Coupling method for redundant servo devices of an actuator control system, associated system and device

Abstract

The invention relates to a system (30) for controlling an actuator (TS) comprising several redundant servo-control devices (FC-1, FC-2, FC-3) producing values ​​of the same quantity (, and ) from the same setpoint (Gsp) and the same measurement data (Gs1, Gs2, Gs3), said redundant servo-control devices (FC-1, FC-2, FC-3) being furthermore mutually in communication (B) so that each redundant servo-control device (FC-1, FC-2, FC-3) accesses in reading the last values ​​of said quantity (, , ) produced by said redundant servo-control devices and implements a method for correcting their respective productions by coupling. The invention thus prevents any divergence of the latter (, , ). Such a system (30) may equip a vehicle with a load consisting of a driver, a passenger and / or goods or merchandise comprising one or more actuators thus controlled. Figure to be published with the abstract: Fig 5

Description

Title of the invention: Coupling method for redundant servo devices of an actuator control system, associated system and device

[0001] The invention relates to the field of actuator control systems. The term "control system" means any system designed to reach a setpoint value as quickly as possible and maintain it regardless of the disturbances caused by the system's environment as far as possible. The invention relates more particularly to the field of such control systems when the latter are said to be "redundant" or "multiple redundant" to be used for example in land, water or air vehicles. The invention will be described mainly, without this giving rise to any limitation to the present invention, in the context of the flight control of an aircraft, whether a pilot is present in said aircraft or remote from it as may be the case for a drone.Such an aircraft generally takes the form of a propulsion device, preferably but not limited to vertical propulsion, adapted or arranged to ensure the elevation and movement of a load, whether it consists of a pilot, one or more human or animal passengers and / or one or more solid or fluid goods for which the propulsion device would ensure the transport.

[0002] The principle of a control of a quantity or a characteristic thereof generally consists of measuring said quantity produced by a system and comparing it to a setpoint value. In order for said produced quantity to reach the target value determined by the setpoint value as quickly as possible and then to be maintained, said setpoint is corrected in light of the difference between the value produced by the system and said setpoint value. Some control systems by control act on one or more characteristics of such a controlled quantity such as position, speed or acceleration. Such systems are for this reason sometimes referred to as "negative feedback" or "counter-reaction" or "closed loop" control systems. It is also possible to control different quantities and / or characteristics of the latter to ultimately produce a command for an actuator.The concepts of stability and precision are often antagonistic to the concept of speed. To improve the performance of a control system, it is generally necessary to add a corrector in the control loop. There are different types of correctors whose action can be integral, derivative and / or proportional to the measured difference between quantities. controlled and setpoint. We then speak of a "PID corrector", an acronym for "Proportional, Integral, Derivative". Such a regulator is configured using gains or coefficients to weight the corrective actions respectively proportional to said deviation, to the integral and to the derivative of the latter. The action that we can call "proportional" contributes directly to the responsiveness and stability of the control. The "integral" action makes it possible to erase a residual error and brings precision to the system and the "derivative" action makes it possible to limit oscillations around the setpoint of the controlled quantity.

[0003] Furthermore, depending on the reliability sought, in particular for constituting systems used in land, maritime, aeronautical and / or space transport, such servo systems may have multiple redundancy and require a plurality of arbitration devices for such multiple redundancy.

[0004] In engineering, the concept of "redundancy" consists of the duplication of critical components or functions of a system in order to increase the reliability of said system. When the safety of potential passengers is at stake, as may be the case during an aircraft flight, certain parts of a control system of the latter may be doubled or tripled, this is then referred to as a double or triple redundancy system. Thus, an error generated by an element linked for example to a malfunction or a drift in performance of said element can then be cancelled or compensated by the use of one or more other redundant elements. A multiple redundancy system is also known as a "voting / majority logic system" or "voting logic system" to use multiple productions of the same quantity in order to control an actuator for example.

[0005] There are several operating modes for a servo-control system for a multiple redundancy actuator. Let us take the example of a control system for an actuator using three similar servo-control systems, called "even systems" or "redundant systems", producing respectively, that is to say in parallel with each other, quantities which must reflect the same setpoint value. The control of the actuator is ultimately produced from a single or several quantities produced by said redundant systems. According to a first known operating mode, the control of such an actuator is produced from a quantity produced by one of the three servo-control systems, which is sometimes referred to as the "master".It is only when it is observed that said master is malfunctioning, such a malfunction being able to be detected by too large a difference between the quantity delivered by said master and the average of the quantities delivered respectively by its peers, that the control system or an operator of said control system elects a new master from among these redundant servo systems to replace the previous one. This solution can become suboptimal when the . values ​​of the controlled quantity produced respectively by the redundant control systems diverge. The reassignment of a master system, when the three redundant control systems express quantities of very disparate values, becomes delicate because it is no longer possible to judge a possible malfunction or drift of said current master if no consensus appears among the other redundant systems. Other techniques consist of calculating the average of the quantities produced respectively by the redundant control systems and producing an actuator command from said average. This second embodiment is sometimes problematic, particularly when one of the systems delivers a quantity whose value deviates very significantly from those produced by its peers.In fact, the average obtained suffers from the clear drift of said faulty system, itself becoming very far from a relevant value to ultimately produce a suitable actuator command.

[0006] The invention makes it possible to resolve the drawbacks previously expressed. Among the numerous advantages provided by the implementation of the invention, we can mention: - automatic correction of the production of a servo device with respect to those of peer servo devices within a multiple redundancy control system prevents the risk of divergence of productions and increases the relevance of the latter; - the distribution within a control system of the arbitration and / or correction of redundant productions makes the latter more reliable without generating complexity or hampering the responsiveness of the actuator control production; - a fine and adaptive correction of redundant productions with regard to the characteristics of the signals or data produced, improving the precision and relevance of the commands generated without affecting the responsiveness, increasing the cost and complexity of a system implementing the invention; - the recommendation of the median to take into account the respective productions of at least three redundant servo devices and the latencies generated by the sharing of information between said redundant servo devices, provides a particularly relevant compromise when producing aberrant or divergent values.

[0007] To this end, the invention provides a method implemented by a processing unit of a servo device among several redundant servo devices of an actuator control system, each redundant servo device respectively producing values ​​of the same quantity from the same setpoint and the same measurement data, said devices redundant servo positives being mutually in communication so that each redundant servo device accesses in reading the last values ​​of said quantity produced by said redundant servo devices.

[0008] To prevent any drift in the respective productions of the values ​​of the quantity, said method iteratively comprises: - a step of producing the quantity value from the setpoint and the measurement data; - a step of reading the last known values ​​of the quantity produced by the redundant control devices of said control system and of constituting a set of current values ​​of said quantity; - a step of determining a reference value of said quantity taken from said set; - a step of calculating a difference between the current value of the quantity produced and said reference value; - a step of producing a current value corrected for the quantity produced consisting of implementing an operation of subtracting a correction consisting of said difference multiplied by a correction coefficient of said current value.

[0009] To increase the relevance of the value of the quantity produced, when said control system comprises at least three redundant servo devices capable of producing such a value of said quantity, the step of determining the reference value advantageously consists of choosing the median of the values ​​of all the current values ​​of the quantity.

[0010] Alternatively, when said control system comprises only two redundant servo devices capable of producing such a value of said quantity, the step of determining the reference value may consist of choosing one of the values ​​from the set of current values ​​of the quantity.

[0011] To define the coupling of the production of the redundant servo devices, the value of the correction coefficient can be predetermined.

