Non-similar three-redundancy aircraft control surface position feedback voting method

Abstract

This invention belongs to the field of flight control technology and discloses a non-similarity triple-redundant aircraft control surface position feedback voting method. It outputs a voting result for the aircraft control surface position in an aircraft control surface control system with dual-winding motor control and dual LVDT detection. The dual windings of the motor output RDC1 and RDC2 signals respectively, and the dual LVDTs output LVDT1 and LVDT2 signals respectively. The validity of RDC1 and RDC2 signals is determined, as are the validity of LVDT1 and LVDT2 signals. Each pair of RDC1, LVDT1, and LVDT2 signals is compared to obtain three errors. These three errors are then compared to error thresholds. When all errors are less than the error threshold, the LVDT1 signal is selected as the voting value for the aircraft control surface position. This invention cleverly utilizes the rotary transformer of the dual-winding motor to calculate the control surface position signal, forming a non-similarity triple-redundant monitoring system with the position signal acquired by the dual LVDTs, achieving triple-redundant monitoring without adding additional hardware.

Description

Technical Field

[0001] This invention belongs to the field of flight control technology and relates to a method for detecting the position of control surfaces in an aircraft fly-by-wire flight control system, specifically a method for feedback voting on the position of control surfaces of a non-similar triple-redundant aircraft. Background Technology

[0002] The flight control system is the core control system of an aircraft, and its reliability is directly related to flight safety. Control surface position feedback signals, as a critical input to the flight control system, are essential for achieving precise flight attitude control. Deviations in control surface position signals can lead to aircraft attitude instability, and in severe cases, even flight accidents. Therefore, flight control systems typically employ techniques such as redundancy design, fault detection and isolation, and signal voting to improve the system's fault tolerance and reliability.

[0003] With the development of aviation technology, the control architecture of aircraft flight control systems is shifting from traditional centralized control to distributed control. Centralized control architecture relies on a single core controller to process all sensor signals and control commands, resulting in limitations such as high single-point-of-failure risk, complex wiring, and poor system scalability. Distributed control architecture, by distributing control functions to multiple independent sub-nodes, allows each sub-node to collect sensor signals locally and perform collaborative calculations. This simplifies system wiring, reduces the risk of electromagnetic interference, and enhances system fault tolerance through redundant sub-node configurations.

[0004] In a distributed control architecture, control surface position feedback, as a critical sensing component of the flight control system, currently commonly employs an electrical triple-redundancy or electrical quadruple-redundancy design. Data is exchanged between redundancies via cross-channel data links. Each electrical redundancy is equipped with the same type of linear variable differential transformer (LVDT) to collect control surface position signals, which are then transmitted to the voting unit for processing. This similar redundancy design can solve the signal loss problem caused by a single sub-node failure through redundant configuration, but it carries the risk of common-mode failure: when encountering specific electromagnetic interference, temperature stress, or common design defects, all redundancies may fail simultaneously, causing the voting unit to be unable to obtain effective feedback signals, thereby affecting control surface accuracy and flight safety.

[0005] Furthermore, existing redundancy management schemes have shortcomings in fault isolation mechanisms. When a sensor signal in a redundancy fails, there is a lack of an effective degradation voting strategy. The failure of a single redundancy may affect the overall voting result, leading to a decrease in the system's fault tolerance. Simultaneously, when multiple redundancy signals differ, the lack of clear arbitration rules to determine the final voting output may result in uncertainty in control commands, affecting system stability.

[0006] In practical applications, traditional similarity redundancy designs also face limitations in cost and weight. To improve system reliability, more LVDT sensors are often needed, which not only increases hardware costs but also increases system weight and complexity, posing a significant disadvantage for aircraft that pursue lightweight design.

[0007] Therefore, a new control surface position feedback voting method is needed to effectively avoid common-mode failure risks under a distributed control architecture, improve the system's fault tolerance and robustness, and at the same time have a sound fault isolation mechanism and clear arbitration rules to ensure the reliability and safety of the flight control system without increasing additional hardware costs and system weight. Summary of the Invention

[0008] To address the aforementioned issues, this invention provides a non-similar triple-redundant aircraft control surface position feedback voting method. By fully utilizing the hardware advantages of the distributed control architecture and combining it with this control surface position feedback voting method, the problem of common-mode fault risk and low core fault tolerance in traditional electrical triple redundancy is solved.

