A flight control multi-level fault-tolerant voting method and system for singular faults

Abstract

The application discloses a kind of to be aimed at singular fault's flight control multilevel fault-tolerant voting method and system, it is related to the field of fly-by-wire control system.The system includes channel health state and working redundancy determination unit and multilevel fault-tolerant voting logic execution unit.The method designs the layered voting logic suitable for four redundancy, three redundancy, double redundancy and single channel state, and redundancy degradation is carried out after fault detection;For singular fault, introduce health memory value as virtual redundancy to participate in voting and fault location;Add review link before output in multiple redundancy voting link, prevent the voting result error caused by simultaneous failure of majority channel;When only single channel remains, virtual redundancy is used to guarantee the credibility of output;Establish risk degree dynamic counting mechanism to monitor the health state of each channel in real time, and based on risk degree and memory value maintenance period implements dynamic weight distribution.The application can significantly improve the fault-tolerant capability of multiple redundancy fly-by-wire control system under singular fault.

Description

Technical Field

[0001] This invention relates to the field of redundancy technology in fly-by-wire control systems, and specifically to a multi-level fault-tolerant voting method and system for flight control systems accommodating singular faults. Background Technology

[0002] A fly-by-wire control system is a full-time, full-authority electrical signaling system and a flight control system for control and stability enhancement, such as... Figure 1 (See *Flight Control Systems, 2nd Edition*, Wu Sentang, Beijing University of Aeronautics and Astronautics Press, October 2013, pp. 119-120). Modern aircraft fly-by-wire control systems must reliably replicate the mechanical control systems' manipulation of different control surfaces. Furthermore, fly-by-wire systems utilize feedforward signals from stick commands and various forms of sensor feedback signals to impart different response characteristics and superior flight qualities. To achieve reliable aircraft control and the required response characteristics and superior flight qualities across the entire flight envelope, the safety and reliability of fly-by-wire control systems are crucial for their development. The most effective method for addressing the safety and reliability issues of fly-by-wire control systems is to employ redundancy technology.

[0003] Fly-by-wire control systems effectively integrate manual control and automatic control in terms of both function and operation. Redundancy technology is a crucial core element ensuring aircraft achieve stable attitude control, heading and speed management, and the execution of complex missions. To ensure flight safety and reliability, existing flight control systems typically employ a multi-channel redundancy architecture. This involves using multiple parallel measurement, sensor, and computing channels to acquire the same or similar control parameters, voting on the outputs of different channels to eliminate the impact of single-point failures. Such redundancy architectures generally include quadruple redundancy, triple redundancy, and dual redundancy, and can gradually degrade as the number of available channels decreases until they enter a single-channel operating state.

[0004] Traditional fault-tolerant voting methods typically determine the final output based on the consistency of data across channels, that is, by comparing whether the differences in data between channels exceed a set threshold to judge its validity. Under normal circumstances, traditional methods can effectively suppress abnormal signals in a single channel. However, when singular faults occur, traditional methods may fail to determine the correct output value and struggle to locate the faulty channel. Singular faults include the following:

[0005] (1) In dual-channel voting, if the difference between the output values ​​of the two channels exceeds a set threshold, a result is formed. Type abnormality.

[0006] (2) In three-channel voting, if the difference between the output values ​​of any two channels exceeds a set threshold, or if the difference between the median and the maximum / minimum values ​​is less than the threshold but the difference between the maximum / minimum values ​​exceeds the threshold, a result is formed. Type abnormality.

[0007] (3) In four-channel voting, singular faults are divided into Type and type. The pattern is characterized by the difference between the largest and second largest values ​​and the difference between the smallest and second smallest values ​​being less than the threshold, but the difference between the second largest and second smallest values ​​being greater than the threshold, forming two independent groups. The type is characterized by the difference between the output values ​​of each pair of channels exceeding a set threshold.

[0008] Existing technologies lack effective strategies for handling singular failures, making it impossible to reliably generate correct outputs and accurately locate faulty channels. This limits the applicable scenarios of redundant systems and reduces overall reliability. In a quadruple-redundant majority voting system, the redundant architecture fails if two or more channels fail simultaneously.

[0009] Furthermore, traditional majority voting relies on "majority consensus" as the basis for judging the correct output. If the majority channel produces a consistent erroneous output due to a common cause failure, the vote will incorrectly identify the value as correct, which may lead to system failure or even flight safety accidents.

[0010] When the system redundancy is gradually reduced to only one channel, the traditional method cannot determine the validity of the channel output due to the lack of a reference channel. Once the channel deviates or becomes abnormal, the system cannot correct it in time, which can easily lead to flight control output distortion or even loss of control.

[0011] Existing technologies also have shortcomings in channel health assessment. Most methods tend to judge channel failures based on consecutive error cycles, ignoring the risk of long-term slight drift. For example, in triple redundancy voting, if the difference between the maximum and minimum values ​​exceeds a threshold, but the difference between the median and both the maximum and minimum values ​​is less than the threshold, the three channels exhibit a slight consistency in drift. This cannot be directly identified as a failure, but if the drift persists for a long time, it will significantly weaken system reliability. Furthermore, judging solely based on the results of the current cycle ignores historical operational information, masking the risk of intermittent failures.

[0012] Traditional voting strategies often employ equal weighting, failing to consider the real-time health status and historical performance of channels. This results in channels with potential problems having the same influence as healthy channels in voting. Furthermore, when using memory values ​​as virtual redundancy, existing methods do not adjust weight decay based on the retention time of health memory values. Long-term retained memory values ​​may introduce errors, affecting voting accuracy. Summary of the Invention

[0013] Because different flight requirements necessitate different stability enhancement functions, fly-by-wire control systems also require different redundancy structures. To address the shortcomings of multi-redundancy voting in handling singular faults, preventing simultaneous failures in multiple channels, ensuring single-channel operation, health assessment, and dynamic weight allocation, which can easily lead to channel voting failures or misjudgments, a new multi-level fault-tolerant voting system and method for flight control systems oriented towards singular faults is urgently needed. This invention's fault-tolerant voting method, on the one hand, introduces virtual redundancy to enhance handling capabilities under singular faults and ensure operation in single-channel conditions; on the other hand, it uses dynamic risk counting to assess the health status of each channel and employs a weight adjustment mechanism to improve reliability and fault tolerance performance under multiple fault modes, thereby enhancing flight quality.

[0014] Furthermore, the fault-tolerant voting method of the present invention can improve the applicability and fault tolerance of redundant voting under complex fault conditions.

[0015] Furthermore, addressing the issue of singular fault determination: This invention designs a virtual redundancy based on health memory values ​​to solve the technical problem that traditional majority voting cannot effectively distinguish between faulty and normal channels when there are conflicting output groups in multi-sensor channels, making it difficult to determine the final output value. Specifically, the fault-tolerant voting method of this invention stores the output value under each non-singular fault condition as a health memory value. When a conflicting group pattern is detected in the voting results of the current cycle, the health memory value of the previous cycle is used as a virtual redundancy and introduced into the voting operation of the current cycle. Using this virtual redundancy as a benchmark, the difference between each group of data and the virtual redundancy is judged. When the difference between the output value of a group and the virtual redundancy is less than or equal to a threshold, the group is judged to be healthy in the current cycle; otherwise, the group is considered to have an error in the current cycle. By introducing health memory values ​​into the voting process, the virtual redundancy plays a dual role in breaking ties and providing a reliable benchmark in symmetrical conflicting patterns, effectively identifying faulty channel groups and determining the correct output value, thereby solving the problem that traditional majority voting cannot make correct decisions in singular fault scenarios.

[0016] Furthermore, addressing the issue of majority failures: This invention designs a verification mechanism before output after the initial voting to prevent erroneous outputs caused by simultaneous failures in multiple channels during the majority voting process. This mechanism adds a judgment step before the final control signal output to verify the voting results, addressing the loopholes in preventing majority failures and improving the security and reliability of the fault-tolerant voting method of this invention. In specific implementation, after the initial voting in each cycle, the obtained data consistency group is compared with the health memory value of the previous cycle. If the deviation between the data consistency group and the health memory value is less than or equal to a preset threshold, the current voting value is considered to have high consistency with the health memory value, and the voting result is reliable and can be used as the final output; if the deviation is greater than the preset threshold, it is determined that there may be a multi-channel failure phenomenon, that is, the output of most channels has the same type of error, causing the voting result to deviate from the normal range. In this case, the voting value is not adopted, and the minority channels are then judged again with the health memory value to determine the final output. By introducing a review mechanism after the majority voting step, the fault-tolerant voting method of the present invention can effectively block the problem of erroneous output due to majority failures, and ensure that the fly-by-wire system can still output correct or safe control commands even when most channels fail at the same time, thereby significantly improving the fault tolerance, fault protection capability and overall safety of the fly-by-wire system.

[0017] Furthermore, addressing the reliability issue of single-channel operation, this invention designs a single-channel assurance mechanism to prevent severe erroneous outputs caused by sudden failures or performance drift of the sole working channel when the fly-by-wire control system degrades to a single-channel operating state. This ensures the stability and safety of the fly-by-wire control system even under minimum redundancy conditions. Specifically, when the fly-by-wire control system detects that the number of available channels has decreased to a single channel, it automatically enters a single-channel assurance mode. In this mode, the fault-tolerant voting method of this invention continuously performs data and health memory value comparison, fault determination, and anomaly response in each operating cycle. The single-channel assurance mechanism utilizes health memory values ​​to provide fault-tolerant support and prevents uncontrollable outputs caused by sudden single-channel failures, effectively extending the safe operating time of the fly-by-wire control system under low redundancy conditions and ensuring the availability and reliability of flight control commands even in extreme situations.

