Redundancy control method, actuator processing module, flight control system and storage medium

Abstract

The invention discloses a redundancy control method, an actuator processing module, a flight control system and a storage medium, and the method comprises the steps: a first actuator processor receives a verification flight control instruction sent by a first flight control computer, and compares the verification flight control instruction with a main flight control instruction, received by a second actuator processor, of the first flight control computer; when the main flight control instruction is not matched with the verification flight control instruction, it is indicated that the second actuator processor breaks down. At the moment, a disconnection signal is sent to a power switch corresponding to the second actuator processor, and a locking signal is sent to the locking mechanism, so that the first actuator processor can synchronously control the execution mechanisms locked together. Therefore, when one actuator processing module finds that the other actuator processing module breaks down, power output of the other actuator processing module can be cut off in time, the normal actuator processing module is adopted to control all executing mechanisms, the maneuverability of the whole executing mechanisms is protected, and flight safety is improved.

Description

[0001] This application is a divisional application of application number 202211659669.2, with the parent application filed on December 22, 2022. The invention of the parent application is entitled: Redundancy control method, actuator processing module, flight control system and storage medium. Technical Field

[0002] This invention relates to the field of aircraft technology, and in particular to a redundancy control method, actuator processing module, flight control system, and storage medium. Background Technology

[0003] With the development of small aircraft design and manufacturing technologies and related supporting industries, the functions, performance, and production volume of small aircraft have gradually stabilized and matured. The operation of small aircraft is also gradually expanding into civil aviation fields such as logistics and passenger transport. However, due to the unique nature of the flight platform itself, new challenges have been posed to aircraft safety. In related technologies, flight control computers employ dual-redundant or multi-redundant control. However, this only provides protection in case of faults at the flight control computer level. If the actuator module or actuator mechanism malfunctions, it will also pose a significant threat to flight safety. Summary of the Invention

[0004] This application provides a redundancy control method, an actuator processing module, a flight control system, and a storage medium, aiming to solve the problem of flight insecurity caused by actuator module or actuator failure.

[0005] This application provides a redundancy control method for a flight control system applied to a first actuator processor. The redundancy control method for the flight control system includes: Receive verification flight control commands sent by the first flight control computer; The second actuator processor receives the master flight control command, which is sent by the first flight control computer to the second actuator processor. When the main flight control command and the verification flight control command do not match, a disconnect signal is sent to the power switch corresponding to the second actuator processor; A locking signal is sent to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the locked actuators.

[0006] In addition, to achieve the above objectives, the present invention also provides an actuator processing module, which includes: a memory, an actuator processor, and a redundancy control program for a flight system stored in the memory and executable on the actuator processor. When the redundancy control program for the flight system is executed by the processor, it implements the steps of the redundancy control method for the flight control system described above.

[0007] In addition, to achieve the above objectives, the present invention also provides a flight control system, which includes an actuator processing module.

[0008] In addition, to achieve the above objectives, the present invention also provides a computer-readable storage medium storing a redundancy control program for a flight system, wherein the redundancy control program for the flight system, when executed by a processor, implements the steps of the redundancy control method for the flight control system described above.

[0009] This application provides a redundancy control method, actuator processing module, flight control system, and storage medium. The first actuator processor receives verification flight control commands from a first flight control computer and compares these commands with the main flight control commands received by the second actuator processor from the same first flight control computer. If the main flight control commands and verification flight control commands do not match, it indicates a malfunction in the second actuator processor. At this time, a disconnect signal is sent to the power switch corresponding to the second actuator processor, and a lock signal is sent to the locking mechanism, enabling the first actuator processor to synchronously control the locked actuators. This allows one actuator processor to promptly cut off the power output of the other when it detects a malfunction in the other, ensuring that the normal actuator processor controls all actuators, protecting the overall maneuverability of the actuators, and improving flight safety. Attached Figure Description

[0010] Figure 1 This is a flowchart illustrating the first embodiment of the redundancy control method for the flight control system of the present invention. Figure 2 This is a flowchart illustrating the second embodiment of the redundancy control method for the flight control system of the present invention. Figure 3 This is a flowchart illustrating the third embodiment of the redundancy control method for the flight control system of the present invention. Figure 4 This is a flowchart illustrating another embodiment of the redundancy control method for the flight control system of the present invention. Figure 5 This is a schematic diagram of the flight control system of the present invention.

[0011] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. The accompanying drawings are only one embodiment and not the entirety of the invention. Detailed Implementation

[0012] In related technologies, to improve flight safety, flight control computers are typically configured as dual-redundant or multi-redundant, while the actuator processors controlled by the flight control computer are configured as single-redundant. That is, under normal circumstances, one flight control computer is connected to the actuator processor, which in turn connects to the actuator, driving the actuator mechanism. When one flight control computer fails, a working flight control computer can be used to replace it, thus ensuring flight safety. However, this fault protection only applies to the flight control computer level; when the actuator processor, actuator, or actuator mechanism malfunctions, it still poses a significant threat to flight safety.

[0013] Therefore, this application aims to address the threat to flight safety posed by actuator module or actuator failures. This application proposes a redundancy control method for a flight control system. This method protects flight safety at both the actuator processor and actuator levels. This application configures the actuator processor and actuators as redundant. The first actuator processor receives verification flight control commands from a first flight control computer and compares these commands with the main flight control commands received by the first flight control computer from the second actuator processor. If the main flight control commands and verification flight control commands do not match, it indicates a failure in the second actuator processor. At this time, a disconnect signal is sent to the power switch corresponding to the second actuator processor, and a lock signal is sent to the locking mechanism, enabling the first actuator processor to synchronously control the locked actuators. This allows the system to promptly cut off the power output of the other device when one device detects a failure in the other, ensuring that the normal device controls all actuators, protecting the overall maneuverability of the actuators, and improving flight safety.

[0014] To better understand the above technical solutions, exemplary embodiments of this disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of this disclosure to those skilled in the art.

