitted between adjacent secondary computers, and the status quantities are sent from the normal mode link of the secondary computer to the degraded mode link of the adjacent secondary computer. If the status quantity indicates that the adjacent secondary computer is in the normal mode, the degraded mode link of the secondary computer replaces the degraded mode control instruction calculated by itself with a default safety instruction as the degraded mode link instruction, so that when the secondary computer is in the degraded mode, the default safety instruction can be output to the backend actuator (for aborting the control of the backend actuator). Until the working mode status quantity from the adjacent secondary computer indicates that the adjacent secondary computer is not in the normal mode, the degraded mode link of this secondary computer changes to select the degraded mode control instruction calculated by itself (instead of replacing it with the default safety instruction), so that when this secondary computer is in the degraded mode, the degraded mode control instruction calculated by the degraded mode link (instead of the default safety instruction) can be output to the backend actuator, thus avoiding the serious force disputes of the rudder surface caused by the output of mixed mode instructions by redundant secondary computers (in other words, the secondary computer and the adjacent secondary computer are redundant to each other).

[0006] According to a first aspect of the present disclosure, a method for selecting control instructions of a flight control computer is provided, including: calculating a degraded mode control instruction by a degraded mode link of a secondary computer; receiving an indication signal of the working mode of an adjacent secondary computer of the secondary computer, where the indication signal is received through a communication line for transmitting a working mode status quantity arranged between the adjacent secondary computer and the secondary computer; and if the adjacent secondary computer is in the normal mode, the degraded mode link of the secondary computer selects a default safety instruction as the degraded mode link instruction, otherwise the degraded mode link of the secondary computer selects the degraded mode control instruction as the degraded mode link instruction.

[0007] According to an embodiment, the secondary computer and the adjacent secondary computer are in the same cabin area.

[0008] According to another embodiment, the communication line includes a unidirectional line leading from the normal mode link of the secondary computer to the degraded mode link of the adjacent secondary computer and a unidirectional line leading from the normal mode link of the adjacent secondary computer to the degraded mode link of the secondary computer.

[0009] According to still another embodiment, the adjacent secondary computer issues an indication signal of being in the degraded mode when detecting that it is in the degraded mode or receiving an instruction to enter the degraded mode from the primary computer.

[0010] According to another embodiment, the instruction from the host computer to enter the degraded mode is issued by the host computer to each secondary computer when the host computer monitors that the number of secondary computers in the abnormal mode is greater than or equal to two, where the abnormal mode includes the degraded mode and the fault mode.

[0011] According to another embodiment, the method further includes: when determining that it is in the degraded mode, the secondary computer outputs the degraded mode link instruction from the degraded mode link to control the corresponding actuator, and when determining that it is in the normal mode, the secondary computer outputs the normal mode link instruction to control the corresponding actuator.

[0012] According to another embodiment, the default safety instruction can cause the secondary computer to abort the control of the corresponding actuator, so that the secondary computer does not actively control the corresponding actuator.

[0013] According to another embodiment, the method is executed cyclically.

[0014] According to a second aspect of the present disclosure, there is provided a secondary computer for a flight control system of an aircraft, the secondary computer including a processing device configured to execute the method according to the first aspect of the present disclosure.

[0015] According to a third aspect of the present disclosure, there is provided an aircraft including the secondary computer according to the second aspect of the present disclosure.

[0016] Each aspect generally includes methods, apparatuses, systems, computer program products, and processing systems as substantially described herein with reference to the accompanying drawings and as illustrated by the accompanying drawings.

