Electrically controlled method for distributed large eVTOL

Abstract

The application discloses a distributed large eVTOL electric governor control method, relates to the technical field of aircraft control systems, and discloses a distributed large eVTOL electric governor control method, which realizes rapid detection and isolation of faults, maintains system stability through accurate dynamic thrust compensation, can improve flight safety, reduce fault propagation risk, and ensure that the system can quickly recover to stability when hardware faults occur.

Description

Technical Field

[0001] This application relates to the field of aircraft control system technology, and in particular to an electronic control method for distributed large-scale eVTOL. Background Technology

[0002] The rapid development of electric vertical takeoff and landing (EVTOL) aircraft technology has driven the widespread application of multi-rotor distributed electric propulsion systems. These systems achieve high-efficiency flight control through multiple independent propulsion units, each consisting of a motor and an electronic speed controller (ESC), each connected to a dedicated power bus. However, while the distributed architecture enhances system flexibility, it also increases the risk of fault propagation. When a single ESC experiences a hardware failure, such as a short circuit in the power switch or an abnormal drive signal, the faulty unit not only fails itself but also triggers a voltage drop or current surge through the shared bus, causing abnormal power supply to adjacent units. This localized power grid collapse can trigger a chain reaction, causing previously healthy ESC units to misjudge their operating status, resulting in uncommanded thrust output. During critical flight phases, such abnormal thrust can disrupt the aircraft's torque balance, creating uncontrollable roll or yaw moments, severely threatening flight stability. Existing ESC control systems generally operate in isolated modes, with each unit relying solely on local sensor data for fault detection, lacking a real-time data interaction mechanism with neighboring units and the main controller. Therefore, the system cannot effectively distinguish between real hardware failures and transient interference, and it is even more difficult to complete the physical isolation of faulty units and the dynamic reallocation of thrust load within a millisecond timescale. Especially in hovering or low-speed transitional flight states, a single ESC failure can quickly evolve into global attitude loss of control. Current technology has not yet established a collaborative framework for rapid isolation at the hardware level and intelligent compensation at the system level, resulting in a significant reduction in the safety margin of the aircraft.

[0003] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0004] The main objective of this application is to provide an electronic control method for a distributed large-scale eVTOL, which aims to improve flight safety, reduce the risk of fault propagation, and ensure that the system can quickly recover stability in the event of hardware failure.

[0005] To achieve the above objectives, this application proposes an electronic speed control (ESC) method for a distributed large-scale eVTOL. The eVTOL's power system includes multiple ESC modules powered by independent busbars. Geographically adjacent ESC modules are interconnected to form a power cluster. Each ESC module has at least one power input interface that can be switched to two different busbars. The method includes:

[0006] The ESC module collects its own operating parameters in real time, uses the collected operating parameters as local health status data, and broadcasts the local health status data within the power cluster to which the ESC module belongs through the communication network.

[0007] The ESC module receives other health status data broadcast from other ESC modules within the same power cluster, cross-compares and verifies the consistency of the local health status data with the other health status data, and generates a confidence assessment result corresponding to the ESC module.

[0008] When the local health status data indicates that the ESC module has a serious hardware failure of a preset type, or when the confidence assessment result determines that the ESC module is in an abnormal working state, the ESC module generates a hardware failure isolation instruction containing a fault identifier and fault module identity information.

[0009] According to the hardware fault isolation command, the ESC module identified as faulty cuts off the motor drive output of the ESC module and switches the power input interface of the ESC module from the currently connected first sub-bus to the preset second sub-bus.

[0010] The main controller receives the hardware fault isolation command and calculates the theoretical thrust loss value of the faulty power cluster to which the faulty module belongs based on the faulty module identity information therein. Based on the theoretical thrust loss value and the real-time state of the faulty power cluster after completing intra-cluster rebalancing, the main controller generates incremental thrust compensation commands for neighboring healthy power clusters and attitude adjustment commands for the entire aircraft.

[0011] In one embodiment, the step of the ESC module receiving other health status data broadcast from other ESC modules within the same power cluster, and cross-comparing and verifying the local health status data with the other health status data to generate a confidence assessment result corresponding to the ESC module includes:

[0012] The ESC module receives and parses other health status data broadcast by other ESC modules within its power cluster, and extracts current and temperature information from the other health status data;

[0013] The current information in the local health status data of this module is compared with the current information of other ESC modules. If the difference is less than the preset similarity threshold, the ESC module is determined to be at a similar operating point.

[0014] For ESC modules operating at similar points, compare their temperature information. If the temperature information of this module is higher than the average temperature information of other ESC modules operating at similar points, and the difference exceeds a preset temperature deviation threshold, then generate a preliminary abnormal signal indicating that this module may be overheating. If the temperature information of this module is lower than the average temperature information, and the difference exceeds the temperature deviation threshold, then generate a preliminary abnormal signal indicating that the temperature sampling of this module may have failed.

[0015] Based on the preliminary abnormal signal and combined with the historical temperature change trend calculated from the temperature information of multiple consecutive periods stored in this module, the confidence assessment result is generated.

[0016] In one embodiment, the step of receiving other health status data broadcast by other ESC modules within the same power cluster, cross-comparing and verifying the local health status data with the other health status data, and generating a confidence assessment result corresponding to the ESC module further includes:

[0017] The ESC module calculates the real-time resultant torque balance of the power cluster based on the current information in the local health status data and the current information in the other health status data.

[0018] If the confidence assessment result indicates that the status of this module is questionable, and the resultant torque balance shows that there are abnormal fluctuation components in the torque components related to this module that do not match the current flight command, then feature data is extracted based on the abnormal fluctuation components, and the feature data is added to the confidence assessment result as auxiliary diagnostic information.

[0019] In one embodiment, the step of receiving other health status data broadcast by other ESC modules within the same power cluster, cross-comparing and verifying the local health status data with the other health status data, and generating a confidence assessment result corresponding to the ESC module further includes:

[0020] The ESC module extracts the stored historical local health status data, combines it with the local health status data of the current period to form the current health status data sequence, and performs real-time matching of the current health status data sequence with the pre-stored local lightweight fault early symptom pattern library.

[0021] If an early symptom pattern with a similarity exceeding a preset matching threshold is matched, the parameter weights and judgment thresholds used to generate the confidence assessment results are dynamically adjusted based on the expected failure development speed and impact of the pattern.

[0022] In one embodiment, determining that the operating state of the ESC module is abnormal based on the confidence assessment result includes:

[0023] When the confidence assessment result of the ESC module is lower than the first preset threshold, the ESC module determines that it has entered a low confidence test state and broadcasts a request for re-verification signal containing the current complete health status data of the ESC module to its power cluster.

[0024] Other ESC modules within the power cluster receive the request re-verification signal, compare the stored historical health status data sequence of the ESC module with the currently received complete health status data, and determine whether the state decline trajectory of the ESC module matches any early symptom mode in the pre-stored historical failure mode case library.

[0025] Each neighboring signaling module generates pattern matching verification opinions based on the comparison results, and generates comprehensive confirmation feedback by combining the real-time cross-verification results of the neighboring signaling module itself with the comparison results of the signaling module.

[0026] After broadcasting the request for re-verification signal, if the number of comprehensive confirmation feedbacks indicating that the ESC module's working state is abnormal received within a preset time exceeds a preset arbitration threshold, then the working state of the ESC module is ultimately determined to be abnormal, triggering the generation of the hardware fault isolation instruction.

[0027] In one embodiment, before the main controller generates the incremental thrust compensation command and attitude adjustment command, the method further includes:

[0028] When one ESC module in a power cluster is isolated, the remaining healthy ESC modules in the power cluster negotiate through communication, and based on the real-time current and temperature parameters of each module, reallocate the total thrust command required by the power cluster according to the load balancing strategy, generating temporary load adjustment amounts for each healthy ESC module and updated cluster status information.

[0029] In one embodiment, reallocating the total thrust command required for the power cluster according to a load balancing strategy includes:

[0030] The health ESC module calculates the current remaining power capacity of the health ESC module based on the current temperature parameters and the maximum allowable temperature.

[0031] The weighting coefficient is the ratio of the remaining power capacity of each health ESC module to the total remaining power capacity of all health ESC modules.

[0032] Based on the thrust command share undertaken by the isolated faulty ESC module just before isolation, the thrust load increment originally undertaken by the isolated faulty ESC module is determined, and then distributed to each healthy ESC module according to the weighting allocation coefficient to obtain the temporary load adjustment amount.

