A modular partitioned flight control system for high safety requirements

Abstract

This invention discloses a modular partitioned flight control system for high safety requirements, including a control execution link unit, an embedded health monitoring partition, a cross-channel data interaction partition, a system-level redundancy management and voting partition, a power and thermal management partition, an execution and self-test management partition, a security communication and configuration management partition, and a flight data recording partition. By partitioning the flight control system, and setting the control execution link unit, the embedded health monitoring partition, and the execution and self-test management partition as independent partitions, the direct interference of the monitoring function on the control calculation process is avoided, and the stability of the control system is improved. At the same time, combined with the inter-partition interactive constraints and scheduling mechanism, the functions of the flight control system are decoupled, faults are isolated, and safe operation is achieved.

Description

Technical Field

[0001] This invention belongs to the field of flight control systems, and specifically relates to a modular partitioned flight control system for high safety requirements. Background Technology

[0002] To meet the extremely high flight safety requirements of electric vertical takeoff and landing (eVTOL) aircraft, it has become an industry consensus to build a flight control computing system using a partitioned operating system compliant with the ARINC 653 standard. Several patented partitioned flight control architectures exist, but analysis reveals shortcomings in addressing the specific safety requirements of eVTOL.

[0003] For example, patent CN103544065A mainly focuses on optimizing the scheduling algorithm, but does not deeply integrate functional safety level (DAL) for partitioning and protection, and the monitoring function does not receive a higher priority guarantee than the monitored function; patent CN106873953B proposes a general partitioning framework for input, calculation and output, but does not carry out special partitioning reinforcement design for the core high-safety function of control allocation and fault reconfiguration of eVTOL multi-rotor power system; patent CN115877754B divides the system into safe and non-safety related control areas, with a relatively macro architecture, but does not refine it to the deterministic interaction, isolation protection and deep integration mechanism between multiple partitions in the application software layer and dissimilar monitoring channels.

[0004] In summary, existing partitioned architecture patents still have room for improvement in areas such as the fine-tuning of partitioned functions and security levels, the specialized optimization of eVTOL power safety characteristics, and the enhanced design of deterministic monitoring and interaction paths for the entire system. Summary of the Invention

[0005] The purpose of this invention is to provide a modular partitioned flight control system for high safety requirements. By partitioning the flight control system and combining the inter-partition interaction constraints and scheduling mechanisms, the system achieves functional decoupling, fault isolation, and safe operation of the flight control system.

[0006] The specific technical solution for achieving the objective of this invention is as follows:

[0007] A modular partitioned flight control system for high safety requirements includes a control execution link unit, an embedded health monitoring partition, a cross-channel data interaction partition, a system-level redundancy management and voting partition, a power and thermal management partition, and an execution and self-test management partition.

[0008] The control execution link unit is used to realize the aircraft's navigation, fault diagnosis, and control calculation, and to convert the calculated control quantity into control commands and transmit them to the aircraft's execution mechanism.

[0009] The embedded health monitoring partition is used to monitor the operating status of the control execution link unit and send the monitoring results to the system-level redundancy management and voting partition;

[0010] The power and thermal management partition is used to monitor and protect the operating environment of the flight control computing system, and to send the power and temperature-related status information of the flight control computer where the system is located to the system-level redundancy management and voting partition in real time.

[0011] The execution and self-test management partition is used to perform consistency analysis by combining the status data of the aircraft actuators with control commands, and execute the corresponding self-test process to send the actuator status data and self-test results to the system-level redundancy management partition.

[0012] The cross-channel data interaction partition obtains embedded health monitoring data based on the system-level redundancy management and voting partition, and performs a consistency comparison with the monitoring data of the control execution link using external independent computation, forming data for voting processing to be transmitted to the system-level redundancy management and voting partition.

[0013] The system-level redundancy management and voting partitions acquire data from the control execution link unit, embedded health monitoring partition, cross-channel data interaction partition, power and thermal management partition, and execution and self-test management partition, respectively, to achieve a comprehensive assessment of the system's availability and corresponding handling and control strategies.

[0014] Furthermore, the control execution link unit includes a navigation and integrity management partition, a flight control and reconfiguration partition, and a control output and interface partition;

[0015] The navigation and integrity management partition is used for the fusion of multi-source navigation information and integrity assessment of the system. The navigation and integrity management partition uses nonlinear state estimation algorithm, residual test and consistency judgment algorithm, and fault detection and isolation algorithm to realize the fusion of multi-source sensor data of the aircraft and evaluate its reliability. When an anomaly is detected, it is isolated and the fusion strategy is adjusted. Finally, the navigation state information with reliability label is output to the flight control and reconstruction solution partition.

