Flight control system, control method and aircraft

Abstract

The invention discloses a flight control system, a control method and an aircraft. The system comprises a flight data calculation module, an obstacle avoidance perception calculation module and a flight control module. The flight data calculation module obtains multi-source sensing data, and generates flight state information reflecting the real-time motion state of the aircraft and environment adaptation parameters through redundancy operation and voting; the obstacle avoidance sensing calculation module comprises two visual positioning mapping sub-modules, obstacle avoidance information is generated in an intelligent driving mode and is subjected to interactive verification, and a waypoint instruction is generated after an error reaches the standard; and the flight control module is connected with each related module and a cabin operation system, obtains flight state information, waypoint instructions and / or cabin operation instructions, outputs actuator control signals through control law redundancy operation and voting, and drives an actuator to control the aircraft to fly according to an obstacle avoidance path or a control path. According to the invention, the reliability and safety of flight control are improved, and complex flight scene requirements are met.

Description

Technical Field

[0001] This invention relates to the field of aircraft control technology, and in particular to a flight control system and control method, and an aircraft. Background Technology

[0002] The flight control system is a core component of a vertical take-off and landing (VTOL) aircraft. VTOL aircraft need to switch between multiple modes, such as vertical take-off and landing, hovering, transitional flight, and level flight. Its flight control system is mainly used to accurately acquire flight status data of the aircraft in multiple modes, receive and parse flight commands, generate actuator control signals through calculation and decision-making, and then accurately control the attitude, trajectory and power output of the aircraft to ensure that the aircraft flies stably and safely according to the preset intention in complex mode switching and operation scenarios.

[0003] VTOL aircraft are commonly used in urban air traffic, low-altitude complex terrain operations, and other scenarios. The flight environment is highly variable and the safety redundancy requirements are extremely high. The operational reliability of its flight control system is directly related to the flight safety and mission completion efficiency of the aircraft, and is crucial for the large-scale application of VTOL aircraft.

[0004] Therefore, how to improve the overall operational reliability of the flight control system of VTOL aircraft and avoid various failure risks has become a key issue that urgently needs to be addressed in the field of VTOL aircraft technology. Summary of the Invention

[0005] In view of the above problems, the present invention provides a flight control system and control method, and an aircraft. Through the collaborative design of physical and logical dual isolation of core functions of multiple modules, cross-verification of obstacle avoidance information, switching between primary and backup control and multi-level redundancy protection, the reliability of the flight control system is significantly improved, meeting the high safety redundancy requirements of VTOL aircraft and ensuring safe and stable flight in complex scenarios.

[0006] Firstly, a flight control system is provided, comprising: The flight data calculation module is used to acquire multi-source flight sensor data, and perform redundancy calculation and voting based on the multi-source flight sensor data to generate flight status information. The flight status information is used to reflect the real-time motion status and environmental adaptation parameters of the aircraft. The obstacle avoidance perception and calculation module includes two visual positioning and mapping sub-modules. Each visual positioning and mapping sub-module is used to acquire environmental point cloud data and target location data after the aircraft enters the intelligent driving mode, and generate obstacle avoidance information based on the environmental point cloud data and the target location data. The obstacle avoidance information includes at least an obstacle map and an obstacle avoidance path. The two visual positioning and mapping sub-modules are used to exchange the obstacle avoidance information, and generate waypoint instructions based on the obstacle avoidance information when the error between the two sets of obstacle avoidance information is within a set range. The flight control module is communicatively connected to the flight data calculation module, the obstacle avoidance perception calculation module, and the cockpit operating system of the aircraft. It is used to acquire the flight status information, the waypoint instructions, and / or the cockpit operation instructions. Based on the flight status information and the waypoint instructions, or based on the flight status information and the cockpit operation instructions, it performs control law redundancy calculation and voting, outputs corresponding actuator control signals, and sends them to the corresponding actuators on the aircraft to drive each actuator to control the aircraft to fly according to the obstacle avoidance path or the pilot control path.

[0007] In some embodiments, the obstacle avoidance perception calculation module is further configured to: generate an alarm command and send it to the flight control module when the error between the two sets of obstacle avoidance information is outside the set range, wherein the alarm command is used to indicate that the obstacle avoidance perception calculation module has failed and intelligent driving is unavailable; The flight control module is also used to: if it receives the alarm command and the cockpit operation command, output the corresponding actuator control signal based on the cockpit operation command and send it to the corresponding actuator on the aircraft, so as to drive each actuator to control the aircraft to fly according to the pilot's control path.

[0008] In some embodiments, the two visual positioning and mapping submodules are communicatively connected, and each visual positioning and mapping submodule is configured as follows: The obstacle avoidance information and power-on count of the current visual positioning and mapping submodule are sent to another visual positioning and mapping submodule, and the obstacle avoidance information and power-on count sent by the other visual positioning and mapping submodule are received. If the error between the obstacle avoidance information of the current visual positioning and mapping submodule and the obstacle avoidance information of the other visual positioning and mapping submodule is within a set range, a main visual positioning and mapping submodule is determined based on the number of power-on times of the current visual positioning and mapping submodule and the number of power-on times of the other visual positioning and mapping submodule. The main visual positioning and mapping submodule is one of the current visual positioning and mapping submodule or the other visual positioning and mapping submodule. If the current visual positioning and mapping submodule is the main visual positioning and mapping submodule, the waypoint command is generated and sent to the flight control module based on the obstacle avoidance information of the current visual positioning and mapping submodule.

[0009] In some embodiments, each of the visual localization mapping submodules includes: The second transmission unit is communicatively connected to the detection radar and display device on the aircraft, and is used to acquire the environmental point cloud data detected by the detection radar and the target location data input by the user through the display device after the aircraft enters the intelligent driving mode. Storage unit, pre-stored with map data; The computing unit, communicatively connected to the second transmission unit and the storage unit, is used to acquire the environmental point cloud data, the target location data, and the map data, and to perform synchronous positioning and map building algorithm calculations based on the acquired data to generate the obstacle avoidance information; it is also used to generate waypoint instructions based on the obstacle avoidance information and send them to the second transmission unit. The second transmission unit is also configured to communicate with the flight control module and send the waypoint command to the flight control module and the display device.

[0010] In some embodiments, the flight multi-source sensing data includes inertial measurement data and target sensor data; the flight state information includes at least the aircraft's position information, attitude information, and external environment information in which the aircraft is located; The flight data calculation module includes: Multiple inertial measurement units (IMUs) are used to collect the inertial measurement data, which includes at least the angular velocity and acceleration data of the aircraft. The first transmission unit has multiple external interfaces that are communicatively connected to multiple target sensors on the aircraft. It is used to acquire target sensor data detected by the multiple target sensors, perform packet processing on the acquired target sensor data, and distribute the packetized data to each microcontroller unit through an internal bus. The target sensor data includes at least radio altimeter data, angle of attack sensor data, barometric altimeter data, real-time dynamic positioning data, magnetic heading data, and visual odometry data. The system includes multiple microcontroller units, each communicatively connected to the first transmission unit, the multiple inertial measurement units, and the flight control module. Each microcontroller unit acquires multiple sets of inertial measurement data detected by the multiple inertial measurement units, as well as target sensor data. It performs redundancy calculations and voting based on the multiple sets of inertial measurement data to determine target inertial data; and processes the target inertial data and the target sensor data to generate flight status information. The multiple microcontroller units are communicatively connected to exchange flight status information. Each microcontroller unit votes on multiple sets of flight status information and sends the voting results to other microcontroller units. The voting results are used to indicate whether each microcontroller unit has failed. If the master microcontroller unit has not failed, the master microcontroller unit sends the generated flight status information to the flight control module through the first transmission unit. The master microcontroller unit is one of the multiple microcontroller units.

