Hot backup unmanned aerial vehicle electromechanical system and redundancy management method
By employing a hot backup design for computer A and computer B in the UAV electromechanical system, and utilizing heartbeat signal lines and mutual transmission signal lines for state differentiation and redundancy management, the problems of increased weight and high cost in existing technologies are solved, achieving efficient, low-latency redundancy switching and stable control.
Patent Information
- Application Number
- CN202510923020.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-07-04
- Publication Date
- 2025-11-18
AI Technical Summary
Existing redundancy management methods for UAV electromechanical management systems suffer from increased aircraft weight and high costs, and the switching process is complex, making it difficult to meet the high-efficiency and safe control requirements of UAVs.
The UAV electromechanical system with hot backup transmits data between computer A and computer B through heartbeat signal lines and mutual transmission signal lines, enabling the differentiation of the status of computer A and computer B and redundancy management. By utilizing the hot backup of mutual transmission signal lines and the design of main and backup channels, low-cost and efficient redundancy switching is achieved.
It achieves low-cost redundancy management, reduces aircraft weight, lowers information interaction costs, has a redundancy switching delay of 100-150ms, ensures stable control task output, and avoids signal conflicts and equipment failures.
Smart Images
Figure CN120972640A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application belongs to the field of avionics, and particularly relates to a hot backup unmanned aerial vehicle electromechanical system and a redundancy management method. BACKGROUND
[0002] The airborne electromechanical system is a general term of systems on an aircraft for performing various functions of flight support. Typical electromechanical systems on an aircraft include power supply, fuel, hydraulic pressure, secondary power, wheel brake, environmental control and life support system, which directly affect the performance and safety of the aircraft.
[0003] The electromechanical management system generally undertakes the specific control of the execution structure of the aircraft electromechanical system, sensor fault monitoring, such as sending brake quantity to the brake valve to control brake force, monitoring the temperature of each cabin of the aircraft body through a temperature sensor, etc.
[0004] In order to ensure flight safety, important functions in the electromechanical management system need to be designed in a redundant manner. System redundancy management mainly includes the following aspects.
[0005] a) Data transmission redundancy management with external devices such as flight parameter recording equipment; b) Data internal transmission redundancy management; c) Management of data redundancy acquisition; d) Redundancy management of electromechanical control logic calculation; e) Management of electromechanical control command redundancy output; f) Reconstruction management under system fault mode.
[0006] There are the following existing technologies in the redundancy management of the electromechanical management system: 1. Patent "Electromechanical management subsystem fault-tolerant design method based on hybrid redundancy heterogeneous network" by Yang Dongliang The data transmission network between the electromechanical management subsystem and the avionics system adopts a three-redundancy heterogeneous design, and the data transmission network inside the electromechanical management subsystem adopts a double-redundancy heterogeneous design. When a data bus of a certain structure fails, the electromechanical management subsystem can perform bus switching and self-reconstruction, and can continue information interaction through other structure data buses. This design method is used to improve the safety and fault tolerance of data internal transmission of the electromechanical management system and data transmission between the electromechanical management system and external devices, but requires increased bus cable length and nodes supported by the whole machine design, which causes redundancy of the weight of the aircraft most of the time.
[0007] 2. Patent "GJB289A bus data scheduling and redundancy management method and device" by Huan Tianlun The application provides a GJB289A bus data scheduling and redundancy management method and device, and belongs to the technical field of avionics.
[0008] 3. Patent "Electromechanical control system based on dual-redundant bus" by Zhang Nan The application provides an electromechanical control system based on a dual-redundant bus, which comprises a first computer, a second computer and a remote interface, wherein the remote interface comprises a safety interface and a non-safety interface, and the method comprises the following steps: the first computer is connected with the remote interface through a first data communication bus, and the second computer is connected with the remote interface through a second data communication bus; the safety interface is connected with the first computer and the second computer in a double-hanging mode, and the non-safety interface is connected with the first computer or the second computer in a preset single-hanging mode. The application improves the communication efficiency between the system and the interface. The design provides high safety, realizes complete redundancy of data acquisition, internal data transmission of the system, logical calculation, instruction output and external device data transmission in terms of multiple key control functions, and ensures the normal operation of multiple important functions of the electromechanical system of an airplane, such as oil control, landing gear control, flap control and pilot cabin temperature control. However, the complex system has a high cost, and only a few functions on the unmanned aerial vehicle have such high-level (complete redundancy) safety requirements. SUMMARY
[0009] The application aims to solve the problems in the prior art and provides a redundancy management method of an unmanned aerial vehicle electromechanical management system.
