A flight control system and method suitable for eVTOL multicopter passenger aircraft

Abstract

The application discloses a flight control system and method suitable for an eVTOL multi-rotor manned aircraft. The system comprises: a main flight control computer for generating self-state score information and a candidate main flight control instruction; a backup flight control computer for determining a target main flight control instruction based on the self-state score information and the candidate main flight control instruction, generating a backup flight control instruction, and comparing the consistency of the target main flight control instruction and the backup flight control instruction; a motor main controller for determining and executing the target main flight control instruction based on the self-state score information and the candidate main flight control instruction, and simultaneously generating and outputting a suppression signal; and a motor backup controller for executing a motor speed control function when no suppression signal is received and a start instruction of the backup flight control computer is received. The application can realize safe flight control of the eVTOL multi-rotor manned aircraft and improve the protection capability against common mode failure.

Description

Technical Field

[0001] This invention relates to the field of flight control system technology, and in particular to a flight control system and method suitable for eVTOL multi-rotor manned aircraft. Background Technology

[0002] With the rapid development of the urban air mobility industry and increasingly stringent airworthiness regulations, the reliability and safety of the flight control system of eVTOL multi-rotor manned aircraft, as a new type of travel tool, have become key factors in determining whether a model can be put into commercial operation.

[0003] Currently, existing eVTOL multirotor flight control systems generally rely on a homogeneous flight control computer and a single type of motor controller to achieve flight control. However, existing flight control systems have weak protection against common-mode failures. When the homogeneous main control computer fails simultaneously due to design flaws or software vulnerabilities, the system will lose all control capabilities. This results in high hardware costs, making it difficult for the overall reliability of the flight control system to meet the safety control requirements of the aircraft. Summary of the Invention

[0004] This invention provides a flight control system and method suitable for eVTOL multi-rotor manned aircraft to achieve safe flight control of eVTOL multi-rotor manned aircraft, greatly improve the protection against common mode failures, reduce hardware costs, and thus improve the overall reliability of the flight control system, which can meet the safety control requirements of the aircraft.

[0005] According to one aspect of the present invention, a flight control system suitable for an eVTOL multi-rotor manned aircraft is provided, characterized in that it comprises: two isomorphic main flight control computers, one heterogeneous backup flight control computer, and N main motor controllers and N backup motor controllers, wherein the main motor controllers and backup motor controllers installed on the same motor correspond one-to-one to form a paired combination, wherein... The main flight control computer is used to generate its own status score information and candidate main flight control commands, and send the self-status score information and candidate main flight control commands to the backup flight control computer and each of the motor main controllers; The backup flight control computer is used to select the highest priority instruction as the target primary flight control instruction based on the self-status score information received from the two primary flight control computers and the candidate primary flight control instructions, and to generate a backup flight control instruction, and to compare the consistency between the target primary flight control instruction and the backup flight control instruction. The main motor controller is used to select the highest priority instruction as the target main flight control instruction based on the self-state score information received from the two main flight control computers and the candidate main flight control instructions, and execute the target main flight control instruction to control the motor rotation. At the same time, it generates and outputs a suppression signal to the motor backup controller paired with it to prevent the motor backup controller from entering the working state. The motor backup controller is used to perform motor speed control function when it does not receive the suppression signal but receives the start command of the backup flight control computer.

[0006] According to another aspect of the present invention, a flight control method suitable for eVTOL multi-rotor manned aircraft is provided, characterized in that it includes: The main flight control computer generates its own status score information and candidate main flight control commands, and sends the self-status score information and candidate main flight control commands to the backup flight control computer and each motor main controller. The backup flight control computer is used to select the highest priority instruction as the target primary flight control instruction based on the self-status score information received from the two primary flight control computers and the candidate primary flight control instructions, and to generate a backup flight control instruction, and to compare the consistency between the target primary flight control instruction and the backup flight control instruction. The main motor controller is used to select the highest priority instruction as the target main flight control instruction based on the self-state score information received from the two main flight control computers and the candidate main flight control instructions, and execute the target main flight control instruction to control the motor rotation. At the same time, it generates and outputs a suppression signal to the paired motor backup controller to prevent the motor backup controller from entering the working state. The motor backup controller is used to perform motor speed control function when the suppression signal is not received and the start command of the backup flight control computer is received.

[0007] This invention relates to a flight control system for eVTOL multi-rotor manned aircraft, characterized by comprising: two isomorphic main flight control computers, one heterogeneous backup flight control computer, and N main motor controllers and N backup motor controllers. The main motor controllers and backup motor controllers mounted on the same motor correspond one-to-one, forming a paired combination. The main flight control computer generates its own status score information and candidate main flight control commands, and sends these to the backup flight control computer and each of the main motor controllers. This avoids control interruptions, and the score information allows downstream devices to dynamically perceive the health status of each flight control computer, providing a basis for intelligent decision-making. The backup flight control computer, based on the received status score information and candidate main flight control commands from the two main flight control computers, selects the highest priority command as the target main flight control command, generates a backup flight control command, and compares the consistency between the target main flight control command and the backup flight control command, thereby proactively detecting hidden failures. The main motor controller is used to select the highest priority instruction as the target main flight control instruction based on its own status score information received from the two main flight control computers and the candidate main flight control instructions. It then executes the target main flight control instruction to control the motor rotation. Simultaneously, it generates and outputs a suppression signal to its paired backup motor controller to prevent the backup controller from entering the working state. This ensures that the backup controller will not malfunction under normal circumstances and avoids control conflicts that may occur when the main and backup controllers drive the motor simultaneously. The backup motor controller is used to perform motor speed control when it receives a start command from the backup flight control computer but not the suppression signal. This greatly reduces the probability of the backup controller being mistakenly started due to a single signal error, improving safety. This invention, through a system architecture consisting of two homogeneous main flight control computers, one heterogeneous backup flight control computer, N main motor controllers, and N backup motor controllers, achieves safe flight control of an eVTOL multi-rotor manned aircraft. It greatly improves the protection against common-mode failures, reduces hardware costs, and thus improves the overall reliability of the flight control system, meeting the safety control requirements of the aircraft.

