EVTOL control system and control method

Abstract

The invention belongs to the technical field of aircraft control, and relates to an eVTOL control system and control method.The system comprises a main control device, a main control controller, an auxiliary control device and an auxiliary control controller; the main control device is connected with the main control controller, and the main control device is used for generating a main control instruction and transmitting the main control instruction to the flight control computer through the main control controller; the auxiliary control device is connected with the auxiliary control controller, and the auxiliary control device is used for generating an auxiliary control instruction and transmitting the auxiliary control instruction to the flight control computer through the auxiliary control controller; the auxiliary control device is provided with a main control cut-off switch; an external power supply is connected with the main operation controller through the main operation cut-off switch and supplies power to the main operation controller; and the power supply of the main operation controller is actively cut off through the main operation change-over switch, so that the active switching of the control authority is realized.

Description

Technical Field

[0001] This invention belongs to the field of aircraft control technology and relates to an eVTOL control system and control method. Background Technology

[0002] With the rapid development of technology, electric vertical takeoff and landing (eVTOL) aircraft have shown great potential in urban transportation, tourism, and logistics. However, existing eVTOL control systems still face some significant problems and challenges in practical applications.

[0003] Traditional aircraft control systems typically employ multiple control devices such as side sticks, pedals, and throttles to achieve multi-axis control. For high-safety commercial aircraft and helicopters, a dual-cockpit control system layout is often used, resulting in high complexity, large size, heavy weight, and high cost. For eVTOLs, such control systems not only increase the aircraft's load, affecting its flight performance and energy efficiency, but also limit the aircraft's internal space layout and payload. This restricts the widespread application of manned eVTOLs, especially in scenarios such as urban transportation and tourism, where a simple, intuitive, compact, reliable, and low-cost control system is needed to meet user requirements.

[0004] In existing eVTOL control systems, the control devices are often singular and lack effective auxiliary control methods. Once the control devices malfunction or fail, the safety of the aircraft will be seriously threatened, greatly affecting the airworthiness certification and commercial application of eVTOL. Summary of the Invention

[0005] This invention provides an eVTOL operating system and control method that can meet the application requirements of eVTOL and has advantages such as high safety, high reliability, small size and weight, simplicity and low cost.

[0006] The technical solution adopted by this invention to solve its technical problem is: Technical Solution 1: An eVTOL control system includes a main control device, a main control controller, an auxiliary control device, and an auxiliary control controller, and has a four-axis high-safety control function.

[0007] The main control unit is equipped with command elements including a longitudinal sensor, a lateral sensor, a heading sensor, a vertical sensor, and a communication switch. The longitudinal sensor uses a magnetoresistive sensor to accurately sense the longitudinal displacement of the main control unit, serving as the control command for forward / reverse movement. The longitudinal sensor employs an electrically redundant configuration within space constraints to increase the safety of longitudinal control. The lateral sensor uses a magnetoresistive sensor to sense the lateral displacement of the main control unit, serving as the control command for left / right swerve movement. The lateral sensor also employs an electrically redundant configuration within space constraints to increase the safety of lateral control. The heading sensor uses a magnetoresistive sensor to sense the lateral displacement of the main control unit, serving as the control command for left / right turn movement. The heading sensor also employs an electrically redundant configuration within space constraints to increase the safety of lateral control. The vertical sensor uses a potentiometer to sense the vertical displacement of the main control unit, serving as the control command for ascent / descent movement. The vertical sensor employs a mechanically redundant configuration to enhance the safety of vertical operation of the main control unit, given the space constraints. The intercom switch, a single-redundant configuration, allows the driver to communicate with ground base station personnel. Pressing the switch activates the intercom, enabling communication between the driver and ground base station personnel.

[0008] The main control controller is configured with independent dual-redundant channels (Channel A and Channel B). Each redundant channel includes a digital processing module, a signal interface and processing module, a main CAN bus interface module, a main programming interface module, and a main power supply module. Taking one redundant channel as an example, the signal interface and processing module supplies power to the longitudinal, lateral, heading, and vertical sensors, receives analog voltage command signals from these sensors, and converts these analog signals into digital signals under the control of the main digital control module before sending them to the main digital control module. The main digital control module receives command data from the signal interface and processing module and command data from the other redundant channel. After internal data calculation, comparison, and processing, it obtains the four-axis control commands and sends them to the external CANFD / CAN bus via the main CAN bus interface module. The main programming interface module provides a programming interface for the processor in the main digital control module, facilitating program download and debugging. The main power supply module receives two external DC power supplies, performs power synthesis, filtering, and conversion, and supplies power to each module of the redundant channel of the main control controller.

