Command monitoring backup control architecture

Abstract

Systems, methods, and machine-readable media can facilitate the control of aircraft. Actuators can be controlled based on the following: A first control signal can be output using a first command module to control the actuator. The first command module may include a first electronic configuration. Commands and / or system response signals generated by the first command module can be monitored using a monitoring module. The monitoring module may include a third electronic configuration different from the first electronic configuration. When the first command module is deactivated or malfunctions, a second control signal can be output using a second command module to control the actuator. The second command module may include a second electronic configuration different from the first and third electronic configurations. When the first command module is deactivated or malfunctions, the actuator can be controlled using the second control signal.

Description

[0001] Cross-references to related applications This application claims the benefit of U.S. Provisional Patent Application No. 63 / 594,387, filed October 30, 2023, entitled “COMMAND MONITOR BACKUP CONTROL ARCHITECTURE”, the disclosure of which is incorporated herein by reference in its entirety for all purposes. Technical Field

[0002] This disclosure generally relates to aircraft actuation control electronics and propulsion engine control, and particularly to a command monitoring backup control architecture. Background Technology

[0003] The controllers of an aircraft's actuation and / or propulsion engine units may require mitigation of common-mode failures caused by design and / or manufacturing errors within complex electronic hardware. Since aircraft configurations relatively do not allow for loss of actuation and propulsion functionality, each controller may need to fail operationally in the event of a common-mode failure. In conventional systems, controllers can be used in a command / monitoring module pair. The controller is deactivated when the output of the command module cannot be acknowledged by the monitoring module.

[0004] In conventional aircraft, when critical components of the controller are deactivated, the aircraft can continue operating with significantly reduced resources, and the alternative control path ultimately provides analog signals to the hydromechanical-electric control unit, which, in response to these analog inputs, generates control electricity by modulating the flow of hydraulic fluid. The electrical components of these control units are not complex at all. However, for all electric aircraft, the generation of propulsion and control electricity is directly controlled by local electronic controllers that embody complex electronic components. Furthermore, for unconventional aircraft requiring high system availability, multiple controllers may be deactivated simultaneously in the event of common-mode failure, which could have catastrophic consequences.

[0005] Therefore, solutions are needed to address the challenges and problems that hinder the actuation and / or propulsion engine units of an aircraft. This and other needs are addressed by embodiments according to this disclosure. Summary of the Invention

[0006] According to certain embodiments of this disclosure, it generally relates to aircraft actuation control electronics and propulsion engine control, and particularly to a command monitoring backup control architecture.

[0007] In one aspect, the system can facilitate the control of an aircraft. The system may include one or a combination of the following: A controller can communicate with an actuator. The controller may include a first command module, a second command module, and a monitoring module. The first command module may include a first electronic configuration. The first command module may be configured to output a first control signal to control the actuator. The second command module may include a second electronic configuration different from the first electronic configuration. The second command module may be configured to output a second control signal to control the actuator. The monitoring module may be configured to monitor at least one of: (i) one or more commands generated by the first command module, or (ii) one or more system response signals at least in part based on one or more sensors. The monitoring module may include a third electronic configuration different from the first and second electronic configurations. When the first command module is deactivated or malfunctions, the actuator can be controlled using the second control signal.

[0008] On the other hand, one or more non-transitory machine-readable media having machine-readable instructions thereon, when executed by one or more processing devices, such machine-readable instructions can cause the system to perform one or a combination of the following operations. An actuator communicating with one or more processing devices can be controlled at least in part based on one or a combination of the following: A first control signal can be output using a first command module to control the actuator. The first command module may include a first electronic configuration. When the first command module is deactivated or malfunctions, a second control signal can be output using a second command module to control the actuator. The second command module may include a second electronic configuration different from the first electronic configuration. One or more commands generated by the first command module and / or at least in part based on one or more system response signals from one or more sensors can be monitored using a monitoring module. The monitoring module may include a third electronic configuration different from the first and second electronic configurations. When the first command module is deactivated or malfunctions, the actuator can be controlled using the second control signal.

[0009] On another front, a method can facilitate the control of an aircraft. An actuator communicating with one or more processing devices can be controlled at least partially based on one or a combination of the following: A first command module can output a first control signal to control the actuator. The first command module may include a first electronic configuration. When the first command module is deactivated or malfunctions, a second command module can output a second control signal to control the actuator. The second command module may include a second electronic configuration different from the first electronic configuration. One or more commands generated by the first command module and / or at least partially based on one or more system response signals from one or more sensors can be monitored using a monitoring module. The monitoring module may include a third electronic configuration different from the first and second electronic configurations. When the first command module is deactivated or malfunctions, the actuator can be controlled using the second control signal.

[0010] In various embodiments, the first electronic configuration may be a first hardware configuration, and the second electronic configuration may be a second hardware configuration different from the first hardware configuration. In various embodiments, the first electronic configuration may be a first software configuration, and the second electronic configuration may be a second software configuration different from the first software configuration. In various embodiments, the system may include a propulsion system, which may include actuators. The controller may control the propulsion system at least partially based on a first control signal or a second control signal. In various embodiments, the propulsion system may further include thrusters, and actuators may be coupled to the thrusters. In various embodiments, the aircraft may be an autonomous aircraft. In various embodiments, the controller may be configured to select a second command module for controlling the actuators in response to determining that a first command module is deactivated or malfunctioning.

[0011] In various embodiments, a first command module may receive a set of one or more input signals from a sensor set corresponding to one or more sensors, and may generate a first control signal at least partially based on the set of one or more input signals. A monitoring module may receive a set of one or more input signals from the sensor set. The monitoring module may generate a monitoring signal at least partially based on the set of one or more input signals, may compare the first control signal generated by the first command module with the monitoring signal, and may transmit the first control signal to the actuator if the first control signal matches the monitoring signal. In various embodiments, the monitoring module may suppress the first control signal when the first control signal differs from the monitoring signal. When the first control signal is suppressed, a second control signal may be transmitted to the actuator. In various embodiments, a second command module may receive a set of one or more input signals from the sensor set, and may generate a second control signal at least partially based on the set of one or more input signals.

[0012] In various embodiments, the system can be configured to generate an alarm when the actuator is controlled by a second control signal when the first command module is deactivated or malfunctions.

[0013] Further areas of applicability of this disclosure will become apparent from the detailed description provided below. It should be understood that while the detailed description and specific examples indicate various embodiments, they are intended for illustrative purposes only and are not necessarily intended to limit the scope of this disclosure. Attached Figure Description

[0014] A further understanding of the nature and advantages of the various embodiments can be achieved by referring to the following accompanying drawings. In the drawings, similar components or features may have the same reference labels. Furthermore, various components of the same type may be distinguished by a dash following the reference label and a second label distinguishing them among similar components, or by brackets enclosing the second label after the reference label. If only the first reference label is used in this specification, this description applies to any of the similar components having the same first reference label, regardless of the second reference label.

[0015] Figure 1A and 1B Perspective views of an exemplary aircraft with a tilting fan according to embodiments of the present disclosure are depicted in forward and vertical configurations, respectively.

[0016] Figure 2 An example of an assembled controller according to an embodiment of the present disclosure is shown.

[0017] Figure 3 An example of a controller in the context of a larger control system according to embodiments of the present disclosure is depicted.

[0018] Figure 4 An example of a system architecture for a tilt propulsion system with a backup command module according to an embodiment is described.

[0019] Figure 5 An example of the system architecture of a vertical propulsion system with a backup command module according to an embodiment is described.