[0008] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a schematic diagram of the structure of a flight control system for an eVTOL multi-rotor manned aircraft according to Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the main flight control network consisting of two main flight control computers and N motor main controllers according to Embodiment 1 of the present invention; Figure 3 This is an example diagram illustrating the functional principle of the motor main controller according to Embodiment 1 of the present invention; Figure 4 This is an example diagram illustrating the communication relationship between the backup flight control computer and the two main flight control computers according to Embodiment 1 of the present invention. Figure 5 This is a schematic diagram of the internal structure of the backup flight control computer according to Embodiment 1 of the present invention; Figure 6 This is an example diagram of a linear shared bus network constructed by a backup flight control computer and N motor backup controllers according to Embodiment 1 of the present invention. Figure 7 This is an example diagram of a star bus network constructed by a backup flight control computer and N motor backup controllers according to Embodiment 1 of the present invention. Figure 8 This is an example diagram of the internal structure of the motor backup controller according to Embodiment 1 of the present invention; Figure 9 This is a flowchart of a flight control method for an eVTOL multi-rotor manned aircraft provided according to Embodiment 2 of the present invention. Detailed Implementation

[0011] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0012] It should be noted that the terms "first," "second," "target," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0013] Example 1 Figure 1 This invention provides a schematic diagram of a flight control system suitable for an eVTOL multi-rotor manned aircraft, as shown in Embodiment 1. Figure 1 As shown, the system includes: two isomorphic main flight control computers 101, one heterogeneous backup flight control computer 102, and N main motor controllers 103 and N backup motor controllers 104. The main motor controllers and backup motor controllers installed on the same motor correspond one-to-one, forming a paired combination. The main flight control computer 101 is used to generate its own status score information and candidate main flight control commands, and send the self-status score information and candidate main flight control commands to the backup flight control computer and each of the motor main controllers; The backup flight control computer 102 is used to select the highest priority instruction from the candidate primary flight control instructions as the target primary flight control instruction based on the self-status score information received from the two primary flight control computers and the candidate primary flight control instructions, and to generate a backup flight control instruction, and to compare the consistency between the target primary flight control instruction and the backup flight control instruction. The motor main controller 103 is used to select the highest priority instruction as the target main flight control instruction based on the self-state score information received from the two main flight control computers and the candidate main flight control instructions, and execute the target main flight control instruction to control the motor rotation. At the same time, it generates and outputs a suppression signal to the motor backup controller paired with it to prevent the motor backup controller from entering the working state. The motor backup controller 104 is used to perform motor speed control function when it does not receive the suppression signal but receives the start command of the backup flight control computer.

[0014] In this embodiment, two isomorphic main flight control computers 101 ( Figure 1 The main flight control computer (1) and main flight control computer (2) operate independently. Each main flight control computer performs real-time assessment of its own integrity status and generates a self-status score representing its health level. The scoring criteria may include internal self-test results, sensor data validity, and computing resource utilization. At the same time, the main flight control computer generates candidate main flight control commands based on external input: for manned mode, it collects signals from cockpit command sensors such as the pilot's joystick and pedals; for unmanned mode, it automatically generates or receives commands from the ground remote control station based on preset waypoints. The generated self-status score and candidate main flight control commands are sent to the backup flight control computer and each of the motor main controllers, which can avoid control interruption. The score information enables downstream equipment to dynamically perceive the health status of each flight control computer, providing a basis for intelligent decision-making. The self-status score information refers to the health score generated in real time by the primary flight control computer based on its own integrity status (such as self-test results, sensor data validity, computing resource status, etc.). This score is used by downstream devices (motor main controller, backup flight control computer) to determine which primary flight control computer's (primary flight controller) commands have higher priority, thereby achieving dynamic optimization. The candidate primary flight control command refers to the motor speed control target value calculated by the primary flight control computer based on external inputs (such as cockpit commands, automatic flight paths, remote control commands). The backup flight control computer can be a flight control computer heterogeneous with the primary flight controller. The motor main controller can be a controller corresponding one-to-one with each motor, used to control motor rotation.

[0015] The backup flight control computer 102 is used to select the highest priority instruction from the candidate primary flight control instructions based on its own status score information received from the two primary flight control computers and the candidate primary flight control instructions, according to a predefined priority rule (e.g., higher score, higher priority). It also generates a backup flight control instruction based on external inputs (e.g., cockpit instructions, remote control instructions), and compares the consistency between the target primary flight control instruction and the backup flight control instruction to proactively detect hidden failures. The target primary flight control instruction can be the highest priority instruction among the two candidate primary flight control instructions, which is the final motor speed control target to be executed. The backup flight control instruction can be a backup motor speed instruction generated by the instruction generation module inside the backup flight control computer, which is only selected for execution when all primary flight control instructions fail, and is normally used for consistency comparison with the primary instruction to expose hidden failures.