[0015] like Figure 1As shown, in the first embodiment of this application, the redundancy control method of the flight control system is applied to a first actuator processor. This first actuator processor verifies whether a counterpart actuator processor has malfunctioned and, if so, cuts off the signal output of the counterpart actuator processor. The first actuator processor is also used to send a disconnect signal to its connected actuator and a lock signal to the locking mechanism when the actual control input of the actuator and the theoretical control input of the master flight control command do not match, thereby enabling the second actuator to synchronously control all actuators, thus allowing the aircraft to fly safely. The redundancy control method of the flight control system includes the following steps: Step S110: Receive the verification flight control command sent by the first flight control computer.

[0016] Step S120: Obtain the master flight control command received by the second actuator processor, wherein the master flight control command is sent by the first flight control computer to the second actuator processor; Step S130: Determine whether the main flight control command and the verification flight control command match; Step S140: When the main flight control command and the verification flight control command do not match, a disconnect signal is sent to the power switch corresponding to the second actuator processor; Step S150: Send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the locked actuators.

[0017] In this embodiment, the flight control computer, actuator processor, and actuators of this application can all be configured as redundant. That is, in the flight control system, there can be two or more flight control computers, actuator processors, and actuators, and the number of flight control computers, actuator processors, and actuators can be set according to actual usage and specific application scenarios. This application takes a dual-redundant configuration of flight control computers, actuator processors, and actuators as an example.

[0018] Before an actuator can receive control, its actuator processor needs to convert the main control commands sent by the flight control computer into output current for the actuator. For proper control, the actuator processor must be functioning correctly. Therefore, this application employs a mutual monitoring mechanism between actuator processors. Each actuator processor receives control commands from all flight control computers, one of which is its own main control command, used to output to the actuator to drive the actuator mechanism; the other flight control computer control command serves to verify the functionality of the other actuator processor. This allows, in the event of a failure in a single actuator processor, another normally functioning actuator processor to intervene, cutting off the output of the failed processor and simultaneously locking the two separate actuators, thus allowing the normally functioning actuator to operate all actuator mechanisms.

[0019] Furthermore, each actuator processor processes two tasks in parallel using dual threads. The first thread translates the main flight control commands to the corresponding actuator motor, while the second thread verifies the validity of the output based on the input and output of the other actuator processor. This dual-thread design is employed to avoid conflicts between the verification process and the main computational work.

[0020] Furthermore, the verification algorithm is executed in the second thread, including an input verification algorithm and an output verification algorithm. First, the input verification algorithm is executed. This algorithm determines whether the master flight control command received by the other party matches the verification flight control command received by this processor. If they do not match, the master flight control computer of the other party's actuator processor is informed of this error, and the power output of the other party's actuator processor is cut off. If they match, the output verification algorithm is executed. This algorithm outputs a disconnect signal to the power switch of the other party's actuator when the verification shows that the output of the other party's actuator processor is unreasonable. Simultaneously, a lock signal is output to the locking mechanism between the actuators, allowing this actuator to control both actuators simultaneously.

[0021] Because this application employs a dual-redundant actuator processor mutual detection method, the dual-redundant mutual monitoring should allow the two actuator processors to share all data, including data output from the flight control computer to the actuator processor, the actuator processor's output data, and feedback data from the sensors corresponding to the actuator. When one actuator processor detects an input or output mismatch in the other actuator processor, it cuts off the other's output power, thereby protecting the overall maneuverability of the actuator. Furthermore, the mutual detection of the two actuator processors uses a parallel verification algorithm to determine whether the other actuator processor is outputting an error, thus avoiding the need to use the main drive algorithm to verify the input and output of the other actuator processor. The verification algorithm is independent of the main drive; even if the main drive algorithm malfunctions, the individual verification algorithm will not be affected. The other actuator processor will also immediately shut down its output to the faulty actuator processor, thereby improving flight stability and safety.

[0022] Optionally, when the redundancy control method of the flight control system in this application is applied to the first actuator processor, under the condition that both the first and second actuator processors are working normally, the first actuator processor can accept control commands from all flight control computers, including verification flight control commands sent by the first flight control computer and master flight control commands sent by the second flight control computer. Similarly, the second actuator processor can also accept control commands from all flight control computers, including verification flight control commands sent by the second flight control computer and master flight control commands sent by the first flight control computer. The first and second actuator processors can send their own master flight control commands to the other actuator processor to verify whether the other actuator processor is working normally.

[0023] Optionally, this application takes the execution of an input verification algorithm in the first actuator processor as an example. For the first actuator processor, in order to verify whether the second actuator processor can function properly, the first actuator processor can obtain the master flight control command sent by the second actuator processor. This master flight control command is sent by the first flight control computer to the second actuator processor. The second actuator processor sends this master flight control command back to the first actuator processor for verification. Optionally, the first actuator processor will match the master flight control command with its own verification flight control command. If the master flight control command and the verification flight control command do not match, it indicates that the first actuator processor has calculated that the second actuator processor may have a fault. At this time, it will send a disconnect signal to the corresponding power switch of the second actuator processor. Simultaneously, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, enabling the first actuator processor to synchronously control the locked actuators.

[0024] Similarly, the redundancy control method of the flight control system in this application is also applicable to the second actuator processor, where the input verification algorithm can be executed. Optionally, for the second actuator processor, in order to verify whether the first actuator processor can work properly, the second actuator processor can obtain the master flight control command sent by the first actuator processor. This master flight control command is sent by the second flight control computer to the first actuator processor. The first actuator processor sends this master flight control command to the second actuator processor so that the second actuator processor can verify the first actuator processor. Optionally, the second actuator processor will match the main flight control command with its own verification flight control command. If the main flight control command and the verification flight control command do not match, it indicates that the second actuator processor has calculated that the first actuator processor may have a fault. At this time, the second actuator processor will send a disconnect signal to the power switch corresponding to the first actuator processor. At the same time, the second actuator processor will also send a lock signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the locked actuator.