[0010] To achieve the above object, the application provides the following technical scheme: a hot backup unmanned aerial vehicle electromechanical system, which comprises a computer A, a computer B and a main channel and a backup channel for outputting important data of the unmanned aerial vehicle, A heartbeat signal line and a mutual transmission signal line are arranged between the computer A and the computer B, and the important data of the unmanned aerial vehicle is all input data related to the safety function of the unmanned aerial vehicle, The mutual transmission signal line is used for mutual transmission of the input data between the computer A and the computer B, the data source of the main channel is from the computer A, and the data source of the backup channel is from the computer B.
[0011] The unmanned aerial vehicle electromechanical system with hot backup provided by the application further has the technical scheme that the computer A and the computer B run the same software.
[0012] The unmanned aerial vehicle electromechanical system with hot backup provided by the application further has the technical scheme that the mutual transmission signal line includes two groups, and the two groups of mutual transmission signal lines are hot backup to each other.
[0013] The unmanned aerial vehicle electromechanical system with hot backup provided by the application further has the technical scheme that the main channel and the backup channel are each provided with a backhaul channel.
[0014] Another object of the application is to provide a redundancy management method of the unmanned aerial vehicle electromechanical system with hot backup, which is realized based on the unmanned aerial vehicle electromechanical system according to any one of the preceding aspects and includes the following steps. The computer A and the computer B run the same software at the same time. The computer A and the computer B are powered on, and the states of the computer A and the computer B are distinguished so that they are divided into one main control and one backup, and initialization is completed. After the initialization of the computer A and the computer B is completed, all control tasks are periodically executed, and a judgment is made before output, if the current computer is not the main control channel, the output is not executed. After the initialization of the computer A and the computer B is completed, a redundancy management task is periodically executed.
[0015] The redundancy management method of the unmanned aerial vehicle electromechanical system with hot backup provided by the application further has the technical feature that the distinguishing of the states of the computer A and the computer B includes the following steps. During power-on initialization, the computer A and the computer B are both defaulted as backup control states, and then the states of the opposite sides are confirmed through data mutual transmission of the mutual transmission signal line, if the opposite side is the main control channel, the self enters the backup control state, and if the opposite side is the backup control channel, the self enters the main control state.
[0016] The redundancy management method of the unmanned aerial vehicle electromechanical system with hot backup provided by the application further has the technical feature that the periodically executing of the redundancy management task includes the following steps. The computer A and the computer B judge whether the main acquisition channel of each data is faulty, if a hardware failure occurs, the data of the backup acquisition channel is used as valid data. The computer A and the computer B perform data mutual transmission through the two groups of mutual transmission signal lines, and the two groups are hot backup to each other. The computer A and the computer B judge the mutual transmission communication receiving state of the self, judge the heartbeat state of the opposite side, judge the control output data channel failure state, and are used for judging whether the main control channel is switched from the computer A to the computer B, and different judgments are made for the computer A and the computer B.
[0017] The hot backup unmanned aerial vehicle electromechanical system redundancy management method provided by the application further has the technical features that the computer A and the computer B judge the mutual communication receiving state of themselves, judge the heartbeat state of the other party, judge the control output data channel fault state, and are used for determining whether the master channel is switched from the computer A to the computer B. Different determinations are made for the computer A and the computer B, including: If the computer A determines that it is the master channel, the heartbeat of the other party is normal, the main channel of a certain important signal output is faulty, and the backup channel of the signal output is normal, the computer A sends a control channel switching request through mutual transmission and switches itself to the backup channel. If the computer A determines that it is the backup channel and determines through mutual transmission data that the other party is the backup channel for a period of time, the computer A switches itself to the master channel. If the computer B determines that it is the backup channel and receives a control channel switching request, the computer B switches itself to the master channel. If the computer B determines that it is the backup channel and determines through the heartbeat signal and mutual transmission data that the computer A is dead, the computer B switches itself to the master channel. If the computer B determines that it is the master channel and determines through mutual transmission data that the other party is the master channel for a period of time, the computer B switches itself to the backup channel.