[0017] The foregoing has outlined rather broadly the features and technical advantages of examples in accordance with the present disclosure so that the detailed description that follows may be better understood. Additional features and advantages will be described hereinafter. The disclosed concepts and specific examples can be readily used as a basis for modifying or designing other structures for carrying out the same purposes as the present disclosure. Such equivalent constructions do not depart from the scope of the appended claims. The characteristics of the concepts disclosed herein, both in their organization and operation methods, as well as the associated advantages, will be better understood by considering the following description in conjunction with the accompanying drawings. Each drawing is provided for purposes of illustration and description, and does not define a limitation on the claims. Description of the Drawings

[0018] To understand the manner in which the above-described features of the present disclosure can be used in detail, the content briefly outlined above can be described more specifically with reference to various aspects, some of which are illustrated in the accompanying drawings. It should be noted, however, that the drawings only illustrate certain typical aspects of the present disclosure and should not be considered to limit its scope, as the description may allow other equally effective aspects. The same reference numerals in different drawings may identify the same or similar elements.

[0019] Figure 1 A flowchart showing a method for selecting flight control computer control instructions according to an embodiment of the present disclosure;

[0020] Figure 2 A schematic diagram showing a cross-linking architecture between secondary computers according to an exemplary embodiment of the present disclosure;

[0021] Figure 3 A schematic diagram showing a secondary computer of a flight control system for an aircraft according to an aspect of the present disclosure; and

[0022] Figure 4 A schematic diagram showing an aircraft according to an exemplary embodiment of the present disclosure. Detailed Description of the Invention

[0023] The inventors have recognized that the fly-by-wire flight control systems currently used in aircraft (especially civil aircraft) include cockpit control devices, flight control computers, and flight control actuator assemblies for manipulating corresponding control surfaces. The flight control computers generally include redundant primary computers and secondary computers. Each of the redundant secondary computers corresponds to a control channel and is configured to independently receive cockpit control instructions from the cockpit control devices and perform control law calculations in the event of a failure of the primary computer. Each secondary computer is communicatively connected to a corresponding flight control actuator assembly, so that the minimum flight safety requirements of the aircraft can be achieved when each control surface operates independently in a single control channel.

[0024] The inventors have also recognized that the existing aircraft designs have the following problems:

[0025] After a single flight control system secondary computer enters the degraded mode, the entire flight control system will enter the hybrid control mode. At this time, the aircraft control performance can only meet the "fail-safe" working requirements of the automatic flight function, and thus cannot support the "fail-operational" requirements of the CATIIIb automatic landing system;

[0026] For the control surfaces operating in the master-master or master-master-master mode, if a secondary computer of a single flight control system enters the degraded mode, it will cause continuous and significant control surface force disputes and oscillations among multiple actuators on the same control surface due to their responses to instructions of different control modes. This will affect the fatigue life of the control surface, may even affect the flight safety of the aircraft, and increase the maintenance work such as aircraft structure flaw detection, resulting in additional operating costs.

[0027] The inventors also recognized that the existing solutions for force disputes mainly rely on the control law for mitigating control surface force disputes and the force dispute oscillation monitor, but there are deficiencies. For example:

[0028] In the case where the secondary computer is in the degraded mode, it cannot respond to the force dispute mitigation instructions from the primary computer, thus lacking the force dispute mitigation function;

[0029] For the control surface with a 2-actuator redundancy configuration, the force dispute oscillation monitor cannot determine the fault source, so it will cut off both actuators on the control surface simultaneously, significantly reducing the aircraft's maneuverability;

[0030] For the control surface with a 3-actuator redundancy configuration, the actuator that triggers the monitor is controlled by the secondary computer in the degraded mode, so it cannot control the cut-off of this actuator, and the control surface will have continuous force disputes;

[0031] When the force dispute oscillation monitor is triggered, the control surface has already suffered fatigue damage, and the aircraft still needs to carry out maintenance work such as structure flaw detection, resulting in additional operating costs;

[0032] And so on.

