Backup control device and control method

Abstract

The invention provides a backup control apparatus and a control method. The backup control device comprises a first activation module, a second activation module and an instruction calculation module. The first activation module and the second activation module generate a first activation signal and a second activation signal indicating activation of the backup control device, respectively, in response to the aircraft speed being higher than a first threshold and the number of host computer failures being higher than a second threshold. In response to the first activation signal and the second activation signal, the instruction calculation module is configured to generate a backup control command to control a control surface actuator to move.

Description

Technical Field

[0001] This invention relates to the field of fly-by-wire flight control, and more specifically to a backup control device and control method in a fly-by-wire flight control system. Background Technology

[0002] In the aviation field, catastrophic failure states must meet failure-safe requirements, meaning that a single failure, regardless of its probability, cannot lead to catastrophic consequences. However, common-mode problems can undermine the independence of redundant architectures. Therefore, the safety risks that common-mode problems may cause flight control system failure must be addressed.

[0003] With the development of fly-by-wire flight control technology, configuring independent backup control systems on top of the main flight control system has become a trend in civil aircraft. Currently, mainstream passenger aircraft are equipped with backup control systems of varying degrees, and due to improved backup capabilities, these systems now possess the ability to continue safe flight and make emergency landings. Some newer aircraft models even employ more advanced and versatile backup methods, such as EHA (electro-hydraulic actuator), EBHA (electro-backup hydraulic actuator), and EMA (electro-mechanical actuator).

[0004] There is a need in the art for an improved backup control device and control method. Summary of the Invention

[0005] To address the design and implementation challenges of backup computers, this application proposes a backup control device and control method.

[0006] In one embodiment of this application, a backup control device is proposed, comprising: a first activation module, which determines a first number of failed master computers based on the status of the master computer of the main flight control system, and generates a first activation signal based on the aircraft speed and the first number, wherein the first activation signal indicates activation of the backup control device based on the aircraft speed being higher than a first threshold and the first number being higher than a second threshold; a second activation module, which determines a second number of failed master computers based on the status of the master computer of the main flight control system, and generates a second activation signal based on the aircraft speed and the second number, wherein the second activation signal indicates activation of the backup control device based on the aircraft speed being higher than the first threshold and the second number being higher than the second threshold; and an instruction calculation module, wherein, in response to both the first activation signal and the second activation signal indicating activation of the backup control device, the backup control device enters an activated state, and in the activated state, the instruction calculation module generates a backup control command, the backup control command being used to control the movement of the control surface actuators. This embodiment of the invention provides a backup control device for a flight control system and its activation method. In this embodiment of the invention, at least two activation modules can combine the main computer status and aircraft speed information to determine whether the backup control device (BCM) needs to be activated. The dual activation module architecture ensures high integrity of the activation logic and reduces the probability of false activation of the backup control device. The activation module's judgment condition includes aircraft speed, which helps prevent false alarms from the ground.

[0007] In one implementation, the activation of the backup control device by the first activation signal and / or the second activation signal is further based on the fact that no fault was detected by the Ground-based Motor Internal Detection (PBIT). The PBIT checks whether the backup control device is functioning correctly, and only allows the activation module to generate an activation signal if the backup control device is functioning correctly, thus preventing the backup control device from performing control surface control in the event of a fault.

[0008] In one implementation, the backup control device further includes an enable module. In response to both the first activation signal and the second activation signal indicating activation of the backup control device, the enable module generates an enable signal, and in response to the enable signal, the backup control device enters an activated state. By generating the enable signal based on both the first and second activation signals, the enable signal can be used to control the backup control device to enter an activated state from a cold backup state, improving the integrity of the backup control device's activation.

[0009] In one implementation, the backup control device further includes a cold plate and a hot plate, wherein the first activation module, the second activation module, and the power supply module are located on the hot plate, and the instruction calculation module is located on the cold plate. In response to the backup control device being in a cold backup state, the power supply module supplies power to the modules on the hot plate, while the modules on the cold plate are powered off; and in response to the enable signal, the power supply module supplies power to the modules on the cold plate, causing the backup control device to enter an active state. Using the hot-cold plate design of this embodiment, the instruction calculation module of the backup control device does not generate backup control commands in the cold backup state, reducing the possibility of the backup system interfering with the main system from the source, and also helping to reduce device power consumption.

[0010] In one implementation, the backup control device further includes a power supply control switch connected between the power supply module and the cold plate. In response to the enable signal, the power supply control switch closes to supply power to the module on the cold plate. The power supply control switch can be controlled by the enable signal, thereby enabling power supply to the module on the cold plate of the backup control device when certain conditions are met.

[0011] In one implementation, the backup control device further includes: in the active state, the command calculation module performs a handshake communication with the control surface actuator; and in response to a successful handshake communication, the backup control device enters an on state, in which the command calculation module generates the backup control command and transmits the backup control command to the control surface actuator. The handshake communication can confirm whether the communication link between the backup control device and the control surface actuator is unobstructed or secure, and send the backup control command if the communication link is unobstructed or secure.

[0012] In one implementation, the backup control device further includes: in response to an unsuccessful handshake communication, the instruction calculation module retrying handshake communication with the control surface actuator. For example, the BCM can continuously retry handshake communication until the handshake is successful.

