Master-slave CPU board for flight control system

Abstract

The utility model provides a master-slave CPU board for a flight control system. The master-slave CPU board comprises a bottom board and a bottom board bus interface located on one side of the bottom board. A master CPU module, a slave CPU module and an FPGA module are attached to the bottom plate; the backplane bus interface comprises an ISA (Industrial Standard Architecture) interface bus and two paths of CAN (Controller Area Network) interface buses; the master CPU module and the slave CPU module are symmetrically arranged; the state lamp LED module, the two-way expansion serial port RS232 module, the NVRAM storage module, the RTC module and the temperature sensor module are in communication connection with the FPGA module, a fault-tolerant backup mechanism is added for a CPU, the defect that an existing single-channel flight control computer is insufficient in reliability is overcome, meanwhile, the redundancy function of the fault-tolerant flight control computer is achieved, and the reliability of the single-channel flight control computer is improved. Compared with a traditional fault-tolerant flight control computer, the production cost and the software maintenance cost are reduced, and the unmanned aerial vehicle flight control system can be popularized to any unmanned aerial vehicle with the mass being 100 kg or above in the market due to the miniaturization and expandability design.

Description

[Technical field]

[0001] The utility model relates to the technical field of master-slave CPU boards, and in particular to a master-slave CPU board that has high reliability, scalability, and stability, can provide a control system with advanced performance and confidentiality, can be directly applied to flight control and management of aircraft, and is suitable for various types of medium and large unmanned aerial vehicles. [Background Technology]

[0002] With the rapid development of drone technology, modern drone flight control systems are becoming increasingly complex. These systems consist of three components: sensors, flight control computers, and actuators. Modern warfare demands that drones maintain long flight times, fly at high altitudes, and perform multiple missions. This complexity, in turn, significantly increases the probability of flight control system failures during missions.

[0003] For example, in the event of flight control computer failure, sensor failure, or actuator failure, drones generally do not have additional redundant backups for sensors and actuators due to limited space inside the cabin. Moreover, the flight control computer is the core component of the flight control system, responsible for important tasks such as mission management, control rate calculation, sensor data collection, and actuator control. Therefore, if you want to improve the reliability of the flight control system, improving the reliability of the flight control computer is of paramount importance.

[0004] As single-channel flight control computers have matured, fault-tolerant computers with higher reliability are also in a stage of rapid development.

[0005] The flight control computers of high-end drones worldwide now all utilize fault-tolerant technology. The US Global Hawk, a high-altitude, long-endurance, unmanned reconnaissance aircraft, employs a dual-redundant flight control computer. Europe's latest-generation unmanned reconnaissance aircraft, the Barrakuda, and Israel's fourth-generation Heron both utilize triple-redundant flight control computers. For example, the Boeing 777's flight control computer utilizes a 3×3 redundant architecture with three identical primary flight control computer (PFC) channels. Each channel consists of three non-similar branches: a command branch, a backup branch, and a monitoring branch. Each branch utilizes a different processor and has distinct peripheral circuits and hardware interfaces to mitigate common-mode failures. The PFC and bus are divided into three groups: left, center, and right. The PFC can monitor all three bus groups simultaneously, but can only transmit data to buses in the same group. Therefore, a bus failure in one group does not affect the operation of the other two.

[0006] Northwestern Polytechnical University in China adopts a homogeneous three-channel hot backup fault-tolerant structure, and through the system's voting, shielding, diagnosis, reconstruction and other fault-tolerant logic, it has realized a triple-redundant flight control computer; in addition, there is a fault-tolerant solution based on "hardware similarity, software dissimilarity", which adopts a dual redundant structure to realize a two-module redundant flight control computer that can solve common faults related to software design. The Flight Control Research Institute of Nanjing University of Aeronautics and Astronautics has developed a fault-tolerant flight control computer with a "four CPU, dual IO channel" structure.

[0007] The fault-tolerant flight control computer consists of four central processing units, two serial interface units, two analog interface units and two switch interface units. It adopts similar redundancy, and the hardware configuration of all units with the same function is the same. Internal data communication is realized by using a four-way CAN bus. To balance the bus load, two channels are used as upstream buses (sent by the interface unit and received by the central processing unit), and two channels are used as downstream buses (sent by the central processing unit and received by the interface unit). The same-role buses and each interface unit adopt a master-slave working mode. The central processing unit receives sensor data from the main interface unit through a dual-redundant CAN bus, and then performs control logic operations. Redundancy management is realized through the cross data link composed of the CAN bus, including task synchronization, signal monitoring voting, fault detection and diagnosis, etc. Finally, the main central processing unit is selected according to the voting results, and outputs instructions to the actuator obtained by the downstream control logic operation of the interface unit.