[0018] Advantages: The hot backup unmanned aerial vehicle electromechanical system provided by the application only needs one device, the internal information interaction cost of the system is low, the weight of the aircraft is low, the redundancy switching information acquisition cost is low, and no new bus node is needed, but only internal communication of the device can be determined.
[0019] The redundancy management method provided by the application has the advantages of efficient and accurate redundancy switching. In laboratory tests, the delay is between 100-150 ms, and the output of all control tasks does not change after switching, and all control processes being executed continue to be executed. BRIEF DESCRIPTION OF DRAWINGS
[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the following will briefly introduce the drawings needed to be used in the embodiments. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative labor.
[0021] Figure 1 The system internal interface diagram provided by the embodiments of the present application is provided. Figure 2 The system external interface diagram provided by the embodiments of the present application is provided. Figure 3Flow chart of redundancy management provided by the embodiment of the present application; Figure 4 Time axis of dead machine fault determination in the embodiment of the present application. DETAILED DESCRIPTION
[0022] The present application will be further described below in conjunction with the accompanying drawings and embodiments. It should be noted that these embodiments are not intended to limit the present application, and equivalent transformations or substitutions of functions, methods or structures made by those skilled in the art based on these embodiments are within the protection scope of the present application.
[0023] In the description of the embodiments of the present application, it should be understood that the terms "center", "longitudinal", "transverse", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer" and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as a limitation of the present application.
[0024] In addition, the terms "first", "second", "third" and the like are only for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Therefore, the features defined with "first", "second" and the like can explicitly or implicitly include one or more of the features. In the description of the present application, unless otherwise specified, the meaning of "multiple" is two or more.
[0025] The terms "mounting", "connection", "connection" should be broadly understood, for example, it can be fixed connection, or detachable connection, or integral connection; it can be mechanical connection, or electrical connection; it can be directly connected, or indirectly connected through intermediate medium, or the communication between the two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.
[0026] As Figures 1-4 shown, the embodiment of the present application provides a hot backup unmanned aerial vehicle electromechanical system, the system comprises: computer A, computer B and the main channel and backup channel for outputting important data of unmanned aerial vehicle, The heartbeat signal line and the mutual transmission signal line are provided between the computer A and the computer B, and the important data of the unmanned aerial vehicle is all input data related to the safety function of the unmanned aerial vehicle, The mutual transmission signal line is used for inputting data between the computer A and the computer B, the data source of the main channel is from the computer A, and the data source of the backup channel is from the computer B. The data in the main acquisition channel can be acquired by the computer A and the computer B simultaneously, and the data in the backup acquisition channel can be acquired by the computer A and the computer B simultaneously.
[0027] In some embodiments, the computer A and the computer B run the same software.
[0028] In some embodiments, the mutual transmission signal line includes two groups, and the two groups of mutual transmission signal lines are hot backups of each other, and the communication period of the two mutual transmission channels is (T2).
[0029] In some embodiments, the instruction output related to important functions has a designed hardware redundancy channel, the main channel is connected to the computer A, the backup channel is connected to the computer B, and the main channel and the backup channel are both provided with a back acquisition channel.
[0030] In some embodiments, a hot backup unmanned aerial vehicle mechanical and electrical system redundancy management method is provided, characterized in that the redundancy management method is realized based on the unmanned aerial vehicle mechanical and electrical system according to any one of the preceding embodiments, and includes the following steps: The computer A and the computer B simultaneously run the same software; The computer A and the computer B are powered on, and the states of the computer A and the computer B are distinguished, so that they are divided into one main control and one backup, and initialization is completed; After the initialization of the computer A and the computer B is completed, all control tasks are periodically executed, and a judgment is made before output, if the current computer is not the main control channel, the output is not executed; After the initialization of the computer A and the computer B is completed, a redundancy management task is periodically executed.
[0031] In some embodiments, the states of the computer A and the computer B are distinguished as follows: During power-on initialization, the computer A and the computer B are both defaulted as backup control states, and then the states of the other party are confirmed through data mutual transmission of the mutual transmission signal line, if the other party is the main control channel, the self enters the backup control state; if the other party is the backup control channel, the self enters the main control state.
