A low-cost distributed primary and backup flight control automatic switching method and system based on a universal bus

Abstract

The application discloses a low-cost distributed main-backup flight control automatic switching method and system based on a general bus. The method is applied to a double-redundancy control system without an external voter, and networking is formed on the same bus by a main controller, a backup controller and an actuator controller. When the main controller and the backup controller are powered on, time delay starting is performed according to preset IDs, so that the main controller is ensured to take over preferentially; in operation, the two controllers are used as peer nodes to monitor each other's control instructions through the bus. When the backup controller monitors the main controller failure, the backup controller takes over autonomously, and a dynamic weighted smooth transition algorithm is adopted to eliminate the control instruction jump during main-backup switching; when the main controller is temporarily disabled and then recovers or is unstable in operation, the system supports autonomous return or active giving up of the control right. The application does not depend on an additional hardware switching switch, and has the advantages of low cost, high reliability and seamless smooth switching.

Description

Technical Field

[0001] This invention belongs to the field of aircraft technology, specifically a low-cost distributed automatic switching method and system for primary and backup flight control based on a universal bus. Background Technology

[0002] With the rise of the low-altitude economy, aircraft safety has received increasing attention from society. Among them, the flight control system (FSS), the core of aircraft control, plays a crucial role in aircraft flight safety.

[0003] To address the insufficient safety of a single flight control system, multiple redundant flight control systems are typically designed, along with a voting system. When one flight control system fails, another can take over, thereby maximizing the safety and reliability of the flight control system.

[0004] However, such specialized multi-redundant flight control systems are typically expensive and complex. For some low-cost aircraft, the widespread application of such redundant flight control systems is not feasible, making it difficult to further improve the safety redundancy capabilities of the flight control system. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings and deficiencies of existing technologies by proposing a decentralized automatic switching scheme for primary / backup redundant flight control. This scheme is based on a CAN bus communication network. When the primary flight control experiences a recoverable or non-recoverable loss of control output signals during operation, the backup flight control can autonomously take over control of the aircraft. Furthermore, when the primary flight control loses a recoverable control output signal, the backup flight control can temporarily take over and autonomously reclaim control of the aircraft after the primary flight control restores its control output. This invention can be implemented without relying on an additional voting unit. Based on this technology, a dual-redundancy backup mechanism can be quickly constructed using two existing sets of conventional non-redundant flight control systems without incurring additional costs.

[0006] The technical solution for achieving the objective of this invention is: a low-cost distributed automatic switching method for primary and backup flight control based on a universal bus. This method is applied to a dual-redundant control system without an external voter. The system includes a primary controller, a backup controller, and an actuator controller connected via a bus network. The method includes the following:

[0007] Identity recognition: The main controller and the backup controller read preset identity information respectively during startup to distinguish between the main and backup identities;

[0008] Mutual monitoring: During operation, both the main controller and the backup controller monitor each other's control commands in real time via the bus;

[0009] Autonomous takeover of control: After the system starts up, when the backup controller detects that the control command issued by the main controller meets the preset fault triggering conditions, the backup controller autonomously activates the control output to take over the control of the actuator controller;

[0010] Autonomous return or relinquishment of control: In operation, when the backup controller, after taking over control, detects that the main controller has resumed normal control output, the backup controller autonomously shuts down its own control output and returns control to the main controller; or, when the main controller detects that it meets unstable operating conditions during operation, it actively shuts down its control output to relinquish control.

[0011] Furthermore, the autonomous takeover of control also includes a primary / standby switchover transition mechanism:

[0012] During the period when the backup controller does not take over control, the backup controller is in a silent state, continuously monitoring and receiving real-time control commands from the main controller;

[0013] When the backup controller activates its control output, its final output control command is obtained by weighted calculation of the control command calculated internally by the backup controller and the control command received last from the main controller. The calculation formula is as follows:

[0014]

[0015] In the formula, This indicates the control command ultimately output by the backup controller. This indicates the control commands calculated internally by the backup controller. This indicates the last control command received by the standby controller from the main controller. These are weight values;

[0016] After the backup controller begins outputting control commands, the weight value The weight value is set to 1 in each of its control output loops. With a preset linear decay step size Gradually decrease, until .