[0009] The auxiliary control device is an extremely simple control device designed to improve its basic reliability. The configured command elements include a forward switch, a reverse switch, a left turn switch, a right turn switch, an ascent switch, and a descent switch, as well as a main control cut-off switch. The forward and reverse switches are discrete control commands for the aircraft's forward / reverse movement. Both are single-pole, single-throw self-resetting buttons, normally open, and closed when pressed, indicating a control action along that axis. The left and right turn switches are discrete control commands for the aircraft's left / right turn movement. Both are single-pole, single-throw self-resetting buttons, normally open, and connected when pressed, indicating a control action along that axis. The ascent and descent switches are discrete control commands for the aircraft's ascent / descent movement. Both are single-pole, single-throw self-resetting buttons, normally open, and connected when pressed, indicating a control action along that axis. The main control cut-off switch is the power cut-off switch for the main control controller, capable of directly cutting off / connecting the two DC power supplies to the main control controller for forced transfer of control authority.

[0010] The auxiliary control controller features a simple single-redundant channel configuration to improve its basic reliability. It includes a digital processing module, a discrete signal interface and processing module, an auxiliary CAN bus interface module, an auxiliary programming interface module, and an auxiliary power supply module. The discrete signal interface and processing module receives discrete control commands from the forward, backward, left, right, up, and down switches. The auxiliary digital control module receives command data from the discrete signal interface and processing module, processes it internally, and then sends the discrete control commands to two external CAN buses via the auxiliary CAN bus interface module. The auxiliary programming interface module provides a programming interface for the processor in the auxiliary digital control module, facilitating program download and debugging. The main power supply module receives two external DC power supplies, processes them through power synthesis, filtering, and conversion, and then supplies power to all modules of the auxiliary control controller.

[0011] Preferably, the main digital control modules contained in the two channels of the main control controller can employ different (dissimilar) processor schemes or the same processor scheme. The processor type can be a microprocessor scheme or a programmable logic device scheme.

[0012] Preferably, the two redundant channels of the main control controller interact with each other via inter-channel data link (CCDL).

[0013] Technical Solution Two: A control method for an eVTOL operating system, wherein the control authority transfer logic is applied to the operating system as described in technical solution one, and the control authority transfer logic is as follows: S1. After the operating system is powered on, the operating authority is on the main control controller by default; S2. If any redundancy of the longitudinal sensor, lateral sensor, yaw sensor, or vertical sensor in the main control unit fails and has been detected by the main control controller, the main control controller determines that the corresponding channel has a sensor failure, sets the command sent to the flight control computer to a safe value and the corresponding fault flag position to invalid, and the main control controller continues to send control commands to the flight control computer through another normal channel, and the control authority is not transferred. S3. If any of the longitudinal, lateral, yaw, or vertical sensors in the main control unit fails and cannot be detected by the main control controller, the command values ​​obtained by the two channels of the main control controller will differ significantly during the operation of the main control unit. The controller will determine that a fault has occurred, set the command sent to the flight control computer to a safe value, and set the corresponding fault flag to invalid. The flight control computer will transfer the control authority to the auxiliary control controller, which will then provide the control commands. S4. If a short circuit or open circuit occurs in the cable between the sensor in the main control device and the main control controller, there will be a large difference in the command values ​​obtained by the two channels of the main control controller during the operation of the main control device. The main control controller itself will determine that a fault has occurred, set the command sent to the flight control computer to a safe value and set the corresponding fault flag position to invalid. The flight control computer will transfer the control authority to the auxiliary control controller, and the auxiliary control controller will provide the control commands. S5. If any of the main digital control module, signal interface and processing module, main CAN bus module, main power module or CANFD / CAN bus in a certain channel of the main control controller fails, the corresponding channel of the flight control computer will not receive instructions or will receive incorrect instructions. The flight control computer will transfer the control authority to the auxiliary control controller, which will provide control instructions. S6. If the data link transmission between the main control controller channels (CCDL) fails, the two channels of the main control controller cannot obtain data from the other channel. The main control controller itself determines that a fault has occurred, sets the command sent to the flight control computer to a safe value and sets the corresponding fault flag position to invalid. The flight control computer transfers the control authority to the auxiliary control controller, which provides the control commands. S7. If one of the external power supplies of the main control controller fails, the main power module will continue to operate normally and the control authority will not be transferred. S8. If a common-mode fault occurs in the main control unit, main control controller, or cable, and the flight control computer cannot identify the fault through the fault flag on the bus, the pilot shall determine whether there is a fault based on the control commands and the aircraft response. In this case, the pilot shall manually cut off the power supply to the main control stick by using the main control switching switch on the auxiliary control controller, so that the main control controller stops sending data to the bus. After the flight control computer detects that the main control controller has stopped sending data, it shall transfer the control authority to the auxiliary control controller, which shall provide the control commands. S9. If the main control device, main control controller, or cable are all normal, in the event of manual operation of the main control switch, the main control controller will lose power. After the flight control computer detects that the main control controller has stopped sending data, it will transfer the control authority to the auxiliary control controller, which will then provide control commands. S10. If the control authority has been transferred to the auxiliary control controller, and the manual control main control switch is reset, if the main control device, main control controller, or cable are all normal, the control authority will be transferred to the main control controller, which will provide control commands. If any one of the main control device, main control controller, or cable fails, the control authority will not be transferred, and the auxiliary control controller will still provide control commands.