[0009] The technical solution of the present invention is as follows: A non-similarity triple-redundant aircraft control surface position feedback voting method, which outputs the voting position of the aircraft control surface in an aircraft control surface control system with dual-winding motor control and dual LVDT detection, includes the following steps: S1, the dual windings of the motor output RDC1 and RDC2 signals respectively, and the dual LVDTs output LVDT1 and LVDT2 signals respectively; S2, determine whether the RDC1 and RDC2 signals are valid; if yes, proceed to S3. S3, determine whether LVDT1 and LVDT2 signals are valid; if yes, proceed to S4. S4. Compare the RDC1 signal, LVDT1 signal, and LVDT2 signal in pairs to obtain three errors. Then compare the three errors with the error threshold. When all errors are less than the error threshold, proceed to S5. S5, select the LVDT1 signal as the voting value for the aircraft control surface position.

[0010] Furthermore, in S2, otherwise proceed to S6; S6, determine whether the RDC1 signal is invalid, and determine whether the RDC2 signal is valid. If yes, proceed to S7. S7, disconnect the RDC1 signal, switch the RDC2 signal for servo control, and proceed to S8; S8, determine if the LVDT2 signal is valid, if yes, proceed to S9; S9, determine whether the error between the LVDT2 signal and the RDC2 signal is less than the error threshold; if yes, proceed to S10. S10, select the average value of the LVDT2 signal and the RDC2 signal as the voting value for the aircraft control surface position.

[0011] Furthermore, in S6, if both RDC1 and RDC2 signals are deemed invalid, a motor malfunction is identified, and the aircraft control surface actuators driven by the motor cease operation.

[0012] Furthermore, in S8, the RCD2 signal is otherwise selected as the voting value for the aircraft control surface position.

[0013] Furthermore, in S9, if the vote fails, the signal closest to the previous control surface position feedback signal among the LVDT2, RDC1, and RDC2 signals is selected as the voting value for the aircraft control surface position.

[0014] Furthermore, in S3, otherwise proceed to S11; S11, determine whether either LVDT1 or LVDT2 is valid; if so, proceed to S12. S12, Determine whether the error between the LVDT1 signal and the RDC1 signal is greater than the error threshold, and whether the error between the LVDT1 signal and the LVDT2 signal is greater than the error threshold; if any of the determinations in this step is true, proceed to S13; S13, select the average value of either the LVDT1 signal or the LVDT2 signal and the RCD1 signal as the voting value for the aircraft control surface position.

[0015] Furthermore, in S11, the RCD1 signal is otherwise suspended as the voting value for the aircraft control surface position.

[0016] Furthermore, in S12, if none of the above conditions are met, the vote is deemed to have failed. Among the LVDT1 signal or LVDT2 signal, and the RDC1 signal and the RDC2 signal, the signal that is closest to the previous control surface position feedback signal is selected as the voting value for the aircraft control surface position.

[0017] Furthermore, in S3, otherwise proceed to S13; S13, determine whether all errors are greater than the error threshold; if so, proceed to S14. S14, if the vote fails, select the signal that is closest to the previous control surface position feedback signal from among the LVDT1, LVDT2 and RDC1 signals as the voting value for the aircraft control surface position.

[0018] Furthermore, in S13, otherwise proceed to S15; S15, Determine whether the error between the LVDT1 signal and the RDC1 signal is greater than the error threshold, and whether the error between the LVDT1 signal and the LVDT2 signal is greater than the error threshold. If either of the determinations in this step is true, select the LVDT1 signal as the voting value for the aircraft control surface position; otherwise, select the average value of the RDC1 signal and the LVDT2 signal as the voting value for the aircraft control surface position.

[0019] The advantages of this invention are as follows: 1. By cleverly utilizing the rotary transformer of the dual-winding motor to calculate the rudder surface position signal, and forming a non-similarity triple redundancy monitoring with the position signal collected by dual LVDTs, triple redundancy monitoring is achieved without adding extra hardware devices. This does not increase the cost and weight of the rudder surface servo actuator system, fundamentally avoiding the common-mode fault risk of traditional similar redundancy design, and significantly improving the core fault tolerance capability of the servo actuator system.

[0020] 2. A step-by-step degrading voting strategy based on signal validity is adopted. When a signal is invalid, it is removed and voting is conducted again until all signals are invalid before stopping the control surface servo. This achieves effective fault isolation and greatly improves the system's ability to handle faults and its robustness.

[0021] 3. The system adopts a priority arbitration voting rule based on the main channel. When all signals are valid and the error between the main channel signal and any backup channel signal is less than the threshold, the main channel signal is selected as the servo closed-loop signal. This effectively avoids control command confusion caused by differences in multiple signals and ensures the uniqueness and stability of the system control logic.

[0022] 4. In the event of a failed vote, the system output continuity is ensured by selecting the signal with the smallest deviation from the control surface position feedback signal of the previous sampling period as the voting value, thus avoiding the adverse effects of sudden output changes on flight control.