[0025] Optionally, this application may also include a third-party monitoring module, in which an input verification algorithm can be executed. The redundancy control method of the flight control system of this application is also applicable to this third-party monitoring module. The third-party monitoring module is equipped with a verification algorithm that can acquire verification flight control commands sent from the first flight control computer to the first actuator processor, and simultaneously acquire the main flight control commands sent from the first flight control computer to the second actuator processor.

[0026] Optionally, the third-party monitoring module will match the verification flight control command with the main flight control command. If the main flight control command and the verification flight control command do not match, it indicates that the second actuator processor may be faulty. At this time, the first actuator processor will send a disconnect signal to the power switch corresponding to the second actuator processor. At the same time, the first actuator processor will also send a lock signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the locked actuator.

[0027] Similarly, the third-party monitoring module will also acquire the verification flight control commands sent from the second flight control computer to the second actuator processor, and simultaneously acquire the main flight control commands sent from the second flight control computer to the first actuator processor. Optionally, the third-party monitoring module will match the verification flight control commands and the main flight control commands. If the main flight control commands and verification flight control commands do not match, it indicates that the first actuator processor may have a fault. At this time, the second actuator processor will send a disconnect signal to the power switch corresponding to the first actuator processor, and at the same time, the second actuator processor will also send a lock signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the locked actuators.

[0028] In one embodiment, when executing the above-described input verification algorithm, if the main flight control command and the verification flight control command do not match, the main flight control computer of the other actuator processor is informed of this error, and the power output of the other actuator processor is cut off.

[0029] Optionally, for the first actuator processor, when the first actuator processor determines that the main flight control command of the second actuator processor does not match its own verification flight control command, it can generate an error message including the mismatch between the main flight control command and the verification flight control command, and send the error message to the main flight control computer of the second actuator processor, i.e., the first flight control computer, so that the error message can be fed back in a timely manner and corresponding rectification can be made in a timely manner to avoid flight accidents.

[0030] Similarly, for the second actuator processor, when the second actuator determines that the main flight control command of the first actuator processor does not match its own verification flight control command, it can generate an error message including the mismatch between the main flight control command and the verification flight control command, and send the error message to the main flight control computer of the first actuator processor, i.e. the second flight control computer, so that the error message can be fed back in time and the corresponding rectification can be made in time to avoid flight accidents.

[0031] In one embodiment, if both the first actuator processor and the second actuator processor detect a fault in the other, to prevent all actuator processors from shutting down and causing a loss of control over the actuators or actuators, thus preventing the aircraft from flying normally, this application also includes a limiter. This limiter connects the actuator processor and a power switch. Upon receiving disconnect signals from all actuator processors, it controls at least one power switch connected to an actuator processor to close; or upon receiving disconnect signals from all actuator processors, it controls at least one actuator processor to send a locking signal to the locking mechanism. This ensures that at least one actuator processor can perform normal control.

[0032] Optionally, in order to improve the accuracy of the verification results, it is necessary to ensure the synchronization of the verification between the first actuator processor and the second actuator processor, that is, to control the first actuator processor and the second actuator processor to execute the verification algorithm simultaneously.

[0033] Optionally, if both the first actuator processor and the second actuator processor detect an input fault in the other, the actuator output of the actuator processor whose fault was detected first can be disconnected. For example, if the first actuator processor detects a fault in the second actuator processor first, a disconnect signal can be sent to the power switch corresponding to the second actuator processor. Optionally, a disconnect signal can be sent to a limiter to avoid disconnecting the power switch corresponding to the first actuator processor when the second actuator processor also detects an input fault in the first actuator processor.

[0034] Optionally, if both the first actuator processor and the second actuator processor detect that the other has an input fault, they can also send a disconnect signal to the power switch corresponding to the actuator server that meets the conditions of having the most historical faults, the fewest historical usage frequencies, and the lowest service quality.

[0035] In one embodiment, for redundancy control of the entire flight control system, when all flight control computers are operating normally, different flight control computers can be used to execute different control functions. If a flight control computer malfunctions, a normally operating flight control computer can replace the malfunctioning one and perform its control functions. Similarly, when all actuator processors are operating normally, different actuator processors can be used to execute different data processing functions and control the connected actuators. If an actuator processor malfunctions, a normally operating actuator processor can replace the malfunctioning one and control the actuators connected to the malfunctioning one. Likewise, when all actuators are operating normally, different actuators can be used to drive their corresponding actuators. However, if an actuator malfunctions, the actuator processor connected to the normally operating actuator can send a locking signal to the locking mechanism, enabling the normally operating actuator processor to synchronously control the locked actuators.

[0036] Optionally, assume that the flight control computer, actuator processor, and actuators are all configured as dual-redundant. The flight control computer includes a first flight control computer and a second flight control computer; the actuator processor includes a first actuator processor and a second actuator processor; the actuator includes a first actuator and a second actuator; and the execution mechanism includes a first execution mechanism and a second execution structure. Then, the following situations exist, but are not limited to: First, assuming all flight control computers, actuator processors, and actuators are functioning normally, the control flow is as follows: The first flight control computer sends the main flight control command to the first actuator processor; the first actuator processor converts the main control command into a current signal and sends it to the first actuator, which then sends the current signal to the first execution mechanism, thereby enabling the first flight control computer to drive the first execution mechanism. Simultaneously, the second flight control computer sends the main flight control command to the second actuator processor; the second actuator processor converts the main control command into a current signal and sends it to the second actuator, which then sends the current signal to the second execution mechanism, thereby enabling the second flight control computer to drive the second execution mechanism. Thus, with all equipment functioning normally, each device can perform its respective function, allowing the aircraft to operate normally.

[0037] Second, regarding the scenario where all actuator processors are functioning normally, even if either the first or second flight control computer malfunctions: The control procedure for a first flight control computer malfunction is as follows: the second flight control computer simultaneously sends master flight control commands to both the first and second actuator processors. This allows the first and second actuator processors to perform their respective control functions. Optionally, the master flight control commands from the second flight control computer can be sent only to the connected second actuator processor, which then controls all actuators and actuators. Similarly, the control procedure for a second flight control computer malfunction is as follows: the first flight control computer simultaneously sends master flight control commands to both the first and second actuator processors. This allows the first and second actuator processors to perform their respective control functions. Optionally, the master flight control commands from the first flight control computer can be sent only to the connected first actuator processor, which then controls all actuators and actuators. This ensures that even if one flight control computer malfunctions, the normally functioning flight control computer can still control all normally functioning actuators and actuators, improving flight safety.