[0014] The advantages of this invention are: (1) High security: This invention provides two independent operation modes and designs operation authority transfer logic, which effectively prevents the risk of loss of operation instructions due to the failure of one operation mode, and greatly improves the security of the operation system; (2) Strong fault detection capability: This invention adopts dual-redundant sensor and dual-redundant main control controller hardware, so that when any component of the main control device sensor and the main control controller fails, the fault can be determined by comparing the data of the two channels, which has a strong fault detection capability and reduces the risk of outputting incorrect operation instructions; (3) High task reliability: On the one hand, the main control controller and the main control device sensor are dual-redundant. If any one of them fails, the auxiliary control controller provides the operation instructions. (3) Ensures that the control task is not lost and improves the reliability of the task; on the other hand, the present invention adopts a dissimilar processor and bus, which reduces the impact of common mode interference on the control system and improves the reliability of the task; (4) Low cost. The auxiliary control of the present invention adopts a simple control form, which is lower in cost and more commercially viable than the traditional control system while ensuring safety; (5) High control accuracy. The main control device uses a magnetoresistive sensor as a displacement sensor, which can provide high-precision angular displacement measurement in a limited volume, thereby improving the accuracy of the control command; (6) Small space occupation. The cockpit of the eVTOL aircraft has a small internal space. The present invention adopts a combination of less main control redundancy and small-volume auxiliary control, realizing the layout of the main and auxiliary control system in a narrow space. Attached Figure Description

[0015] Figure 1 This is a block diagram of the operating system.

[0016] Figure 2 This is a connection diagram of the main control controller and the main control device.

[0017] Figure 3 This is a connection diagram of the auxiliary control controller and the auxiliary control device. Detailed Implementation

[0018] The present invention will now be described in detail, see the appendix to the specification. Figures 1-3 .

[0019] Example 1 like Figures 1-2 As shown, an eVTOL control system includes a main control device, a main control controller, an auxiliary control device, and an auxiliary control controller, and has a four-axis high-safety control function.

[0020] The main control unit is equipped with command elements including a longitudinal sensor, a lateral sensor, a heading sensor, a vertical sensor, and a communication switch. The longitudinal sensor uses a magnetoresistive sensor to accurately sense the longitudinal displacement of the main control unit, serving as the control command for forward / reverse movement. The longitudinal sensor employs an electrically redundant configuration within space constraints to increase the safety of longitudinal control. The lateral sensor uses a magnetoresistive sensor to sense the lateral displacement of the main control unit, serving as the control command for left / right swerve movement. The lateral sensor also employs an electrically redundant configuration within space constraints to increase the safety of lateral control. The heading sensor uses a magnetoresistive sensor to sense the lateral displacement of the main control unit, serving as the control command for left / right turn movement. The heading sensor also employs an electrically redundant configuration within space constraints to increase the safety of lateral control. The vertical sensor uses a potentiometer to sense the vertical displacement of the main control unit, serving as the control command for ascent / descent movement. The vertical sensor employs a mechanically redundant configuration to enhance the safety of vertical operation of the main control unit, given the space constraints. The intercom switch, a single-redundant configuration, allows the driver to communicate with ground base station personnel. Pressing the switch activates the intercom, enabling communication between the driver and ground base station personnel.

[0021] The main control controller is configured with dual redundancy channels (channel A and channel B). Each redundant channel includes a digital control module, a signal interface and processing module, a CAN bus interface module, a programming interface module, and a power supply module.