[0013] In one implementation, the backup control device further includes: in the active state or the connected state, in response to the first activation signal and / or the second activation signal not indicating activation of the backup control device, the backup control device enters a standby state. In the standby state, the power supply module supplies power to the modules on the hot plate and the cold plate, and the command calculation module generates the backup control command but does not send the backup control command to the control surface actuator. Generating the backup control command but not sending it in the standby state can reduce the delay of subsequent takeover of flight control and reduce interference of the backup control command to the control surface control commands of the main flight control system.

[0014] In one implementation, in the standby state, in response to both the first activation signal and the second activation signal indicating activation of the backup control device, the backup control device enters the on-state and sends the backup control command generated by the command calculation module to the control surface actuator. If the primary flight control system fails again in the standby state, the backup control device can directly enter the on-state from the standby state and send the backup control command, quickly taking over control of the actuator components and reducing the adverse effects of the primary flight control system failure.

[0015] In one implementation, the instruction calculation module is a single-channel instruction calculation module, and the control law of the instruction calculation module provides surface control that satisfies the three-axis minimum acceptable control (MAC). Under the premise of meeting the false activation probability safety index, the single-channel design of the instruction calculation module is simple and reliable. Using a single-channel instruction calculation module can minimize the complexity of the device and improve its availability.

[0016] In one embodiment of this application, a flight control system is provided, comprising: a main flight control system; and a backup control device as described in any of the preceding claims.

[0017] In one embodiment of this application, a backup control method is proposed, comprising: determining a first number of failed master computers based on the master computer state of the master flight control system, and generating a first activation signal based on the aircraft speed and the first number, wherein the first activation signal indicates activation of a backup control device based on the aircraft speed being higher than a first threshold and the first number being higher than a second threshold; determining a second number of failed master computers based on the master computer state of the master flight control system, and generating a second activation signal based on the aircraft speed and the second number, wherein the second activation signal indicates activation of the backup control device based on the aircraft speed being higher than the first threshold and the second number being higher than the second threshold; and, in response to both the first activation signal and the second activation signal indicating activation of the backup control device, causing the backup control device to enter an activated state and generating a backup control command, the backup control command being used to control the movement of a control surface actuator.

[0018] In one implementation, the activation of the backup control device by the first activation signal and / or the second activation signal is also based on the fact that no fault was detected by the ground-based motor internal self-detection (PBIT).

[0019] In one implementation, the backup control method further includes: generating an enable signal in response to both the first activation signal and the second activation signal indicating activation of the backup control device, the enable signal causing the backup control device to enter an activated state.

[0020] In one implementation, the backup control method further includes: in the active state, the backup control device performs handshake communication with the control surface actuator; and in response to the successful handshake communication, the backup control device enters an on state, in the on state, the backup control device generates the backup control command and transmits the backup control command to the control surface actuator.

[0021] In one implementation, the backup control method further includes: in response to the handshake communication failure, the backup control device retrying handshake communication with the control surface actuator.

[0022] In one implementation, the backup control method further includes: in the active state or the connected state, in response to the first activation signal and / or the second activation signal not indicating the activation of the backup control device, the backup control device enters a standby state, in the standby state, the backup control device generates the backup control command, but does not send the backup control command to the control surface actuator.

[0023] In one implementation, the backup control method further includes: in the standby state, in response to both the first activation signal and the second activation signal indicating the activation of the backup control device, the backup control device enters the on state, generates the backup control command, and sends the backup control command to the control surface actuator. Attached Figure Description

[0024] Figure 1 This is a schematic diagram of the architecture of a backup control device according to an embodiment of the present invention.

[0025] Figure 2 This is a logical schematic diagram of a backup control device according to an embodiment of the present invention.

[0026] Figure 3 This is a schematic diagram of the backup control device according to an embodiment of the present invention.

[0027] Figure 4 This is a schematic diagram of the state switching of the backup control device according to an embodiment of the present invention.

[0028] Figure 5 This is a flowchart of a backup control method according to an embodiment of the present invention.

[0029] Figure 6 This is a flowchart illustrating an implementation of a backup control method according to an embodiment of the present invention. Detailed Implementation

[0030] The present invention will be further described below with reference to specific embodiments and accompanying drawings, but this should not be construed as limiting the scope of protection of the present invention.

[0031] The flight control system may include a primary flight control system (such as a primary flight control computer, abbreviated as PRIM or PFC) and a backup control module (BCM). The primary flight control system includes one or more primary computers (also known as primary flight control computers). The primary computer can perform control law calculations and generate control commands based on input signals from the cockpit control devices. The control commands are then transmitted via bus to remote control electronics (REU) located on the control surfaces to control the corresponding control surface actuators, thereby driving the control surfaces (such as ailerons, elevators, rudders, spoilers, etc.) to move.