[0033] In one embodiment, the main controller generates incremental thrust compensation commands and attitude adjustment commands based on the theoretical thrust loss value and by integrating the real-time state of the faulty power cluster after intra-cluster rebalancing, including:

[0034] The main controller obtains the fault module's identity information and the fault type of the fault module from the hardware fault isolation instruction;

[0035] The main controller queries the pre-trained dynamic model parameter set associated with the fault type according to the fault type; the pre-trained dynamic model parameter set is used to characterize the transient characteristics of the total thrust of the fault power cluster decaying over time after a specific fault occurs.

[0036] The main controller combines the command thrust of the faulty power cluster at the moment of the fault with the parameter set of the pre-trained dynamic model, and introduces the real-time state of the faulty power cluster as a correction factor to calculate the estimated attenuation curve of the thrust output of the faulty power cluster within a set time window from the current moment.

[0037] The integral average value of the estimated attenuation curve within the set time window is calculated as the current available thrust estimate, and the precise total thrust requirement to be compensated is determined based on the theoretical thrust loss value and the current available thrust estimate.

[0038] Based on the precise total thrust requirement and the current flight attitude, the main controller determines the target healthy power clusters that need to provide compensating thrust, and generates the incremental thrust compensation command for each of the target healthy power clusters.

[0039] Based on the theoretical thrust loss value, the geometric layout of the faulty power cluster and the target healthy power cluster, the main controller predicts the undesirable additional torque, calculates the corresponding compensation torque, and generates the attitude adjustment command.

[0040] In one embodiment, the step of the main controller determining the target healthy power clusters that require compensating thrust based on the precise total thrust requirement and the current flight attitude, and generating the incremental thrust compensation command for each of the target healthy power clusters, includes:

[0041] Based on the precise total thrust requirement and the current flight attitude, the main controller determines the target healthy power cluster that needs to provide compensating thrust;

[0042] For each target healthy power cluster, based on its spatial position relative to the faulty power cluster, the total thrust requirement to be compensated is decomposed into compensation components along multiple axes of the body coordinate system.

[0043] The compensation components for each axis are allocated according to the thrust contribution capability coefficient of each target healthy dynamic cluster in that axis, and the incremental thrust compensation command is generated and sent to each target healthy dynamic cluster.

[0044] In one embodiment, the steps of the main controller predicting the undesirable additional torque, calculating the corresponding compensation torque, and generating the attitude adjustment command based on the theoretical thrust loss value, the geometric layout of the faulty power cluster and the target healthy power cluster include:

[0045] Calculate the compensation torque that each of the target healthy power clusters will generate based on the incremental thrust compensation command;

[0046] The predicted undesirable additional torque is compared with the calculated compensation torque to determine the additional compensation torque that still needs to be generated by the differential thrust of the aerodynamic control surfaces or the remaining healthy power cluster.

[0047] The additional compensation torque is converted into a control surface deflection command or a differential thrust fine-tuning command to form the attitude adjustment command.

[0048] The distributed large-scale eVTOL electronic control method proposed in this application achieves rapid fault detection and isolation by using an electronic control module to collect and broadcast health status data in real time, perform cross-comparison to generate confidence assessment results, generate isolation commands and switch power interfaces in case of anomalies, and the main controller calculates thrust compensation requirements and generates compensation commands by combining theoretical thrust loss values ​​with the real-time rebalancing status within the faulty power cluster. At the same time, it maintains system stability through precise dynamic thrust compensation, which can improve flight safety, reduce the risk of fault propagation, and ensure that the system can quickly recover stability in the event of hardware failure. Attached Figure Description

[0049] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0050] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 A flowchart illustrating an embodiment of the distributed large-scale eVTOL electronic control method of this application;

[0052] Figure 2 For this application Figure 1 A detailed flowchart of step S200;

[0053] Figure 3 For this application Figure 1 A detailed flowchart of step S500;

[0054] Figure 4 For this application Figure 3 Detailed flowchart of step S550;

[0055] Figure 5 For this application Figure 3 A detailed flowchart of step S560.

[0056] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0057] The technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of this application, but merely represents selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0058] It should be understood that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, the terms "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0059] In existing multi-rotor distributed electric propulsion (eVTOL) systems, when a hardware failure occurs in a single ESC unit, its impact can rapidly extend beyond the unit itself, leading to local power grid collapse, abnormal drag torque, and ultimately, loss of aircraft attitude control. Current ESC control and fault handling lack effective mechanisms for rapid coordination with neighboring units and the main controller, achieving physical fault isolation and dynamic system dynamic reconfiguration. This makes it difficult to achieve immediate fault isolation at the hardware level and to quickly and accurately redistribute thrust at the system level to maintain flight stability.

[0060] Based on this, this application provides an electronic speed control method for a distributed large-scale eVTOL. The eVTOL's power system includes multiple electronic speed control modules powered by independent busbars. Geographically adjacent electronic speed control modules are interconnected to form a power cluster. Each electronic speed control module has at least one power input interface that can be switched to two different busbars. (Refer to...) Figure 1 The distributed large-scale eVTOL electronic control method includes steps S100 to S500, wherein:

[0061] Step S100: The ESC module collects its own operating parameters in real time, uses the collected operating parameters as local health status data, and broadcasts the local health status data within the power cluster to which the ESC module belongs through the communication network.

[0062] Step S200: The ESC module receives other health status data broadcast from other ESC modules within the same power cluster, performs cross-comparison and consistency verification between the local health status data and the other health status data, and generates a confidence assessment result corresponding to the ESC module.

[0063] Step S300: When the local health status data indicates that the ESC module has a serious hardware failure of a preset type, or when the ESC module is determined to be in an abnormal working state based on the confidence assessment result, the ESC module generates a hardware failure isolation instruction containing a fault identifier and fault module identity information.

[0064] Step S400: According to the hardware fault isolation instruction, the ESC module identified as faulty disconnects the motor drive output of the ESC module and switches the power input interface of the ESC module from the currently connected first busbar to the preset second busbar.

[0065] In step S500, the main controller receives the hardware fault isolation command and calculates the theoretical thrust loss value of the faulty power cluster to which the faulty module belongs based on the faulty module identity information therein. Based on the theoretical thrust loss value and the real-time state of the faulty power cluster after completing intra-cluster rebalancing, the main controller generates an incremental thrust compensation command for the adjacent healthy power cluster and an attitude adjustment command for the entire aircraft.

[0066] In this embodiment, eVTOL, or Electric Vertical Take-Off and Landing Aircraft, is an electric-powered aircraft with vertical take-off and landing capabilities. This aircraft typically employs a multi-rotor distributed propulsion system to achieve flight control and power output. The ESC module is the functional unit of the electronic speed controller, used to control the motor's speed and output power. In an eVTOL system, each ESC module typically works in conjunction with one motor, forming the basic unit of the power system. A busbar refers to the power line that provides electrical energy to the ESC module. In a distributed propulsion system, multiple independent busbars are usually set up to improve power redundancy and reliability. A power cluster refers to a group of geographically adjacent and communicatively interconnected ESC modules. These ESC modules work collaboratively as a whole to jointly complete thrust output and fault management in a local area. The power input interface is the physical connection port for the ESC module to receive electrical energy. This interface can connect to different busbars, thereby enabling power switching in case of power supply failure. Local health status data refers to the real-time self-operating parameters collected by the ESC module, such as current, voltage, temperature, and speed. This data is used to assess the current operating status of the ESC module. The confidence level assessment result is an indicator that quantifies the reliability of the ESC module's operating status based on the ESC module's local health status data and cross-comparison results with other ESC modules.

[0067] In this embodiment, the hardware fault isolation command is a control command generated by the ESC module itself or the system when a serious hardware fault or abnormal operating state occurs in the ESC module. This command is used to trigger the physical isolation operation of the faulty ESC module. The main controller is the core control unit of eVTOL, responsible for receiving pilot commands and sensor data, and generating flight control commands, including thrust commands and attitude commands, to maintain stable flight of the aircraft. The theoretical thrust loss value refers to the difference between the thrust that the faulty ESC module or its associated power cluster should have provided before the fault occurred and the actual thrust that can be provided after the fault, used to accurately assess the loss of the system's total thrust capability due to the fault. The real-time rebalancing status within the cluster refers to the real-time operating parameters and thrust output status of the remaining healthy modules in the power cluster after the faulty ESC module is isolated and the load redistribution is completed. The incremental thrust compensation command is a precise additional thrust output command issued by the main controller to the adjacent healthy power cluster, combining the theoretical thrust loss value and the cluster rebalancing status. The attitude adjustment command is an attitude correction command issued by the main controller to the aircraft control system after the fault occurs to offset the undesired attitude changes caused by thrust loss or unbalanced torque.

[0068] In this embodiment, the eVTOL's power system is configured to include multiple electronic speed control (ESC) modules, which are powered via independent busbars. Geographically adjacent ESC modules are interconnected via a communication network to form a power cluster. Each ESC module is designed to have at least two power input interfaces that can be switchably connected to two different busbars to enhance power supply reliability.