[0016] The motor main controller 103 (may refer to...) Figure 1The system comprises one of the main motor controllers (1-N) that, based on its own status score information received from the two main flight control computers and the candidate main flight control commands, selects the highest priority command from the candidate main flight control commands as the target main flight control command according to a predefined priority rule (e.g., higher score, higher priority). It then executes the target main flight control command to control the motor rotation. Simultaneously, it generates and outputs a suppression signal to its paired backup motor controller to prevent the backup motor controller from entering the working state. This ensures that the backup motor controller will not malfunction under normal circumstances and avoids control conflicts that may arise from the main and backup controllers simultaneously driving the motor. The suppression signal can be a signal used to prevent the backup motor controller from entering the working state, thus preventing conflicts caused by the main and backup controllers simultaneously driving the motor.

[0017] The motor backup controller 104 is used to perform motor speed control function when it does not receive the suppression signal but receives the start command of the backup flight control computer, which greatly reduces the probability of the backup controller being started by mistake due to a single signal error and improves safety.

[0018] Optionally, the two main flight control computers 101 are of the same functional configuration and are interchangeable; both main flight control computers include an execution command calculation module and an execution command monitoring module, and the main flight control computer can only output a valid main flight control command when the outputs of the execution command calculation module and the execution command monitoring module are consistent.

[0019] Specifically, the two main flight control computers 101 employ the same design (i.e., identical hardware and software), possessing physical and functional interchangeability. The main flight control computer uses a command-monitor architecture; the command calculation module (command branch) and the command monitoring module (monitoring branch) are different in both software and hardware, and only output valid commands when the commands from the command branch and the monitoring branch are consistent. Through a cross-validation mechanism between the command branch and the monitoring branch, it is ensured that any calculation error, hardware failure, or software malfunction in any single module will not result in the output of erroneous commands, guaranteeing flight control safety. The main functions of the main flight control computer are: to collect pilot control commands and generate flight control commands, or generate automatic flight control commands according to preset paths, or receive commands from the ground remote control station, ultimately forming the speed commands for each motor, i.e., the candidate main flight control commands; to vote on and monitor the cockpit command sensor signals or remote control station command signals input to the main flight control computer; and to generate alarm information related to the flight control system as required.

[0020] For example, during operation, both modules of the primary flight control computer simultaneously receive the same input signals (such as pilot stick displacement, automatic flight path parameters, or ground remote control commands). The command calculation module calculates the expected motor speed command based on the control algorithm; the monitoring module independently calculates the same command using its own algorithm. The calculation results of the two modules are cross-compared before output. Only when the outputs of the two modules are completely consistent will the primary flight control computer allow the command to be sent to the downstream motor main controller and the backup flight control computer. If the results are inconsistent, the primary flight control computer determines that it has a fault, immediately blocks command output, and reports the fault status to the system.

[0021] Optionally, the main flight control computer 101 is specifically used for: scoring its own integrity status and generating its own status score information; generating candidate main flight control commands based on at least one of the collected pilot control commands, preset automatic flight paths, or received ground remote control commands; and sending the own status score information and the candidate main flight control commands to each of the motor main controllers and the backup flight control computer.

[0022] Specifically, each main flight control computer 101 can continuously run a self-test program to monitor the health status of key components such as the processor, memory, bus interface, and sensor inputs in real time, and generate a quantitative score, i.e., its own status score information, based on preset scoring rules (such as the number of faults, signal quality, and calculation latency). Simultaneously, the main flight control computer collects three types of input sources: pilot control commands (such as those collected by stick displacement sensors), preset automatic flight paths (such as those from a navigation database), or ground remote control commands (such as received remote control signals). It can select at least one of these as a basis, calculate, and generate candidate main flight control commands. The self-status score information and the candidate main flight control commands are sent to each of the motor main controllers and the backup flight control computer, enabling downstream devices to select the healthiest main flight control command to execute in real time.

[0023] Optionally, the backup flight control computer 102 includes: an instruction generation module, an instruction selection module, and a status monitoring module. The instruction generation module generates backup control instructions and sends them to the instruction selection module. The instruction selection module determines a target primary flight control instruction based on the received self-status score information and the candidate primary flight control instructions, and performs consistency verification between the backup control instructions and the target primary flight control instructions. The status monitoring module starts the motor backup controller, monitors its status, and forcibly shuts down any abnormal motor backup controllers.

[0024] Specifically, the backup flight control computer 102 adopts a single-branch design without a command monitoring branch. Internally, it consists of three main functional modules: a backup flight control command generation module, a command selection module, and a status monitoring module (motor backup controller status monitoring module). Each module functions independently. The command generation module generates backup control commands. For manned aircraft, it can generate manned commands based on cockpit command sensor signals; for unmanned aircraft, it can receive remote control commands. The command selection module receives the self-status score information and candidate main flight control commands from the two main flight control computers. It selects the command with the highest priority as the target main flight control command based on the score, and simultaneously compares the backup control command with the target main flight control command for consistency, returning the comparison result to the main flight control computer. The status monitoring module is used to start the motor backup controller, monitor its status, and forcibly shut down any abnormal motor backup controllers. It should be noted that the status monitoring module also returns motor speed and other status information to the main flight control computer via a bus interface.

[0025] It should be noted that the command selection module is used to select commands from those of the backup flight control command generation module and the two main flight control computers, and outputs the selected command to the motor backup controller. The command selection can be implemented according to a fixed priority order, for example: main flight control computer A > main flight control computer B > backup flight control command generation module. The priority order of main flight control computers A and B can be dynamically adjusted based on their own status scores. The backup flight control computers are connected to N motor backup controllers. After the command selection module selects the command with the highest priority, it can use this command as the final speed control command and issue it to all motor backup controllers. When a motor backup controller receives a start command and is not suppressed by the main controller, it will execute this command to control the motor rotation.