[0032] When the primary flight control system fails due to malfunction, power outage, or other reasons, the backup control module (BCM) automatically takes over control, ensuring that the pilot can still perform basic but crucial control of the aircraft's main control surfaces (such as ailerons, elevators, and rudder) through the fly-by-wire flight control system. The backup control module (or backup control unit) calculates (backup) control laws based on input signals from the cockpit controls and generates backup control commands. These commands are then transmitted via the bus to the REU (Rear Aircraft Unit) to control the corresponding control surface actuators, thereby driving the control surfaces to move.

[0033] Both the primary flight control system and the backup control module can communicate with other systems, such as avionics systems and inertial navigation systems. The primary flight control system and the backup control module can each be implemented using computers, processors, integrated circuits, programmable logic devices, microprocessors, controllers, microcontrollers, or state machines.

[0034] Figure 1 This is a schematic diagram of the architecture of a backup control device (BCM) 100 according to an embodiment of the present invention.

[0035] The backup control device 100 may include at least a first activation module (e.g., activation module 1), a second activation module (e.g., activation module 2), a power supply module, an input / output (I / O) module 130, an instruction calculation module 140, etc. In one embodiment, the I / O module 130 may be integrated with the instruction calculation module 140, for example, the I / O module 130 may be implemented as part of the instruction calculation module 140.

[0036] In one embodiment, the backup control device 100 may include a hot plate 110 and a cold plate 120, wherein the first activation module, the second activation module, and the power supply module are deployed on the hot plate 110, and other functional modules (e.g., I / O module 130, instruction calculation module 140, etc.) are deployed on the cold plate 120. The power supply module receives power from the aircraft busbar of the aircraft power system and supplies power to the cold plate, the hot plate, and the back-end actuation components according to the instructions of the activation module. In one implementation, the hot plate 110 and the cold plate 120 may be implemented as different PCB boards. In another implementation, the hot plate 110 and the cold plate 120 may be implemented as different partitions on the same PCB board.

[0037] If the primary flight control system is functioning normally, i.e., the primary flight control system is not below the minimum acceptable control MAC (e.g., all primary computers are functioning normally, or the number of failed primary computers is not higher than a second threshold), the backup control device 100 can enter a cold backup state after power-on self-test. In this state, the cold plate 120 is in a cold backup state (e.g., power off), while the hot plate 110 remains powered on and operational in a hot backup state, powered by the power supply module. When the backup control device 100 is in a cold backup state, activation modules 1 and 2 operate, and when conditions are met, the backup control device 100 enters an active state, powering on and operationalizing the cold plate 120. After the backup control device 100 is activated, activation modules 1 and 2 continue to operate, or optionally, enter hibernation mode.

[0038] Activation module 1 can receive aircraft speed and master computer status from the master flight control system. Based on the status of each master computer, activation module 1 can determine a first number of failed master computers and generate a first activation signal based on the aircraft speed and the first number. In one example, based on the aircraft speed being higher than a first threshold and the first number being higher than a second threshold (e.g., causing the master flight control system to fall below the minimum acceptable control (MAC), i.e., the master flight control system is failed), the first activation signal indicates activation of the backup control device; for example, the first activation signal is a valid signal, such as a value of 1. In another example, based on the aircraft speed being lower than the first threshold and / or the first number being lower than the second threshold, the first activation signal does not indicate activation of the backup control device; for example, the first activation signal is an invalid signal, such as a value of 0.

[0039] Activation module 2 can receive aircraft speed and master computer status from the master flight control system. Based on the status of each master computer, activation module 2 can determine a second number of failed master computers and generate a second activation signal based on aircraft speed and the second number. In one example, based on aircraft speed exceeding a first threshold and the second number exceeding a second threshold (e.g., causing the master flight control system to fall below MAC), the second activation signal indicates activation of the backup control device; for example, the second activation signal is a valid signal, such as a value of 1. In another example, based on aircraft speed equal to or below the second threshold and / or the second number equal to or below the second threshold, the second activation signal does not indicate activation of the backup control device; for example, the second activation signal is an invalid signal, such as a value of 0.

[0040] Activation Module 1 and Activation Module 2 can receive the master computer status from the master flight control system via the same or different buses, and determine the number of failed master computers based on the master computer status. The master computer status received by Activation Module 1 and Activation Module 2 can be the master computer status at the same time or at different times. Similarly, Activation Module 1 and Activation Module 2 can receive aircraft speed via the same or different buses. The aircraft speed can come from the air data system, inertial reference system, and / or airspeed indicator, etc. The master computer status and aircraft speed received by Activation Module 1 and Activation Module 2 can correspond to the same or similar times. The determination criteria of the activation modules include aircraft speed to prevent false alarms from the ground.

[0041] In response to both the first and second activation signals indicating the activation of the backup control device 100, the backup control device 100 can enter an activated state. For example, the power supply module supplies power to the modules on the hot and cold plates and can also supply power to the control surface actuators. Accordingly, the I / O module 130 and the instruction calculation module 140 begin operation.

[0042] In another embodiment, if the aircraft speed does not exceed a first threshold and / or the number of main computer failures does not exceed a second threshold in any of the activation modules, the corresponding activation module will not generate a valid activation signal, or may generate a deactivation signal (e.g., a value of 0). In response to one or two activation modules failing to generate a valid activation signal (or generating a deactivation signal), the backup control device 100 remains in a cold backup state and will not enter the activation state.