[0032] In some embodiments, the redundancy management task is periodically executed as follows: The computer A and the computer B judge whether the main acquisition channel of each data is faulty, if a hardware failure occurs, the backup acquisition channel data is used as valid data; The computer A and the computer B perform data mutual transmission through two groups of mutual transmission signal lines, and the two groups are hot backups of each other; The computer A and the computer B judge the mutual communication receiving state of itself, judge the heartbeat state of the other party, judge the control output data channel fault state, and are used for judging whether the master channel is switched from the computer A to the computer B. Different judgments are made for the computer A and the computer B.
[0033] In some embodiments, the computer A and the computer B judge the mutual communication receiving state of itself, judge the heartbeat state of the other party, judge the control output data channel fault state, and are used for judging whether the master channel is switched from the computer A to the computer B. Different judgments are made for the computer A and the computer B, including: If the computer A judges that itself is the master channel, the heartbeat of the other party is normal, the main channel of a certain important signal output is faulty, the backup channel of the signal output is normal, the computer A sends a control channel switching request through mutual transmission, and switches itself to the backup channel; If the computer A judges that itself is the backup channel and judges that the other party is the backup channel through mutual transmission data, the computer A switches itself to the master channel after a period of time; If the computer B judges that itself is the backup channel and receives a control channel switching request, the computer B switches itself to the master channel. If the computer B judges that itself is the backup channel and judges that the computer A is dead through heartbeat signals and mutual transmission data, the computer B switches itself to the master channel. If the computer B judges that itself is the master channel and judges that the other party is the master channel through mutual transmission data, the computer B switches itself to the backup channel after a period of time.
[0034] In some embodiments, the computer A and the computer B realize hot backup of all functions and ensure the accuracy of all functions during redundancy switching. Specifically, the computer A and the computer B need to obtain all input data required for logical calculation of functions, and divide the logical calculation input into four categories, including Figure 2 input data of external device 1, input data of external device 2, and data of input device; channel fault states of hardware redundancy, such as communication fault states of external device 1 and external device 2; input data of non-hardware redundancy, such as data of external device 3, data of external device 4, and data of input device; and channel fault states of non-hardware redundancy, such as communication fault states of external device 3 and external device 4. Figure 2 The computer A and the computer B need to include part of the data collected (data in the channel) and judged (channel communication fault state) by the computer A in the mutual transmission data from A to B, except for the input data of hardware redundancy. The computer A and the computer B need to include part of the data collected by the computer B in the mutual transmission data from B to A, except for the input data of hardware redundancy.
[0035] In some embodiments, after computer A and computer B are powered on, the same software is run, and only when the output signal is needed, it is determined whether the self is the master channel, if the self is the master channel, the output is executed, and if the self is not the master channel, the output is not executed. Avoiding the failure caused by the output signal conflict when the device is normally running.
[0036] In some embodiments, the master channel computer determines the acquisition channel failure, the bus signal determines the bus acquisition channel failure through judging whether there is a data packet and the data packet checksum, and the non-bus signal determines the non-bus acquisition channel failure through comparing the reference voltage acquisition value with the circuit preset value deviation; when the main acquisition channel fails, the master channel computer uses the backup acquisition channel.
[0037] In some embodiments, the fault determination of the control logic solution generally considers that the computer A cannot perform the control logic solution only when the computer A is dead. The heartbeat signal fault determination: the determination is made at the end of the fixed period (T1), and the number of changes (n) of the heartbeat signal line 01 in the period meets the fixed preset change frequency (f), that is, (n≈T1 / f), then the heartbeat is normal, otherwise the heartbeat is faulty; the mutual communication fault determination: in the past (T3) time, neither of the two data mutual communication channels receives a data packet or all data packets do not pass the packet check; the computer B determines the computer A dead condition: a) at a certain time (t0), the computer A to the computer B heartbeat signal line determines that there is a computer A heartbeat failure, at this time, the computer A to the computer B mutual communication is normal, b) after a certain time delay (T4), the computer A to the computer B mutual communication fails, then it is determined that the computer A is dead. Note: the setting of each determination time needs to meet 1. T3>T2, to ensure the accuracy of the communication fault determination; 2. T3>T1, to ensure that in the determination of a), if A is dead, the heartbeat failure will necessarily be normal in communication; 3. T4>T3-T2, to ensure that in the determination of b), if A is already dead, the mutual communication failure will necessarily occur When the control logic solution fails, the redundancy management is performed by the computer B to control and output all functions, and the computer B marks itself as the master channel computer In some embodiments, the master channel computer A determines the control instruction main output channel failure, and determines whether the hardware channel fails by comparing the back acquisition value with the recorded output value; When the control instruction main output channel fails, the redundancy management is performed, if the instruction output backup channel does not fail at this time, the mutual communication is normal, and the computer B heartbeat is normal, the computer A marks itself as the backup channel state, the computer A sends a switching request through the mutual communication channel, and the computer B receives the switching request to control and output all functions, and the computer B marks itself as the master channel computer.