[0018] Furthermore, addressing the issue of channel health status assessment, this invention designs a dynamically updated risk assessment mechanism. This mechanism continuously monitors the health status of each sensor channel during the operation of the fly-by-wire control system and determines, isolates, and degrades redundancy based on the risk level. This dynamically updated risk assessment mechanism aims to solve the problem of traditional fly-by-wire control systems relying on single-detection assessments and lacking dynamic trend monitoring, thereby improving the accuracy and timeliness of fault identification. Specifically, the fault-tolerant voting method of this invention assigns an independent risk value to each sensor channel in the fly-by-wire control system, quantifying the channel's health status with a specific numerical value, and dynamically updates the risk level based on real-time detection results in each operating cycle. When a channel is determined to have an output error in the current cycle, its risk value is increased; if a channel has a slight anomaly but does not reach the error determination threshold, its risk value is slightly increased; when the channel output is considered normal in the current cycle, the risk level is slightly decreased. When the risk level of a channel exceeds a set reasonable upper limit, the fault-tolerant voting method of this invention treats the channel as faulty, pulls its operating signal low and isolates it, triggering redundancy degradation. The dynamic risk assessment mechanism can improve the fault detection and isolation capabilities of the fly-by-wire control system, provide reliable health status data support for dynamic weight allocation and redundancy degradation, and significantly enhance the overall safety and robustness of the fly-by-wire control system.

[0019] Furthermore, addressing the dynamic weight allocation problem, this invention designs a weight adjustment mechanism based on channel risk and the health memory value retention period to rationally allocate the influence of each data source during multi-channel redundancy voting. For each sensor channel, its weight value is inversely proportional to its corresponding risk level, ensuring that healthy and stable channels occupy a larger proportion in the final voting result, weakening the influence of channels with higher risk, and improving the reliability of the output. For the health memory value, its weight is decreasing with the retention period, i.e., the longer the retention period, the lower the weight; when a new health memory value replaces the old value, the retention period is reset to zero, and the weight is restored to the default. This weight adjustment mechanism based on channel risk and the health memory value retention period prevents the fly-by-wire control system from relying on expired data for a long time, ensuring that the reference value of virtual redundancy remains effective. Through this dynamic weight allocation method, the fault-tolerant voting method of this invention can adaptively adjust the importance of each data source during the voting process, taking into account both real-time performance and security, thereby maintaining the reliability of the voting result output under various failure modes.

[0020] To achieve the above-mentioned objectives, the present invention proposes a multi-level fault-tolerant voting method for flight control systems accommodating singular faults, comprising: Step 1, channel health status assessment and current working redundancy determination: assessing the health status of each sensor channel, identifying whether a faulty channel exists, and determining the number of working redundancies for the current cycle based on the operating status of each channel; Step 2, execution of multi-level fault-tolerant voting logic based on current working redundancy: selecting an appropriate redundancy voting algorithm based on the current working redundancy number, determining the consistency of data from each channel and forming a data consistency group, comparing and verifying the data consistency group with the health memory value, and generating the voting result output for the current cycle by combining dynamic weight calculation; Steps 1 and 2 are executed cyclically during the multi-level fault-tolerant voting process for flight control systems accommodating singular faults, ensuring that the fly-by-wire control system can continuously output stable, reliable, and safe control signals under different redundancy levels and various fault modes.

[0021] In step two, the output value under each non-singular fault condition is stored as a health memory value. When the voting result of the current period is detected to present a group opposition mode, the health memory value of the previous period is called as a virtual redundancy to be introduced into the voting operation of the current period. The virtual redundancy is used as a benchmark to judge each group of data. When the difference between the output value of a group and the virtual redundancy is less than or equal to the threshold, the group is judged to be healthy in the current period; otherwise, the group is considered to have an error in the current period.

[0022] In step two, after the initial vote in each cycle, the obtained data consensus group is compared with the health memory value of the previous cycle: if the deviation between the data consensus group and the health memory value is less than or equal to a preset threshold, the voting result is considered credible and is output as the voting result; if the deviation is greater than the preset threshold, it is determined that there may be a multi-channel fault phenomenon, and a few channels are re-judged with the health memory value to determine the final output.

[0023] In step two, for each sensor channel, its weight value is inversely proportional to the corresponding risk level; for the health memory value, its weight is decreasing with the retention period, the longer the retention period, the lower the weight. When a new health memory value replaces the old value, the retention period is reset to zero and the weight is restored to the default.

[0024] In step two, when the number of working margins is two, if the difference between the output values ​​of the two channels exceeds the preset channel data threshold, a singular fault is formed. At this time, the data values ​​of the two channels are compared with the health memory value respectively: if the absolute value of the difference between the data value of one channel and the health memory value is less than or equal to the channel data threshold, it is determined that the channel is operating normally, and the output is the weighted average of the data value of that channel and the health memory value; if the difference between the data values ​​of both channels and the health memory value exceeds the channel data threshold, it is determined that both channels have a clear error, and the health memory value is used as the output; if the difference between the data values ​​of both channels and the health memory value does not exceed the channel data threshold, it is considered a suspicious anomaly, and the health memory value is used as the output.

[0025] In step two, when the number of working margins is three, if there are significant differences between any two of the data from the three channels, a singular fault is formed. The sorted maximum, median, and minimum values ​​are compared with the health memory value in sequence, and the health status of each channel is determined based on the comparison results: if the absolute value of the difference between a certain channel's data value and the health memory value is less than or equal to the channel's data threshold, then the channel is determined to be operating normally, and the output uses the weighted average of the channel's data value and the health memory value; if the difference between the data values ​​of all three channels and the health memory value exceeds the channel's data threshold, then all three channels are determined to have a clear error, and the health memory value is used as the output.

[0026] In step two, when the number of working margins is four, if two consistent groups consisting of two data points are formed and the consistency between them is low, or if the differences between the four channel data points are significant, it is considered a singular fault. The mean value of the two groups of channel data or the deviation of each channel data value from the health memory value is calculated respectively. The health status of each channel is determined based on the comparison result of the deviation and the threshold, and the final output is determined.

[0027] This invention discloses a multi-level fault-tolerant voting system for flight control accommodating singular faults. The multi-level fault-tolerant voting system is embedded within a fly-by-wire control system and includes:

[0028] The channel health status and redundancy determination unit consists of a channel health status assessment module and a current cycle redundancy determination module. The channel health status assessment module is used to assess the health status of each channel of the same type of sensor and identify whether there is a faulty channel. The current cycle redundancy determination module determines the number of redundancies for the current cycle based on the operating status of each channel.

[0029] The multi-level fault-tolerant voting logic execution unit is used to select the corresponding channel voting algorithm according to different redundancy levels. Under each level condition, it first determines the consistency of the data of each channel and forms a data consistency group. Then, it compares and verifies the consistency group with the health memory value. Finally, it combines dynamic weight calculation to generate the voting result output of the current period.

[0030] Compared with existing technologies, the technical advantages of the multi-level fault-tolerant voting method for flight control in this invention are as follows:

[0031] (A) Strong applicability and stable operation under different redundancy levels: The fault-tolerant voting method of this invention establishes matching voting strategies for four redundancy levels: quadruple redundancy, triple redundancy, dual redundancy, and single-channel redundancy. It can automatically degrade and switch when a channel fault or insufficient redundancy is detected, without manual intervention. Compared with the fixed voting logic in the prior art, which may fail when the number of channels changes, the fault-tolerant voting method of this invention can adapt to the entire range of operating states from high redundancy to low redundancy, achieving stronger applicability and continuous output stability.

[0032] (B) Under singular fault conditions, the fault-tolerant voting method of this invention can still achieve reliable output and complete fault location: This addresses the shortcomings of existing technologies in... type, type, Type and To address the dilemma of decision-making under singular failure modes, this invention introduces a health memory value to construct virtual redundancy, breaking the deadlock of conflicting data and ensuring that the voting results have additional reliable references. This significantly improves the system's decision-making capability and output reliability under singular failure modes, enhancing the overall system reliability and applicability.

[0033] (C) Effectively avoids erroneous outputs caused by simultaneous failures of multiple channels: In majority voting mode, if multiple channels experience the same type of failure simultaneously, existing technologies tend to treat erroneous results as correct outputs. The fault-tolerant voting method of this invention introduces a verification mechanism before the final output. When the deviation between the data consistency group and the health memory value exceeds a threshold, it is automatically determined as a majority failure and the reliability of the minority channels is verified, thereby selecting the correct or safe value for output. This design effectively prevents erroneous signals from entering the execution link, improving the fault tolerance and safety performance of the fly-by-wire control system.

[0034] (D) Fault tolerance even in low redundancy or single-channel operation: When the fly-by-wire system is downgraded to single-channel operation, existing methods often lack reliable redundancy, causing the failure of the sole channel to directly affect the output. The fault-tolerant voting method of this invention uses the health memory value as virtual redundancy in voting under single-channel mode. Even if the sole channel malfunctions, a safe or correct output can be generated by referring to the memory value, thereby ensuring the reliability and stability of the fly-by-wire system under extremely low redundancy conditions.