[0016] The flight control and reconfiguration partition receives navigation status information and flight commands, calculates and generates virtual control quantities based on the control law of the current flight mode, and then performs control allocation processing. When receiving fault or capability degradation information, it dynamically adjusts the control strategy to achieve fault-tolerant control and outputs control commands to the control output and interface partition.

[0017] The control output and interface partition is used to convert control commands into control quantities for the actuator interface. The control output and interface partition receives control commands from the flight control partition, performs periodic processing under the scheduling mechanism, converts the control quantities into standard interface data, and performs amplitude and rate of change constraints before outputting them to the aircraft actuators through the underlying drive interface. At the same time, it provides the relevant interface status to the execution and self-test management partition.

[0018] Furthermore, the embedded health monitoring partition continuously evaluates the operational data of the navigation and integrity management partition, flight control and reconfiguration partition, and control output and interface partition based on operational status monitoring, threshold discrimination, and trend analysis algorithms, in order to identify calculation anomalies, timing anomalies, and output anomalies.

[0019] The embedded health monitoring partition periodically receives status information and intermediate calculation results from the navigation and integrity management partition, flight control and reconfiguration partition, and control output and interface partition. It performs health assessments based on preset criteria, generates fault flags and performs preliminary classifications when an anomaly is detected, and reports the results to the system-level redundancy management partition.

[0020] Furthermore, the system-level redundancy management and voting partition receives status information from the embedded health monitoring partition, cross-channel data interaction partition, power and thermal management partition, and execution and self-test management partition, and performs comprehensive analysis on the calculation status of the control execution link unit, the hardware operation status of the flight control computer, and the status of the aircraft actuators to obtain the operation status judgment result of the flight control computer.

[0021] If the system-level redundancy management and voting partition determine that the flight control computer is unavailable or does not meet the operating conditions, a control link exit command is generated and the system reconfiguration process is triggered, causing the flight control computer to exit the control link and other flight control computers to take over the control functions, while issuing status alarm information.

[0022] When the flight control computer is ready to be restarted, a restart request interface is provided for decision-making. After the restart is completed, the status of the flight control computer is updated to an available backup status and it participates in the system redundancy operation.

[0023] Furthermore, the system also includes a secure communication and configuration management partition and a flight data recording partition;

[0024] The secure communication and configuration management partition is used to realize external data interaction and system parameter management. The secure communication and configuration management partition receives external communication requests, parses and verifies the data, forwards the data to the target partition after the access control conditions are met, and provides parameter loading services in the system startup or maintenance state.

[0025] The flight data recording partition is used to record and store flight operation data. The flight data recording partition receives data from each partition through a one-way interface, organizes the data and writes it to a non-volatile storage medium. It does not provide control or feedback interfaces to the outside world, thereby achieving isolation from the flight control link.

[0026] Furthermore, during operation, the modular partitioned flight control system determines the execution priority of each partition based on its functional safety criticality and operational efficiency, and arranges them sequentially in the scheduling table. The priorities of each partition are as follows:

[0027] System-level redundancy management and voting partition > Cross-channel data interaction partition ≥ Embedded health monitoring partition = Power and thermal management partition > Navigation and integrity management partition = Flight control and reconfiguration partition = Control output and interface partition > Execution and self-test management partition > Secure communication and configuration management partition > Flight data logging partition;

[0028] The priority is used not only to determine the execution order of partitions, but also to characterize the resource guarantee level of each partition during system operation;

[0029] In cases of limited system resources or abnormal events, high-priority partitions are given priority in obtaining scheduling resources and are guaranteed to execute, while the execution of low-priority partitions is delayed or compressed.

[0030] Furthermore, during operation, the modular partitioned flight control system executes the navigation and integrity management partition, flight control and reconfiguration partition, and control output and interface partition sequentially within a single scheduling cycle, with the time windows arranged continuously. This allows state perception, control calculation, and control output to be completed within a single cycle, thereby forming a deterministic closed-loop control process.

[0031] Furthermore, the system-level redundancy management and voting partitioning will interact with the operating status judgment results and control information of this flight control computer and the operating status results and control information of other flight control computers.

[0032] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0033] (1) To achieve functional decoupling between the control chain and the monitoring chain, this solution sets independent partitions for the control execution link unit, the embedded health monitoring partition and the execution and self-test management partition, thereby avoiding direct interference of the monitoring function on the control calculation process and improving the stability of the control system.

[0034] (2) Improve the fault isolation capability of the execution layer. This solution unifies the status feedback of the actuator and the built-in test by handling them in the self-test management area and separates them from the control output path, so as to avoid the execution layer abnormality from affecting the control calculation through the interface path and improve the system's fault tolerance capability for actuator faults.