[0023] 5. This voting method is characterized by strong scalability, simple operation, and considerable benefits. It can be widely applied to various redundant signal processing scenarios, and is particularly suitable for aircraft fly-by-wire flight control systems with high safety requirements. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. The drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 This is a schematic diagram of a distributed electrical dual-redundant aircraft control surface servo actuator control architecture.

[0026] Figure 2 This is a flowchart illustrating the feedback voting method for control surface positions of a non-similarity triple-redundant aircraft.

[0027] Figure 1 In this diagram, CE stands for Electronic Control Unit of the Actuator Controller, PDE stands for Power Drive Unit of the Actuator Controller, CCDL stands for Cross-Channel Data Link for Data Transfer between the Two Channels of the Actuator Controller, RDC stands for Aircraft Control Surface Position Feedback Calculated by Motor Rotary Transformer, and LVDT stands for Aircraft Control Surface Position Feedback Acquired by Linear Variable Differential Transformer.

[0028] Figure 2 In this context, Valid_RDC1 and Valid_RDC2 represent the validity of the primary channel RDC signal and the backup channel RDC signal, respectively, with 1 indicating validity and 0 indicating invalidity. Similarly, Valid_LVDT1 and Valid_LVDT2 represent the validity of the primary channel LVDT signal and the backup channel LVDT signal, respectively, with 1 indicating validity and 0 indicating invalidity. Error_L1R1 represents the error between the primary channel LVDT signal and the RDC signal; Error_L1L2 represents the error between the primary channel LVDT signal and the backup channel LVDT signal; and Error_L2R2 represents the error between the backup channel LVDT signal and the backup channel RDC signal. ET represents the error threshold between any two signals, and NUM_BE represents the number of pairs of signals whose errors are less than the error threshold. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] The features and illustrative embodiments of various aspects of the present invention will now be described in detail. Numerous specific details are set forth in the following detailed description to provide a thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention may be practiced without requiring some of these specific details. The following description of embodiments is merely intended to provide a better understanding of the invention by illustrating examples of the invention. The invention is by no means limited to any specific setups and methods set forth below, but covers any improvements, substitutions, and modifications to structures, methods, and devices without departing from the spirit of the invention. Well-known structures and techniques are not shown in the drawings and the following description to avoid unnecessarily obscuring the invention.

[0031] In the description of this invention, it should be noted that the directions or positional relationships indicated by terms such as "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer" are based on the directions or positional relationships shown in the accompanying drawings and are only for the convenience of describing and simplifying the invention, and should not be construed as limiting the invention. Furthermore, the use of ordinal numbers (e.g., "first and second," etc.) is for distinguishing objects and is not limited to this order, and should not be construed as indicating or implying relative importance.

[0032] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly, encompassing both direct connection and indirect connection via an intermediate medium. Those skilled in the art can understand the specific meaning of these terms in this invention based on the specific circumstances.

[0033] It should be noted that, unless otherwise specified, the embodiments of the present invention and the features thereof can be combined with each other, and the various embodiments can be referenced and cited in each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0034] First embodiment: A non-similarity triple-redundant aircraft control surface position feedback voting method, which outputs the voting position of the aircraft control surface in an aircraft control surface control system with dual-winding motor control and dual LVDT detection, includes the following steps: S1, the dual windings of the motor output RDC1 and RDC2 signals respectively, and the dual LVDTs output LVDT1 and LVDT2 signals respectively; S2, determine whether the RDC1 and RDC2 signals are valid; if yes, proceed to S3. S3, determine whether LVDT1 and LVDT2 signals are valid; if yes, proceed to S4. S4. Compare the RDC1 signal, LVDT1 signal, and LVDT2 signal in pairs to obtain three errors. Then compare the three errors with the error threshold. When all errors are less than the error threshold, proceed to S5. S5, select the LVDT1 signal as the voting value for the aircraft control surface position.

[0035] In S2, otherwise proceed to S6; S6, determine whether the RDC1 signal is invalid, and determine whether the RDC2 signal is valid. If yes, proceed to S7. S7, disconnect the RDC1 signal, switch the RDC2 signal for servo control, and proceed to S8; S8, determine if the LVDT2 signal is valid, if yes, proceed to S9; S9, determine whether the error between the LVDT2 signal and the RDC2 signal is less than the error threshold; if yes, proceed to S10. S10, select the average value of the LVDT2 signal and the RDC2 signal as the voting value for the aircraft control surface position.

[0036] In S6, otherwise it is determined that both RDC1 and RDC2 signals are invalid, indicating a motor failure, and the aircraft control surface actuators driven by the motor stop working.

[0037] In S8, otherwise the RCD2 signal is selected as the voting value for the aircraft control surface position.