[0033] Generally speaking, the flight control system modes of an aircraft include a normal mode and a degraded mode. In the normal mode, the control law is calculated by one main computer and sent to the actuation system through four secondary computers. There is no signal cross-linking between the four secondary computers. Each secondary computer includes two links, namely a normal mode link and a degraded mode link. The normal mode link receives control instructions from the main computer and outputs normal mode link instructions, while the degraded mode link calculates and outputs the degraded mode control instructions by itself as the degraded mode link instructions. Subsequently, the secondary computer can output the instructions from one of these two links to the corresponding actuation system accordingly based on whether it is in the normal mode or the degraded mode. That is, when the secondary computer is in the normal mode, the secondary computer selects the normal mode link instructions from the normal mode link to control the corresponding actuation system. When the secondary computer is in the degraded mode, the secondary computer selects the degraded mode link instructions from the degraded mode link to control the corresponding actuation system. Under specific fault conditions, the secondary computer will enter the degraded mode from the normal mode. At this time, the control law in the degraded mode is calculated by the secondary computer (i.e., its degraded mode link) and directly sent to the actuation system connected to the backend of this secondary computer to control the corresponding control surface. Since several actuators of the same control surface work in a master-master or master-master-master form and are connected to different secondary computers, if the working modes of different secondary computers of the same control surface are inconsistent, it will cause different actuators on the same control surface to respond to different control mode instructions, which will cause the control surface to oscillate due to the generation of mixed-mode force disputes, resulting in a decline in the control performance of the aircraft, affecting the fatigue life of the control surface, and even affecting the flight safety of the aircraft.

[0034] Thus, the inventor realized that due to the current flight control system architecture, when a single secondary computer enters the degraded mode, the flight control system enters a mixed-mode working scenario, which not only causes large force disputes on the control surface and affects the fatigue life of the control surface, but also leads to a decline in the aircraft's handling performance, making the aircraft unable to meet the "fail-operational" requirement of CAT IIIb automatic landing.

[0035] To this end, the present disclosure proposes a solution for selecting control instructions of a secondary computer in a flight control system. The solution of the present disclosure enables the secondary computers (especially their degraded mode links) to select the control instructions to be output according to the working modes of adjacent secondary computers by adding communication lines between adjacent secondary computers. In the method of the present disclosure, the working mode status quantities are mutually transmitted between adjacent secondary computers, and the status quantities are sent from the normal mode link of a secondary computer to the degraded mode link of an adjacent secondary computer. If the status quantity indicates that the adjacent secondary computer is in the normal mode, the degraded mode link of the secondary computer replaces the degraded mode control instruction calculated by it with a default safety instruction as the degraded mode link instruction, so that when the secondary computer is in the degraded mode, the default safety instruction can be output to the backend actuator (for aborting the control of the backend actuator). Until the working mode status quantity from the adjacent secondary computer indicates that the adjacent secondary computer is not in the normal mode, the degraded mode link of this secondary computer changes to select the degraded mode control instruction calculated by itself (instead of replacing it with the default safety instruction), so that when the secondary computer is in the degraded mode, the degraded mode control instruction calculated by the degraded mode link (instead of the default safety instruction) can be output to the backend actuator, thereby avoiding the serious force disputes of the control surface caused by the redundant secondary computers outputting mixed mode instructions.

[0036] Thus, the method of the present disclosure enables:

[0037] 1) When a single secondary computer enters the degraded mode, through the selection logic of the control instructions, the backend actuator is controlled to be in the bypass state (that is, this single secondary computer no longer actively controls the backend actuator), thereby avoiding the flight control system from entering the mixed working mode and eliminating the adverse effects of force disputes;

[0038] 2) When a single secondary computer enters the degraded mode, since the flight control system does not enter the mixed working mode, the aircraft can still support the CAT IIIb automatic landing function, improving the maneuverability of the aircraft;

[0039] 3) Preferably, the communication line of the present disclosure is set as a one-way communication line leading from the normal mode link of a secondary computer to the degraded mode link of an adjacent secondary computer, so that the degraded mode link of one secondary computer will not affect the normal mode links of other secondary computers.