[0035] (3) To realize a unified decision-making mechanism at the system level, this scheme sets up a system-level redundancy management and voting partition as the only system-level decision-making unit, so that various monitoring information can be comprehensively processed under a unified logic, avoiding inconsistencies caused by multi-source decision-making and improving the certainty of system behavior;

[0036] (4) Reduce the degree of coupling between sub-sections. This scheme avoids the formation of loop dependencies and implicit data channels by constraining the direction of data flow and interaction path between sub-sections, making the system structure clearer and facilitating security analysis and verification.

[0037] (5) Applicable to high safety level system design. The partition architecture of this scheme, combined with the development assurance level division and partition isolation mechanism, can support the design requirements of high safety level flight control system and improve the overall reliability of the system.

[0038] The present invention will be further described below with reference to specific embodiments. Attached Figure Description

[0039] Figure 1 This diagram illustrates the modular partitioned flight control system architecture and partitioned data flow for this solution, designed to meet high safety requirements.

[0040] Figure 2 This is a schematic diagram of the partition scheduling timing within a single scheduling cycle in this embodiment of the solution. Detailed Implementation

[0041] Example

[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. The described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" do not specifically refer to the singular and may also include the plural. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0044] Unless otherwise specifically stated, the relative arrangement, numerical expressions, and values ​​of the components and steps described in these embodiments do not limit the scope of this application. It should also be understood that, for ease of description, the dimensions of the various parts shown in the drawings are not drawn to actual scale. Techniques, methods, and devices known to those skilled in the art may not be discussed in detail, but where appropriate, such techniques, methods, and devices should be considered part of the specification. In all examples shown and discussed herein, any specific values ​​should be interpreted as merely exemplary and not as limitations. Therefore, other examples of exemplary embodiments may have different values. It should be noted that similar reference numerals and letters in the following drawings denote similar items; therefore, once an item is defined in one drawing, it need not be further discussed in subsequent drawings.

[0045] Combination Figure 1 A modular partitioned flight control system for high safety requirements includes a control execution link unit, an embedded health monitoring partition P4a, a cross-channel data interaction partition P4b, a system-level redundancy management and voting partition P5, a power and thermal management partition P6, and an execution and self-test management partition P7.

[0046] The control execution link unit is used to realize the aircraft's navigation, fault diagnosis, and control calculation, and to convert the calculated control quantity into control commands and transmit them to the aircraft's execution mechanism.

[0047] The embedded health monitoring partition P4a is used to monitor the operating status of the control execution link unit and send the monitoring results to the system-level redundancy management and voting partition P5.

[0048] The power and thermal management partition P6 is used to monitor and protect the operating environment of the flight control computing system, and to send the power and temperature-related status information of the flight control computer where the system is located to the system-level redundancy management and voting partition P5 in real time.

[0049] The execution and self-test management partition P7 is used to perform consistency analysis by combining the status data of the aircraft actuators with control commands, and execute the corresponding self-test process to send the actuator status data and self-test results to the system-level redundancy management partition.

[0050] The cross-channel data interaction partition P4b obtains embedded health monitoring data based on the system-level redundancy management and voting partition P5, and performs a consistency comparison with the monitoring data of the control execution link using external independent computation, forming data for voting processing to be transmitted to the system-level redundancy management and voting partition.

[0051] Specifically, in this embodiment, a separate heterogeneous monitoring channel computing unit is set up, constructed using an implementation method different from that of the main channel, and the control execution link unit runs independently. The cross-channel data interaction partition P4b obtains the heterogeneous monitoring data and performs data alignment and consistency comparison processing with the main channel monitoring data obtained through the system-level redundancy management and voting partition P5 to ensure the comparability of the output results of different channels. Specifically, this partition exchanges key status data and control commands with the heterogeneous monitoring channel computing unit through the cross-channel data interaction structure, and performs alignment and unified processing with the main channel monitoring data to provide data for voting processing.

[0052] The system-level redundancy management and voting partition P5 acquires data from the control execution link unit, the embedded health monitoring partition P4a, the cross-channel data interaction partition P4b, the power and thermal management partition P6, and the execution and self-test management partition P7, respectively, to realize the comprehensive determination of the system's availability and the corresponding handling and control strategies.

[0053] More specifically, the control execution link unit includes a navigation and integrity management partition P1, a flight control and reconfiguration partition P2, and a control output and interface partition P3;

[0054] The navigation and integrity management partition P1 is used for the fusion of multi-source navigation information and integrity assessment of the system. The navigation and integrity management partition P1 runs nonlinear state estimation algorithms (such as extended Kalman filtering or similar methods), residual testing and consistency discrimination algorithms, and fault detection and isolation algorithms to realize the fusion of multi-source sensor data of the aircraft and evaluate its reliability. In the specific operation process, this partition aligns and preprocesses the input data based on the unified time base provided by the operating system, then performs state fusion calculation, and identifies abnormal data sources through consistency detection. When an anomaly is detected, it is isolated and the fusion strategy is adjusted. Finally, the navigation state information with a reliability label is output to the flight control and reconstruction solution partition P2.

