A quad tiltrotor drone redundancy architecture

Abstract

The application discloses a quad tiltrotor unmanned aerial vehicle (UAV) redundancy architecture, and relates to the technical field of UAVs. The architecture comprises a flight control system, a sensor system, an electrical system and an actuator system. The flight control system comprises a voting circuit and a plurality of flight control computers. The sensor system comprises a plurality of heterogeneous devices. Each flight control computer determines and votes for an effective data from a plurality of sensor data, and independently outputs a control instruction of each channel according to the effective data. The voting circuit outputs a flight control instruction from the control instructions of multiple channels according to a voting and priority switching mechanism. The electrical system is a dual-redundant high-voltage direct-current power supply system, which provides uninterrupted power supply. The actuator system comprises a plurality of actuators. The flight control system controls the plurality of actuators according to attitude control requirements, adopts a master-master mode and a force balancing algorithm, and drives the rudder surface in parallel through the balanced force of the plurality of actuators. The application can effectively improve the safety and reliability of the UAV.

Description

Technical Field

[0001] This application relates to the field of unmanned aerial vehicle (UAV) technology, and in particular to a redundant architecture for a quad tiltrotor UAV. Background Technology

[0002] With the rapid development of drone technology, quadcopter drones have gained widespread application in both civilian and military fields due to their dual advantages of vertical takeoff and landing and high-speed cruising. However, the complex and ever-changing flight environment of drones places extremely high demands on their safety and reliability.

[0003] Currently, the system architecture of traditional quadcopter drones has many limitations. In terms of flight control systems, most employ a single-redundant or simple backup design. If a single-redundant flight control system fails, such as a damaged flight control computer chip or a software error, the drone will lose effective control, potentially leading to a crash. Simple backup designs suffer from switching delays and difficulties in data synchronization, making it impossible to quickly and accurately take over when the main system fails.

[0004] In terms of electrical and power systems, common designs rely on a single power source or a single motor to drive each rotor. If the power source fails, such as a battery short circuit, generator failure, or a single motor stops working due to overload or mechanical failure, the drone's power supply will be severely affected, or it may even lose power altogether.

[0005] For actuators and actuators, such as control surface actuators that control rotor tilt and flight attitude, many UAVs are equipped with only a single actuator to control each critical control surface. If this actuator fails, such as due to hydraulic leakage or motor jamming, the corresponding control surface cannot be effectively controlled, affecting the UAV's flight attitude adjustment and stability.

[0006] In addition, civilian drones must meet stringent airworthiness requirements, and the probability of catastrophic failure must be less than 10%. -9 / flight hours, a standard that traditional architectures struggle to achieve. As drone applications expand to fields such as logistics, aerial photogrammetry, and agricultural plant protection, the demand for long-duration stable flight and safety assurance for drones is becoming increasingly urgent. The shortcomings of existing technologies severely limit the application of quadcopter drones in complex and demanding scenarios. Summary of the Invention

[0007] The purpose of this application is to provide a redundant architecture for a four-tilt rotor UAV, which can effectively improve the safety and reliability of the UAV.

[0008] To achieve the above objectives, this application provides the following solution: This application provides a redundant architecture for a four-tilt-rotor unmanned aerial vehicle, including: a flight control system, a sensor system, an electrical system, and an actuator system; The flight control system includes a voting circuit and multiple flight control computers; the sensor system includes multiple sets of heterogeneous devices, and the sensor data collected by the multiple sets of heterogeneous devices is simultaneously transmitted to multiple flight control computers; each flight control computer is used to determine and vote on one valid data from the multiple sensor data, and based on the valid data, independently outputs control commands for its own channel using a flight control algorithm. The voting circuit compares the control commands of multiple channels to determine whether a channel has malfunctioned. When all channels are determined to be fault-free, it outputs one of the multiple control commands as a flight control command based on the voting and priority switching mechanism. When a channel is determined to be faulty, the control command of the faulty channel is isolated, and the control command output by the channel with the highest priority is output as the flight control command based on the channel priority. The sensor system includes multiple heterogeneous devices. The sensor data collected by the multiple heterogeneous devices are transmitted to the flight control computer, which is used to determine and vote on one of the multiple sensor data as valid data. The actuator system includes multiple actuators, which are connected to the control surfaces. Each flight control computer outputs its own action commands according to attitude control requirements, using a master-master mode and force balance algorithm. Through voting by the voting circuit, it controls multiple actuators to drive the control surfaces in a balanced and parallel manner. The electrical system is a dual-redundant high-voltage DC power supply system, used to provide uninterrupted power to the flight control system, sensor system and actuator system.