[0035] (E) More Accurate and Reasonable Channel Risk Assessment: The fault-tolerant voting method of this invention sets dynamically updatable risk parameters for each sensor channel and reflects the continuous changing trend of the channel status through periodic accumulation or deduction. Unlike the single standard in existing technologies that relies on a number of consecutive cycles of errors to determine a fault, this method introduces multi-level quantification processing in risk calculation, transforming different types of abnormal performance into corresponding weight values, thereby achieving a more detailed health assessment. This mechanism can more accurately determine the risk status of the channel, effectively identify and suppress the impact of long-term slight drift or intermittent faults, reduce the probability of missed detection, and thus ensure the safety and stability of the fly-by-wire control system in complex operating environments.

[0036] (F) Combining dynamic weights for more accurate and reliable output results: The fault-tolerant voting method of this invention dynamically adjusts the weights based on the channel risk level, giving lower-risk channels a larger proportion in the voting. Simultaneously, the weight of health memory values ​​decreases dynamically according to their retention period, preventing long-term reliance on expired data. This weight allocation method ensures that the voting results fully match the actual channel health status, helping to improve the reliability and security of the output data from the telemetry control system. Attached Figure Description

[0037] Figure 1 This is a block diagram of a traditional flight control system.

[0038] Figure 2 This is a flowchart of the multi-level fault-tolerant voting method for flight control systems in response to singular faults, as described in this invention.

[0039] Figure 3 This is a flowchart of the single-channel fault-tolerant voting algorithm of the present invention.

[0040] Figure 4 This is a flowchart of the dual-redundant fault-tolerant voting algorithm of the present invention.

[0041] Figure 5 This is a flowchart of the triple redundancy consistency partitioning process of the present invention.

[0042] Figure 6 This is a flowchart of the redundancy voting process for triple redundancy singular faults in this invention.

[0043] Figure 7 This is a flowchart of the four-redundancy consistency partitioning process of the present invention.

[0044] Figure 8 This is the quadruple redundancy of the present invention. Flowchart for voting in various scenarios.

[0045] Figure 9 This is the quadruple redundancy of the present invention. Flowchart for voting in various scenarios.

[0046] Figure 10This is the quadruple redundancy of the present invention. Flowchart for voting in various scenarios.

[0047] Figure 11 This is a simulation result diagram of Embodiment 1 of the present invention.

[0048] Figure 12 This is a simulation result diagram of Embodiment 2 of the present invention.

[0049] Figure 13 This is a simulation result diagram of Embodiment 3 of the present invention.

[0050] Figure 14 This is a simulation result diagram of Embodiment 4 of the present invention.

[0051] Figure 15 This is a simulation result diagram of Embodiment 5 of the present invention. Detailed Implementation

[0052] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. The examples of the parameters listed are merely preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

[0053] See Figure 1 , Figure 2 As shown, due to the different stabilization functions required for different flights, the redundancy structure of the fly-by-wire control system also varies. To address the shortcomings of multi-redundancy voting in handling singular faults, preventing simultaneous failures of multiple channels, ensuring single-channel operation, health assessment, and dynamic weight allocation, which can easily lead to channel voting failure or misjudgment risks, this invention designs a multi-level fault-tolerant voting system for flight control oriented towards singular faults. This system is embedded in the fly-by-wire control system. The multi-level fault-tolerant voting system for flight control oriented towards singular faults includes: a channel health status and redundancy determination unit and a multi-level fault-tolerant voting logic execution unit.

[0054] The channel health status and redundancy determination unit consists of a channel health status assessment module and a current cycle redundancy determination module. The channel health status assessment module evaluates the health status of each channel of the same type of sensor to identify any faulty channels. The current cycle redundancy determination module determines the current cycle redundancy based on the operating status of each channel.

[0055] The multi-level fault-tolerant voting logic execution unit is used to select the corresponding channel voting algorithm according to the different redundancy levels. Under the conditions of each level, it first determines the consistency of the data of each channel and forms a data consistency group. Then, it compares and verifies the consistency group with the health memory value. Finally, it combines dynamic weight calculation to generate the voting result of the current period and outputs it to the telecontrol system.

[0056] In this invention, the same type of sensor channels are designed as a quadruple redundancy structure, that is, one to four input channels respectively perform parallel measurement or preprocessing of the same flight state parameter, and send the obtained multi-channel sensor data to a multi-level fault-tolerant voting logic execution unit for channel voting.

[0057] in accordance with Figure 2 As shown, to further illustrate the multi-level fault-tolerant voting system for flight control systems accommodating singular faults proposed in this invention, the specific implementation steps of the proposed multi-level fault-tolerant voting method for flight control systems accommodating singular faults (hereinafter referred to as the fault-tolerant voting method) will be described in detail below with reference to preferred embodiments. Because the stability augmentation functions required for different flights vary, the redundancy structure of fly-by-wire control systems also differs. To address the shortcomings of multi-redundancy voting algorithms in singular fault handling, prevention of simultaneous faults in multiple channels, single-channel operation assurance, health assessment, and dynamic weight allocation, which can easily lead to channel voting failure or misjudgment risks, the fault-tolerant voting method proposed in this invention includes the following two core steps: channel health status assessment and current working redundancy determination, and execution of multi-level fault-tolerant voting logic based on the current working redundancy. By introducing virtual redundancy to enhance the handling capability under singular faults and ensure operation in single-channel conditions, the health status of each sensor channel is assessed through dynamic risk counting, and a weight adjustment mechanism is adopted to improve reliability and fault tolerance performance under multiple fault modes, thereby improving flight quality.

[0058] The fault-tolerant voting method involves three preset thresholds: a risk threshold, a memory threshold, and a data threshold. The risk threshold is used to determine whether the channel risk exceeds a preset upper limit, and accordingly, whether the channel is faulty. The memory threshold is used to determine whether the deviation between the current channel output data and the health memory value exceeds the allowable range. The data threshold is used to determine whether the channel input data meets the consistency requirements when there is two to four redundancy.

[0059] like Figure 2 As shown, due to the different stability augmentation functions required for different flights, the redundancy structure of fly-by-wire control systems also varies. To address the issue of channel voting failure caused by multi-redundancy voting algorithms in handling singular faults, preventing simultaneous faults in multiple channels, ensuring single-channel operation, health assessment, and dynamic weight allocation, a multi-level fault-tolerant voting method for flight control oriented towards singular faults is proposed. This fault-tolerant voting method includes two core steps.

[0060] Step 1: Assess the health status of the channel and determine the current operational margin;

[0061] This step assesses the health status of each sensor channel, identifies any faulty channels, and determines the current cycle's workload margin based on the operational status of each channel. It can be further divided into the following sub-steps:

[0062] Step 11, Health status assessment of each channel;

[0063] In step 11, the fly-by-wire control system first invokes the risk assessment, reads the risk parameters of each sensor channel (or working channel), and determines the health status of each channel accordingly.

[0064] The risk level parameter is calculated cumulatively based on the channel's output performance over several previous operating cycles. Within a single operating cycle, the channel's output performance is categorized into three types: explicit error, suspected anomaly, and normal operation. Explicit error refers to a significant discrepancy between the channel's output and the health memory value, as well as data from other channels. Suspected anomaly manifests as a lack of significant consistency decline, but with slight data drift, potentially indicating underlying instability. Normal operation refers to any performance other than the above two categories, indicating that the channel maintains stable and normal output within the cycle. In the fault-tolerant voting method of this invention, different output performances correspond to different risk level increment / decrease rules: when a channel exhibits an explicit error, its risk level increases by 1; when a channel exhibits a suspected anomaly, its risk level increases by 0.25; and when a channel exhibits normal operation, its risk level decreases by 0.5.

[0065] When the risk level of a channel exceeds a preset risk threshold, the channel is determined to be faulty in the current cycle and will no longer participate in normal data voting. At this time, the telematics control system forcibly lowers the operating signal of the channel and performs an isolation operation to prevent its erroneous output from affecting the redundancy voting results.

[0066] Step 12: Determine the current cycle's workload margin;

[0067] In step 12, the working margin for the current cycle is determined based on the number of healthy channels, i.e. the number of channels currently participating in the vote, and the corresponding fault-tolerant voting logic is executed in subsequent processes accordingly.

[0068] After the health status of all channels is updated, the fly-by-wire control system detects the working signal status of each channel and counts the number of normal channels that can participate in voting within the current cycle. Based on the statistical results, the working redundancy level for the current cycle is determined. For example, if three channels have high working signals and one channel has low working signals in a certain cycle, then three healthy channels participate in voting in that cycle, and the multi-level fault-tolerant voting logic execution unit is currently in a triple-redundancy working state. The number of working redundancies determined in this invention is a key parameter for the multi-level fault-tolerant voting logic execution unit to perform fault-tolerant voting subsequently, and it is related to the handling of singular faults and the invocation of the majority fault prevention mechanism.

[0069] Step two: Execute the multi-level fault-tolerant voting logic based on the current workload.

[0070] See Figure 2 As shown, this step aims to vote on the working channel data (sensor data) for the current cycle and determine the final output. Depending on the working margin for the current cycle, the multi-level fault-tolerant voting logic execution unit selects the appropriate margin voting algorithm. Under each working margin condition, the consistency of each channel's data is first determined, and a data consistency group (channel data value) is formed. Then, the channel data value is compared and verified with the health memory value. Finally, combined with dynamic weight calculation, the voting result output for the current cycle is generated.

