Crosslinking control system and crosslinking control method for a multi-channel actuator

Abstract

The application provides a cross-linking control system and method of a multi-channel actuator, comprising: a plurality of secondary computers, which receive normal control laws as control signals from a master computer in a normal mode, and switch to a direct mode to independently generate and output direct control laws as control signals in an abnormality; a plurality of remote electronic units, which respectively receive control signals from the plurality of secondary computers, and output corresponding control signals; and a plurality of actuators, which are correspondingly arranged with the remote electronic units, and are respectively controlled by the remote electronic units to drive the same control object, wherein the remote electronic units drive the corresponding actuators to act when receiving the normal control laws from the plurality of secondary computers, and selectively do not drive the corresponding actuators to act when receiving the direct control laws from the plurality of secondary computers. Thus, the control performance decline caused by the differentiated driving of the multi-channel actuator can be avoided, and the safety and reliability of the control system are significantly improved.

Description

Technical Field

[0001] This application relates to the field of aircraft, specifically to a cross-linking control system and cross-linking control method for a multi-channel actuator. Background Technology

[0002] In fly-by-wire (FBW) flight control systems widely used in modern civil aircraft, multiple isolated redundant channels are typically employed for actuator control to meet the reliability and safety requirements of airworthiness authorities. For example, the primary flight computer (PFC) calculates the normal control law based on pilot commands, while the secondary flight computers (SFCs) in each redundant channel calculate the direct control law as a backup. Because the control law commands calculated in normal mode and direct mode differ, and because normal mode prioritizes optimal handling and safety, while direct mode aims to maintain basic controllability even in the event of a higher-level failure, different control law calculation methods are used in normal and direct modes, resulting in different calculation outcomes.

[0003] Normally, in normal mode, each actuator operates according to the normal control law output by the main computer. When some channels malfunction (e.g., PFC failure, abnormal or invalid instructions), the malfunctioning channel is downgraded to direct mode, and the corresponding actuator operates according to the direct control law output by the secondary computer. If the number of malfunctioning channels is less than a specified threshold (e.g., 2), the system still operates in normal mode to ensure good operability. In this case, some channels enter direct mode due to malfunctions, while other channels remain in normal mode, resulting in a mixed mode within the system.

[0004] However, as mentioned earlier, multi-channel design is the core of ensuring redundancy, reliability, and safety in fly-by-wire flight control systems. Therefore, it is very likely that multiple independent actuators will act on the same object. If the system enters a mixed mode, the following situation will occur: some actuators acting on the object will respond to the direct control law in direct mode, while other actuators will respond to the normal control law in normal mode. Since the control laws are different in different modes, the outputs of the actuators will be inconsistent, which will not only affect the handling performance but also pose serious safety hazards. Summary of the Invention

[0005] The problem the invention aims to solve: This application was developed to solve the above-mentioned technical problems, and its purpose is to provide a cross-linking control system and cross-linking control method for a multi-channel actuator, which can avoid the decrease in control performance caused by the multi-channel actuator being driven in a differentiated manner, and significantly improve the safety and reliability of the control system.

[0006] Technical means to solve the problem: This application provides a cross-linking control system for a multi-channel actuator, comprising: multiple secondary computers, which in normal mode receive normal control laws as control signals from a main computer via a communication bus, and switch to direct mode to independently generate and output direct control laws as control signals when the main computer or its signals are abnormal; multiple remote electronic units, which respectively receive control signals from the multiple secondary computers and output corresponding control signals; and Multiple actuators are configured corresponding to the remote electronic unit and are controlled by the remote electronic unit to drive the same controlled object. When any one of the remote electronic units receives the normal control law from the multiple secondary computers, it drives the corresponding actuator to act. When it receives the direct control law from the multiple secondary computers, it selectively does not drive the corresponding actuator to act.

[0007] Preferably, when multiple secondary computers output the direct control law, the remote electronic unit connects the corresponding actuator through cross-linking control, enabling the multiple actuators to drive the controlled object based on the direct control law.

[0008] Preferably, the actuator includes a solenoid valve, the solenoid valve including a high side of SOV located on the high potential side and a low side of SOV located on the low potential side, and the remote electronic unit includes: The SOV high-side drive is driven by a high-side drive signal as a control signal; the SOV low-side drive is driven by a low-side drive signal as a control signal; and the SOV low-side suppression is driven by a low-side suppression signal as a control signal. When the SOV high-side drive outputs a high level and the SOV low-side drive outputs a low level, the solenoid valve of the corresponding actuator is turned on, and the actuator is driven.

[0009] Preferably, in any one of the plurality of actuators used to drive the same controlled object, the SOV high side is driven connected to the SOV high side of a corresponding remote electronic unit, the SOV low side is driven connected to the SOV low side of a corresponding remote electronic unit, and the SOV low side is also suppressed connected only to the SOV low side of one of the plurality of remote electronic units other than the remote electronic unit corresponding to its own actuator.

[0010] Preferably, when the remote electronic unit receives the normal control law from the plurality of secondary computers, it causes the SOV high-side drive to output a high level, the SOV low-side drive to output a low level, and the SOV low-side suppression to output a high level.

[0011] Preferably, when the remote electronic unit receives the direct control law from the plurality of secondary computers, it causes the SOV high-side drive to output a high level, causes the SOV low-side drive to output a high level, and causes the SOV low-side suppression to output a low level.

[0012] Preferably, when the remote electronic unit fails, the SOV high-side drive outputs a low level, the SOV low-side drive outputs a low level, and the SOV low-side suppression outputs a low level.