[0038] In S9, otherwise the vote is deemed to have failed. Among the LVDT2 signal, RDC1 signal and RDC2 signal, the signal that is closest to the previous control surface position feedback signal is selected as the voting value for the aircraft control surface position.

[0039] In S3, otherwise proceed to S11; S11, determine whether either LVDT1 or LVDT2 is valid; if so, proceed to S12. S12, Determine whether the error between the LVDT1 signal and the RDC1 signal is greater than the error threshold, and whether the error between the LVDT1 signal and the LVDT2 signal is greater than the error threshold; if any of the determinations in this step is true, proceed to S13; S13, select the average value of either the LVDT1 signal or the LVDT2 signal and the RCD1 signal as the voting value for the aircraft control surface position.

[0040] In S11, otherwise the RCD1 signal is suspended as the voting value for the aircraft control surface position.

[0041] If none of the above conditions are met in S12, the vote is deemed unsuccessful. Among the LVDT1 or LVDT2 signals, and the RDC1 and RDC2 signals, the signal closest to the previous control surface position feedback signal is selected as the vote value for the aircraft control surface position.

[0042] In S3, otherwise proceed to S13; S13, determine whether all errors are greater than the error threshold; if so, proceed to S14. S14, if the vote fails, select the signal that is closest to the previous control surface position feedback signal from among the LVDT1, LVDT2 and RDC1 signals as the voting value for the aircraft control surface position.

[0043] If it proceeds to S13, then proceed to S15. S15, Determine whether the error between the LVDT1 signal and the RDC1 signal is greater than the error threshold, and whether the error between the LVDT1 signal and the LVDT2 signal is greater than the error threshold. If either of the determinations in this step is true, select the LVDT1 signal as the voting value for the aircraft control surface position; otherwise, select the average value of the RDC1 signal and the LVDT2 signal as the voting value for the aircraft control surface position.

[0044] Second embodiment: To address the shortcomings of existing technologies, this invention proposes a non-similarity triple redundancy aircraft control surface position feedback voting method.

[0045] The method provided by this invention applies a distributed electrically redundant aircraft control surface servo actuator control architecture, such as... Figure 1 As shown.

[0046] The actuator controller includes channel 1 and channel 2. Each channel includes two power drive electronic units (PDEs) and one control electronic unit (CE). The PDEs are responsible for driving the motors of the aircraft control surface actuators, while the CEs perform functions such as redundancy management, motor drive algorithms, and bus data processing. The control surface position feedback voting method mentioned in this invention is executed in the CEs. The CEs of the two channels exchange data through synchronous CCDL.

[0047] The aircraft control surface actuator features electrical redundancy, with a single-motor, dual-winding motor configuration and a primary / backup operating mode. When one channel fails, it switches to the backup channel for servo operation. Each channel is equipped with an LVDT (Low-Level Digital Transformer) to acquire control surface position signals and can also calculate control surface position information using a resolver-to-digital converter (RDC) within that channel. The non-similar triple-redundant control surface position feedback mentioned in this invention comprises the control surface position signals acquired by the two LVDT channels and the control surface position information calculated by the RDC within that channel.

[0048] The method provided by this invention includes: The first step involves the primary and backup LVDT and RDC channels uploading control surface position signals to their respective connected CEs and monitoring the validity of the control surface position signals calculated by the primary and backup LVDT and RDC channels. If both primary and backup RDC signals are valid, proceed to the second step; if the primary channel's RDC signal is invalid but the backup channel's RDC signal is valid, proceed to the ninth step; if both primary and backup RDC signals are invalid, proceed to the fourteenth step.

[0049] The second step is to proceed to the third step if the LVDT signals of both the primary and backup channels are valid; if only one channel's LVDT signal is valid, proceed to the sixth step; if both the primary and backup channels' LVDT signals are invalid, proceed to the eighth step.

[0050] The third step is to output the LVDT signal of the main channel as the aircraft control surface position feedback signal if any one of the errors between the LVDT signal of the main channel and the RDC signal of the main channel and the LVDT signal of the backup channel is less than the error threshold; otherwise, proceed to the fourth step.

[0051] Fourth step: If the LVDT signal of the main channel, the RDC signal of the main channel, and the LVDT signal of the backup channel form a 1V2, then output the average value of the RDC signal of the main channel and the LVDT signal of the backup channel as the aircraft control surface position feedback signal; otherwise, proceed to the fifth step.

[0052] Fifth step: If the LVDT signal of the main channel, the RDC signal of the main channel, and the LVDT signal of the backup channel form a 1V1V1, the voting is deemed to have failed, and the signal closest to the previous control surface position feedback signal is output as the voting result.