[0020] Figure 6 The illustrations depict various aspects of a computer system according to embodiments of the present disclosure, some of which may be incorporated as part of a vehicle management system computer, controller, and / or other components of the aircraft. Detailed Implementation

[0021] The following description provides only one or more preferred exemplary embodiments and is not intended to limit the scope, applicability, or configuration of this disclosure. Rather, the subsequent description of one or more preferred exemplary embodiments will provide those skilled in the art with an enabling description for implementing preferred exemplary embodiments of this disclosure. It should be understood that various changes may be made to the function and arrangement of the elements without departing from the spirit and scope of this disclosure as set forth in the appended claims.

[0022] The aircraft may include a control system, such as a flight control system, which can be configured to control the aircraft. In some embodiments, the aircraft may include an electric vertical takeoff and landing (eVTOL) or electric conventional takeoff and landing (eCTOL) aircraft. According to various embodiments, the eVTOL or eCTOL aircraft may be an autonomous aircraft. The control system may be configurable to control the aircraft automatically and / or based on remote control commands. In some embodiments, the aircraft may be a guided aircraft.

[0023] For example, a control system can control when one or more propulsion systems should be operated, the electrical force supplied to the propulsion systems, and / or other parameters and settings associated with the propulsion systems. The control system can control the propulsion systems based on inputs received from sensor data and / or flight data received from sensors (e.g., sensors measuring air temperature, motor temperature, aircraft airspeed, etc.), computers, and other input / output devices coupled to the aircraft.

[0024] A control system may include one or more controllers. Each controller may be configured to control one or more actuators (or other aircraft components, such as actuators) of the propulsion system. In conventional systems, each controller may include similar electronic components (e.g., hardware and / or software). This can be problematic because each controller may have the same or similar vulnerabilities, and the controllers may potentially all fail simultaneously due to the same root cause.

[0025] In the event of a failure in the electronic control system, conventional aircraft may include a backup control mechanism, such as manual control by a human navigator. However, humans may not be able to manually navigate aircraft with more complex components. In some embodiments, the human navigator may not take manual control of the aircraft (e.g., in the case of autonomous aircraft).

[0026] Embodiments of this disclosure may provide a controller system with a backup control module that can provide flight control functions in the event of a failure of the primary control module. The backup control module may be electronically different from the primary control module (e.g., having different hardware and / or software). As a result, events or other causes of failure that could lead to the malfunction of one or more primary control modules may not cause the backup control module to fail, and thus can prevent the failure of one or more actuators and / or the failure of one or more aircraft propulsion systems.

[0027] Figure 1A A perspective view of an exemplary aircraft with a tilting fan according to an embodiment of the present disclosure in a forward-flying configuration is depicted. Figure 1B A perspective view of an exemplary aircraft with a tilting fan according to an embodiment of the present disclosure in a vertical flight (e.g., lift) configuration is depicted. In various embodiments, aircraft 100 can be any suitable type of flight vehicle, such as an airplane, helicopter, unmanned aerial vehicle, or hybrid flight vehicle. In some embodiments, aircraft 100 may be capable of vertical takeoff and landing (VTOL). Aircraft 100 can be configured for human-guided, remotely guided, and / or autonomous flight. In some embodiments, aircraft 100 can be an autonomous eVTOL aircraft.

[0028] In the illustrated example, aircraft 100 includes a fuselage 104, which may include a cabin portion (e.g., facing the nose) for carrying passengers and / or cargo. A pair of wings, including a first wing 102 and a second wing 103, may be mounted or otherwise attached to the fuselage 104. These wings may be coupled to opposite sides of the fuselage and may have any suitable shape and configuration. For example, the wings may be rectangular straight wings, tapered straight wings, circular or elliptical straight wings, swept wings, delta wings, or any other suitable type of wing. In some embodiments, the first wing 102 and the second wing 103 may be coupled to the fuselage 104 in a high wing configuration. That is, the first wing 102 and the second wing 103 may be mounted on the upper part of the fuselage 104, such as... Figure 1A and 1B As shown in the illustration. In some embodiments, the aircraft may include a single wing coupled to the fuselage.

[0029] The aircraft 100 may also include support structures 106(A)-(F), which can be coupled to wings 102, 103. For example... Figure 1A and 1B Each of the support structures 106(A)-(F) shown can take the form of a hanger, although various embodiments may include any other suitable structure. Figure 1A and1B The diagram shows six support structures 106(A)-(F), of which three support structures 106(A)-(F) are provided under each of the pair of wings 102, 103. The support structures 106(A)-(F) can be coupled to the underside of the pair of wings and can include a forward portion extending beyond the wings and a tail portion extending at the tail of the wings.

[0030] In some embodiments, each of the support structures 106(A)-(F) may be identical, and therefore the support structures 106(A)-(F) may be interchangeable in their positions on the wing. For example, the first support structure 106(A) closer to the fuselage may be interchangeable with an adjacent second support structure 106(B) (e.g., the intermediate boom on the wing) or another third support structure 106(C) (e.g., the boom furthest from the fuselage).

[0031] Propulsion system.

[0032] The aircraft 100 may also include a propulsion system 101(A)-(L). Although in Figure 1A and 1B Twelve propulsion systems 101(A)-(L) are shown, but any suitable number of propulsion systems 101(A)-(L) may be included. The propulsion systems 101(A)-(L) may be coupled to the pair of wings 102, 103 and may be equally divided between the wings. In some embodiments, such as Figure 1A and 1B As shown, one or more of the propulsion systems 101(A)-(L) can be mounted on the support structures 106(A)-(F). For example, pairs of propulsion systems 101(A)-(L) can be mounted on opposite ends of the respective support structures 106(A)-(F), with one propulsion system mounted forward of the wing and the other mounted at the tail of the wing. In other embodiments, one or more of the propulsion systems 101(A)-(L) can be directly coupled to the wing. The number of booms and / or propulsion systems can vary depending on flight requirements and the requirements of the aircraft 100.

[0033] According to various embodiments, each of the propulsion systems 101(A)-(L) can be configured to provide thrust to the aircraft 100. The thrust from one or more of the propulsion systems 101(A)-(L) can be used to move, control, and / or stabilize the aircraft 100. The propulsion systems 101(A)-(L) can take the form of any suitable mechanism for providing thrust. In one example, propulsion system 101 may include a rotor (e.g., a fan). Propulsion system 101 may also include a drive mechanism for the rotor, such as a dedicated motor (e.g., in the case of an electric vehicle).

[0034] The rotor may include any suitable number of rotor blades (e.g., 2 blades, 3 blades, 4 blades, 5 blades, 6 blades, 7 blades, or 8 blades). The rotor blades may have a predetermined angle of attack. In some embodiments, all rotor blades may have the same angle of attack. In other embodiments, at least two rotor blades may have angles of attack different from each other. The rotor blades may be spaced equally or unequally. The rotor may also include a hub. The rotor blades may be attached to the hub. In some embodiments, the rotor blades and the complete hub may be manufactured as a single piece. The hub may provide a central structure to which the rotor blades are connected, and in some embodiments, the hub may be shaped to surround the motor.

[0035] In some embodiments, the motor components may be low-profile so that the entire motor is housed within the rotor hub, exhibiting low resistance to airflow during forward flight. The rotor may be attached to the rotating portion of the motor. The stationary portion of the motor may be attached to a support structure. In some embodiments, the motor may be a permanent magnet motor and may be controlled by an electronic motor controller. The electronic motor controller may send current to the motor in a precise sequence to allow the rotor to rotate at a desired speed or with a desired torque.