[0017] Furthermore, the decay step size The calculation formula is:

[0018]

[0019] In the formula, The control output frequency of the controller. The time allotted for the master and backup controllers to complete the transition switch.

[0020] Furthermore, when the system starts up, it is necessary to initialize the internal calculation control output values ​​of the main controller and the backup controller, the received control output values ​​of the other party, and clear or initialize the corresponding weight values ​​and count values.

[0021] Furthermore, the mutual monitoring and autonomous takeover of control are specifically implemented through the following timing control process:

[0022] Set the delayed startup parameter T1 and the normal operation monitoring threshold T2;

[0023] If the current controller is identified as the master controller, and no control command is detected from the backup controller for more than T1 seconds after the start of the loop, the system will jump to the start output and load the integral parameters of the control algorithm in the master controller. If the current controller is identified as the backup controller, and no control command is detected from the master controller for more than 2*T1 seconds after the start of the loop, the system will jump to the start output and load the integral parameters of the control algorithm in the backup controller.

[0024] Furthermore, the timing control process also includes:

[0025] During the operation of the main controller or the backup controller, determine whether the interval between the current distance and the receipt of the control command output by the other party in the previous frame is greater than or equal to the normal operation monitoring threshold T2.

[0026] If it is greater than or equal to the normal operation monitoring threshold T2, then set the weight. It executes the startup output and loads the integral parameters of the control algorithm within the controller;

[0027] If the value is less than the normal operating monitoring threshold T2, and the current controller is a standby controller, then the controller's own control output will be turned off and the controller's integral parameters will be cleared.

[0028] Furthermore, the delayed start parameter T1 is ≥ 5 seconds to ensure that the main controller starts first and takes over control under normal circumstances; the normal operation monitoring threshold T2 has a value range of 0.1s ≥ T2 ≥ 0.02s.

[0029] Furthermore, the unstable operating conditions in the step of autonomously returning or relinquishing control are specifically as follows:

[0030] When the main controller is operating normally and the backup controller is in a silent state, if the main controller detects that the interval between two consecutive frames of control commands issued by the backup controller is less than the normal operation monitoring threshold T2, then the internal unstable state counter is incremented, i.e., c = c + 1, where c represents the accumulated value of the unstable state.

[0031] When the cumulative value of the unstable state c is greater than the preset threshold, it is determined that the main controller itself is unstable. The main controller permanently shuts down its control output and relinquishes control, and will not take over again in the future. Control is then taken over by other backup controllers.

[0032] On the other hand, a low-cost distributed automatic switching system for primary and backup flight control based on a universal bus is provided. The system adopts the above method and includes a primary controller, a backup controller, and an actuator controller.

[0033] The main controller, the backup controller, and the actuator controller are networked together via a CAN bus, and both the main controller and the backup controller are configured to receive message frames sent by each other from the CAN bus.

[0034] Both the main controller and the backup controller are equipped with the same cyclic detection and redundancy switching logic, and the main and backup identities are distinguished by reading a preset ID number.

[0035] Furthermore, the main controller and the backup controller are two identical non-redundant conventional control units; the actuator controller is an electronic speed controller or a motor controller.

[0036] Compared with the prior art, the significant advantages of this invention are:

[0037] (1) This invention is based on the existing two sets of conventional non-redundant control units (flight controllers) and a bus network (CAN bus) for networking connection, without relying on any additional external hardware voter or central switching switch. As long as a peer unit is added to the original single control unit, the cyclic detection and redundancy switching logic can be deployed in pure software, and it can be quickly upgraded to a dual-redundant backup system, which greatly reduces the system modification cost and hardware complexity.

[0038] (2) To address the problem of drastic changes in control commands during switching due to measurement noise and accumulated errors in controller integral parameters caused by redundant controllers, this invention designs a primary / standby switching transition mechanism. When the standby controller is activated and takes over, the output command adopts a dynamic weighting algorithm, so that the weight of the primary controller gradually decreases from 100% to 0%, while the weight of the standby controller linearly increases from 0% to 100%. At the same time, in conjunction with the dynamic loading and clearing of the controller integral parameters, the control stability and safety of the actuator during the transition period are ensured while ensuring the switching response speed.