[0011] In some embodiments, each of the microcontroller units is configured to: After each of the microcontroller units is powered on, a self-test operation and a level-triggered hardware synchronization operation are performed. The level-triggered hardware synchronization operation is used to synchronize the task timing of each of the microcontroller units. After each microcontroller unit passes its self-test and the task timing of each microcontroller unit is synchronized, the power-on count of each microcontroller unit is obtained. The main microcontroller unit is determined based on the number of power-on cycles of each of the microcontroller units; When the main microcontroller unit fails, it stops outputting signals, and another compliant microcontroller unit sends the generated flight status information to the flight control module.

[0012] In some embodiments, the flight control module includes: Multiple flight control units (FCUs) are configured to acquire flight status information, waypoint commands, and / or cockpit operation commands; perform control law calculations based on the flight status information and waypoint commands, or based on the flight status information and cockpit operation commands, and output corresponding actuator control signal candidate values; the multiple FCUs are configured to exchange the actuator control signal candidate values; each FCU is configured to vote on multiple sets of actuator control signal candidate values ​​and send the voting results to other FCUs; the voting results are used to indicate whether each FCU has failed; if the master FCU has not failed, the master FCU is configured to send the output actuator control signal candidate values ​​as the final actuator control signals to the corresponding actuators on the aircraft; the master FCU is one of the multiple FCUs. A backup flight control unit is communicatively connected to the multiple flight control units. When all multiple flight control units fail or cannot obtain the heartbeat data of the multiple flight control units, it acquires the flight status information and the cockpit operation commands, performs control law redundancy calculation and voting based on the flight status information and cockpit operation commands, outputs the corresponding actuator control signals, and sends them to the corresponding actuators on the aircraft.

[0013] In some embodiments, each of the flight control units is configured to: Each flight control unit performs a self-test after being powered on. After each flight control unit passes its self-test, the number of times each flight control unit is powered on is obtained. The main flight control unit is determined based on the number of times each of the flight control units is powered on; When the main flight control unit fails, it stops outputting signals, and another flight control unit that has not failed sends the candidate value of the actuator control signal as the final actuator control signal to the corresponding actuator on the aircraft.

[0014] In a second aspect, a flight control method is provided, applicable to the flight control system as described in the first aspect, the method comprising: When the flight status information and waypoint instructions are obtained, but no cockpit operation instructions are obtained, the control law redundancy calculation and voting are performed based on the flight status information and waypoint instructions to generate a first actuator control signal and send it to the corresponding actuator on the aircraft, driving each actuator to control the aircraft to fly according to the obstacle avoidance path; Upon receiving the cockpit operation command, the system performs control law redundancy calculation and voting based on the cockpit operation command, generates a second actuator control signal, and sends it to the corresponding actuator on the aircraft, driving each actuator to control the aircraft to fly according to the path corresponding to the cockpit operation command.

[0015] Thirdly, an aircraft is provided, including a flight control system as described in the first aspect.

[0016] The technical solutions provided in the embodiments of the present invention have at least the following technical effects or advantages: This invention provides a flight control system and method, as well as an aircraft. By configuring a flight data calculation module, an obstacle avoidance perception calculation module, and a flight control module, it achieves physical and logical dual isolation of the three core functions of aircraft flight status acquisition, obstacle avoidance path planning, and flight control. This effectively avoids cross-interference between functions and achieves precise isolation and prevention of fault propagation. After the aircraft enters intelligent flight mode, the dual-vision positioning and mapping submodule built into the obstacle avoidance perception calculation module can perform cross-validation on the obstacle avoidance information generated by each module. This allows for timely identification and elimination of data analysis biases in individual submodules, ensuring the reliability and accuracy of waypoint commands. The flight control module can complete flight control based on the acquired flight status information and waypoint commands. Even when the obstacle avoidance perception calculation module does not output waypoint commands, the flight control module can still operate normally according to cockpit operation commands, ensuring the pilot's basic control over the aircraft and further improving the system's fault tolerance. In addition, both the flight data calculation module and the flight control module adopt redundant computing and voting architectures, constructing a multi-level redundant protection system that can effectively avoid the risk of failure of their own computing units. The synergistic effect of the above technical solutions significantly improves the overall operational reliability of the system, fully meeting the high safety redundancy requirements of vertical takeoff and landing (VTOL) aircraft and providing a solid guarantee for their safe and stable flight in complex scenarios.

[0017] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This is a structural block diagram of a flight control system provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the circuit structure of an obstacle avoidance perception computing module provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the circuit structure of a flight data calculation module provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the circuit structure of a flight control module provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the circuit structure of a flight control system provided in an embodiment of the present invention; Figure 6 This is a flowchart of a flight control method provided in an embodiment of the present invention. Detailed Implementation

[0019] To better understand the above technical solutions, the following will describe the above technical solutions in detail with reference to the accompanying drawings and specific implementation methods. It should be understood that the embodiments of this disclosure and the specific features in the embodiments are detailed descriptions of the technical solutions of this application, rather than limitations on the technical solutions of this application. Unless otherwise specified, the embodiments of this application and the technical features in the embodiments can be combined with each other.

[0020] Figure 1 This is a structural block diagram of a flight control system provided in an embodiment of the present invention, such as... Figure 1 As shown, the flight control system 100 includes a flight data calculation module 10, an obstacle avoidance perception calculation module 20, and a flight control module 30.

[0021] The flight data calculation module 10 is used to acquire multi-source flight sensor data and perform redundancy calculations and voting based on the multi-source flight sensor data to generate flight status information. The flight status information is used to reflect the real-time motion status and environmental adaptation parameters of the aircraft. Among them, the environmental adaptation parameters are parameters that are strongly correlated with the external atmospheric environment and space environment in which the aircraft is located.

[0022] The obstacle avoidance perception and calculation module 20 includes two visual positioning and mapping sub-modules. Each visual positioning and mapping sub-module is used to acquire environmental point cloud data and target location data after the aircraft enters intelligent driving mode, and generate obstacle avoidance information based on the environmental point cloud data and target location data. The obstacle avoidance information includes at least an obstacle map and an obstacle avoidance path. The two visual positioning and mapping sub-modules are used to exchange obstacle avoidance information, and when the error between the two sets of obstacle avoidance information is within a set range, they generate waypoint instructions based on the obstacle avoidance information. Among them, the waypoint instructions are discrete flight instructions further generated by the visual positioning and mapping sub-modules after generating obstacle avoidance data based on environmental point cloud data and user-input target location data. The core is a set of instructions containing the coordinates of key nodes of the safe path from the current position to the target location (e.g., a point sequence of "coordinate A → coordinate B → coordinate C"), which is used by the flight control module to receive and drive the actuators to control the aircraft to fly safely along the preset obstacle avoidance path.

[0023] The flight control module 30 is communicatively connected to the flight data calculation module 10, the obstacle avoidance perception calculation module 20, and the cockpit operating system 200 of the aircraft. It is used to acquire flight status information, waypoint instructions, and / or cockpit operation instructions. Based on the flight status information and waypoint instructions, or based on the flight status information and cockpit operation instructions, it performs control law redundancy calculation and voting, outputs corresponding actuator control signals and sends them to the corresponding actuators on the aircraft, and drives each actuator to control the aircraft to fly according to the obstacle avoidance path or the pilot control path.

[0024] Among them, the control law is the core algorithm rule of the flight control system. Simply put, it is the mathematical logic and decision-making criterion of how the aircraft adjusts its own state according to the input signal. In essence, it is the calculation rule of converting the deviation between the target state (such as the predetermined waypoint and attitude) and the actual state (such as the current position and attitude) into the control signal of the actuator (such as the servo motor). This is common knowledge in this field and will not be elaborated here.