[0043] After the backup control device 100 is activated, the I / O module 130 can receive control command inputs and / or control surface actuator feedback, and transmit this information to the command calculation module 140. Control command inputs may include cockpit operation inputs, such as operation signals generated by input components like sidesticks, pedals, and joysticks. Control command inputs may also include aircraft attitude sensor inputs, such as pitch angle, roll angle, angular rate, airspeed, and angle of attack. Control surface actuator feedback may include control surface position, control surface status, and fault reports. The command calculation module 140 stores a control law, which can be configured to generate backup control commands based on the control command inputs and / or control surface actuator feedback. The control law stored in the command calculation module 140 provides control surface manipulation that meets the three-axis minimum acceptable control (MAC), enabling the aircraft to continue safe flight and landing in backup mode. The I / O module 130 can transmit the backup control commands generated by the command calculation module 140 to the control surface actuators to control their movement.

[0044] In this embodiment of the invention, at least two activation modules can combine the host computer status and aircraft speed information to determine whether the backup control device (BCM) needs to be activated. The dual activation module architecture can ensure the high integrity of the activation logic, for example, ensuring that the probability of BCM false activation is <1E-9 / FH.

[0045] By adopting the BCM hot and cold plate design of this embodiment, the BCM instruction calculation module 140 will not generate backup control commands in the cold backup state, which reduces the possibility of the backup system interfering with the main system from the source and helps to reduce the power consumption of the device.

[0046] In one embodiment, the instruction calculation module 140 may be a single-channel instruction calculation module, which includes a single instruction channel without a monitoring channel. Since the backup mode is the last resort when other available modes fail, the single-channel design of the instruction calculation module 140 is simple and reliable, provided that the false activation probability security index is met. Using a single-channel instruction calculation module can minimize the complexity of the device and improve its availability.

[0047] Figure 2 This is a logical schematic diagram of a backup control device 200 according to an embodiment of the present invention. The backup control device 200 may be an embodiment of the backup control device 100 described above.

[0048] In one embodiment, the backup control device 200 may include a hot plate 210 and a cold plate 220, wherein the first activation module, the second activation module and the power supply module are deployed on the hot plate 210, and other functional modules (e.g., I / O modules, instruction calculation modules, etc.) are deployed on the cold plate 220.

[0049] like Figure 2As shown, after the backup control device 200 is powered on, the power supply module receives power from the aircraft busbar and continuously supplies power to the components on the hot plate. At least two activation modules (e.g., activation module 1 and activation module 2) monitor the main computer status and aircraft speed, respectively, and generate valid activation signals to instruct the backup control device to be activated when the main computer status and aircraft speed meet certain conditions (e.g., the aircraft is in flight and the main flight control system malfunctions). For example, based on the aircraft speed being higher than a first threshold and a first quantity being higher than a second threshold, the first activation signal generated by activation module 1 instructs the backup control device to be activated; based on the aircraft speed being higher than the first threshold and a second quantity being higher than the second threshold, the second activation signal generated by activation module 2 instructs the backup control device to be activated.

[0050] In one embodiment, the hot plate may include an enable module 201. The enable module 201 receives a first activation signal and a second activation signal. In response to both the first and second activation signals indicating activation of the backup control device, the enable module generates an enable signal, and in response to the enable signal, the backup control device enters an activated state. In one embodiment, the output of the enable module 201 is used to control a power supply control switch 202. The power supply control switch 202 may be connected between the power supply module and the cold plate 220. In response to the enable signal, the power supply control switch 202 closes, and the power supply module supplies power to the module on the cold plate, causing the backup control device to enter an activated state.

[0051] When no valid first activation signal and / or second activation signal is received, for example, either or both of activation module 1 and / or activation module 2 output an invalid activation signal or deactivation signal, and enable module 201 generates a non-enable signal (e.g., a 0 value signal).

[0052] In one embodiment, the enable module 201 may be implemented as a logic gate (e.g., an AND logic gate) that receives the output of the activation module 1 (e.g., a valid or invalid first activation signal) and the output of the activation module 2 (e.g., a valid or invalid second activation signal). When a valid first activation signal and a valid second activation signal are received, the enable module 201 outputs an enable signal.

[0053] In another embodiment, the power supply control switch 202 can be implemented as two switches connected in series, with each activation module controlling one switch. In this case, the enable module 201 is not required. A valid first activation signal output by activation module 1 can close the first switch, and a valid second activation signal output by activation module 2 can close the second switch, thereby closing the power supply control switch 202. The power supply module supplies power to the module on the cold plate, causing the backup control device to enter the activated state.

[0054] In another embodiment, the input of the enable module 201 receives a valid enable signal. Two switches connected in series are linked between the input and output of the enable module 201, with each activation module controlling one switch. For example, a valid first activation signal output by activation module 1 can close the first switch, and a valid second activation signal output by activation module 2 can close the second switch, thereby enabling module 201 transmits the valid enable signal from its input to its output. In other embodiments, the enable module 201 can be implemented in other ways to generate an enable signal in response to a valid first activation signal and a valid second activation signal.