[0013] Preferably, when two or more of the secondary computers enter the direct mode, all other secondary computers automatically enter the direct mode.

[0014] Preferably, the controlled object is the aircraft's control surfaces.

[0015] This application also provides a cross-linking control method for a multi-channel actuator. In the cross-linking control system of the multi-channel actuator, when multiple actuators controlled by different secondary computers drive the controlled object, it is determined that the different secondary computers are in normal mode or direct mode respectively. When any one of the different secondary computers is determined to be in normal mode, the secondary computer controls its remote electronic unit to turn on the solenoid valve of the corresponding actuator. When any one of the different secondary computers is determined to be in direct mode, the secondary computer controls its remote electronic unit not to turn on the solenoid valve of the corresponding actuator.

[0016] Preferably, the remote electronic unit is configured to: when receiving the normal control law from the plurality of secondary computers, set the high-side drive signal, the low-side drive signal, and the low-side suppression signal to true; and when receiving the direct control law from the plurality of secondary computers, set the high-side drive signal to true and the low-side drive signal and the low-side suppression signal to false.

[0017] Preferably, when the high-side drive signal emitted by the remote electronic unit is true, the SOV high-side drive provides a high level to the SOV high side; when the high-side drive signal emitted by the remote electronic unit is false, the SOV high-side drive provides a low level to the SOV high side; when the low-side drive signal emitted by the remote electronic unit is true, the SOV low-side drive provides a low level to the SOV low side; when the low-side drive signal emitted by the remote electronic unit is false, the SOV low-side drive provides a high level to the SOV low side; when the low-side suppression signal emitted by the remote electronic unit is true, the SOV low-side suppression provides a high level to the SOV low side; when the low-side suppression signal emitted by the remote electronic unit is false, the SOV low-side suppression provides a low level to the SOV low side.

[0018] Preferably, when any one of the different secondary computers is determined to be neither in normal mode nor in direct mode, it is determined that its remote electronic unit has failed and cannot connect the solenoid valve of the corresponding actuator.

[0019] Preferably, the remote electronic unit is configured to: when it fails, regardless of whether the signal is true or false, cause the SOV high-side drive to provide a low level to the SOV high-side, the SOV low-side drive to provide a low level to the SOV low-side, and the SOV low-side suppression to provide a low level to the SOV low-side.

[0020] Preferably, when any one of the secondary computers is determined to be in direct mode and the other secondary computers are determined to be not in normal mode, the secondary computer in direct mode is designated as the first primary computer, and the remote electronic unit controlled by the first primary computer is defined as the first remote electronic unit. Furthermore, the secondary computer not in normal mode is designated as the second secondary computer, and the remote electronic unit controlled by the second secondary computer is defined as the second remote electronic unit. The first primary computer controls the first remote electronic unit to not connect the solenoid valve of the corresponding actuator, but the solenoid valve of the actuator is connected via the second remote electronic unit of the second secondary computer.

[0021] Invention effects: In summary, this application achieves comprehensive control optimization from the hardware to the software layer by introducing REU cross-control and high / low side drive and suppression signal logic into the flight control system. First, it selectively suppresses control in direct mode, improving the availability of the flight control system in normal mode and enhancing aircraft maneuverability. Simultaneously, it ensures that the control surfaces are always driven by a unified control law in hybrid mode, completely eliminating control surface force conflicts and output oscillations. Second, the secondary computer and REU only communicate at the hardware level, without direct data communication across channels at the software level, minimizing the impact on the physical independence of control channels in normal mode. Third, it maintains continuous control surface response during mode switching, avoiding abrupt jumps and failures, ensuring maneuverability in abnormal situations, and meeting airworthiness regulations. Finally, it fully supports common architectures such as dual-channel and triple-channel systems, making it easy to extend to different aircraft models and control surface configurations, exhibiting excellent scalability and adaptability. Therefore, this application not only improves the safety and reliability of the flight control system but also provides modern civil aircraft with a higher level of control redundancy and intelligent management capabilities, fundamentally guaranteeing flight safety and handling quality. Attached Figure Description

[0022] Figure 1 This is a schematic diagram illustrating the module communication architecture of the crosslinking control system; Figure 2 This is a schematic diagram showing the structure of the remote electronic unit and the solenoid valve in a dual-channel actuator; Figure 3 This is a schematic diagram showing the structure in the normal-normal mode; Figure 4 This is a schematic diagram showing the structure in the normal-direct mode (i.e., the mixed mode); Figure 5 This is a schematic diagram showing the structure under normal-failure modes; Figure 6 This is a schematic diagram showing the structure in the direct-normal mode; Figure 7 This is a schematic diagram showing the structure in the direct-to-direct mode; Figure 8 This is a schematic diagram showing the structure under the direct failure mode; Figure 9 This is a schematic diagram showing the structure under the failure-normal mode; Figure 10 This is a schematic diagram showing the structure in the failure-direct mode; Figure 11 This is a block diagram illustrating the crosslinking control method; Figure 12 This is a schematic diagram showing the structure of the remote electronic unit and solenoid valve in a three-channel actuator. Detailed Implementation

[0023] The present application is further described below with reference to the following embodiments. It should be understood that the following embodiments are for illustrative purposes only and are not intended to limit the scope of the present application. The same or corresponding reference numerals in the figures denote the same components, and repeated descriptions are omitted. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this application.