[0012] Alternatively, such coupling may be dynamic. For this, a method according to the invention may comprise a step of recording the current or corrected value of the quantity produced in a data memory of the servo-control device to constitute a history of a determined number of values. Such a method then comprises, prior to the correction step, a step of producing the value of the correction coefficient which is a function of the variability of the values ​​taken from said history and of the iteration frequency of the step of reading the last known values ​​of the quantity produced by the redundant servo-control devices.

[0013] Furthermore, to prevent any sudden correction, or even to soften the process of correcting the production of the values ​​of the quantity, the calculation of the value of the correction is arranged so that said value of the correction does not exceed in absolute value a predetermined limit value.

[0014] According to a preferred embodiment according to which the redundant servo-control devices each comprise a PID corrector delivering three components of an output signal describing respectively a proportional action, an integral action and a derivative action, the quantity may consist of the component describing said integral action of said PID corrector.

[0015] To increase the reliability of an actuator control system, the latter may comprise redundant sources arranged to jointly deliver a plurality of setpoint values. A method according to the invention may advantageously comprise a step for producing the setpoint so that it takes as its value: - one of the values ​​of said plurality of values ​​when the control system comprises only two redundant sources; - the median of said plurality of values ​​when said control system comprises at least three redundant sources.

[0016] To increase the reliability of an actuator control system, the latter may comprise redundant sources arranged to jointly deliver a plurality of measurement data values. A method according to the invention may advantageously comprise a step for producing the measurement data so that the latter takes the value: - one of the values ​​of said plurality of values ​​when the control system comprises only two redundant sources; - the median of said plurality of values ​​when the control system comprises at least three redundant sources.

[0017] According to a second object, the invention relates to a servo-control device among several redundant servo-control devices of an actuator control system, said redundant servo-control devices each producing a value of the same quantity from the same setpoint and the same measurement data, said redundant servo-control devices being furthermore mutually in communication so that each servo-control device accesses in reading the last values ​​of said quantity produced by the redundant servo-control devices. Said servo-control device is arranged to implement a method according to the invention.

[0018] According to a third object, the invention relates to a system for controlling an actuator comprising several redundant servo devices in accordance with the preceding claim, said actuator control being produced from the plurality of values ​​of the quantity produced jointly by the redundant control devices.

[0019] According to an advantageous embodiment, said control system can be arranged so that said command can be produced from: - one of the values ​​of said plurality of values ​​of the quantity produced by the redundant servo devices when said plurality of values ​​comprises only two values; - the median of said plurality of values ​​of the quantity produced if said plurality of values ​​comprises at least three values.

[0020] According to a fourth object, the invention relates to a vehicle with a load consisting of a driver, a passenger and / or goods or merchandise comprising one or more actuators in the form of at least one thrust group for moving said vehicle, a command of which is produced by a control system according to the invention.

[0021] According to a preferred embodiment, such a vehicle may be an aircraft.

[0022] According to a fifth object, the invention further relates to a computer program product comprising one or more program instructions interpretable by a processing unit of a servo device among a plurality of redundant servo devices of a control system of an actuator according to the invention. For this, said program instructions are loadable into a non-volatile memory of the servo device and designed so that their execution by said processing unit causes the implementation of a method according to the invention.

[0023] According to a sixth object, the invention relates to a storage medium readable by such a processing unit comprising the instructions of such a computer program product.

[0024] Other characteristics and advantages will appear more clearly on reading the description which follows and on examining the figures which accompany it, among which:

[0025] [Fig. 1] illustrates a first known propulsion device, arranged to provide a substantially vertical take-off and landing capability;

[0026] [Fig.lA] illustrates the axes around which rotations determine the attitude and movements in space of an aircraft, in this case a propulsion device according to [Fig.l];

[0027] [Fig.2] illustrates the arrangement of a thrust system of such a known propulsion device and illustrated by Figures 1 and 1A;

[0028] [Fig.3] illustrates the arrangement of a command unit comprising a human-machine input interface for translating human instructions for piloting an aircraft, such as that described in connection with the preceding figures;

[0029] [Fig.3A] illustrates an example of possible interactions between a pilot and input members of a human-machine interface of a command unit of an aircraft according to [Fig.3];

[0030] [Fig.4] illustrates the example of a functional architecture of a flight controller intended to equip a drone;

[0031] [Fig.5] illustrates an example of functional architecture of a system according to the invention for controlling an actuator such as a thrust group of an aircraft comprising a plurality of redundant flight controllers and possibly similar to the flight controller illustrated by the previous figure;

[0032] [Fig.6] illustrates a functional description of an example of a method for correcting data produced by a servo-control device of an actuator control system such as that described by [Fig.5];

[0033] [Fig.7] illustrates a first remarkable contribution provided by the implementation of the invention in connection with the production of a pitch actuator command by a control system conforming to [Fig.5];

[0034] [Fig.7A] illustrates a second contribution provided by the implementation of the invention in connection with such pitch actuator control produced by a control system according to [Fig.5];

[0035] [Fig.8] illustrates the remarkable contribution provided by the implementation of the invention in connection with a roll actuator control produced by a control system also in accordance with said [Fig.5].

[0036] Let us preferentially but non-limitingly describe the invention through an example of application to the field of flight control of an aircraft or an aerodyne arranged to offer a substantially vertical takeoff and landing capability. As non-limiting examples, such a propulsion device may consist of a drone, a quadcopter or octocopter. Document EP 3495262 A1 describes an example of such a propulsion device. The invention cannot, however, be limited to these application examples alone and could, instead, be used in connection with any type of device for propelling a load, a pilot or a passenger.

[0037] According to the invention, such a vertical takeoff / landing aircraft is powered by a plurality of thrust groups. It differs from that taken from document EP3495262A1 in that the respective actuation commands of said thrust groups are produced by a multiple redundancy control system.

[0038] As indicated in [Fig.l], such an aircraft 10 allowing the elevation of a load carried by the latter according to the technical teaching taken from document EP 3495262 A1, consists of a quadricopter comprising support means 14 for propellers, said support means 14 being in the form of four arms describing an 'X' above a substantially flat platform 11. Each arm supports a system thrusters TSa, TSb, TSc, TSd each comprising a thrust group 12a, 12b, 12c, 12d composed of a thermal propellant in the form of a turbojet. To raise a load, not shown in [Fig.2], carried by the platform 11, the four thrust groups 12a, 12b, 12c, 12d respectively deliver thrust vectors AL12a, AL12b, AL12c, AL12d, substantially normal to the platform 11. To land without damaging the nozzles or fluid ejection outlets of the turbojets of the thrust groups 12a to 12d, the arms of the support means 14 of the thrust systems TSa, TSb, TSc and TSd cooperate, at their respective distal parts, with projecting means or advantageously telescopic feet 17.A control system 30, in the form of electronic processing means, delivers thrust commands to the thrust systems TSa, TSb, TSc, TSd, for example in the form of MIP signals (acronym for pulse-position modulation or PPM) according to a known modulation technique for transmitting on a “point-to-point” link a symbol of a plurality of bits in a single coded pulse from an alphabet of 2M possible transitions in time or any other appropriate format. The fluid outlets of the thrusters of the thrust systems are positioned above or below, substantially at the level of the center of gravity CG10 of the device 10 according to the configuration and arrangement of the support means 14.To modify and stabilize the attitude of the platform 11, each thrust system TSa to TSd comprises means 19a, 19b, 19c, 19d for correcting the thrust vectors AL12a, AL12b, AL12c, AL12d delivered respectively by the turbojets of the thrust groups 12a to 12d.