[0055] In one embodiment, after the power supply control switch 202 is closed, the power supply module can also power the back-end actuation components. The back-end actuation components may include REUs and actuators associated with the control surfaces, as well as sensors associated with the REUs, actuators, and control surfaces. In some embodiments, the power supply module can also power external sensors via the closed power supply control switch 202, such as cockpit sensors and aircraft attitude sensors.

[0056] In one embodiment, after the enable signal output by the enable module 201 closes the power supply control switch 202 and causes the backup control device to enter the active state, the activation modules 1 and / or 2 respond to changes in conditions, such as the aircraft speed no longer exceeding the first threshold and / or the number of failed main computers no longer exceeding the second threshold, the first activation signal and / or the second activation signal become invalid (do not indicate activation of the backup control device), and the power supply control switch 202 will not be disconnected, that is, it still supplies power to the cold plate of the backup control device.

[0057] In one embodiment, after the backup control device enters the active state, in response to the first activation signal and / or the second activation signal becoming invalid (not indicating the activation of the backup control device), the power supply to the control surface actuator in the power supply control switch 202 can be cut off, but the power supply to the cold plate is not cut off.

[0058] In an alternative embodiment, the output of the enable module 201 can be sent to the cold plate. For example, an enable signal or a disable signal can be passed to the I / O module of the cold plate and input into the instruction calculation module.

[0059] In one embodiment, one or both of the activation modules may further generate an activation signal based on a Power-up Built-in Test (PBIT / PUBIT). PBIT can be performed while the aircraft is on the ground. PBIT checks the functionality of the backup control unit and only allows the activation module to generate an activation signal if the backup control unit is functioning correctly.

[0060] Accordingly, the activation module can generate a valid activation signal when the aircraft speed exceeds a first threshold (e.g., greater than 30 kts), the number of main computer (e.g., main flight control computer) failures exceeds a second threshold resulting in a drop below the minimum acceptable control (MAC), and no fault is detected by the ground PBIT. If one or more of these conditions are not met, the activation module can generate an invalid activation signal (e.g., a value of 0), which does not indicate the activation of the backup control unit.

[0061] Figure 3 This is a schematic diagram of the backup control device 300 according to an embodiment of the present invention. The backup control device 300 may be an embodiment of the backup control device 100 or 200 described above. As described above, the power supply module on the hot plate can supply power to the modules on the cold plate, such as the I / O module 330 and the instruction calculation module 340.

[0062] The I / O module 330 may include an input processing component 331, an output control component 332, and a monitor 333. The input processing component 331 can receive control command inputs, which may include, for example, cockpit operation inputs and aircraft attitude sensor inputs. The input processing component 331 can also receive control surface actuator feedback, such as control surface actuator position, status, and fault reports. After preprocessing the received control command inputs and / or control surface actuator feedback (e.g., verification, filtering), the input processing component 331 of the I / O module 330 transmits this information to the command calculation module 340.

[0063] The output control component 332 of the I / O module 330 can receive backup control commands generated by the command calculation module 340 and determine whether to transmit the backup control commands to the control surface actuators. For example, if the backup control device 300 is in an active (or connected) state, the output control component 332 transmits the backup control commands to the control surface actuators. If the backup control device 300 is in a standby state, and the main flight control system is operating normally, the output control component 332 inhibits the transmission of backup control commands to the control surface actuators. The monitor 333 can monitor whether the command calculation module 340 is operating normally, monitor whether the input signals and output signals of the I / O module 330 are normal, and generate corresponding status indication signals. For example, the monitor 333 can monitor the cockpit control inputs, aircraft attitude sensor inputs, and control surface actuator feedback received by the input processing component 331 as needed.

[0064] The command calculation module 340 may include a control law 341 and a monitor 343. The control law 341 may be configured to generate backup control commands based on control command inputs and / or control surface actuator feedback. The monitor 343 of the command calculation module may monitor the input and output signals of the control law 341 and generate corresponding status indication signals.

[0065] For the design of the monitor 333 of I / O module 330 and the monitor 343 of instruction calculation module 340, considering the special nature of the backup mode, the fault response can be relatively mild and the monitor is given the ability to self-recover.

[0066] In one embodiment, the hot plate data transmitted from the hot plate to the cold plate may include signals output by the enable module 201, such as an enable signal or a disable signal. For example, after the backup control device 300 enters the active state, the command calculation module 340 operates and can determine the state of the main flight control system based on the enable signal or disable signal output by the enable module 201. Specifically, in response to the enable module 201 outputting an enable signal, the command calculation module 340 can determine that the main flight control system is in an abnormal state; in response to the enable module 201 outputting a disable signal, the command calculation module 340 can determine that the main flight control system is in a normal state (i.e., the main flight control system has resumed normal operation).

[0067] In another embodiment, the instruction calculation module 340 can receive the host computer status from the main flight control system and determine whether the main flight control system is in a normal state.

[0068] After the backup control device 300 (e.g., in response to a malfunction of the primary flight control system) enters the activation state, if the command calculation module 340 determines that the primary flight control system has resumed normal operation, the backup control device 300 (e.g., the command calculation module 340 or the I / O module 330) can enter the standby state without sending backup control commands to the REU. The command calculation module 340 may continue to generate backup control commands or may not generate backup control commands.