[0024] In the description of this application, it should be noted that the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. The terms "installation," "connection," and "linking" should be interpreted broadly, and those skilled in the art can understand their specific meaning in this application based on the specific circumstances.

[0025] Hereinafter, an embodiment of this application will be described with reference to the accompanying drawings. It should be understood that... Figure 1 The diagram illustrates a simplified and schematic portion of the structure. Furthermore, any structures, components, elements, etc., described in this application, unless otherwise specified or illustrated, are assumed to be prior art or implementable using existing technology.

[0026] [Main Computer Layer]

[0027] The fly-by-wire flight control system (or flight control system) of one embodiment of this application includes multiple independent host computers (hereinafter sometimes referred to as PFCs). Figure 1 The diagram shows three main computers, PFC1, PFC2, and PFC3, but is not limited to these. Furthermore, each main computer has multiple independent redundant channels, for example, three channels. Figure 1 (A simplified diagram is shown below), thus forming a multi-redundant architecture. Each channel is connected to the communication bus and is completely isolated physically and electrically. During communication, for example, all data is checked by a cyclic redundancy check code to ensure the integrity and reliability of information transmission. Furthermore, the information exchange between channels can achieve millisecond-level frame synchronization, thereby ensuring the consistency of the calculation results of the three channels in time.

[0028] In this implementation, each channel of each host computer can switch between "master control" and "monitoring" roles. At any given time, each host computer allows only one channel to function as the master control channel, while the other two act as monitoring channels. The master control channel calculates the proposed instruction and outputs it to the communication bus to interact with other host computers, while the monitoring channels monitor the output instructions of the master control channel in real time. Furthermore, the master control channels of the three host computers exchange their calculated proposed instructions via the communication bus, selecting one from the proposed instructions from the three host computers as the final selected instruction using a predetermined algorithm. The monitoring channel within each host computer verifies the selected instruction from the master control channel. Simultaneously, the master control channels of the three host computers also cross-monitor the selected instruction, effectively preventing erroneous instructions from being output to the communication bus and improving overall security and robustness.

[0029] [Secondary Computer Layer]

[0030] The fly-by-wire flight control system of one embodiment of this application includes multiple independent secondary computers (hereinafter sometimes referred to as SFCs) that receive instructions from a main computer via a communication bus. Figure 1 The diagram shows four secondary computers: SFC1, SFC2, SFC3, and SFC4, but it is not limited to these. Under normal circumstances, each secondary computer interprets and forwards the control law (i.e., selected instructions) from the master computer according to a predetermined program. When the master computer or the control law from the master computer malfunctions, it switches to direct mode to drive the corresponding actuator as a fallback.

[0031] Generally, to reduce the risk of failure, actuators are not directly driven by the main computer, but are managed by specific secondary computers. In other words, each secondary computer is configured to drive a specific actuator. For example, one or a group of actuators corresponds to one or more secondary computers. The assigned secondary computer receives the control law from the main computer, filters out relevant instructions, and executes them. Furthermore, there are different redundancy configurations between secondary computers and actuators. For example, for spoilers, one secondary computer typically controls a group of actuators. For elevators, rudders, ailerons, etc., a dual-channel actuator redundancy configuration is usually used, with each actuator managed by an independent secondary computer channel. This forms a power chain where the main computer issues commands, and two secondary computers simultaneously receive and drive their respective actuators. For all-moving horizontal stabilizers, which bear a heavy load, a three-channel actuator redundancy configuration is typically used.

[0032] However, the specific allocation method of secondary computers is not limited to the above, as long as redundancy is guaranteed in the allocation. For example, secondary computers for different control surfaces can be physically distributed, or a single secondary computer can avoid controlling multiple critical control surfaces simultaneously. Here, control surfaces refer to deflectable aerodynamic surfaces installed on parts such as the wings, tail, or fuselage of an aircraft. By changing their aerodynamic shape or airflow direction, they generate additional lift, drag, or torque to control the attitude, trajectory, and performance of the aircraft. In other words, the aforementioned spoilers, elevators, rudders, ailerons, etc., can all be collectively referred to as control surfaces.

[0033] [Executive Level]

[0034] In this embodiment, the actuator layer includes actuators (hereinafter sometimes referred to as ACTs) and remote electronic units (hereinafter sometimes referred to as REUs). The remote electronic units are typically installed in a one-to-one correspondence with the actuators, receiving instruction signals from the secondary computer and converting them into drive signals acceptable to the actuators. For example, the remote electronic unit sends a solenoid valve (hereinafter sometimes referred to as SOV) activation command to the corresponding actuator, thereby energizing and driving the actuator.

[0035] like Figure 1 As shown, SFC1 drives ACT1 via REU1, and SFC2 drives ACT2 via REU2. Thus, relative to control surface A, ACT1 and ACT2 form a dual-actuator redundant configuration. In normal mode, the PFC layer calculates and issues control laws based on operating commands, and the SFC layer receives and interprets the control laws. SFC1 and SFC2 filter out information related to control surface A and drive ACT1 and ACT2 respectively via REU1 and REU2, forming multiple independent power links to achieve complete control of control surface A. Similarly, SFC2 drives ACT2-2 via REU2-2, SFC3 drives ACT3 via REU3, and SFC4 drives ACT4 via REU4. Thus, relative to control surface B, ACT2-2, ACT3, and ACT4 form a redundant three-actuator configuration. In normal mode, the PFC layer calculates and issues control laws based on operating commands, and the SFC layer receives and interprets these control laws. SFC2, SFC3, and SFC4 filter out information related to control surface B and drive ACT2-2, ACT3, and ACT4 via REU2-2, REU3, and REU4 respectively, forming multiple independent power links to achieve complete control of control surface B.