[0025] This invention achieves physical and logical dual isolation of the three core functions of aircraft flight status acquisition, obstacle avoidance path planning, and flight control by configuring a flight data calculation module, an obstacle avoidance perception calculation module, and a flight control module. This effectively avoids cross-interference between functions and achieves precise isolation and prevention of fault propagation. After the aircraft enters intelligent flight mode, the dual-vision positioning and mapping submodule built into the obstacle avoidance perception calculation module can perform cross-validation on the obstacle avoidance information generated by each module. This can promptly identify and eliminate data analysis biases of individual submodules, ensuring the reliability and accuracy of waypoint commands. The flight control module can complete autonomous flight control based on the acquired flight status information and waypoint commands. When the obstacle avoidance perception calculation module does not output waypoint commands, the flight control module can still operate normally according to cockpit operation commands, ensuring the pilot's basic control over the aircraft and further improving the system's fault tolerance. In addition, both the flight data calculation module and the flight control module adopt redundant computing and voting architectures to build a multi-level redundant protection system, which can effectively avoid the risk of failure of their own computing units. The synergistic effect of the above technical solutions significantly improves the overall operational reliability of the system, fully meets the technical requirements of vertical takeoff and landing (VTOL) aircraft for high safety redundancy, solves the technical pain points of control systems being susceptible to interference and single-point failures easily causing safety risks in complex flight scenarios, and provides a solid guarantee for its safe and stable flight in scenarios such as urban air traffic and low-altitude complex terrain operations.

[0026] In some embodiments, the obstacle avoidance perception calculation module 20 is further configured to: generate an alarm command and send it to the flight control module when the error between the two sets of obstacle avoidance information is outside a set range; the alarm command is used to indicate that the obstacle avoidance perception calculation module has failed and intelligent driving is unavailable.

[0027] The flight control module 30 is also used to: if it receives an alarm command and a cockpit operation command, output the corresponding actuator control signal based on the cockpit operation command and send it to the corresponding actuator on the aircraft, so as to drive each actuator to control the aircraft to fly according to the pilot's control path.

[0028] The above implementation not only enables rapid identification and alarm of the fault status of the obstacle avoidance perception and computing module, but also avoids the system falling into an uncontrolled or miscontrolled state after the intelligent driving mode fails by switching the priority of control, further enhancing the system's emergency response capability and providing reliable protection for the flight safety of the aircraft in complex environments.

[0029] In some embodiments, the two visual localization and mapping submodules are communicatively connected, and each visual localization and mapping submodule is configured as follows: The obstacle avoidance information and power-on count of the current visual positioning and mapping submodule are sent to another visual positioning and mapping submodule, and the obstacle avoidance information and power-on count sent by the other visual positioning and mapping submodule are received. If the error between the obstacle avoidance information of the current visual positioning and mapping submodule and the obstacle avoidance information of another visual positioning and mapping submodule is within a set range, the main visual positioning and mapping submodule is determined based on the number of times the current visual positioning and mapping submodule is powered on and the number of times the other visual positioning and mapping submodule is powered on. The main visual positioning and mapping submodule is one of the current visual positioning and mapping submodule or the other visual positioning and mapping submodule. If the current visual positioning and mapping submodule is the primary visual positioning and mapping submodule, then based on the obstacle avoidance information of the current visual positioning and mapping submodule, waypoint commands are generated and sent to the flight control module.

[0030] The above embodiments enable the dual-vision positioning and mapping submodules to exchange obstacle avoidance information and power-on counts. Based on the consistency verification of obstacle avoidance information, the master-slave roles are clearly defined according to the power-on count. This avoids command conflicts caused by both modules simultaneously outputting waypoint commands, ensuring that the waypoint commands received by the flight control module have a unique source and consistent logic. Furthermore, the master-slave allocation rule based on the power-on count allows for task load rotation between the two modules, preventing a single module from bearing the waypoint command generation task for an extended period and accelerating hardware wear, effectively extending the lifespan of the vision positioning and mapping submodules. Simultaneously, the dynamic determination mechanism of master-slave roles eliminates the need for an additional master node selection controller; role division is completed solely through data interaction between modules, simplifying system architecture design, reducing hardware costs and failure probability, and further improving the operational stability and reliability of the obstacle avoidance perception calculation module in intelligent driving mode.

[0031] In one implementation, the main visual positioning and mapping submodule, which determines the number of power-on cycles, may include: Calculate the results of taking the remainder of 2 for the power-on times of the two visual positioning and mapping sub-modules respectively. If N1 / 2 = 1 and N2 / 2 = 0, determine that the current visual positioning and mapping sub-module is the main visual positioning and mapping sub-module; if N1 / 2 = 0 and N2 / 2 = 1, determine that the other visual positioning and mapping sub-module is the main visual positioning and mapping sub-module; if the remainders of N1 / 2 and N2 / 2 are the same, by default, the sub-module with a lower number is the main visual positioning and mapping sub-module. Here, N1 is the power-on time of the current visual positioning and mapping sub-module, and N2 is the power-on time of the other visual positioning and mapping sub-module.

[0032] In another implementation, determining the main visual positioning and mapping sub-module based on the power-on time may further include: If N1 > N2, determine that the current visual positioning and mapping sub-module is the main visual positioning and mapping sub-module; if N1 < N2, determine that the other visual positioning and mapping sub-module is the main visual positioning and mapping sub-module; if N1 = N2, by default, the current visual positioning and mapping sub-module is the main visual positioning and mapping sub-module.

[0033] In other implementations, the power-on time may also be used as an equivalent indicator of the cumulative operation duration, and the sub-module with fewer power-on times is selected as the main module to achieve load balancing rotation of the dual modules. The embodiments of the present invention do not limit this.

[0034] It should be noted that if the error between the obstacle avoidance information of the current visual positioning and mapping sub-module and the obstacle avoidance information of the other visual positioning and mapping sub-module is outside the set range, it means that at least one of the visual positioning and mapping sub-modules has abnormal data acquisition, algorithm operation deviation or hardware failure, and the generated obstacle avoidance information is not reliable and cannot support the safe flight path planning in the intelligent driving mode. At this time, the two visual positioning and mapping sub-modules will stop the waypoint instruction generation process, and the obstacle avoidance perception calculation module will uniformly generate an alarm instruction and send it to the flight control module 30, clearly informing the system that the obstacle avoidance perception function fails and the intelligent driving mode is unavailable, ensuring that the flight control module 30 promptly switches to the cockpit operation instruction response mode to avoid generating dangerous flight instructions based on incorrect obstacle avoidance information and guarantee the safety of aircraft control.

[0035] In some embodiments, each visual positioning and mapping sub-module in the obstacle avoidance perception calculation module 20 includes a second transmission unit 21, a storage unit 22 and an operation unit 23.

[0036] The second transmission unit 21 is communicatively connected to the detection radar and the display device on the aircraft, and is used to obtain the environmental point cloud data detected by the detection radar and the target location data input by the user through the display device after the aircraft enters the intelligent driving mode.

[0037] Storage unit 22 pre-stores map data. The processing unit 23 is communicatively connected to the second transmission unit 21 and the storage unit 22, and is used to acquire environmental point cloud data, target location data, and map data. Based on the acquired data, it performs synchronous positioning and map building algorithm calculations to generate obstacle avoidance information; it is also used to generate waypoint commands based on the obstacle avoidance information and send them to the second transmission unit 21. The second transmission unit 21 is communicatively connected to the flight control module 30, and is used to send waypoint commands to the flight control module 30 and the display device 300.

[0038] The two visual positioning and mapping sub-modules have bidirectionally interconnected second transmission units 21, enabling the interactive transmission of obstacle avoidance information and power-on counts between the two sub-modules. The second transmission unit 21 can also synchronously feed back obstacle avoidance information and waypoint commands to the display device 300, allowing users to view the aircraft's obstacle avoidance path planning status in real time. The storage unit 22 pre-stores high-precision electronic map data of the aircraft's operating area, including terrain elevation information, no-fly zone coordinates, and obstacle distribution baseline data. It also supports real-time caching of environmental point cloud data and target location data received by the second transmission unit 21, as well as obstacle avoidance information calculated by the computing unit 23, providing data support for subsequent data comparison and algorithm iteration. The computing unit 23 of each visual positioning and mapping submodule is also used to perform error analysis and consistency verification on the obstacle avoidance information of itself and another submodule. When the error of the two sets of obstacle avoidance information is within a set range, the master-slave role determination is completed based on the number of power-on cycles. If the current visual positioning and mapping submodule is determined to be the master visual positioning and mapping submodule, the computing unit 23 further generates discrete waypoint instructions based on the obstacle avoidance information it generates and sends them to the second transmission unit 21.