[0069] In this embodiment, the distributed large-scale eVTOL electronic speed controller (ESC) control method first collects its own operating parameters in real time through the ESC module. The ESC module can periodically collect its internal operating parameters such as current, voltage, temperature, motor speed, and PWM signal duty cycle. For example, the ESC module can have built-in sensors that sample these parameters at a frequency of milliseconds or microseconds. These collected operating parameters are used as local health status data. Subsequently, this local health status data is broadcast within the power cluster to which the ESC module belongs via a communication module inside the ESC module, such as a CAN bus or Ethernet. The broadcast method can be periodic transmission or triggered when parameters change.

[0070] Furthermore, the ESC module receives additional health status data broadcast from other ESC modules within the same power cluster. Upon receiving this data, the ESC module cross-references and verifies the consistency of its local health status data with the received data. For example, the ESC module can compare its own current or temperature data with that of neighboring modules; differences under similar operating conditions may indicate an anomaly. This comparison generates a confidence assessment result for the corresponding ESC module. This assessment result can be a numerical value representing the reliability of the ESC module's current operating status, or a status indicator such as "normal," "suspect," or "abnormal."

[0071] In this embodiment, when the local health status data indicates that the ESC module has experienced a preset type of serious hardware fault, such as detecting a direct hardware abnormality signal like a power transistor short circuit, overcurrent, or overvoltage, or when the ESC module's operating state is determined to be abnormal based on the aforementioned confidence assessment results, the ESC module will generate a hardware fault isolation instruction containing a fault identifier and fault module identity information. For example, the fault detection logic inside the ESC module can determine the fault type based on a preset threshold or pattern matching, and generate an instruction package with its own unique ID and fault code.

[0072] In this embodiment, according to the hardware fault isolation command, the ESC module identified as faulty will perform an isolation operation. Specifically, the faulty ESC module will immediately cut off its motor drive output, stopping power supply to the motor to prevent the fault from spreading or causing further damage. Simultaneously, the power input interface of the faulty ESC module will switch from the currently connected first busbar to a preset second busbar. This switching can be achieved through internal relays or electronic switches, aiming to isolate the faulty module from the main power supply network and attempt to recover from the backup power supply, or at least prevent it from affecting the main power supply.

[0073] In this embodiment, after receiving the hardware fault isolation command, the main controller first calculates the theoretical thrust loss value of the faulty power cluster based on the faulty module's identity information. Then, it integrates the real-time state of the faulty power cluster after completing intra-cluster load rebalancing to accurately determine the global thrust compensation requirement. For example, the main controller can combine the faulty module ID, the load status of the remaining modules in the cluster, and the thrust output capability to calculate the difference between the lost thrust and the compensable thrust. Subsequently, the main controller generates incremental thrust compensation commands for neighboring healthy power clusters based on the accurate compensation requirements, and simultaneously generates overall aircraft attitude adjustment commands based on the aircraft's geometry and attitude status to ensure rapid stabilization of the aircraft's thrust and attitude after a fault.

[0074] In this embodiment, precise perception of the operating status of the ESC modules is achieved through collaborative comparison and confidence assessment of health status data among the ESC modules. When a hardware fault or anomaly is detected, a hardware fault isolation command can be generated in real time, prompting the faulty ESC module to cut off the motor drive and switch the power input interface, thereby achieving rapid physical isolation of the fault at the hardware level and effectively preventing the fault from spreading. At the same time, the main controller integrates theoretical thrust loss with the real-time state of intra-cluster rebalancing for dynamic compensation calculation, which can more accurately compensate for thrust loss and ensure that the eVTOL can still maintain flight stability and control capability after a fault occurs, thus improving the safety and reliability of the multi-rotor distributed propulsion eVTOL.

[0075] In one feasible implementation, refer to Figure 2 Step S200 includes steps S210 to S240, wherein:

[0076] Step S210: The ESC module receives and parses other health status data broadcast by other ESC modules in its power cluster, and extracts the current information and temperature information from the other health status data.

[0077] Step S220: Compare the current information in the local health status data of this module with the extracted current information of other ESC modules. If the difference is less than the preset similarity threshold, the ESC module is determined to be at a similar operating point.

[0078] Step S230: For ESC modules at similar operating points, compare the temperature information of the ESC modules; if the temperature information of this module is higher than the average temperature information of other ESC modules at similar operating points, and the difference exceeds a preset temperature deviation threshold, then generate a preliminary abnormal signal indicating that this module may be overheating; if the temperature information of this module is lower than the average temperature information, and the difference exceeds the temperature deviation threshold, then generate a preliminary abnormal signal indicating that the temperature sampling of this module may have failed.

[0079] Step S240: Based on the preliminary abnormal signal and combined with the historical temperature change trend calculated from the temperature information of multiple consecutive cycles stored in this module, the confidence assessment result is generated.

[0080] In this embodiment, the ESC module receives health status data packets periodically broadcast from other ESC modules within the same power cluster via its built-in communication interface. These data packets typically contain multiple operating parameters, among which current and temperature information are key indicators for evaluating the operating status of the ESC module. The processor receiving the ESC module parses these data packets, accurately extracting the real-time current and temperature values ​​of other ESC modules for subsequent cross-comparison. The current information reflects the load and power output of the ESC module, while the temperature information is directly related to the module's heat dissipation performance and potential overheating risk.

[0081] In this embodiment, in a distributed propulsion system, ESC modules within the same power cluster typically bear similar thrust commands, therefore their current information should be highly consistent under normal circumstances. This step compares the local current information of this ESC module with the current information of other ESC modules within the same power cluster to determine whether they are under similar workload conditions. The preset similarity threshold is an empirical value or a value obtained through system calibration, used to define the allowable range of current differences. If the current difference is within this threshold, these ESC modules are considered to be at similar operating points, providing a prerequisite for subsequent anomaly detection based on temperature information and avoiding misjudgments caused by load differences.

[0082] In this embodiment, after confirming that the ESC modules are at similar operating points, their temperature information should be highly comparable. This step further compares the temperature information of this ESC module with the average temperature information of other ESC modules at similar operating points within the same power cluster. If the temperature of this module is higher than the average and exceeds a preset temperature deviation threshold, it strongly indicates that the module may have a risk of overheating due to poor heat dissipation or excessive internal losses. Conversely, if the temperature of this module is lower than the average and exceeds the preset temperature deviation threshold, it may indicate that its temperature sensor has a sampling fault, such as sensor detachment, short circuit, or reading drift, resulting in an inaccurate reflection of the actual temperature. Both of these situations will generate corresponding preliminary abnormal signals, providing key input for subsequent confidence assessment.

[0083] In this embodiment, the initial anomaly signal provides an immediate indication of an anomaly. However, to improve the accuracy and robustness of the assessment, it is necessary to combine it with historical data for comprehensive judgment. This step analyzes the initial anomaly signal with historical temperature information stored in the ESC module itself for multiple consecutive periods to calculate its historical temperature change trend. For example, it can analyze the rate of temperature rise, fluctuation amplitude, and whether it continuously deviates from the normal range. By combining the real-time initial anomaly signal with historical trends (such as a continuous overheating trend, a long-term low temperature sensor reading trend, etc.), the confidence level of the ESC module can be assessed more comprehensively and accurately. For example, a brief temperature rise may be judged as a normal fluctuation by historical trends, while a continuous, rapid temperature rise trend will strengthen the judgment of overheating, thereby generating a more reliable confidence assessment result.

[0084] In this embodiment, cross-comparison of current information ensures that temperature comparisons are performed under similar workload conditions, effectively avoiding misjudgments caused by load differences. Secondly, precise comparison of temperature information not only identifies potential overheating risks but also distinguishes sampling failures of the temperature sensor itself. This is crucial for distributed propulsion systems, as sensor failures can lead to incorrect fault isolation or missed faults. Finally, combining preliminary anomaly signals with historical temperature change trends for comprehensive evaluation makes the confidence assessment results more robust and reliable, effectively filtering transient disturbances and identifying persistent or developing anomalies, thereby improving the accuracy of fault diagnosis and reducing false alarm and false negative rates. This multi-dimensional, multi-timescale health status assessment mechanism enhances the redundancy and fault tolerance of the eVTOL propulsion system, ensuring flight safety.

[0085] In one feasible implementation, step S200 further includes: the ESC module calculates the real-time resultant torque balance of the power cluster based on the current information in the local health status data and the current information in the other health status data; if the confidence assessment result indicates that the status of the module is suspicious, and the resultant torque balance shows that the torque component related to the module has an abnormal fluctuation component that does not match the current flight command, then feature data is extracted based on the abnormal fluctuation component, and the feature data is added to the confidence assessment result as auxiliary diagnostic information.