[0055] The flight control and reconfiguration calculation partition P2, the core computing unit for flight control, is used to generate control quantities based on flight status and control commands, and to implement flight mode management and control reconfiguration under fault conditions. Internally, it runs flight control law algorithms, control allocation algorithms, and fault reconfiguration algorithms, and also includes a state machine-based flight mode management algorithm and parameter scheduling mechanism to support switching and smooth transitions between different flight modes. In practice, this partition receives navigation status information and flight commands, calculates virtual control quantities based on the current flight mode using control laws, performs control allocation processing, dynamically adjusts the control strategy to achieve fault-tolerant control when fault or capability degradation information is received, and outputs control commands to the control output and interface partition P3.

[0056] The control output and interface partition P3 is used to convert control commands into control quantities for the actuator interface. It serves as the interface unit between the flight control calculation and physical execution systems. Internally, it operates control quantity mapping, output constraint processing, and consistency verification mechanisms to convert control commands into control quantity expressions that meet the actuator interface requirements and ensure their rationality. In specific operation, the control output and interface partition P3 receives control commands from the flight control partition, performs periodic processing under the scheduling mechanism, converts the control quantities into standard interface data, and performs amplitude and rate-of-change constraints before outputting them to the aircraft actuators through the underlying drive interface. Simultaneously, it provides relevant interface status information to the execution and self-test management partition P7.

[0057] The embedded health monitoring partition P4a monitors the operational status of the core flight control computing link and is a software-level health management unit oriented towards the control chain. Its internal operational status monitoring, threshold discrimination, and trend analysis algorithms continuously evaluate the operational data of the navigation and integrity management partition P1, the flight control and reconfiguration solution partition P2, and the control output and interface partition P3 to identify computational anomalies, timing anomalies, and output anomalies.

[0058] In the specific operation process, the embedded health monitoring partition P4a periodically receives status information and intermediate calculation results from the navigation and integrity management partition P1, the flight control and reconfiguration solution partition P2, and the control output and interface partition P3. It performs health assessments based on preset criteria, generates fault flags and performs preliminary classifications when an anomaly is detected, and reports the results to the system-level redundancy management partition.

[0059] The system-level redundancy management and voting partition P5 serves as the onboard redundancy management and operational status decision-making unit in the flight control system. It is used to comprehensively determine the availability of the flight control computer and implement corresponding system-level response control. Its internal operational status fusion judgment algorithm, fault confirmation logic, redundancy consistency discrimination algorithm, and reconfiguration decision algorithm are used to evaluate the onboard operational capability and determine the system response strategy based on the onboard health status and multi-computing unit consistency information. Specifically, it receives status information from the embedded health monitoring partition P4a, cross-channel data interaction partition P4b, power and thermal management partition P6, and execution and self-test management partition P7. It comprehensively analyzes the computational status of the control execution link units, the hardware operational status of the flight control computer, and the status of the aircraft's actuators. Simultaneously, based on the cross-computing unit data interaction mechanism provided by the system, it obtains status or control-related information from other flight control computers and performs consistency discrimination or voting processing as auxiliary references.

[0060] If the system-level redundancy management and voting partition P5 determines that the flight control computer is unavailable or does not meet the operating conditions, it generates a control link exit command and triggers the system reconfiguration process, causing the flight control computer to exit the control link and other flight control computers to take over the control functions, while issuing status alarm information.

[0061] When the flight control computer is ready to be restarted, a restart request interface is provided for decision-making. After the restart is completed, the status of the flight control computer is updated to an available backup status and it participates in the system redundancy operation.

[0062] In addition, the system-level redundancy management and voting partition P5 will interact with the operating status judgment results and control information of this flight control computer and the operating status results and control information of other flight control computers.

[0063] Furthermore, the system also includes a low development assurance level partition (auxiliary and service partition), namely, the secure communication and configuration management partition P8 and the flight data recording partition P9;

[0064] The secure communication and configuration management partition P8 serves as the unified entry point for external communication and configuration management, enabling external data interaction and system parameter management. Its internal mechanisms for protocol parsing, access control, and data verification are used to determine the legality of external input data, facilitating external data interaction and system parameter management. Specifically, the secure communication and configuration management partition P8 receives external communication requests, parses and verifies the data, and forwards the data to the target partition after meeting access control conditions. It also provides parameter loading services during system startup or maintenance.

[0065] The flight data recording partition P9 is used to record and store flight operation data. It is a persistent information management unit of the system, and its internal operation data organization and storage management mechanism is used to organize and save key operation data and event information. In specific operation, the flight data recording partition P9 receives data from each partition through a one-way interface, organizes the data and writes it to a non-volatile storage medium. It does not provide external control or feedback interfaces, thereby achieving isolation from the flight control link.