[0039] [Fig.2] illustrates the arrangement of such thrust vector correcting means 19a of the thrust group 12a of the thrust system TSa according to [Fig.l]. Said thrust vector correcting means 19a comprise a pair of deflector guides 19a-1 and 19a-5 mounted movably, more precisely via respective pivot links 19a-2 and 19a-6. Said deflector guides 19a-1 and 19a-5 are arranged to deflect all or part of the thrust vector AL12a at a region close to the fluid ejection outlet 12a-o of the turbojet engine 12a-e of the thrust group 12a. The deflector assembly composed of the deflector guides 19a-1 and 19a-5 thus makes it possible to describe a “pinching” of said thrust vector AL12a. The deflector guides 19a-1 and 19a-5 are advantageously actuated respectively by a pair of cam actuators or servomotors, of which only the actuator 19a-3 is visible in [Fig.l].Thus, the actuator 19a-3 cooperates via a connecting rod 19a-4 with the deflector guide 19a-1. The actuation of the cam of the actuator 19a-3 causes a rotary movement r of the deflector guide 19a-1 around the axis 19a-2 located above the fluid ejection region of the turbojet 12a, which reduces the torque required to . the actuator 19a-3 to overcome and resist the suction or rejection generated by the thrust vector AL 12a delivered by the turbojet 12a-e of the thrust group 12a during the closing and opening of the deflector guide 19a-1. When the cam actuators, such as the actuator 19a-3, associated respectively with the deflector guides 19a-1 and 19a-5 cause a pinching of the thrust vector AL12a by the latter, said thrust vector AL12a is subdivided downstream of said deflector guides into two or three components AL12a, AL12a', AL12a” depending on whether such or such deflector guide 19a-1 or 19a-5 penetrates or not the flow ejected at the fluid outlet 12a-o of the turbojet 12a-e. In an “open” configuration according to which the deflector guides 19a-1 and 19a-5 are positioned substantially outside the path of the thrust vector AL 12a, the force of said thrust vector AL 12a is maximum.On the other hand, when one of the two (or both) deflector guides 19a-1, 19a-5 “pinches” said thrust vector, the resulting thrust force of said thrust vector AL12a, downstream of said deflector guides 19a-1 and 19a-5, is reduced, to the point of being cancelled during a “total pinching” of said deflector guides 19a-1 and 19a-5 of the flow at the outlet of nozzle 12a-o of the turbojet. Depending on the arrangement of said deflector guides 19a-1 and 19a-5, the latter resembling in [Fig.3] two substantially curvilinear semi-circular cups or surfaces facing each other, it may result in the case of a "closed" configuration of the two guides 19a-1 and 19a-5, a counter-thrust, that is to say a thrust vector of a direction opposite to that of the thrust vector AL12a at the outlet of fluid ejections 12a-o. Such a counter-thrust, for example of the order of ten to thirty percent, may be made possible thanks to the morphology of said guides.Indeed, the latter can be arranged to respectively guide fluid flows causing at the outlet (distal parts) of said guides, secondary thrust vectors AL12a' and AL12a” oriented in directions substantially opposite to the direction of the original thrust vector AL12a at the outlet of the fluid ejection 12a-o of the turbojet 12a-e.

[0040] Alternatively, the thrust systems TSa to TSd of the aircraft 10 could each consist of a propeller driven in rotation by an electric and / or thermal engine to deliver a thrust equivalent to that described by a thrust system based on a turbojet as described in connection with FIGS. 1 and 1A. Whatever the embodiments of a thrust system of a propulsion device, an electronic control system 30 controls the respective powers of the thrust systems TSa to TSd from measurements delivered by an inertial unit 40 advantageously positioned near the center of gravity CG10 of the aircraft 10 and from piloting instructions delivered by a command unit 20 in communication CL, wired or radio, with the control system 30. The latter thus translates the pilot's directives, via the command unit 20, into control of actuators (thrusters, de- flectors) to regulate the thrusts respectively delivered by the thrust systems TSa to TSd causing the trajectory of the aircraft 10 required by said pilot with regard to the attitude and position of said aircraft estimated by the measurement unit 40.

[0041] [Fig. 1 A] describes such an aircraft 10 in the light of a reference frame determined by three axes x, y, z respectively inscribed in the plane of the platform 11 for the x and y axes and normal to the latter for the z axis. The three axes x, y and z are intersecting at the center of gravity CG10 of the aircraft 10. The x axis extends from the stern to the bow of the aircraft and the y axis extends from starboard to port. The z axis describes a vertical, from the distance to the ground, when the platform is horizontal.Such an aircraft 10 can move in the air according to rotations R, P, Y caused respectively around said axes x, y and z by the control system 30 deliberately regulating the respective thrusts delivered by the thrust groups TSa to TSd. Thus, a vertical rise of the aircraft 10 is caused by a joint and identical increase in the thrusts delivered by the four thrust groups TSa to TSd, an increase sufficient to create a lift force greater than the weight of the aircraft 10. Conversely, a vertical movement from top to bottom of the aircraft is obtained by a joint and identical reduction in the thrusts delivered by the four thrust groups TSa to TSd to create a lift force less than the weight of the aircraft 10.

[0042] To cause a forward (bow) or rearward (stern) movement of the aircraft 10, the control system 30 induces a thrust difference between the thrust group pairs respectively formed by the thrust groups TSa and TSd for one and by the thrust groups TSb and TSc for the other. Thus, a rotation P, also known as "pitching" or "pitch" according to English terminology, around the y axis is caused. A relative and combined increase in the torque {TSa, TSd] with respect to the torque {TSb, TSc] caused by a positive thrust differential induces a forward movement of the aircraft. The converse induces a rearward movement of the aircraft 10.

[0043] To cause a movement to port or starboard, the control system 30 induces a thrust difference between the pairs of thrust groups respectively formed by the thrust groups TSa and TSc for one and by the thrust groups TSd and TSb for the other. Thus, a rotation R, also known as a “roll” or “roll” according to English terminology, around the x axis is caused. A relative and combined increase in the torque {TSa, TSc] with respect to the torque {TSb, TSd] caused by a positive thrust differential induces a movement to port of the aircraft 10. The converse induces a movement of the aircraft 10 to starboard.

[0044] The control system 30 can also cause a Y rotation, also known as “yaw” or “yaw” according to English terminology, of the aircraft around the z axis. For this, the control system 30 induces an asymmetrical pinching of the deflector guides of each thrust group TSa to TSd, of at least one pair {TSa, TSb} or {TSc, TSd} of thrust groups. In connection with [Fig.2], such an asymmetrical pinching of the deflector guides 19al, 19a-5 of the thrust group TSa produces three components of the resulting thrust of said thrust group which is no longer strictly parallel to the direction of ejection of the fluid from the turbojet engine 12a-e and therefore normal to the platform but which becomes oblique with respect to the latter under the combined effect of one of the components AL12a remaining parallel to the direction of ejection of the fluid by the turbojet engine 12a-e and of the predominant component among the components AL12a' or AL12a” substantially normal to the latter.Depending on whether the AL12a' component is greater or less than the AL12a” component, a rotation Y around the y axis is caused in a clockwise or counterclockwise direction.