[0036] Furthermore, in this embodiment, multiple actuators on the same control surface and their corresponding multiple remote electronic units belong to multiple relatively independent secondary computer channels. The command signal can be provided by any key device in the control channel where the actuator is located. For example, for a dual-actuator control surface, it can be provided by a remote electronic unit, and for a three-actuator control surface, it can be provided by a secondary computer, and so on.

[0037] As mentioned earlier, in this embodiment, in normal mode, the PFC layer calculates the normal control law (which can be understood as control surface commands) in real time based on pilot input and flight status parameters, and issues it through redundant voting and bus allocation to ensure that flight control meets both operational requirements and safety protection. After receiving a valid normal control law, the SFC layer performs signal conversion, parsing, and rationality checks, and then determines the SFC required to execute the command. The determined SFCs distribute the normal control law (which has now been converted into standardized commands required for actuator actuation, such as voltage, current, or control quantities) to multiple REUs corresponding to the control surfaces, and coordinate the actions of each REU to ensure stable and reliable control surface actions. Furthermore, the SFC receives feedback on the actual execution results of the REUs in real time and compares them with the normal control law as the target command. If there is a deviation, the drive signal issued to the REUs is adjusted in real time. In addition, the SFC feeds back the execution status and health status to the PFC layer in real time so that the PFC can confirm whether the normal control law has been implemented. When any channel in the multi-channel system experiences equipment failure or signal anomalies—meaning the SFC layer cannot receive a valid normal control law—it triggers an automatic downgrade of the SFC associated with that channel. The SFC degrades from the normal mode (receiving normal control laws from the PFC) to a direct mode (independently generating direct control laws by directly processing pilot input signals). Meanwhile, the other channels in the dual-channel system remain in the normal mode (receiving normal control laws from the PFC), thus creating a hybrid mode for the dual-channel actuators. Furthermore, when a fixed number or more SFCs (e.g., two or more) degrade to direct mode, the flight control system determines that the PFC is untrusted and downgrades the entire system to direct mode.

[0038] In this embodiment, the actuator includes a solenoid valve (SOV). The control circuit of the solenoid valve consists of two independent control terminals: the SOV high side, located at a high potential, and the SOV low side, located at a low potential. Control units such as remote electronic units can control the power supply and circuit closure of the solenoid valve through these two ports respectively, thereby achieving safer and more flexible valve body control.

[0039] In this embodiment, the remote electronic unit (REU) has three modules or circuits: SOV high-side drive, SOV low-side drive, and SOV low-side suppression. Furthermore, the REU can emit three types of signals: a high-side drive signal (sov_hi_engage) driving the SOV high-side drive, a low-side drive signal (sov_lo_nm_engage) driving the SOV low-side drive, and a low-side suppression signal (adjacent_sov_lo_inh) driving the SOV low-side suppression. When the REU emits a high-side drive signal, the SOV high-side drive (module or circuit) receives the signal and performs an action, supplying power to the SOV high-side. When the REU emits a low-side drive signal, the SOV low-side drive (module or circuit) receives the signal and performs an action, supplying power to the SOV low-side. When the REU emits a low-side suppression signal, the SOV low-side suppression (module or circuit) receives the signal and performs an action, supplying power to the SOV low-side.

[0040] In this embodiment, the SOV high-side drives of multiple remote electronic units are connected to the SOV high-sides of their corresponding actuators, and the SOV low-side drives of multiple remote electronic units are connected to the SOV low-sides of their corresponding actuators. Furthermore, the SOV low-side suppressions of multiple remote electronic units are sequentially connected to the SOV low-sides of adjacent actuators. Thus, multiple actuators and multiple remote electronic units form an interconnected structure. Here, "adjacent" means that the SOV low-side suppression of one REU is only connected to the SOV low-side of another actuator under the same control surface.

[0041] Furthermore, in this embodiment, the relationship between the remote electronic unit's command (i.e., drive signal) to the solenoid valve and its output level is set as follows: when the high-side drive signal is true, the SOV high-side drive outputs a high level; when the low-side drive signal is true, the SOV low-side drive outputs a low level; when the low-side suppression signal is true, the SOV low-side suppression outputs a high level; when the high-side drive signal is false, the SOV high-side drive outputs a low level; when the low-side drive signal is false, the SOV low-side drive outputs a high level; when the low-side suppression signal is false, the SOV low-side suppression outputs a low level. Therefore, only when the remote electronic unit's SOV high-side drive outputs a high level and the SOV low-side drive outputs a low level can the corresponding actuator's SOV be turned on through the potential difference, and the actuator will operate.

[0042] As a crosslink control, it can be set as follows: When the secondary computer is in normal mode, the high-side drive signal, low-side drive signal, and low-side suppression signal of the remote electronic unit on this channel are set to true. When the secondary computer is in direct mode, the high-side drive signal of the remote electronic unit on this channel is set to true, while the low-side drive signal and low-side suppression signal are set to false. Thus, by using the combination of high-side drive + low-side drive + suppression signals of the REU, the SOV can be controlled to form a closed current loop to activate the ACT, thereby realizing the crosslink control of the multi-channel actuator in hybrid mode.

[0043] The following, combined with Figures 2-11 Taking the dual-actuator rudder surface A as an example, this application details the cross-linking structure and cross-linking control method of a multi-channel actuator according to an embodiment of the present application.