[0071] In this invention, the redundancy structure of the multi-level fault-tolerant voting setting based on the current working redundancy includes: single-channel case, dual-redundancy case, triple-redundancy case and quadruple-redundancy case, which will be described in detail below.

[0072] (A) Single-channel case

[0073] Based on the current cycle's working margin number output in step one, if the current working margin number is one, then the single-channel case is entered. The flowchart of the single-channel fault-tolerant voting algorithm is as follows: Figure 3 As shown.

[0074] Step 11, Single-channel data reliability determination;

[0075] In single-channel mode, the multi-level fault-tolerant voting logic execution unit detects only one available and healthy working channel, which independently undertakes the data output task in the current cycle. The multi-level fault-tolerant voting logic execution unit directly constructs a data consistency group consisting of a single data element from the output data of this channel and compares it with the health memory value. A comparison will be performed. If the difference between the two exceeds the preset health memory threshold... If the data in that channel is unreliable, then the data in that channel is considered unreliable; otherwise... The channel data is deemed reliable, and the channel data value is output. .

[0076] Step 12: Single-channel voting results are generated;

[0077] When single-channel data is determined to be reliable, it indicates that the channel is operating normally during this cycle. To improve the channel data value... The credibility of the channel data value With health memory value The weighted average is used as the voting result output for the current period, as shown in formula (1). .in This represents the current channel output result calculated in the case of a single channel. This represents the channel data value in a single-channel scenario. This is the health memory value under single-channel conditions. These are the channel weight values ​​in the single-channel case. This represents the weighting of health memory values ​​in a single-channel scenario.

[0078] In the single-channel case of the present invention, the current channel output result is updated to the next health memory value, and its duration is set to 0.

[0079] In this invention, when single-channel data is determined to be unreliable, it indicates that a clear error has occurred in that channel during the current period, increasing the risk level of that channel. The final output uses a health memory value, and the duration of this health memory value is increased by 1.

[0080] (B) Dual redundancy case

[0081] Based on the current cycle's working leeway count output in step one, if the current working leeway count is two, then the multi-level fault-tolerant voting logic execution unit enters the double-redundancy state. The double-redundancy fault-tolerant voting algorithm flow is as follows: Figure 4 As shown.

[0082] Step 21, data consistency partitioning with dual redundancy;

[0083] In the dual-redundancy configuration, the multi-level fault-tolerant voting logic execution unit detects two available and healthy working channels (i.e., the first working channel and the second working channel). The channel data value of the first working channel is denoted as... The channel data value of the second working channel is denoted as At this point, the output data from the two channels may fall into two categories: one is... The first type is characterized by a high degree of consistency between the two sets of data; the second type is... This type of fault, where two data points differ significantly and are in a discrete state, is a singular fault situation, and it is impossible to directly determine which channel's data is reliable.

[0084] To determine the case of two data channels, the multi-level fault-tolerant voting logic execution unit calculates the difference between the two data channels and takes its absolute value, then compares it with a preset channel data threshold. Comparison: When the absolute value is greater than the channel data threshold, the two data points are considered to have low consistency and are classified as... Type 1 case, i.e. When the absolute value is less than or equal to the channel data threshold, the consistency is considered high, and the data is classified as follows: Type 1 case, i.e. .

[0085] Step 22: Review and generate the dual-redundancy voting results;

[0086] This step reviews the voting results and generates the final output based on the different scenarios identified in step 21.

[0087] For the case of double redundancy In this scenario, it is necessary to combine the data from the consensus group with the health memory value. A comparison is performed to prevent a situation where two channels fail simultaneously. The two data points are then compared with the health memory value. Calculate the difference and take the absolute value. If both absolute values ​​are greater than the set health memory threshold, then... If the deviation between the consistent group and the health memory value is large, indicating a majority of faults, meaning both channels experience errors in this cycle, the health memory value is used as the output; this health memory value is... Otherwise, it is assumed that both channels are working normally in this cycle, and the output is a weighted average of the two channels, as shown in formula (2). .in, This represents the channel data value of the first working channel in the dual-redundancy configuration. This refers to the channel data value of the second working channel in the dual-redundancy case. This represents the weight value of the first working channel in the case of dual redundancy. This represents the weight value of the second working channel in the case of dual redundancy.

[0088] For the case of double redundancy In this type of situation, which is considered a singular fault, it's impossible to directly determine which channel is more reliable based on the data from the two channels. A health memory value is needed for this assessment. The specific steps are as follows:

[0089] Step 22A, if the channel data value of the first working channel With health memory value The absolute value of the difference is less than or equal to the channel data threshold. At that time, that is If yes, proceed to step 22B; otherwise, proceed to step 22D.

[0090] Step 22B, if the channel data value of the second working channel With health memory value The absolute value of the difference is less than or equal to the channel data threshold. At that time, that is This results in a slight drift. In this situation, health memory values ​​are used. As output, although the data from the two channels exceeds the channel data threshold, neither of them, nor the health memory value, exceeds the channel data threshold, and is therefore considered a suspicious anomaly.

[0091] Step 22C, if the channel data value of the second working channel With health memory value The absolute value of the difference is greater than the channel data threshold. At that time, that is If the first working channel is operating normally and the second working channel has a clear error, the output will use a health memory value. Channel data value of the first working channel The weighted average, i.e. , This is the weighted average value of the first working channel under the dual-redundancy condition. This represents the weight value of the first working channel in the case of dual redundancy. This represents the weighting value of the health memory value under the dual-redundancy condition.

[0092] Step 22D, Channel data value of the first working channel With health memory value The absolute value of the difference is greater than the channel data threshold. At that time, that is Continue to evaluate the second working channel. If the channel data value of the second working channel... With health memory value The absolute value of the difference is less than or equal to the channel data threshold. At that time, that is If a clear error occurs in the first working channel and the second working channel is operating normally, the output uses a health memory value. Channel data values ​​of the second working channel The weighted average, i.e. , This is the weighted average value of the second working channel under the dual-redundancy condition. This is the weight value for the second working channel in the case of dual redundancy; otherwise, it is determined that both channels have experienced a clear error in this cycle, and the adopted health memory value is output. .

[0093] (C) Triple redundancy

[0094] Based on the current cycle redundancy count output in step one, if the current redundancy count is three, then the multi-level fault-tolerant voting logic execution unit enters the three-redundancy state.

[0095] Step 31, Data consistency partitioning for triple redundancy;

[0096] In the triple-redundancy configuration, the multi-level fault-tolerant voting logic execution unit detected three available and healthy working channels. The channel data value of the first working channel is denoted as... The channel data value of the second working channel is denoted as The channel data value of the third working channel is denoted as At this point, the three channels may have three possible distribution scenarios: one is... The first type is characterized by high consistency among the three channels; the second type is characterized by... This pattern refers to a situation where two channels have high data consistency, while the data in another channel differs significantly from them; for example, the data in the third working channel is highly consistent with the data in the second working channel, while the data in the first working channel differs significantly from the data in the third and second working channels; thirdly... The type is characterized by significant differences between each pair of the three channels, which is considered a singular fault.

[0097] To ensure consistency, the multi-level fault-tolerant voting logic execution unit first sorts the channel data of the three channels and marks them in descending order as follows: , , The preset channel data threshold under triple redundancy is denoted as Health memory value is recorded as The preset health memory value is recorded as Then, proceed with the following steps to divide the data; the division process is as follows: Figure 5 As shown.

[0098] Step 31A: If the absolute value of the difference between the maximum and minimum values ​​is less than or equal to the channel data threshold, then classify it as... Type 1 case, i.e. Otherwise, determine whether the absolute value of the difference between the maximum value and the median value is less than or equal to the channel data threshold. If yes, proceed to step (B); otherwise, proceed to step (C).

[0099] Step 31B: If the absolute value of the difference between the median and minimum values ​​is less than or equal to the channel data threshold, then classify it as slightly drifted. Type 1 case, i.e. Otherwise, it is classified as In this case, the maximum value of the channel data is ( ) and the median value of channel data ( The consistency is high, and the minimum value of the channel data is ( The deviations from them are relatively large.

[0100] Step 31C: If the absolute value of the difference between the median and minimum values ​​is less than or equal to the channel data threshold, i.e. Then it is divided into In this case, the median value of the channel data ( ) and the minimum value of channel data ( The consistency between the faults is high; otherwise, it is classified as a singular fault. In this scenario, the deviations between each pair of the three channel data are relatively large.

[0101] Step 32: Verify and generate the results of the triple redundancy voting;

[0102] In the case of triple redundancy, this step reviews the voting results and determines the final output based on the different scenarios identified in step 31.

[0103] Step 32A, in the case of triple redundancy, for In this scenario, it's necessary to compare the channel data of the consistency group with the health memory value to prevent multi-channel failures. The maximum value in the channel data ( ) and minimum value ( ) Calculate the difference between each of the health memory values ​​and take the absolute value. and If both absolute values ​​are greater than the set health memory threshold, that is... Then the health memory value is considered The data from the same channel group differed significantly, indicating a simultaneous failure of three channels. This suggests that all three channels experienced a clear error during this cycle, and a health memory value was used. As the output. Otherwise, it is assumed that all three channels are working normally in this cycle, and the output is a weighted average of the data from the three channels, as shown in formula (3). .in, This is the channel-weighted average of the three channels under triple redundancy. This represents the weight value of the first working channel under triple redundancy. This represents the weight value of the second working channel under triple redundancy. This represents the weight value of the third working channel under triple redundancy.