[0026] Optionally, the motor main controller 103 includes an execution control module and an execution monitoring module. The execution control module is used to determine a target main flight control command based on the received self-state score information and the candidate main flight control command, execute the target main flight control command to control the motor rotation, and generate a suppression signal, which is then sent to the motor backup controller corresponding to the motor main controller. The execution monitoring module is used to monitor the motor speed and shut down the motor when the actual motor speed is inconsistent with the expected speed and exceeds the monitoring threshold.

[0027] Specifically, the N motor main controllers 103 adopt the same design and are interchangeable. The motor main controllers use an instruction-monitoring architecture, with the execution control module and the execution monitoring module employing dissimilar designs. The execution control module receives its own status score information from the two main flight control computers and the candidate main flight control instructions. Based on the score, it selects the instruction with the highest priority as the target main flight control instruction and executes it to drive the motor to rotate. Simultaneously, it continuously sends suppression signals to the matching motor backup controller to prevent it from intervening in motor control, and returns the working status information of the motor and the motor main controller to the main flight control computer. The execution monitoring module independently receives instructions from the two main flight control computers and similarly selects the instruction with the highest priority as the expected speed reference, monitors the motor speed, and shuts down the motor when the actual motor speed differs from the expected speed and exceeds the monitoring threshold.

[0028] It should be noted that the suppression signal can be sent in real time to the corresponding motor backup controller when the main motor controller is operating normally. The instruction module and monitoring module can each be connected to a set of motor speed measurement sensors and their analysis circuits.

[0029] Optionally, the motor backup controller 104 includes: a suppression signal receiving module, a motor control module, and an information feedback module. The suppression signal receiving module receives the suppression signal to suppress the motor backup controller from entering the working state. The motor control module performs motor speed control when it simultaneously receives a start command from the backup flight control computer and a non-suppression signal from the corresponding motor main controller. The information feedback module returns the motor speed signal to the backup flight control computer in real time.

[0030] Specifically, the suppression signal receiving module continuously monitors suppression signals from the matching motor main controller. When a suppression signal is received, it locks the motor control module, preventing it from entering the working state. When the suppression signal disappears, it unlocks and outputs a non-suppressed state to the motor control module. The motor control module simultaneously monitors whether it receives a non-suppressed state from the suppression signal receiving module and whether it receives a start command from the backup flight control computer. Only when both conditions are met will the motor control module begin to execute the speed command of the backup flight control and drive the motor to rotate. The information feedback module collects signals from the motor speed sensor connected to the machine and other motor operating status signals in real time, regardless of whether the motor control module is performing control functions, and continuously sends them back to the backup flight control computer. This greatly reduces the probability of accidentally starting the backup controller due to a single signal error and improves safety.

[0031] It should be noted that the N backup motor controllers employ the same design and are interchangeable. Each backup motor controller uses a single-branch design, possessing only control and information feedback functions. The backup motor controller can only execute motor speed control when it simultaneously receives a start command from the backup flight control computer and a non-suppression signal from the corresponding main motor controller. Regardless of whether the backup motor controller executes motor speed control, it continuously returns the motor speed signal to the backup flight control computer in real time.

[0032] Optionally, two main flight control computers and N motor main controllers form a ring communication network with MIL-1394B bus as the transmission medium. When a disconnection occurs, the ring communication network is converted into a bus topology network.

[0033] Optionally, the backup flight control computer and the N backup motor controllers can be configured into a linear shared bus network, a star bus network, or other network types.

[0034] Optionally, the two primary flight control computers and the backup flight control computer are interconnected via a point-to-point bus.

[0035] Optionally, in the flight control system of the eVTOL multi-rotor manned aircraft in this embodiment, all devices operate asynchronously and no synchronous clock is set.

[0036] Optionally, the system employs communication verification between the main flight control computer and the main motor controller to prevent tampering during signal transmission.

[0037] Optionally, the instruction selection module of the backup flight control computer compares the consistency between the high-priority instructions of the primary flight control computer and the instructions of the backup flight control computer in real time, and returns the comparison result to the primary flight control computer.

[0038] Optionally, the motor speed signal collected by the motor backup controller is fed back to the main flight control computer in real time. The main flight control computer compares the speed signal with the motor speed signal provided by the main motor controller to prevent the motor backup controller and its associated speed sensor from experiencing hidden failures.

[0039] Optionally, when the instructions from the primary flight control computer in the system are transmitted to the backup motor controller via the backup flight control computer, communication verification is used to prevent tampering during signal transmission.

[0040] Optionally, the primary flight control computer and the backup flight control computer adopt a dissimilar architecture design.