[0044] like Figure 2 As shown, REU1 and REU2 on the SFC1 and SFC2 channels control the solenoid valves (SOVs) of ACT1 and ACT2, respectively. In REU1, the SOV high-side drive is connected to the SOV high-side of ACT1, the SOV low-side drive is connected to the SOV low-side of ACT1, and the SOV low-side suppression is connected to the SOV low-side of ACT2. In REU2, the SOV high-side drive is connected to the SOV high-side of ACT2, the SOV low-side drive is connected to the SOV low-side of ACT2, and the SOV low-side suppression is connected to the SOV low-side of ACT1. Thus, the SOV low-side suppressions of the two REUs are cross-connected with the SOV low-side of the other ACT, forming a cross-linked structure.

[0045] In the crosslinking control of this embodiment, firstly, in step S1, it is determined whether SFC1 is in normal mode.

[0046] When SFC1 is determined to be in normal mode in step S1, the process proceeds to step S2. SFC1 forwards the PFC command to REU1, making REU1's high-side drive signal, low-side drive signal, and low-side suppression signal true. Consequently, REU1's SOV high-side drive outputs a high level, providing positive power to the SOV coil of ACT1. REU1's SOV low-side drive outputs a low level, creating a current loop in the SOV coil of ACT1 due to a potential difference. ACT1's SOV then activates, enabling it to respond to normal control law commands in normal mode. Simultaneously, REU1's SOV low-side suppression outputs a high level.

[0047] Next, in step S3, it is determined whether SFC2 is in normal mode.

[0048] When SFC2 is determined to be in normal mode in step S3, the process proceeds to step S4. SFC2 forwards the PFC command to REU2, making REU2's high-side drive signal, low-side drive signal, and low-side suppression signal true. Consequently, REU2's SOV high-side drive output goes high, providing positive power to the SOV coil of ACT2. REU2's SOV low-side drive output goes low, creating a current loop in the SOV coil of ACT2 due to a potential difference, thus turning on ACT2's SOV. Simultaneously, REU2's SOV low-side suppression output goes high. Figure 3 As shown, ACT1 and ACT2 are activated respectively, enabling them to respond to the normal control law commands of their respective channels in normal mode. Furthermore, the SOV low-side suppression of REU1 and REU2 does not affect the other's loop. In essence, as long as the actuator's solenoid valve is activated, it will not be affected by the low-side suppression of either side.

[0049] If it is determined in step S3 that SFC2 is not in normal mode, proceed to step S5 to determine whether SFC2 is in direct mode.

[0050] When it is determined in step S5 that SFC2 is in direct mode, proceed to step S6. SFC2 controls REU2 to have its high-side drive signal true and its low-side drive signal and low-side suppression signal false. Therefore, REU2's SOV high-side drive output is high, and REU2's SOV low-side drive output is high, as shown below. Figure 4 As shown, there is no potential difference across the SOV coil of ACT2, so a current loop cannot be formed, and ACT2's SOV cannot be turned on. Simultaneously, the low-side suppression output of REU2's SOV is low. At this point, the configuration is a hybrid mode where SFC1 is in normal mode and SFC2 is in direct mode. Because ACT2's SOV cannot be turned on, ACT2 does not actively perform any operation (i.e., it does not respond to the direct control law command corresponding to SFC2 in direct mode), and enters a follow-up state following ACT1's actions. This can be understood as ACT2 changing from active control mode to bypass / damped mode. Therefore, in hybrid mode, only ACT1 in normal mode acts on control surface A, while ACT2 in direct mode follows. Compared to the situation in hybrid mode where ACT1 and ACT2 simultaneously act on control surface A with inconsistent outputs, this can very effectively avoid control surface force conflict oscillations.

[0051] If it is determined in step S5 that SFC2 is not in direct mode, proceed to step S7, where it is determined that REU2 has failed. At this time, automatically, REU2's SOV high-side drive outputs a low level, REU2's SOV low-side drive outputs a low level, and REU2's SOV low-side suppression outputs a low level. Specifically, at the software level, REU2 failure will not generate any signal, while at the hardware level, REU can be set to be passively pulled down to a low level once the active pull-up signal is lost. Therefore, when REU fails, all ports output a consistent low level. Thus, as... Figure 5 As shown, there is no potential difference across the SOV coil of ACT2, preventing the formation of a current loop, and thus ACT2's SOV cannot be switched on. Simultaneously, REU2's SOV low-side suppression outputs a low level. Therefore, ACT1 completely takes over control of rudder surface A, and ACT2 enters a follow-up state, ensuring maneuverability and safety.

[0052] If it is determined in step S1 that SFC1 is not in normal mode, proceed to step S8 to determine whether SFC1 is in direct mode.

[0053] When it is determined in step S8 that SFC1 is in direct mode, the process proceeds to step S9. SFC1 controls REU1's high-side drive signal to be true, and its low-side drive signal and low-side suppression signal to be false. Therefore, REU1's SOV high-side drive output is high, REU1's SOV low-side drive output is high, and there is no potential difference across the SOV coil of ACT1, preventing the formation of a current loop and thus preventing ACT1's SOV from being turned on. Simultaneously, REU1's SOV low-side suppression output is low.

[0054] Next, in step S10, it is determined whether SFC2 is in normal mode.