[0086] In this embodiment, the ESC module calculates the real-time resultant torque balance of the power cluster based on the current information in the local health status data and the current information in the other health status data. Real-time resultant torque balance refers to whether the spatial distribution of the total thrust or torque generated by all ESC modules and their driven motors within a power cluster conforms to expectations. In multi-rotor aircraft, each power cluster typically consists of multiple ESC modules that work collaboratively to generate specific thrust vectors and torques. Resultant torque balance reflects the coordination and stability of thrust output within the power cluster. The ESC module can collect real-time current information from all healthy ESC modules within the power cluster. Since there is a certain mapping relationship between current and the thrust (and thus torque) generated by the motors, the instantaneous torque contribution of each ESC module can be calculated using this current information, combined with the physical position and geometric layout of each ESC module within the power cluster. Vector superposition of these instantaneous torque contributions yields the real-time resultant torque of the power cluster. Its balance can be evaluated by comparing it with the expected resultant torque (based on flight control commands). For example, the deviation of the current of each ESC module from the average current can be calculated, or the deviation of the thrust generated by each ESC module from the theoretical thrust can be calculated, and the contribution to the overall torque of the power cluster can be calculated in combination with its position, thereby evaluating the overall torque balance.

[0087] Furthermore, if the confidence assessment result indicates that the module's status is questionable, and the resultant torque balance shows that the torque component related to this module has abnormal fluctuation components that do not match the current flight command, then feature data is extracted based on the abnormal fluctuation components, and the feature data is added to the confidence assessment result as auxiliary diagnostic information. Here, "the confidence assessment result indicates that the module's status is questionable" can be expressed as a confidence score lower than a preset "questionable" threshold, but higher than a "fault" threshold. For "the resultant torque balance shows that the torque component related to this module has abnormal fluctuation components that do not match the current flight command," the ESC module can continuously monitor the deviation between its own output current (or thrust) and the command requirements of the main controller, and analyze whether this deviation has caused unexpected fluctuations in the overall resultant torque of the power cluster, in conjunction with the outputs of other modules within the power cluster. For example, if the current output of one module experiences severe fluctuations in a short period of time, while other modules remain relatively stable, and this fluctuation causes an instantaneous imbalance in the overall torque of the power cluster, then it can be determined that there are abnormal fluctuation components. It can identify abnormal fluctuations by performing spectral analysis and statistical variance calculation on current or thrust signals. When the above conditions are met, the system no longer relies solely on the original confidence assessment results, but extracts more diagnostically valuable "feature data" from the abnormal fluctuations at the power cluster level and integrates it into the confidence assessment results to provide richer and more accurate fault diagnosis basis. This feature data can help the main controller or higher-level diagnostic logic to more accurately determine the fault type and severity. Extracted feature data may include, but is not limited to: the amplitude, frequency, duration, waveform characteristics (e.g., whether it is periodic jitter or random pulse) of the abnormal fluctuation components, and their impact on the overall torque balance of the power cluster. For example, if the abnormal fluctuation manifests as oscillations at a specific frequency, that frequency itself can serve as feature data. If the fluctuation amplitude exceeds a certain dynamic threshold, that amplitude can also serve as feature data. This feature data can be extracted from the original current or torque component data using signal processing techniques (such as Fourier transform, wavelet analysis, statistical moment calculation, etc.). The extracted feature data is then encapsulated or encoded and sent or stored together with the original confidence assessment results as auxiliary information for subsequent fault diagnosis and isolation decisions.

[0088] In this embodiment, by introducing the calculation of the real-time resultant torque balance of the power cluster, this application can verify the "suspicious" state of a single ESC module at the system level. When the confidence assessment result of a single module indicates that its state is suspicious, combining the torque balance analysis of the entire power cluster, especially identifying abnormal fluctuation components related to the suspicious module that do not match flight commands, can effectively avoid misjudgment or omission. This multi-dimensional, system-level cross-verification mechanism makes the judgment of the ESC module's operating state more accurate and reliable. Furthermore, extracting feature data from abnormal fluctuation components and appending it to the confidence assessment result provides richer and more refined auxiliary information for subsequent fault diagnosis, helping the main controller to more accurately identify the fault type and assess the severity of the fault, thereby enabling the formulation of more precise fault isolation and compensation strategies, and improving the redundancy and fault tolerance capability and flight safety of the entire eVTOL power system.

[0089] In one feasible implementation, step S200 further includes: the electronic control module extracts stored historical local health status data, combines it with local health status data of the current period to form a current health status data sequence, and performs real-time matching of the current health status data sequence with a pre-stored local lightweight fault early symptom pattern library; if an early symptom pattern with a similarity exceeding a preset matching threshold is matched, the parameter weights and judgment thresholds used to generate the confidence assessment result are dynamically adjusted according to the expected fault development speed and impact degree corresponding to the pattern.

[0090] In this embodiment, the ESC module continuously collects its own operating parameters during operation, such as current, voltage, temperature, speed, and vibration. These parameters constitute local health status data. To achieve a more comprehensive assessment of the ESC module's health status, the ESC module not only focuses on the local health status data for the current period but also extracts and stores historical local health status data from a past period. This historical data can be stored in the ESC module's internal non-volatile memory or a circular buffer to ensure data continuity and traceability. By combining the current period's local health status data with this stored historical data, a "current health status data sequence" with time-series characteristics can be formed. This sequence reflects the ESC module's operating trajectory and state evolution over a period of time, providing rich time-dimensional information for subsequent fault mode matching. For example, data from the most recent N sampling periods can be stored to form a data sequence of length N, where the value of N can be reasonably set according to the fault development cycle of the ESC module and the data sampling frequency.

[0091] In this embodiment, to identify potential faults earlier and more accurately, the ESC module pre-stores a "local lightweight fault early symptom pattern library." This library contains typical health state data sequence patterns exhibited by various known ESC module or motor faults in their early stages. These patterns can be constructed and trained through extensive fault injection experiments, historical fault data analysis, or physical model-based simulations. For example, an early symptom of bearing wear might manifest as a specific sequence of vibration frequency changes, while insulation aging might manifest as a slow increase in leakage current. "Lightweight" here refers to the optimized size of the pattern library and the complexity of the matching algorithm to accommodate the limited computing resources and real-time requirements of the ESC module. The ESC module continuously matches the real-time generated "current health state data sequence" with various early symptom patterns in the library. The matching process can employ various sequence similarity measurement algorithms, such as Dynamic Time Warping (DTW), distance calculation based on feature vectors, or lightweight machine learning classifiers, to assess the similarity between the current sequence and any pattern in the library.

[0092] In this embodiment, when the similarity between the current health status data sequence of the ESC module and an early symptom pattern in the pattern library exceeds a preset matching threshold, it indicates that the ESC module may be in the early development stage of the fault corresponding to that pattern. At this time, the system will not immediately determine it as a fault, but will dynamically adjust the parameter weights and judgment thresholds used to generate the confidence assessment results based on the preset "expected fault development speed" and "impact level" information of the matched early symptom pattern. For example, if the matched pattern indicates a potential fault with a rapid development speed and severe impact (such as a partial short circuit in the motor windings), the system will correspondingly increase the weight of health parameters related to the fault (such as current imbalance and local temperature) in the confidence assessment and appropriately lower the anomaly judgment threshold, making it more sensitive to minor abnormal changes, thereby achieving earlier warning. Conversely, if the matched pattern indicates a potential fault with a slow development speed and minor impact (such as slight bearing wear), the adjustment range will be relatively conservative to avoid oversensitivity. This dynamic adjustment mechanism makes the confidence assessment process more adaptive and forward-looking, enabling intelligent risk assessment based on the characteristics of potential faults.

[0093] In this embodiment, through the above technical solution, the ESC module can construct a time series using historical local health status data and perform real-time matching with a pre-stored library of early fault symptom patterns. This allows the system to no longer rely solely on instantaneous or short-term trend anomalies, but instead identify potential faults that develop slowly, have inconspicuous initial characteristics, but exhibit specific temporal evolution patterns. When an early symptom pattern with a similarity exceeding a preset matching threshold is matched, the system can dynamically adjust the parameter weights and judgment thresholds used to generate confidence assessment results based on the expected fault development speed and impact corresponding to that pattern. This forward-looking and adaptive adjustment mechanism improves the ESC module's early fault identification capability and diagnostic accuracy. It avoids false alarms or missed alarms caused by fixed thresholds, enabling the system to issue early warnings before a fault evolves into a serious hardware failure. This buys valuable time for the main controller to take preventative measures or perform smoother fault isolation operations, further enhancing the redundancy and fault tolerance of the eVTOL power system and flight safety.