[0053] Step 6: If the error between the LVDT signal of the main channel or the LVDT signal of the backup channel and the RDC signal of the main channel is less than the error threshold, then output the average value of the LVDT signal of the main channel or the LVDT signal of the backup channel and the RDC signal of the main channel as the aircraft control surface position feedback signal; otherwise, proceed to step 7.

[0054] Step 7: If the LVDT signal of the main channel or the LVDT signal of the backup channel forms a 1V1 with the RDC signal of the main channel, the voting is deemed to have failed, and the signal closest to the previous control surface position feedback signal is output as the voting result.

[0055] Step 8: Output the RDC signal of the main channel as the aircraft control surface position feedback signal.

[0056] Step 9: Disconnect the main channel and switch to the backup channel for servoing. In this step, the control surface position feedback signal from the previous step is used as the voting result.

[0057] Step 10: If the LVDT signal of the backup channel is valid, proceed to step 11; otherwise, proceed to step 13.

[0058] Step 11: If the error between the LVDT signal and the RDC signal of the backup channel is less than the error threshold, then the average value of the LVDT signal and the RDC signal of the backup channel is output as the aircraft control surface position feedback signal; otherwise, proceed to step 12.

[0059] Step 12: If the LVDT signal of the backup channel and the RDC signal of the backup channel form a 1V1, the voting is deemed to have failed, and the signal closest to the previous control surface position feedback signal is output as the voting result.

[0060] Step 13: Output the RDC signal from the backup channel as the aircraft control surface position feedback signal.

[0061] Step fourteen: Disconnect the backup channel; the aircraft's control surface actuators will then cease servo operation.

[0062] Third embodiment: This invention provides a distributed electrically redundant aircraft control surface servo actuator control architecture, including: an aircraft management computer 1, an aircraft management computer 2, an actuator controller, and aircraft control surface actuators 1 and 2, as follows: Figure 1 As shown.

[0063] Specifically, the actuator controller includes a channel 1 control unit and a channel 2 control unit. The channel 1 control unit includes a channel 1 CE module, a channel 1 PDE1 module, and a channel 1 PDE2 module. The channel 2 control unit includes a channel 2 CE module, a channel 2 PDE1 module, and a channel 2 PDE2 module. The channel 1 CE module and the channel 2 CE module require 28V DC power and perform functions such as redundancy management, motor drive algorithms, bus data processing, and control surface position feedback voting. The channel 1 CE module communicates with the aircraft management computer 1, and the channel 2 CE module communicates with the aircraft management computer 2. The channel 1 CE module and the channel 2 CE module exchange data via the CCDL internal bus. The channel 1 PDE1 module, channel 1 PDE2 module, channel 2 PDE1 module, and channel 2 PDE2 module require 270V DC power.

[0064] The aircraft control surface actuators include control surface 1 actuator and control surface 2 actuator. Both control surface 1 and control surface 2 actuators include a dual-winding motor and an actuator cylinder. A dual-redundant LVDT is installed within the actuator cylinder for acquiring aircraft control surface position signals. Motor winding 1 of control surface 1 actuator is driven by channel 1 PDE1 module, and motor winding 2 of control surface 1 actuator is driven by channel 2 PDE1 module. Similarly, motor winding 1 of control surface 2 actuator is driven by channel 1 PDE2 module, and motor winding 2 of control surface 2 actuator is driven by channel 2 PDE2 module. The motor RDC1 signal of control surface 1 actuator is transmitted back to channel 1 CE module; the motor RDC2 signal of control surface 1 actuator is transmitted back to channel 2 CE module; the actuator cylinder LVDT1 signal of control surface 1 actuator is transmitted back to channel 1 CE module; and the actuator cylinder LVDT2 signal of control surface 1 actuator is transmitted back to channel 2 CE module. Similarly, the motor RDC1 signal of control surface 2 actuator is transmitted back to channel 2 CE module; the motor RDC2 signal of control surface 2 actuator is transmitted back to channel 1 CE module; the actuator cylinder LVDT1 signal of control surface 2 actuator is transmitted back to channel 2 CE module; and the actuator cylinder LVDT2 signal of control surface 2 actuator is transmitted back to channel 1 CE module. The current servo channel for the aircraft control surface actuators is defined as the main channel.

[0065] The actuator controller channel 1 PDE1 module drives motor winding 1 of the aircraft control surface 1 actuator, and the actuator controller channel 2 PDE2 module drives motor winding 2 of the aircraft control surface 2 actuator. Both the main and backup channel RDC signals and LVDT signals of the aircraft control surface 1 actuator are valid. The main channel LVDT control surface position is 5.2°, the main channel RDC control surface position is 5.5°, and the backup channel LVDT control surface position is 5.85°. Both the main and backup channel RDC signals and LVDT signals of the aircraft control surface 2 actuator are valid. The main channel LVDT control surface position is 4.1°, the main channel RDC control surface position is 4.2°, and the backup channel LVDT control surface position is 4.15°. The error threshold ET between any two position signals of the aircraft control surface actuators is 0.2°. The previous control surface position of the aircraft control surface 1 actuator was 5.4°, and the previous control surface position of the aircraft control surface 2 actuator was 4.0°. The actuator controller's Channel 1 CE module communicates normally with Channel 2 CE module CCDL, and its communication with the aircraft management computer is also normal.