[0009] According to the specific embodiments provided in this application, this application has the following technical effects: This application provides a redundant architecture for a four-tilt-rotor UAV. The flight control system includes multiple flight control computers. Employing a redundant architecture combined with real-time voting and priority switching mechanisms, it can tolerate single-point and even double-point failures, ensuring continuous and correct output of flight control commands and fundamentally avoiding the risk of loss of control due to flight control computer failure. The sensor system, through redundant configuration of multiple heterogeneous devices, ensures the accuracy and availability of critical sensor data. A dual-redundant high-voltage DC power supply system ensures uninterrupted power supply to critical loads even in the event of failure of any single power generation unit, avoiding catastrophic consequences due to power loss. The actuators adopt a master-master mode combined with a force balancing algorithm, providing not only hardware redundancy to prevent control surface failure due to single actuator failure but also improving the control accuracy and response performance of the control surfaces. Therefore, this application, through redundant design, significantly reduces the probability of single-point failure in the entire system, effectively improving the safety and reliability of the UAV. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A schematic diagram of a redundant architecture for a four-tilt-rotor unmanned aerial vehicle provided in an embodiment of this application; Figure 2 A schematic diagram of the triplet voting process of the flight control system provided in this application embodiment; Figure 3 This is a schematic diagram of the height sensor data output provided in an embodiment of this application; Figure 4 This is a schematic diagram of the electrical system architecture provided for an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0013] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0014] To address the shortcomings in safety and reliability of existing quadcopter drones, in one exemplary embodiment, such as Figure 1 As shown, a redundant architecture for a quad tiltrotor unmanned aerial vehicle (UAV) is provided, including: a flight control system ( Figure 1 ①) Sensor system ( Figure 1 (②) Electrical system and actuator system.

[0015] The flight control system includes a voting circuit and multiple flight control computers; the sensor system includes multiple sets of heterogeneous devices, and the sensor data collected by these devices is simultaneously transmitted to multiple flight control computers. Each flight control computer is used to determine and vote on one valid data point from the multiple sensor data points, and based on the valid data, independently outputs control commands for its respective channel using a flight control algorithm. The voting circuit compares the control commands from multiple channels to determine if a channel is faulty. If all channels are determined to be fault-free, one of the multiple control commands is output as a flight control command based on a voting and priority switching mechanism. If a channel is determined to be faulty, the control command of the faulty channel is isolated, and the control command output by the channel with the highest priority is output as the flight control command.

[0016] The actuator system includes multiple actuators, which are connected to the control surfaces. Each flight control computer outputs its own action commands according to attitude control requirements, using a master-master mode and force balance algorithm. Through voting by the voting circuit, it controls multiple actuators to drive the control surfaces in a balanced and parallel manner.

[0017] The electrical system is a dual-redundant high-voltage DC power supply system, used to provide uninterrupted power to the flight control system, sensor system and actuator system.

[0018] By redundancy in the flight control system, sensor system, electrical system, and actuator system, the risk of single point of failure is significantly reduced, and the overall system robustness is improved.

[0019] As an optional implementation, the flight control computer includes a processor, memory, and a communication interface. The memory stores flight control law algorithms, flight state and mode configuration parameters, sensor calibration parameters, fault diagnosis logic, and flight mission data. The memory is fundamental to ensuring the flight control computer can operate independently and reliably. The processor retrieves the flight control law algorithm from the memory and independently calculates control commands based on it; that is, each channel processor independently calculates control commands according to the flight control algorithm. The processor also obtains displacement data fed back from the actuators through the communication interface and controls the actuators using a master-master mode and force balance algorithm based on the feedback displacement data.