[0039] (3) The system not only supports the rapid autonomous takeover of the backup controller when the main controller fails (response time not exceeding T2 seconds, and even if the main flight controller restarts in the air, the backup flight controller can still maintain control of the aircraft), but also supports intelligent handling of "recoverable faults". When the main controller recovers normal output after only a brief communication failure or temporary signal loss, the backup controller can sensitively detect the state and autonomously return control and re-enter the silent state, thereby accurately avoiding conflicts caused by the simultaneous output of commands by the main and backup controllers.

[0040] (4) This invention not only relies on the passive monitoring mechanism of the backup controller, but also endows the main controller with an active self-protection function. When the output frequency of the main controller is unstable and the timing interval fluctuates (the main and backup flight controllers are running normally, and the time interval between two adjacent outputs of the main flight controller is different, and the output frequency is unstable. When the backup flight controller detects that the time interval between two outputs of the main flight controller exceeds the specified threshold, it can detect the control signal that the backup controller frequently tries to take over through the bus; when the accumulated value of the internal unstable state counter reaches the specified threshold, the main controller can determine that its own operating state is unstable, and then actively and permanently shut down the output and relinquish control, so as to achieve a higher level of system self-healing and safety fault tolerance.

[0041] (5) By embedding different delay start parameters T1 and 2*T1 in the main controller and the backup controller respectively (for example, the main flight controller is set to a 5-second delay start, and the backup flight controller is set to a 2×5-second delay start), in the initial stage when the two flight controllers are powered on and started at the same time, the system can naturally and stably ensure that the main controller takes over the control first, thereby avoiding control competition and logic confusion in the initialization stage.

[0042] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0043] Figure 1 This is a schematic diagram of the communication topology of the main flight controller, backup flight controller, and electronic speed controller in one embodiment.

[0044] Figure 2 This is a schematic diagram of the unified process for switching between primary and backup flight controllers in one embodiment. Detailed Implementation

[0045] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0046] In one embodiment, a low-cost distributed automatic master-slave flight controller switching method based on a universal bus is provided. This method is applied to a dual-redundant control system without an external voter. The system includes a master controller, a backup controller, and an actuator controller connected via a bus network (the connection relationship between the three is as follows...). Figure 1 As shown, the main controller, the backup controller, and the actuator controller are networked together via the same universal serial bus. Figure 2 The method includes the following:

[0047] Identity recognition: The main controller and the backup controller read preset identity information respectively during startup to distinguish between the main and backup identities;

[0048] Mutual monitoring: During operation, both the main controller and the backup controller monitor each other's control commands in real time via the bus;

[0049] Autonomous takeover of control: After the system starts up, when the backup controller detects that the control command issued by the main controller meets the preset fault triggering conditions, the backup controller autonomously activates the control output to take over the control of the actuator controller;

[0050] Autonomous return or relinquishment of control: In operation, when the backup controller, after taking over control, detects that the main controller has resumed normal control output, the backup controller autonomously shuts down its own control output and returns control to the main controller; or, when the main controller detects that it meets unstable operating conditions during operation, it actively shuts down its control output to relinquish control.

[0051] Preferably, in some embodiments, the bus is, but not limited to, a CAN bus.

[0052] Furthermore, in one embodiment, the autonomous takeover of control also includes a primary / backup switchover mechanism:

[0053] During the period when the backup controller does not take over control, the backup controller is in a silent state, continuously monitoring and receiving real-time control commands from the main controller;

[0054] When the backup controller activates its control output, its final output control command is obtained by weighted calculation of the control command calculated internally by the backup controller and the control command received last from the main controller. The calculation formula is as follows:

[0055]

[0056] In the formula, This indicates the control command ultimately output by the backup controller. This indicates the control commands calculated internally by the backup controller. This indicates the last control command received by the standby controller from the main controller. These are weight values;

[0057] After the backup controller begins outputting control commands, the weight value The weight value is set to 1 in each of its control output loops. With a preset linear decay step size Gradually decrease until .