[0045] So that no elevation or loss of altitude is induced during a yaw, roll or pitch, the control system 30 causes an increase equal to the decrease in the combined thrusts delivered by the pair or pairs of thrust groups concerned by such asymmetrical pinching of their deflector guides so that the overall lift force delivered by all of the thrust groups is constant.

[0046] To translate the pilot's instructions, as shown in [Fig. 3], a command unit 20 may consist of a human-machine input interface comprising input peripherals in the form of a pair of joysticks or levers 21 and 22. The invention cannot be limited by this sole choice of input peripherals, the latter being able to further or alternatively comprise a plurality of buttons, a touch surface or any other equivalent and suitable means.

[0047] As an example according to figures 3 and 3A (the latter describing a top view of the joysticks 21 and 22), the joystick 21 makes it possible to detect four movements D21-1, D21-2, D21-3, D21-4 of the distal part 21d of the lever 21 with respect to its support 21b: - a D21-1 movement can reflect a pilot instruction aimed at increasing the overall thrust of the aircraft and causing an increase in altitude; - opposite to the D21-1 movement, a D21-2 movement can reflect an instruction from the pilot to reduce the overall thrust of the aircraft and cause a loss of altitude; - a movement D21-3 can translate an instruction from the pilot to pivot the aircraft 10 in the counterclockwise direction around the z axis according to [Fig.lA]; - opposite to the movement D21-3, a movement D21-4 can translate an instruction from the pilot to pivot the aircraft 10 clockwise around the z axis according to [Fig.lA].

[0048] Still as an example according to [Fig.3A], the joystick 22 makes it possible to detect four movements D22-1, D22-2, D22-3, D22-4 of the distal part 22d of the lever 22 with respect to its support 22b: - a D22-1 movement can reflect an instruction from the pilot aimed at causing the aircraft to move forward; - opposite to the D22-1 movement, a D22-2 movement can reflect an instruction from the pilot aimed at causing the aircraft to move backward; - a D22-3 movement can reflect an instruction from the pilot aimed at causing the aircraft to move to port; - opposite to the movement D22-3, a movement D22-4 can translate an instruction from the pilot aimed at causing a movement to starboard of the aircraft.

[0049] A command unit 20 further comprises electronic means 23, such as one or more microcontrollers or microprocessors, for translating such movements of the distal parts 21d and 22d of the levers 21 and 22 into electrical command signals Gsp, the latter being intended to be conveyed to the control system 30 by radio or wire CL. Such electronic means 23 can be duplicated in several redundant means and jointly produce a plurality of command signals

[0050] Said instruction unit 20 may further comprise other members such as push buttons, for example, to translate an order to start the thrusters, to signify a loss of ability of the pilot to pilot the aircraft, to switch from a manual piloting mode to an assisted piloting mode, etc. Said electronic means 23 of the instruction unit 20 are arranged to also communicate the information delivered by said members. Thus, said instruction unit 20 may transmit a signal Gsp, or even a plurality of signals if the means 23 are redundant, for example of the PPM type, conveying a vector of information among which we can cite position instructions Xsp, heading / yaw ^P, instructions for starting or stopping the thruster(s), a piloting mode identifier, etc.

[0051] Figure 4 describes a system 30 for controlling TS actuators, for example the thrust groups TSa to TSd of an aircraft 10 according to Figure 1. Said control system 30 integrates or cooperates with one or more inertial units 40 (accelerometers, gyroscopes, magnetometers), inertial navigation units (INU, an English acronym for “Inertial Navigation Unit”), or even measurement units inertial measurements (IMU, an English acronym for "Inertial Measurement Unit"). Such a measurement unit 40 is designed in particular to estimate the positions x, linear speeds y or angular speeds q of the aircraft 10. The linear speed y, the position x can be estimated with respect to the "NED Frame" (for North-East-Down according to English terminology) reference frame determined by three orthogonal axes in which a first axis points towards geographic north, a second axis points towards the center of the earth and the third axis points towards the east. The attitude q) and quaternion q as well as any angular speed q of the aircraft are generally estimated with respect to a reference frame specific to the aircraft 10 such as that illustrated by the axes x, y, z in [Fig.lA]. Said linear speeds and said positions are possibly corrected by a Kalman filter.

[0052] The control system 30 comprises one or more flight controllers FC whose role is to integrate the measurements delivered by the measurement unit(s) 40 and the piloting instructions delivered by the instruction unit 20 to deliver to each thrust group TSa to TSd (or more generally to an actuator TS) a command A, for example in the form of a PPM signal or equivalent, capable of mainly conveying components relating to the pitch ôp, the roll ôr, the yaw ôy, the power / thrust ôt.

[0053] Figure 4 depicts more precisely a block diagram of an architecture of a flight controller FC for an aircraft such as the drone 10 illustrated by Figure 1. According to this example, said flight controller FC comprises a plurality of control devices constituting two main stages, referenced STA and STB in Figure 4. The STA stage is responsible for regulating the position of the aircraft in the “NED Frame” frame of reference. According to the example illustrated by Figure 4, the STA stage generally produces a setpoint acceleration Asp from, on the one hand, measurements emanating from a measurement unit 40, in this case estimates of the position x and the linear speed y of the aircraft and, on the other hand, position setpoints Xsp delivered by a setpoint unit 20 such as that previously described in connection with Figures 3 and 3A.

[0054] The STB stage is, for its part, responsible for regulating the position of the aircraft in a reference frame, called “Body frame” according to English terminology, specific to the platform of the aircraft 10 as illustrated by the axes x, y, z in FIG. 1A to deliver actuator control components A relating to the pitch ôp, the roll ôr, the yaw ôy from, on the one hand, the production of the STA stage (setpoint acceleration Asp), the heading / yaw setpoints TSP emanating from the control unit and, on the other hand, measurements delivered by the measurement unit 40 in terms of attitude qf, quaternion q, and angular speed q. To do this, an interface 33 ensures a transposition of references so that the setpoint acceleration Asp and the heading / yaw setpoints TSP are translated into a setpoint quaternion and a 5t component of the A command relating to power / thrust.

[0055] Each STA and STB stage can be “clocked” according to distinct periods or frequencies. The regulation frequencies implemented by the two main STA and STB stages can be fifty hertz for the STA stage and two hundred and fifty to one thousand hertz for the STB stage.

[0056] According to the example illustrated by [Fig.4], each of said stages STA and STB comprises two control devices respectively 31, 32 for the STA stage and 34, 35 for the STB stage.

[0057] The aircraft position control device 31 delivers a set speed Vsp from the difference between a set position Xsp and an estimated position x. This set speed Vsp is then compared by the control device 32 to the estimated linear speed y by the measurement unit 40 in order to produce the set acceleration Asp previously mentioned.

[0058] For its part, the attitude control device 34 of the STB stage delivers a set angular speed £2sp by comparing the set quaternion 9SP and the estimations of the quaternion q and the attitude $ delivered by the measurement unit 40. This set angular speed Qsp is then compared to the angular speed of the aircraft estimated q by said measurement unit 40 to ultimately produce the components of the control vector A relating to the pitch ôp, the roll ôr and the yaw ôy by the angular speed control device 35 of the STB stage.