[0040] The detailed description set forth below in connection with the accompanying drawings is intended as a description of various configurations and is not intended to represent the only configurations in which the concepts described herein can be practiced. The detailed description includes specific details to provide a thorough understanding of the various concepts. However, it will be apparent to those skilled in the art that these concepts may be practiced without these specific details.

[0041] Reference Figure 1, which shows a flowchart of a method 100 for selecting flight control computer control instructions according to an embodiment of the present disclosure.

[0042] As shown, method 100 may include, at block 110, calculating a degraded mode control instruction by a degraded mode link of a secondary computer.

[0043] In this embodiment, each secondary computer includes two links: a normal mode link and a degraded mode link. The normal mode link receives control instructions from the primary computer and outputs normal mode link instructions for the secondary computer to output to the corresponding actuator in the normal mode. The degraded mode link calculates the degraded mode control instruction by itself and outputs this instruction as the degraded mode link instruction for the secondary computer to output to the corresponding actuator in the degraded mode. Subsequently, the secondary computer can correspondingly output an instruction from one of these two links to the corresponding actuation system based on whether it is in the normal mode or the degraded mode, that is: when the secondary computer is in the normal mode, the secondary computer selects the normal mode link instruction from the normal mode link for controlling the corresponding actuation system; when the secondary computer is in the degraded mode, the secondary computer selects the degraded mode link instruction from the degraded mode link for controlling the corresponding actuation system.

[0044] Continuing to refer to Figure 1 , method 100 may include, at block 120, receiving an indication signal of the operating mode of an adjacent secondary computer of the secondary computer. In one embodiment, this indication signal is received through a communication line provided between the adjacent secondary computer and this secondary computer for transmitting the operating mode status quantity.

[0045] Therefore, in this embodiment, a communication line for transmitting the operating mode status quantity is provided between the adjacent secondary computer and this secondary computer. In a preferred embodiment of the present disclosure, this communication line includes a one-way line from the normal mode link of this secondary computer to the degraded mode link of the adjacent secondary computer and a one-way line from the normal mode link of the adjacent secondary computer to the degraded mode link of this secondary computer. Thus, in this preferred embodiment, it can be ensured that the normal mode link of the secondary computer will not be affected by the degraded mode link of its adjacent secondary computer, reducing system complexity and improving system robustness.

[0046] Different from the solution of the present disclosure, in the existing system, in the normal mode, the control law is calculated by 1 primary computer and sent to the actuator system through 4 secondary computers to control the corresponding control surfaces, and there is no signal cross-linking between the 4 secondary computers (that is, there is no communication line for transmitting the operating mode status quantity between the secondary computers); in the degraded mode, the control law in the degraded mode is calculated by the secondary computer and directly sent to the actuation system connected to the backend of this secondary computer.

[0047] Refer toFigure 2 , which shows a schematic diagram of the cross-linking architecture between secondary computers according to an exemplary embodiment of the present disclosure.

[0048] As Figure 2 shown, the flight control system may include several primary computers (e.g., three) and four secondary computers ( Figure 2 shown as secondary computer 1, secondary computer 2, secondary computer 3, and secondary computer 4 in Figure 2 . Among them, secondary computer 1 and secondary computer 2 are adjacent secondary computers to each other (both are in compartment area 1), and secondary computer 3 and secondary computer 4 are adjacent secondary computers to each other (both are in compartment area 2).

[0049] Referring to Figure 2 , it can be seen that there is a one-way communication line between the normal mode link of secondary computer 1 and the degraded mode link of secondary computer 2 for secondary computer 1 to transmit its normal mode link state to secondary computer 2; similarly, there is a one-way communication line between the normal mode link of secondary computer 2 and the degraded mode link of secondary computer 1 for secondary computer 2 to transmit its normal mode link state to secondary computer 1. The same settings are made for secondary computer 3 and secondary computer 4, which will not be elaborated here.