[0039] It should be noted that the Simultaneous Localization and Mapping (SLAM) algorithm is mainly designed to accurately determine the current three-dimensional spatial position of the aircraft by fusing real-time acquired environmental point cloud data with high-precision reference map data pre-stored in storage unit 22, and updating dynamic obstacle information in the environment. Ultimately, it generates obstacle avoidance information including a three-dimensional coordinate map of obstacles and the optimal obstacle avoidance path. This is a conventional algorithm in this field and will not be elaborated further.

[0040] Figure 2 This is a circuit structure diagram of an obstacle avoidance perception calculation module provided in an embodiment of the present invention, as shown below. Figure 2 As shown, the obstacle avoidance perception computing module 20 includes two visual positioning and mapping sub-modules (i.e. Figure 2 In QSLAM1 and QSLAM2), each visual localization and mapping submodule includes a second transmission unit 21 (i.e., Figure 2 The IO (Input / Output) board and storage unit 22 (i.e., the corresponding Figure 2The planning map storage unit and the operation unit 23 (i.e., the corresponding) Figure 2 The NPU (Neural Processing Unit) unit in the system.

[0041] The IO board enables bidirectional transmission of multiple types of data: on one hand, it receives environmental point cloud information collected by detection radars such as downward-looking LiDAR and forward-looking LiDAR, as well as target point data input from the display device; on the other hand, it is responsible for exchanging obstacle avoidance path information between QSLAM1 and QSLAM2, and simultaneously sends the final generated waypoint command to the flight control unit 30 (i.e., Figure 2 (FCU1 / FCU2 / FCU3 in the system). The IO board can also communicate with the intelligent driving disconnect switch to obtain its status. When the intelligent driving disconnect switch is not closed, it indicates that the aircraft has entered intelligent driving mode. The NPU (Non-Standard Processing Unit) is the core computing carrier of the obstacle avoidance perception computing module. It can read pre-stored map data from the SLAM map storage unit (i.e., the planning map storage), combine it with the environmental point cloud information and target point data transmitted by the IO board, execute SLAM algorithm calculations, and generate obstacle avoidance information including obstacle maps and obstacle avoidance paths. It can also perform obstacle avoidance information error verification between QSLAM1 and QSLAM2, master-slave role determination based on the number of power-on cycles, and waypoint command generation tasks.

[0042] In some embodiments, such as Figure 2 As shown, each visual localization mapping submodule (corresponding to) Figure 2 The QSLAM1 and QSLAM2 modules are also equipped with redundant power supplies A and B to achieve power supply redundancy and ensure that the modules can still operate stably when a single power supply fails.

[0043] In some embodiments, the flight data calculation module 10 acquires multi-source flight sensor data including inertial measurement data and target sensor data. The inertial measurement data consists of three-axis angular velocity and three-axis acceleration data of the aircraft body relative to the inertial frame, acquired by the inertial measurement unit on the aircraft. The target sensor data is based on data detected by target sensors on the aircraft. These target sensors include at least: a radio altimeter, an angle-of-attack sensor, a barometric altimeter, a real-time dynamic positioning module, a magnetic heading sensor, and a visual odometry, etc. The corresponding target sensor data may include at least radio altimeter data, angle-of-attack sensor data, barometric altimeter data, real-time dynamic positioning data, magnetic heading data, and visual odometry data, etc.

[0044] The flight status information output by the flight data calculation module 10 includes at least the aircraft's position information, attitude information, and external environment information. The aircraft's position information can include its three-dimensional spatial coordinates (longitude, latitude, altitude), vertical height relative to the ground, horizontal displacement, and velocity vector, which can be calculated by fusing real-time dynamic positioning data, radio altimeter data, and barometric altimeter data. Attitude information can include the aircraft's pitch angle, roll angle, heading angle (Euler angle), and motion parameters such as angular velocity and acceleration, which can be calculated based on angular velocity and acceleration data acquired by the inertial measurement unit, combined with data from the magnetic heading sensor after calibration. The external environment information can include environmental parameters highly relevant to flight safety, such as atmospheric pressure, air density, wind speed, and wind direction, which can be derived by fusing environmental characteristic data from the barometric altimeter, angle-of-attack sensor, and visual odometry, providing an environmental adaptation basis for aircraft mode switching and power adjustment.

[0045] In some embodiments, such as Figure 1 As shown, the flight data calculation module 10 includes multiple inertial measurement units 11, a first transmission unit 12, and multiple microcontroller units 13.

[0046] Each inertial measurement unit 11 is used to collect inertial measurement data, which includes at least the angular velocity and acceleration data of the aircraft.

[0047] The first transmission unit 12 has multiple external interfaces that are connected to multiple target sensors on the aircraft. These interfaces are used to acquire target sensor data detected by the multiple target sensors, process the acquired target sensor data into packets, and distribute the packetized data to each microcontroller unit via an internal bus. The target sensor data includes at least radio altimeter data, angle of attack sensor data, barometric altimeter data, real-time dynamic positioning data, magnetic heading data, and visual odometry data.

[0048] Each microcontroller unit 13 is communicatively connected to the first transmission unit 12, multiple inertial measurement units 11, and the flight control module 30. The microcontroller unit 13 is used to acquire multiple sets of inertial measurement data detected by multiple inertial measurement units and target sensor data, and to perform redundancy calculations and voting based on the multiple sets of inertial measurement data to determine the target inertial data; and to solve the target inertial data and target sensor data to generate flight status information.

[0049] Multiple microcontroller units 13 are connected for communication to exchange flight status information. Each microcontroller unit 13 is used to vote on multiple sets of flight status information and send the voting results to other microcontroller units. The voting results are used to indicate whether each microcontroller unit has failed. If the main microcontroller unit has not failed, the main microcontroller unit is used to send the generated flight status information to the flight control module through the first transmission unit. The main microcontroller unit is one of the multiple microcontroller units.

[0050] By setting up multiple inertial measurement units 11 and multiple microcontroller units 13, a two-tiered redundancy protection system can be constructed: the first tier uses data redundancy of multiple inertial measurement units 11, combined with redundancy calculations and voting to eliminate abnormal data from a single inertial measurement unit, ensuring the basic reliability of the target inertial data; the second tier uses parallel calculations of multiple microcontroller units 13 and interactive voting based on flight status information to achieve accurate identification and isolation of faults in the microcontroller units themselves, preventing the failure of a single microcontroller unit from paralyzing the flight data calculation function. Simultaneously, the centralized data acquisition and distribution design of the first transmission unit 12 ensures the uniformity and efficiency of target sensor data transmission, providing synchronous data support for the parallel calculations of multiple microcontroller units 13, thus comprehensively improving the fault resistance, operational stability, and data output reliability of the flight data calculation module, laying a solid data foundation for the precise control of the subsequent flight control module.

[0051] For example, the flight data calculation module 10 includes four inertial measurement units 11, and the microcontroller unit 13 performs redundancy calculations and voting based on multiple sets of inertial measurement data as follows: Determine the difference between each set of inertial measurement data and several other sets of inertial measurement data; if the difference between a set of inertial measurement data and other inertial measurement data exceeds the set difference range, i.e. outside the set range, determine that the inertial measurement data is invalid and discard the inertial measurement data, and mark the inertial measurement unit 11 corresponding to the inertial measurement data as invalid; determine that the median or mean of the remaining valid inertial measurement data is the target inertial data, and use the median's anti-extreme interference characteristics to ensure data reliability.