[0059] Advantageously, the position 31 and attitude 34 control devices generate respective outputs proportional to the differences separating their inputs. On the other hand, the linear and angular speed control devices 32 and 35 produce outputs from components describing corrective actions respectively proportional to the difference between their inputs, to the integral and to the derivative of said difference, for example by using a PID regulator. Each control device can advantageously comprise its own processing unit Ut (for example, in the form of one or more microprocessors or microcontrollers cooperating with a data and / or program memory M) which samples, according to a given periodicity, the measurements and / or instructions delivered by the measurement unit 40 and / or the instruction unit 20 or more generally by sources delivering instructions or measurement data.Such a source, which we can call a "setpoint source", can thus consist of a setpoint unit 20 as described previously in connection with [Fig. 3]. This is the case for the flight controller 30, when the latter is considered as a whole, or for the position controller 31 alone of such a flight controller FC. Such a setpoint source can further consist of . a position control device 31 or attitude control device 34, or even in the interface 33, for the linear speed control modules 31 and angular speed control modules 35.

[0060] Alternatively, such a flight controller FC may comprise only a single processing unit Ut responsible for implementing production processes specific to the various electronic elements (position controllers 31, attitude controllers 34, linear speed controllers 32 or angular speed controllers 35, or even the interface 33). Whether the processing unit Ut of a flight controller is centralized or decentralized, i.e. whether all or part of the various electronic elements of the latter comprise their own processing unit Ut ([Fig. 4] illustrates such a situation for the control modules 34 and 35), the behavior of a processing unit Ut may advantageously be determined by means of a suitable computer program whose program instructions are loaded into the data and / or program memory(s) M cooperating with said processing unit.

[0061] Figure 5 illustrates an embodiment of such a control system 30 of an actuator TS according to the invention for which measurement, communication and / or data processing elements are duplicated for reasons of reliability. According to this example, three flight controllers FC-1, FC-2 and FC-3, similar to the FC controller described previously in connection with FIG. 4, are arranged within said control system 30 to carry out similar processing operations from measurement data emanating from a measurement unit 40 and from setpoint data delivered by a setpoint unit 20. The three flight controllers FC-1 to FC-3 are thus individually responsible for producing a command A1, A2 or A3 of an actuator TS such as the thrust groups TSa to TSd of an aircraft 10 already described in connection with FIG. 1. Said commands A1, A2 or A3 thus collectively form the command A of the control system 30.

[0062] Unlike known control systems having multiple redundancy, i.e. comprising several flight controllers each producing and independently of one another a command A1, A2 or A3 from measurement data GS and common instructions Gsp, a control system 30 according to the invention is arranged so that said commands A1, A2 and A3 are jointly produced by the redundant flight controllers. For this, said three flight controllers FC-1, FC-2 and FC-3 are arranged to be in mutual communication via a communication bus B so that each flight controller knows the values ​​produced by its peers. More precisely, the control devices (such as the devices 31, 32, 34 and 35 illustrated by [Fig.4]) respectively composing the latter and ensuring the regulations of position, attitude, linear and angular speeds can have the capacity to know themselves the data produced by their peers within the different FC-la FC-3 flight controllers. According to an advantageous embodiment, such a communication bus B may consist of a data bus called CAN (acronym for the English expression “Controller Area Network”), advantageously redundant, that is to say for example doubled for reasons of reliability. Such a technological choice is advantageous for routing via a single cable, a large number of data and sharing them between the different electronic elements of the control system 30.

[0063] The outputs or commands A1, A2 and A3 delivered respectively by the flight controllers FC-1, FC-2 and FC-3 can thus also be produced by the latter, no longer independently of each other, but jointly, that is to say taking into account the productions of the redundant flight controllers. Said commands A1, A2 and A3 thus jointly form a command A with multiple redundancy and are routed to the actuator TS, more precisely to an electronic controller of the latter, said controller of the actuator TS itself possibly being plural and redundant. Such a controller is included in the notion of actuator for the sake of simplicity in FIG. 5. Such a controller and / or actuator TS implements a policy of choice and / or arbitration between the different commands A1, A2 and A3 to carry out its action.As an advantageous example, such a controller can produce a “simple” command A from the plural command A delivered by the control system 30 so that said command A consists of: . - one of the commands A1, A2 and A3 produced respectively and jointly by the redundant flight controllers FC-1, FC-2, FC-3 when only two of said flight controllers retain their capacity to produce such a command - this situation may occur when one of said three flight controllers malfunctions; - the median of said plurality A of commands A1, A2 and A3 jointly produced by the redundant flight controllers.

[0064] Alternatively, such a control system according to the invention may be arranged so that a “simple” command A may be generated directly by the control system from the plurality A of commands A1, A2 and A3 produced respectively and jointly by the three flight controllers FC-1, FC-2 and FC-3, in order to relieve the actuator TS of such an arbitration task. In this case, such a control system 30 may comprise an arbitration means (not shown for the sake of simplification in FIG. 5) for developing such a command A according to a technique similar to that set out previously for the arbitration that an actuator can perform.

[0065] According to the example illustrated by FIG. 5, the measurement unit 40 can also be multiplied in the form of three redundant measurement units 40-1, 40-2, 40-3 delivering their measurements respectively to the three flight controllers FC-1, FC-2, FC-3. The latter can propagate to its peers, via the communication bus B, the data of measurements delivered by the measurement unit dedicated to each flight controller. Thus, according to the example illustrated by figure 5, the measuring unit 40-1 delivers to the flight controller FC-1 measurement data Gsl in the form of estimates of the position yi, linear velocities yj and angular velocities q] of the aircraft 10, of the attitude qq and quaternion fl of the latter. In the same way, the 40-2 measuring unit delivers to the FC-2 flight controller Gs2 measurement data in the form of estimates of the position ^9, linear velocities yp and angular velocities q? of the aircraft 10, attitude vpp and quaternion ^2 of the latter. Finally, the measurement unit 40-3 delivers to the flight controller FC-3 measurement data Gs3 in the form of estimates of the position of the linear velocities y^ and angular velocities Q3 of the aircraft 10, attitude and quaternion of the latter. Alternatively, the three measurement units 40-1, 40-2, 40-3 could be connected via communication bus B to the three flight controllers FC-1, FC-2, FC-3.

[0066] Via the communication bus B, the instruction unit 20 delivers to the three flight controllers FC-1, FC-2 and FC-3 the instructions Gsp relating to the positions Xsp, headings and yaw ^SP. Such an instruction can also be plural when said instruction unit has multiple redundancy. Figure 5 also illustrates the possible presence of a navigation assistance module 20a which can, as a supplement, assist the pilot and deliver instructions Gsp relating to the positions Xsp, headings and yaw ^SP in place of or in addition to the instruction unit 20.

[0067] In an ideal world, the three flight controllers FC-1, FC-2 and FC-3 would be perfectly identical, would have the capacity to sample the data or signals carried by the data bus B at an infinite frequency and would thus share their produced data with their peers instantly. The measurement units would deliver identical and noise-free estimates. According to such an ideal world, there would be no gap or deviation possible between the commands A1, A2 and A3 delivered to the actuator TS. This ideal world is, however, utopian. There are therefore latencies between the reading or sampling carried out by each flight controller, of the data produced by its peers and the production of its own data.Indeed, the sampling frequency of the data available via the communication bus B cannot be unlimited, the measurement data is noisy and can fluctuate depending on the measurement units 40-1, 40-2 and 40-3 considered and the electronics and clocks at the level of the respective control devices of the redundant flight controllers FC-1, FC-2 and FC-3 cannot be perfectly cloned or synchronized. Thus, the commands A1, A2 and A3 deviate, or even diverge, tirelessly from each other. of others and lose precision and relevance to the detriment of the piloting of the aircraft. To respond to such a reality and / or technological limitations, the invention provides for distributing at the level of each flight controller FC-1, FC-2, FC-3 within the control system 30, or even distributing at the level of each control device 31, 32, 34, 35 of each of said flight controllers FC-1, FC-2, FC-3, a method for correcting the values ​​of quantities produced which takes into account the productions of control devices and / or peer flight controllers. Thanks to the implementation of such a method according to the invention, the commands A1, A2 and A3 become jointly produced by the flight controllers FC-1, FC-2, FC-3 do not diverge in nominal operation (i.e. in accordance with the design constraints), leaving the actuator TS to take into account coherent and precise commands A1, A2 and A3.