[0094] In one feasible implementation, determining an abnormal operating state of the ESC module based on the confidence assessment result includes: when the confidence assessment result of the ESC module is lower than a first preset threshold, the ESC module determines that it has entered a low-confidence pending inspection state and broadcasts a request for re-verification signal containing the current complete health status data of the ESC module to its power cluster; other ESC modules in the power cluster receive the request for re-verification signal, compare the stored historical health status data sequence of the ESC module with the currently received complete health status data, and determine whether the state decay trajectory of the ESC module matches any early symptom pattern in the pre-stored historical failure mode case library; each neighboring ESC module generates a pattern matching verification opinion based on the comparison result, and generates a comprehensive confirmation feedback by combining the real-time cross-verification result of the neighboring ESC module on the ESC module; after broadcasting the request for re-verification signal, if the number of comprehensive confirmation feedbacks indicating that the operating state of the ESC module received by the ESC module within a preset time exceeds a preset arbitration threshold, the operating state of the ESC module is finally determined to be abnormal, triggering the generation of the hardware fault isolation instruction.

[0095] In this embodiment, when the confidence assessment result of the ESC module is lower than a first preset threshold, the ESC module determines that it has entered a low-confidence pending inspection state and broadcasts a request for reverification signal containing the current complete health status data of the ESC module to its power cluster. The first preset threshold is a key configuration parameter, set to define the critical point at which the ESC module transitions from a normal operating state to a potentially abnormal state, comprehensively considering the system's fault tolerance, false alarm rate, and false negative rate. The ESC module entering a low-confidence pending inspection state means that its self-diagnostic system lacks confidence in its own status and needs to initiate a deeper verification process. At this time, the ESC module proactively broadcasts a request for reverification signal to other healthy ESC modules in the power cluster. This signal contains all its currently available complete health status data, such as detailed operating parameters like current, voltage, temperature, speed, and control command response, aiming to seek external collaborative verification.

[0096] In this embodiment, after receiving the request for reverification signal, other ESC modules within the power cluster compare the stored historical health status data sequence of the ESC module with the currently received complete health status data to determine whether the state decline trajectory of the ESC module matches any early symptom pattern in the pre-stored historical failure mode case library. Specifically, other healthy ESC modules within the power cluster act as independent verification nodes and initiate a collaborative diagnostic process upon receiving a request from a suspicious module. Each neighboring ESC module typically stores historical operating data of other modules within its power cluster for trend analysis and anomaly detection. By longitudinally comparing the real-time data of the suspicious module with its own stored historical data, the changing trends of its operating parameters can be analyzed in depth. Simultaneously, the system's pre-stored historical failure mode case library is a knowledge base containing characteristic data patterns and decline trajectories exhibited in the early stages of various known fault types (such as bearing wear, winding short circuits, sensor drift, etc.). For example, a sustained slow rise or periodic fluctuation of a key parameter may indicate the occurrence of a specific fault. This comparison is based on pattern recognition and trend analysis, aiming to identify potential, yet not fully manifested, fault signs.

[0097] Based on this, each neighboring electrical control module generates a pattern matching verification opinion according to the comparison results, and combines this with the real-time cross-validation results of the neighboring electrical control module itself to generate a comprehensive confirmation feedback. The pattern matching verification opinion is an assessment of the degree of matching between the state decay trajectory of the suspected module and the historical failure mode case library, and can be a confidence score or a Boolean value. In addition to historical data comparison, the neighboring electrical control module also uses the health status data of the suspected module that it receives in real time to perform real-time horizontal cross-comparison, such as comparing it with similar parameters of itself or other modules in the power cluster, to further verify its status. Finally, each neighboring electrical control module generates a comprehensive confirmation feedback, which integrates the results of historical trend analysis and real-time cross-validation, and gives an independent judgment on the status of the suspected module.

[0098] In this embodiment, after broadcasting the request for re-verification signal, if the number of comprehensive confirmation feedbacks indicating an abnormal operating state received by the ESC module within a preset time exceeds a preset arbitration threshold, the ESC module is ultimately determined to be abnormal, triggering the generation of the hardware fault isolation command. The preset time is a time window used to collect feedback from neighboring ESC modules. The system counts how many neighboring modules consider a suspected module to be abnormal within the specified time. The preset arbitration threshold is a key decision parameter; for example, it can be set to the majority of healthy ESC modules within the power cluster, i.e., a majority voting mechanism. Only when a majority or a sufficient number of neighboring modules confirm that a suspected module is abnormal is its operating state ultimately diagnosed as abnormal. This distributed arbitration mechanism effectively avoids the possibility of misjudgment by a single module or collusion by a few modules, ensuring the fairness and reliability of the decision. Once the ESC module is ultimately determined to be abnormal, the generation of the hardware fault isolation command is immediately triggered to ensure system security.

[0099] In this embodiment, through the above technical solution, when the self-diagnostic confidence of the ESC module decreases, it can proactively initiate collaborative verification. Utilizing the independent judgment and historical data analysis capabilities of other healthy ESC modules within the power cluster, it performs multi-dimensional and multi-perspective cross-verification of its own status. This distributed arbitration mechanism effectively avoids the misjudgment or lag issues that may exist in single-module self-diagnosis, improving the accuracy and reliability of fault determination. By comparing with a historical failure mode case library, potential fault symptoms and degradation trends can be identified earlier, thereby achieving early warning and timely isolation of faults and preventing fault escalation. Finally, the majority arbitration-based decision-making mechanism ensures that hardware fault isolation is triggered only when sufficient evidence is obtained, greatly enhancing the redundancy and fault tolerance capabilities and flight safety of the eVTOL power system.

[0100] In one feasible implementation, before the main controller generates incremental thrust compensation commands and attitude adjustment commands, the method further includes: when one ESC module in the power cluster is isolated, the remaining healthy ESC modules in the power cluster negotiate through communication, and based on the real-time current parameters and temperature parameters of each module, reallocate the total thrust commands required by the power cluster according to the load balancing strategy, and generate temporary load adjustment amounts for each healthy ESC module and updated cluster status information.

[0101] In this embodiment, when an ESC module in the power cluster is isolated, this step clarifies the triggering condition of this scheme, namely, after an ESC module failure occurs within the power cluster and preliminary isolation operations have been performed. Isolation typically means that the faulty ESC module has stopped motor drive output and may have switched power input interfaces, but the thrust load it originally bore needs to be quickly compensated. In this scenario, the remaining healthy ESC modules within the power cluster achieve distributed decision-making through communication negotiation. The "communication negotiation" refers to the process of information exchange and collaborative decision-making among the various healthy ESC modules within the power cluster through a preset communication network. This can be achieved based on point-to-point communication, broadcast, or multicast mechanisms, ensuring that all participating modules can obtain the necessary information and reach a consensus on load allocation. For example, each healthy ESC module can broadcast its own health status, real-time load capacity, and other information, and receive information from other modules to jointly calculate the optimal load allocation scheme.

[0102] In this embodiment, during the negotiation process, each module makes decisions based on its own real-time current and temperature parameters. The "real-time current parameter" reflects the actual workload of the ESC module, while the "temperature parameter" indicates the thermal state and potential overload risk of the ESC module, and is a key indicator for assessing its continuous operating capability and remaining power capacity. These parameters form the basis for accurate load balancing decisions, ensuring that load allocation meets thrust requirements while avoiding overload or overheating of individual modules. Subsequently, each module redistributes the total thrust command required by the power cluster according to the load balancing strategy. The "load balancing strategy" is a set of predefined algorithms or rules used to fairly and efficiently distribute thrust commands among healthy ESC modules within the power cluster. This strategy can consider various factors, such as the remaining power capacity, efficiency curve, and thermal management capabilities of each module. The goal is to ensure that the power cluster can still output a total thrust as close as possible to the original command after a failure, optimize the operating state of each module, and extend its service life. Finally, temporary load adjustments for each healthy ESC module and updated cluster status information are generated. The cluster status information is synchronized to the main controller as a basis for global thrust compensation correction. These adjustments are temporary and designed to respond quickly to faults, compensate for thrust loss in the faulty module, and maintain stable output of the power cluster before the main controller performs global compensation.

[0103] In this embodiment, through the above technical solution, when an ESC module within the power cluster fails and is isolated, the remaining healthy ESC modules within the power cluster can immediately negotiate via communication and dynamically redistribute the total thrust command required by the power cluster based on their own real-time current and temperature parameters. This localized and rapid load balancing response effectively compensates for the thrust loss within the power cluster after the faulty module is isolated. Simultaneously, it generates updated cluster state information to provide data support for precise compensation by the main controller, avoiding transient attitude disturbances caused by uneven or insufficient local thrust, thereby improving the immediate stability and response speed of eVTOL during fault occurrences.