[0069] Figure 4 This is a schematic diagram of the state switching of the backup control device (BCM) according to an embodiment of the present invention.

[0070] After the BCM is powered on, it enters the initialization state. The initialization state is a transitional state before normal operation, in which both the hot and cold plates are powered on and the internal modules are initialized.

[0071] After initialization, in response to the absence of a fault detected by the ground PBIT, the BCM enters a cold backup state, in which the cold plate is powered off and the hot plate (e.g., the activation module) monitors the activation conditions in real time.

[0072] In response to the activation conditions being met in the cold backup state (e.g., the number of main computer failures exceeds a second threshold and the aircraft speed exceeds a first threshold), the BCM enters the activation state: the cold plate is powered on, the power supply module can also supply power to the back-end actuation components, and the BCM and the actuation components attempt to handshake.

[0073] In one embodiment, in response to the BCM completing a handshake with the actuation component, the BCM enters an on state: the command calculation module receives control command input and / or control surface actuator feedback, calculates backup control commands, and transmits the backup control commands to the control surface actuator.

[0074] In another embodiment, the on / off state may not exist. In this case, in response to meeting the activation conditions in the cold backup state, the BCM enters the active state, where the cold plate is powered on, the command calculation module receives control command inputs and / or control surface actuator feedback, and calculates backup control commands. Furthermore, in the active state, the power supply module can supply power to the back-end actuation components, the BCM attempts to handshake with the actuation components, and after completing the handshake, it transmits the backup control commands generated by the command calculation module to the control surface actuators.

[0075] In one embodiment, in the BCM active state or BCM connected state, if the main flight control system resumes normal operation (e.g., the failed main computer resumes normal operation, such that the number of failed main computers is less than or equal to the second threshold) and / or the aircraft speed is not higher than the first threshold, one or two activation modules generate invalid activation signals, and the enable module 201 outputs invalid enable signals (or non-enable signals). The instruction calculation module can enable the BCM to enter a standby state: the hot and cold plates remain powered on, the BCM exits control of the actuators, that is, there is no need to send backup control commands to the REU (wherein the instruction calculation module can continue to generate backup control commands or not generate backup control commands), the power supply module can stop supplying power to the back-end actuators and / or external sensors, and the hot plate monitors the status of the main computer in real time. If the number of main computer failures exceeds the second threshold and the aircraft speed exceeds the first threshold, both activation modules generate valid activation signals, and the enable module 201 outputs a valid enable signal. Then, the command calculation module can enable the BCM to enter the on state (or enter the active state) from the standby state. The power supply module supplies power to the back-end actuation components and / or external sensors. The BCM takes over the control of the actuation components and transmits the backup control commands generated by the command calculation module to the control surface actuators.

[0076] In another embodiment, in the BCM active or connected state, the command calculation module can receive status information from the main flight control system. If the status information indicates that the main flight control system has resumed normal operation, the command calculation module can cause the BCM to enter a standby state: the hot and cold plates remain powered on, and the BCM relinquishes control of the actuation components, meaning there is no need to send backup control commands to the REU. In the standby state, if the status information of the main flight control system indicates that the main flight control system has failed again (below MAC), the command calculation module can cause the BCM to enter a connected state (or an active state). The BCM then takes over control of the actuation components and transmits the backup control commands generated by the command calculation module to the control surface actuators.

[0077] Figure 5 This is a flowchart of a backup control method according to an embodiment of the present invention.

[0078] In step 501, a first number of failed master computers is determined based on the master computer status of the master flight control system, and a first activation signal is generated based on the aircraft speed and the first number, wherein the first activation signal indicates activation of the backup control device based on the aircraft speed being higher than a first threshold and the first number being higher than a second threshold.

[0079] In step 502, a second number of failed master computers is determined based on the master computer status of the master flight control system, and a second activation signal is generated based on the aircraft speed and the second number, wherein the second activation signal indicates activation of the backup control device based on the aircraft speed being higher than a first threshold and the second number being higher than a second threshold.

[0080] In one embodiment, the first activation signal and / or the second activation signal instruct the activation of the backup control device further based on the fact that no fault was detected by the Ground-based Motor Internal Detection and Testing (PBIT). For example, the first activation signal and / or the second activation signal instruct the activation of the backup control device based on the aircraft speed being higher than a first threshold, the number of mainframe failures being higher than a second threshold, and no fault being detected by PBIT.

[0081] Although Figure 5 Step 501 is shown before step 502, but it should be understood that in a specific implementation, step 501 may be implemented before or after step 502, or steps 501 and 502 may be implemented in parallel or overlapping in time.

[0082] In step 503, in response to both the first activation signal and the second activation signal indicating the activation of the backup control device, the backup control device enters the activation state and generates a backup control command, which is used to control the movement of the rudder surface actuator.

[0083] In one embodiment, in response to both the first activation signal and the second activation signal indicating the activation of the backup control device, an enable signal is generated, which causes the backup control device to enter an activated state.

[0084] In one embodiment, in the active state, the backup control device performs handshake communication with the control surface actuator; and in response to successful handshake communication, the backup control device generates a backup control command and transmits the backup control command to the control surface actuator.