[0068] It is important to emphasize that when the control system 30 only comprises two redundant flight controllers or when only two flight controllers among the three illustrated by [Fig. 5] retain their production capacity, it is particularly advantageous for the redundant commands to remain coherent and not directing one or the other. Indeed, even if the TS actuator only takes into account one command out of the two during its arbitration, when a malfunction occurs in the flight controller producing said command previously used and said TS actuator must now select and use the second command in place of the first which has become unavailable, the actuator does not undergo a marked break in terms of control and therefore behavior.The situation would be very different if the outputs of the two redundant flight controllers were carried out in parallel, i.e. independently of each other and not jointly accomplished as according to the invention. Indeed, without the contribution of the invention, the commands issued respectively by the two redundant flight controllers could gradually diverge from each other. During a control switch, the behavior of the aircraft would suffer from a loss of continuity. Such a correction method specific to the invention allowing joint outputs of redundant commands can be implemented by the processing unit of a flight controller FC according to [Fig. 4] as such (i.e. in a centralized manner) or by one of the processing units of the different control devices 31, 32, 34 and 35 included in the latter (i.e. in a distributed manner).The expression “servo device” will subsequently be used to designate indifferently a flight controller as such or a control device included in the latter.

[0069] To adapt the operation of such a servo device, program instructions interpretable by the processing unit of said servo device may be loaded into a non-volatile memory M thereof. Such program instructions are then designed so that their execution by the processing units Ut of such servo devices causes the implementation of a method for correcting the production of the values ​​of the quantities concerned in accordance with the invention. Such program instructions may constitute a computer program product as such and be conveyed or stored on any suitable storage medium.

[0070] [Fig. 6] illustrates such a method 100 according to the invention intended to be implemented by the processing unit Ut of a servo device among several redundant servo devices of an actuator control system. Advantageously, such a method 100 is intended to be implemented by each of said redundant servo devices. The latter are arranged to respectively produce values ​​of the same quantity G from the same setpoint Gsp and the same measurement data Gs. To jointly produce such quantities, said servo devices are in mutual communication, for example via a communication bus B as illustrated by [Fig. 5], so that each servo device knows, i.e. can access in reading via said communication bus B, the latest values ​​of said quantity G produced by said redundant servo devices.

[0071] Such a method 100 is implemented iteratively according to a given frequency SP. As stated previously, without this conferring any limitation on the present invention, such a frequency SP may be chosen to be between fifty and one hundred hertz for a device for controlling an STA stage or between two hundred and fifty and one thousand hertz for a device for controlling an STB stage of an FC controller according to [Fig.4].

[0072] Such a method 100 comprises a first step 110 of producing the value G1 of a quantity G from a setpoint Gsp and a measurement datum Gs.

[0073] It further comprises a step 120 of reading, for example, via the communication bus B, the last values ​​of the quantity produced by the redundant servo devices and of constructing a set q of current values ​​of said quantity G from said values ​​accessed in reading and the value produced in step 110.

[0074] According to a first example of implementation by a system 30 for controlling an actuator TS according to FIG. 5, said servo device implementing said method 100 may consist of the flight controller FC-1, the flight controllers FC-2 and FC-3 being the even servo devices of the controller FC-1. In this case, the quantity G mentioned is the actuator command A, the value G1 thereof being alternatively the command Al when said servo device implementing implements the method 100 is the controller FC-1 or the command A2 when, for its part, the servo device FC-2 implements said method 100, the flight controllers FC-1 and FC3 being the even servo devices of the latter, and so on for the flight controller FC-3. According to this first example, the set q consists of the commands A1, A2 and A3. The instruction Gsp consists of the components relating to the position Xsp, heading and yaw ^SP emanating from a instruction unit such as the unit 20 according to figure 5. The measurement data Gs consists of all the estimations of position x, linear speed y, attitude and quaternion q, as well as the angular speed q delivered by a measurement unit 40 according to said [Fig.4], or even in the estimations delivered respectively by the redundant measurement units 40-1, 40-2 and 40-3 according to the example illustrated by [Fig.5].

[0075] According to a second example of implementation of a method 100 according to the invention implemented by a system 30 for controlling an actuator TS according to FIG. 5, the redundant servo devices implementing said method 100 may be the respective linear speed controllers 32 of the flight controllers FC-1 and FC-2 and FC-3, or even the respective angular speed controllers 35 of said flight controllers FC-1 and FC-2 and FC-3 (when the latter are constituted like the flight controller FC illustrated by FIG. 4). In the case where said redundant servo devices are the linear speed controllers 32, the quantity G is a setpoint acceleration Asp, or more precisely the component of the latter reflecting the integral action when said speed controller 32 comprises a PID regulator.The Gsp setpoint consists of the setpoint linear speed Vsp, itself produced by a position controller of said FC-1, FC-2 or FC-3 flight controller concerned. The set of q values ​​consists of the setpoint accelerations Asp produced by the 32-pair speed control devices or by only the components of said setpoint acceleration Asp reflecting the integral action of the PID regulators of the pair speed controllers.

[0076] Alternatively or in addition, said redundant servo devices implementing a method 100 according to the invention may consist of the respective position control devices 31 of the flight controllers FC-1, FC-2 and FC-3. The quantity G considered is then the setpoint linear speed Vsp. The setpoint Gsp consists of the components relating to the position Xsp, heading and yaw 'fsP emanating from a setpoint unit 20, the measurement data Gs being the position of the aircraft estimated by a measurement unit 40, 40-1, 40-2, 40-3.

[0077] To couple, that is to say to jointly produce the value of a quantity with regard to the redundant control devices, it is necessary to correct the value produced in step 110 to take into account the productions of said devices. redundant or even servocontrols. For this, a method 100 according to the invention further comprises a step 130 of determining a reference value Gr of said quantity taken from the set g, that is to say selected from the values ​​forming said set g in step 120.

[0078] When the actuator control system 30, the elements of which each implement said method 100 in a distributed manner, comprises at least three redundant servo-control devices (such as the controllers FC-1, FC-2, FC-3 or the position, attitude and / or linear or angular speed controllers of the latter) capable of producing and communicating a value of the quantity G, the invention provides that the step 130 of determining the reference value Gr may consist of determining the median of said values ​​forming the set g of current values ​​of the quantity G. The term "median" is understood to mean the midpoint of a data set, in this case the set g, such that fifty percent of said data have a value less than or equal to the median and fifty percent of said data have a value greater than or equal to said median.In a small data set, it is sufficient to count the number of data and order them according to their respective values ​​in ascending order. If the number of data is an odd number, it is necessary to increment the said number by one unit, then divide it by two to obtain the rank which designates the median value. The rank is the position of a value once the set g is ordered: the smallest value corresponds to the first rank, the second smallest value to the second rank, etc. According to the example of a triple redundancy system, the median will therefore be chosen as the value of the second-rank quantity or the intermediate value between the two minimum and maximum values. Opting for the median makes it possible to avoid aberrations generated according to certain previous techniques which favor the average or a unit selection, when a production of one of the servo devices deviates clearly compared to the others.