[0041] This invention relates to a flight control system for eVTOL multi-rotor manned aircraft, characterized by comprising: two isomorphic main flight control computers, one heterogeneous backup flight control computer, and N main motor controllers and N backup motor controllers. The main motor controllers and backup motor controllers mounted on the same motor correspond one-to-one, forming a paired combination. The main flight control computer generates its own status score information and candidate main flight control commands, and sends these to the backup flight control computer and each of the main motor controllers. This avoids control interruptions, and the score information allows downstream devices to dynamically perceive the health status of each flight control computer, providing a basis for intelligent decision-making. The backup flight control computer, based on the received status score information and candidate main flight control commands from the two main flight control computers, selects the highest priority command as the target main flight control command, generates a backup flight control command, and compares the consistency between the target main flight control command and the backup flight control command, thereby proactively detecting hidden failures. The main motor controller is used to select the highest priority instruction as the target main flight control instruction based on its own status score information received from the two main flight control computers and the candidate main flight control instructions. It then executes the target main flight control instruction to control the motor rotation. Simultaneously, it generates and outputs a suppression signal to its paired backup motor controller to prevent the backup controller from entering the working state. This ensures that the backup controller will not malfunction under normal circumstances and avoids control conflicts that may occur when the main and backup controllers drive the motor simultaneously. The backup motor controller is used to perform motor speed control when it receives a start command from the backup flight control computer but not the suppression signal. This greatly reduces the probability of the backup controller being mistakenly started due to a single signal error, improving safety. This invention, through a system architecture consisting of two homogeneous main flight control computers, one heterogeneous backup flight control computer, N main motor controllers, and N backup motor controllers, achieves safe flight control of an eVTOL multi-rotor manned aircraft. It greatly improves the protection against common-mode failures, reduces hardware costs, and thus improves the overall reliability of the flight control system, meeting the safety control requirements of the aircraft.

[0042] For example, the schematic diagram of the main flight control network consisting of two main flight control computers and N motor main controllers in this embodiment can be as follows: Figure 2As shown. The network is a ring bus network constructed using the MIL-1394B bus; the main flight control computer (1) is the main CC node (controller node) of the MIL-1394B network, used for bus management and communication scheduling; the main flight control computer (2) is the backup CC node of the ring network. The instruction output function of the main flight control computer and the control function of the CC node are independent of each other; the loss of instruction function does not affect the function and priority of the CC node. The priority of the main flight control computer (1) and the main flight control computer (2) does not affect the definition of the priority of the CC node; that is, if the score of the main flight control computer (2) is prioritized, the N motor main controllers execute the instructions of the main flight control computer (2), which does not affect the main flight control computer (1) still executing the main CC node function of the ring bus network. The failure of any device on the ring bus network does not affect the normal communication function of the ring network. When the communication bus of the ring network is disconnected once, it will be transformed into a bus topology network, and the devices on the network can continue to communicate with each other.

[0043] When the main flight control computer (1) and main flight control computer (2) are functioning normally, they transmit their respective instructions and integrity scores to the main motor controllers in the network via a ring bus network. The instruction branches of each main motor controller verify whether the instructions received from the two main flight control computers have been tampered with through the network communication verification function. At the same time, they return the verification codes of the instructions from the two main flight control computers to the two main flight control computers, which then check whether the instructions received by each main motor controller are normal. The instruction branches and monitoring branches of each main motor controller receive the instructions from the main flight control computer (1) and main flight control computer (2) respectively, and independently select the higher priority instruction based on the scores of the main flight control computer (1) and main flight control computer (2) to carry out motor speed control and monitor the working status of the instruction branches.

[0044] When a motor main controller loses signal interaction with both the main flight control computer (1) and the main flight control computer (2), or when a motor main controller reports its own fault to the main flight control computer (1) and the main flight control computer (2), the main flight control computer (1) and the main flight control computer (2) will send an instruction to the backup flight control computer to start the motor backup controller that is matched with the failed motor main controller.

[0045] An example of the functional schematic diagram of the motor main controller can be found as follows: Figure 3As shown. The motor main controller adopts an instruction-monitoring architecture; the instruction branch and the monitoring branch have different functions; the instruction branch obtains instructions from the main flight control computer (1) and the main flight control computer (2) through the communication interface module, and selects the instruction with higher priority to control the motor speed; the monitoring branch obtains instructions from the main flight control computer (1) and the main flight control computer (2) through the communication interface module, and selects the instruction with higher priority to monitor the motor speed. The instruction branch and the monitoring branch each receive one independent motor speed signal to avoid common-mode effects caused by abnormal speed sensors. The monitoring branch uses a motion model to monitor the motor speed. The monitoring branch has a built-in motor model to simulate the speed change after receiving the speed command, and compares it with the speed signal fed back by the motor speed sensor (2); if the speed output by the model is inconsistent with the speed fed back by the motor speed sensor (2) and exceeds the amplitude threshold and the duration reaches the time threshold, the monitoring branch will cut off the speed control command output of the instruction branch.

[0046] When the main motor controller command branch can normally receive commands from the main flight control computer (1) or the main flight control computer (2), and the command branch can normally control the motor, the main motor controller command branch sends a suppression signal to the motor backup controller that cooperates with it, and does not allow the motor backup controller to switch to the working state.

[0047] When the monitoring branch of the motor main controller determines that the motor main controller command branch is in normal working condition, the monitoring branch of the motor main controller returns a suppression signal to the main flight control computer (1) and the motor main flight control computer (2) to suppress the motor backup controller that cooperates with it.

[0048] An example of the communication relationship between the backup flight control computer and the two primary flight control computers can be shown as follows: Figure 4 As shown, the backup flight control computer communicates bidirectionally with the two primary flight control computers via a physically independent point-to-point bus. The two primary flight control computers send their respective integrity scores and motor control commands to the backup flight control computer. The backup flight control computer returns its status, the status of the backup motor controller, and signals such as the motor speed measured by the backup motor controller to the two primary flight control computers. The communication signals between the backup flight control computer and the two primary flight control computers employ a communication verification function to prevent tampering.