[0052] For example, the microcontroller unit 13 can perform attitude and inertial navigation calculations based on target inertial data. For instance, by combining a quaternion attitude calculation algorithm with a Kalman filter algorithm, drift errors in the inertial data integration process can be eliminated, and basic attitude data such as pitch angle, roll angle, and heading angle of the aircraft can be initially obtained. Then, the heading angle can be calibrated again using magnetic heading data to finally generate accurate attitude information. Secondly, specific calculations can be performed based on signals from peripheral target sensors: atmospheric data calculations can be performed by combining barometric altimeter data to derive parameters such as atmospheric pressure and air density. The system performs altitude calculations by fusing radio altimeter data and barometric altimeter data to determine the aircraft's absolute altitude and vertical altitude relative to the ground. It also incorporates real-time dynamic positioning data to assist in inertial navigation calculations, accurately outputting the aircraft's three-dimensional spatial coordinates (longitude, latitude, altitude) and other positional information. Finally, it integrates angle-of-attack sensor data with environmental feature data collected by visual odometry to obtain external environmental parameters such as wind speed and direction. Ultimately, it integrates attitude information, position information, atmospheric data, altitude data, and external environmental parameters to generate flight status information.

[0053] For example, the microcontroller unit 13 can vote on multiple sets of flight status information in the following manner: Each microcontroller unit 13 synchronizes its generated flight status information to other microcontroller units 13 via a communication link. For each core parameter dimension of the flight status information, a corresponding voting threshold is preset. Subsequently, each microcontroller unit performs consistency verification on the same dimension parameters in all synchronized flight status information, counting the number of information groups whose parameter differences are within the voting threshold. If the flight status information generated by a microcontroller unit 13 satisfies the requirement that the parameter differences with the corresponding parameters of a set number (e.g., more than half) of the microcontroller units are within the voting threshold in all core parameter dimensions, then the microcontroller unit 13 is considered to be in normal condition (not failed). If the flight status information of a microcontroller unit 13 has multiple core parameter dimensions whose parameter differences with the corresponding parameters of a set number (e.g., more than half) of the microcontroller units exceed the voting threshold, then the microcontroller unit 13 is considered to be failed. After all microcontroller units 13 complete the voting, the voting results are synchronized, and finally, the main microcontroller unit that has not failed sends its generated flight status information to the flight control module 30.

[0054] Figure 3 This is a circuit structure diagram of a flight data calculation module provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the flight data calculation module 10 includes four inertial measurement units 11 (i.e., Figure 3 The three microcontroller units 13 (i.e., mems1, mems2, mems3, mems4) and mems4 are also included. Figure 3The three MCUs (MCU1, MCU2, and MCU3) exchange self-test results and flight status information internally via the CCDL (Control Channel Data Link) bus, enabling synchronous communication and data interaction among multiple units. Four MEMS inertial measurement units (IMUs) are connected to the three MCUs respectively via the CCDL bus, synchronously transmitting collected inertial measurement data to each MCU, providing common data support for each MCU to independently perform redundancy calculations and voting. Simultaneously, the flight data calculation module 10 is also equipped with a first transmission unit 12 (i.e.,... Figure 3 The I / O expansion chip houses an FPGA (Field-Programmable Gate Array) or a high-performance MCU. This chip communicates with multiple target sensors on the aircraft via a CAN bus (Controller Area Network) to centrally acquire data from the radio altimeter (RA), angle-of-attack sensor (AOA), and barometric altimeter (i.e.,...). Figure 2 The barometer), real-time dynamic positioning module (RTK), magnetic heading sensor (i.e. Figure 2 Data from target sensors such as the magnetic compass and visual odometry (VIO) are packaged and processed before being distributed to three MCUs via an internal bus. At the same time, the IO expansion chip is also connected to the flight control module 30 to receive flight status information sent by the main MCU and forward it to the flight control module 30, thereby realizing centralized data transmission and distribution.

[0055] In some embodiments, such as Figure 2 As shown, the flight data calculation module 10 is also equipped with power supply A and power supply B to achieve power supply redundancy and ensure that the module can still operate stably when a single power supply fails.

[0056] In some embodiments, each microcontroller unit 13 is configured to: After each microcontroller unit 13 is powered on, a self-test and a level-triggered hardware synchronization operation are performed. The level-triggered hardware synchronization operation is used to synchronize the task timing of each microcontroller unit 13. After each microcontroller unit 13 passes the self-test and the task timing of each microcontroller unit 13 is synchronized, the power-on count of each microcontroller unit 13 is obtained. The master microcontroller unit is determined based on the power-on count of each microcontroller unit 13. When the master microcontroller unit fails, the master microcontroller unit stops outputting signals, and another unfailed microcontroller unit sends the generated flight status information to the flight control module.

[0057] By performing a self-test and level-triggered hardware synchronization operation after power-on, hardware faults in the microcontroller unit 13 can be detected in advance, preventing faulty units from participating in data calculation and voting, which could lead to erroneous outputs. Furthermore, the level-triggered hardware synchronization ensures strict consistency in the task timing of each microcontroller unit 13, guaranteeing the synchronous acquisition and parallel calculation of inertial measurement data and target sensor data by multiple microcontroller units 13. This improves the homogeneity and consistency of multiple sets of flight status information at the timing level, laying the foundation for the accuracy of subsequent voting. The method of determining the master microcontroller unit based on the number of power-on cycles eliminates the need for an additional master-slave decision controller, simplifying the system architecture design. Simultaneously, the automatic switching mechanism after the master microcontroller unit fails achieves seamless connection of flight status information output, avoiding data transmission interruptions caused by master unit failure. This further enhances the redundancy and fault tolerance of the flight data calculation module 10, ensuring the continuity and reliability of data supply to the flight control module 30, and meeting the high requirements for data real-time performance and stability during aircraft flight.

[0058] For example, after power-on, each microcontroller unit 13 performs a self-test and determines whether it has failed based on the self-test results. Simultaneously, each microcontroller unit 13 interacts with other microcontroller units 13 to determine whether other microcontroller units 13 have failed. The self-test operations include at least random access memory self-test, read-only memory self-test, and runtime self-test.

[0059] For example, if the self-test results determine that the microcontroller unit 13 is not faulty, a level-triggered hardware synchronization operation can be performed after acquiring multiple sets of inertial measurement data and target sensor data and before generating flight status information, so that the task timing of the microcontroller unit 13 is synchronized with that of other microcontroller units 13. The level-triggered hardware synchronization operation specifically includes: MCU1, MCU2, and MCU3 establish a connection with each other via hardwires. When each MCU reaches the synchronization task node, it first pulls the hardwire level high through its own GPIO (General Purpose Input / Output) interface, then reads the hardwire level status of the other two MCUs in real time, and enters a waiting program. If the hardwire levels of all three MCUs are detected to be high within a preset time, it indicates that each MCU has reached the synchronization node. At this time, each MCU pulls its own hardwire level low through the GPIO interface. After the hardwire level of the other two MCUs is detected to be low, the task timing synchronization is completed, and each MCU can enter the subsequent redundancy calculation and flight status information calculation process. If the level of the hardwire is not detected to be high or low within the specified time, the synchronization is determined to have failed, and the synchronization operation is re-executed or a synchronization abnormality alarm is triggered.

[0060] For example, determining the main microcontroller unit based on the power-on count of each microcontroller unit 13 can be achieved in the following way: Using the rule of dividing the power-on count by 3 and taking the remainder, first obtain the cumulative power-on count of the three microcontroller units 13 (MCU1, MCU2, MCU3), calculate the remainder after dividing this power-on count by 3 (denoted as R, where R can take values ​​of 0, 1, or 2), and allocate the branch role of each MCU according to the remainder result. The main microcontroller unit corresponds to the instruction branch. The specific allocation rule is as follows: when the remainder R = 0, MCU1... As the command branch (main microcontroller unit), MCU1 is responsible for outputting flight status information to the flight control module 30; MCU2, as the monitoring branch, is responsible for real-time monitoring of the operation status and data output of the command branch; MCU3, as the backup branch, is in standby mode. When the remainder R=1, MCU1 acts as the backup branch, MCU2 as the command branch (main microcontroller unit), and MCU3 as the monitoring branch; when the remainder R=2, MCU1 acts as the monitoring branch, MCU2 as the backup branch, and MCU3 as the command branch (main microcontroller unit). This method allows for dynamic allocation of the main microcontroller unit based on the number of power-on cycles, while clearly defining the roles of the monitoring and backup branches, providing a role basis for seamless switching in the event of a main microcontroller unit failure.