[0066] In this system, each application partition executes based on the time-partition scheduling mechanism provided by the partitioned operating system. The runtime sequence of each partition is uniformly managed through a pre-configured static scheduling table. Each partition is allocated an independent and non-overlapping time window within the main scheduling cycle and executes in a predetermined order, thereby achieving time isolation and deterministic scheduling within each partition.

[0067] During operation, the modular partitioned flight control system determines the execution priority of each partition based on its functional safety criticality and operational efficiency, and arranges them sequentially in the scheduling table. The priorities of each partition are as follows:

[0068] System-level redundancy management and voting partition P5 > Cross-channel data interaction partition P4b ≥ Embedded health monitoring partition P4a = Power and thermal management partition P6 > Navigation and integrity management partition P1 = Flight control and reconfiguration partition P2 = Control output and interface partition P3 > Execution and self-test management partition P7 > Secure communication and configuration management partition P8 > Flight data logging partition P9;

[0069] Among them, the system-level redundancy management and voting partition (P5) is executed first to complete the determination of the local operating status; the embedded health monitoring partition (P4a), cross-channel data interaction partition (P4b), and power and thermal management partition (P6) are executed before control calculation to provide input for the operating status of the control chain and hardware status; the control execution link related partitions (P1, P2, P3) are executed sequentially within the same scheduling cycle; the execution and self-test management partition (P7) is executed after control output; and the safety communication and configuration management partition (P8) and flight data recording partition (P9) are executed in the latter part of the scheduling cycle.

[0070] In addition, the priority is not only used to determine the execution order of partitions, but also to characterize the resource guarantee level of each partition during system operation;

[0071] In cases of limited system resources or abnormal events, high-priority partitions are given priority in obtaining scheduling resources and are guaranteed execution, while the execution of low-priority partitions is delayed or compressed. In this embodiment, the main scheduling period can be configured to 10ms, and its specific scheduling is as follows: Figure 2 As shown.

[0072] In the scheduling strategy, in addition to being arranged according to execution order, each partition also implicitly contains functional priority semantics during system operation. Specifically, the scheduling priority corresponds to the following functional hierarchy:

[0073] System status determination (P5) > Status monitoring (P4a, P4b, P6) > Control execution (P1, P2, P3) > Execution layer management (P7) > Auxiliary service functions (P8, P9)

[0074] Under this hierarchical structure, the system prioritizes the execution of status determination and monitoring functions during operation, followed by ensuring the normal operation of the control link, while auxiliary functions can be postponed when necessary. Through these scheduling constraints, the system can prioritize the operation of critical safety functions in abnormal or resource-constrained situations.

[0075] In different implementations, the length of the time window and the scheduling cycle of each partition can be adjusted according to the real-time requirements of the system, but the constraint that the control execution link completes closed-loop processing within the same scheduling cycle remains unchanged.

[0076] The following describes the interaction and data flow design between the application partitions. In this system, the interaction between application partitions is achieved through the port and channel mechanisms provided by the partition operating system; direct memory access is not performed between partitions. Based on the system's functional division, the data interaction relationships between partitions include control and monitoring main data flow, system-level redundancy management data flow, and service-related data flow.

[0077] (1) Control and monitoring main data stream. The control and monitoring main data stream is used to support the flight control closed loop and its operational status monitoring, including the control forward data stream, the compute chain health monitoring data stream, and the cross-channel interactive data stream, including:

[0078] Control the forward data flow:

[0079] During operation, the modular partitioned flight control system executes the navigation and integrity management partition P1, flight control and reconfiguration partition P2, and control output and interface partition P3 sequentially within a single scheduling cycle, with the time windows arranged continuously. This ensures that state perception, control calculation, and control output are completed within a single cycle, thereby forming a deterministic closed-loop control process and generating a forward control data flow.

[0080] P1 → P2 → P3

[0081] The navigation and integrity management partition P1 outputs state data after completing the navigation state calculation. The flight control and reconfiguration partition P2 calculates the control law based on this state data. The control output and interface partition P3 converts the control result into the actuator interface control quantity. These three partitions are executed sequentially within the same scheduling cycle, and the time windows are arranged continuously, so that state perception, control calculation, and control output are completed within a single cycle, thus forming a deterministic closed-loop control process.

[0082] Under this scheduling mechanism, the execution of the control link is based on the results of prior monitoring and status determination. That is, before the control calculation is executed, the system has completed the evaluation of the operating status, thereby ensuring that the control calculation is performed in an available state.