[0020] The flight control computer is a hardware module that integrates a processor, memory, and communication interface to perform core tasks such as sensor signal processing, flight control law calculation, and command output.

[0021] As an optional implementation, the flight control system adopts a triple-redundant architecture, containing three independent control channels, each with its own flight control computer. Sensor signals, such as inertial navigation data, are simultaneously input to all three channels. The priority of the three channels is: Channel 1 > Channel 2 > Channel 3. The voting circuit at the output continuously compares the output commands of the three channels and outputs flight control commands according to the corresponding strategy.

[0022] As an optional implementation, the flight control system also includes: a cross-channel data link; the cross-channel data link is set between the channels of multiple flight control computers; each channel periodically sends a heartbeat signal to other channels through the cross-channel data link; if the heartbeat signal of a channel is lost or abnormal, a channel fault is determined. The channels are connected by a high-speed, reliable, and redundantly designed cross-channel data link, which has fault detection and automatic switching functions.

[0023] Channel faults are primarily monitored and assessed by the "cross-channel data link" and "voting circuit / fault management unit" within the flight control system. Channel fault detection is achieved through the following methods: ① Output voting comparison: The voting circuit continuously compares the control commands (such as servo angle and engine speed commands) calculated by the three channels. If the output of a certain channel deviates from the outputs of the other two normal channels for a continuous period of time, the channel is determined to be faulty.

[0024] Therefore, in determining whether a channel has malfunctioned, the voting circuit is used to: continuously compare the control commands of multiple channels within a preset time; if the deviation between the control command of one channel and the control commands of other channels exceeds the preset fault tolerance threshold, then the channel is determined to have malfunctioned; otherwise, the channel is determined to have no malfunction.

[0025] ② Heartbeat / Vitality Signal Monitoring: Each channel periodically sends a "heartbeat" signal to other channels and the central manager via the cross-channel data link. If the heartbeat signal of a channel is lost or abnormal, it is considered a fault.

[0026] ③ Built-in self-test: The flight control computer of each channel will periodically run a hardware and software self-test program (BIT, Built-in Test). If an abnormality is detected in the processor, memory or critical peripheral interface, a fault will be reported.

[0027] When any channel fails, the faulty channel is isolated. Then, based on channel priority, the command output by the higher-priority channel is used as the flight control system's output command. Faulty channel isolation is primarily achieved at the software level of the flight control system; the fault management logic also logically isolates the channel on the data bus. The control flow is as follows: a. The fault detection device (voting circuit / fault manager) determines that a certain channel (e.g., channel 3) has failed.

[0028] b. The fault manager generates a "Channel 3 fault" instruction and sends it to the voting circuit.

[0029] c. After receiving the instruction, the voting circuit blocks all output signals from fault channel 3, preventing them from being transmitted to subsequent actuators or power systems.

[0030] d. At the same time, the cross-channel data link will notify the other normal channels to ignore the data from the faulty channel 3, ensuring that the system continues to work based on the remaining healthy channels (in terms of document priority, channel 1 > channel 2).

[0031] As an optional implementation, if multiple flight control computers include a first flight control computer, a second flight control computer, and a third flight control computer, and the channel priorities of the first, second, and third flight control computers decrease sequentially, then when it is determined that no channel faults have occurred, one of the multiple control commands is output as a flight control command according to the voting and priority switching mechanism. The voting circuit is used for: The control command output by the first flight control computer is defined as the first control command, the control command output by the second flight control computer is defined as the second control command, and the control command output by the third flight control computer is defined as the third control command. If the deviation between the first control command and the second control command is within a preset allowable range, or the deviation between the first control command and the third control command is within a preset allowable range, then the first control command will be output as a flight control command. Otherwise, compare whether the deviation between the second control command and the third control command is within the preset allowable range. If yes, output the second control command as a flight control command; if no, output the first control command as a flight control command.

[0032] Figure 2 The triple redundancy voting process of the flight control system is shown, in which channel 1 (first flight control computer) outputs flight control command A (first control command), channel 2 (second flight control computer) outputs flight control command B (second control command), and channel 3 (third flight control computer) outputs flight control command C (third control command).