[0036] According to various embodiments, one or more of the propulsion systems 101 (A)-(L) can be positioned, oriented, and / or otherwise configured to provide thrust and / or movement to the aircraft 100 in a predefined direction. For example, one or more of the propulsion systems 101 (A)-(L) can be configured to provide upward thrust in the vertical direction. Figure 1A and 1B As shown, these may include propulsion systems 101(A), 101(D), 101(E), 101(F), 101(G), 101(J), 101(K), and / or 101(L). Propulsion systems 101(A)-(L) configured to provide thrust in the vertical direction may also be referred to as vertical fans or lift fans. Vertical fans can be used to generate vertical thrust (e.g., lift) for takeoff, landing, hovering, stabilization, and / or control of aircraft 100.

[0037] According to various embodiments, one or more of the propulsion systems 101(A)-(L) may have a fixed orientation. For example, one or more of the propulsion systems 101(A)-(L) may be mounted in a fixed orientation relative to the corresponding wings 102 or 103, the corresponding support structures 106(A)-(F), and / or the aircraft 100. While the rotor blades of the fixed propulsion system can rotate when activated, the orientation of the propulsion system housing and structure may not be rotatable relative to the aircraft 100. As a result, the fixed propulsion system can be configured to provide thrust in a constant direction relative to the aircraft 100. According to embodiments, the thrust direction and orientation of the fixed propulsion system relative to the aircraft 100 (e.g., fuselage, wings, and / or support structures) may remain unchanged or move regardless of the current direction of activity and / or movement of the aircraft 100 (e.g., both forward flight and vertical flight).

[0038] In other embodiments, one or more of the propulsion systems 101(A)-(L) can be configured to change orientation. For example, one or more of the propulsion systems 101(A)-(L) can be mounted in a manner that allows tilting of the orientation relative to the respective wings 102 or 103, the respective support structures 106(A)-(F), and / or the aircraft 100. As a result, the tilting propulsion system (which may be referred to as a tilt fan) can be configured to provide thrust relative to the aircraft 100 in more than one direction. The tilt fan can be coupled to the respective support structures 106(A)-(F) via one or more tilting mechanisms, which include, for example, motors and coupling mechanisms. According to various embodiments, the tilting mechanism can be controllable and / or configured to change or move the orientation and thrust direction of the tilt fan relative to the aircraft 100 (e.g., fuselage, wings, and / or support structures) based on the current activity, required, and / or direction of movement of the aircraft 100 (e.g., forward flight, vertical flight).

[0039] The rotor blades of propulsion system 101 can be configured with a specific blade pitch. The blade pitch refers to the angle of the blade. The blade pitch can be measured relative to the aircraft body, the propulsion system's spinner, or the plane of rotation. Assuming no slippage, the blade pitch can generally be described as a ratio of the forward distance per revolution. Typically, a low pitch (also known as a fine pitch) can produce good low-speed acceleration and climb rate in an aircraft, while a high pitch (also known as a coarse pitch) can optimize high-speed performance and fuel economy.

[0040] According to an embodiment, one or more rotor blades of the propulsion system 101 may have an adjustable pitch setting. Such a propulsion system may be referred to as a variable pitch propeller. In a variable pitch propeller, the blade pitch of one or more rotor blades can be adjusted during flight. Therefore, the blade pitch can be adjusted based on the flight phase (such as takeoff, climb, or cruise) to optimize thrust and / or efficiency. For example, a fine pitch setting can be used during takeoff and landing, while a coarser pitch setting can be used for high-speed cruise flight. An example of a high pitch used during cruise flight is approximately 40 degrees.

[0041] Any suitable mechanism can be included to achieve pitch adjustment. For example, the rotor blades can be coupled to the corresponding spinner via one or more pitch mechanisms, which include, for example, a motor and a coupling mechanism. According to an embodiment, the pitch mechanism can be controllable and / or configured to change or move the pitch positioning of the rotor blades relative to the spinner (or other part of the propulsion system) based on the current activity, required and / or direction of movement (e.g., forward flight, vertical flight) of the aircraft 100.

[0042] Control system.

[0043] According to various embodiments, aircraft 100 may be an electrically powered aircraft or a hybrid electric aircraft. One or more battery cells may be included in aircraft 100 (e.g., within fuselage 104) and may be configured to provide power to various aircraft components, such as one or more motors and / or onboard computer systems. Propulsion systems 101(A)-(L) may be driven by motors powered by an electrical system comprising one or more battery cells. In some embodiments, each of propulsion systems 101(A)-(L) may be coupled to a dedicated battery cell. Alternatively, there may be a one-to-many relationship between one or more battery cells and propulsion systems 101(A)-(L). In some cases, one or more battery cells may be the sole power source for aircraft 100. Each battery cell may include one or more individual battery cells.

[0044] According to various embodiments, aircraft 100 may include a central control computer 107, such as a flight control system, which may be configured to control aircraft 100. The central control computer 107 may be configurable to control aircraft 100 automatically and / or remotely (e.g., via control signals received from a remote entity, such as a remote controller, remote navigator, or remote control tower). In various embodiments, the central control computer 107 may include one or more computers having one or more non-transitory computer-readable media storing instructions and one or more processors configured to execute the instructions to perform the processing and control functions described herein.

[0045] For example, the central control computer 107 can control when the propulsion system 101(A)-(L) should be operated and / or when electrical force is supplied to the propulsion system 101(A)-(L). The central control computer 107 can be configured to control the propulsion system 101(A)-(L) independently of each other. According to various embodiments, the central control computer 107 can control the propulsion system 101(A)-(L) based on inputs received from a remote controller (e.g., a remote navigator), inputs received from the autopilot, sensor data and / or flight data received from sensors (e.g., sensors measuring air temperature, motor temperature, aircraft airspeed, etc.), computers, and other input / output devices coupled to the aircraft.

[0046] The central control computer 107 can also control one or more tilting mechanisms to switch the positioning of one or more tilting fans from a forward flight position to a vertical position, and from a vertical position to a forward flight position. According to various embodiments, the central control computer 107 can control the tilting fans between the two positions based on sensor data and / or flight data received from sensors (e.g., sensors measuring air temperature, motor temperature, aircraft airspeed, etc.), a computer, and other input / output devices coupled to the aircraft.

[0047] The central control computer 107 can also control one or more pitch mechanisms to switch the positioning of one or more rotor blades between two or more pitch positions. According to various embodiments, the central control computer 107 can control the rotor blade pitch positioning based on sensor data and / or flight data received from sensors (e.g., sensors measuring air temperature, motor temperature, aircraft airspeed, etc.), a computer, and other input / output devices coupled to the aircraft.

[0048] Therefore, the central control computer 107 can be configured to convert navigator or other operator inputs and / or corrections calculated by the onboard computer into forces and torques, and / or further convert such forces and torques into actuator assemblies (e.g., vertical lift rotors; propellers; control surfaces such as ailerons; etc.) and / or associated parameters (e.g., lift fan power, pitch, speed, or torque) to provide the required forces and torques. For example, navigator or other operator inputs may indicate desired changes in aircraft speed, direction, and / or orientation, and / or wind or other forces may act on the aircraft, requiring the propulsion system and / or other actuators to be used to maintain the desired aircraft attitude (roll / pitch / yaw), speed, and / or altitude.

[0049] Backup controller module.