[0058] Here, even when different flight controllers use the same integrated navigation module, slight differences in attitude and position information can occur due to measurement noise. These differences, under the action of controllers with integral parameters, gradually accumulate into errors, leading to a gradual increase in the difference in control commands calculated internally by the two flight controllers. This results in a drastic change in actual control commands at the moment of primary / standby flight controller switching, affecting flight safety. Therefore, this invention proposes a primary / standby switching transition mechanism.

[0059] Preferably, in some embodiments, the decay step size The calculation formula is:

[0060]

[0061] In the formula, The controller's control output frequency (unit: ), The time for the preset primary and backup controllers to complete the transition switchover (unit: ).

[0062] Here, time There are two objectives. First, to allow the backup flight control system to completely complete the transition after time t after taking over the aircraft; second, to ensure the primary / backup switchover time is not excessively long. For the aircraft, it is recommended that... The range of values This is to balance the response speed of the primary and backup flight control switching, while also reserving time for the transition of control output.

[0063] Furthermore, in one embodiment, when the system starts up, the internal calculation control output values ​​of the main controller and the backup controller, the received control output values ​​of the other party, need to be initialized, and the corresponding weight values ​​and count values ​​are cleared or initialized.

[0064] Furthermore, in one embodiment, the mutual monitoring and autonomous takeover of control are specifically implemented through the following timing control process:

[0065] Set the delayed start parameter T1 (unit: (used to set the delay of output control commands for primary and backup flight controllers) and the normal operation monitoring threshold T2 (unit: (Used for primary and backup flight controllers to mutually detect whether each other is operating normally, threshold).

[0066] If the current controller is identified as the master controller, and no control command is detected from the backup controller for more than T1 seconds after the start of the loop, the system will jump to the start output and load the integral parameters of the control algorithm in the master controller. If the current controller is identified as the backup controller, and no control command is detected from the master controller for more than 2*T1 seconds after the start of the loop, the system will jump to the start output and load the integral parameters of the control algorithm in the backup controller.

[0067] Furthermore, the timing control process also includes:

[0068] During the operation of the main controller or the backup controller, determine whether the interval between the current distance and the receipt of the control command output by the other party in the previous frame is greater than or equal to the normal operation monitoring threshold T2.

[0069] If it is greater than or equal to the normal operation monitoring threshold T2, then set the weight. It executes the startup output and loads the integral parameters of the control algorithm within the controller;

[0070] If the value is less than the normal operating monitoring threshold T2, and the current controller is a standby controller, then the controller's own control output will be turned off and the controller's integral parameters will be cleared.

[0071] Preferably, in some embodiments, the delayed start parameter T1 is ≥ 5 seconds to ensure that the main controller starts first and takes over control under normal circumstances; the normal operation monitoring threshold T2 has a value range of: 0.1s ≥ T2 ≥ 0.02s.

[0072] Here, the flight controller operating frequency is generally between 100Hz and 400Hz, so the interval between two adjacent control outputs is 10ms to 2.5ms. To ensure that the switching delay is within a reasonable range, T2 is set to the following value in practical applications: 0.1s ≥ T2 ≥ 0.02s.

[0073] Furthermore, in one embodiment, the unstable operating conditions in the step of autonomously returning or relinquishing control are specifically as follows:

[0074] When the main controller is operating normally and the backup controller is in a silent state, if the main controller detects that the interval between two consecutive frames of control commands issued by the backup controller is less than the normal operation monitoring threshold T2, then the internal unstable state counter is incremented, i.e., c = c + 1, where c represents the accumulated value of the unstable state.

[0075] When the cumulative value of the unstable state c is greater than the preset threshold, it is determined that the main controller itself is unstable. The main controller permanently shuts down its control output and relinquishes control, and will not take over again in the future. Control is then taken over by other backup controllers.

[0076] Preferably, the cumulative value c of the unstable state is 5.