[0049] A schematic diagram of the internal structure of the backup flight control computer can be seen as follows: Figure 5As shown. The backup flight control computer adopts a single-branch design and does not have a monitoring branch. It is internally divided into three main functional modules: instruction generation module, instruction selection module, and status monitoring module (motor backup controller status monitoring module). Each module has independent functions. The instruction generation module is used to generate backup control instructions. The instruction selection module is used to select instructions from the instructions of the backup flight control instruction generation module and the instructions of the two main flight control computers, and outputs the selected instructions. The status monitoring module is used to start the motor backup controller, monitor the status of the motor backup controller, and forcibly shut down the abnormal motor backup controller. According to the instruction priority definition, when the main flight control computer (1) or the main flight control computer (2) is working normally, the instructions of the backup flight control computer will not be selected; however, the instructions of the backup flight control computer are compared with the instructions with higher priority in the main flight control computer (1) and the main flight control computer (2) in the instruction selection module. If the instruction difference exceeds the monitoring threshold, the instruction selection module will report the backup flight control computer instruction calculation abnormality to the maintenance personnel to prevent the backup flight control computer instruction generation module from having a hidden failure. When the instruction selection module of the backup flight control computer cannot obtain valid signals from the main flight control computer (1) and the main flight control computer (2), the instruction selection module outputs the instruction from the backup flight control instruction module and sends an instruction to the motor backup controller status monitoring module to start the control functions of all motor backup controllers. After receiving the instruction to start the motor backup controller and the corresponding unsuppressed signal from the paired main motor controller, the motor backup controller status monitoring module will start the control function of the motor backup controller and start monitoring of the motor backup controller and the motor.

[0050] In addition to the case where the command selection module outputs the control function of all motor backup controllers, the status monitoring module will also start the control function of certain designated motor backup controllers according to the instructions of the main flight control computer, and start monitoring work on the motor backup controller and the motor.

[0051] Regardless of whether the motor control function of the backup motor controller is activated, the backup motor controller status monitoring module continuously feeds back the motor speed from the backup motor controller to the main flight control computer. The main flight control computer compares the three speed signals of a single motor, which are derived from the command branch, monitoring branch, and backup motor controller of the main motor controller. If it detects that the speed signal fed back by the backup motor controller is inconsistent with both speed signals provided by the main motor controller, it will report the backup motor controller malfunction to maintenance personnel to prevent concealed failures and will feed back the malfunction to the backup flight control computer's backup motor controller status monitoring module. The backup motor controller will not be activated until the fault is resolved.

[0052] The signal interaction between the backup flight control computer and the N backup motor controllers can take various forms, such as a linear shared bus network, a star bus network, or a ring bus network; the goal is to achieve the signal interaction function between the backup flight control computer and the N backup motor controllers. An example of a linear shared bus network constructed by the backup flight control computer and the N backup motor controllers is as follows: Figure 6 As shown, an example of a star bus network consisting of a backup flight control computer and N backup motor controllers can be illustrated as follows: Figure 7 As shown.

[0053] The internal structure diagram of the motor backup controller can be seen as follows: Figure 8 As shown. The motor backup controller adopts a single-branch design; the motor backup controller returns the motor speed signal to the backup flight control computer in real time, and then the backup flight control computer returns it to the two main flight control computers. The main flight control computers compare the speed signal with that of the main motor controller to monitor whether the motor speed sensor and its conversion circuit and signal transmission circuit used by the motor backup controller are normal, in order to prevent the motor backup controller from experiencing hidden failures. To prevent the motor backup controller from starting incorrectly, the motor backup controller requires two independent start signals to allow the control function of the motor backup controller to start. When the motor backup controller status monitoring module of the backup flight control computer detects an abnormality in the control function of the motor backup controller in operation, it will shut down the motor backup controller again. The motor backup controller is equipped with a communication verification function to check whether the instructions from the backup flight control computer or the main flight control computer have been tampered with; it will not incorrectly use tampered instructions.

[0054] It should be noted that, Figure 8 The motor backup controller instruction branch is not a standalone FPGA processing chip, but a combined circuit with processing, output, and input peripheral circuits, which together constitute the suppression signal receiving module, motor control module, and information feedback module. The suppression signal does not enter the processing chip; it only performs a chip cutoff operation outside the processing chip.

[0055] For example, a complete functional description of the above flight control system can be given as follows: Scenario 1: When all devices of the flight control system are working normally, the instructions of the main flight control computer (1) take precedence over those of the main flight control computer (2). The N motor main controllers work according to the instructions of the main flight control computer (1). The instruction branches and monitoring branches of the N motor main controllers send suppression signals to their respective paired motor backup controllers to prevent the motor backup controllers from entering the working state. The instructions of the main flight control computer (1) and the main flight control computer (2) are transmitted to the instruction selection module of the backup flight control computer. According to the priority definition, the instruction selection module selects the instructions of the main flight control computer (1) and compares them with the instructions of the instruction generation module of the backup flight control computer to monitor whether the instruction generation module of the backup flight control computer is normal. The N motor backup controllers return the motor speed signals they measure to the two main flight control computers through the backup flight control computers. The two main flight control computers monitor the speed sensor, speed measurement function and signal return function of the motor backup controllers.

[0056] Scenario 2: If an anomaly occurs in the command branch of any of the main flight control computers in the flight control electronic system, the monitoring branch of that computer will cut off command output, limiting the impact of the failure to that computer and preventing it from affecting the operation of other devices in the flight control electronic system. The flight control electronic system will continue to operate using commands from the remaining main flight control computer.

[0057] Scenario 3: When an anomaly occurs in the command branch of any motor main controller in the flight control electronic system, the monitoring branch of that motor main controller will cut off the motor control function of that main controller; simultaneously, it will stop suppressing the corresponding motor backup controller through the discrete signal of the command branch and the bus signal of the monitoring branch. The backup flight control computer will issue a speed control command to the corresponding motor backup controller and perform corresponding monitoring functions.