[0050] The aircraft may include one or more controllers 200, which are local to one or more actuators (e.g., in some embodiments, the controller 200 may be adjacent to the actuators). For example, each propulsion system or a pair of propulsion systems may have a dedicated controller configured to control one or more actuators of the propulsion system (e.g., electric, tilt, pitch, etc.). Embodiments may allow any suitable number of controllers for any suitable number of actuators to be included in the aircraft 100 and located in any suitable location within the aircraft 100.

[0051] Figure 2 An example of a simplified controller 200 according to an embodiment of the present disclosure is shown. The controller 200 may include a first command module 201, a monitoring module 202, and a second command module 203. Each of the first command module 201, the monitoring module 202, and the second command module 203 may be mounted on a chassis, a tower, and / or any other suitable structural support.

[0052] Each of the first command module 201, monitoring module 202, and / or second command module 203 may take the form of an electronic device. For example, the electronic device may include a printed circuit board assembly (PCBA), a field-programmable transistor array (FPTA), one or more computer processors (e.g., microprocessors), and / or any other suitable electronic hardware component. The electronic device may also include any suitable software having instructions for performing one or more processes.

[0053] Each of the first command module 201, monitoring module 202, and / or second command module 203 can be configured to receive information from one or more sensors, as well as information related to flight path, flight direction, or flight commands. The first command module 201, monitoring module 202, and / or second command module 203 can also be configured to determine one or more command instructions based on sensor and other flight information to control one or more actuators or other aircraft components, thereby providing a desired flight outcome. According to various embodiments, each of the first command module 201, monitoring module 202, and / or second command module 203 can have a different electronic configuration. For example, the first command module 201 can have a first electronic configuration, the second command module 203 can have a second electronic configuration, and the monitoring module 202 can have a third electronic configuration.

[0054] The controller 200 can be configured to provide dual routes with a backup architecture. The monitoring module 202 can be configured to monitor the command module 201. For example, the monitoring module 202 can also be configured to receive and analyze commands generated by the first command module 201 and determine whether these commands are correct. In some embodiments, the monitoring module 202 can compare commands generated locally at the monitoring module 202 (i.e., monitoring signals) with commands received from the first command module 201 to determine whether they match within a predetermined threshold. For example, the monitoring module 202 can be configured to monitor signals from one or more vehicle management system computers (VMSCs) and, in response to such signals, replicate commands using a set of operations, hardware configurations, and / or software configurations that have a certain degree of dissimilarity relative to the first command module 201. Additionally or alternatively, the monitoring module 202 can be configured to at least partially base its data on one or more sensors received from one or more actuators (e.g., by means of...). Figure 3 The monitoring module 202 generates commands (i.e., monitoring signals) by using a set of one or more input signals from the drive health monitor 241 (described in the diagram). Therefore, the monitoring module 202 can calculate the commands that the command module 201 should calculate. In this way, the monitoring module 202 can simultaneously create a reference monitoring signal in the second flight path, which masks the command line in the first flight path being monitored.

[0055] The monitoring module 202 can compare the command signals (i.e., one or more first control signals) in the first route and the reference signals (i.e., one or more monitoring signals) generated by secondary calculation in the second route with an integrated or separate comparison logic component, which may, for example, be with the switch control logic 236 (which in... Figure 3The command signal in the first route (described in the diagram, and in some embodiments may be part of the MON route) corresponds to the command signal in the second route. When the command signal in the first route is determined to match the monitoring signal in the second route, the command signal in the first route can be transmitted (e.g., in various embodiments, by the first command module 201 or the monitoring module 202) to actuator 1 and / or 2 (e.g., by means of a monitoring module 202). Figure 3 The switch 230 depicted can be independent of the illustrated command module 201. When a difference exists between two routes, causing one or more commands generated by the first command module 201 to mismatch with one or more monitoring signals generated by the monitoring module 202, this can be considered an indication that the first command module 201 is malfunctioning (or deactivated, e.g., if the monitoring module 202 and / or switching logic 236 determine that there is no signal, or indicates a deactivation signal from the first control module 201). Therefore, a flag can be generated to trigger switch 230 to switch to the second command module 203, causing the second command module 203 to control one or more actuators. In various embodiments, the switch 230 can be included in one or more of the central control computer 107 (e.g., VMSC), or separate from one or more of the central control computer 107 (e.g., VMSC). In various embodiments, the switch 230 can be directly controlled or controlled via one or more of the control system. Therefore, if a command (i.e., a first control signal) from the first command module 201 is mismatched, otherwise inconsistent, or not approved by the monitoring module 202, the monitoring module 202 can be configured to prevent / suppress the use of that command to control actuators or aircraft components. In such an event, the controller 200 (e.g., the monitoring module 202 using switch control logic 236) can cause switch 230 to electrically disconnect the first command module 201 from one or more actuators and electrically connect the second command module 203 to one or more actuators, such that one or more commands (i.e., one or more second control signals) from the second command module 203 are transmitted to one or more actuators.

[0056] According to embodiments, the second command module 203 can be configured to provide a backup option in case the first command module 201 fails or malfunctions. For example, if the monitoring module 202 and the first command module 201 are inconsistent regarding the next action, the second command module 203 can take over the operation of the controller and can provide commands to the actuators controlled by the controller 200. According to various embodiments, the second command module 203 may not be associated with the monitoring module. That is, the second command module 203 may not be actively monitored. If the command / monitoring pair (e.g., the first command module 201 and the monitoring module 202) is found to be invalid or malfunctioning, the backup module (e.g., the second command module 203) can restart control of the controller 200.

[0057] The second command module 203 (which may also be referred to as the backup control module) may be electrically different from the first command module 201 (which may also be referred to as the main control module) in one or more ways. Similarly, in some embodiments, the monitoring module 202 may also be electrically different from the first command module 201 and / or the second command module 203 (e.g., three sets of electrically different modules). For example, the first command module 201, the monitoring module 202, and the second command module 203 may each include one or more hardware components (e.g., processor, configuration, other circuitry, etc.) that are different from the other modules. Additionally or alternatively, the first command module 201, the monitoring module 202, and the second command module 203 may each include one or more software components (e.g., programming language, programmed instructions, etc.) that are different from the other modules. According to various embodiments, the second command module 203 is functionally similar to the first command module 201. In some embodiments, although the second command module 203 may still be configured to provide one or more control functions by one or more actuators, the second command module 203 may be electrically and / or functionally simpler than the first command module 201, with simpler hardware and / or software configuration, less complex, and therefore potentially more efficient and reliable.

[0058] A malfunction or other event at the first command module 201 may be related to the electronics and configuration of the first command module 201. Advantageously, due to the difference in electronics at the second command module 203, the second command module 203 may be unaffected by the same event or trigger. As a result, the second command module 203 remains operational even when the first command module 201 is not in operation. Even when the first command module 201 is unavailable, the same controller can continue to operate using the second command module 203. This sophisticated redundancy enhances the safety of the aircraft 100 and meets safety-based certification standards.

[0059] Referring back to Figure 1, as an example, aircraft 100 may include twelve propulsion systems 101(A)-(L). To maintain control during flight of aircraft 100, the assembly of propulsion systems 101(A)-(L) can be operated in precise coordination. A central control computer 107 can be configured to rapidly process sensor data to determine, at each passing moment, how to operate each of the propulsion systems 101(A)-(L) as well as other control surfaces and components on aircraft 100. In some embodiments, this complex arrangement of control components may exceed the operational capabilities of a human navigator. From a human navigator's perspective, there may be too many individual components to control, and the speed and complexity of calculations and adjustments are beyond human capability. Therefore, in the event that the first command module 201 becomes impaired, relying on a human operator to manually navigate aircraft 100 may be impractical. Therefore, the second command module 203 can provide a new type of redundancy for flight operations because it enables the controller to continue to control the complex mechanisms of the aircraft 100 even if the first command module 201 fails, rather than relying on more primitive backup control options (e.g., manual human navigation) that may not be sufficient for certain types of aircraft.