[0038] Third, regarding the scenario where all flight control computers are functioning normally, but either the first actuator processor or the second actuator processor malfunctions. The control flow for a first actuator processor malfunction is as follows: The second flight control computer sends the main control command to the second actuator processor. The second actuator processor converts the main control command into a current signal and sends it to the second actuator. Simultaneously, the second actuator processor sends a lock signal to the locking mechanism to lock the actuator and sends a disconnect signal to the power switch corresponding to the first actuator processor, allowing the normally functioning flight control computer to control all actuators through the second actuator processor. Similarly, the control flow for a second actuator processor malfunction is as follows: The first flight control computer sends the main control command to the first actuator processor. The first actuator processor converts the main control command into a current signal and sends it to the first actuator. Simultaneously, the first actuator processor sends a lock signal to the locking mechanism to lock the actuator and sends a disconnect signal to the power switch corresponding to the second actuator processor, allowing the normally functioning flight control computer to control all actuators through the first actuator processor. This allows the flight control computer to control all actuators when one actuator processor fails, thus improving flight safety.

[0039] Fourth, in the event of an anomaly in all flight control computers, but with the first actuator processor and / or the second actuator processor functioning normally, the system can switch to manual control mode and operate manually to avoid impacting the flight safety of the aircraft in the event of a malfunction in all flight control computers.

[0040] In one embodiment, at the flight control computer level, an arbitration unit is further provided to determine whether a flight control computer has malfunctioned. During flight, each flight control computer sends control commands to the actuator processor in real time, enabling the actuator processor to control the actuators based on these commands. However, due to various unforeseen circumstances that may occur during flight, causing the flight control computer to malfunction, to improve flight safety, the control information from each flight control computer needs to be sent to the arbitration unit. The arbitration unit then determines in real time whether a flight control computer is malfunctioning and, based on the determination result, determines the corresponding control strategy to control the actuator processor, thereby improving flight safety.

[0041] Optionally, control information from each flight control computer can be synchronously sent to the arbitration unit at preset intervals to avoid inaccurate fault diagnosis due to asynchronous data transmission, which could affect the stability of the aircraft.

[0042] Optionally, each flight control computer outputs corresponding control commands, which are instructions for controlling the operation of motors, control surfaces, throttle, etc. These control commands include commands such as throttle commands, control surface deflection commands, motor speed commands, and motor torque commands.

[0043] Optionally, each flight control computer outputs a checksum, which is used to verify whether the flight control computer is malfunctioning. The format of this checksum can be preset according to different aircraft models.

[0044] Optionally, each flight control computer may attach a checksum to its output control commands to prove that it is still working normally. The arbitration unit will determine whether the flight control computer is faulty by comparing the control commands output by each flight control computer and verifying the checksum.

[0045] Optionally, a preset checksum is pre-set in the arbitration unit. The format and type of this preset checksum should be consistent with the format and type of the checksum sent by the flight control computer. That is, after receiving the checksums from each flight control computer, the arbitration unit will match the received checksums with the preset checksum in terms of both format and type. If the checksum of a flight control computer does not match the preset checksum, the mismatched flight control computer is determined to be faulty, i.e., a failed flight control computer. Optionally, a flight control computer with no signal output or garbled output can also be determined to be faulty. Optionally, if the arbitration unit detects a disconnection in the output frequency when the flight control computer outputs control commands at a constant frequency, it determines that the flight control computer is faulty.

[0046] For example, suppose there is a first flight control computer and a second flight control computer. If the checksum of the first flight control computer does not match the preset checksum, the first flight control computer is identified as faulty; if the checksum of the second flight control computer does not match the preset checksum, the second flight control computer is identified as faulty; if the checksums of both the first and second flight control computers do not match the preset checksum, then both the first and second flight control computers are identified as faulty.

[0047] Optionally, when there are at least two matched flight control computers, the error between the control commands received by the matched flight control computers is determined. Flight control computers with errors greater than a preset error are determined to be faulty.

[0048] Optionally, control commands can include various types, such as discrete control commands, continuous control commands, and Boolean control commands. Different types of control commands have different preset errors. For example: for discrete control commands, such as throttle commands, the preset error is 10% of the value range; for continuous control commands, such as rudder deflection commands, the preset error is 5% of the value range; for Boolean control commands, such as takeoff commands, the preset error is 0 (i.e., zero tolerance).

[0049] For example, suppose the flight control computers whose checksums match are the first and second flight control computers. And both the first and second flight control computers use discrete control commands. Then, the error between the control commands of the first and second flight control computers can be calculated. If this error is greater than 10% of its own range, then both the first and second flight control computers are determined to be faulty. If the error is less than 10% of its own range, then both the first and second flight control computers are determined to be functioning normally.

[0050] Optionally, each flight control computer is connected to the arbitration unit and actuator processor via a signal switch. The default state of this signal switch is closed. When the arbitration unit detects a fault in the flight control computer, it sends a disconnect signal to the signal switch connected to the faulty flight control computer, thereby cutting off the signal output of the faulty flight control computer.

[0051] Optionally, if it is determined that the checksum output by one of the flight control computers is faulty, the output control command of that flight control computer is disconnected, and the control command output by another normally functioning flight control computer is sent to the actuator processor.

[0052] Optionally, with all flight control computers operating normally, each flight control computer can control its corresponding actuator processor via a corresponding signal switch. However, if one flight control computer malfunctions, the normally operating flight control computer can control all actuator processors. Optionally, the signal switch corresponding to the normally operating flight control computer can be closed, connecting the signal switch to all actuator processors.