[0058] Scenario 4: When both main flight control computers in the flight control electronic system fail, the command branches of the N main motor controllers stop suppressing the N backup motor controllers. At the same time, the backup flight control computer also stops suppressing the N backup motor controllers and sends control commands from the backup flight control computer to the N main motor controllers.

[0059] Scenario 5: When the communication network consisting of the two main flight control computers and N motor main controllers of the flight control electronic system experiences a communication line disconnection, the ring network is converted into a bus topology network, and the main flight control computers and motor main controllers can work normally as in Scenario 1.

[0060] Scenario 6: The backup flight control computer in the flight control electronic system is in an abnormal state, which can be identified and reported by the primary flight control computer. A single failure of the backup flight control computer does not affect the normal operation of the primary flight control computer or the main motor controller.

[0061] Scenario 7: The status of the motor backup controller in the flight control electronic system is abnormal, which can be identified and reported by the main flight control computer. A single failure of the motor backup controller or multiple failures caused by common-mode factors do not affect the normal operation of the main flight control computer and the main motor controller.

[0062] Example 2 This embodiment, based on the flight control system for eVTOL multirotor manned aircraft provided in the above embodiments, provides a flight control method for eVTOL multirotor manned aircraft. Figure 9 This is a flowchart illustrating a flight control method for an eVTOL multi-rotor manned aircraft provided by an embodiment of the present invention, as shown below. Figure 9 As shown, the method includes the following steps: S210: The main flight control computer generates its own status score information and candidate main flight control commands, and sends the self-status score information and candidate main flight control commands to the backup flight control computer and the main controllers of each motor.

[0063] Specifically, each primary flight control computer performs real-time assessments of its own integrity status, generating a self-status score representing its health level. The score can be based on internal self-check results, sensor data validity, and computing resource utilization. Simultaneously, the primary flight control computer generates candidate primary flight control commands based on external input: for manned mode, it collects signals from cockpit command sensors such as the pilot's joystick and pedals; for unmanned mode, it automatically generates or receives commands from the ground remote control station based on preset waypoints. The generated self-status score and candidate primary flight control commands are sent to backup flight control computers and each motor's main controller, preventing control interruptions. The score information allows downstream equipment to dynamically perceive the health status of each flight control computer, providing a basis for intelligent decision-making.

[0064] S220: Using a backup flight control computer, based on the self-status score information received from the two primary flight control computers and the candidate primary flight control commands, select the highest priority command as the target primary flight control command, generate a backup flight control command, and compare the consistency between the target primary flight control command and the backup flight control command.

[0065] Specifically, through the backup flight control computer, based on the self-status score information received from the two primary flight control computers and the candidate primary flight control commands, the highest priority command is selected as the target primary flight control command according to predefined priority rules (e.g., higher score, higher priority). A backup flight control command is generated based on external inputs (e.g., cockpit commands, remote control commands). The consistency between the target primary flight control command and the backup flight control command is compared, thereby proactively detecting concealed failures. The target primary flight control command can be the highest priority command among the two candidate primary flight control commands, which is the final target for motor speed control. The backup flight control command can be a spare motor speed command generated by the command generation module inside the backup flight control computer. It is only selected for execution when all primary flight control commands fail, and is normally used for consistency comparison with the primary command to expose concealed failures.

[0066] S230, via the main motor controller, based on the self-status score information received from the two main flight control computers and the candidate main flight control commands, selects the highest priority command as the target main flight control command from the candidate main flight control commands, executes the target main flight control command to control the motor rotation, and at the same time generates and outputs a suppression signal to the paired motor backup controller to prevent the motor backup controller from entering the working state.

[0067] Specifically, the main motor controller, based on its own status score information received from the two main flight control computers and the candidate main flight control commands, selects the highest priority command from the candidate main flight control commands according to a predefined priority rule (e.g., higher score, higher priority) as the target main flight control command and executes it to control the motor rotation. Simultaneously, it generates and outputs a suppression signal to its paired backup motor controller to prevent the backup controller from entering the operating state. This ensures that the backup motor controller will not malfunction under normal circumstances and avoids control conflicts that may arise from the main and backup controllers simultaneously driving the motor. The suppression signal refers to a signal used to prevent the backup motor controller from entering the operating state, thus preventing conflicts caused by the main and backup controllers simultaneously driving the motor.

[0068] S240, via the motor backup controller, is used to perform motor speed control function when no suppression signal is received and a start command is received from the backup flight control computer.

[0069] Specifically, the motor backup controller executes motor speed control when it receives a start command from the backup flight control computer but does not receive a suppression signal, greatly reducing the probability of the backup controller being accidentally started due to a single signal error and improving safety.

[0070] The technical solution of this embodiment generates its own status score information and candidate main flight control commands through the main flight control computer, and sends the self-status score information and candidate main flight control commands to the backup flight control computer and each motor main controller. This avoids control interruption. The score information enables downstream devices to dynamically perceive the health status of each flight control computer, providing a basis for intelligent decision-making. Through the backup flight control computer, based on the self-status score information and candidate main flight control commands received from the two main flight control computers, the highest priority command is selected as the target main flight control command from the candidate main flight control commands, and a backup flight control command is generated. The consistency between the target main flight control command and the backup flight control command is compared, thereby enabling proactive detection of hidden failures. The main motor controller, based on its own status score information and candidate main flight control commands received from two main flight control computers, selects the highest priority command as the target main flight control command and executes it to control motor rotation. Simultaneously, it generates and outputs a suppression signal to its paired backup motor controller to prevent the backup controller from entering operating mode. This ensures that the backup controller will not malfunction under normal circumstances, avoiding control conflicts that may arise from the main and backup controllers simultaneously driving the motors. The backup motor controller, when not receiving a suppression signal but receiving a start command from the backup flight control computer, executes motor speed control, significantly reducing the probability of erroneous backup controller activation due to a single signal error, thus improving safety. This invention, through a system architecture consisting of two homogeneous main flight control computers, one heterogeneous backup flight control computer, N main motor controllers, and N backup motor controllers, achieves safe flight control of an eVTOL multi-rotor manned aircraft, greatly improving protection against common-mode failures, reducing hardware costs, and thereby enhancing the overall reliability of the flight control system, meeting the safety control requirements of the aircraft.