[0033] As an optional implementation, the sensor system includes: a primary inertial navigation system, a backup inertial navigation system, an ultrasonic altimeter, a radio altimeter, an atmospheric instrument, and three atmospheric data systems.

[0034] The primary and backup inertial navigation systems (INS) operate on different principles and are supplied by different manufacturers. Both systems measure the motion and attitude of the quadcopter UAV and transmit the data to the flight control computer. When both systems are deemed functioning correctly, the flight control computer uses the motion and attitude data measured by the primary INS as valid data. If either system malfunctions, the flight control computer isolates the faulty system and uses the valid data from the functioning system. In this implementation, the sensor data fusion and management module (software algorithm) within the flight control computer is responsible for determining the primary INS. The software configuration pre-specifies the fiber optic INS as the primary system and the MEMS INS as the backup. The flight control computer continuously receives and verifies data from both systems (e.g., through data validity, jump rate, and consistency with other sensor data). When both are functioning normally, the data management module directly selects and outputs data from the primary inertial navigation system (fiber optic inertial navigation system) to the flight control law calculation module. If a fault is detected in the primary inertial navigation system, the management module will automatically switch to select and output data from the backup inertial navigation system (MEMS inertial navigation system), thereby achieving a seamless data supply to the downstream control module.

[0035] Fault detection is performed by the sensor interface and data processing unit within the flight control computer. There are three fault detection methods: ① Data reasonableness check: Determine if the sensor output value is within the physically possible range (e.g., the altitude value will not be negative and will not exceed the aircraft's limits). ② Data jump rate / gradient check: Detect whether the rate of change of data within adjacent sampling periods exceeds a reasonable threshold, eliminating outliers caused by interference. ③ Redundancy sensor cross-comparison: For similar redundant sensors such as three atmospheric data systems, the flight control computer performs real-time comparisons of their data (e.g., ...). Figure 2 (The voting logic is shown). If the data from a certain sensor deviates significantly from the median values ​​of the other two, the sensor is considered faulty. For heterogeneous sensors (such as two sets of inertial navigation systems), state estimation is performed using a data fusion algorithm (such as a Kalman filter), and the residual between the estimated and measured values ​​is compared to detect the fault.

[0036] The method for isolating a malfunctioning inertial navigation system is as follows: logical isolation is achieved at both the software and data flow levels by the input management module of the flight control computer. The fault management software of the flight control computer generates instructions, and at the data level, the input management module of the flight control computer marks the data channel from the malfunctioning sensor as "invalid" in the software, and ignores its data in subsequent data fusion and processing, using only the data from the remaining normal sensors.

[0037] Three atmospheric data systems are used to measure the aerodynamic parameters of the interaction between the four tiltrotor UAV and the atmosphere, and transmit the data to the flight control computer. The flight control computer sorts the measured aerodynamic parameters in ascending or descending order and selects the median value as valid data. The installation locations of the three atmospheric data systems are carefully designed and verified by airflow simulation to avoid interference. The design goal of the installation locations is to select installation locations for the three atmospheric data probes (such as pitot tubes) to obtain accurate and undisturbed airflow data and avoid mutual aerodynamic interference from the fuselage, rotor vortices, or other probes. The process of determining the installation locations is as follows: Preliminary location selection: Based on the aerodynamic layout, several alternative installation points are initially selected in relatively stable and clean areas such as the nose, wing leading edge, or vertical tail. Redundant layout: The three probes are usually arranged separately, for example, one directly in front of the nose and two symmetrically arranged on both sides of the wing or fuselage, to achieve spatial isolation and redundancy, reducing the risk of local airflow distortion affecting all probes. The signal voting algorithm is implemented in the flight control computer. Taking attitude angle data as an example, the measured pitch angles are sorted and the median value is selected as the valid data. The processing of other sensor data is similar to ensure that the data input to the flight control system is accurate and reliable.

[0038] For example, aerodynamic parameters include: pressure altitude, indicated airspeed / vacuum speed, climb rate (vertical speed), ambient air temperature, angle of attack (angle of attack), and sideslip angle.