[0008] The above-mentioned fault-tolerant flight control computers all adopt the comparative monitoring redundancy model of "synchronization + voting". However, for distributed systems, not only is the production cost high and difficult to promote, but the synchronization process will also bring a large amount of software logic overhead, increase software complexity and maintenance costs, and thus reduce the reliability of the system to a certain extent. [Utility Model Content]

[0009] The problems existing in the prior art that this application solves are:

[0010] Traditional fault-tolerant flight control computers all use a "synchronization + voting" comparative monitoring redundancy model. However, for distributed systems, not only is the production cost high and difficult to promote, but the synchronization process will also bring a large amount of software logic overhead, increasing software complexity and maintenance costs, thereby reducing system reliability to a certain extent.

[0011] The solution to the technical problem solved by this utility model is:

[0012] Provided is a master-slave CPU board for a flight control system, comprising a baseboard and a baseboard bus interface located on one side of the baseboard; a master CPU module, a slave CPU module, and an FPGA module are attached to the baseboard; the baseboard bus interface comprises an ISA interface bus and a two-way CAN interface bus; the master CPU module and the slave CPU module are symmetrically arranged; and further comprising a status light LED module communicatively connected to the FPGA module, a two-way extended serial port RS232 module, an NVRAM storage module, an RTC module, and a temperature sensor module.

[0013] Preferably, the size of the base plate is 117mm*109mm; the plate thickness is 2mm.

[0014] The technical effects of this application in solving the technical problem are as follows:

[0015] Compared with the existing technology, the master-slave CPU board for the flight control system of the utility model adds a fault-tolerant backup mechanism for the CPU, which solves the shortcoming of insufficient reliability of the existing single-channel flight control machine, and also realizes the redundancy function of the fault-tolerant flight control computer. Compared with the traditional fault-tolerant flight control computer, it reduces the production cost and software maintenance cost, and its miniaturized and scalable design can be extended to any drone with a mass of more than 100 kg on the market. [Brief Description of the Drawings]

[0016] Figure 1 The utility model is a three-dimensional structural diagram of a master and slave CPU board used in a flight control system.

[0017] Figure 2 The utility model discloses a fault-tolerant backup block diagram of a master-slave CPU board for a flight control system.

[0018] Figure 3 The utility model is a counter logic block diagram of a master-slave CPU board used in a flight control system. [Specific implementation method]

[0019] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0020] See also Figures 1 to 3The present invention provides a master-slave CPU board 1 for a flight control system, comprising a baseboard 11 and a baseboard bus interface 15 located on one side of the baseboard 11; a master CPU module 12, a slave CPU module 13, and an FPGA module 14 are attached to the baseboard 11; the baseboard bus interface 15 includes an ISA interface bus and a two-way CAN interface bus; the master CPU module 12 and the slave CPU module 13 are symmetrically arranged; and the board also includes a status light LED module, a two-way extended serial port RS232 module, an NVRAM storage module, an RTC module, and a temperature sensor module, which are communicatively connected to the FPGA module 14.

[0021] Furthermore, the size of the bottom plate 11 is 117 mm*109 mm, and the thickness is 2 mm.

[0022] This patent proposes a new master-slave CPU board for flight control systems. It adds a fault-tolerant backup mechanism to the CPU, solving the reliability issues of existing single-channel flight control computers while also achieving redundancy for fault-tolerant flight control computers. Compared to traditional fault-tolerant flight control computers, it reduces production and software maintenance costs. Its miniaturized and scalable design can be applied to any drone weighing more than 100kg on the market.

[0023] The board consists of three relatively independent systems: CPUA minimum system, CPUB minimum system, and public resource system. The CPUA minimum system and CPUB minimum system are identical and can communicate via the ISA bus and 2-way CAN bus through the backplane.

[0024] The CPU board adopts the master-slave CPU symmetrical design technology. The identification flags, control words and status words of the master and slave CPUs are exactly the same. Therefore, the master and slave CPUs can implement exactly the same application programs. This feature greatly simplifies application development and maintenance.

[0025] The board uses a single switching logic rule, combined with safe switching operations, to ensure the safety and reliability of switching between the master and slave CPUs. Common resources include: status lights (LEDs), two expansion serial ports (RS232), two CAN buses, NVRAM (128KB each), RTC, EEPROM, and a temperature sensor. A single board can also implement basic external communication control functions, and common resources are accessible when the CPU takes over the bus.

[0026] Compared with the fault-tolerant flight control computer, its scalability is enhanced. In theory, n function boards can be expanded through the baseboard PC104 bus.