[0050] Generally speaking and as Figure 2 shown, the 4 secondary computers are set in different compartment areas of the aircraft in pairs to improve the independence between the secondary computers and avoid problems such as common mode failures. Thus, in the preferred embodiment of the present disclosure, the secondary computer and its adjacent secondary computer are in the same compartment area. In this preferred embodiment, the added communication line can have a shorter size, thereby effectively reducing the total weight and at the same time maintaining the independence between the secondary computers to the greatest extent. In a further preferred embodiment, the secondary computer and its adjacent secondary computer are respectively connected to the corresponding actuators for operating at least one common control surface. For example, the two actuators of aileron can work in a primary-primary form, and the secondary computer and its adjacent secondary computer are respectively connected to one of the two actuators of the same aileron. In another embodiment of the present disclosure, the control surface can be an aileron, a rudder, an elevator, etc.

[0051] In yet another embodiment of the present disclosure, the indication signal of the operating mode of the adjacent sub-computer may indicate whether the adjacent sub-computer is in the normal mode. According to various embodiments, the adjacent sub-computer issues an indication signal of being in the degraded mode when it detects that it is in the degraded mode or receives an instruction from the host computer to enter the degraded mode. For example, the adjacent sub-computer may monitor its own operating state in real time and enter the degraded mode when in a specific fault, and thus can detect this. Alternatively, the adjacent sub-computer may determine that it is to be in the degraded mode after receiving an instruction from the host computer to enter the degraded mode. In other words, in this embodiment, the adjacent sub-computer may be in the normal mode and enter the degraded mode and then determine that it is in the degraded mode after receiving an instruction from the host computer to enter the degraded mode. The instruction from the host computer to enter the degraded mode is issued by the host computer to each sub-computer when the host computer monitors that the number of sub-computers in the abnormal mode is greater than or equal to two, where the abnormal mode includes the degraded mode and the fault mode. In this embodiment, the host computer continuously monitors the operating modes of each sub-computer, and when two or more sub-computers are in the degraded mode or the fault mode (i.e., the abnormal mode), the entire system enters the degraded mode, thereby sending an instruction to enter the degraded mode to the sub-computers that are in the normal mode, so that the corresponding sub-computers enter the degraded mode.

[0052] , then the sub-computer selects the default safety instruction as the instruction, otherwise the sub-computer uses the following as the degraded mode link instruction.

[0053] Subsequently, if the adjacent sub-computer is in the normal mode, method 100 proceeds to block 130, where the default safety instruction is selected as the degraded mode link instruction for the degraded mode link of this sub-computer. In one embodiment, the default safety instruction may cause the sub-computer to abort the control of the corresponding actuator, so that the sub-computer does not actively control the corresponding actuator. Thus, when this sub-computer (when in the degraded mode) outputs the default safety instruction to the corresponding actuator, it does not actively control the corresponding actuator, and thus does not exert any effect or influence on the control surface, and only the adjacent sub-computer in the normal mode manipulates the control surface, avoiding force disputes. For example, the default safety instruction cuts off the control solenoid valve to make the rear actuator in the standby state, that is, this instruction keeps the position of the control surface unchanged and the solenoid valve instruction is 0 (i.e., cuts off the solenoid valve without affecting the actuator).

[0054] Otherwise, if the adjacent sub-computer is not in the normal mode (e.g., the degraded mode or the fault mode), then method 100 proceeds to block 140, where the degraded mode control instruction calculated by the degraded mode link of this sub-computer is selected as the degraded mode link instruction for the degraded mode link of this sub-computer.

[0055] In yet another embodiment of the present disclosure, method 100 may be executed by a degraded mode link loop of a secondary computer. Thus, when the degraded mode link of the secondary computer detects that an adjacent secondary computer is in the normal mode, the degraded mode link of this secondary computer will select a default safety instruction (thus being in a "silent" state) and continuously monitor the operating mode of the adjacent secondary computer. Subsequently, when the adjacent secondary computer is not in the normal mode (for example, the adjacent secondary computer receives an instruction from the primary computer to enter the degraded mode and enters the degraded mode, or experiences some kind of failure and enters the failure mode, etc.), the degraded mode link of this secondary computer wakes up from "silence" and selects a degraded mode control instruction calculated by itself.