[0060] Figure 3 An example of a controller 200 within a larger control system context according to embodiments of the present disclosure is depicted. One or more vehicle management system computers (VMSC 1, 2, and 3) can communicate with each of the first command module 201, monitoring module 202, and second command module 203. VMSC 1, 2, and 3 can be as described above regarding... Figure 1A and 1B This is part of the central control computer 107 described. The central control computer 107 (e.g., VMSC 1, 2, and 3) can determine whether to activate the second command module 203 based on communication with the first command module 201, the monitoring module 202, and the second command module 203.

[0061] The first command module 201, monitoring module 202, and second command module 203 may each include command selection components 210, 211, and 212, respectively. Command selection components 210, 211, and 212 are configured to receive signals from VMSCs 1, 2, and 3 and generate corresponding commands. Command selection component 211 of monitoring module 202 may simultaneously create a reference signal in the second flight path, which obscures the command line in the monitored first flight path, including the one from which command selection component 210 is located. The first command module 201, monitoring module 202, and second command module 203 may each include loop closure and communication components 215, 216, and 217, respectively. Loop closure and communication components 215, 216, and 217 are each configured to receive commands from command selection components 210, 211, and 212, which are communicatively coupled to each other. The loop closure and communication components 215 and 217 can be communicatively coupled to the pulse width modulator (PWM) pulse sequence components 220 and 221, respectively, which are configured to generate pulse sequence signals to the corresponding PWM drive buffers 225 and 226.

[0062] PWM drive buffers 225 and 226 can be communicatively coupled to switch 230, which is configured to switch between PWM drive buffers 225 and 226 to selectively connect one of them to power electronic devices A and B, which drive the motors of actuators 1 and 2, respectively. Therefore, a first command module 201 can be configured to output control signals (e.g., a first control signal, a first set of one or more controls, etc.) to control actuators 1 and 2, and a second command module 203 can be configured to output control signals (e.g., a second control signal, a second set of one or more controls, etc.) to control actuators 1 and 2. In some embodiments, the second command module 203 can output control signals for actuators 1 and 2 even if switch 230 does not electrically connect the second command module 203 to power electronic devices A and B, and is therefore electrically connected to actuators 1 and 2. In other embodiments, the second command module 203 may output control signals for actuators 1 and 2 only when the switch 230 electrically connects the second command module 203 to power electronic devices A and B and thus electrically to actuators 1 and 2.

[0063] Loop closure and communication components 215, 216 may be communicatively coupled to electronic command comparison component 235, which may be part of switch control logic 236. In some embodiments, command comparison component 235 and / or switch control logic 236 may be decoupled from monitoring module 202. In some embodiments, monitoring module 202 may include command comparison component 235 and / or switch control logic 236; therefore, switch control logic 236 may be part of the MON route. Drive health monitors 240, 241, 242 may be configured to monitor actuators 1, 2 via communicatively coupled sensors. Thus, for example, first command health module 201 may receive a set of one or more input signals from sensors by means of coupled drive health monitor 240, and in some embodiments, first command health module 201 may generate an output control signal (e.g., a first control signal) at least in part based on one or more input signals from one or more sensors associated with one or more actuators. Monitoring module 202 can also receive a set of one or more input signals from sensors via coupled drive health monitor 241, and in some embodiments, monitoring module 202 can generate monitoring signals at least in part based on one or more input signals from one or more sensors associated with one or more actuators. Second command module 203 can also receive a set of one or more input signals from sensors via coupled drive health monitor 242, and in some embodiments, second command health module 203 can generate output control signals (e.g., a second control signal) at least in part based on one or more input signals from one or more sensors. The outputs of drive health monitors 240, 241 can be provided to switch control logic 236.

[0064] According to some embodiments, VMSC 3 can be a different backup VMSC, where the backup VMSC calculates commands for the second command module 203. That is, VMSC 3 may be different from VMSC1 and VMSC 2, which calculate commands for the first command module 201 and monitoring module 202, respectively. Therefore, the backup controller (i.e., the second command module 203) may depend on the commands calculated by the flight control computer (FCC) (e.g., the VMSC), due to the significantly increased complexity of controlling eVTOL compared to conventional jet transport aircraft. This provides FCC redundancy for eVTOL aircraft.

[0065] In various embodiments, if the instructions received from the first command module 201 and / or the flight analysis are not verified by the information received from the monitoring module 202, one or more of VMSCs 1, 2, and 3, or controller 200, may determine to deactivate, disconnect, or otherwise ignore the first command module 201. VMSCs 1, 2, and / or 3, or controller 200, may then activate or otherwise enable the second command module 203 to provide control signals to the power electronics A and B of the motors of actuators 1 and 2, for example, by switching switch 230 to electrically disconnect the first command module 201 from power electronics A and B and electrically connect the second command module 203 to power electronics A and B. According to various embodiments, when the first command module 201 is deactivated and / or malfunctions and the second command module 203 provides control signals to actuators 1 and 2, an alarm may be provided to the aircraft's controller (e.g., a remote supervisor monitoring the flight of the unmanned aerial vehicle). In some embodiments, the flight path of the aircraft may be altered when the backup controller (i.e., the second command module 203) is activated. For example, a fail-safe flight path can be activated to allow the aircraft to land safely.

[0066] In some embodiments, if the instructions received from the first command module 201 and / or the flight analysis are not verified by the information received from the monitoring module 202, the controller 200 (e.g., the monitoring module 202 having switch control logic 236) can determine to deactivate, disconnect, or ignore the first command module 201 (e.g., using switch control logic 236). For example, when the controller 200 (e.g., the monitoring module 202 having switch control logic 236) detects that one or more commands generated by the first command module 201 do not match one or more reference commands generated by the monitoring module 202, the controller 200 can use the control switch 230 to electrically disconnect the first command module 201 from the power electronic devices A and B and electrically connect the second command module 203 to the power electronic devices A and B, switching from the first command module 201 (e.g., the monitoring module 202 having switch control logic 236) to the second command module 203. While in some embodiments the activation of switch 230 from first command module 201 to second command module 203 may be caused by one or more of the VMSCs, in some embodiments the activation of switch 230 may be caused by controller 200 (e.g., in various embodiments, by the operation of switch control logic 236 which may be integrated with or separate from monitoring module 202).

[0067] In some embodiments, for redundancy purposes, the controller may include two or more pairs of main control modules and monitoring modules. A backup control module may be provided in such a controller to generate control signals for the controller in the event of failure of multiple pairs of main control modules and monitoring modules.

[0068] Figure 4 and Figure 5 An example of a hardware system architecture for a propulsion system including a backup command module according to an embodiment is described. Figure 4 The diagram illustrates the architecture of the tilt propulsion system, and Figure 5 The diagram illustrates the structure of a fixed vertical propulsion system. Two architectures can include a controller 200 with a command module, a monitoring module, a comparison module, and a DC voltage inverter. The controller 200 can be coupled to a motor, which in turn can be coupled to a propeller. Figure 4 The tilt propulsion system can include a variable pitch propeller and a tilt actuator, while Figure 5 A vertical propulsion system may include a fixed-pitch propeller.