[0077] In one embodiment, a low-cost distributed automatic primary / backup flight control switching system based on a universal bus is provided. The system adopts the above method and includes a primary controller, a backup controller, and an actuator controller.

[0078] The main controller, the backup controller, and the actuator controller are networked together via a CAN bus, and both the main controller and the backup controller are configured to receive message frames sent by each other from the CAN bus.

[0079] Both the main controller and the backup controller are equipped with the same cyclic detection and redundancy switching logic, and the main and backup identities are distinguished by reading a preset ID number.

[0080] Furthermore, the main controller and the backup controller are two identical non-redundant conventional control units; the actuator controller is an electronic speed controller or a motor controller.

[0081] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the low-cost distributed primary / backup flight control automatic switching method based on a universal bus.

[0082] Identity recognition: The main controller and the backup controller read preset identity information respectively during startup to distinguish between the main and backup identities;

[0083] Mutual monitoring: During operation, both the main controller and the backup controller monitor each other's control commands in real time via the bus;

[0084] Autonomous takeover of control: After the system starts up, when the backup controller detects that the control command issued by the main controller meets the preset fault triggering conditions, the backup controller autonomously activates the control output to take over the control of the actuator controller;

[0085] Autonomous return or relinquishment of control: In operation, when the backup controller, after taking over control, detects that the main controller has resumed normal control output, the backup controller autonomously shuts down its own control output and returns control to the main controller; or, when the main controller detects that it meets unstable operating conditions during operation, it actively shuts down its control output to relinquish control.

[0086] For specific limitations on each step, please refer to the limitations of the low-cost distributed master-slave flight controller automatic switching method based on a general-purpose bus mentioned above, which will not be repeated here.

[0087] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the low-cost distributed master-slave flight control automatic switching method based on a general-purpose bus.

[0088] Identity recognition: The main controller and the backup controller read preset identity information respectively during startup to distinguish between the main and backup identities;

[0089] Mutual monitoring: During operation, both the main controller and the backup controller monitor each other's control commands in real time via the bus;

[0090] Autonomous takeover of control: After the system starts up, when the backup controller detects that the control command issued by the main controller meets the preset fault triggering conditions, the backup controller autonomously activates the control output to take over the control of the actuator controller;

[0091] Autonomous return or relinquishment of control: In operation, when the backup controller, after taking over control, detects that the main controller has resumed normal control output, the backup controller autonomously shuts down its own control output and returns control to the main controller; or, when the main controller detects that it meets unstable operating conditions during operation, it actively shuts down its control output to relinquish control.

[0092] For specific limitations on each step, please refer to the limitations of the low-cost distributed master-slave flight controller automatic switching method based on a general-purpose bus mentioned above, which will not be repeated here.

[0093] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention without departing from its spirit and scope should be included within the protection scope of the present invention.