[0039] An ultrasonic altimeter is used to measure the first altitude of the quadcopter UAV, a radio altimeter is used to measure the second altitude, and an atmospheric altimeter is used to measure the third altitude. All three altitudes are transmitted to the flight control computer. The flight control computer uses the following methods: if the first altitude is less than the lower limit of the altitude threshold, it considers the first altitude as valid data; if the first altitude is greater than or equal to the lower limit of the altitude threshold and the second altitude is less than the upper limit of the altitude threshold, it considers the second altitude as valid data; and if the first altitude is greater than or equal to the lower limit of the altitude threshold and the second altitude is greater than or equal to the upper limit of the altitude threshold, it considers the third altitude as valid data.

[0040] The drone is equipped with three sets of altitude measurement sensors with different operating principles, and its altitude data output strategy is as follows: Figure 3 As shown. Near the ground, the altitude is output using ultrasonic altimeter data; at low altitudes, it is output using radio altimeter data; and at high altitudes, it is output using atmospheric pressure data.

[0041] As an optional implementation, the electrical system includes: a generator controller, a busbar power control unit, and two high-voltage DC power supply systems consisting of turbine generators and power lithium batteries. During normal flight, the two turbine generators output power, which, after filtering and voltage regulation, is fed into the main power distribution busbar to power various loads, including the photoelectric radar and flight control computer, while simultaneously charging their respective power batteries. When the generator controller detects a turbine generator failure, it controls the power lithium battery corresponding to the failed turbine generator to switch to the main busbar for discharge via the busbar power control unit, achieving uninterrupted power supply and ensuring highly reliable tiered power protection for critical equipment and uninterrupted loads.

[0042] Methods for detecting faults in turbine generators include: Voltage / Frequency Over-Limits: Monitor whether the generator's output voltage and frequency are within the rated operating range. Excessively high / low voltage or abnormal frequency indicates a fault in the generator's regulation system. Abnormal Output Current: Monitor whether the current is consistently too high (overload) or suddenly disappears (open circuit). Reverse Power / Reverse Current Protection: Monitor the power flow direction. If the current is reversed (flowing from the busbar to the generator), it indicates that the generator is unable to supply power, possibly due to a drive interruption (e.g., engine shutdown) or an internal short circuit.

[0043] When a generator failure is detected, the Bus Power Control Unit (BPCU) immediately sends a "shutdown" command to the SSPC of the faulty channel and a "close" command to the Solid-State Power Controller (SSPC) of the backup battery pack. Because the SSPC operates extremely quickly and the battery pack is always in a "hot backup" state ready for grid connection (its voltage has been matched to the bus via DC / DC regulation), battery power can replenish the main busbar within milliseconds, achieving "uninterrupted" or "seamless" switching of load power supply.

[0044] like Figure 4 As shown, the regulating control protector, in an electrical system, typically refers to the Generator Control Unit (GCU) or busbar power control unit. Its core function is to regulate the generator's output voltage and frequency, stabilizing them within a set range; simultaneously, it monitors the generator and busbar status, enabling fault detection and protection (such as overvoltage, undervoltage, overfrequency, and underfrequency protection) as well as grid connection / disconnection logic control of the generator channel. The reverse current protector, typically referring to the reverse current protection function in a diode or solid-state power controller, allows current to flow unidirectionally from the power source (generator, battery) to the busbar, preventing current from flowing back from the normal busbar to the faulty power source when a power source experiences a voltage drop due to a fault. This protects the normal power source and equipment and isolates the fault.

[0045] Figure 4 This diagram shows that neither battery pack supplies power to the main busbar. Battery pack 1 is always connected to the grid, supplying power to the critical equipment busbar and the uninterruptible power supply (UPS). Battery pack 2 is also always connected to the grid, supplying power to the UPS.