[0079] On the other hand, when the control system 30 only comprises two redundant servo devices, or even when only two servo devices among a plurality remain capable of producing a value of the quantity G, the step 130 of determining the reference value Gr consists of choosing, within the set g of current values ​​of the quantity G, one of the current values ​​of said quantity produced by the first or the second servo device remaining capable of producing a value of the quantity G. Such a choice can be made on the servo device whose index is the lowest, when said redundant servo devices are identified by such an index or according to any other technique opting for an alternation or a random choice.

[0080] A method 100 therefore comprises a step 140 of calculating a difference Ge between the current value G1 of the quantity G produced in step 110 and said reference value Gr then a step 150 of producing a corrected current value GP of the quantity G consisting of the implementation of an operation of subtraction of a correction Gc. The value of the latter consists of a calculation according to which said difference Ge is multiplied by a correction coefficient Kc of said current value Gl resulting from step 110. In this way, the final production Gl' of each of the redundant servo devices is coupled with those of the other redundant servo devices. The latter jointly produce corrected Gl' values ​​of the quantity G.

[0081] To implement a step 150 of producing a corrected current value Gl' of the quantity G, the value of the correction coefficient Kc which induces a coupling of the respective productions of the redundant servo devices, can be predetermined and for example written in a memory M of each servo device. The choice of said value of the correction coefficient Kc induces different remarkable technical effects on the desired behavior for the control system 30 as we will see later in connection with FIGS. 7, 7A and 8. Depending on the quantity G considered, said value of the correction coefficient Kc may be chosen as equal to one, meaning that the entirety of the difference Ge between the current value Gl of the quantity G produced by one of the redundant servo devices and the reference value Gr, is subtracted from said current value Gl, the latter taking as its value, said reference value Gr.Alternatively, only a fraction of said difference Ge can be subtracted from said current value Gl to produce the corrected value Gl'. Thus, said correction coefficient value Kc can be chosen, empirically, for example according to a criterion based on the variability of the quantity G with respect to the frequency SP to sample, in step 120, the values ​​produced by the even servo-control device(s), i.e. to constitute the set q of current values ​​of the quantity G produced by all the redundant servo-control devices. For example, a correction coefficient Kc of low value, for example of the order of five percent, will be preferred for a quantity G whose values ​​vary intensely with respect to the frequency SP and conversely a coefficient close to or equal to one hundred percent in the opposite case.A low correction coefficient Kc may also be chosen in the presence of a large latency between the current values ​​produced by the different redundant control devices to constitute the sets q and a value close to or equal to one hundred percent in the opposite case. A value of Kc of, for example, between eighty and one hundred percent may be preferred when the quantity G concerned is the component reflecting the integral action of a regulator. PID of a linear speed control 32. As a variant or addition, a value of Kc of between five and thirty percent may be preferred when the quantity G concerned is the component reflecting the integral action of a PID regulator of an angular speed control 35 for example. The invention would not be limited to these parameterization examples alone. A memory M of a servo device may thus comprise a table of possible values ​​for said correction coefficient Kc according to the quantity G concerned, according to the performance of the communication means B for exchanging the respective productions of the redundant servo devices, or even the respective iteration frequencies SP of each of the latter.

[0082] The determination of a value of the correction Kc can be predetermined in the design or adjustment phase of the control system or in the simulation phase of such a system 30 to adjust the technical coupling effect sought by the implementation of the method 100 according to the quantity(ies) G considered.

[0083] Alternatively, the values ​​of said correction coefficient Kc may be dynamic and adjusted in real time by each redundant servo device of the control system. In this case, the invention provides that such a servo device may constitute, in a step 151, a history of a determined number of values ​​of the quantities produced G1 in step 110 or corrected GF in step 150 in order to estimate its variability. Thus, in a step 101, prior to the implementation of step 150, or even according to an execution frequency lower than the iteration frequency SP of steps 110, 120, 130, 140 and 150, the value of said correction coefficient Kc may be adjusted dynamically as a function of the estimation of the variation of the previous values ​​of the quantity G and the iteration frequency SP of step 120 of constituting the set q. Such an adjustment 101 can be determined by means of pre-established calculation rules.According to an alternative embodiment, such an adjustment 101 can be implemented by a neural network previously trained using data collected via numerous flight simulations for example, or more generally from the control of different quantities.

[0084] The invention provides, as a variant or in addition to the weighting of the value of the correction Gc by the choice of a correction coefficient Kc suitable with regard to such or such quantity G concerned, to limit in absolute value the value of said correction Gc before subtracting it from the value G1 produced in step 110. For this, the step 150 of producing the value of the correction Gc can be arranged to limit the latter in absolute value to a limit value L. Thus, when the value of the correction Gc calculated from the difference Ge between the current value G1 of the quantity G and the reference value Gr exceeds in absolute value said limit value L, the absolute value of said correction Gc takes as its value said limit value L. By way of example non-limiting, such a value L can be calculated as a percentage of the reference quantity Gr strictly greater than zero and less than thirty percent.

[0085] This double parameterization of step 150, on the one hand, by the value of the correction coefficient Kc and, on the other hand, by the limit value L, offers a very great finesse for adjusting the behavior expected by a control system 30 of actuator TS according to the invention.

[0086] As indicated in [Fig.5], certain input data of a servo device may be redundant, i.e. emanating from a plurality of sources. This may be the case when measurement data are delivered to said servo device by a plurality of redundant sources or when, via the communication goal B, it is intended to voluntarily inject into the input of said servo device, values ​​produced by third-party servo devices that are also redundant. For example, in connection with figures 4 and 5, provision may be made to inject into the input of a linear speed control device 32 on the one hand the estimates of the linear speed of the aircraft delivered by the measurement units 40-1, 40-2, 40-3 and, on the other hand, the linear speeds of instructions delivered respectively by the position control devices 31 of the different flight controllers FC-1, FC-2, FC-3.

[0087]

[0088]

[0089] The same could apply to the respective position 31, attitude 34 or angular velocity 35 controllers of the redundant flight controllers FC-1, FC-2 and FC-3. Thus, in connection with Figure 6, when a Gsp instruction consists of a plurality of values ​​delivered respectively by redundant sources delivering said instruction of the actuator control system, a method 100 according to the invention may comprise a step 102 for producing said Gsp instruction so that it takes the value: - one of the values ​​of said plurality when the latter comprises only two values, that is to say when only two redundant sources deliver such an instruction; - the median of said plurality of values ​​when the latter comprises at least three values, that is to say when at least three redundant sources deliver such an instruction. In the same way, when the step 110 of producing the value G1 of a quantity G is implemented from a setpoint Gsp and a measurement datum Gs consisting of a plurality of values ​​delivered respectively by redundant sources of said control system (for example, the measurement units 40-1, 40-2, 40-3 according to [Fig. 5]), a method 100 according to the invention can advantageously comprise a step 103 for producing said measurement datum Gs so that it- this takes the value: - one of the values ​​of said plurality of values ​​when the latter comprises only two values, that is to say when only two redundant sources deliver measurement data; - the median of said plurality of values ​​when the latter comprises at least three values, that is to say when at least three redundant sources deliver such measurement data.