Claims

1. A low-cost distributed automatic master / slave flight control switching method based on a universal bus, characterized in that, The method is applied to a dual-redundant control system without an external voter. This system includes a main controller, a backup controller, and an actuator controller connected via a bus network. The main controller, the backup controller, and the actuator controller are connected via the same universal serial bus. The method includes the following: Identity recognition: The main controller and the backup controller read preset identity information respectively during startup to distinguish between the main and backup identities; Mutual monitoring: During operation, both the main controller and the backup controller monitor each other's control commands in real time via the bus; Autonomous takeover of control: After the system starts up, when the backup controller detects that the control command issued by the main controller meets the preset fault triggering conditions, the backup controller autonomously activates the control output to take over the control of the actuator controller; Autonomous return of control: In operation, when the backup controller, after taking over control, detects that the main controller has resumed normal control output, the backup controller autonomously shuts down its own control output and returns control to the main controller; when the main controller detects that it meets unstable operating conditions during operation, it actively shuts down its control output to relinquish control. The autonomous takeover of control also includes a primary / standby switchover transition mechanism: During the period when the backup controller does not take over control, the backup controller is in a silent state, continuously monitoring and receiving real-time control commands from the main controller; The timing control process also includes: During the operation of the main controller or backup controller, determine whether the interval between receiving the control command output by the other party in the previous frame is greater than or equal to the normal operation monitoring threshold T2. If it is greater than or equal to the normal operation monitoring threshold T2, then set the weight. It executes the startup output and loads the integral parameters of the control algorithm within the controller; If the value is less than the normal operating monitoring threshold T2, and the current controller is a standby controller, then the controller's own control output will be turned off and the controller's integral parameters will be cleared. The unstable operating conditions in the step of autonomously returning or relinquishing control are applicable to the following scenarios: when the output frequency of the main controller is unstable and the timing interval fluctuates, the bus detects control signals that the backup controller frequently attempts to take over. The unstable operating conditions are specifically as follows: When the main controller is operating normally and the backup controller is in a silent state, if the main controller detects that the interval between two consecutive frames of control commands issued by the backup controller is less than the normal operation monitoring threshold T2, then the internal unstable state counter is incremented, i.e., c = c + 1, where c represents the accumulated value of the unstable state. When the cumulative value of the unstable state c is greater than the preset number threshold, it is determined that the main controller itself is unstable. The main controller permanently shuts down its own control output and relinquishes control, and will not take over again afterward. The other backup controllers will take over control. The primary / standby switchover mechanism also includes: When the backup controller activates its control output, its final output control command is obtained by weighted calculation of the control command calculated internally by the backup controller and the control command received last from the main controller. The calculation formula is as follows: ； In the formula, This indicates the control command ultimately output by the backup controller. This indicates the control commands calculated internally by the backup controller. This indicates the last control command received by the standby controller from the main controller. These are weight values; After the backup controller begins outputting control commands, the weight value The weight value is set to 1 in each of its control output loops. With a preset linear decay step size Gradually decrease until .

2. The low-cost distributed automatic master / slave flight control switching method based on a universal bus according to claim 1, characterized in that, The decay step size The calculation formula is: ； In the formula, The control output frequency of the controller. The time allotted for the preset primary and backup controllers to complete the transition switch.

3. The low-cost distributed automatic master / slave flight control switching method based on a universal bus according to claim 1, characterized in that, When the system starts, the internal calculation control output values ​​of the main controller and the backup controller, as well as the received control output values ​​of the other party, need to be initialized, and the corresponding weight values ​​and count values ​​need to be cleared or initialized.

4. The low-cost distributed automatic master / slave flight control switching method based on a universal bus according to claim 1, characterized in that, The mutual monitoring and autonomous takeover of control are specifically implemented through the following timing control process: Set the delayed startup parameter T1 and the normal operation monitoring threshold T2; If the current controller is identified as the master controller, and no control command is detected from the backup controller for more than T1 seconds after the start of the loop, the system will jump to the start output and load the integral parameters of the control algorithm in the master controller. If the current controller is identified as the backup controller, and no control command is detected from the master controller for more than 2*T1 seconds after the start of the loop, the system will jump to the start output and load the integral parameters of the control algorithm in the backup controller.

5. The low-cost distributed automatic master / slave flight control switching method based on a universal bus according to claim 4, characterized in that, The delayed start parameter T1 is ≥ 5 seconds to ensure that the main controller starts first and takes over control under normal circumstances; the normal operation monitoring threshold T2 has a value range of 0.1s ≥ T2 ≥ 0.02s.

6. A low-cost distributed primary / backup flight control automatic switching system based on a universal bus, characterized in that, The system employs the method described in any one of claims 1 to 5, and the system includes a main controller, a backup controller, and an actuator controller; The main controller, the backup controller, and the actuator controller are networked together via a bus, and both the main controller and the backup controller are configured to receive message frames sent by each other from the bus. Both the main controller and the backup controller are equipped with the same cyclic detection and redundancy switching logic, and the main and backup identities are distinguished by reading a preset ID number.

7. The low-cost distributed primary / backup flight control automatic switching system based on a universal bus according to claim 6, characterized in that, The main controller and the backup controller are two identical non-redundant conventional control units; the actuator controller is an electronic speed controller or a motor controller.

Images