[0104] Step 32B, in the case of triple redundancy, for In this scenario, first compare the data from the two channels (e.g., the third and second working channels) with the health memory values ​​respectively. The difference between the two absolute values ​​is used to determine whether a multi-channel fault has occurred; if one of the two absolute values ​​is less than or equal to the health memory threshold... If the condition is as follows: If no multi-channel fault has occurred, the weighted average of the data from the two channels is used as the final output value, indicating that the two working channels are operating normally, and the remaining working channel (e.g., the first working channel) has a clear error. Otherwise, the consistency between the remaining working channel (e.g., the first working channel) and the health memory value is first assessed. If the consistency is high, the weighted average of the data from that channel (e.g., the first working channel) and the health memory value is used as the output, indicating that the corresponding working channel (e.g., the first working channel) is operating normally, and the corresponding two working channels (e.g., the third and second working channels) have a clear error. If the consistency is low, all three working channels are considered faulty, and the health memory value is used as the final output. As output.

[0105] for The case of type (1) can be expressed mathematically as follows: (1) and ; , This is the channel-weighted average of the third and second working channels under triple redundancy. (2) ; , This is the channel-weighted average value of the first working channel under triple redundancy. This represents the weighting value of health memory values ​​under triple redundancy.

[0106] Step 32C, in the case of triple redundancy, for This type of situation can be divided into two cases: slight drift and large difference. For the case of slight drift, the maximum value ( ), minimum value ( The data range exceeded the channel data threshold. However, the differences between the maximum and median values, and between the median and minimum values, did not exceed the channel data threshold. In this case, it is believed that the channel data values ​​of the three working channels still have good consistency, only the maximum value ( ), minimum value ( ) and median ( This resulted in a slight drift, specifically the maximum value ( ) and minimum value ( The corresponding working channel experienced a suspicious anomaly, and the final output adopted the intermediate value. For cases with significant differences, it is necessary to introduce health memory values. As a virtual redundancy to assist in the judgment, the redundancy voting process is as follows: Figure 6 As shown, the specific steps are as follows:

[0107] Step (A), if the maximum value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now If yes, proceed to step (B); otherwise, proceed to step (C).

[0108] Step (B), if the intermediate value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now Then the maximum value is considered to be ( Health Memory Value With the median ( This constitutes a slight drift. The case of type, i.e., the maximum value ( ), median ( The corresponding work channel showed a suspicious anomaly, with the minimum value being ( The corresponding work channel encountered a clear error and used health memory values. As the final output; otherwise, consider the maximum value ( ) and health memory value The consistency is high, and the corresponding working channel is operating normally, while the values ​​of the other two channels (intermediate value (...)) ), minimum value ( A clear error occurred in the corresponding working channel. The output uses the channel-weighted average of the maximum value and the health memory value, i.e. .

[0109] Step (C), if the intermediate value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now If yes, proceed to step (D); otherwise, proceed to step (E).

[0110] Step (D), if the minimum value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now Then the median value is considered to be ( Health Memory Value and minimum value ( This constitutes a slight drift. The case of the intermediate value ( ), minimum value ( The corresponding working channel showed a suspicious anomaly, with a maximum value of ( A clear error occurred in the corresponding work channel; a health memory value was used. As the final output; otherwise, consider the intermediate value ( ) and health memory value The consistency is high, indicating that the corresponding working channel is operating normally, while the other two values ​​(maximum value ( ), minimum value ( The corresponding working channel encountered a clear error, and the output uses the channel-weighted average of the median value and the health memory value, i.e. , This is the channel-weighted average value of the third working channel in the triple redundancy case.

[0111] Step (E), if the minimum value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now If the minimum value is highly consistent with the health memory value, the corresponding working channel is considered to be operating normally, while the other two values ​​(maximum value (...)... ), median ( A clear error occurred in the corresponding working channel. The output uses the channel-weighted average of the minimum value and the health memory value, i.e. , The value is the channel-weighted average of the second working channel under triple redundancy; otherwise, it is considered that the consistency between the three working channel values ​​and the healthy memory value is low, and all three working channels have obvious errors, so the healthy memory value is used. As output value.

[0112] (D) Quadratic redundancy

[0113] Based on the current cycle working leeway number output in step one, if the current working leeway number is four, then the multi-level fault-tolerant voting logic execution unit enters the four-leeway state.

[0114] Step 41, data consistency partitioning for four redundancies;

[0115] In the quadruple redundancy configuration, the multi-level fault-tolerant voting logic execution unit detected that all four channels were available and healthy. The channel data value of the first working channel is denoted as... The channel data value of the second working channel is denoted as The channel data value of the third working channel is denoted as The channel data value of the fourth working channel is denoted as At this point, there are five possible distribution scenarios for the four channels:

[0116] First The pattern indicates that the data from the four channels is highly consistent.

[0117] Second The pattern is characterized by high consistency among three channels, while the remaining channel shows significant and independent differences. For example, the data of the third, second, and fourth working channels are highly consistent, while the data of the first working channel differs significantly from those of the third, second, and fourth working channels.

[0118] Third This type of fault occurs when two consistent groups of data are formed, but the consistency between them is low, which is a singular fault situation. For example, the channel data of the first working channel and the third working channel have high consistency, the channel data of the second working channel and the fourth working channel have high consistency, while the channel data of the third working channel and the second working channel have a large difference.

[0119] Fourth This type is characterized by two channels having high data consistency, while the other two channels have low consistency with the consistent group and with each other. For example, the third working channel has high consistency with the second working channel, while the first working channel has a large data difference with the third working channel, and the second working channel has a large data difference with the fourth working channel.

[0120] The last one is The type is characterized by significant differences in the data across the four channels, which is considered a singular fault condition.

[0121] To ensure consistency, the multi-level fault-tolerant voting logic execution unit first sorts the data from the four channels and labels them in descending order. , , , In the case of quadruple redundancy, the preset channel data threshold is denoted as... Health memory value is recorded as The preset health memory value is recorded as Then, proceed with the following steps to divide the data; the division process is as follows: Figure 7 As shown.

[0122] Step 41A, if the maximum value ( ), minimum value ( The absolute value of the difference between the two is less than or equal to the channel data threshold. Then it is divided into Type 1 case, i.e. Otherwise, if the maximum value ( ), second smallest value ( The absolute value of the difference between the two is less than or equal to the channel data threshold. ,Right now If yes, proceed to step (41B); otherwise, proceed to step (41C).

[0123] Step 41B, if the second smallest value ( ), minimum value ( The absolute value of the difference between the two is less than or equal to the channel data threshold. ,Right now Then it is believed , and High consistency and High consistency, but and , and The consistency among the consistent groups is low, so they are divided into groups with slight drift In this case; otherwise, and The consistency was also low, and it was classified as normal. This is a typical situation.

[0124] Step 41C, if the second largest value ( ), minimum value ( The absolute value of the difference between the two is less than or equal to the channel data threshold. ,Right now If yes, proceed to step (41D); otherwise, proceed to step (41E).

[0125] Step 41D, if the maximum value ( ), second largest value ( The absolute value of the difference between the two is less than or equal to the channel data threshold. ,Right now Then it is believed , and High consistency and High consistency, but and , and The consensus group has low consistency and is divided into groups with slight drift In this case; otherwise, and The consistency was also low, and it was classified as normal. This is a typical situation.

[0126] Step (41E), when , and All are greater than the channel data threshold At that time, it was divided into This type of situation is a singular fault; when only Greater than the channel data threshold At that time, it was divided into This type of situation is a singular fault; when only Greater than the channel data threshold At that time, it was divided into , Slight data drift on both sides Type of situation; when only Greater than the channel data threshold At that time, it was divided into , Data drift on both sides Type of situation;

[0127] when , and All are less than the channel data threshold At that time, it was divided into , Slight drift Type of situation;

[0128] The rest, i.e. , and Only one of them is less than the channel data threshold. At that time, it was classified as normal. This is a typical situation.

[0129] Step 42: Confirmation of the four-redundancy voting results and determination of the final output;

[0130] This step reviews the voting results and determines the final output based on the different scenarios identified in step 41.

[0131] Step 42A, in the case of quadruple redundancy, for In this scenario, it's necessary to compare the channel data of the consistency group with the health memory value to prevent multi-channel failures. The maximum value in the channel data ( ) and minimum value ( (These are related to health memory values) Calculate the difference and take the absolute value. If both absolute values ​​are greater than the set health memory threshold, then... ,Right now If the data in the consistent group deviates significantly from the health memory value, it indicates a multi-channel failure. Therefore, it is determined that all four working channels experienced errors during this cycle, and the health memory value is adopted. As the output; otherwise, it is assumed that all four working channels are working normally in this cycle, and the output is the channel-weighted average of the data from the four channels, as shown in formula (4). ,in, This is the channel-weighted average of the four channels in the quadruple redundancy case. This represents the weight value of the first working channel in the case of quadruple redundancy. This represents the weight value of the second working channel in the quadruple redundancy case. This represents the weight value of the third working channel in the quadruple redundancy scenario. This represents the weight value of the fourth working channel under quadruple redundancy.