[0061] In some embodiments, such as Figure 1 As shown, the flight control module 30 includes: Multiple flight control units 31 are provided. Each flight control unit 31 is used to acquire flight status information, waypoint instructions, and / or cockpit operation instructions. Based on the flight status information and waypoint instructions, or based on the flight status information and cockpit operation instructions, it performs control law calculations and outputs corresponding actuator control signal candidate values. The multiple flight control units 31 are used to exchange actuator control signal candidate values. Each flight control unit 31 is used to vote on multiple sets of actuator control signal candidate values ​​and send the voting results to other flight control units 31. The voting results are used to indicate whether each flight control unit 31 has failed. If the master flight control unit has not failed, the master flight control unit is used to send the output actuator control signal candidate values ​​as the final actuator control signals to the corresponding actuators on the aircraft. The master flight control unit is one of the multiple flight control units 31.

[0062] The backup flight control unit 32 is connected to multiple flight control units 31. When multiple flight control units 31 fail or cannot obtain heartbeat data from multiple flight control units 31, it acquires flight status information and cockpit operation commands, performs control law redundancy calculation and voting based on the flight status information and cockpit operation commands, outputs corresponding actuator control signals and sends them to the corresponding actuators on the aircraft.

[0063] By setting up multiple flight control units 31, a core redundancy protection system at the flight control level can be constructed. On the one hand, multiple flight control units 31 perform control law calculations in parallel. By exchanging candidate values ​​of actuator control signals and conducting voting, the failure state of one or more flight control units 31 can be identified, avoiding flight risks caused by the output of erroneous control signals by failed units and ensuring the reliability of actuator control signals. On the other hand, the setting of the main flight control unit clarifies the main body of the control signal output. Combined with the failure voting mechanism, it can realize rapid switching after the failure of the main flight control unit (with other unfailed flight control units taking over the output), ensuring the continuity of control signal output and adapting to the high requirements of real-time and accuracy of control commands during aircraft flight. At the same time, the parallel calculation and voting mechanism also provide a basis for cross-verification of control law calculation results, further improving the robustness of flight control logic. By setting up a backup flight control unit 32, an ultimate emergency protection line for flight control can be constructed: when multiple core flight control units 31 fail or extreme failure scenarios such as heartbeat loss occur, the backup flight control unit 32 can quickly take over the flight control task, independently complete the control law redundancy calculation and voting based on flight status information and cockpit operation commands, and output effective actuator control signals, avoiding complete paralysis of flight control functions. This dual-layer architecture design of core redundancy and emergency backup significantly improves the fault tolerance limit and resistance to extreme failures of the flight control module, further ensuring the flight safety of the aircraft, especially suitable for flight requirements in high-risk scenarios such as low-altitude flight and complex terrain operations.

[0064] In some embodiments, each flight control unit 31 is configured as follows: After each flight control unit 31 is powered on, a self-test is performed. After each flight control unit 31 passes the self-test, the number of times each flight control unit 31 is powered on is obtained. The main flight control unit is determined based on the number of times each flight control unit 31 is powered on. When the main flight control unit fails, the main flight control unit stops outputting signals, and another flight control unit 31 that has not failed sends the candidate value of the output actuator control signal as the final actuator control signal to the corresponding actuator on the aircraft.

[0065] For example, the multiple flight control units 31 include at least a primary flight control unit, a secondary flight control unit, and a monitoring flight control unit. When the primary flight control unit fails, the secondary flight control unit can send the output actuator control signal candidate values ​​as the final actuator control signals to the corresponding actuators on the aircraft. When both the primary and secondary flight control units fail, the monitoring flight control unit can send the output actuator control signal candidate values ​​as the final actuator control signals to the corresponding actuators on the aircraft.

[0066] For example, after each flight control unit 31 is powered on, it performs a self-test and determines whether it has failed based on the self-test results. Simultaneously, each flight control unit 31 can exchange self-test results with other flight control units 31 via the CCDL bus to determine whether other flight control units 31 have failed. The self-test operation includes at least an arithmetic logic self-test, a random access memory self-test, and a read-only memory self-test.

[0067] For example, the flight control module 30 includes three flight control units 31, namely FCU1, FCU2, and FCU3. The main flight control unit can be determined based on the number of power-on cycles of each flight control unit 31 in the following way: Flight control module 30 includes three flight control units 31 (i.e. Figure 4 The system consists of three flight control units (FCU1, FCU2, and FCU3) and a backup flight control unit (BFCU). FCU1, FCU2, and FCU3 can exchange their stored power-on counts via the CCDL bus. After the exchange, the maximum value among the three is taken as the common power-on count (i.e., the system's unified power-on count), and this common power-on count is stored in the ROM of each FCU as a criterion. Then, the primary and secondary roles of the FCUs are assigned using the remainder after dividing the power-on count by 3. Let R be the remainder after dividing the common power-on count by 3 (R can be 0, 1, or 2). The specific allocation rules are as follows: When R=0, FCU1 is the primary flight control unit, responsible for outputting the final control command; FCU2 is the secondary flight control unit; and FCU3 is the monitoring flight control unit. When R=1, FCU2 is the primary flight control unit, FCU1 is the secondary flight control unit, and FCU3 is the monitoring flight control unit. When R=2, FCU3 is the primary flight control unit, FCU1 is the secondary flight control unit, and FCU2 is the monitoring flight control unit. The secondary flight control unit and the monitoring flight control unit synchronously receive various types of data and perform calculations and voting. However, the secondary flight control unit only has the authority to output commands when the primary flight control unit fails, and the monitoring flight control unit only has the authority to output commands when both the primary and secondary flight control units fail.

[0068] After the primary and secondary role allocation rules are determined, FCU1, FCU2, and FCU3 interact via the CCDL bus to check their status and confirm the primary and secondary role allocation results; after BFCU completes its self-check, it enters the standby state and continuously monitors the operating status and heartbeat data of the three FCUs via the CCDL bus.

[0069] Figure 4 This is a circuit structure diagram of a flight control module provided in an embodiment of the present invention, as shown below. Figure 4 As shown, the flight control module 30 includes three flight control units 31 (i.e., Figure 4 The FCU1, FCU2, and FCU3 are included, along with a backup flight control unit 32 (i.e., Figure 4The BFCU in the text. Each flight control unit (FCU) employs a triple-redundant heterogeneous design, housing three heterogeneous MCU core boards (i.e., corresponding to...). Figure 4 The three instruction branches in the middle) and an independent power supply board (i.e., the corresponding Figure 4 The FCU utilizes three dedicated power supplies (three for instruction control) to provide redundant protection for core computation and power supply. The three MCU core boards within the FCU are connected via hardwired connections and a CCDL bus to achieve synchronous communication and data exchange, ensuring consistent task timing across all core boards. Simultaneously, each MCU core board communicates with the I / O instruction board via an independent bus, enabling it to independently receive external data such as flight status information from the flight data calculation module, cockpit operation commands, and waypoint commands from the obstacle avoidance perception calculation module.