[0083] Computational link health monitoring data stream: used for centralized monitoring of the control link's operational status, and its data transmission relationship is as follows:

[0084] P1, P2, P3 → P4a → P5

[0085] Among them, the navigation and integrity management partition P1, the flight control and reconfiguration solution partition P2, and the control output and interface partition P3 send operating status information, intermediate calculation results, and self-test information to the embedded health monitoring partition P4a, respectively. The embedded health monitoring partition P4a processes the above information, generates health status results, and sends them to the system-level redundancy management and voting partition P5.

[0086] In addition, the system operating environment and execution layer related states also participate in the system-level evaluation, and their data relationships are as follows:

[0087] P6 → P5

[0088] P7 → P5

[0089] Cross-channel interactive data stream: Used to support data interaction between the main control channel and the independent monitoring channel, and its data relationship is as follows:

[0090] P4b ↔ Monitoring Channel

[0091] Among them, the cross-channel data interaction partition P4b exchanges key status data and control-related information with the independent monitoring channel through the cross-channel data interaction interface provided by the system, and performs alignment and consistency processing on the data of different channels to form data for voting processing.

[0092] (2) System-level redundancy management data flow: used to support the determination of local operating status and the system reconfiguration process, and its data interaction relationship is as follows:

[0093] P4a, P6, P7 → P5

[0094] P5 ↔ Other flight control computers

[0095] Specifically, the system-level redundancy management and voting partition P5 receives status information from the embedded health monitoring partition P4a, power and thermal management partition P6, and execution and self-test management partition P7, and obtains status or control-related information from other flight control computers through the cross-computing unit data interaction mechanism provided by the system. Based on this, the system-level redundancy management and voting partition P5 comprehensively determines the operating status of the flight control unit, generates a flight control link exit command and status identifier when necessary, and publishes the flight control unit's operating status information to the relevant partitions.

[0096] (3) Service-type data flow: used to support communication, configuration, and data recording functions during system operation, including:

[0097] Data records data stream:

[0098] P1–P8 → P9

[0099] Each partition sends its operational data, status information, and event information to the flight data recording partition P9 via a one-way interface. The flight data recording partition P9 organizes and stores the data without providing feedback to other partitions.

[0100] Communication and configuration data flow:

[0101] External System → P8 → Partitions

[0102] External systems interact with the flight control computing system through the secure communication and configuration management partition P8. After parsing and verifying the received data, the secure communication and configuration management partition P8 forwards the data to the target partition. In the system startup or maintenance state, the secure communication and configuration management partition P8 provides parameter loading data to the relevant partitions.

[0103] Based on the above-mentioned functional division and data interaction relationship, the system of this solution constrains the information transmission path, control triggering method and execution relationship between different partitions according to the functional boundaries and safety criticality of different partitions, thereby realizing the isolation between partitions and the control of the scope of fault impact.

[0104] The navigation and integrity management partition P1, the flight control and reconfiguration partition P2, and the control output and interface partition P3 constitute the control execution link. Data is transmitted unidirectionally between the partitions only in a predetermined order. Specifically, the navigation and integrity management partition P1 outputs status information to the flight control and reconfiguration partition P2, the flight control and reconfiguration partition P2 outputs control commands to the control output and interface partition P3, and the control output and interface partition P3 does not feed back control-related data to the upstream partitions after completing the control output.

[0105] By limiting the direction of data transmission within the control chain, the control chain is prevented from forming closed-loop internal feedback paths, thus structurally avoiding circular dependencies between partitions. Simultaneously, the navigation and integrity management partition P1, the flight control and reconfiguration partition P2, and the control output and interface partition P3 do not directly receive raw data from the monitoring partition or the execution layer, thereby ensuring the stability of the control calculation process.

[0106] Isolation mechanism between control chain and monitoring partition:

[0107] The embedded health monitoring partition P4a and the execution and self-test management partition P7 are responsible for monitoring the control chain's operational status and managing the execution layer's status, respectively. Neither of them participates in control variable calculation. The navigation and integrity management partition P1, the flight control and reconfiguration partition P2, and the control output and interface partition P3 only output operational status information to the embedded health monitoring partition P4a and do not receive control-related inputs from the embedded health monitoring partition P4a. Similarly, the actuator status is processed by the execution and self-test management partition P7 and used for system-level evaluation, but does not directly affect the control calculation process of the flight control and reconfiguration partition P2.

[0108] By imposing the above constraints, the monitoring partition exists only as an information collection and analysis unit, and its output does not directly change the calculation behavior of the control chain partition, thereby achieving isolation between the control function and the monitoring function in the execution path.

[0109] Isolation mechanism between execution interface partitioning and execution layer

[0110] The control output and interface partition P3, as the control output interface partition, is only responsible for converting control commands into actuator interface control quantities and outputting them. It does not process actuator feedback information. The status feedback information of the actuator is uniformly received and processed by the execution and self-test management partition P7, and is not directly fed back to the control output and interface partition P3 or the flight control and reconfiguration partition P2.