[0132] Step 42B, in the case of quadruple redundancy, for In this type of situation, data is divided into normal channel data ( , and ), separate channel data ( Slight drift and data from both sides of the channel ( , Three scenarios of slight drift, the voting process is as follows: Figure 8 As shown.

[0133] For normal channel data ( , and ) and separate channel data ( In the case of slight drift, first set the maximum value ( ), minimum value ( (These are related to health memory values) The difference between the two values ​​is taken, and the absolute value is used to determine whether a multi-channel fault has occurred; if both absolute values ​​are greater than the health memory threshold... If this occurs, a multi-channel fault will occur, i.e. Conversely, no multi-channel fault occurred.

[0134] If a multi-channel failure occurs, first isolate the data from the individual channels that are not in the data consistency group. ) and health memory value For comparison, if it has a high degree of consistency with health memory values, that is... Then the data from that single channel will be used. ) and health memory value The channel-weighted average is used as the output, i.e. Otherwise, it is assumed that all four channels are malfunctioning, and the healthy memory value is used. As output This represents the weighting value of health memory values ​​under the quadruple redundancy condition.

[0135] If no multi-channel failure occurs, it is assumed that all three working channels are operating normally, and the output uses a channel-weighted average. For individual data not included in the consistency group ( If the drift is slight, the corresponding working channel is considered to have a suspicious abnormality; otherwise, it is a definite fault. , This is the channel-weighted average of the third, second, and fourth working channels under the quadruple redundancy condition.

[0136] For data from both sides of the channel ( , The slight drift of the median value () ) and health memory value Take the difference and then the absolute value, that is... This is because, in this situation, only the median value has stable reference value. If the absolute value is greater than the healthy memory threshold... ,Right now If this intermediate value is incorrect, the output will use the health memory value. All working channels show explicit errors. Otherwise, an intermediate value is used. As output, the working channel corresponding to the intermediate value operates normally, and the data from both sides of the channel ( , The corresponding working channel showed a suspicious anomaly, and the data from a single channel () The corresponding work channel has a clear error.

[0137] Step 42C, in the case of quadruple redundancy, for In this type of situation, two consistent groups are opposed (e.g.) and Group 1 and (This is the second group, and the first group is the opposite of the second group), using health memory values. To assist in the judgment.

[0138] First, take the mean value of each channel data set for the two sets of data. The mean value of the first set of channel data is... The mean of the second group of channel data is ;

[0139] Then compare the channel data mean with the health memory value. Take the absolute value of the difference, the first set of absolute values The second group of absolute values If both absolute values ​​are greater than the healthy memory threshold This indicates that all four working channels have encountered errors, and the output value uses the health memory value. ;Right now ;

[0140] Then, if both absolute values ​​are less than or equal to the healthy memory threshold, that is... This represents the average value of the channel data. , and health memory value This constitutes a set of slightly drifting sides In this scenario, all data from the four working channels are considered suspicious, and the output uses the health memory value. ;

[0141] In other cases, where one absolute value is greater than the healthy memory threshold and the other absolute value is less than or equal to the healthy memory threshold, i.e. or If the group with the smaller absolute value is considered to be operating correctly and the other group has a clear error, the output is the channel-weighted average of the working channels of the correct group.

[0142] That is based on The channel-weighted average of the output working channels is then: , This is the channel-weighted average of the second and fourth working channels under quadruple redundancy. Or...

[0143] based on The channel-weighted average of the output working channels is then: , This is the channel-weighted average of the first and third working channels under the quadruple redundancy condition.

[0144] Step 42D, in the case of quadruple redundancy, for In this type of situation, data is divided into normal channel data ( and ) and data from both sides of the channel ( and In the case of slight drift, the voting process is as follows: Figure 9 As shown.

[0145] The first step is to diagnose multi-channel faults: This involves analyzing the data from two channels (…). and (These are related to health memory values) Take the difference and then the absolute value. If both absolute values ​​are greater than the set health memory threshold... If this occurs, a channel failure will occur between the third working channel and the second working channel. Conversely, the third working channel and the second working channel are operating normally, that is... ,or ,or The output uses the channel-weighted average of the third working channel and the second working channel. ;

[0146] Then if it is normal Type of situation, data from both sides of the channel ( and The corresponding work channel has a clear error;

[0147] Then if it's a slight drift Type of situation, data from both sides of the channel ( and The corresponding work channel showed suspicious anomalies;

[0148] Then, if a multi-channel failure occurs, the data from both channels will be... and (These are related to health memory values) Perform a consistency check; if the consistency between the data from both channels and the health memory value is high, then... ,Right now , and The three elements caused a slight drift on both sides. In this form, the data from both channels ( and The corresponding work channel has generated a suspicious anomaly, and a health memory value has been used. As output;

[0149] Then if the data from both channels ( and ) and health memory value The consistency is low, that is If this is the case, then the corresponding working channel for the data on both sides also shows a clear error, and a health memory value is used. As output;

[0150] If one channel's data has a high consistency with the health memory value, while another channel's data has a low consistency with the health memory value, then the working channel corresponding to the low-consistency channel has a clear error, while the working channel corresponding to the high-consistency channel is operating normally. The output is the channel-weighted average of the high-consistency channel data and the health memory value.

[0151] For example, channel data With health memory value The consistency is relatively high, while the channel data With health memory value The consistency is low, that is The output channel weighted average is then... , This is the channel-weighted average value of the first working channel in the quadruple redundancy case.

[0152] Step 42E, in the case of quadruple redundancy, for This type of situation is a peculiar fault and requires the introduction of health memory values. As virtual redundancy is used to assist in the judgment, the process is as follows: Figure 10 As shown, the specific steps are as follows.

[0153] Step (A), if the maximum value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. At the same time, if the second largest value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now Then the maximum value ( Health Memory Value Second largest value ( This resulted in a slight drift on both sides. In the case of type, determine the maximum value ( ), second largest value ( The corresponding working channel showed a suspicious anomaly, the second smallest value ( ), minimum value ( A clear error occurred in the corresponding working channel, and the output used the health memory value. .

[0154] If the maximum value is satisfied ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. At the same time, the second largest value was not satisfied ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now At this point, the second largest value is determined ( ), second smallest value ( ) and minimum value ( A clear error occurred in the corresponding working channel, and the output adopted the maximum value ( ) and health memory value The channel-weighted average is .

[0155] If the maximum value ( ) and health memory value The absolute value of the difference is greater than the channel data threshold. ,Right now Then proceed to step (B).

[0156] Step (B), if the second largest value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. At the same time, if the second smallest value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now Then the second largest value ( Health Memory Value Second smallest value ( This resulted in a slight drift on both sides. In the case of type, determine the second largest value ( ), second smallest value ( The corresponding working channel has a suspicious anomaly, with a maximum value of ( ), minimum value ( A clear error occurred in the corresponding working channel, and the output used the health memory value. .

[0157] If the second largest value is satisfied ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. At the same time, the second smallest value was not satisfied ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now At this point, determine the maximum value ( ), second smallest value ( ) and minimum value ( A clear error occurred in the corresponding working channel, and the output adopted the second largest value. ) and health memory value The channel-weighted average is .

[0158] If the second largest value ( ) and health memory value The absolute value of the difference is greater than the channel data threshold. ,Right now Then proceed to step (C).

[0159] Step (C), if the second smallest value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. At the same time, if the minimum value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now Then the second smallest value ( Health Memory Value and minimum value ( This resulted in a slight drift on both sides. In the case of type, determine the maximum value ( ) and the second largest value ( The corresponding working channel has a clear error, the second smallest value ( ) and minimum value ( A suspicious anomaly occurred in the corresponding working channel, and the output adopted the health memory value. .

[0160] If the second smallest value is satisfied ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. At the same time, the minimum value was not satisfied ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now At this point, determine the second smallest value ( The corresponding working channel is operating normally, with a maximum value of ( ). ), second largest value ( ) and minimum value ( A clear error occurred in the corresponding working channel, and the output adopted the second smallest value. ) and health memory value The channel-weighted average is .

[0161] If the second smallest value ( ) and health memory value The absolute value of the difference is greater than the channel data threshold. ,Right now Then proceed to step (D).

[0162] Step (D), if the minimum value ( ) and health memory value The absolute value of the difference is less than or equal to the channel data threshold. ,Right now Then determine the minimum value ( The corresponding working channel is operating normally, with a maximum value of ( ). ), second largest value ( ) and the second smallest value ( A clear error occurred in the corresponding working channel, and the output adopted the minimum value. ) and health memory value The channel-weighted average, i.e. .

[0163] If the minimum value ( ) and health memory value The absolute value of the difference is greater than the channel data threshold. ,Right now If all four working channels have a clear error, the output will use the health memory value. .

[0164] This invention is a multi-level fault-tolerant voting method for flight control systems designed to address singular faults. The problems it aims to solve include singular faults, majority fault prevention, insufficient single-channel reliability, and incomplete channel health assessment. The simulation process of this invention is implemented using MATLAB (version 9.8.0) and its Simulink module, a simulation platform running on a computer. MATLAB is a high-level technical computing language and interactive development environment for scientific and engineering computing, possessing functions such as algorithm design, data visualization, signal processing, and numerical analysis. Using its Simulink module, simulation models of various dynamic systems can be built and run in a graphical modeling environment, thereby verifying and evaluating the technical solution of this invention.