[0055] When SFC2 is determined to be in normal mode in step S10, the process proceeds to step S11. SFC2 forwards the PFC command to REU2, making REU2's high-side drive signal, low-side drive signal, and low-side suppression signal true. Consequently, REU2's SOV high-side drive output is high, providing positive power to the SOV coil of ACT2. REU2's SOV low-side drive output is low, creating a current loop in the SOV coil of ACT2 due to a potential difference, thus turning on ACT2's SOV. Simultaneously, REU2's SOV low-side suppression output is high. Figure 6 As shown, in normal mode, ACT2 (SOV on) acts on rudder surface A, while in direct mode, ACT1 (SOV off) follows, effectively avoiding rudder surface force conflict and oscillation.

[0056] If it is determined in step S10 that SFC2 is not in normal mode, proceed to step S12 to determine whether SFC2 is in direct mode.

[0057] When SFC2 is determined to be in direct mode in step S12, the process proceeds to step S13. SFC2 controls REU2's high-side drive signal to be true, and its low-side drive signal and low-side suppression signal to be false. Therefore, REU2's SOV high-side drive output is high, REU2's SOV low-side drive output is high, and ACT2's SOV cannot be turned on by itself. Furthermore, as mentioned earlier, when SFC1 is in direct mode, SFC1 controls REU1's high-side drive signal to be true, and its low-side drive signal and low-side suppression signal to be false. Therefore, REU1's SOV high-side drive output is high, REU1's SOV low-side drive output is high, and ACT1's SOV cannot be turned on by itself. However, at this time, because REU1's SOV low-side suppression output is low, and REU2's SOV low-side suppression output is low, therefore... Figure 7 As shown, by suppressing the low level of the SOV low-side output of REU1 and driving the high level of the SOV high-side output of REU2, the SOV low-side and SOV high-side of ACT2 achieve a closed loop, and ACT2's SOV is turned on. Similarly, by suppressing the low level of the SOV output of REU2 and driving the high level of the SOV high-side output of REU1, the SOV low-side and SOV high-side of ACT1 achieve a closed loop, and ACT1's SOV is turned on. Thus, ACT1 and ACT2 can respectively respond to the direct control law instructions of their respective SFC channels in direct mode. That is to say, in the overall direct mode, the control loops between each REU and its corresponding actuator are connected at the hardware level through cross-connection, and at the software level, the direct control law on their respective SFC channels is executed.

[0058] If it is determined in step S12 that SFC2 is not in direct mode, proceed to step S14, where REU2 is determined to be faulty. At this time, the high-side drive output of REU2's SOV is low, the low-side drive output of REU2's SOV is low, and the low-side suppression output of REU2's SOV is low. Therefore, there is no potential difference across the coil of ACT2's SOV, preventing the formation of a current loop, and ACT2's SOV cannot be switched on. Figure 8 As shown, by using the low-side suppression of the SOV output of REU2 to suppress the low level, and in conjunction with the high-side drive of the SOV output of REU1, the SOV low-side and SOV high-side of ACT1 achieve a closed loop, and the SOV of ACT1 is turned on. Thus, ACT1 can respond to the direct control law command in direct mode, and ACT2 enters the follower state.

[0059] If it is determined in step S8 that SFC1 is not in direct mode, proceed to step S15, where REU1 is determined to be faulty. At this time, the high-side drive output of REU1's SOV is low, the low-side drive output of REU1's SOV is low, and the low-side suppression output of REU1's SOV is low. As a result, there is no potential difference across the coil of ACT1's SOV, and a current loop cannot be formed, so ACT1's SOV cannot be turned on.

[0060] Next, in step S16, it is determined whether SFC2 is in normal mode.

[0061] When SFC2 is determined to be in normal mode in step S16, the process proceeds to step S17. SFC2 forwards the PFC command to REU2, making REU2's high-side drive signal, low-side drive signal, and low-side suppression signal true. Consequently, REU2's SOV high-side drive output is high, providing positive power to the SOV coil of ACT2. REU2's SOV low-side drive output is low, creating a current loop in the SOV coil of ACT2 due to a potential difference, thus turning on ACT2's SOV. Simultaneously, REU2's SOV low-side suppression output is high. Figure 9 As shown, ACT2 completely takes over control of rudder surface A, and ACT1 enters a follow-up state to ensure maneuverability and safety.

[0062] If it is determined in step S16 that SFC2 is not in normal mode, proceed to step S18 to determine whether SFC2 is in direct mode.

[0063] When it is determined in step S18 that SFC2 is in direct mode, the process proceeds to step S19. SFC2 controls REU2's high-side drive signal to be true, and its low-side drive signal and low-side suppression signal to be false. Therefore, REU2's SOV high-side drive output is high, REU2's SOV low-side drive output is high, and ACT2's SOV cannot be turned on by itself. Figure 10 As shown, by using the low-side suppression of the SOV output of REU1 to suppress the low level, and in conjunction with the high-side drive of the SOV output of REU2, the SOV low-side and SOV high-side of ACT2 achieve a closed loop, and the SOV of ACT2 is turned on. Thus, ACT2 can respond to the direct control law command in direct mode, and ACT1 enters the follower state.

[0064] If it is determined in step S18 that SFC2 is not in direct mode, proceed to step S20, where it is determined that REU2 has failed. At this time, all actuators on control surface A fail, triggering alarms and other actions.

[0065] It should be understood that Figure 11 The control logic in the crosslink control is shown in detail, but the decision order is not limited to the above.

