A method for flight control computer redundancy management to prevent NAN failure propagation

Abstract

The application belongs to the field of flight control, and particularly relates to a flight control computer redundancy management method for preventing NAN fault spreading, and specifically comprises: modifying various operations and cross monitoring, the cross monitoring is realized through cross transmission of integrator outputs between redundancy channels, and comprises: sending end monitoring: before sending the integrator output to other channels, data legitimacy is judged, if the data is illegal, the last valid value is sent, and a fault counter is triggered; when data is illegal for 8 beats (100 ms) continuously, a central processing unit fault (CPUV) of the channel is set, a latch fault is set, and fault information is recorded to a nonvolatile memory (NVM); receiving end monitoring: when the integrator output of other channels is received, data legitimacy is judged, if the data is illegal, the last valid value is input to control law software, and fault information is recorded.

Description

Technical Field

[0001] This application belongs to the field of flight control, and specifically relates to a method for managing the redundancy of flight control computers to prevent the spread of NAN faults. Background Technology

[0002] In a computer system, the processor is a core component responsible for performing various computational tasks. However, when a processor experiences a Not a Number (NAN) fault, the system may face a series of serious problems. NAN is a special type of floating-point number that indicates the result of a calculation cannot be represented as a valid numerical value. This fault not only affects the accuracy of calculations but also poses a significant threat to the stability and safety of the system, potentially leading to serious flight accidents.

[0003] Existing flight control computer redundancy management strategies typically employ methods such as comparative monitoring, majority voting, and integral equalization to process input and output signals. However, in the event of a non-altering anomaly (NAN) failure, there is a possibility that the fault can propagate from one channel to all channels, significantly reducing the safety of the flight control redundancy system. Therefore, there is an urgent need for a method that can comprehensively, in real-time, and reliably monitor and isolate NAN failures. Summary of the Invention

[0004] To address the aforementioned issues, this application provides a flight control computer redundancy management method to prevent the spread of NAN faults, including a monitoring mechanism that combines source blocking and cross-monitoring.

[0005] The source blocking is achieved by implementing security protection at the software layer for mathematical operations that are prone to generating NaN (Navigational Anomalies), specifically including:

[0006] When performing square root operations, the safe square root function is called: when the input value is less than 0, it is automatically replaced with 0 for the operation;

[0007] Before performing arccosine or arcsine operations, the input value is limited to [-1.0, 1.0].

[0008] Before tangent calculation, the input angle is limited to [-90.0+1e-6, 90.0-1e-6];

[0009] When performing logarithmic operations, if the input value is less than 1e-6, the output value will be fixed at 1e-6.

[0010] When performing a division operation, the safe division function is called: if the absolute value of the divisor is less than 1e-6, it is replaced with 1e-6 or the value of the previous step is retained for the operation;

[0011] The cross-monitoring is achieved through cross-transmission of integrator outputs between redundancy channels, including:

[0012] Transmitter monitoring: Before sending the integrator output to other channels, this channel performs a data validity check. If the data is invalid, the valid value of the previous step is used for transmission, and the fault counter is triggered. When the data is invalid for 8 consecutive steps (100ms), the central processing unit (CPUV) and latch fault of this channel are set and recorded in the non-volatile memory (NVM).

[0013] Receiver monitoring: When this channel receives the integrator output from other channels, it performs a data validity check. If the data is invalid, it uses the previous valid value to input the control law software and records the fault information.

[0014] Channel isolation: If a remote channel is determined to have invalid data for 8 consecutive frames (100ms), this channel marks the DP_T of that remote channel as faulty.

[0015] Preferably, the data validity judgment conditions include detecting whether the floating-point number is NAN, infinity, or exceeds a preset valid value range.

[0016] Preferably, the safe square root function, safe arccosine / arcsine function, safe tangent function, safe logarithmic function, and safe division function are all encapsulated in the basic function library of the flight control computer and are called and executed by the control law software.

[0017] Preferably, the integrator output is transmitted between redundant channels via a cross-channel data link (CCDL), and the transmitted data format is floating-point numbers.

[0018] Preferably, when the number of consecutive illegal data entries accumulated by the fault counter reaches the 8-times threshold, a channel-level fault isolation action is triggered.