[0104] In one feasible implementation, the total thrust command required by the power cluster is reallocated according to a load balancing strategy, including: the healthy ESC module calculates the current remaining power capacity of the healthy ESC module based on the current temperature parameters and the maximum allowable temperature; the remaining power capacity of each healthy ESC module is used as the proportion of the total remaining power capacity of all healthy ESC modules as a weight allocation coefficient; the thrust load increment originally borne by the isolated faulty ESC module is determined based on the thrust command share borne by the isolated faulty ESC module at the moment before isolation, and allocated to each healthy ESC module according to the weight allocation coefficient to obtain the temporary load adjustment amount.

[0105] In this embodiment, when calculating the current remaining power capacity of the health ESC modules, each health ESC module monitors its current temperature parameters in real time, such as the junction temperature of its internal power devices (e.g., MOSFETs) or the temperature of its heatsink. Simultaneously, each ESC module has a preset maximum allowable temperature, which is the upper limit of its safe operation. By comparing the current temperature parameters with the maximum allowable temperature, and combining this with the power characteristic curve or thermal model of the ESC module, the additional power load that the ESC module can handle in the current state can be accurately calculated, i.e., its current remaining power capacity. For example, when the ESC module temperature is low, its remaining power capacity is large; conversely, when the temperature is close to the maximum allowable temperature, its remaining power capacity is small.

[0106] Based on this, to determine the weighting allocation coefficient, after calculating the current remaining power capacity of all healthy ESC modules within the power cluster, the system aggregates these capacities to obtain the total remaining power capacity of all healthy ESC modules. Then, the proportion of each healthy ESC module's remaining power capacity to the total remaining power capacity is used as the weighting allocation coefficient for that module. This means that modules with larger remaining power capacity have larger weighting allocation coefficients and will bear more load in subsequent load distribution.

[0107] In this embodiment, for accurate compensation, the system determines the thrust load increment originally borne by the isolated faulty ESC module based on the thrust command share it was undertaking just before isolation. The isolated faulty ESC module is typically executing a specific thrust command and undertaking a certain thrust load share just before it fails and is isolated. The system records or queries the thrust command value of the faulty module before isolation, thereby accurately determining the thrust load increment lost due to the module's failure and requiring compensation from other healthy modules.

[0108] In this embodiment, to obtain the temporary load adjustment amount, after obtaining the thrust load increment that needs to be compensated, the system will proportionally distribute the thrust load increment to the remaining healthy ESC modules within the power cluster according to the previously calculated weight allocation coefficients of each healthy ESC module. The share allocated to each healthy ESC module is its temporary load adjustment amount. This adjustment amount will be superimposed on the original thrust command of the healthy module, enabling it to jointly bear the thrust lost by the faulty module.

[0109] In this embodiment, through the above-described technical solution, this application can achieve precise, dynamic, and intelligent compensation for thrust loss from a faulty module. First, by real-time evaluation of the remaining power capacity of the healthy ESC modules, it ensures that load allocation is based on the actual load-bearing capacity of the modules, effectively avoiding overload on healthy modules and thus preventing potential secondary failures or chain reactions, improving system reliability and safety. Second, the adoption of a proportional weighting allocation mechanism allows for a more reasonable distribution of load, fully utilizing the redundancy of each healthy module and improving the efficiency and accuracy of thrust recovery. Furthermore, accurately identifying the thrust command share before the faulty module is isolated ensures the targeted and accurate nature of the compensation, enabling the entire power cluster to maintain a near-expected total thrust output after a fault occurs. This provides a more stable foundation for subsequent attitude adjustments and incremental thrust compensation by the main controller, ensuring the flight stability and controllability of the eVTOL under fault conditions.

[0110] In one feasible implementation, refer to Figure 3 Step S500 includes steps S510 to S560, wherein:

[0111] Step S510: The main controller obtains the fault module identity information and the fault type of the fault module from the hardware fault isolation instruction;

[0112] Step S520: The main controller queries the pre-trained dynamic model parameter set associated with the fault type according to the fault type; the pre-trained dynamic model parameter set is used to characterize the transient characteristics of the total thrust of the fault power cluster decaying over time after a specific fault occurs.

[0113] Step S530: The main controller combines the command thrust of the faulty power cluster at the moment of the fault with the parameter set of the pre-trained dynamic model, and introduces the real-time state of the faulty power cluster as a correction factor to calculate the estimated attenuation curve of the thrust output of the faulty power cluster within a set time window from the current moment.

[0114] Step S540: Calculate the integral average value of the estimated attenuation curve within the set time window as the current available thrust estimate, and determine the precise total thrust requirement to be compensated based on the theoretical thrust loss value and the current available thrust estimate.

[0115] Step S550: Based on the precise total thrust requirement and the current flight attitude, the main controller determines the target healthy power clusters that need to provide compensating thrust, and generates the incremental thrust compensation command for each of the target healthy power clusters.

[0116] In step S560, the main controller predicts the undesirable additional torque based on the theoretical thrust loss value, the geometric layout of the faulty power cluster and the target healthy power cluster, calculates the corresponding compensation torque, and generates the attitude adjustment command.

[0117] In this embodiment, the main controller is the core control unit of eVTOL, responsible for flight attitude, trajectory planning, and power system management. The hardware fault isolation command is a signal issued by the electronic speed controller (ESC) module after detecting a serious fault. It contains the unique identifier (identity information) of the faulty ESC module and the specific nature of the fault (fault type). Obtaining this information is fundamental for subsequent precise compensation and attitude adjustment. Fault types can include motor short circuits, drive circuit failures, sensor malfunctions, etc., and each fault may have a different impact on thrust output.

[0118] In this embodiment, the pre-trained dynamic model parameter set is learned in advance through a large amount of experiments, simulations, or historical data. It describes the mathematical model parameters that depict how the thrust output of the faulty power cluster dynamically changes over time after different types of faults occur. For example, for a short-circuit fault in the motor windings, the thrust may drop sharply in a short period and then stabilize; while for a fault where the drive circuit gradually fails, the thrust may exhibit a slow decay trend. These parameter sets can be in the form of lookup tables, regression model coefficients, neural network weights, etc., and are stored in the main controller's memory. By querying the parameter set that matches the current fault type, the main controller can obtain the ability to predict the future thrust behavior of the faulty power cluster.

[0119] In this embodiment, the commanded thrust at the moment of failure, combined with the real-time state correction factor within the cluster and the pre-trained dynamic model parameter set, allows the main controller to predict the actual thrust output change of the faulty power cluster within a preset time window. This curve reflects the dynamic process from failure occurrence to stabilization; the introduction of the real-time state correction factor eliminates the thrust deviation caused by cluster rebalancing. In this embodiment, the integral average of the estimated attenuation curve represents the average thrust that the faulty power cluster can provide within the set time window. The accurate total thrust requirement calculated by combining the theoretical thrust loss value with the current available thrust estimate is more consistent with the actual thrust loss after a failure than traditional static compensation, significantly improving compensation accuracy.

[0120] In this embodiment, the main controller, based on the calculated precise total thrust requirement and the current flight attitude of the eVTOL, intelligently selects one or more healthy power clusters as targets to share the compensation task, taking into account factors such as the spatial location, maximum thrust margin, and response speed of each healthy power cluster. The incremental thrust compensation command is issued to these target healthy power clusters, instructing them to increase the thrust value based on the original thrust command to compensate for the thrust loss of the faulty power cluster.

[0121] In this embodiment, the theoretical thrust loss of the faulty power cluster and the compensating thrust of the healthy power cluster, due to their spatial position deviation from the eVTOL's center of mass, will inevitably generate additional, undesirable torques, affecting the aircraft's attitude stability. The main controller uses the theoretical thrust loss value and the precise geometric layout information of the faulty and target healthy power clusters on the airframe to predict the undesirable additional torques generated by these thrust changes. Subsequently, it calculates the compensating torques that need to be applied to counteract these undesirable torques and generates attitude adjustment commands by adjusting the differential thrust of other healthy power clusters or aerodynamic control surfaces (if the eVTOL is equipped) to maintain the aircraft's stable attitude.

[0122] In this embodiment, through the above technical solution, the main controller integrates the real-time status of the faulty power cluster to perform dynamic thrust attenuation prediction, no longer relying solely on static theoretical thrust loss. The accurate total thrust requirement allows compensation commands to better match the actual fault conditions. Simultaneously, based on the theoretical thrust loss value and the airframe geometry, the main controller accurately predicts additional torque, generating refined attitude adjustment commands, thus improving flight stability, fault tolerance, and safety after an eVTOL failure.

[0123] In one feasible implementation, refer to Figure 4 Step S550 includes steps S551 to S553, wherein:

[0124] Step S551: The main controller determines the target healthy power cluster that needs to provide compensating thrust based on the precise total thrust requirement and the current flight attitude.