[0066] The first step is to ensure that the primary and backup RDC signals of both the aircraft control surface 1 actuator and the aircraft control surface 2 actuator are valid, that is, Valid_RDC1 = 1 and Valid_RDC2 = 1 for the control surface 1 actuator, and Valid_RDC1 = 1 and Valid_RDC2 = 1 for the control surface 2 actuator.

[0067] The second step is to ensure that the primary and backup LVDT signals of both the aircraft control surface 1 actuator and the aircraft control surface 2 actuator are valid, that is, Valid_LVDT1 = 1 and Valid_LVDT2 = 1 for the control surface 1 actuator, and Valid_LVDT1 = 1 and Valid_LVDT2 = 1 for the control surface 2 actuator.

[0068] Third, the error between the LVDT signal of the main channel and the RDC signal of the main channel of the aircraft control surface 1 actuator is: Error_L1R1 = | 5.2° - 5.5°| = 0.3°, and the error between the LVDT signal of the main channel and the LVDT signal of the backup channel is: Error_L1L2 = | 5.2° - 5.85°| = 0.65°. Therefore, both errors are greater than the error threshold ET = 0.2°.

[0069] The error between the LVDT signal and the RDC signal of the main channel of the aircraft control surface 2 actuator is: Error_L1R1 = |4.1° - 4.2°| = 0.1°, and the error between the LVDT signal of the main channel and the LVDT signal of the backup channel is: Error_L1L2 = |4.1° - 4.15°| = 0.05°. Therefore, both errors are less than the error threshold ET = 0.2°. Thus, the control surface position feedback signal of the aircraft control surface 2 actuator is 4.1°, and the voting process ends.

[0070] Fourthly, the error between the RDC signal of the main channel and the LVDT signal of the backup channel of the aircraft control surface 1 actuator is: Error_R1L2 = |5.5°-5.85°| = 0.35°, which is greater than the error threshold ET = 0.2°. Therefore, the LVDT signal of the main channel does not constitute 1V2 with the RDC signal of the main channel and the LVDT signal of the backup channel.

[0071] In the fifth step, the errors between the pairwise position signals of the aircraft control surface 1 actuator are: Error_L1R1 = 0.3°, Error_L1L2 = 0.65°, and Error_R1L2 = 0.35°, all of which are greater than the error threshold ET = 0.2°. Therefore, the LVDT signal of the main channel, the RDC signal of the main channel, and the LVDT signal of the backup channel constitute a 1V1V1, and the voting fails. Since the control surface position of the aircraft control surface 1 actuator in the previous step is 5.4°, the closest main channel RDC signal of 5.5° is output as the control surface position feedback signal, and the voting process ends.

[0072] Fourth embodiment: The actuator controller channel 2 PDE1 module drives the motor winding 2 of the aircraft control surface 1 actuator, and the actuator controller channel 1 PDE2 module drives the motor winding 1 of the aircraft control surface 2 actuator. The main channel RDC and LVDT signals of the aircraft control surface 1 actuator are both invalid, while the backup channel RDC and LVDT signals are both valid. The next backup channel LVDT control surface position is 6.4°, and the backup channel RDC control surface position is 6.5°. The main and backup channel RDC signals and the backup channel LVDT signal of the aircraft control surface 2 actuator are both valid, but the main channel LVDT signal is invalid. The main channel RDC control surface position is 3.8°, and the backup channel LVDT control surface position is 3.4°. The error threshold ET between any two position signals of the aircraft control surface actuators is 0.2°. The previous control surface position of the aircraft control surface 1 actuator was 6.2°, and the previous control surface position of the aircraft control surface 2 actuator was 3.5°. The actuator controller's Channel 1 CE module communicates normally with Channel 2 CE module CCDL, and its communication with the aircraft management computer is also normal.

[0073] First, the main channel RDC signal of the aircraft control surface 1 actuator is invalid, while the backup channel RDC signal is valid, i.e., Valid_RDC1 = 0 and Valid_RDC2 = 1.

[0074] Both the primary and backup RDC signals of the aircraft control surface 2 actuator are valid, i.e., Valid_RDC1 = 1 and Valid_RDC2 = 1.