[0069] Figure 4 and Figure 5 The architecture illustrated may also include a second command module 203 (e.g., a monitoring module 202 in addition to the first command module 201) that communicates with the selection module. As a result, as discussed above, the second command module 203 can provide redundant and complex electronic hardware components different from the first command module 201. Figure 4 and Figure 5 As noted herein, the second command module 203 can provide new protection against common-mode failure because the first command module 201 and the second command module 203 include different electronic devices and are therefore less susceptible to the same failure mode.

[0070] The embodiments can provide robust fault containment and control for each actuator to a third distinct backup module in each controller 200 by means of distinct command and monitoring modules (e.g., COM / MON line pairs). The embodiments can provide distinct command / monitoring module pairs to provide high integrity detection of malfunctions in any of the complex electronics that make up the command / monitoring module pairs. In the event of a failure or malfunction in one of these modules, the controller 200 can switch control to the distinct backup line, thereby allowing continued operation. The embodiments can allow continued operation of a given type of controller 200 after a failure of complex electronics (e.g., in the case of common-mode failure of all devices of a specific type disabled). Therefore, the embodiments mitigate the effects of common-mode failure of complex electronics. As described herein, the controller 200 including the backup command module can be used in conjunction with actuation control electronics and a propulsion engine control unit.

[0071] Various embodiments may provide an aircraft including a fuselage; a pair of wings coupled to opposite sides of the fuselage; one or more propulsion systems coupled to a first wing of the pair of wings; and one or more propulsion systems coupled to a second wing of the pair of wings. Each propulsion system may include a propeller; an actuator coupled to the propeller; and a controller in communication with the actuator. The controller includes a first command module including a first electronic configuration, wherein the first command module is configured to output a first control signal to control the actuator; a monitoring module configured to monitor the first control signal output by the first command module; and a second command module including a second electronic configuration different from the first electronic configuration, wherein the actuator is controlled using the second control signal when the first command module is deactivated or malfunctions.

[0072] While the above description primarily concerns the propulsion system controller, a backup command module can be included in any suitable electronic components and systems of the aircraft.

[0073] Figure 6 The illustrations depict various aspects of a computer system 600 according to an embodiment of the present disclosure, some of which may be incorporated as part of one or more vehicle management system computers, controllers 200, and / or other components of an aircraft. Figure 6 A schematic illustration of one embodiment of a computer system 600 is provided, which can perform various steps of the methods provided by various embodiments. It should be noted that... Figure 6 This is intended only to provide a generalized description of the various components, any one or all of which can be appropriately utilized. Therefore, Figure 6 It extensively illustrates how individual system components can be implemented in a relatively discrete or relatively more integrated manner.

[0074] The illustrated computer system 600 includes hardware components that can be electrically connected (or otherwise communicate with) via a bus 605. The hardware components may include one or more processors 610, including but not limited to one or more general-purpose processors and / or one or more special-purpose processors (such as digital signal processing chips, graphics accelerators, video decoders, and / or the like); one or more input devices 615, which may include, but are not limited to, a mouse, keyboard, remote controls, any suitable operator interface, and / or the like; and one or more output devices 620, which may include, but are not limited to, display devices and / or the like.

[0075] The computer system 600 may also include (and / or communicate with therewith) one or more non-transitory storage devices 625, which may include, but are not limited to, local and / or network-accessible storage devices, and / or may include, but are not limited to, disk drives, drive arrays, optical storage devices, solid-state storage devices, such as random access memory (“RAM”) and / or read-only memory (“ROM”), which are programmable, flash-updatable, and / or the like. Such storage devices may be configured to implement any suitable data storage device, including but not limited to various file systems, database structures, and / or the like.

[0076] Computer system 600 may also include communication subsystem 630, which may include, but is not limited to, modems, network interface cards (wireless or wired), infrared communication devices, wireless communication devices and / or chipsets (such as... The communication subsystem 630 may be equipped with devices such as 802.11 devices, Wi-Fi devices, WiMAX devices, cellular communication devices, etc., and / or the like. The communication subsystem 630 may permit the exchange of data with networks (as an example, such as those described below), other computer systems, and / or any other devices described herein. In many embodiments, as described above, the computer system 600 will also include working memory 635, which may include RAM or ROM devices.

[0077] Computer system 600 may also include software elements, shown as currently residing within working memory 635, including operating system 640, device drivers, executable libraries and / or other code (e.g., configuring computer system 600 to perform the operations of the methods, thereby facilitating control of the aircraft disclosed herein), such as one or more application programs 645, which may include computer programs provided by various embodiments and / or may be designed to implement the methods and / or configure the system as described herein by other embodiments. By way of example only, one or more programs described with respect to the methods(one or more) discussed above may be implemented as code and / or instructions executable by a computer (and / or a processor within a computer); then, in one aspect, such code and / or instructions may be used to configure and / or adapt a general-purpose computer (or other device) to perform one or more operations according to the described methods.

[0078] The collection of these instructions and / or codes, including instructions and / or codes to configure computer system 600 to perform operations that facilitate control of the aircraft disclosed herein, may be stored on a non-transitory computer-readable storage medium, such as one or more non-transitory storage devices 625 described above. In some cases, the storage medium may be incorporated within a computer system (such as computer system 600). In other embodiments, the storage medium may be separable from the computer system (e.g., a removable medium, such as an optical disc), and / or provided in an installation package, such that the storage medium can be used to program, configure, and / or adapt to a general-purpose computer on which instructions / code are stored. These instructions may take the form of executable code executable by computer system 600, and / or may take the form of source code and / or installable code, which, when compiled and / or installed on computer system 600 (e.g., using any of a variety of generally available compilers, installers, compression / decompression utilities, etc.), then take the form of executable code.

[0079] As mentioned above, in one aspect, some embodiments may employ a computer system (such as computer system 600) to perform the methods according to various embodiments. According to the set of embodiments, some or all of the program of such a method is executed by computer system 600 in response to processor 610 executing one or more sequences of instructions contained in working memory 635 (which may be incorporated into operating system 640 and / or other code, such as application 645). Such instructions may be read into working memory 635 from another computer-readable medium (such as one or more of non-transitory storage devices 625). By way of example only, execution of the sequence of instructions contained in working memory 635 may cause processor (one or more) 610 to execute one or more programs of the method to facilitate control of the aircraft described herein.

[0080] As used herein, the terms “machine-readable medium,” “computer-readable storage medium,” and the plural forms of the foregoing refer to any medium or medium involved in providing data that causes a machine to operate in a particular manner. These media may be non-transitory. In embodiments implemented using computer system 600, various computer-readable media may be involved in providing instructions / code to processor(s) 610 for execution, and / or may be used to store and / or carry such instructions / code. In many embodiments, computer-readable media are physical and / or tangible storage media. Such media may take the form of non-volatile or volatile media. Non-volatile media include, for example, optical discs and / or magnetic disks, such as one or more non-transitory storage devices 625. Volatile media include, but are not limited to, dynamic memory, such as working memory 635.

[0081] Common forms of physical and / or tangible computer-readable media include, for example, floppy disks, hard disks, magnetic tapes or any other magnetic media, CD-ROMs, any other optical media, any other physical media with marked patterns, RAM, PROMs, EPROMs, FLASH-EPROMs, any other memory chips or cassette tapes, or any other media from which a computer can read instructions and / or code.

[0082] Various forms of computer-readable media may be used to load one or more sequences of one or more instructions to processor(s) 610 for execution. By way of example only, the instructions may initially be carried on a disk and / or optical disk of a remote computer. The remote computer may load the instructions into its dynamic memory and transmit the instructions as signals to be received and / or executed by computer system 600 via a transmission medium.