[0056] Thereby, the degraded mode link of the secondary computer can depend on the operating mode of the adjacent secondary computer to select either the default safety instruction or the calculated degraded mode control instruction, so that when the secondary computer outputs a control instruction to the corresponding actuator, it can output the default safety instruction in the degraded mode instead of always outputting the degraded mode control instruction, thereby improving the maneuverability of the control surface in the case of a single secondary computer failure, supporting the CAT IIIb automatic landing function, and also avoiding force disputes.

[0057] Thereby, method 100 may further include the secondary computer outputting a degraded mode link instruction from the degraded mode link to control the corresponding actuator when determining that it is in the degraded mode, and outputting a normal mode link instruction from the normal mode link to control the corresponding actuator when determining that it is in the normal mode. In an embodiment of the present disclosure, when the secondary computer is in the degraded mode while its adjacent secondary computer is in the normal mode, the degraded mode link instruction output by this secondary computer will be the default safety instruction instead of the degraded mode control instruction calculated by the degraded mode link.

[0058] It will be understood that although the various steps are shown and described in sequence, these steps may be executed in a different order or in parallel, such as steps 110 and 120 may be executed in the reverse order or in parallel. Figure 1

[0059] Figure 3 Referring to , which shows a schematic diagram of a secondary computer 300 of a flight control system for an aircraft according to an aspect of the present disclosure.

[0060] Figure 3 As Figure 1-2 shown, the secondary computer 300 may include a processing device 305. In various embodiments, the processing device 305 may be configured to execute methods according to the embodiments of the present disclosure, such as method 100 described in conjunction with

[0061] ​​Figure 4 FIG. 1 shows a schematic diagram of an aircraft 400 according to an exemplary embodiment of the present disclosure. In one embodiment of the present disclosure, the aircraft 400 may include a secondary computer according to the embodiments of the present disclosure, such as the secondary computer 300 described in connection with Figure 3 the secondary computer 300 described above.

[0062] Thus, the present disclosure proposes a flight control computer control instruction selection scheme based on the existing flight control system architecture. In the solution of the present disclosure, by establishing communication between adjacent secondary computers located in the same area, the control instructions of itself are selected according to the working modes of the adjacent secondary computers, so as to control the rear actuator to be in a bypass state or directly control, avoid the flight control system from entering the hybrid working mode, reduce the adverse effects of force disputes, improve the operability of the aircraft, and further support the CAT IIIb automatic landing function.

[0063] In the solution of the present disclosure, the working mode status quantities are mutually transmitted between adjacent secondary computers, and the status quantities are sent from the normal mode link of the secondary computer to the degradation mode link of the adjacent secondary computer. If the status quantity indicates that the adjacent secondary computer is working in the normal mode, the degradation mode link of the secondary computer converts (sets) the degradation mode (also called the direct mode) control instruction into a default safety instruction (that is, itself has no influence on the relevant actuator). If the status quantity indicates that the adjacent secondary computer is not working in the normal mode, the degradation mode link of the secondary computer sets the degradation mode control instruction to an effective degradation mode control law calculation instruction, thus avoiding the serious force disputes on the rudder surface caused by the redundant secondary computers outputting hybrid mode instructions.

[0064] The present invention proposes a new flight control computer control instruction selection scheme to ensure that the redundant flight control computers do not enter the hybrid working mode, so as to support the CAT IIIb automatic landing system to meet the "fail-operational" requirements, and can slow down the rudder surface force disputes, providing the ability for the aircraft to fly and land safely continuously.