[0085] In one embodiment, in the active state, the backup control device performs handshake communication with the control surface actuator; and in response to the successful handshake communication, the backup control device enters the connected state, in which the backup control device generates a backup control command and transmits the backup control command to the control surface actuator.

[0086] In another embodiment, in response to a failed handshake communication, the backup control device retryes handshake communication with the control surface actuator.

[0087] In one embodiment, in the active or connected state, in response to the first activation signal and / or the second activation signal not indicating the activation of the backup control device, the backup control device enters a standby state. In the standby state, the backup control device generates a backup control command but does not send a backup control command to the control surface actuator.

[0088] In one embodiment, in the standby state, in response to both the first activation signal and the second activation signal indicating the activation of the backup control device, the backup control device enters the on state, generates a backup control command, and sends the backup control command to the control surface actuator.

[0089] Figure 6 This is a flowchart illustrating an implementation of a backup control method according to an embodiment of the present invention.

[0090] In one embodiment, after power-on, the BCM performs initialization and self-test. If no fault is detected (e.g., the ground PBIT does not detect a fault), the BCM enters a cold backup state, the cold plate is powered off, and the hot plate monitors the activation conditions in real time. If the ground PBIT detects a fault, the BCM can be disabled (e.g., the BCM can be powered off).

[0091] In one embodiment, when the activation conditions are met, the BCM is activated, the cold plate and the back-end actuation components are powered on, and the BCM attempts to handshake with the actuation components. If the handshake is successful, the BCM is powered on and sends actuation control commands. If the handshake fails, considering the special nature of the backup mode as a final solution, the BCM can continuously retry until the handshake is successful.

[0092] In one embodiment, in the activated and powered-on state, if the primary flight control system recovers, the BCM can be put into standby mode, relinquishing control of the actuators. However, due to precedents of primary flight control system failure, the BCM's hot and cold plates remain powered on; for example, the command calculation module generates backup control commands but does not send backup control commands to the control surface actuators. When the primary flight control system fails again, the BCM immediately activates and takes over control of the actuators, sending the generated backup control commands to the control surface actuators.

[0093] As described above, this invention proposes a backup control device (BCM) employing a single-channel architecture for determining backup mode activation, calculating commands after activation, and controlling control surfaces. The BCM's hot and cold plate design reduces the possibility of the backup system interfering with the main system, thus reducing power consumption. Furthermore, the single-channel design reduces device complexity and improves availability.

[0094] Furthermore, high integrity of the activation logic (<1E-9 / FH) is ensured through combinational logic and a dual-activation module architecture. After activation, instruction calculation that meets backup control requirements is implemented based on a simple and efficient single-channel module.

[0095] The various steps and modules of the methods and apparatus described above can be implemented in hardware, software, or a combination thereof. If implemented in hardware, the various illustrative steps, modules, and circuits described in connection with this disclosure can be implemented or executed using a general-purpose processor, digital signal processor (DSP), application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), or other programmable logic components, hardware components, or any combination thereof. A general-purpose processor can be a processor, microprocessor, controller, microcontroller, or state machine, etc. If implemented in software, the various illustrative steps and modules described in connection with this disclosure can be stored as one or more instructions or codes on a computer-readable medium or transmitted. Software modules implementing the various operations of this disclosure can reside in a storage medium, such as RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, removable disk, CD-ROM, cloud storage, etc. The storage medium can be coupled to a processor so that the processor can read and write information from / to the storage medium and execute the corresponding program modules to implement the various steps of this disclosure.

[0096] The numerical values ​​given in the various embodiments are merely examples and are not intended to limit the scope of the invention. In practice, the specific parameters of each component and various thresholds can be appropriately set as needed, and are not limited to the specific values ​​given as examples herein. Furthermore, as a whole technical solution, there are other components or steps not listed in the claims or specification of this invention. Moreover, a single name for a component does not preclude other names for that component.

[0097] It should also be noted that these embodiments may be described as processes depicted as flowcharts, flow diagrams, structure diagrams, or block diagrams. Although a flowchart may describe the operations as a sequential process, many of these operations can be executed in parallel or concurrently. Furthermore, the order of these operations can be rearranged.

[0098] Furthermore, it should be noted that the use of sequential terms such as "first" and "second" to define components is merely for the purpose of distinguishing the corresponding components. Unless otherwise stated, the above terms have no special meaning and therefore cannot be construed as limiting the scope of protection of this application.

[0099] The disclosed methods, apparatuses, and systems should not be limited in any way. Rather, this disclosure covers all novel and non-obvious features and aspects of the various disclosed embodiments (individually and in various combinations and sub-combinations of each other). The disclosed methods, apparatuses, and systems are not limited to any particular aspect or feature or combination thereof, and no disclosed embodiment is required to have any one or more specific advantages or to solve any particular or all technical problems.

[0100] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the scope of protection of the present invention.