[0070] During operation, the three MCU core boards within the FCU independently perform control law calculations and voting calculations based on received external data, obtaining their respective candidate values ​​for actuator control signals. After the calculations are completed, the three MCU core boards conduct internal voting, combining the number of power-on cycles to determine the final actuator control signal from the valid candidate values. Subsequently, FCU1, FCU2, and FCU3 further exchange their respective output actuator control signals and complete inter-unit voting. Finally, the main flight control unit sends the final valid actuator control signal to the corresponding actuator of the aircraft (i.e., the actuator control signal) via the triple-redundant bus. Figure 4 (Electric drives and servos in the system). The backup flight control unit (BFCU) maintains communication with FCU1, FCU2, and FCU3, and monitors the operating status and heartbeat data of each FCU in real time. When it is detected that FCU1, FCU2, and FCU3 have all failed or lost their heartbeats, the emergency takeover process is immediately initiated, and the BFCU independently completes the control law redundancy calculation and voting and outputs control signals.

[0071] Figure 5 This is a schematic diagram of the circuit structure of a flight control system provided in an embodiment of the present invention. The following is in conjunction with... Figure 5 Here's a brief explanation of how the Flight Control System 100 works: After the system is powered on, the three flight control units (FCU1, FCU2, FCU3) and the backup flight control unit (BFCU) in the flight control module synchronously start self-tests. The three heterogeneous MCU core boards inside a single FCU first complete the self-test. After passing the self-test, they achieve internal synchronization through hard wiring and CCDL bus, exchange and unify the number of power-on times (the maximum value of the number of power-on times stored in each branch is stored in its respective ROM), and then assign the roles of internal branches (command branch, monitoring branch, backup branch) based on the rule of dividing the number of power-on times by 3 and taking the remainder.

[0072] During flight, the flight data calculation module 10 transmits the calculated flight status information (including position, attitude, and environmental information) and the obstacle avoidance perception calculation module 20 transmits the generated waypoint commands, along with cockpit operation commands, synchronously to the three FCUs via the bus and I / O command board. Each FCU's internal command branch independently performs control law calculations based on the received data, outputting candidate values ​​for actuator control signals. These candidate values ​​are then voted on by the three internal MCU core boards to determine the valid command signal for each FCU. Subsequently, the three FCUs exchange valid command signals and complete the voting process. Finally, the main FCU sends the final actuator control signal to the corresponding actuator via the triple-redundant bus, achieving precise control of the aircraft.

[0073] Based on the same inventive concept, this invention also provides a flight control method applicable to the flight control system described in the above embodiments. Figure 6 This is a flowchart of a flight control method provided in an embodiment of the present invention, such as... Figure 6 As shown, this method can be executed by the flight control module 30, specifically by each flight control unit 31 within the flight control module 30. The method specifically includes: Step S610: When flight status information and waypoint instructions are obtained, but cockpit operation instructions are not obtained, control law redundancy calculation and voting are performed based on flight status information and waypoint instructions to generate the first actuator control signal and send it to the corresponding actuator on the aircraft to drive each actuator to control the aircraft to fly according to the obstacle avoidance path.

[0074] Flight status information and waypoint commands can be obtained through the flight data calculation module 10 and the obstacle avoidance perception calculation module 20, respectively, while cockpit operation commands can be obtained through the cockpit operating system 200. Each flight control unit 31 establishes a stable communication link with the above modules through the system's internal IO command board to achieve synchronous data reception. The control law redundancy calculation is specifically executed in parallel and independently by three sets of heterogeneous MCU core boards within each flight control unit 31. Each core board outputs the corresponding first actuator control signal candidate value based on the same flight status information and waypoint commands. Subsequently, the three core boards exchange candidate values ​​through the CCDL bus and complete internal voting to select the valid signal. Afterward, each flight control unit 31 further interacts with its own valid signals and conducts inter-unit voting. Finally, the main flight control unit sends the voted first actuator control signal to the actuator through the triple redundancy bus to ensure the accuracy and reliability of automatic obstacle avoidance flight.

[0075] Step S620: When the cockpit operation command is obtained, the control law redundancy calculation and voting are performed based on the cockpit operation command to generate the second actuator control signal and send it to the corresponding actuator on the aircraft to drive each actuator to control the aircraft to fly according to the path corresponding to the cockpit operation command.

[0076] The cockpit operation commands are generated by the cockpit operating system 200 and transmitted to the IO command board of the flight control module 30 via the CAN bus. The IO command board then distributes the commands to each flight control unit 31. When performing calculations, each flight control unit 31 needs to simultaneously combine the real-time flight status information (such as attitude and position data) output by the flight data calculation module 10 to ensure that the control commands match the current state of the aircraft. The calculation process also adopts a redundant architecture, with three sets of internal heterogeneous MCU core boards independently outputting candidate values ​​for the second actuator control signals. After internal voting and inter-unit voting, the main flight control unit outputs the final second actuator control signal, giving priority to responding to manual control commands and ensuring the timeliness and accuracy of human-machine interaction.

[0077] It should be noted that steps S610 and S620 can be executed synchronously by each flight control unit. The synchronous execution mechanism enables rapid switching between the two control logics. When a cockpit operation command is detected, the system can immediately terminate the execution of step S610 and prioritize the execution of step S620, thereby improving control response efficiency.

[0078] In some embodiments, the flight control unit includes multiple flight control units 30. Before executing steps S610 and S620, the multiple flight control units 30 may also perform self-test operations and related processes for determining the master flight control unit based on the number of power-on cycles of each flight control unit. The specific implementation of the above steps by each flight control unit can be found in the relevant description of the flight control system described above, and will not be repeated here.

[0079] Based on the same inventive concept, embodiments of the present invention also provide an aircraft, including the flight control system described in the above embodiments.

[0080] The technical solutions provided in the above embodiments of this application have at least the following technical effects or advantages: This invention provides a flight control system and method, as well as an aircraft. By configuring a flight data calculation module, an obstacle avoidance perception calculation module, and a flight control module, it achieves physical and logical dual isolation of the three core functions of aircraft flight status acquisition, obstacle avoidance path planning, and flight control. This effectively avoids cross-interference between functions and achieves precise isolation and prevention of fault propagation. After the aircraft enters intelligent flight mode, the dual-vision positioning and mapping submodule built into the obstacle avoidance perception calculation module can perform cross-validation on the obstacle avoidance information generated by each module. This allows for timely identification and elimination of data analysis biases in individual submodules, ensuring the reliability and accuracy of waypoint commands. The flight control module can complete flight control based on the acquired flight status information and waypoint commands. Even when the obstacle avoidance perception calculation module does not output waypoint commands, the flight control module can still operate normally according to cockpit operation commands, ensuring the pilot's basic control over the aircraft and further improving the system's fault tolerance. In addition, both the flight data calculation module and the flight control module adopt redundant computing and voting architectures, constructing a multi-level redundant protection system that can effectively avoid the risk of failure of their own computing units. The synergistic effect of the above technical solutions significantly improves the overall operational reliability of the system, fully meeting the high safety redundancy requirements of vertical takeoff and landing (VTOL) aircraft and providing a solid guarantee for their safe and stable flight in complex scenarios.

[0081] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of the invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0082] Similarly, it should be understood that, in order to simplify this disclosure and aid in understanding one or more of the various aspects of the invention, in the above description of exemplary embodiments of the invention, various features of the invention are sometimes grouped together in a single embodiment, figure, or description thereof. However, this method of disclosure should not be construed as reflecting an intention that the claimed invention requires more features than are expressly recited in each claim. Rather, as reflected in the following claims, inventive aspects lie in fewer than all features of a single foregoing disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into this detailed description, wherein each claim itself is a separate embodiment of the invention.

[0083] It should be noted that the above embodiments are illustrative of the invention and not restrictive of the invention, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims.