[0022] Taking channel A as an example, the signal interface and processing module A connects to and supplies power (5VDC) to the longitudinal sensor A, lateral sensor A, heading sensor A, and vertical sensor A. It receives analog voltage command signals from these sensors (each sensor outputs two single-ended analog signals) and converts all analog signals into digital signals under the control of the main digital control module A, sending them to the main digital control module A. The main digital control module A receives command data from the signal interface and processing module A and command data from channel B. After internal data calculation, comparison, and processing, it obtains the four-axis control commands and sends them to the external CANFD bus via the main CAN bus interface module A. The main programming interface module A provides a programming interface for the processor in the main digital control module A, using a JTAG interface for easy program download and debugging. The main power supply module A receives two external DC power supplies (+12V), processes them through power synthesis, filtering, and conversion, and supplies power to the various modules of channel A of the main control controller.

[0023] Taking channel B as an example, the signal interface and processing module B supplies power (5VDC) to the longitudinal sensor B, lateral sensor B, heading sensor B, and vertical sensor B. It receives the four-axis voltage command analog signals from these sensors (each sensor outputs two single-ended analog signals) and converts all analog signals into digital signals under the control of the main digital control module B, sending them to the main digital control module B. The main digital control module B receives command data from the signal interface and processing module B and command data from channel A. After internal data calculation, comparison, and processing, it obtains the four-axis control commands and sends them to the external CAN bus through the main CAN bus interface module B. The main programming interface module B provides a programming interface for the processor in the main digital control module B, facilitating program download and debugging. The main power supply module B receives two external DC power supplies (+12V), processes them through power synthesis, filtering, and conversion, and supplies power to the various modules of the main control controller channel B.

[0024] The two channels of the main control controller contain the same microprocessor scheme in their main digital control modules.

[0025] The two redundant channels of the main control controller exchange data with each other through the Channel-to-Channel Data Link (CCDL).

[0026] Example 2 like Figure 1 and Figure 3 As shown, an eVTOL control system includes a main control device, a main control controller, an auxiliary control device, and an auxiliary control controller, and has a four-axis high-safety control function.

[0027] The auxiliary control device is an extremely simple control device designed to improve its basic reliability. The configured command elements include a forward switch, a reverse switch, a left turn switch, a right turn switch, an ascent switch, and a descent switch, as well as a main control disconnect switch. The forward and reverse switches are discrete control commands for the aircraft's forward / reverse movement. Both are single-pole, single-throw self-resetting buttons, normally open, and closed when pressed, indicating a control action along that axis. The left and right turn switches are discrete control commands for the aircraft's left / right turn movement. Both are single-pole, single-throw self-resetting buttons, normally open, and closed when pressed, indicating a control action along that axis. The ascent and descent switches are discrete control commands for the aircraft's ascent / descent movement. Both are single-pole, single-throw self-resetting buttons, normally open, and closed when pressed, indicating a control action along that axis. The main control disconnect switch is the power disconnect switch for the main control controller. It can directly disconnect / connect the two DC power supplies (power supply voltage is +12V) to the main control controller to perform forced transfer of control authority.

[0028] The auxiliary control controller features a simple single-redundant channel configuration to improve its basic reliability. It includes a digital processing module, a discrete signal interface and processing module, an auxiliary CAN bus interface module, an auxiliary programming interface module, and an auxiliary power supply module. The discrete signal interface and processing module receives discrete control commands from the forward, backward, left, right, up, and down switches. The auxiliary digital control module receives command data from the discrete signal interface and processing module, processes it internally, and then sends the discrete control commands to two external CAN buses via the auxiliary CAN bus interface module. The auxiliary programming interface module provides a programming interface for the processor in the auxiliary digital control module, facilitating program download and debugging. The main power supply module receives two external DC power supplies (+12V), processes them through power synthesis, filtering, and conversion, and then supplies power to the various modules of the auxiliary control controller.