[0053] For example, assuming a malfunction is detected in the first flight control computer while the second flight control computer is functioning normally, the arbitration unit sends a disconnect signal to the signal switch connected to the first flight control computer, thereby cutting off its signal output. Conversely, it sends a closed signal to the signal switch corresponding to the second flight control computer, enabling that switch to connect to all actuator processors. This allows the second flight control computer to send received control commands to all actuator processors, thus enabling control of all actuators through the second flight control computer.

[0054] Optionally, when all flight control computers malfunction, the signal output of all flight control computers is cut off, the signal channel between the joystick and the actuator processor is connected, and the control signal output by the joystick is sent to the actuator processor, so that manual control is used to avoid affecting the flight safety of the aircraft when all flight control computers malfunction.

[0055] When the verification codes of all flight control computers do not match the preset verification codes, the signal channel between the joystick and the actuator processor can be connected, and the control signal output by the joystick can be sent to the actuator processor, thereby enabling manual control to avoid affecting the flight safety of the aircraft when all flight control computers malfunction.

[0056] It can also connect the signal channel between the joystick and the actuator processor when the check codes of all flight control computers match the preset check codes, but the error between the control commands received by the matched flight control computers is greater than the preset error. Then, the control signal output by the joystick is sent to the actuator processor, so that manual operation is used for control, so as to avoid the flight safety of the aircraft being affected when all flight control computers fail.

[0057] It can also connect the signal channel between the joystick and the actuator processor when the output frequency of all flight control computer control commands fluctuates, thereby sending the control signal output by the joystick to the actuator processor, so as to use manual operation for control, so as to avoid the flight safety of the aircraft being affected when all flight control computers fail.

[0058] Optionally, the flight control system of this application also includes a display. The arbitration unit can send the determination result of the faulty flight control computer to the display for display. The determination result specifies which flight control computer is faulty, and may be the serial number of the faulty flight control computer. Optionally, the arbitration unit may also send the reason for the fault determination to the display. The reason for the fault determination may be inconsistent checksums, errors between control commands exceeding a preset error, etc.

[0059] Optionally, in addition to controlling the actuators or actuators connected to the actuator processor via the flight control computer, this application can also switch to manual control mode. By connecting the joystick and the actuator processor via a signal channel, the control signals output by the joystick are sent to the actuator processor, thereby controlling the actuators or actuators. This allows for manual control of the actuators or actuators even when all flight control computers malfunction, improving the flight safety of the flight system.

[0060] Optionally, the joystick and actuator processor are connected via a signal switch, which is in the open state by default. When the arbitration unit sends a closing signal to this signal switch, it indicates receipt of an arbitration intervention command. At this time, the arbitration unit will cut off all signal outputs from the flight control computer. Additionally, when the signal switch is closed, the signal channel between the joystick and the actuator processor is connected, thereby sending the control signals output by the joystick to the actuator processor. Specific control methods include, but are not limited to, the following: Example 1: The operator can choose the method of controlling the aircraft at any time. This could involve cutting off the control outputs of all flight control computers and connecting the signal channel between the joystick and the actuator processor when an arbitration intervention command is received, even when all flight control computers are operating normally. The control signals output by the joystick can then be sent to the actuator processor.

[0061] Example 2: Alternatively, when all flight control computers are faulty or a particular flight control computer is faulty, upon receiving an arbitration intervention command, the control output of all flight control computers is cut off, and the signal channel between the joystick and the actuator processor is connected, so that the control signal output by the joystick is sent to the actuator processor.

[0062] Example 3: When a flight control computer's checksum does not match a preset checksum, an arbitration intervention command is received to cut off the control output of all flight control computers and connect the signal channel between the joystick and the actuator processor, so as to send the control signal output by the joystick to the actuator processor.

[0063] Example 4: Alternatively, when the error of the control commands of each flight control computer is detected to be greater than a preset error, an arbitration intervention command can be received to cut off the control output of all flight control computers and connect the signal channel between the joystick and the actuator processor so as to send the control signal output by the joystick to the actuator processor.

[0064] This embodiment, based on the aforementioned technical solution, incorporates relatively redundant control at three levels: the flight control computer, the actuator processor, and the actuator output. At the flight control computer level, an arbitration unit determines if a flight control computer has failed and determines a resolution strategy based on the failure status. At the actuator processor level, actuator processors perform mutual monitoring and detection; when the output of a fellow actuator processor does not match the input, the output of that fellow actuator is cut off. This ensures that when one device detects a fault in another, it can promptly cut off the other's power output, allowing the normal device to control all actuators, protecting the overall maneuverability of the actuators and improving flight safety.

[0065] like Figure 2As shown, based on the first embodiment. In the second embodiment of this application, the redundancy control method of the flight control system of this application includes the following steps: Step S110: Receive the verification flight control command sent by the first flight control computer.

[0066] Step S120: Obtain the master flight control command received by the second actuator processor, wherein the master flight control command is sent by the first flight control computer to the second actuator processor; Step S210: When the main flight control command matches the verification flight control command, obtain the first output command generated by the first actuator processor according to the verification flight control command, and obtain the second output command generated by the second actuator processor according to the main flight control command; Step S220: Determine whether the first output instruction matches the second output instruction; Step S230: When the first output command and the second output command do not match, send a disconnect signal to the power switch corresponding to the second actuator processor; Step S150: Send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the locked actuators.

[0067] In this embodiment, when the input verification algorithm determines that the main flight control command received by the other party matches the verified flight control command received by this actuator processor, the output verification algorithm is further executed. The output verification algorithm is as follows: when the verification shows that the output of the other party's actuator processor is unreasonable, a disconnect signal is output to the power switch of the other party's actuator, and a lock signal is output to the locking mechanism between the actuators, thereby allowing the actuator to control both actuators simultaneously.

[0068] Optionally, this application takes the execution of an output verification algorithm in the first actuator processor as an example. For the first actuator processor, in order to further verify whether the second actuator processor can function properly, when verifying the match between the main flight control command and the verification flight control command, the first actuator processor obtains the first output command generated by the first actuator processor based on the verification flight control command, and obtains the second output command generated by the second actuator processor based on the main flight control command. The output verification algorithm executed is as follows: matching the first output command with the second output command. When the first output command and the second output command do not match, it indicates that the first actuator processor has calculated that the output of the second actuator processor may have a fault. At this time, it will send a disconnect signal to the power switch corresponding to the second actuator processor. Simultaneously, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, enabling the first actuator processor to synchronously control the locked actuators.