[0046] As an optional implementation, when there are two actuators, they are symmetrically mounted on both sides of the control surface and connected to the control surface via a connecting mechanism. The force balancing algorithm is implemented within the flight control computer. This algorithm aims to ensure that the forces applied to the control surface by the two actuators are equal in magnitude and coordinated in direction, avoiding force distortion of the control surface structure due to uneven force output (i.e., "force conflict"), and allowing the other actuator to independently bear the entire load if one actuator fails. The flight control computer sends displacement commands to the two actuators based on attitude control requirements (referring to attitude commands generated by the flight control computer's navigation and guidance layer, such as target pitch and roll angles), while simultaneously receiving feedback from displacement sensors. Based on the force balancing model, it adjusts the control signals to balance the forces applied by the two actuators. The detailed process of the flight control computer adjusting the control signals to balance the forces applied by the two actuators based on displacement sensor feedback and the force balancing model is as follows: 1. Control Structure: Typically, a dual closed-loop structure is adopted, with a displacement loop embedded in a force balance loop. Each actuator has an independent position loop, while the force balance loop spans across the actuators.

[0047] 2. Force Equilibrium Model and Adjustment Process: The core of the model is: force difference ΔF = F1 - F2, where F1 and F2 are the output forces of the two actuators (which can be obtained through motor current or a dedicated force sensor).

[0048] Control objective: To make ΔF approach 0.

[0049] Adjustment signal: The force balance controller (usually a PI controller) calculates a corrected displacement ΔX_cmd based on the force difference ΔF.

[0050] Command correction: This correction amount is added to the original displacement commands of the two actuators with opposite signs. The final command of actuator 1 = the original displacement command - ΔX_cmd K1; The final command of actuator 2 = the original displacement command + ΔX_cmd K2; K1 and K2 are allocation coefficients, which are usually related to the characteristics of the actuator. The simplest one can be set to 0.5.

[0051] Effect: If the force of actuator 1 is greater than that of actuator 2 (ΔF>0), the output ΔX_cmd of the force balance controller will be positive. As a result, the displacement command to actuator 1 will be slightly reduced, while the displacement command to actuator 2 will be slightly increased. This causes actuator 1 to unload part of the load and actuator 2 to increase the load, thereby making the output of the two tend to be balanced.

[0052] Therefore, the flight control computer also has subsequent functions: receiving the output forces of the two actuators; calculating the force difference between the two output forces; determining the corrected displacement amount using a force balance controller based on the force difference; and superimposing the corrected displacement amount with opposite signs onto the original displacement commands of the two actuators to obtain the corrected displacement commands of the two actuators.

[0053] In this implementation, the actuator includes a motor, a reducer, a lead screw and nut mechanism, and a displacement sensor. The motor (typically a brushless DC motor or permanent magnet synchronous motor) is the power source, and its output shaft is directly connected to the input shaft of the reducer. The output shaft of the reducer (typically a planetary gear or harmonic gear) is connected to one end of the lead screw. The lead screw and nut form a helical pair; the nut is restricted from rotation and can only translate along the lead screw axis. The measuring head of the displacement sensor (such as a linear variable differential transformer (LVDT) or a magnetic scale) is connected to the nut (or the actuator output rod rigidly connected to the nut) to measure its linear displacement. The motor provides rotational motion and torque. The reducer reduces the rotational speed and increases the output torque to meet the requirements of the driving load. The lead screw and nut mechanism converts the rotational motion of the motor into the precise linear motion of the nut, thereby driving the control surface deflection. The displacement sensor measures the actual linear displacement of the nut (i.e., the actuator output rod) in real time with high precision and feeds this position signal back to the flight control computer, forming a closed-loop control.

[0054] Figure 1 The electronic speed controller (ESC) is also shown. The ESC is a key component for controlling brushless DC motors or permanent magnet synchronous motors. Its main function is to receive speed control commands (usually PWM signals or CAN bus commands) from the flight control system and convert them into precise three-phase AC power to drive the motor at a specified speed and torque, thereby controlling the rotor's lift.

[0055] The comprehensive redundancy architecture proposed in this application significantly improves the overall safety and mission reliability of a quadcopter UAV by systematically introducing redundancy design into key subsystems such as flight control, sensors, electrical power, and actuators. Beneficial effects include: (1) Extremely high control reliability: The flight control system adopts a triple redundancy architecture combined with real-time voting and priority switching mechanism, which can tolerate single-point or even double-point failures, ensuring the continuous and correct output of flight control commands, and fundamentally avoiding the risk of loss of control due to flight control computer failure.