[0165] The fault-tolerant voting method of this invention covers one to four redundancies. The input reference uses a sine wave with a period of 8s and an amplitude of 1, and white noise with a variance of 0.0009 is added. The sampling period is 0.01s. For easy differentiation, the signal values ​​of the four channels are multiplied by 0.96, 0.99, 1.02, and 1.05 respectively. In addition, the risk threshold is set to 3, and the health memory threshold and channel data threshold under the four working redundancy numbers are set to 0.15 and 0.10 respectively.

[0166] Example 1: Step-by-step degradation process from quadruple redundancy to single channel

[0167] In Example 1, pulse signals were superimposed on the data from the four working channels to simulate faults occurring during the operation of the fly-by-wire control system. Specifically, pulses with a period of 2 seconds, a duration of 0.4 seconds, and an amplitude of 0.2 were superimposed on the first working channel; pulses with a period of 2.5 seconds, a duration of 0.01 seconds, and an amplitude of 0.5 were superimposed on the second working channel; pulses with a period of 4 seconds, a duration of 0.4 seconds, and an amplitude of 0.2 were superimposed on the third working channel; and pulses with a period of 8 seconds, a duration of 0.4 seconds, and an amplitude of 0.2 were superimposed on the fourth working channel. The simulation results of this example are as follows: Figure 11 As shown. Among them, Figure 11 (a) represents the input signals for each channel. The blue, orange, yellow, and purple lines represent the signals of the first working channel, the second working channel, the third working channel, and the fourth working channel, respectively. Figure 11 (b) represents the result signal after processing by the multi-level fault-tolerant voting algorithm proposed in this invention. Figure 11 (c) indicates the working status of each channel during the voting process.

[0168] Step 1: Assess the health status of the channel and determine the current operational margin;

[0169] At the start of each cycle, the health status of each channel is assessed to identify any faulty channels and determine the current cycle's workload. Figure 11 (c) It can be seen that the channel health status and working margin determination unit detects a fault in the first working channel after 2 seconds and isolates it, and the current working margin number is reduced from four to three; the channel health status and working margin determination unit detects a fault in the third working channel after 4 seconds and isolates it, and the current working margin number is further reduced to two; the channel health status and working margin determination unit detects a fault in the fourth working channel after 8 seconds and isolates it, and the current working margin number is reduced to one.

[0170] Step 2: Multi-level fault-tolerant voting based on current workload margin;

[0171] Based on the current cycle working redundancy determined in step one, the multi-level fault-tolerant voting logic execution unit sequentially executes the corresponding fault-tolerant voting strategies under the four-redundancy, three-redundancy, two-redundancy, and single-channel states. Figure 11 (b) As can be seen, when the first, third, and fourth working channels experience sequential failures, and the second working channel experiences a short-term pulse disturbance, the multi-level fault-tolerant voting logic execution unit can effectively suppress the impact of abnormal data on the final output result, avoiding significant erroneous output. The final fault-tolerant voting output result maintains a good sinusoidal trend, indicating that the method proposed in this invention can maintain stable output under conditions of continuous multi-channel failures and short-term abnormal disturbances, verifying the effectiveness of channel health status assessment, working margin determination, and multi-level fault-tolerant voting function.

[0172] Example 2, Type and Type of unusual fault conditions

[0173] In Example 2, different fault scenarios are simulated by changing the pulses superimposed on the input signals of each working channel. Specifically, the pulse signals superimposed on the first and third working channels are adjusted to have a period of 2 seconds, a duration of 0.4 seconds, and an amplitude of 0.2, with the remaining settings identical to Example 1. With these settings, the input signals of the four working channels form a signal after the second second. A type of peculiar fault forms after 8 seconds. Type-specific fault. The simulation results of this embodiment are as follows: Figure 12 As shown. Among them, Figure 12 (a) represents the input signals for each channel. The blue, orange, yellow, and purple lines represent the signals of the first working channel, the second working channel, the third working channel, and the fourth working channel, respectively.

[0174] Step 1: Assess the health status of the channel and determine the current operational margin;

[0175] At the start of each cycle, the health status of each channel is assessed to identify any faulty channels and determine the current cycle's workload. Figure 12 (c) It can be seen that the channel health status and working margin determination unit detects and isolates the first working channel and the third working channel after 2 seconds, and the current working margin number is reduced from four to two; the channel health status and working margin determination unit detects and isolates the fourth working channel after 8 seconds, and the current working margin number is further reduced to one.

[0176] Step 2: Multi-level fault-tolerant voting based on current workload margin;

[0177] Based on the current cycle redundancy determined in step one, the multi-level fault-tolerant voting logic execution unit sequentially executes the corresponding fault-tolerant voting strategies under the four-redundancy, dual-redundancy, and single-channel states. Figure 12 (b) It can be seen that the multi-level fault-tolerant voting logic execution unit appears in the 2nd second. A strange glitch occurred at the 8th second. When a singular fault occurs, the correct vote is made and the fault channel is effectively isolated, maintaining the reliability and stability of the output results. This verifies the ability of the proposed method to identify and handle singular faults.

[0178] Example 3, Type of unusual fault conditions

[0179] In Example 3, the pulse parameters superimposed on the input signals of each channel are further modified based on Example 2. Specifically, the amplitude of the pulse signal superimposed on the first working channel is adjusted to 0.4, and the pulse signal superimposed on the fourth working channel is adjusted to have a period of 2 seconds, a duration of 0.4 seconds, and an amplitude of -0.2. The remaining settings are the same as in Example 2. With the above settings, the input signals of the four working channels are formed after the second second. Type-specific fault. The simulation results of this embodiment are as follows: Figure 13 As shown. Among them, Figure 13 (a) represents the input signals for each channel. The blue, orange, yellow, and purple lines represent the signals of the first working channel, the second working channel, the third working channel, and the fourth working channel, respectively.

[0180] Step 1: Assess the health status of the channel and determine the current operational margin;

[0181] At the start of each cycle, the health status of each channel is assessed to identify any faulty channels and determine the current cycle's workload. Figure 13 (c) It can be seen that the channel health status and working margin determination unit detects and isolates the first working channel, the third working channel and the fourth working channel after 2 seconds, and the current working margin number is reduced from four to one.

[0182] Step 2: Multi-level fault-tolerant voting based on current workload margin;

[0183] Based on the current cycle redundancy determined in step one, the multi-level fault-tolerant voting logic execution unit sequentially executes the fault-tolerant voting strategies corresponding to the four-redundancy and single-channel states. Figure 13 (b) It can be seen that the multi-level fault-tolerant voting logic execution unit appears in the 2nd second. The method can correctly output and isolate the faulty channel during a singular fault. It continues to output stable and reliable results even after the working margin is reduced to one, further verifying the fault-tolerant processing capability of the proposed method under complex singular fault conditions.

[0184] Example 4, Type of unusual fault conditions

[0185] In Example 4, the pulse parameters superimposed on the input signals of each channel are further modified based on Example 3. Specifically, the timing of the pulse signal superimposed on the first working channel is adjusted to the time at the start of the simulation; the remaining settings are the same as in Example 2. With these settings, the input signals of the four working channels are formed after the second second. Type-specific fault. The simulation results of this embodiment are as follows: Figure 14 As shown. Among them, Figure 14 (a) represents the input signals for each channel. The blue, orange, yellow, and purple lines represent the signals of the first working channel, the second working channel, the third working channel, and the fourth working channel, respectively.

[0186] Step 1: Assess the health status of the channel and determine the current operational margin;

[0187] At the start of each cycle, the health status of each channel is assessed to identify any faulty channels and determine the current cycle's workload. Figure 14 (c) It can be seen that the channel health status and working margin determination unit detected a fault in the first working channel and isolated it at the beginning of the simulation, and the current working margin number was reduced from four to three; the channel health status and working margin determination unit detected a fault in the third and fourth working channels after 2 seconds and isolated them, and the current working margin number was further reduced to one.

[0188] Step 2: Multi-level fault-tolerant voting based on current workload margin;

[0189] Based on the current cycle redundancy determined in step one, the multi-level fault-tolerant voting logic execution unit sequentially executes the corresponding fault-tolerant voting strategies under the four-redundancy, three-redundancy, and single-channel states. Figure 14 (b) It can be seen that when the first working channel fails in the initial stage of the simulation, the multi-level fault-tolerant voting logic execution unit can still maintain correct output; after 2 seconds, the fault occurs... After a singular fault, the multi-level fault-tolerant voting logic execution unit can complete the correct voting and identify and isolate the faulty channel. Even after the working margin is reduced to one, the multi-level fault-tolerant voting logic execution unit can still continuously generate stable and reliable outputs, further verifying the fault-tolerant processing capability of the proposed method under complex singular fault conditions.

[0190] Simulations of different singular fault states were conducted using Examples 2, 3, and 4. The results show that the method proposed in this invention can effectively cope with various singular fault states, correctly identify and isolate fault channels, and maintain stable and reliable fault-tolerant voting output, thereby verifying the effectiveness of the multi-level fault-tolerant voting method under singular fault conditions.

[0191] Example 5: Simultaneous Failure of Multiple Channels

[0192] In Example 5, pulse signals with a period of 2 seconds, a duration of 0.4 seconds, and an amplitude of 0.2 are superimposed on the first, third, and fourth working channels, respectively. With this configuration, the input signals of the four working channels form a signal after the second second. This describes a multi-channel simultaneous fault state. The simulation results of this embodiment are as follows: Figure 15 As shown. Among them, Figure 15 (a) represents the input signals for each channel. The blue, orange, yellow, and purple lines represent the signals of the first working channel, the second working channel, the third working channel, and the fourth working channel, respectively.