[0069] Similarly, this application can execute an output verification algorithm in the second actuator processor. Optionally, for the second actuator processor, in order to verify whether the output of the first actuator processor is normal, and thus verify whether the first actuator processor can work normally, when verifying the matching of the main flight control command and the verification flight control command, the second actuator processor obtains the second output command generated by the second actuator processor according to the verification flight control command, and obtains the first output command generated by the first actuator processor according to the main flight control command. The output verification algorithm executed is: matching the first output command with the second output command. When the first output command and the second output command do not match, it indicates that the second actuator processor has calculated that the output of the first actuator processor may be faulty. At this time, it will send a disconnect signal to the power switch corresponding to the first actuator processor, and at the same time, the second actuator processor will also send a lock signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the locked actuator.

[0070] Optionally, this application may also include a third-party monitoring module, in which the output verification algorithm may be executed.

[0071] Optionally, when the third-party monitoring module verifies the match between the main flight control command of the first flight control computer (the main flight control command is sent by the first flight control computer to the second actuator processor) and the verification flight control command, it can further execute an output verification algorithm: obtain the first output command generated by the first actuator processor according to the verification flight control command, and obtain the second output command generated by the second actuator processor according to the main flight control command. The third-party monitoring module will match the first output command and the second output command. If the first output command and the second output command do not match, it indicates that the first actuator processor has calculated that the output of the second actuator processor may be faulty. At this time, it will send a disconnect signal to the power switch corresponding to the second actuator processor. At the same time, the first actuator processor will also send a locking signal to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the locked actuator.

[0072] In one embodiment, if both the first actuator processor and the second actuator processor detect a fault in each other's output, to prevent all actuator processors from shutting down and causing a failure to control the actuators or actuators, thus preventing the aircraft from flying normally, this application also provides a limiter. This limiter connects the actuator processor and a power switch. It is used to control at least one actuator processor's connected power switch to close when all actuator processors send disconnect signals, or to control at least one actuator processor to send a locking signal to the locking mechanism when all actuator processors send disconnect signals. This ensures that at least one actuator processor can perform normal control.

[0073] Optionally, in order to improve the accuracy of the verification results, it is necessary to ensure the synchronization of the verification between the first actuator processor and the second actuator processor, that is, to control the first actuator processor and the second actuator processor to execute the verification algorithm simultaneously.

[0074] Optionally, if both the first actuator processor and the second actuator processor detect an output fault in the other, the actuator output of the actuator processor whose fault was detected first can be disconnected. For example, if the first actuator processor detects an output fault in the second actuator processor first, a disconnect signal can be sent to the power switch corresponding to the second actuator processor. Optionally, a disconnect signal can be sent to the limiter to avoid disconnecting the power switch corresponding to the first actuator processor when the second actuator processor also detects an output fault in the first actuator processor, which would cause all actuator processors to shut down and affect flight safety.

[0075] Optionally, if both the first actuator processor and the second actuator processor detect that the other has an output fault, they can also send a disconnect signal to the power switch corresponding to the actuator server that meets the conditions of having the most historical faults, the fewest historical usage frequencies, and the lowest service quality.

[0076] Based on the above technical solution, this embodiment enables mutual monitoring and detection among actuator processors at the actuator processor level. When the output of a counterpart actuator processor does not match the input, the output of the counterpart actuator is cut off, and a locking mechanism is connected, allowing another normal actuator to simultaneously control both actuators. This ensures that when one device detects a malfunction in the other, it can promptly cut off the counterpart's power output, allowing the normal device to control all actuators, protecting the overall maneuverability of the actuators and improving flight safety.

[0077] Reference Figure 3 Based on the first and second embodiments, in the third embodiment of this application, the redundancy control method of the flight control system includes the following steps: Step S310: Receive the main flight control command from the second flight control computer; Step S320: Send the main flight control command to the actuator corresponding to the first actuator processor.

[0078] In this embodiment, each actuator processor processes two tasks in parallel using two threads. The first thread's task is to translate the main flight control commands to the corresponding actuator motors. The execution process of the second thread is as described in the first and second embodiments, and will not be repeated here. The dual-thread design is adopted to avoid conflicts between the verification process and the main calculation work. Optionally, the second thread can be executed in real time while the first thread is being executed.

[0079] Optionally, while receiving verification flight control commands from the first flight control computer for calculation, the first actuator processor can also receive main flight control commands from the second flight control computer for control, and send main flight control commands to the actuator corresponding to the first actuator processor. Optionally, the first actuator processor converts the main flight control commands into current signals and sends them to the first actuator. A first power switch is also provided on the first actuator processor side, connecting the first actuator and the first actuator. The default state of the first power switch is closed, allowing the current signal from the first actuator to be transmitted to the first actuator, thereby achieving control of the first actuator.

[0080] Similarly, while receiving verification flight control commands from the second flight control computer for calculation, the second actuator processor can also receive main flight control commands from the first flight control computer for control, sending main flight control commands to the actuator corresponding to the second actuator processor. Optionally, the second actuator processor converts the main flight control commands into current signals and sends them to the second actuator. A second power switch is also provided on the second actuator processor side, connecting the second actuator and the second actuator. The default state of this second power switch is closed, allowing the current signal from the second actuator to be transmitted to the second actuator, thereby achieving control of the second actuator.

[0081] In one embodiment, at the actuator level, the actuator is divided into two parts that are executed synchronously by the actuators. For example, a wing control surface is cut into left and right parts, with a locking mechanism in the middle that can receive a signal and lock the two parts together. Each actuator controls its own left and right parts. When the control input fed back by one actuator does not match the control output of the corresponding actuator processor, that actuator is disconnected and the locking mechanism is connected, so that the other actuator can control both actuators simultaneously.