[0056] (2) Accurate and continuous environmental perception: The sensor system ensures the accuracy and availability of key data such as navigation, atmosphere and altitude through redundant configuration of multiple heterogeneous devices (such as inertial navigation, atmospheric instruments and altimeters with different principles) and intelligent voting / switching strategies, and can still provide reliable input even when some sensors fail.

[0057] (3) Uninterrupted energy supply: The dual-redundant high-voltage DC electrical system realizes seamless backup of the generator and lithium battery pack, ensuring that in the event of failure of any single power generation unit, it can still provide uninterrupted power supply to critical loads such as flight control computer and actuators, avoiding catastrophic consequences caused by power loss.

[0058] (4) Enhanced control surface capability: The actuator adopts a master-master mode and is combined with a force balance algorithm, which not only provides hardware redundancy and avoids the failure of the control surface due to the failure of a single actuator, but also improves the control accuracy and response performance of the control surface.

[0059] (5) Meets stringent airworthiness standards: This integrated redundancy design significantly reduces the probability of single-point failure in the entire system, enabling the probability of catastrophic failure of the UAV to be less than 10%. -9 The stringent civil airworthiness requirements for flight hours have broadened its application scenarios in safety-sensitive fields such as logistics and passenger transport.

[0060] (6) Enhance system robustness and maintainability: Modular and standardized redundant design improves the system’s fault tolerance to internal faults and external interference, while facilitating fault isolation and diagnosis, thus improving the system’s maintainability.

[0061] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0062] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A redundant architecture for a four-tilt-rotor unmanned aerial vehicle, characterized in that, include: Flight control system, sensor system, electrical system, and actuator system; The flight control system includes a voting circuit and multiple flight control computers; the sensor system includes multiple sets of heterogeneous devices, and the sensor data collected by the multiple sets of heterogeneous devices is simultaneously transmitted to multiple flight control computers; each flight control computer is used to determine and vote on one valid data from the multiple sensor data, and based on the valid data, independently outputs control commands for its own channel using a flight control algorithm. The voting circuit compares the control commands of multiple channels to determine whether a channel has malfunctioned. When all channels are determined to be fault-free, it outputs one of the multiple control commands as a flight control command based on the voting and priority switching mechanism. When a channel is determined to be faulty, the control command of the faulty channel is isolated, and the control command output by the channel with the highest priority is output as the flight control command based on the channel priority. The actuator system includes multiple actuators, which are connected to the control surfaces. Each flight control computer outputs its own action commands according to attitude control requirements, using a master-master mode and force balance algorithm. Through voting by the voting circuit, it controls multiple actuators to drive the control surfaces in a balanced and parallel manner. The electrical system is a dual-redundant high-voltage DC power supply system, used to provide uninterrupted power to the flight control system, sensor system and actuator system.

2. The redundant architecture of the four tiltrotor UAV according to claim 1, characterized in that, Flight control computers include: processors, memory, and communication interfaces; The memory is used to store flight control law algorithms, flight status and mode configuration parameters, sensor calibration parameters, fault diagnosis logic, and flight mission data. The processor is used to retrieve the flight control law algorithm from memory and independently calculate control commands based on the flight control law algorithm; it also obtains the displacement data fed back by the actuator through the communication interface, and controls the actuator using master-master mode and force balance algorithm based on the feedback displacement data.

3. The redundant architecture of the four tiltrotor UAV according to claim 1, characterized in that, In determining whether a channel has malfunctioned, the voting circuit is used for: Continuously compare control commands from multiple channels within a preset time period; If the deviation between the control command of one channel and the control commands of other channels exceeds the preset fault tolerance threshold, the channel is determined to be faulty; otherwise, the channel is determined to be fault-free.

4. The redundant architecture of the four tiltrotor UAV according to claim 1, characterized in that, If multiple flight control computers include a first flight control computer, a second flight control computer, and a third flight control computer, with channel priorities decreasing sequentially from first to third flight control computers, then when all channels are determined to be fault-free, one of the multiple control commands is output as a flight control command based on a voting and priority switching mechanism. The voting circuit is used for: The control command output by the first flight control computer is defined as the first control command, the control command output by the second flight control computer is defined as the second control command, and the control command output by the third flight control computer is defined as the third control command. If the deviation between the first control command and the second control command is within a preset allowable range, or the deviation between the first control command and the third control command is within a preset allowable range, then the first control command will be output as a flight control command. Otherwise, compare whether the deviation between the second control command and the third control command is within the preset allowable range. If yes, output the second control command as a flight control command; if no, output the first control command as a flight control command.