[0083] The communication subsystem 630 (and / or its components) will generally receive signals, and the bus 605 may load signals (and / or data, instructions, etc. carried by the signals) to the working memory 635, from which one or more processors 610 retrieve and execute instructions. Instructions received by the working memory 635 may optionally be stored on a non-transitory storage device 625 before or after execution by one or more processors 610.

[0084] For simplicity, various active and passive circuit components are not shown in the figures. Embodiments of this disclosure have been described in the foregoing specification with reference to numerous specific details, which may vary depending on the implementation. Therefore, the specification and drawings are to be considered illustrative rather than restrictive. The unique and exclusive indications of the scope of this disclosure, and the content intended by the applicant for the scope of this disclosure, are the literal and equivalent scope of the set of claims published in this application, in the specific form of such claims, including any subsequent corrections. Specific details of particular embodiments may be combined in any suitable manner without departing from the spirit and scope of the embodiments of this disclosure.

[0085] The electronic components of the described embodiments may be specifically constructed for the claimed purpose or may include one or more general-purpose computers that can be selectively activated or reconfigured by computer programs stored in the computers. Such computer programs may be stored in computer-readable storage media such as, but not limited to, any type of disk, including floppy disks, optical disks, DVDs, CD-ROMs, magneto-optical disks, read-only memory (ROM), random access memory (RAM), EPROM, EEPROM, magnetic cards or optical cards, application-specific integrated circuits (ASICs), or any type of media suitable for storing electronic instructions, and each may be coupled to a computer system bus.

[0086] Additionally, spatially relative terms, such as “front” or “back” and the like, may be used to describe the relationship of an element and / or feature to one or more other elements and / or one or more other features, for example, as illustrated in the accompanying drawings. It will be understood that, in addition to the orientations depicted in the drawings, the spatially relative terms are intended to cover different orientations of the device during use and / or operation. For example, if the device in the drawings is flipped, an element then described as the “front” surface may be “back” oriented with respect to other elements or features. The device may be oriented in other ways (e.g., rotated 90 degrees or at other orientations), and the spatially relative descriptors used herein are interpreted accordingly.

[0087] Although embodiments have been described with reference to specific examples, those skilled in the art who will be able to access this disclosure will appreciate that variations and modifications are possible.

[0088] It should be understood that all numerical values ​​used in this document are for illustrative purposes and are subject to change. In some cases, ranges are specified to provide meaning for the scale, but this does not exclude numerical values ​​outside the published ranges.

[0089] It should also be understood that all figures herein are intended to be illustrative. Unless specifically indicated otherwise, the figures are not intended to suggest any particular physical arrangement of the elements shown therein, or that all elements shown are necessary. Those skilled in the art, upon obtaining this disclosure, will understand that elements shown in the figures or otherwise described in this disclosure may be modified or omitted, and that other elements not shown or described may be added.

[0090] The above description is illustrative and not restrictive. Many variations will become apparent to those skilled in the art upon review of this disclosure. Therefore, the scope of patent protection should not be determined by reference to the above description, but rather by reference to the following claims and their full scope or equivalents. Claims (as amended under Article 19 of the Treaty) 1. A system for facilitating the control of an aircraft, the system comprising: A controller that communicates with the actuator, the controller comprising: A first command module, the first command module including a first electronic configuration, wherein the first command module is configured to output a first control signal to control the actuator; A second command module, comprising a second electronic configuration different from the first electronic configuration, wherein the second command module is configured to output a second control signal to control the actuator; and A monitoring module configured to monitor one or more of the following: (i) one or more commands generated by the first command module, or (ii) one or more system response signals based at least in part on one or more sensors, wherein the monitoring module includes a third electronic configuration different from the first electronic configuration and the second electronic configuration, wherein the monitoring module is configured to output a monitoring signal; When the first command module is deactivated or malfunctions, the actuator is controlled using the second control signal; and When the first control signal is different from the monitoring signal, the monitoring module suppresses the first control signal and electrically connects to the second command module, so that the second control signal is transmitted to the actuator. 2. The system for facilitating the control of an aircraft according to claim 1, wherein: The first electronic configuration is the first hardware configuration; The second electronic configuration is a second hardware configuration that is different from the first hardware configuration; and The first command module, the second command module, and the monitoring module are arranged in a stacked structure and are positioned at corresponding levels of the stacked structure. 3. The system for facilitating the control of an aircraft according to claim 1, wherein the first electronic configuration is a first software configuration, and wherein the second electronic configuration is a second software configuration different from the first software configuration. 4. The system for facilitating the control of an aircraft according to claim 1, further comprising: A propulsion system, the propulsion system including an actuator, wherein the controller controls the propulsion system at least in part based on either the first control signal or the second control signal. 5. The system for facilitating the control of an aircraft according to claim 4, wherein the propulsion system further comprises a propeller, and the actuator is coupled to the propeller. 6. The system for facilitating the control of an aircraft according to claim 1, wherein the aircraft is an autonomous aircraft. 7. The system for facilitating the control of an aircraft according to claim 1, wherein the controller is configured to select a second command module for controlling the actuator in response to determining that the first command module is deactivated or malfunctioning. 8. The system for facilitating the control of an aircraft according to claim 1, wherein: The first command module receives a set of one or more input signals from a set of sensors corresponding to the one or more sensors, and generates the first control signal based at least in part on the set of one or more input signals; The monitoring module receives a set of one or more input signals from the sensor set; and The monitoring module generates the monitoring signal at least in part based on the set of the one or more input signals, and transmits the first control signal to the actuator if the first control signal matches the monitoring signal. 9. The system for facilitating the control of an aircraft according to claim 8, wherein the second command module receives a set of the one or more input signals from the set of sensors and generates the second control signal based at least in part on the set of the one or more input signals. 10. The system for facilitating the control of an aircraft according to claim 1, wherein the system is configured to generate an alarm when the actuator is controlled using the second control signal when the first command module is deactivated or malfunctions. 11. One or more non-transitory machine-readable media having machine-readable instructions thereon, which, when executed by one or more processing devices, cause a system to perform operations, said operations including: The actuators communicating with the one or more processing devices are controlled based at least in part on the following: The actuator is controlled by outputting a first control signal using a first command module, wherein the first command module includes a first electronic configuration. When the first command module is deactivated or malfunctions, a second control signal is output using the second command module to control the actuator, wherein the second command module includes a second electronic configuration different from the first electronic configuration; and The monitoring module monitors at least one of the following: (i) one or more commands generated by the first command module, or (ii) one or more system response signals based at least in part on one or more sensors, wherein the monitoring module includes a third electronic configuration different from the first electronic configuration and the second electronic configuration, wherein the monitoring module is configured to output a monitoring signal; When the first command module is deactivated or malfunctions, the actuator is controlled using the second control signal; and When the first control signal is different from the monitoring signal, the monitoring module suppresses the first control signal and electrically connects to the second command module, so that the second control signal is transmitted to the actuator. 12. The one or more non-transitory machine-readable media of claim 11, wherein the first electronic configuration is a first hardware configuration, and wherein the second electronic configuration is a second hardware configuration different from the first hardware configuration. 13. The one or more non-transitory machine-readable media of claim 11, wherein the first electronic configuration is a first software configuration, and wherein the second electronic configuration is a second software configuration different from the first software configuration. 14. One or more non-transitory machine-readable media according to claim 11, wherein: The first command module receives a set of one or more input signals from a set of sensors, and generates the first control signal based at least in part on the set of one or more input signals; The monitoring module receives a set of one or more input signals from the sensor set; and The monitoring module generates a monitoring signal at least in part based on the set of one or more input signals, compares the first control signal generated by the first command module with the monitoring signal, and transmits the first control signal to the actuator if the first control signal matches the monitoring signal. 15. The one or more non-transitory machine-readable media of claim 14, wherein the second command module receives a set of the one or more input signals from the set of sensors and generates the second control signal based at least in part on the set of the one or more input signals. 16. The operation of one or more non-transitory machine-readable media according to claim 11 further includes generating an alarm when the actuator is controlled using the second control signal when the first command module is deactivated or malfunctions. 17. A method for facilitating the control of an aircraft, the method comprising: The actuators communicating with one or more processing devices are controlled based at least in part on the following: The actuator is controlled by outputting a first control signal using a first command module, wherein the first command module includes a first electronic configuration. When the first command module is deactivated or malfunctions, a second control signal is output using the second command module to control the actuator, wherein the second command module includes a second electronic configuration different from the first electronic configuration; and The monitoring module monitors at least one of the following: (i) one or more commands generated by the first command module, or (ii) one or more system response signals based at least in part on one or more sensors, wherein the monitoring module includes a third electronic configuration different from the first and second electronic configurations, and wherein the monitoring module is configured to output a monitoring signal; and When the first command module is deactivated or malfunctions, the actuator is controlled using the second control signal; and When the first control signal is different from the monitoring signal, the monitoring module suppresses the first control signal and electrically connects to the second command module, so that the second control signal is transmitted to the actuator.