[0111] By separating the control output path from the execution feedback path, the abnormality of the actuator will not directly affect the control command generation process through the interface partition, thereby reducing the impact of execution layer failures on the control chain.

[0112] Centralized control mechanism for system-level decision-making partitions

[0113] The system-level redundancy management and voting partition P5, as the system-level redundancy management and decision-making partition, is the only partition used to generate system-level control and disposal instructions. The embedded health monitoring partition P4a, power and thermal management partition P6, and execution and self-test management partition P7 only provide status information to the system-level redundancy management and voting partition P5, without directly triggering control chain reconfiguration or mode switching behavior; the system-level redundancy management and voting partition P5 performs a comprehensive judgment based on the received status information, and then uniformly generates the local operating status identifier and control and disposal instructions.

[0114] By limiting system-level control behavior to output only by the system-level redundancy management and voting partition P5, each partition will not trigger control actions based on its local state, thereby avoiding inconsistency issues caused by multi-source decision-making.

[0115] The cross-channel data interaction partition P4b serves as the sole data interaction interface between the main control channel and the independent monitoring channel; other partitions do not directly exchange data with the monitoring channel. The cross-channel data interaction partition P4b aligns and processes the cross-channel data before outputting data for voting, without participating in control logic calculations.

[0116] By concentrating cross-channel interactions in a single partition, the convergence of cross-channel information paths is achieved, preventing cross-channel communication from spreading to multiple partitions and thus reducing the degree of coupling between channels.

[0117] The security communication and configuration management partition P8 serves as the entry point for external communication and configuration management. It is responsible for processing external input data before forwarding it to the target partition. Each core partition does not directly receive external input data. The flight data recording partition P9 only receives data from each partition and records it, without outputting data to other partitions.

[0118] By using the above methods, a controlled interface is formed between external data and the core functions of the system, while ensuring that there is no feedback coupling between the data recording function and the control link, thereby achieving isolation between auxiliary functions and core functions.

[0119] It should be noted that the aforementioned partitions are all application software partitions running on top of the partition operating system. Task scheduling, time management, and inter-partition communication mechanisms are provided and implemented by the operating system; the partitions only call relevant service interfaces. The time base used for multi-source data processing is provided by the underlying system, and the partitions in this invention only perform data processing based on this time base, without involving the implementation of time synchronization mechanisms.

[0120] In addition, the actuator drivers involved in the control output are provided by the hardware support layer. The partitions in this invention only generate control quantities and output them through the driver interface. The voting units used for cross-channel arbitration are implemented in hardware. The partitions in this invention only provide data for voting.

[0121] The innovation of this invention focuses on the functional division and collaboration mechanism of application software partitions, without involving the operating system or hardware implementation. The independent monitoring channel is a computing unit independent of the main control channel. Its heterogeneous implementation belongs to the scope of system hardware architecture or basic software layer design. This invention does not limit its specific implementation method. This invention only involves the data interaction method and collaboration mechanism between the application software partition and the monitoring channel.

[0122] The embodiments described above are merely one implementation method of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A modular, partitioned flight control system for high safety requirements, characterized in that: This includes control execution link unit, embedded health monitoring partition, cross-channel data interaction partition, system-level redundancy management and voting partition, power and thermal management partition, and execution and self-test management partition; The control execution link unit is used to realize the aircraft's navigation, fault diagnosis, and control calculation, and to convert the calculated control quantity into control commands and transmit them to the aircraft's execution mechanism. The embedded health monitoring partition is used to monitor the operating status of the control execution link unit and send the monitoring results to the system-level redundancy management and voting partition; The power and thermal management partition is used to monitor and protect the operating environment of the flight control computing system, and to send the power and temperature-related status information of the flight control computer where the system is located to the system-level redundancy management and voting partition in real time. The execution and self-test management partition is used to perform consistency analysis by combining the status data of the aircraft actuators with control commands, and execute the corresponding self-test process to send the actuator status data and self-test results to the system-level redundancy management partition. The cross-channel data interaction partition obtains embedded health monitoring data based on the system-level redundancy management and voting partition, and performs a consistency comparison with the monitoring data of the control execution link using external independent computation, forming data for voting processing to be transmitted to the system-level redundancy management and voting partition. The system-level redundancy management and voting partitions acquire data from the control execution link unit, embedded health monitoring partition, cross-channel data interaction partition, power and thermal management partition, and execution and self-test management partition, respectively, to achieve a comprehensive assessment of the system's availability and corresponding handling and control strategies.