[0019] A flight control computer redundancy system is applied to a flight control system, including at least three redundancy channels. Each channel is configured with a calculation module formed by the redundancy management method for preventing the spread of NAN faults. The channels are cross-transmitted and monitored by integrator output through CCDL.

[0020] Preferably, the computing module performs source blocking operations in real time during the processor's runtime cycle and performs cross-monitoring operations in each data transmission cycle. Attached Figure Description

[0021] Figure 1 This is a schematic diagram of the redundancy architecture of the flight control computer according to a preferred embodiment of this application. Detailed Implementation

[0022] To make the technical solution and advantages of this application clearer, the technical solution of this application will be described in a clearer and more complete manner below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only some embodiments of this application, and are only used to explain this application, not to limit this application. It should be noted that, for ease of description, only the parts related to this application are shown in the accompanying drawings. Other related parts can be referred to the general design. In the absence of conflict, the embodiments and technical features in the embodiments of this application can be combined with each other to obtain new embodiments.

[0023] A method for redundancy management of flight control computers to prevent the spread of NAN faults, characterized by a monitoring mechanism that combines source blocking and cross-monitoring;

[0024] The source blocking is achieved by implementing security protection at the software layer for mathematical operations that are prone to generating NaN (Navigational Anomalies), specifically including:

[0025] When performing square root operations, the safe square root function is called: when the input value is less than 0, it is automatically replaced with 0 for the operation;

[0026] Before performing arccosine or arcsine operations, the input value is limited to [-1.0, 1.0].

[0027] Before tangent calculation, the input angle is limited to [-90.0+1e-6, 90.0-1e-6];

[0028] When performing logarithmic operations, if the input value is less than 1e-6, the output value will be fixed at 1e-6.

[0029] When performing a division operation, the safe division function is called: if the absolute value of the divisor is less than 1e-6, it is replaced with 1e-6 or the value of the previous step is retained for the operation;

[0030] The cross-monitoring is achieved through cross-transmission of integrator outputs between redundancy channels, including:

[0031] Transmitter monitoring: Before sending the integrator output to other channels, this channel performs a data validity check. If the data is invalid, the valid value of the previous step is used for transmission, and the fault counter is triggered. When the data is invalid for 8 consecutive steps (100ms), the central processing unit (CPUV) and latch fault of this channel are set and recorded in the non-volatile memory (NVM).

[0032] Receiver monitoring: When this channel receives the integrator output from other channels, it performs a data validity check. If the data is invalid, it uses the previous valid value to input the control law software and records the fault information.

[0033] Channel isolation: If a remote channel is determined to have invalid data for 8 consecutive frames (100ms), this channel marks the DP_T of that remote channel as faulty.

[0034] Based on the above technical features, the source of NAN (Network Anomaly) is blocked at the computing layer to directly eliminate the conditions for its generation, and cross-monitoring isolates faults at the data transmission layer, forming a full-process protection. A 100ms-level fault detection speed meets aerospace-grade real-time requirements (DO-254 standard), and the "previous clock value replacement" mechanism ensures continuous system operation. CPUV fault marking and DP_T channel isolation prevent the propagation of single-point faults, maintaining a minimum safety architecture for the redundancy system.

[0035] For example, in the pitch control channel of a certain type of UAV, atmospheric turbulence caused the angle of attack sensor to output an abnormally negative value.

[0036] Source blocking: The safe square root function replaces negative values ​​with 0, preventing the attitude calculation module from outputting NAN.

[0037] Cross-monitoring: Abnormal data is deemed invalid by the receiving channel during CCDL transmission, and the previous normal servo command is used instead. Simultaneously, the fault counter accumulates the number of errors. After 8 consecutive invalid errors, the transmitting channel DP_T is marked as faulty, and control automatically switches to the backup channel.

[0038] In some optional implementations, the data validity determination conditions include detecting whether the floating-point number is NAN, infinity, or exceeds a preset valid value range.

[0039] In some optional implementations, the safe square root function, safe arccosine / arcsine function, safe tangent function, safe logarithmic function, and safe division function are all encapsulated in the basic function library of the flight control computer and are called and executed by the control law software.

[0040] Based on the above technical features, a unified encapsulation of safety functions reduces code redundancy and lowers the development error rate (e.g., preventing engineers from forgetting to add amplitude limiting protection). When the function library is updated (e.g., to optimize the tangent amplitude limiting range), there is no need to modify the main control law code.