[0125] Step S552: For each target healthy power cluster, based on its spatial position relative to the faulty power cluster, the precise total thrust requirement is decomposed into compensation components along multiple axes of the body coordinate system.

[0126] Step S553: ​​The compensation components of each axis are allocated according to the thrust contribution capability coefficient of each target healthy dynamic cluster in that axis, and the incremental thrust compensation command is generated and sent to each target healthy dynamic cluster.

[0127] In this embodiment, the main controller can consider multiple factors when determining the target healthy power cluster that needs to provide compensating thrust. For example, the main controller can prioritize healthy power clusters that are geographically close to the faulty power cluster to minimize the compensation lever arm and thus reduce the need for additional attitude adjustments. Furthermore, it can also assess the current load, remaining power margin, and temperature status of each healthy power cluster, selecting those with sufficient capacity and not on the verge of overload as targets. This selection mechanism ensures that the compensation task can be reliably undertaken and avoids secondary damage to existing healthy components.

[0128] In this embodiment, decomposing the precise total thrust requirement into compensation components along multiple axes of the airframe coordinate system is key to achieving accurate compensation. Since multirotor aircraft move in three-dimensional space, any thrust change will affect the aircraft's lift, pitch, roll, and yaw. The main controller utilizes the known precise geometric position information of the faulty power cluster and the target healthy power cluster in the airframe coordinate system to convert the total thrust requirement into force components along the X, Y, and Z axes, as well as torque components around these axes. For example, if a fault causes a loss of vertical thrust and simultaneously generates an undesirable roll torque, then compensation requires not only providing a force in the vertical direction but also a reverse roll torque. This decomposition ensures that the thrust contribution of each target healthy power cluster acts precisely in the required force or torque direction.

[0129] In this embodiment, the compensation components for each axis are allocated according to the thrust contribution capability coefficient of each target healthy power cluster in that axis, aiming to optimize the compensation effect and avoid local overload. The thrust contribution capability coefficient can be a pre-calibrated or real-time calculated parameter, reflecting the ability of a specific healthy power cluster to generate effective thrust or torque in a given axis. For example, a healthy power cluster farther from the roll axis may be more efficient in generating roll torque, and therefore its roll thrust contribution capability coefficient will be relatively larger. The main controller can dynamically adjust the allocation weights based on these coefficients and the real-time operating status of each power cluster (such as maximum available thrust, current temperature, etc.). This fine-grained allocation ensures that the incremental thrust compensation command received by each target healthy power cluster is best matched to its own capabilities and spatial position, thereby achieving the overall optimal compensation effect.

[0130] In this embodiment, through the above technical solution, the main controller can allocate fault compensation thrust more intelligently and accurately. First, by determining the most suitable target healthy propulsion cluster based on the precise total thrust requirement and the current flight attitude, the effective utilization of compensation resources and the overall stability of the system are ensured. Second, the precise total thrust requirement is decomposed into compensation components along multiple axes of the airframe coordinate system, enabling the compensation command to accurately offset the mechanical disturbances caused by the fault, avoiding secondary attitude deviations that may result from compensation in a single direction. Finally, the thrust is allocated according to the thrust contribution capability coefficient of each target healthy propulsion cluster in each axis, which not only fully utilizes the unique spatial advantages and performance characteristics of each healthy propulsion cluster, but also avoids excessive dependence on or overload of any single healthy propulsion cluster, thereby improving the efficiency and reliability of compensation. This refined thrust allocation strategy enhances the flight stability, controllability, and safety of eVTOL after a distributed propulsion system failure, enabling the aircraft to maintain stable flight or safe landing even in the event of partial power failure.

[0131] In one feasible implementation, refer to Figure 5 Step S560 includes steps S561 to S563, wherein:

[0132] Step S561: Calculate the compensation torque that each of the target healthy power clusters will generate based on the incremental thrust compensation command of each cluster.

[0133] Step S562: Compare the predicted undesirable additional torque with the calculated compensation torque to determine the additional compensation torque that still needs to be generated by the differential thrust of the aerodynamic control surface or the remaining healthy power cluster.

[0134] Step S563: The additional compensation torque is converted into a control surface deflection command or a differential thrust fine-tuning command to form the attitude adjustment command.

[0135] In this embodiment, the compensation torque generated by each of the target healthy propulsion clusters is calculated based on the incremental thrust compensation commands. This step aims to accurately quantify the impact of the incremental thrust provided by the healthy propulsion clusters on the aircraft attitude. When generating the incremental thrust compensation commands, the main controller has already determined the amount of additional thrust required from each target healthy propulsion cluster. By combining the specific spatial location of each target healthy propulsion cluster on the aircraft (e.g., distance and direction relative to the aircraft's center of gravity), the torque components generated by the incremental thrust of each target healthy propulsion cluster can be calculated according to the definition of torque (force multiplied by lever arm). These torque components are vector-superimposed in the aircraft coordinate system to obtain the total compensation torque generated by all target healthy propulsion clusters. This calculation process ensures an accurate assessment of the actual attitude effect of the compensation thrust, laying the foundation for subsequent refined attitude adjustments.

[0136] Based on this, the predicted undesirable additional torque is compared with the calculated compensation torque to determine the additional compensation torque still required by the aerodynamic control surfaces or the differential thrust of the remaining healthy power cluster. This step is crucial for attitude adjustment accuracy. After a fault occurs, the main controller initially predicts an undesirable additional torque caused by the fault. However, after the healthy power cluster performs incremental thrust compensation, this compensation thrust also generates a certain torque, offsetting or altering the originally predicted undesirable additional torque. Therefore, by vector-comparing the predicted undesirable additional torque with the actual compensation torque generated by the healthy power cluster, the net residual torque after the two are offset can be accurately calculated, i.e., the additional torque still requiring compensation. This additional compensation torque is a target that the aircraft attitude control system needs to further process, reflecting the deviation trend of the aircraft attitude after incremental thrust compensation.

[0137] Furthermore, the additional compensation torque is converted into control surface deflection commands or differential thrust fine-tuning commands to constitute the attitude adjustment commands. After determining the precise additional compensation torque, the main controller needs to convert it into specific control commands to eliminate the torque. For eVTOLs equipped with aerodynamic control surfaces, the additional compensation torque can be decomposed into the required deflection amounts for each control surface (such as ailerons, elevators, rudders, etc.), generating corresponding control surface deflection commands. For eVTOLs that primarily rely on thrust vectoring or differential thrust for attitude control, the additional compensation torque can be converted into commands to fine-tune the thrust of the remaining healthy power clusters, i.e., differential thrust fine-tuning commands. These commands together constitute the final attitude adjustment commands, ensuring that the aircraft can quickly and accurately recover or maintain the desired flight attitude after a failure occurs and thrust compensation is performed.

[0138] In this embodiment, through the above technical solution, after an ESC module failure occurs in the eVTOL, the main controller, when generating attitude adjustment commands for the entire aircraft, no longer relies solely on the preliminary prediction of the undesirable additional torque caused by the failure. Instead, this application further considers the actual compensation torque generated after the healthy power cluster executes the incremental thrust compensation command. By accurately comparing the predicted undesirable additional torque with the actual generated compensation torque, the residual additional torque remaining after incremental thrust compensation can be accurately identified. Based on this accurately calculated additional compensation torque, the main controller can generate more refined and accurate control surface deflection commands or differential thrust fine-tuning commands, thereby constituting the final attitude adjustment command. This method avoids insufficient or excessive attitude adjustment due to inadequate consideration of compensation torque, improves the attitude control accuracy and stability of the aircraft under failure conditions, and ensures that the aircraft can perform flight missions more smoothly and safely.

[0139] In the embodiments of this application, the electronic control method for distributed large-scale eVTOLs collects and broadcasts health status data in real time through the electronic control module, performs cross-comparison to generate confidence assessment results, generates isolation commands and switches power interfaces when an anomaly occurs, and the main controller combines the theoretical thrust loss value with the real-time rebalancing status within the faulty power cluster to complete precise thrust compensation and attitude adjustment. This achieves rapid fault detection and isolation, and maintains system stability through dynamic thrust compensation, thereby improving flight safety, reducing the risk of fault propagation, and ensuring that the system can quickly recover stability in the event of a hardware failure.

[0140] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0141] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. All equivalent structural transformations made under the technical concept of this application using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included within the scope of patent protection of this application.