[0071] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A flight control system suitable for eVTOL multi-rotor manned aircraft, characterized in that, include: Two isomorphic main flight control computers and one heterogeneous backup flight control computer are equipped with N main motor controllers and N backup motor controllers. The main motor controllers and backup motor controllers installed on the same motor correspond one-to-one, forming a paired combination. The main flight control computer is used to generate its own status score information and candidate main flight control commands, and send the self-status score information and candidate main flight control commands to the backup flight control computer and each of the motor main controllers; The backup flight control computer is used to select the highest priority instruction as the target primary flight control instruction based on the self-status score information received from the two primary flight control computers and the candidate primary flight control instructions, and to generate a backup flight control instruction, and to compare the consistency between the target primary flight control instruction and the backup flight control instruction. The main motor controller is used to select the highest priority instruction as the target main flight control instruction based on the self-state score information received from the two main flight control computers and the candidate main flight control instructions, and execute the target main flight control instruction to control the motor rotation. At the same time, it generates and outputs a suppression signal to the motor backup controller paired with it to prevent the motor backup controller from entering the working state. The motor backup controller is used to perform motor speed control function when it does not receive the suppression signal but receives the start command of the backup flight control computer.

2. The system according to claim 1, characterized in that, The two main flight control computers are of the same functional configuration and are interchangeable. Each main flight control computer includes an execution command calculation module and an execution command monitoring module. The main flight control computer can only output a valid main flight control command when the outputs of the execution command calculation module and the execution command monitoring module are consistent.

3. The system according to claim 1, characterized in that, The main flight control computer is specifically used for: scoring its own integrity status and generating its own status score information; generating candidate main flight control commands based on at least one of the collected pilot control commands, preset automatic flight paths, or received ground remote control commands; and sending the self-status score information and the candidate main flight control commands to each of the motor main controllers and the backup flight control computer.

4. The system according to claim 1, characterized in that, The backup flight control computer includes: an instruction generation module, an instruction selection module, and a status monitoring module, wherein, The instruction generation module is used to generate backup control instructions and send the backup control instructions to the instruction selection module; The instruction selection module is used to determine the target primary flight control instruction based on the received self-state score information and the candidate primary flight control instruction, and to perform consistency verification between the backup control instruction and the target primary flight control instruction. The status monitoring module is used to start the motor backup controller, monitor the status of the motor backup controller, and forcibly shut down any abnormal motor backup controllers.

5. The system according to claim 1, characterized in that, The motor main controller includes: an execution control module and an execution monitoring module, wherein, The execution control module is used to determine the target primary flight control command based on the received self-state score information and the candidate primary flight control command, execute the target primary flight control command to control the motor rotation, generate a suppression signal, and send the suppression signal to the motor backup controller corresponding to the motor primary controller. The execution monitoring module is used to monitor the speed of the motor and shut down the motor when the actual speed of the motor is inconsistent with the expected speed and exceeds the monitoring threshold.

6. The system according to claim 1, characterized in that, The motor backup controller includes: a suppression signal receiving module, a motor control module, and an information feedback module, wherein, The suppression signal receiving module is used to receive the suppression signal to suppress the motor backup controller from entering the working state; The motor control module is used to perform motor speed control function when it simultaneously receives the start command from the backup flight control computer and the non-suppression signal from the corresponding motor main controller. The information feedback module is used to return the motor speed signal to the backup flight control computer in real time.

7. The system according to claim 1, characterized in that, Two main flight control computers and N motor main controllers form a ring communication network with MIL-1394B bus as the transmission medium. When a connection is lost, the ring communication network is converted into a bus topology network.

8. The system according to claim 1, characterized in that, The backup flight control computer and N backup motor controllers form a linear shared bus network or a star bus network.

9. The system according to claim 1, characterized in that, The two primary flight control computers and the backup flight control computer are interconnected via a point-to-point bus.

10. A flight control method suitable for eVTOL multi-rotor manned aircraft, characterized in that, include: The main flight control computer is used to generate its own status score information and candidate main flight control commands, and sends the self-status score information and candidate main flight control commands to the backup flight control computer and each motor main controller. The backup flight control computer is used to select the highest priority instruction as the target primary flight control instruction based on the self-status score information received from the two primary flight control computers and the candidate primary flight control instructions, and to generate a backup flight control instruction, and to compare the consistency between the target primary flight control instruction and the backup flight control instruction. The main motor controller is used to select the highest priority instruction as the target main flight control instruction based on the self-state score information received from the two main flight control computers and the candidate main flight control instructions, and execute the target main flight control instruction to control the motor rotation. At the same time, it generates and outputs a suppression signal to the paired motor backup controller to prevent the motor backup controller from entering the working state. The motor backup controller is used to perform motor speed control function when the suppression signal is not received and the start command of the backup flight control computer is received.

Images