[0027] Its hardware structure is simpler, smaller in size and lighter in weight;

[0028] Low production cost, small software logic overhead, and strong maintainability;

[0029] Both the base plate and the plug have a dual-channel CAN communication redundancy design to improve reliability;

[0030] Adaptable to various types of drones and has high promotion capabilities;

[0031] Counter logic description:

[0032] The FPGA implements three sets of heartbeat counters for CPUA and three sets of heartbeat counters for CPUB respectively. CPUA can refresh its three sets of heartbeat counters. Each time it refreshes, the counter increases by 1, and it can read the count values of CPUB's three sets of heartbeat counters at the same time. CPUB can refresh its three sets of heartbeat counters. Each time it refreshes, the counter increases by 1, and it can read the count values of CPUA's three sets of heartbeat counters at the same time.

[0033] Bus monitoring logic description:

[0034] After power-on, the hardware determines the master / slave CPU selection jumper status. If jumper 0 (short-circuited): CPUA is the master CPU (working CPU) and CPUB is the slave CPU (monitoring CPU). At this time, CPUA reads the working mode as master mode, with the bus valid, while CPUB reads the working mode as slave mode, with the bus invalid. At the same time, the other CPU status word can be read from the monitoring register. If jumper 1 (disconnected): CPUA is the slave CPU (monitoring CPU) and CPUB is the master CPU (working). At this time, CPUA reads the working mode as slave mode, with the bus invalid, while CPUB reads the working mode as master mode, with the bus valid. At the same time, the other CPU status word can be read from the monitoring register.

[0035] When CPUA is the master CPU, it can access the bus, FRAM, RTC, and indicator light resources, while CPUB cannot. CPUB monitors CPUA's heartbeat counter to determine whether CPUA is operating normally. If it is not, it can issue a bus switch command. When the bus switch command takes effect, CPUB becomes the active CPU and owns the bus, while CPUA becomes the monitoring CPU. CPUA monitors CPUB's heartbeat counter to determine whether CPUB is operating normally. If it is not, it can issue a bus switch command. When the bus switch command takes effect, CPUA becomes the active CPU and owns the bus, while CPUB becomes the monitoring CPU.

[0036] The master / slave CPU selection jumper is used to define the initial state of the two CPUs. It only affects bus ownership at power-up. If a bus switching operation occurs, this jumper has no effect on bus ownership.

[0037] Safe switching from slave CPU to master CPU:

[0038] When a bus switching operation is performed from the CPU, in order to ensure the safety of the bus switching, the bus switching switch must be turned on before the bus switching operation can be performed.

[0039] After the slave CPU turns on the bus switch by writing the "slave CPU pre-bus switch control word", it is necessary to determine whether the "slave CPU pre-bus switch status word" is valid, that is, to check whether the bus switch is already turned on. Only after confirming that the bus switch is already turned on can the "slave CPU bus switch control word" be written to implement the bus switching operation. After the bus is switched, it can be confirmed by the "slave CPU bus status word". Only after confirmation can the bus operation be performed.

[0040] The pre-bus switching control word is like the "valve" of the bus switching control word; bus switching can only be implemented when this "valve" is open. Writing the pre-bus switching control word is equivalent to opening the "valve," and the pre-bus switching status word is equivalent to the "valve open" state. For safety reasons, the following restrictions are imposed on this "valve": ① The "valve" must be opened for a full 50ms after the "valve" is opened; ② The "valve" remains open for only 500ms, after which it automatically closes; ③ After completing the bus switching control operation, the "valve" can be prematurely terminated by writing to it.

[0041] The technical effects of this application in solving the technical problem are as follows:

[0042] Compared with the existing technology, the utility model of a master-slave CPU board 1 for a flight control system adds a fault-tolerant backup mechanism to the CPU, which solves the shortcoming of insufficient reliability of the existing single-channel flight control machine, and also realizes the redundancy function of the fault-tolerant flight control computer. Compared with the traditional fault-tolerant flight control computer, it reduces the production cost and software maintenance cost, and its miniaturized and scalable design can be extended to any drone with a mass of more than 100 kg on the market.

[0043] The above-described embodiments of the present invention do not limit the scope of protection of the present invention. Any modifications, equivalent replacements, and improvements made within the spirit and principles of the present invention shall be included in the scope of protection of the claims of the present invention.

Claims

1. A master-slave CPU board for a flight control system, characterized by: The system comprises a baseboard and a baseboard bus interface located on one side of the baseboard; a master CPU module, a slave CPU module and an FPGA module are attached to the baseboard; the baseboard bus interface comprises an ISA interface bus and a 2-way CAN interface bus; the master CPU module and the slave CPU module are symmetrically arranged; the system also comprises a status light LED module connected to the FPGA module for communication, a 2-way extended serial port RS232 module, an NVRAM storage module, an RTC module and a temperature sensor module; the baseboard has a size of 117mm*109mm and a thickness of 2mm.

Images