Claims

1. A backup control device, characterized in that, include: The first activation module determines a first number of failed master computers based on the status of the master computer of the main flight control system, and generates a first activation signal based on the aircraft speed and the first number, wherein the first activation signal indicates activation of the backup control device based on the aircraft speed being higher than a first threshold and the first number being higher than a second threshold. The second activation module determines a second number of failed master computers based on the status of the master computer of the main flight control system, and generates a second activation signal based on the aircraft speed and the second number, wherein the second activation signal indicates activation of the backup control device based on the aircraft speed being higher than a first threshold and the second number being higher than a second threshold. as well as The instruction calculation module, in response to both the first activation signal and the second activation signal indicating the activation of the backup control device, the backup control device enters an activated state, and in the activated state, the instruction calculation module generates a backup control command, which is used to control the movement of the control surface actuator.

2. The backup control device as described in claim 1, characterized in that, The activation of the backup control device by the first activation signal and / or the second activation signal is also based on: No fault was detected by the ground-based motor self-test (PBIT).

3. The backup control device as described in claim 1, characterized in that, Also includes: The enabling module generates an enabling signal in response to both the first activation signal and the second activation signal indicating that the backup control device should be activated. In response to the enabling signal, the backup control device enters an activated state.

4. The backup control device as described in claim 3, characterized in that, It also includes cold plates and hot plates. The first activation module, the second activation module, and the power supply module are located on the hot plate, while the instruction calculation module is located on the cold plate. In response to the backup control device being in a cold backup state, the power supply module supplies power to the module on the hot plate, while the module on the cold plate is in a power-off state; and In response to the enable signal, the power supply module supplies power to the module on the cold plate, thereby activating the backup control device.

5. The backup control device as described in claim 4, characterized in that, Also includes: A power supply control switch is connected between the power supply module and the cold plate. In response to the enable signal, the power supply control switch closes to supply power to the module on the cold plate.

6. The backup control device as described in claim 4, characterized in that: In the activated state, the command calculation module and the control surface actuator perform handshake communication; and In response to the successful handshake communication, the backup control device enters the connected state. In the connected state, the instruction calculation module generates the backup control command and transmits the backup control command to the control surface actuator.

7. The backup control device as described in claim 6, characterized in that: In response to the failure of the handshake communication, the instruction calculation module retryes the handshake communication with the control surface actuator.

8. The backup control device as described in claim 6, characterized in that: In the active state or the connected state, in response to the first activation signal and / or the second activation signal not indicating the activation of the backup control device, the backup control device enters a standby state. In the standby state, the power supply module supplies power to the modules on the hot plate and the cold plate, and the instruction calculation module generates the backup control command but does not send the backup control command to the control surface actuator.

9. The backup control device as described in claim 8, characterized in that: In the standby state, in response to both the first activation signal and the second activation signal indicating that the backup control device is activated, the backup control device enters the on state and sends the backup control command generated by the instruction calculation module to the control surface actuator.

10. The backup control device as described in claim 1, characterized in that: The command calculation module is a single-channel command calculation module, and the control law of the command calculation module provides rudder surface manipulation that satisfies the three-axis minimum acceptable control (MAC).

11. A flight control system, characterized in that, include: Main flight control system; as well as The backup control device as described in any one of claims 1 to 10.

12. A backup control method, characterized in that, include: The first number of failed main computers is determined based on the status of the main computer of the main flight control system, and a first activation signal is generated based on the aircraft speed and the first number, wherein the first activation signal indicates the activation of the backup control device based on the aircraft speed being higher than a first threshold and the first number being higher than a second threshold. The second number of failed master computers is determined based on the status of the master computer of the master flight control system, and a second activation signal is generated based on the aircraft speed and the second number, wherein the second activation signal indicates activation of the backup control device based on the aircraft speed being higher than a first threshold and the second number being higher than a second threshold. as well as In response to both the first activation signal and the second activation signal indicating that the backup control device is activated, the backup control device enters an activated state and generates a backup control command, which is used to control the movement of the rudder surface actuator.

13. The backup control method as described in claim 12, characterized in that, The activation of the backup control device by the first activation signal and / or the second activation signal is also based on: No fault was detected by the ground-based motor self-test (PBIT).

14. The backup control method as described in claim 12, characterized in that, Also includes: In response to both the first activation signal and the second activation signal indicating that the backup control device is activated, an enable signal is generated, which causes the backup control device to enter the activated state.

15. The backup control method as described in claim 14, characterized in that, Also includes: In the active state, the backup control device communicates with the control surface actuator via a handshake. as well as In response to the successful handshake communication, the backup control device enters the connected state. In the connected state, the backup control device generates the backup control command and transmits the backup control command to the control surface actuator.

16. The backup control method as described in claim 15, characterized in that, Also includes: In response to the failure of the handshake communication, the backup control device retryes the handshake communication with the control surface actuator.

17. The backup control method as described in claim 15, characterized in that, Also includes: In the active state or the connected state, in response to the first activation signal and / or the second activation signal not indicating the activation of the backup control device, the backup control device enters a standby state. In the standby state, the backup control device generates the backup control command, but does not send the backup control command to the control surface actuator.

18. The backup control method as described in claim 17, characterized in that, Also includes: In the standby state, in response to both the first activation signal and the second activation signal indicating that the backup control device is activated, the backup control device enters the on state, generates the backup control command, and sends the backup control command to the control surface actuator.

Images