[0041] In some alternative implementations, the integrator output is transmitted between redundant channels via a cross-channel data link (CCDL), with the transmitted data format being floating-point numbers. The floating-point format preserves the decimal precision of the integrator output (e.g., rudder deflection at the 0.0001° level), avoiding control precision loss caused by integer conversion. Directly transmitting binary floating-point numbers reduces data packing / parsing time (improving efficiency by 40% compared to integer transmission).

[0042] In some optional implementations, the fault counter accumulates the number of consecutive illegal data entries, triggering a channel-level fault isolation action when it reaches an 8-beat (100ms) threshold. The 8-beat (100ms) accumulation mechanism masks transient noise (such as a single electromagnetic pulse), reducing the false alarm rate. This gradual strategy of temporary replacement followed by channel isolation maximizes system availability while ensuring safety.

[0043] A flight control computer redundancy system is applied to a flight control system, including at least three redundancy channels. Each channel is configured with a calculation module formed by the redundancy management method for preventing the spread of NAN faults. The channels are cross-transmitted and monitored by integrator output through CCDL.

[0044] The computing module performs source blocking operations in real time during the processor's runtime cycle and performs cross-monitoring operations in each data transmission cycle.

[0045] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for redundancy management of flight control computers to prevent the spread of NAN (Non-Analogous Anomaly) faults, characterized in that, This includes a monitoring mechanism that combines source interception with cross-monitoring; The source blocking is achieved by implementing security protection at the software layer for mathematical operations that are prone to generating NaN (Navigational Anomalies), specifically including: When performing square root operations, the safe square root function is called: when the input value is less than 0, it is automatically replaced with 0 for the operation; Before performing arccosine or arcsine operations, the input value is limited to [-1.0, 1.0]. Before tangent calculation, the input angle is limited to [-90.0+1e-6, 90.0-1e-6]; When performing logarithmic operations, if the input value is less than 1e-6, the output value will be fixed at 1e-6. When performing a division operation, the safe division function is called: if the absolute value of the divisor is less than 1e-6, it is replaced with 1e-6 or the value of the previous step is retained for the operation; The cross-monitoring is achieved through cross-transmission of integrator outputs between redundancy channels, including: Transmitter monitoring: Before sending the integrator output to other channels, this channel performs a data validity check. If the data is invalid, the valid value of the previous step is used for transmission, and the fault counter is triggered. When 8 consecutive steps of data are invalid, the central processing unit of this channel is set to fault and the latch is set to fault, and the fault is recorded in the non-volatile memory. Receiver monitoring: When this channel receives the integrator output from other channels, it performs a data validity check. If the data is invalid, it uses the previous valid value to input the control law software and records the fault information. Channel isolation: If a remote channel is determined to have invalid data for 8 consecutive cycles, this channel marks the DP_T of that remote channel as faulty.

2. The flight control computer redundancy management method for preventing the spread of NAN faults as described in claim 1, characterized in that, The data validity judgment conditions include detecting whether the floating-point number is NAN, infinity, or exceeds the preset valid value range.

3. The flight control computer redundancy management method for preventing the spread of NAN faults as described in claim 1, characterized in that, The safe square root function, arccosine or arcsine function, tangent function, logarithmic function, and safe division function are all encapsulated in the basic function library of the flight control computer and are called and executed by the control law software.

4. The flight control computer redundancy management method for preventing the spread of NAN faults as described in claim 1, characterized in that, The integrator output is transmitted between redundant channels via a cross-channel data link, and the transmitted data format is floating-point numbers.

5. The flight control computer redundancy management method for preventing the spread of NAN faults as described in claim 1, characterized in that, When the number of consecutive illegal data entries accumulated by the fault counter reaches the 8-times threshold, a channel-level fault isolation action is triggered.

6. A flight control computer redundancy system, applied to a flight control system, characterized in that, It includes at least three redundancy channels, each channel is configured with a computing module formed by the redundancy management method for preventing the spread of NAN faults as described in any one of claims 1-5, and the integrator output is cross-transmitted and monitored between the channels through a cross-channel data link.

7. The flight control computer redundancy system according to claim 6, characterized in that, The computing module performs source blocking operations in real time during the processor's runtime cycle and performs cross-monitoring operations in each data transmission cycle.

Images