[0029] Example 3 like Figures 1-3 As shown, this solution provides an eVTOL operating system control method. The operating authority transfer logic is applied to the operating system described in technical solution one. The operating authority transfer logic is as follows: S1. After the operating system is powered on, the operating authority is on the main control controller by default; S2. If any redundancy of the longitudinal sensor, lateral sensor, yaw sensor, or vertical sensor in the main control unit fails and has been detected by the main control controller, the main control controller determines that the corresponding channel has a sensor failure, sets the command sent to the flight control computer to a safe value and the corresponding fault flag position to invalid, and the main control controller continues to send control commands to the flight control computer through another normal channel, and the control authority is not transferred. S3. If any of the longitudinal, lateral, yaw, or vertical sensors in the main control unit fails and cannot be detected by the main control controller, the command values ​​obtained by the two channels of the main control controller will differ significantly during the operation of the main control unit. The controller will determine that a fault has occurred, set the command sent to the flight control computer to a safe value, and set the corresponding fault flag to invalid. The flight control computer will transfer the control authority to the auxiliary control controller, which will then provide the control commands. S4. If a short circuit or open circuit occurs in the cable between the sensor in the main control device and the main control controller, there will be a large difference in the command values ​​obtained by the two channels of the main control controller during the operation of the main control device. The main control controller itself will determine that a fault has occurred, set the command sent to the flight control computer to a safe value and set the corresponding fault flag position to invalid. The flight control computer will transfer the control authority to the auxiliary control controller, and the auxiliary control controller will provide the control commands. S5. If any of the main digital control module, signal interface and processing module, main CAN bus module, main power module or CANFD / CAN bus in a certain channel of the main control controller fails, the corresponding channel of the flight control computer will not receive instructions or will receive incorrect instructions. The flight control computer will transfer the control authority to the auxiliary control controller, which will provide control instructions. S6. If the data link transmission between the main control controller channels (CCDL) fails, the two channels of the main control controller cannot obtain data from the other channel. The main control controller itself determines that a fault has occurred, sets the command sent to the flight control computer to a safe value and sets the corresponding fault flag position to invalid. The flight control computer transfers the control authority to the auxiliary control controller, which provides the control commands. S7. If one of the external power supplies of the main control controller fails, the main power module will continue to operate normally and the control authority will not be transferred. S8. If a common-mode fault occurs in the main control unit, main control controller, or cable, and the flight control computer cannot identify the fault through the fault flag on the bus, the pilot shall determine whether there is a fault based on the control commands and the aircraft response. In this case, the pilot shall manually cut off the power supply to the main control stick by using the main control switching switch on the auxiliary control controller, so that the main control controller stops sending data to the bus. After the flight control computer detects that the main control controller has stopped sending data, it shall transfer the control authority to the auxiliary control controller, which shall provide the control commands. S9. If the main control device, main control controller, or cable are all normal, in the event of manual operation of the main control switch, the main control controller will lose power. After the flight control computer detects that the main control controller has stopped sending data, it will transfer the control authority to the auxiliary control controller, which will then provide control commands. S10. If the control authority has been transferred to the auxiliary control controller, and the manual control main control switch is reset, if the main control device, main control controller, or cable are all normal, the control authority will be transferred to the main control controller, which will provide control commands. If any one of the main control device, main control controller, or cable fails, the control authority will not be transferred, and the auxiliary control controller will still provide control commands.

[0030] The embodiments described above are merely preferred embodiments of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. An eVTOL control system, characterized in that: The system includes: Main control device, main control controller, auxiliary control device and auxiliary control controller; The main control unit is connected to the main control controller. The main control unit is used to generate main control commands and transmit the main control commands to the flight control computer through the main control controller. The auxiliary control device is connected to the auxiliary control controller. The auxiliary control device is used to generate auxiliary control commands and transmit the auxiliary control commands to the flight control computer through the auxiliary control controller. The auxiliary control device is equipped with a main control cut-off switch; An external power supply is connected to the main control controller via the main control disconnect switch and supplies power to the main control controller. The power supply to the main control controller can be actively cut off by the main control switch, thereby enabling the active switching of control authority.

2. The system according to claim 1, characterized in that: The main control unit includes: a sensor group and a communication switch; the sensor group includes a longitudinal sensor, a lateral sensor, a heading sensor, and a vertical sensor; The longitudinal sensor uses a magnetoresistive sensor to sense the longitudinal displacement of the main control unit, which serves as the control command for the aircraft's forward / reverse movement. The lateral sensor uses a magnetoresistive sensor to sense the lateral displacement of the main control unit, which serves as the control command for the aircraft's left / right movement. The heading sensor uses a magnetoresistive sensor to sense the amount of control displacement of the heading of the main control unit, which serves as the control command for the aircraft to turn left or right. The vertical sensor uses a potentiometer to sense the vertical displacement of the main control unit, which serves as the control command for the aircraft's ascent / descent. The call switch is used to request a call between the driver and the ground base station.