[0082] This level of dual-redundancy protection ensures that the actuators can continue to operate normally even if one actuator motor or actuator fails. The algorithm at this level is calculated by the actuator processor directly upstream of the failed actuator. The algorithm's input is the actual control input of the actuator detected by its sensors, such as the actual deflection angle of the aileron. When the actual control input of the downstream actuator does not match the command output by the actuator processor, it can be determined that the downstream actuator motor or actuator has failed. The handling method is similar to the previous level: the downstream actuator output is cut off, and a locking signal is sent to the locking mechanism, relying on the other actuator processor and actuator to control all actuators.

[0083] Optionally, assuming all actuator processors are operating normally, the redundancy control method of this application further includes, on the first actuator processor side, [further details needed]. Figure 4 Steps S410-S440 and step S150: Step S410: Obtain the actual control input of the actuator corresponding to the second flight control computer; Step S420: Determine whether the actual control input matches the theoretical control input of the master flight control command of the second flight control computer; Step S430: When the actual control input and the theoretical control input of the master flight control command of the second flight control computer do not match, a disconnect signal is sent to the actuator connected to the first actuator processor. Step S150: Send a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the locked actuators.

[0084] In this embodiment, when the actual control input does not match the theoretical control input of the master flight control command of the second flight control computer, it indicates that there is a fault in the first actuator or the first execution mechanism. At this time, a disconnect signal is sent to the first actuator corresponding to the first actuator processor.

[0085] Step S440: When the actual control input matches the theoretical control input of the master flight control command of the second flight control computer, a closing signal is sent to the actuator connected to the first actuator processor to send the master control command of the second flight control computer to the actuator corresponding to the first actuator processor.

[0086] In this embodiment, when the actual control input matches the theoretical control input of the master flight control command of the second flight control computer, a closing signal is sent to the first actuator connected to the first actuator processor to send the master control command of the second flight control computer to the actuator corresponding to the first actuator processor.

[0087] In one embodiment, assuming all actuator processors are operating normally, the redundancy control method of this application further includes, on the second actuator processor side: obtaining the actual control input of the second actuator corresponding to the first flight control computer; when the actual control input does not match the theoretical control input of the master flight control command of the first flight control computer, indicating a fault in the second actuator or the second actuator, a disconnect signal is sent to the second actuator corresponding to the second actuator processor; and a locking signal is sent to the locking mechanism to lock the corresponding actuator, enabling the first actuator processor to synchronously control the locked actuators. Optionally, when the actual control input matches the theoretical control input of the master flight control command of the first flight control computer, a closing signal is sent to the second actuator corresponding to the second actuator processor to send the master control command of the second flight control computer to the second actuator corresponding to the second actuator processor.

[0088] In one embodiment, if both the first actuator processor and the second actuator processor detect a malfunction in their respective actuators or actuators, a limiter is provided to prevent the aircraft from failing to fly normally due to all actuators or actuators shutting down. This limiter connects the actuator processor and the power switch. The actuator level and the actuator processor level share a limiter, which is used to restrict the signal to be cut off on one side only at a time. That is, it is used to control at least one actuator processor to send a locking signal to the locking mechanism when disconnection signals are received from all actuator processors.

[0089] According to the above technical solution, this embodiment divides the actuator into two parts at the actuator output level, with each actuator executing them synchronously. Each actuator controls its own left and right parts. When the manipulation amount fed back by one actuator does not match the control output of the corresponding actuator processor, that actuator is disconnected, and a locking mechanism is connected so that the other actuator can simultaneously control all actuators, protecting the overall maneuverability of the actuator and improving flight safety.

[0090] This invention provides an embodiment of a redundancy control method for a flight control system. It should be noted that although the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than that shown here.

[0091] like Figure 5 As shown, Figure 5 This is a schematic diagram of the hardware operating environment of the actuator processing module. The actuator processing module includes: a memory, an actuator processor, and a redundancy control program for the flight system stored in the memory and capable of running on the actuator processor, wherein: When the actuator processor calls the redundancy control program of the flight system stored in memory, it performs the following operations: Receive verification flight control commands sent by the first flight control computer; The second actuator processor receives the master flight control command, which is sent by the first flight control computer to the second actuator processor. When the main flight control command and the verification flight control command do not match, a disconnect signal is sent to the power switch corresponding to the second actuator processor; A locking signal is sent to the locking mechanism to lock the corresponding actuator, so that the first actuator processor can synchronously control the locked actuators.

[0092] Based on the same inventive concept, this application provides a flight control system, which includes: an actuator processing module. The actuator processing module of this application includes at least two actuator processing units, each actuator processing unit including an actuator processor, an actuator, a power switch, and an execution mechanism, wherein the power switch is connected between the actuator and the execution mechanism; a locking mechanism is located between each of the execution mechanisms; each actuator processor is connected to a corresponding power switch and the locking mechanism, and is used to send a disconnect signal to the power switch of the faulty actuator processor and a locking signal to the locking mechanism when a fault is detected in the actuator processor; the default state of the locking mechanism is an open state.

[0093] Optionally, the flight control system includes at least two flight control computers; At least two signal switches are configured corresponding to the flight control computer and are used to connect the flight control computer and the actuator processing module. An arbitration unit is connected to each of the flight control computers and signal switches. When a flight control computer malfunctions, the arbitration unit sends a disconnect signal to the signal switch corresponding to the malfunctioning flight control computer. The default state of the signal switch is closed.

[0094] Optionally, the flight control computer includes a first flight control computer 110 and a second flight control computer 120, and the signal switch includes a first signal switch 130 and a second signal switch 140; both the first signal switch 130 and the second signal switch 140 are connected to the actuator processing module 160.

[0095] Optionally, the actuator processing module includes at least two actuator processing units, each actuator processing unit including an actuator processor, an actuator, a power switch and an execution mechanism, wherein the power switch is connected between the actuator and the execution mechanism; A locking mechanism is located between each of the actuators; Each actuator processor is connected to a corresponding power switch and a locking mechanism, and is used to send a disconnect signal to the power switch of the faulty actuator processor and a locking signal to the locking mechanism when a fault is detected; the default state of the locking mechanism is the disconnect state.