[0038] The above merely describes preferred embodiments of the present application and is not used to limit the present application, and any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application. The above merely describes preferred embodiments of the present application and is not used to limit the present application, and any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A hot backup unmanned aerial vehicle electromechanical system, characterized in that, The system comprises computer A, computer B, and a main channel and a backup channel for outputting important data of the unmanned aerial vehicle, The heartbeat signal line and the mutual transmission signal line are arranged between the computer A and the computer B, and the important data of the unmanned aerial vehicle is all input data related to safety function of the unmanned aerial vehicle, The mutual transmission signal line is used for mutual transmission of the input data between the computer A and the computer B, the data source of the main channel is from the computer A, and the data source of the backup channel is from the computer B.
2. The hot backup drone electromechanical system of claim 1, wherein, The computer A and the computer B run the same software.
3. The hot backup drone electromechanical system of claim 1, wherein, The mutual transmission signal line comprises two groups, and the two groups of mutual transmission signal lines are hot backups of each other.
4. The hot backup drone electromechanical system of claim 1, wherein, The main channel and the backup channel are both provided with a back sampling channel.
5. A method for hot backup redundancy management of unmanned aerial vehicle electromechanical systems, characterized in that, The redundancy management method is realized based on the unmanned aerial vehicle electromechanical system according to any one of claims 1-4, comprising: The computer A and the computer B run the same software at the same time; The computer A and the computer B are powered on, and the states of the computer A and the computer B are distinguished, so that they are divided into a main control and a backup, and initialization is completed; After the initialization of the computer A and the computer B is completed, all control tasks are periodically executed, and a judgment is made before output, if the current computer is not the main control channel, the output is not executed; After the initialization of the computer A and the computer B is completed, a redundancy management task is periodically executed.
6. The method of claim 5, wherein the method further comprises: The distinguishing of the states of the computer A and the computer B comprises: During the power-on initialization, the computer A and the computer B are both defaulted as backup control states, and then the states of the other party are confirmed through mutual transmission of data of the mutual transmission signal line, if the other party is the main control channel, the self enters the backup control state, if the other party is the backup control channel, the self enters the main control state.
7. The method of claim 5, wherein the method further comprises: The periodically executed redundancy management task comprises: The computer A and the computer B judge whether the main sampling channel of each data is faulty, if a hardware failure occurs, the data of the backup sampling channel is used as valid data; The computer A and the computer B perform data mutual transmission through the two groups of mutual transmission signal lines, and the two groups are hot backups of each other; The computer A and the computer B judge the mutual transmission communication receiving state of the self, judge the heartbeat state of the other party, judge the control output data channel failure state, and are used for judging whether the main control channel is switched from the computer A to the computer B, and different judgments are made for the computer A and the computer B.
8. The hot-standby unmanned aerial vehicle electromechanical system redundancy management method of claim 7, wherein, The computer A and the computer B judge the mutual transmission communication receiving state of the self, judge the heartbeat state of the other party, judge the control output data channel failure state, and are used for judging whether the main control channel is switched from the computer A to the computer B, and different judgments are made for the computer A and the computer B, comprising: If the computer A judges that the self is the main control channel, the other party's heartbeat is normal, the main channel of a certain important signal output is faulty, and the backup channel of the signal output is normal, the computer A sends a control channel switching request through mutual transmission, and switches the self to the backup channel; If the computer A judges that the self is the backup channel, and judges that the other party is the backup channel through mutual transmission data, the computer A switches the self to the main control channel for a period of time; If the computer B judges that the self is the backup channel, and receives the control channel switching request, the computer B switches the self to the main control channel. If the computer B determines itself as the standby channel and determines that the computer A is dead through the heartbeat signal and the mutual data transmission, the computer B switches itself as the master channel; If the computer B determines itself as the master channel and determines that the other party is the master channel through the mutual data transmission for a period of time, the computer B switches itself as the standby channel.