Claims

1. A flight control system, characterized in that, include: The flight data calculation module is used to acquire multi-source flight sensor data, and perform redundancy calculation and voting based on the multi-source flight sensor data to generate flight status information. The flight status information is used to reflect the real-time motion status and environmental adaptation parameters of the aircraft. The obstacle avoidance perception and calculation module includes two visual positioning and mapping sub-modules. Each visual positioning and mapping sub-module is used to acquire environmental point cloud data and target location data after the aircraft enters the intelligent driving mode, and generate obstacle avoidance information based on the environmental point cloud data and the target location data. The obstacle avoidance information includes at least an obstacle map and an obstacle avoidance path. The two visual positioning and mapping sub-modules are used to exchange the obstacle avoidance information, and generate waypoint instructions based on the obstacle avoidance information when the error between the two sets of obstacle avoidance information is within a set range. The flight control module is communicatively connected to the flight data calculation module, the obstacle avoidance perception calculation module, and the cockpit operating system of the aircraft. It is used to acquire the flight status information, the waypoint instructions, and / or the cockpit operation instructions. Based on the flight status information and the waypoint instructions, or based on the flight status information and the cockpit operation instructions, it performs control law redundancy calculation and voting, outputs corresponding actuator control signals, and sends them to the corresponding actuators on the aircraft to drive each actuator to control the aircraft to fly according to the obstacle avoidance path or the pilot control path.

2. The flight control system according to claim 1, characterized in that, The obstacle avoidance perception calculation module is also used to: generate an alarm command and send it to the flight control module when the error between the two sets of obstacle avoidance information is outside the set range; the alarm command is used to indicate that the obstacle avoidance perception calculation module has failed and intelligent driving is unavailable. The flight control module is also used to: if it receives the alarm command and the cockpit operation command, output the corresponding actuator control signal based on the cockpit operation command and send it to the corresponding actuator on the aircraft, so as to drive each actuator to control the aircraft to fly according to the pilot's control path.

3. The flight control system according to claim 1, characterized in that, The two visual positioning and mapping submodules are communicatively connected, and each visual positioning and mapping submodule is configured as follows: The obstacle avoidance information and power-on count of the current visual positioning and mapping submodule are sent to another visual positioning and mapping submodule, and the obstacle avoidance information and power-on count sent by the other visual positioning and mapping submodule are received. If the error between the obstacle avoidance information of the current visual positioning and mapping submodule and the obstacle avoidance information of the other visual positioning and mapping submodule is within a set range, a main visual positioning and mapping submodule is determined based on the number of power-on times of the current visual positioning and mapping submodule and the number of power-on times of the other visual positioning and mapping submodule. The main visual positioning and mapping submodule is one of the current visual positioning and mapping submodule or the other visual positioning and mapping submodule. If the current visual positioning and mapping submodule is the main visual positioning and mapping submodule, the waypoint command is generated and sent to the flight control module based on the obstacle avoidance information of the current visual positioning and mapping submodule.

4. The flight control system according to claim 1, characterized in that, Each of the aforementioned visual localization and mapping sub-modules includes: The second transmission unit is communicatively connected to the detection radar and display device on the aircraft, and is used to acquire the environmental point cloud data detected by the detection radar and the target location data input by the user through the display device after the aircraft enters the intelligent driving mode. Storage unit, pre-stored with map data; The computing unit, communicatively connected to the second transmission unit and the storage unit, is used to acquire the environmental point cloud data, the target location data, and the map data, and to perform synchronous positioning and map building algorithm calculations based on the acquired data to generate the obstacle avoidance information; it is also used to generate waypoint instructions based on the obstacle avoidance information and send them to the second transmission unit. The second transmission unit is also configured to communicate with the flight control module and send the waypoint command to the flight control module and the display device.

5. The flight control system according to claim 1, characterized in that, The flight multi-source sensing data includes inertial measurement data and target sensor data; the flight status information includes at least the aircraft's position information, attitude information, and external environment information of the aircraft. The flight data calculation module includes: Multiple inertial measurement units (IMUs) are used to collect the inertial measurement data, which includes at least the angular velocity and acceleration data of the aircraft. The first transmission unit has multiple external interfaces that are communicatively connected to multiple target sensors on the aircraft. It is used to acquire target sensor data detected by the multiple target sensors, perform packet processing on the acquired target sensor data, and distribute the packetized data to each microcontroller unit through an internal bus. The target sensor data includes at least radio altimeter data, angle of attack sensor data, barometric altimeter data, real-time dynamic positioning data, magnetic heading data, and visual odometry data. The system includes multiple microcontroller units, each communicatively connected to the first transmission unit, the multiple inertial measurement units, and the flight control module. Each microcontroller unit acquires multiple sets of inertial measurement data detected by the multiple inertial measurement units, as well as target sensor data. It performs redundancy calculations and voting based on the multiple sets of inertial measurement data to determine target inertial data; and processes the target inertial data and the target sensor data to generate flight status information. The multiple microcontroller units are communicatively connected to exchange flight status information. Each microcontroller unit votes on multiple sets of flight status information and sends the voting results to other microcontroller units. The voting results are used to indicate whether each microcontroller unit has failed. If the master microcontroller unit has not failed, the master microcontroller unit sends the generated flight status information to the flight control module through the first transmission unit. The master microcontroller unit is one of the multiple microcontroller units.

6. The flight control system according to claim 5, characterized in that, Each of the microcontroller units is configured to: After each of the microcontroller units is powered on, a self-test operation and a level-triggered hardware synchronization operation are performed. The level-triggered hardware synchronization operation is used to synchronize the task timing of each of the microcontroller units. After each microcontroller unit passes its self-test and the task timing of each microcontroller unit is synchronized, the power-on count of each microcontroller unit is obtained. The main microcontroller unit is determined based on the number of power-on cycles of each of the microcontroller units; When the main microcontroller unit fails, it stops outputting signals, and another compliant microcontroller unit sends the generated flight status information to the flight control module.

7. The flight control system according to claim 1, characterized in that, The flight control module includes: Multiple flight control units (FCUs) are configured to acquire flight status information, waypoint commands, and / or cockpit operation commands; perform control law calculations based on the flight status information and waypoint commands, or based on the flight status information and cockpit operation commands, and output corresponding actuator control signal candidate values; the multiple FCUs are configured to exchange the actuator control signal candidate values; each FCU is configured to vote on multiple sets of actuator control signal candidate values ​​and send the voting results to other FCUs; the voting results are used to indicate whether each FCU has failed; if the master FCU has not failed, the master FCU is configured to send the output actuator control signal candidate values ​​as the final actuator control signals to the corresponding actuators on the aircraft; the master FCU is one of the multiple FCUs. A backup flight control unit is communicatively connected to the multiple flight control units. When all multiple flight control units fail or cannot obtain the heartbeat data of the multiple flight control units, it acquires the flight status information and the cockpit operation commands, performs control law redundancy calculation and voting based on the flight status information and cockpit operation commands, outputs the corresponding actuator control signals, and sends them to the corresponding actuators on the aircraft.

8. The flight control system according to claim 7, characterized in that, Each of the flight control units is configured as follows: Each flight control unit performs a self-test after being powered on. After each flight control unit passes its self-test, the number of times each flight control unit is powered on is obtained. The main flight control unit is determined based on the number of times each of the flight control units is powered on; When the main flight control unit fails, it stops outputting signals, and another flight control unit that has not failed sends the candidate value of the actuator control signal as the final actuator control signal to the corresponding actuator on the aircraft.

9. A flight control method, characterized in that, The method, applicable to any one of claims 1 to 8, comprises: When the flight status information and waypoint instructions are obtained, but no cockpit operation instructions are obtained, the control law redundancy calculation and voting are performed based on the flight status information and waypoint instructions to generate a first actuator control signal and send it to the corresponding actuator on the aircraft, driving each actuator to control the aircraft to fly according to the obstacle avoidance path; Upon receiving the cockpit operation command, the system performs control law redundancy calculation and voting based on the cockpit operation command, generates a second actuator control signal, and sends it to the corresponding actuator on the aircraft, driving each actuator to control the aircraft to fly according to the path corresponding to the cockpit operation command.

10. An aircraft, characterized in that, Including the flight control system as described in any one of claims 1 to 8.

Images