[0096] Optionally, the actuator processor includes: a first actuator processor and a second actuator processor, wherein the first signal switch and the second signal switch are both connected to the first actuator processor; and / or, the first signal switch and the second signal switch are both connected to the second actuator processor.

[0097] Optionally, the flight control system further includes: a limiter, the limiter being connected to the actuator processor and the power switch, for controlling at least one power switch connected to an actuator processor to close when receiving disconnect signals from all actuator processors, or for controlling at least one actuator processor to send a locking signal to the locking mechanism when receiving disconnect signals from all actuator processors.

[0098] Optionally, the actuator is connected to the actuator processor, which is further configured to send a disconnect signal to the corresponding actuator and a lock signal to the locking mechanism when a failure of the actuator is detected.

[0099] Optionally, the flight control system further includes: a detection sensor connected to the actuator and the actuator processor, used to collect the actual control input of the actuator and feed the actual control input back to the actuator processor, so that the actuator processor can detect whether the actuator has malfunctioned based on the actual control input.

[0100] Optionally, the actuator may include a control surface, a landing gear retraction unit, a tilting unit, or a door.

[0101] Optionally, the actuators can be any movable component on the aircraft, and each actuator may include control surfaces, landing gear retraction units, tilting units, or doors. The tilting unit is a rotor tilting unit; the control surfaces include those on the wings, the vertical tail, and the horizontal tail.

[0102] Optionally, the flight control system further includes: a third signal switch, the third signal switch being connected to the control stick and the actuator processing module; The arbitration unit is also used to: send a closing signal to the third signal switch when all flight control computers fail; the default state of the third signal switch is the open state.

[0103] Optionally, the flight control system further includes a display module connected to the arbitration unit, which is used to display the determination result of a faulty flight control computer.

[0104] The specific implementation of the flight control system of the present invention is basically the same as the various embodiments of the redundancy control method of the flight control system described above, and will not be repeated here.

[0105] Based on the same inventive concept, this application also provides a computer-readable storage medium storing a redundancy control program for a flight system. When the redundancy control program for the flight system is executed by a processor, it implements the various steps of the redundancy control method for the flight control system as described above and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0106] Since the storage medium provided in this application embodiment is the storage medium used to implement the method of this application embodiment, those skilled in the art can understand the specific structure and variations of the storage medium based on the method described in this application embodiment, and therefore will not be repeated here. All storage media used in the method of this application embodiment are within the scope of protection of this application.

[0107] The above description is only a preferred embodiment of the present invention and does not limit the patent scope of the present invention. All equivalent structural transformations made under the concept of the present invention using the contents of the present invention specification and drawings, or direct / indirect applications in other related technical fields, are included within the patent protection scope of the present invention.

Claims

1. A redundancy control method for a flight control system, characterized in that, Applied to a first actuator processor, the method includes: Receives master flight control commands from the second flight control computer; Send the main flight control command to the actuator corresponding to the first actuator processor; Obtain the actual control input of the actuator corresponding to the second flight control computer; When the actual control input and the theoretical control input of the master flight control command of the second flight control computer do not match, a disconnect signal is sent to the actuator connected to the first actuator processor. A locking signal is sent to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the locked actuators.

2. The method as described in claim 1, characterized in that, After the step of obtaining the actual control input of the actuator corresponding to the second flight control computer, the method further includes: When the actual control input matches the theoretical control input of the master flight control command of the second flight control computer, a closing signal is sent to the actuator connected to the first actuator processor to send the master control command of the second flight control computer to the actuator corresponding to the first actuator processor.

3. The method as described in claim 1, characterized in that, After the step of sending a locking signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the locked actuators, the method further includes: Send a disconnect signal to the limiter so that when the limiter receives disconnect signals from all actuator processors, it controls at least one actuator processor to send a locking signal to the locking mechanism.

4. The method as described in claim 1, characterized in that, Sending the main flight control command to the actuator corresponding to the first actuator processor includes: The main flight control commands are converted into current signals; The current signal is sent to the actuator connected to the first actuator processor, so that the current signal is transmitted to the actuator corresponding to the first actuator processor through a power switch connected to the actuator and in a closed state.

5. An actuator processing module, characterized in that, The actuator processing module includes an actuator processor, a memory, and a redundancy control program of the flight control system stored in the memory and executable on the actuator processor. When the redundancy control program of the flight control system is executed by the actuator processor, it implements the steps of the redundancy control method of the flight control system as described in any one of claims 1-4.

6. A flight control system, characterized in that, The flight control system includes the actuator processing module as described in claim 5.

7. The flight control system as described in claim 6, characterized in that, The actuator processor module includes at least two actuation processing units. Each actuation processing unit includes an actuator processor, an actuator, a power switch, and an execution mechanism. The power switch is connected between the actuator and the execution mechanism. A locking mechanism is located between each of the actuators; The actuator processor includes a first actuator processor and a second actuator processor. Each actuator processor is connected to a corresponding power switch and the locking mechanism. When the actual control input and the theoretical control input of the master flight control command of the second flight control computer do not match, the first actuator processor sends a disconnect signal to the actuator connected to the first actuator processor and sends a lock signal to the locking mechanism to lock the corresponding actuator, so that the second actuator processor can synchronously control the locked actuator.

8. The flight control system as described in claim 7, characterized in that, The actuators include control surfaces, landing gear retraction units, tilting units, or hatches.

9. The flight control system as described in claim 7, characterized in that, The flight control system further includes a detection sensor, which is connected to the actuator and the actuator processor. The detection sensor is used to collect the actual manipulation amount of the actuator and feed the actual manipulation amount back to the first actuator processor so that the first actuator processor can obtain the actual manipulation amount of the actuator corresponding to the second flight control computer.

10. A computer-readable storage medium, characterized in that, It stores a redundancy control program for a flight control system, which, when executed by a processor, implements the steps of the redundancy control method for the flight control system as described in any one of claims 1-4.

Images