5. The redundant architecture of the four tiltrotor UAV according to claim 1, characterized in that, The sensor system includes: a primary inertial navigation system, a backup inertial navigation system, an ultrasonic altimeter, a radio altimeter, an atmospheric analyzer, and three atmospheric data systems; Both the primary and backup inertial navigation systems are used to measure the motion state and attitude of the quad tiltrotor UAV and transmit the data to the flight control computer. When the flight control computer determines that both the primary and backup inertial navigation systems are functioning correctly, it uses the motion state and attitude data measured by the primary inertial navigation system as valid data. When the flight control computer determines that either the primary or backup inertial navigation system has failed, it isolates the failed inertial navigation system and uses the motion state and attitude data measured by the functioning inertial navigation system as valid data. Three atmospheric data systems are used to measure the aerodynamic parameters of the interaction between the four tiltrotor UAV and the atmosphere and transmit them to the flight control computer. The flight control computer is used to sort the measured aerodynamic parameters in ascending or descending order and select the median value as the valid data. An ultrasonic altimeter is used to measure the first altitude of the quadcopter UAV, a radio altimeter is used to measure the second altitude, and an atmospheric altimeter is used to measure the third altitude. All three altitudes are transmitted to the flight control computer. The flight control computer uses the following methods: if the first altitude is less than the lower limit of the altitude threshold, it considers the first altitude as valid data; if the first altitude is greater than or equal to the lower limit of the altitude threshold and the second altitude is less than the upper limit of the altitude threshold, it considers the second altitude as valid data; and if the first altitude is greater than or equal to the lower limit of the altitude threshold and the second altitude is greater than or equal to the upper limit of the altitude threshold, it considers the third altitude as valid data.

6. The redundant architecture of the four tiltrotor UAV according to claim 5, characterized in that, The primary inertial navigation system uses fiber optic inertial navigation, while the backup inertial navigation system uses MEMS inertial navigation.

7. The redundant architecture of the four tiltrotor UAV according to claim 1, characterized in that, The electrical system includes: a generator controller, a busbar power control unit, and two high-voltage DC power supply systems consisting of turbine generators and power lithium batteries; When the four tiltrotor drone is in normal flight, the two turbine generators output power, which is filtered and regulated before being fed into the main power distribution busbar, and simultaneously charges their respective power batteries. When the generator controller detects a fault in the turbine generator, it controls the power lithium battery corresponding to the faulty turbine generator to switch to the main busbar for discharge through the busbar power control unit.

8. The redundant architecture of the four tiltrotor UAV according to claim 1, characterized in that, When there are two actuators, the two actuators are symmetrically mounted on both sides of the control surface. The flight control computer is also used for: It receives the output force from two actuators; Calculate the force difference between the two output forces; Based on the force difference, a force balance controller is used to determine the corrected displacement. The corrected displacement is superimposed on the original displacement commands of the two actuators with opposite signs to obtain the corrected displacement commands of the two actuators.

9. The redundant architecture of the four tiltrotor UAV according to claim 1, characterized in that, The actuator includes: Motor, reducer, lead screw and nut mechanism, and displacement sensor; The motor's output shaft is connected to the reducer's input shaft, and the reducer's output shaft is connected to one end of the lead screw in the lead screw and nut mechanism; the nut push rod in the lead screw and nut mechanism is connected to the rudder surface. The measuring head of the displacement sensor is connected to the nut in the lead screw and nut mechanism. The displacement sensor is used to measure the linear displacement of the lead screw and nut mechanism.

10. The redundant architecture of the four tiltrotor UAV according to claim 1, characterized in that, The flight control system also includes: cross-channel data links; Cross-channel data links are set up between the channels of multiple flight control computers; each channel periodically sends heartbeat signals to other channels through the cross-channel data links; if the heartbeat signal of a channel is lost or abnormal, the channel is determined to be faulty.

Images