Claims

1. A distributed large-scale eVTOL electronic control method, characterized in that, The eVTOL power system includes multiple electronic speed control (ESC) modules powered via independent busbars. Geographically adjacent ESC modules are interconnected to form a power cluster. Each ESC module has at least one power input interface that can be switched to two different busbars. The method includes: The ESC module collects its own operating parameters in real time, uses the collected operating parameters as local health status data, and broadcasts the local health status data within the power cluster to which the ESC module belongs through the communication network. The ESC module receives other health status data broadcast from other ESC modules within the same power cluster, cross-compares and verifies the consistency of the local health status data with the other health status data, and generates a confidence assessment result corresponding to the ESC module. When the local health status data indicates that the ESC module has a serious hardware failure of a preset type, or when the confidence assessment result determines that the ESC module is in an abnormal working state, the ESC module generates a hardware failure isolation instruction containing a fault identifier and fault module identity information. According to the hardware fault isolation command, the ESC module identified as faulty cuts off the motor drive output of the ESC module and switches the power input interface of the ESC module from the currently connected first sub-bus to the preset second sub-bus. The main controller receives the hardware fault isolation command and calculates the theoretical thrust loss value of the faulty power cluster to which the faulty module belongs based on the faulty module identity information therein. Based on the theoretical thrust loss value and the real-time state of the faulty power cluster after completing intra-cluster rebalancing, the main controller generates incremental thrust compensation commands for neighboring healthy power clusters and attitude adjustment commands for the entire aircraft.

2. The distributed large-scale eVTOL electronic control method as described in claim 1, characterized in that, The steps for an ESC module to receive health status data broadcast from other ESC modules within the same power cluster, cross-compare and verify the consistency of the local health status data with the other health status data, and generate a confidence assessment result corresponding to the ESC module include: The ESC module receives and parses other health status data broadcast by other ESC modules within its power cluster, and extracts current and temperature information from the other health status data; The current information in the local health status data of this module is compared with the current information of other ESC modules. If the difference is less than the preset similarity threshold, the ESC module is determined to be at a similar operating point. For ESC modules operating at similar points, compare their temperature information. If the temperature information of this module is higher than the average temperature information of other ESC modules operating at similar points, and the difference exceeds a preset temperature deviation threshold, then generate a preliminary abnormal signal indicating that this module may be overheating. If the temperature information of this module is lower than the average temperature information, and the difference exceeds the temperature deviation threshold, then generate a preliminary abnormal signal indicating that the temperature sampling of this module may have failed. Based on the preliminary abnormal signal and combined with the historical temperature change trend calculated from the temperature information of multiple consecutive periods stored in this module, the confidence assessment result is generated.

3. The distributed large-scale eVTOL electronic control method as described in claim 2, characterized in that, The step of receiving health status data broadcast by other ESC modules within the same power cluster, cross-comparing and verifying the local health status data with the other health status data, and generating a confidence assessment result corresponding to the ESC module further includes: The ESC module calculates the real-time resultant torque balance of the power cluster based on the current information in the local health status data and the current information in the other health status data. If the confidence assessment result indicates that the status of this module is questionable, and the resultant torque balance shows that there are abnormal fluctuation components in the torque components related to this module that do not match the current flight command, then feature data is extracted based on the abnormal fluctuation components, and the feature data is added to the confidence assessment result as auxiliary diagnostic information.

4. The distributed large-scale eVTOL electronic control method as described in claim 2, characterized in that, The step of receiving health status data broadcast by other ESC modules within the same power cluster, cross-comparing and verifying the local health status data with the other health status data, and generating a confidence assessment result corresponding to the ESC module further includes: The ESC module extracts the stored historical local health status data, combines it with the local health status data of the current period to form the current health status data sequence, and performs real-time matching of the current health status data sequence with the pre-stored local lightweight fault early symptom pattern library. If an early symptom pattern with a similarity exceeding a preset matching threshold is matched, the parameter weights and judgment thresholds used to generate the confidence assessment results are dynamically adjusted based on the expected failure development speed and impact of the pattern.

5. The distributed large-scale eVTOL electronic control method as described in claim 1, characterized in that, Based on the confidence level assessment results, the abnormal operating status of the ESC module is determined, including: When the confidence assessment result of the ESC module is lower than the first preset threshold, the ESC module determines that it has entered a low confidence test state and broadcasts a request for re-verification signal containing the current complete health status data of the ESC module to its power cluster. Other ESC modules within the power cluster receive the request re-verification signal, compare the stored historical health status data sequence of the ESC module with the currently received complete health status data, and determine whether the state decline trajectory of the ESC module matches any early symptom mode in the pre-stored historical failure mode case library. Each neighboring signaling module generates pattern matching verification opinions based on the comparison results, and generates comprehensive confirmation feedback by combining the real-time cross-verification results of the neighboring signaling module itself with the comparison results of the signaling module. After broadcasting the request for re-verification signal, if the number of comprehensive confirmation feedbacks indicating that the ESC module's working state is abnormal received within a preset time exceeds a preset arbitration threshold, then the working state of the ESC module is ultimately determined to be abnormal, triggering the generation of the hardware fault isolation instruction.

6. The distributed large-scale eVTOL electronic control method as described in claim 1, characterized in that, Before the main controller generates the incremental thrust compensation command and attitude adjustment command, the method further includes: When one ESC module in a power cluster is isolated, the remaining healthy ESC modules in the power cluster negotiate through communication, and based on the real-time current and temperature parameters of each module, reallocate the total thrust command required by the power cluster according to the load balancing strategy, generating temporary load adjustment amounts for each healthy ESC module and updated cluster status information.

7. The distributed large-scale eVTOL electronic control method as described in claim 6, characterized in that, The total thrust command required to reallocate the power cluster according to the load balancing strategy includes: The health ESC module calculates the current remaining power capacity of the health ESC module based on the current temperature parameters and the maximum allowable temperature. The weighting coefficient is the ratio of the remaining power capacity of each health ESC module to the total remaining power capacity of all health ESC modules. Based on the thrust command share undertaken by the isolated faulty ESC module just before isolation, the thrust load increment originally undertaken by the isolated faulty ESC module is determined, and then distributed to each healthy ESC module according to the weighting allocation coefficient to obtain the temporary load adjustment amount.

8. The distributed large-scale eVTOL electronic control method as described in claim 1, characterized in that, Based on the theoretical thrust loss value and integrating the real-time state of the faulty power cluster after intra-cluster rebalancing, the main controller generates incremental thrust compensation commands and attitude adjustment commands, including: The main controller obtains the fault module's identity information and the fault type of the fault module from the hardware fault isolation instruction; The main controller queries the pre-trained dynamic model parameter set associated with the fault type according to the fault type; the pre-trained dynamic model parameter set is used to characterize the transient characteristics of the total thrust of the fault power cluster decaying over time after a specific fault occurs. The main controller combines the command thrust of the faulty power cluster at the moment of the fault with the parameter set of the pre-trained dynamic model, and introduces the real-time state of the faulty power cluster as a correction factor to calculate the estimated attenuation curve of the thrust output of the faulty power cluster within a set time window from the current moment. The integral average value of the estimated attenuation curve within the set time window is calculated as the current available thrust estimate, and the precise total thrust requirement to be compensated is determined based on the theoretical thrust loss value and the current available thrust estimate. Based on the precise total thrust requirement and the current flight attitude, the main controller determines the target healthy power clusters that need to provide compensating thrust, and generates the incremental thrust compensation command for each of the target healthy power clusters. Based on the theoretical thrust loss value, the geometric layout of the faulty power cluster and the target healthy power cluster, the main controller predicts the undesirable additional torque, calculates the corresponding compensation torque, and generates the attitude adjustment command.

9. The distributed large-scale eVTOL electronic control method as described in claim 8, characterized in that, The steps of the main controller determining the target healthy power clusters that require compensating thrust based on the precise total thrust requirement and the current flight attitude, and generating the incremental thrust compensation command for each of the target healthy power clusters, include: Based on the precise total thrust requirement and the current flight attitude, the main controller determines the target healthy power cluster that needs to provide compensating thrust; For each target healthy power cluster, based on its spatial position relative to the faulty power cluster, the total thrust requirement to be compensated is decomposed into compensation components along multiple axes of the body coordinate system. The compensation components for each axis are allocated according to the thrust contribution capability coefficient of each target healthy dynamic cluster in that axis, and the incremental thrust compensation command is generated and sent to each target healthy dynamic cluster.

10. The distributed large-scale eVTOL electronic control method as described in claim 8, characterized in that, The steps of the main controller predicting the undesirable additional torque, calculating the corresponding compensation torque, and generating the attitude adjustment command based on the theoretical thrust loss value, the geometric layout of the faulty dynamic cluster and the target healthy dynamic cluster include: Calculate the compensation torque that each of the target healthy power clusters will generate based on the incremental thrust compensation command; The predicted undesirable additional torque is compared with the calculated compensation torque to determine the additional compensation torque that still needs to be generated by the differential thrust of the aerodynamic control surfaces or the remaining healthy power cluster. The additional compensation torque is converted into a control surface deflection command or a differential thrust fine-tuning command to form the attitude adjustment command.

Images