[0066] like Figure 12 As shown, in the case of three-actuator control surface B, the situation where both SFC channels are degraded to direct mode is usually considered as PFC becoming unreliable. Therefore, the entire system is degraded from normal mode to direct mode. At this time, each SFC channel is in direct mode, independently generating direct control laws. Therefore, although there are three channels, the discussion is actually about the case of single-channel degrade. The cross-linking control logic can be referred to the above-mentioned dual-actuator control surface A, only needing to consider the channels with signal crossover. The signal crossover method of the three REUs has already been discussed. Figure 1 As shown in the diagram, it will not be repeated here.

[0067] In summary, this application addresses the safety and control consistency issues of modern civil aircraft fly-by-wire flight control systems under multi-channel control architectures by proposing a cross-linking control system and method to suppress the cross-linking of multi-channel actuators in mixed control surface operating modes. By establishing hardware cross-connections between adjacent remote electronic units (REUs) and actuators, and combining logical control with high-side drive, low-side drive, and low-side suppression signals, automatic judgment and coordinated control under complex flight conditions are achieved, effectively solving the control surface force conflict problem in mixed modes.

[0068] Specifically, the cross-linking control system and cross-linking control method of this application help meet the safety requirements of civil aviation airworthiness regulations for high-level automatic landing systems. In this application, through hardware cross-connection and signal suppression logic, when some control channels malfunction or degrade to direct mode, the system can automatically ensure that the control surfaces are driven only by the control law of the normal mode, achieving safe maneuverability with high redundancy and avoiding unpredictable control surface movements caused by mixed modes, thereby meeting the stringent safety standards of high-level automatic landing systems.

[0069] Furthermore, this application employs a layered redundancy architecture and REU cross-suppression design to ensure that the control channels in normal mode can continue to operate without interference even when a local channel malfunctions or the secondary computer (SFC) degrades. In mixed-mode scenarios, the actuators in the direct-mode channels do not actively output outputs, existing only as follow-up or bypass units, thus guaranteeing that the normal-mode channels can continue to drive the control surfaces with optimal handling qualities. This technical approach significantly improves the continuous availability of the flight control system in normal mode, reduces the probability of overall degradation due to individual channel malfunctions, and enhances the reliability of the flight control system.

[0070] Furthermore, when one SFC (Shipment Control Function) is downgraded to direct mode while other SFCs remain in normal mode, i.e., when mixed modes exist on the control surfaces, different actuators on the same control surface will respond with different control laws, leading to control surface oscillations, response lag, and even a decrease in handling quality. This application addresses this by using hardware cross-connection between REUs (Reactor Units) and low-side suppression signal logic to automatically deprive actuators in direct mode of independent drive capability, allowing them to follow only the actions of actuators in normal mode. This ensures that in mixed mode, only the normal mode channel outputs effective actuation force, while the direct mode channel enters a follow-up or bypass state, generating no active control force. As a result, control surface movements are smoother and more coordinated, significantly improving overall aircraft handling and flight quality. Especially during critical flight phases (such as landing, go-around, and autopilot switching), it can significantly reduce pilot workload and improve flight safety.

[0071] Furthermore, when multiple SFCs are detected entering direct mode simultaneously, the entire system degrades to direct mode. This application utilizes hardware cross-connections between REUs and low-side suppression signal logic to re-energize actuators in direct mode via these cross-connections. Each channel independently generates a direct control law and collaborates with each other, preventing control interruption. As a result, the control surfaces can avoid inconsistent output, force conflicts, and degraded handling quality under any mode combination.

[0072] Furthermore, the cross-linking control system and method of this application achieve signal suppression through hardware connection between the REU and the actuator, eliminating the need for cross-channel data communication between SFCs or REUs. Compared with traditional cross-channel data interaction schemes, this design maintains the physical and logical isolation of each control channel to the greatest extent, conforming to the redundancy design principle of flight control systems and preventing a failure in one channel from propagating to other channels through the communication link, thus reducing the risk of system-level failures. This combination of physical isolation and hardware-level suppression allows the system to maintain simple and clear control logic while meeting high safety requirements.

[0073] In summary, this application has outstanding advantages in terms of safety, reliability, airworthiness, and engineering implementation, providing a highly efficient, safe, and scalable flight control surface cross-linking control solution for modern civil aircraft.

[0074] Furthermore, any process or method description in the flowchart or otherwise described herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order according to the functions involved, as should be understood by those skilled in the art to which embodiments of this application pertain.

[0075] The above detailed embodiments further illustrate the purpose, technical solution, and beneficial effects of this application. It should be understood that the above are merely one specific embodiment of this application and are not limited to the scope of protection of this application. This application can be embodied in various forms without departing from its fundamental characteristics. Therefore, the embodiments described in this application are for illustrative purposes only and not for limitation. Since the scope of this application is defined by the claims rather than the description, and all variations falling within the scope defined by the claims, or their equivalents, should be understood to be included in the claims. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A cross-linking control system for a multi-channel actuator, characterized in that, include: Multiple secondary computers receive normal control laws as control signals from the main computer via a communication bus in normal mode, and switch to direct mode to independently generate and output direct control laws as control signals when the main computer or its signals are abnormal. Multiple remote electronic units receive control signals from multiple secondary computers and output corresponding control signals; as well as Multiple actuators are configured corresponding to the remote electronic unit and are each controlled by the remote electronic unit to drive the same controlled object. When any one of the remote electronic units receives the normal control law from the plurality of secondary computers, it drives the corresponding actuator to operate; when it receives the direct control law from the plurality of secondary computers, it selectively does not drive the corresponding actuator to operate.