[0193] Step 1: Assess the health status of the channel and determine the current operational margin;

[0194] At the start of each cycle, the health status of each channel is assessed to identify any faulty channels and determine the current cycle's workload. Figure 15 (c) It can be seen that the channel health status and working margin determination unit detects and isolates the first working channel, the third working channel and the fourth working channel after 2 seconds, and the current working margin number is reduced from four to one.

[0195] Step 2: Multi-level fault-tolerant voting based on current workload margin;

[0196] Based on the current cycle redundancy determined in step one, the multi-level fault-tolerant voting logic execution unit sequentially executes the fault-tolerant voting strategies corresponding to the four-redundancy and single-channel states. Figure 15 (b) It can be seen that it appears after 2 seconds. When multiple channels fail simultaneously, the multi-level fault-tolerant voting logic execution unit identifies the faulty channel through verification and selects the correct output result, thereby verifying that the method proposed in this invention has the function of preventing simultaneous failure of multiple channels.

Claims

1. A multi-level fault-tolerant voting method for flight control systems accommodating singular faults. Because different flight requirements necessitate different stability enhancement functions, the redundancy structure of fly-by-wire control systems also varies. This method addresses the issue of multi-redundancy voting algorithms failing in singular fault handling, prevention of simultaneous faults in multiple channels, single-channel operational assurance, health assessment, and dynamic weight allocation, leading to channel voting failures. Its features include: A multi-level fault-tolerant voting method for flight control is proposed for singular faults. The method includes: channel health status assessment and current working margin determination steps, and multi-level fault-tolerant voting based on the current working margin. The aforementioned channel health status assessment and current working margin determination assess the health status of each channel, identify whether there are faulty channels, and determine the number of working margins for the current cycle based on the operating status of each channel. The multi-level fault-tolerant voting based on the current working redundancy selects the corresponding redundancy voting algorithm according to the different redundancy levels. Under the conditions of each level, the consistency of data in each channel is first determined and a data consistency group is formed. Then, the consistency group is compared and verified with the health memory value. Finally, the voting result of the current period is generated by combining dynamic weight calculation. In the case of a single channel, the output data of the channel is compared with the health memory value to determine the reliability of the data. If the data is reliable, the weighted average of the data and the health memory value is used as the output. If the data is unreliable, the health memory value is used as the output and the risk level of the channel is increased. In the case of dual redundancy, the difference between the two channel data is calculated and the absolute value is compared with a preset data threshold to classify the data cases. For non-singular fault cases, the consistent group data is compared with the health memory value for verification to prevent majority faults. If the verification passes, the weighted average of the two channel data is used as the output; if the verification fails, the health memory value is used as the output. For singular fault cases, the health memory value is introduced as a virtual redundancy, and the consistency between the data of each channel and the health memory value is compared to determine the voting result output. In the case of triple redundancy, the data of the three channels are sorted and then divided for consistency. For non-singular fault cases, the majority of faults are reviewed first, and the output is determined based on the review results. For singular fault cases, a health memory value is introduced as a virtual redundancy auxiliary judgment. The consistency between the data of each channel and the health memory value is compared respectively, and the voting result is determined accordingly. In the case of four redundancy, the data of the four channels are sorted and then divided for consistency. For non-singular fault cases, the majority of faults are reviewed first, and the output is determined based on the review results. For singular fault cases, a health memory value is introduced as a virtual redundancy auxiliary judgment. The consistency of each data group or each channel data with the health memory value is compared respectively, and the voting result is determined accordingly.

2. The multi-level fault-tolerant voting method for flight control systems accommodating singular faults as described in claim 1, characterized in that, The specific method for assessing the health status of the channel is as follows: The channel health status and work margin determination unit sets an independent risk level parameter for each working channel. Within a single operating cycle, the channel is divided into three categories based on its output performance: clear error, suspected abnormality, and normal operation. Each category corresponds to a different risk level increase / decrease rule: when there is a clear error, the risk level increases by a first preset value; when there is a suspected abnormality, the risk level increases by a second preset value; and when the channel is operating normally, the risk level decreases by a third preset value. When the risk level of a certain channel exceeds the preset risk threshold, the channel is determined to be faulty, its working signal is forcibly set low and isolation operation is performed, and redundancy degradation processing is triggered at the same time.

3. The multi-level fault-tolerant voting method for flight control systems accommodating singular faults according to claim 1, characterized in that, The health memory value refers to the reliable voting output value obtained and saved by the channel health status and redundancy determination unit during the previous normal voting cycle; the virtual redundancy refers to the use of the saved health memory value as an additional reference channel in the voting operation during the current voting cycle; specifically, after the end of each non-singular fault cycle, the channel health status and redundancy determination unit saves the reliable output value of that cycle as the health memory value. When a singular fault is detected in the current cycle, the most recent health memory value is called as the virtual redundancy to participate in the voting. Using the virtual redundancy as a reference benchmark, the difference between each data group or channel data and the virtual redundancy is calculated. When the difference is less than a set threshold, the corresponding group or channel is determined to be healthy; otherwise, it is determined to be faulty.

4. The multi-level fault-tolerant voting method for flight control systems accommodating singular faults according to claim 1, characterized in that, The specific method of the review mechanism is as follows: After the initial voting in each cycle, the channel health status and redundancy determination unit compares the obtained data consistency group with the health memory value of the previous cycle; if the difference between the data consistency group and the health memory value is less than the preset memory threshold, the voting result is deemed credible and used as the final output; if the difference is greater than the preset memory threshold, it is determined that there is a situation where most channels are simultaneously faulty, and the voting value is not adopted. The channel health status and redundancy determination unit then makes a judgment on the remaining few channel data and the health memory value to determine the voting result output.

5. The multi-level fault-tolerant voting method for flight control systems accommodating singular faults according to claim 2, characterized in that, The specific method of dynamic weight allocation is as follows: for each working channel, its weight value is inversely proportional to the corresponding risk level, and the channel with the lower risk level has a larger weight in the voting; for the health memory value, its weight is decreasing with the maintenance period, and the longer the maintenance period, the lower the weight. When a new health memory value replaces the old value, the maintenance period is reset to zero, and the corresponding weight is restored to the initial state.

6. The multi-level fault-tolerant voting method for flight control systems accommodating singular faults according to claim 1, characterized in that, The specific method for data consistency partitioning under the four-redundancy condition is as follows: After sorting the data of the four channels from largest to smallest, first determine whether the absolute value of the difference between the maximum and minimum values ​​is less than or equal to the data threshold. If so, then partition the data into four channels. If not, then based on comparisons between the maximum and second-smallest values, the second-largest and minimum values, and the differences between adjacent data points, the data scenarios are divided into: , , or situation.

7. The multi-level fault-tolerant voting method for flight control systems accommodating singular faults according to claim 1, characterized in that, The specific method for data consistency partitioning under the triple redundancy condition is as follows: After sorting the data of the three channels from largest to smallest, first determine whether the absolute value of the difference between the maximum and minimum values ​​is less than or equal to the data threshold. If so, then partition the data into three channels. If not, then classify the data cases by comparing the absolute value of the difference between the maximum and median values, and between the median and minimum values, and the data threshold. or situation.

8. The multi-level fault-tolerant voting method for flight control systems accommodating singular faults according to any one of claims 1 to 7, characterized in that, The method is applied to the input voting stage of the fly-by-wire control system, corresponding to redundancy voting. This redundancy voting includes one to four sensor input channels. Each input channel performs parallel measurement or preprocessing of the same flight state parameter, and sends the obtained multi-channel input data to the channel health status and redundancy determination unit for consistency judgment, fault-tolerant voting, and result output.

9. A multi-level fault-tolerant voting system for flight control accommodating singular faults. Because the stability enhancement functions differ depending on the flight requirements, the redundancy structure of the fly-by-wire control system also varies. This system aims to address the issue of channel voting failure caused by the multi-redundancy voting algorithm in singular fault handling, prevention of simultaneous faults in multiple channels, single-channel operational assurance, health assessment, and dynamic weight allocation. Its features include: A multi-level fault-tolerant voting system for flight control designed to handle singular faults is embedded in the fly-by-wire control system. It includes: a channel health status and working margin determination unit and a multi-level fault-tolerant voting logic execution unit; The channel health status and working margin determination unit consists of a channel health status assessment module and a current cycle working margin determination module; wherein, the channel health status assessment module is used to assess the health status of each channel of the same type of sensor and identify whether there is a faulty channel; the current cycle working margin determination module determines the number of working margins for the current cycle based on the operating status of each channel. The multi-level fault-tolerant voting logic execution unit is used to select the corresponding channel voting algorithm according to the different redundancy levels. Under the conditions of each level, it first determines the consistency of the data of each channel and forms a data consistency group. Then, it compares and verifies the consistency group with the health memory value. Finally, it combines dynamic weight calculation to generate the voting result of the current period and outputs it to the telecontrol system.

10. The multi-level fault-tolerant voting system for flight control oriented towards singular faults according to claim 9, characterized in that: The same type of sensor channel is designed with a quadruple redundancy structure.

Images