[0075] The second step involves cutting off the drive of the actuator motor winding 2 of the aircraft control surface 1 actuator from the actuator control channel 2 PDE1 module, and switching the actuator control channel 1 PDE1 module to drive the actuator motor winding 1 of the aircraft control surface 1, using the previous control surface position of 6.2° as the feedback signal for the current control surface position.

[0076] The main channel LVDT signal of the aircraft control surface 2 actuator is invalid, while the backup channel LVDT signal is valid, i.e., Valid_LVDT1 = 0 and Valid_LVDT2 = 1.

[0077] The third step is to enable the LVDT signal of the aircraft control surface 1 actuator backup channel, i.e., Valid_LVDT2 = 1.

[0078] The error between the LVDT signal of the backup channel and the RDC signal of the main channel of the aircraft control surface actuator 2 is: Error_L2R1 = |3.4°-3.8°| = 0.4°, which is greater than the error threshold ET = 0.2°.

[0079] In the fourth step, the error between the LVDT signal and the RDC signal of the backup channel for the next pulse of the aircraft control surface 1 actuator is: Error_L2R2 = |6.4° - 6.5°| = 0.1°, which is less than the error threshold ET = 0.2°. Therefore, the average value of the LVDT signal and the RDC signal of the backup channel, 6.45°, is used as the control surface position feedback signal for the next pulse, and the voting process ends.

[0080] The error between the LVDT signal of the backup channel and the RDC signal of the main channel of the aircraft control surface actuator 2 exceeds the error threshold, so the two signals form a 1V1, and the vote fails. Since the control surface position of the aircraft control surface actuator 2 in the previous step is 3.5°, the closest backup channel LVDT signal of 3.4° is output as the control surface position feedback signal, and the voting process ends.

[0081] This embodiment demonstrates the channel switching and degraded voting process in an RDC single-redundancy failure scenario. When the primary channel RDC signal is invalid while the backup channel RDC signal is valid, the system disconnects the primary channel RDC signal and switches to the backup channel RDC signal for servo control, reflecting a step-by-step degraded voting strategy based on signal validity. When the error between the backup channel LVDT signal and the backup channel RDC signal is less than a preset error threshold, the average of the two is selected as the voting value for the control surface position, improving voting accuracy. When only a single LVDT signal is valid and the error between this signal and the RDC signal is greater than a preset error threshold, the system determines it as a 1V1 voting failure scenario. By selecting the signal with the smallest deviation from the control surface position feedback signal of the previous sampling period as the voting value, the continuity of the system output is ensured.

[0082] It should be noted that when both the primary and backup RDC signals are invalid, the system identifies a motor failure and stops the operation of the aircraft control surface actuators driven by the dual-winding motor, ensuring system safety. When the backup LVDT signal is invalid, the system selects the backup RDC signal as the voting value for the control surface position, achieving effective fault isolation. When both the primary and backup LVDT signals are invalid, the system selects the primary RDC signal as the voting value for the control surface position, continuing until all signals are invalid before stopping the control surface servo, significantly improving the system's fault handling capability and robustness.

[0083] In practical applications, the preset error threshold value can be adjusted according to the specific application scenario. In the embodiment of the present invention, the preset error threshold ET is 0.2°, which ensures voting accuracy while also taking into account the system's fault tolerance. In other embodiments, the preset error threshold value can range from 0.1° to 0.5°. When the preset error threshold is set to 0.1°, the system has higher requirements for signal consistency and is suitable for scenarios with extremely high requirements for control surface position accuracy. When the preset error threshold is set to 0.5°, the system has stronger fault tolerance and is suitable for scenarios with significant sensor noise or electromagnetic interference.

[0084] This invention cleverly utilizes the rotary transformer of a dual-winding motor to calculate the control surface position signal, forming a dissimilar triple-redundant monitoring system with the position signal acquired by dual LVDTs. This achieves triple-redundant monitoring without adding extra hardware, avoiding any increase in cost or weight to the control surface servo actuator system. It fundamentally avoids the common-mode fault risk inherent in traditional similar redundancy designs, significantly improving the core fault tolerance of the servo actuator system. A step-by-step degrading voting strategy based on signal validity is employed. When a signal is invalid, it is removed before voting continues until all signals are invalid, at which point the control surface servo stops. This effectively isolates faults and significantly improves the system's fault handling capability and robustness. A priority arbitration voting rule based on master channel priority is used. When all signals are valid and the error between the master channel signal and any backup channel signal is less than a threshold, the master channel signal is preferentially selected as the servo closed-loop signal. This effectively avoids control command confusion caused by multiple signal differences, ensuring the uniqueness and stability of the system's control logic.