2. The cross-linking control system for the multi-channel actuator according to claim 1, characterized in that, When multiple secondary computers output the direct control law, the remote electronic unit connects the corresponding actuators through cross-linking control, enabling the multiple actuators to drive the controlled object based on the direct control law.

3. The cross-linking control system for the multi-channel actuator according to claim 2, characterized in that, The actuator includes a solenoid valve. The solenoid valve includes a high-potential SOV side and a low-potential SOV side. The remote electronic unit includes: SOV high-side drive is driven by the high-side drive signal, which serves as the control signal; SOV low-side drive driven by the low-side drive signal, which serves as the control signal; and SOV low-side suppression is driven by a low-side suppression signal that serves as the control signal. When the SOV high-side drive output is high and the SOV low-side drive output is low, the solenoid valve of the corresponding actuator is turned on, and the actuator is driven.

4. The cross-linking control system for the multi-channel actuator according to claim 3, characterized in that, In any of the plurality of actuators used to drive the same controlled object, the SOV high side is driven connected to the SOV high side of a corresponding remote electronic unit, the SOV low side is driven connected to the SOV low side of a corresponding remote electronic unit, and the SOV low side is also suppressed connected only to the SOV low side of one of the plurality of remote electronic units other than the remote electronic unit corresponding to its own actuator.

5. The cross-linking control system for the multi-channel actuator according to claim 3, characterized in that, When the remote electronic unit receives the normal control law from the multiple secondary computers, it causes the SOV high-side drive to output a high level, the SOV low-side drive to output a low level, and the SOV low-side suppression to output a high level.

6. The cross-linking control system for the multi-channel actuator according to claim 3, characterized in that, When the remote electronic unit receives the direct control law from the plurality of secondary computers, it causes the SOV high-side drive to output a high level, the SOV low-side drive to output a high level, and the SOV low-side suppression to output a low level.

7. The cross-linking control system for the multi-channel actuator according to claim 3, characterized in that, When the remote electronic unit fails, the SOV high-side drive outputs a low level, the SOV low-side drive outputs a low level, and the SOV low-side suppression outputs a low level.

8. The cross-linking control system for the multi-channel actuator according to claim 1, characterized in that, When two or more of the secondary computers enter the direct mode, all other secondary computers automatically enter the direct mode as well.

9. The cross-linking control system for the multi-channel actuator according to claim 1, characterized in that, The controlled object is the aircraft's control surfaces.

10. A cross-linking control method for a multi-channel actuator, characterized in that, In the cross-linking control system of the multi-channel actuator according to any one of claims 1 to 9 When the controlled object is driven by multiple actuators controlled by different secondary computers, it is determined whether each secondary computer is in normal mode or direct mode. When any one of the different secondary computers is determined to be in normal mode, that secondary computer controls its remote electronic unit to activate the solenoid valve of the corresponding actuator. When any one of the different secondary computers is determined to be in direct mode, the secondary computer controls its remote electronic unit to not connect the solenoid valve of the corresponding actuator.

11. The cross-linking control method for a multi-channel actuator according to claim 10, characterized in that, The remote electronic unit is configured as follows: When receiving the normal control law from the multiple secondary computers, the high-side drive signal, the low-side drive signal, and the low-side suppression signal are set to true. When receiving the direct control law from the multiple secondary computers, the high-side drive signal is set to true, and the low-side drive signal and the low-side suppression signal are set to false.

12. The cross-linking control method for a multi-channel actuator according to claim 11, characterized in that, When the high-side drive signal emitted by the remote electronic unit is true, the SOV high-side drive provides a high level to the SOV high side. When the high-side drive signal emitted by the remote electronic unit is false, the SOV high-side drive provides a low level to the SOV high side. When the low-side drive signal emitted by the remote electronic unit is true, the SOV low-side drive provides a low level to the SOV low side. When the low-side drive signal emitted by the remote electronic unit is false, the SOV low-side drive provides a high level to the SOV low side; When the low-side suppression signal emitted by the remote electronic unit is true, the SOV low-side suppression provides a high level to the SOV low side. When the low-side suppression signal emitted by the remote electronic unit is false, the SOV low-side suppression provides a low level to the SOV low side.

13. The cross-linking control method for a multi-channel actuator according to claim 10, characterized in that, When any of the different secondary computers is determined to be neither in normal mode nor in direct mode, it is determined that its remote electronic unit has failed and cannot connect the solenoid valve of the corresponding actuator.

14. The cross-linking control method for a multi-channel actuator according to claim 12, characterized in that, The remote electronic unit is configured as follows: When a failure occurs, regardless of whether the signal is true or false, the SOV high-side driver provides a low level to the SOV high-side, the SOV low-side driver provides a low level to the SOV low-side, and the SOV low-side suppressor provides a low level to the SOV low-side.

15. The cross-linking control method for a multi-channel actuator according to claim 10, characterized in that, When any one of the secondary computers is determined to be in direct mode, and the other secondary computers are determined to be not in normal mode... The secondary computer in direct mode is designated as the primary computer, and the remote electronic unit controlled by the primary computer is defined as the first remote electronic unit. Conversely, the secondary computer not in normal mode is designated as the secondary computer, and the remote electronic unit controlled by the secondary computer is defined as the second remote electronic unit. The first-level computer controls the first remote electronic unit to not turn on the solenoid valve of the corresponding actuator, but the solenoid valve of the actuator will be turned on via the second remote electronic unit of the second-level computer.

Images