Claims

1. A system for facilitating the control of an aircraft, the system comprising: A controller that communicates with the actuator, the controller comprising: A first command module, the first command module including a first electronic configuration, wherein the first command module is configured to output a first control signal to control the actuator; A second command module, comprising a second electronic configuration different from the first electronic configuration, wherein the second command module is configured to output a second control signal to control the actuator; and A monitoring module is configured to monitor one or more of the following: (i) one or more commands generated by the first command module, or (ii) one or more system response signals based at least in part on one or more sensors, wherein the monitoring module includes a third electronic configuration different from the first electronic configuration and the second electronic configuration; When the first command module is deactivated or malfunctions, the actuator is controlled using the second control signal.

2. The system for facilitating the control of an aircraft according to claim 1, wherein the first electronic configuration is a first hardware configuration, and wherein the second electronic configuration is a second hardware configuration different from the first hardware configuration.

3. The system for facilitating the control of an aircraft according to claim 1, wherein the first electronic configuration is a first software configuration, and wherein the second electronic configuration is a second software configuration different from the first software configuration.

4. The system for facilitating the control of an aircraft according to claim 1, further comprising: A propulsion system, the propulsion system including an actuator, wherein the controller controls the propulsion system at least in part based on either the first control signal or the second control signal.

5. The system for facilitating the control of an aircraft according to claim 4, wherein the propulsion system further comprises a propeller, and the actuator is coupled to the propeller.

6. The system for facilitating the control of an aircraft according to claim 1, wherein the aircraft is an autonomous aircraft.

7. The system for facilitating the control of an aircraft according to claim 1, wherein the controller is configured to select a second command module for controlling the actuator in response to determining that the first command module is deactivated or malfunctioning.

8. The system for facilitating the control of an aircraft according to claim 1, wherein: The first command module receives a set of one or more input signals from a set of sensors corresponding to the one or more sensors, and generates the first control signal based at least in part on the set of one or more input signals; The monitoring module receives a set of one or more input signals from the set of sensors; as well as The monitoring module generates a monitoring signal at least in part based on the set of one or more input signals, compares the first control signal generated by the first command module with the monitoring signal, and transmits the first control signal to the actuator if the first control signal matches the monitoring signal.

9. The system for facilitating the control of an aircraft according to claim 8, wherein when the first control signal is different from the monitoring signal, the monitoring module suppresses the first control signal, wherein when the first control signal is suppressed, the second control signal is transmitted to the actuator.

10. The system for facilitating the control of an aircraft according to claim 8, wherein the second command module receives a set of the one or more input signals from the set of sensors and generates the second control signal based at least in part on the set of the one or more input signals.

11. The system for facilitating the control of an aircraft according to claim 1, wherein the system is configured to generate an alarm when the actuator is controlled using the second control signal when the first command module is deactivated or malfunctions.

12. One or more non-transitory machine-readable media having machine-readable instructions thereon, which, when executed by one or more processing devices, cause a system to perform operations, said operations including: The actuators communicating with the one or more processing devices are controlled based at least in part on the following: The actuator is controlled by outputting a first control signal using a first command module, wherein the first command module includes a first electronic configuration. When the first command module is deactivated or malfunctions, the second command module outputs a second control signal to control the actuator, wherein the second command module includes a second electronic configuration that is different from the first electronic configuration. as well as The monitoring module monitors at least one of the following: (i) one or more commands generated by the first command module, or (ii) one or more system response signals based at least in part on one or more sensors, wherein the monitoring module includes a third electronic configuration that is different from the first electronic configuration and the second electronic configuration; When the first command module is deactivated or malfunctions, the actuator is controlled using the second control signal.

13. One or more non-transitory machine-readable media according to claim 12, wherein the first electronic configuration is a first hardware configuration, and wherein the second electronic configuration is a second hardware configuration different from the first hardware configuration.

14. The one or more non-transitory machine-readable media of claim 12, wherein the first electronic configuration is a first software configuration, and wherein the second electronic configuration is a second software configuration different from the first software configuration.

15. One or more non-transitory machine-readable media according to claim 12, wherein: The first command module receives a set of one or more input signals from a set of sensors, and generates the first control signal based at least in part on the set of one or more input signals; The monitoring module receives a set of one or more input signals from the set of sensors; as well as The monitoring module generates a monitoring signal at least in part based on the set of one or more input signals, compares the first control signal generated by the first command module with the monitoring signal, and transmits the first control signal to the actuator if the first control signal matches the monitoring signal.

16. One or more non-transitory machine-readable media according to claim 15, wherein the monitoring module suppresses the first control signal when the first control signal is different from the monitoring signal, wherein the second control signal is transmitted to the actuator when the first control signal is suppressed.

17. The one or more non-transitory machine-readable media of claim 15, wherein the second command module receives a set of the one or more input signals from the set of sensors and generates the second control signal based at least in part on the set of the one or more input signals.

18. The operation of one or more non-transitory machine-readable media according to claim 12 further includes generating an alarm when the actuator is controlled using the second control signal when the first command module is deactivated or malfunctions.

19. A method for facilitating the control of an aircraft, the method comprising: The actuators communicating with one or more processing devices are controlled based at least in part on the following: The actuator is controlled by outputting a first control signal using a first command module, wherein the first command module includes a first electronic configuration. When the first command module is deactivated or malfunctions, the second command module outputs a second control signal to control the actuator, wherein the second command module includes a second electronic configuration that is different from the first electronic configuration. as well as The monitoring module monitors at least one of the following: (i) one or more commands generated by the first command module, or (ii) one or more system response signals based at least in part on one or more sensors, wherein the monitoring module includes a third electronic configuration different from the first and second electronic configurations; and When the first command module is deactivated or malfunctions, the actuator is controlled using the second control signal.

20. The method for promoting control of an aircraft according to claim 19, wherein when the first control signal is different from the monitoring signal generated by the monitoring module, the monitoring module suppresses the first control signal, wherein when the first control signal is suppressed, the second control signal is transmitted to the actuator.

Images