[0085] The above detailed embodiments are a description of the present invention. It should not be considered that the specific embodiments of the present invention are limited to these descriptions. For those skilled in the art, several simple deductions and substitutions can be made without departing from the concept of the present invention, and all of these should be considered to fall within the protection scope of the present invention.

Claims

1. A method for feedback voting on the position of control surfaces of a non-similarity triple-redundant aircraft, characterized in that, The voting output for the aircraft control surface position of an aircraft control surface control system with dual-winding motor control and dual LVDT detection includes the following steps: S1, the dual windings of the motor output RDC1 and RDC2 signals respectively, and the dual LVDTs output LVDT1 and LVDT2 signals respectively; S2, determine whether the RDC1 and RDC2 signals are valid; if yes, proceed to S3. S3, determine whether LVDT1 and LVDT2 signals are valid; if yes, proceed to S4. S4. Compare the RDC1 signal, LVDT1 signal, and LVDT2 signal in pairs to obtain three errors. Then compare the three errors with the error threshold. When all errors are less than the error threshold, proceed to S5. S5, select the LVDT1 signal as the voting value for the aircraft control surface position.

2. The method for feedback voting on the position of non-similarity triple-redundant aircraft control surfaces according to claim 1, characterized in that, In S2, otherwise proceed to S6; S6, determine whether the RDC1 signal is invalid, and determine whether the RDC2 signal is valid. If yes, proceed to S7. S7, disconnect the RDC1 signal, switch the RDC2 signal for servo control, and proceed to S8; S8, determine if the LVDT2 signal is valid, if yes, proceed to S9; S9, determine whether the error between the LVDT2 signal and the RDC2 signal is less than the error threshold; if yes, proceed to S10. S10, select the average value of the LVDT2 signal and the RDC2 signal as the voting value for the aircraft control surface position.

3. The method for feedback voting on the position of non-similarity triple-redundant aircraft control surfaces according to claim 2, characterized in that, In S6, otherwise it is determined that both RDC1 and RDC2 signals are invalid, indicating a motor failure, and the aircraft control surface actuators driven by the motor stop working.

4. The method for feedback voting on the position of non-similarity triple-redundant aircraft control surfaces according to claim 2, characterized in that, In S8, otherwise the RCD2 signal is selected as the voting value for the aircraft control surface position.

5. The method for feedback voting on the position of non-similarity triple-redundant aircraft control surfaces according to claim 2, characterized in that, In S9, otherwise the vote is deemed to have failed. Among the LVDT2 signal, RDC1 signal and RDC2 signal, the signal that is closest to the previous control surface position feedback signal is selected as the voting value for the aircraft control surface position.

6. The method for feedback voting on the position of non-similarity triple-redundant aircraft control surfaces according to claim 1, characterized in that, In S3, otherwise proceed to S11; S11, determine whether either LVDT1 or LVDT2 is valid; if so, proceed to S12. S12, Determine whether the error between the LVDT1 signal and the RDC1 signal is greater than the error threshold, and whether the error between the LVDT1 signal and the LVDT2 signal is greater than the error threshold; If any of the judgments in this step is true, proceed to S13; S13, select the average value of either the LVDT1 signal or the LVDT2 signal and the RCD1 signal as the voting value for the aircraft control surface position.

7. The method for feedback voting on the position of non-similarity triple-redundant aircraft control surfaces according to claim 6, characterized in that, In S11, otherwise the RCD1 signal is suspended as the voting value for the aircraft control surface position.

8. The method for feedback voting on the position of non-similarity triple-redundant aircraft control surfaces according to claim 6, characterized in that, If none of the above conditions are met in S12, the vote is deemed unsuccessful. Among the LVDT1 or LVDT2 signals, and the RDC1 and RDC2 signals, the signal closest to the previous control surface position feedback signal is selected as the vote value for the aircraft control surface position.

9. A method for feedback voting on the position of non-similarity triple-redundant aircraft control surfaces according to claim 6, characterized in that, In S3, otherwise proceed to S13; S13, determine whether all errors are greater than the error threshold; if so, proceed to S14. S14, if the vote fails, select the signal that is closest to the previous control surface position feedback signal from among the LVDT1, LVDT2 and RDC1 signals as the voting value for the aircraft control surface position.

10. A method for feedback voting on the position of non-similarity triple-redundant aircraft control surfaces according to claim 9, characterized in that, If it proceeds to S13, then proceed to S15. S15, Determine whether the error between the LVDT1 signal and the RDC1 signal is greater than the error threshold, and whether the error between the LVDT1 signal and the LVDT2 signal is greater than the error threshold; If any of the judgments in this step is true, the LVDT1 signal is selected as the voting value for the aircraft control surface position; otherwise, the average value of the RDC1 signal and the LVDT2 signal is selected as the voting value for the aircraft control surface position.

Images