2. The modular partitioned flight control system for high safety requirements according to claim 1, characterized in that, The control execution link unit includes a navigation and integrity management partition, a flight control and reconfiguration partition, and a control output and interface partition; The navigation and integrity management partition is used for the fusion of multi-source navigation information and integrity assessment of the system. The navigation and integrity management partition uses nonlinear state estimation algorithm, residual test and consistency judgment algorithm, and fault detection and isolation algorithm to realize the fusion of multi-source sensor data of the aircraft and evaluate its reliability. When an anomaly is detected, it is isolated and the fusion strategy is adjusted. Finally, the navigation state information with reliability label is output to the flight control and reconstruction solution partition. The flight control and reconfiguration partition receives navigation status information and flight commands, calculates and generates virtual control quantities based on the control law of the current flight mode, and then performs control allocation processing. When receiving fault or capability degradation information, it dynamically adjusts the control strategy to achieve fault-tolerant control and outputs control commands to the control output and interface partition. The control output and interface partition is used to convert control commands into control quantities for the actuator interface. The control output and interface partition receives control commands from the flight control partition, performs periodic processing under the scheduling mechanism, converts the control quantities into standard interface data, and performs amplitude and rate of change constraints before outputting them to the aircraft actuators through the underlying drive interface. At the same time, it provides the relevant interface status to the execution and self-test management partition.

3. The modular partitioned flight control system for high safety requirements according to claim 2, characterized in that, The embedded health monitoring partition, based on operational status monitoring, threshold discrimination, and trend analysis algorithms, continuously evaluates the operational data of the navigation and integrity management partition, flight control and reconfiguration partition, and control output and interface partition to identify calculation anomalies, timing anomalies, and output anomalies. The embedded health monitoring partition periodically receives status information and intermediate calculation results from the navigation and integrity management partition, flight control and reconfiguration partition, and control output and interface partition. It performs health assessments based on preset criteria, generates fault flags and performs preliminary classifications when an anomaly is detected, and reports the results to the system-level redundancy management partition.

4. The modular partitioned flight control system for high safety requirements according to claim 1, characterized in that, The system-level redundancy management and voting partition receives status information from the embedded health monitoring partition, cross-channel data interaction partition, power and thermal management partition, and execution and self-test management partition. It performs a comprehensive analysis of the calculation status of the control execution link unit, the hardware operation status of the flight control computer, and the status of the aircraft actuators to obtain the operation status judgment result of the flight control computer. If the system-level redundancy management and voting partition determine that the flight control computer is unavailable or does not meet the operating conditions, a control link exit command is generated and the system reconfiguration process is triggered, causing the flight control computer to exit the control link and other flight control computers to take over the control functions, while issuing status alarm information. When the flight control computer is ready to be restarted, a restart request interface is provided for decision-making. After the restart is completed, the status of the flight control computer is updated to an available backup status and it participates in the system redundancy operation.

5. The modular partitioned flight control system for high safety requirements according to claim 2, characterized in that, The system also includes a secure communication and configuration management partition and a flight data recording partition; The secure communication and configuration management partition is used to realize external data interaction and system parameter management. The secure communication and configuration management partition receives external communication requests, parses and verifies the data, forwards the data to the target partition after the access control conditions are met, and provides parameter loading services in the system startup or maintenance state. The flight data recording partition is used to record and store flight operation data. The flight data recording partition receives data from each partition through a one-way interface, organizes the data and writes it to a non-volatile storage medium. It does not provide control or feedback interfaces to the outside world, thereby achieving isolation from the flight control link.

6. The modular partitioned flight control system for high safety requirements according to claim 5, characterized in that, During operation, the modular partitioned flight control system determines the execution priority of each partition based on its functional safety criticality and operational efficiency, and arranges them sequentially in the scheduling table. The priorities of each partition are as follows: System-level redundancy management and voting partition > Cross-channel data interaction partition ≥ Embedded health monitoring partition = Power and thermal management partition > Navigation and integrity management partition = Flight control and reconfiguration partition = Control output and interface partition > Execution and self-test management partition > Secure communication and configuration management partition > Flight data logging partition; The priority is used not only to determine the execution order of partitions, but also to characterize the resource guarantee level of each partition during system operation; In cases of limited system resources or abnormal events, high-priority partitions are given priority in obtaining scheduling resources and are guaranteed to execute, while the execution of low-priority partitions is delayed or compressed.

7. The modular partitioned flight control system for high safety requirements according to claim 6, characterized in that, During operation, the modular partitioned flight control system executes the navigation and integrity management partition, flight control and reconfiguration solution partition, and control output and interface partition sequentially within a single scheduling cycle, with the time windows arranged continuously. This allows state perception, control calculation, and control output to be completed within a single cycle, thereby forming a deterministic closed-loop control process.

8. The modular partitioned flight control system for high safety requirements according to claim 4, characterized in that, The system-level redundancy management and voting partition will interact with the operating status judgment results and control information of this flight control computer and the operating status results and control information of other flight control computers.

Images