3. The system according to claim 2, characterized in that: The longitudinal, lateral, and heading sensors employ an electrical dual-redundancy configuration, while the vertical sensor employs a mechanical dual-redundancy configuration.

4. The system according to claim 3, characterized in that: The main control controller has two channels, A and B, each of which is connected to a redundancy of the sensor group. Both channels are connected to the intercom switch. Each channel is equipped with a main digital control module, a signal interface and processing module, a main CAN bus interface module, a main programming interface module, and a main power supply module. A redundant connection is provided between the signal interface and the sensor group of the processing module, which is used to receive analog signals from the sensor group, convert them into digital signals, and then send them to the main digital control module. The main digital control module receives digital signals sent by the signal interface and processing module of this channel, as well as digital signals sent by the main digital control module of another channel; after calculating and comparing the digital signals from the two channels, it obtains the control commands and sends the control commands to the flight control computer through the main CAN bus interface; The main programming interface module connects to the main digital control module, providing an interface for external program download and debugging. The main power module is connected to the main control cut-off switch of the auxiliary control device, and receives external power to supply power to each module in the channel.

5. The system according to claim 1, characterized in that: The auxiliary control device is also equipped with a control switch group, including: forward switch, reverse switch, left turn switch, right turn switch, up switch, and down switch; Forward and backward switches are discrete control commands for the forward / backward movement of an aircraft. The left turn switch and right turn switch are discrete control commands for the aircraft's left / right turn movements; Ascent and descent switches are discrete control commands for the aircraft's ascent / descent movements. All six switches are single-pole single-throw self-resetting buttons that remain normally open. When pressed, they are in the ON state, indicating that there is an operating action along the corresponding axis.

6. The system according to claim 5, characterized in that: The auxiliary control unit includes: a discrete signal interface and processing module, an auxiliary digital processing module, an auxiliary CAN bus interface module, an auxiliary programming interface module, and an auxiliary power supply module; The discrete signal interface is connected to the control switch group and receives control commands from the control switch group; The auxiliary digital processing module receives control commands sent by the discrete signal interface and processing module, processes them, and then sends them to the flight control computer through the auxiliary CAN bus interface module. The auxiliary programming interface module connects to the auxiliary digital processing module, providing an external program download and debugging interface; The auxiliary power supply module is connected to an external power source to supply power to the various internal modules.

7. A control method for an eVTOL operating system, the method being used to control the system according to any one of the preceding claims, characterized in that, Includes the following steps: S1, the system is powered on, and the operation authority is in the main control controller by default; S2, the two channels of the main control controller detect whether there is a fault in the connected sensor. If there is no fault, the state remains unchanged. If there is a fault in the sensor in its own channel, the instruction sent to the flight control computer by the faulty channel is set to a safe value and the fault flag position of the corresponding channel is invalid. The main control controller continues to send control instructions to the flight control computer through another normal channel, and the control authority is not transferred. S3, the main control controller determines whether it has malfunctioned. If there is no malfunction, the state remains unchanged. If a malfunction occurs, the main control controller sets the instruction sent to the flight control computer to a safe value and the fault flag of the main control controller is set to invalid. The flight control computer transfers the control authority to the auxiliary control controller, which provides the control instructions. S4. When the pilot determines that the main control device or main control controller has malfunctioned, he manually controls the main control switch to turn off, the main control controller is powered off, and after the flight control computer detects that the main control controller has stopped sending data, the control authority is transferred to the auxiliary control controller, which provides control commands.

8. The method according to claim 7, characterized in that: In S3, the main control controller determines whether it has malfunctioned in the following scenarios: The sensors in the main control unit malfunctioned and could not be detected by the main control controller; A short circuit or short circuit fault occurred in the cable between the main control controller and the main control device; A fault has occurred in the main digital control module, signal interface and processing module, main CAN bus module, or main power supply module of a certain channel within the main control controller. The data link between the two channels of the main control controller failed.

9. The method according to claim 7, characterized in that: The method further includes: when the main control device and the main control controller are fault-free, the pilot manually controls the main control switch to disconnect as needed, the main control controller is powered off, and after the flight control computer detects that the main control controller has stopped sending data, the control authority is transferred to the auxiliary control controller, which provides control commands.

10. The method according to claim 7, characterized in that: The method further includes: when the main control switch is manually reset, checking whether the main control controller is normal; if it is normal, the control authority is transferred from the auxiliary control controller to the main control controller; otherwise, no transfer occurs.

Images