[0065] The above specific embodiments include references to the accompanying drawings, which form part of the specific embodiments. The drawings illustrate specific embodiments that may be practiced by way of illustration. Such embodiments are also referred to herein as "examples". Such examples may include elements other than those shown or described. However, examples including the elements shown or described are also contemplated. In addition, examples using any combination or arrangement of the elements shown or described, or referring to the specific examples (or one or more aspects thereof) shown or described herein, or referring to other examples (or one or more aspects thereof) shown or described herein are also contemplated.

[0066] In the appended claims, the terms "comprising" and "including" are open-ended, meaning that a system, apparatus, article, or process that includes elements other than those recited after such terms in a claim is still considered to fall within the scope of that claim. Additionally, in the appended claims, the terms "first," "second," "third," etc. are used merely as labels and are not intended to indicate a numerical order of their objects.

[0067] Also, the order of the operations recited in this specification is exemplary. In alternative embodiments, the operations may be performed in a different order than shown in the figures, and the operations may be combined into a single operation or split into more operations.

[0068] The above description is intended to be illustrative, not restrictive. For example, the above-described examples (or one or more aspects thereof) may be used in combination with other embodiments. Other embodiments may be used, for example, by those of ordinary skill in the art after reviewing the above description. The abstract allows the reader to quickly ascertain the nature of the technical disclosure. The abstract is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. Additionally, in the above Detailed Description, various features may be grouped together to streamline the disclosure. However, the claims may not recite every feature disclosed herein, as an embodiment may represent a subset of the features. Moreover, an embodiment may include fewer features than those disclosed in a particular example. Thus, the appended claims are hereby incorporated into the Detailed Description, with each claim standing on its own as a separate embodiment. The scope of the embodiments disclosed herein should be determined with reference to the appended claims and the full scope of equivalents to which such claims are entitled.

Claims

1. A method for selecting flight control computer control instructions, comprising: Calculating degraded mode control instructions by a degraded mode link of a secondary computer; Receiving an indication signal of the operating mode of an adjacent secondary computer of the secondary computer, wherein the indication signal is received through a communication line for transmitting operating mode status variables provided between the adjacent secondary computer and the secondary computer; And If the adjacent secondary computer is in the normal mode, the degraded mode link of the secondary computer selects a default safety instruction as the degraded mode link instruction, otherwise the degraded mode link of the secondary computer selects the degraded mode control instruction as the degraded mode link instruction.

2. The method according to claim 1, wherein The secondary computer and the adjacent secondary computer are in the same compartment area.

3. The method according to claim 1, characterized in that, The communication line includes a one-way line from the normal mode link of the secondary computer to the degraded mode link of the adjacent secondary computer and a one-way line from the normal mode link of the adjacent secondary computer to the degraded mode link of the secondary computer.

4. The method according to claim 1, characterized in that, The adjacent secondary computer issues an indication signal of being in the degraded mode when detecting that it is in the degraded mode or receiving an instruction from the primary computer to enter the degraded mode.

5. The method according to claim 4, characterized in that, The instruction from the primary computer to enter the degraded mode is issued by the primary computer to each secondary computer in the following case: the primary computer monitors that the number of secondary computers in the abnormal mode is greater than or equal to two, wherein the abnormal mode includes the degraded mode and the fault mode.

6. The method according to claim 1, wherein Further comprising: When determining that it is in the degraded mode, the secondary computer outputs the degraded mode link instruction from the degraded mode link to control the corresponding actuator, and when determining that it is in the normal mode, the secondary computer outputs the normal mode link instruction to control the corresponding actuator.

7. The method according to claim 1, characterized in that, The default safety instruction can cause the secondary computer to abort the control of the corresponding actuator, so that the secondary computer does not actively control the corresponding actuator.

8. The method according to claim 1, characterized in that The method is cyclically executed by the degraded mode link of the secondary computer.

9. A secondary computer for a flight control system of an aircraft, the secondary computer comprising a processing device configured to execute the method according to any one of claims 1-8.

10. An aircraft comprising the secondary computer according to claim 9.

Images