[0090] In connection with Figures 4 and 5, Figures 7, 7A and 8 illustrate the various contributions provided by the implementation of the invention and the impact of the choice of the value of the correction coefficient Kc on the behavior of a control system according to the invention. The two Figures 7 and 8 respectively illustrate two quantities G in this case the components relating to the pitch ôp, to the roll ôr of the control A, and more particularly, the components of these quantities reflecting the integral action of a PID regulator of an angular speed controller 35 according to [Fig.4],

[0091] Figure 7 describes more precisely the components reflecting the integral action of the component of the command A relating to the pitch ôp respectively produced by the flight controllers FC-1, FC-2 and FC-3. Thus, the respective productions in connection with the pitch ôp of said flight controllers appear: - in solid line curves for the FC-1 controller (ôpl component); - in dotted curves for the FC-2 controller (component ôp2); - in broken line curves for the FC-3 controller (component ôp3).

[0092] Said [Fig.7] illustrates the respective productions over time t of said flight controllers FC-1, FC-2 and FC-3 according to three distinct values ​​of the correction coefficient Kc, respectively equal to zero, five hundredths and one via three distinct graphs. The upper graph corresponds to a zero value (Kc=0) of the correction coefficient Kc, i.e. a situation in accordance with the state of the art (no correction of the respective productions of the flight controllers FC-1, FC-2 and FC-3 is implemented). The central graph corresponds to a value of the correction coefficient Kc equal to five hundredths (Kc=0.05), i.e. a partial coupling of the respective productions of the flight controllers FC-1, FC-2 and FC-3. Finally, the lower graph corresponds to a value of the correction coefficient Kc equal to one (Kc=1), i.e. a total coupling of the respective productions of said flight controllers FC-1, FC-2 and FC-3.

[0093] We can see that, when the value of the correction coefficient Kc is zero (situation illustrated by the upper graph of figure 7), the servo devices, in this case the PID regulators of the angular speed controllers 35 of the flight controllers FC-1, FC-2 and FC-3, are not coupled. The three curves ôpl, Ôp2 and ôp3 describing their respective productions show an increasing divergence and very marked oscillations. On the other hand, the implementation of the invention induces a remarkable technical effect of convergence and coherence of the respective productions of said flight controllers FC-1, FC-2 and FC-3, as evidenced by the central and lower graphs in figure 7 showing the three curves ôpl, Ôp2 and Ôp3 almost superimposable to the naked eye, reflecting an excellent immediate coupling as soon as the correction coefficient Kc is greater than zero. A very low value, five hundredths according to the example illustrated by the central graph of figure 7, causes a very good coupling symbolized by an almost perfect superposition of the three curves ôpl, Ôp2 and Ôp3 (as indicated by the partial enlargement of said curves). The same applies to a total coupling provided by choosing a value of the correction coefficient Kc equal to one.The curves ôp 1, Ôp2 and Ôp3 are also perfectly superimposed, synonymous with very strong coupling and total coherence, as indicated by the partial enlargement of the said curves ôpl, Ôp2 and Ôp3. If we consider more precisely the two central and lower graphs relating respectively to the values ​​five hundredths and one of the correction coefficient Kc, we can see, beyond the aligned, coupled productions of the three flight controllers FC-1, FC-2 and FC-3, that the value of the correction coefficient Kc equal to five hundredths maintains a high reactivity (the slope of the curves ôpl, Ôp2 and Ôp3 is very steep or vertical at an instant ti for which the system responds to an instruction likely to cause a marked inflection of the value of the components ôpl, Ôp2 and Ôp3. Such reactivity can nevertheless be reduced by a higher value of the correction coefficient Kc (value equal to one, in this case for the lower graph of figure 7).The slope of the curves ôp 1, ôp2 and Ôp3 is in fact less vertical at time ti. However, said superimposed curves ôpl, Ôp2 and Ôp3 are smoother or more stable than those represented on the central graph and, a fortiori, than those illustrated by the upper graph (absence of correction). The choice of the correction coefficient value Kc thus makes it possible to determine a compromise between the desired reactivity and stability. This impact on reactivity and stability is illustrated more precisely by Figure 7A. This superimposes three curves describing the values ​​of the only component relating to pitch ôpl produced by the FC-1 flight controller respectively for three different values ​​of the correction coefficient Kc: . - in solid line curve for a zero value of Kc (K=0); - in dotted curve for a value of Kc equal to 5 hundredths (K=0.05); - in a broken line curve for a value of Kc equal to one (K=l).

[0094] In Figure 7A, the tangents tgO, tgl and tg2 respectively to the three curves of Ôpl mentioned previously have been represented (respectively for Kc=0, Kc=0.05 and Kc=l) at the instant ti where the system responds to an instruction likely to cause a marked inflection of the value of said component Ôpl. The tangent tgO, almost vertical and illustrated in solid line, illustrates the very high reactivity of the control system in the absence of coupling (Kc=0) with the respective productions of the redundant FC-2 and FC-3 flight controllers. The tangent tgl, illustrated in dotted line, always shows a very high reactivity of the control system during a weak coupling (Kc=0.05). Indeed, an angle al, determined by the tangents tgO and tgl, of low value reflects a slight drop in reactivity. The tangent tg2, illustrated in broken line, illustrates the reactivity of the control system during a strong coupling (Kc=l). The angle «2 determined by the tangents tgO and tg2 is much greater than the angle al, indicating a lower reactivity.

[0095] Said figure 7A however illustrates the contribution in stability in return for a possibly reduced reactivity. Thus, the average amplitude of the variations of said component ôpl is very large (this being illustrated by the segment AO in [Fig.7]) synonymous with instability, whereas, as soon as the invention provides a coupling between the respective productions of the redundant flight controllers, even if this is minimal (value of the correction coefficient Kc=0.05), such an average amplitude represented by the segment A1 becomes very low, or even almost zero as indicated by the segment A2 illustrating said average amplitude for a strong coupling (Kc=1).

[0096] We can see by observing figure 8, remarkable and similar contributions provided by the invention, when it is implemented to couple other respective productions of the three flight controllers FC-1, FC-2 and FC-3, in this case the component reflecting the integral action of the PID regulator of the angular speed controller 35 in connection with the control component A relating to the roll ôr.

[0097] Indeed, said figure 8 describes the productions relating to the pitch commands ôr respectively produced by the flight controllers FC-1, FC-2 and FC-3. These appear: - in solid line curves for the FC-1 controller (ôrl component); - in dotted curves for the FC-2 controller (Ôr2 component); - in broken line curves for the FC-3 controller (Ôr3 component).

[0098] Like [Fig.7], said [Fig.8] illustrates the respective productions of said flight controllers FC-1, FC-2 and FC-3, over time t, according to three distinct values ​​of the correction coefficient Kc respectively equal to zero, five hundredths and one by means of three distinct graphs present respectively in the upper, central and lower parts of said [Fig.8]. The upper graph corresponds to a zero value of the correction coefficient Kc, i.e. a situation in accordance with the state of the art (no correction of the respective productions of the flight controllers FC-1, FC-2 and FC-3 is not implemented). The central graph corresponds to a value of the correction coefficient Kc equal to five hundredths, i.e. a partial coupling of the respective productions of the flight controllers FC-1, FC-2 and FC-3. Finally, the lower graph corresponds to a value of the correction coefficient Kc equal to one, i.e. a total coupling of the respective productions of said flight controllers FC-1, FC-2 and FC-3.

[0099] We can see that when the value of the correction coefficient Kc is zero (situation illustrated by the upper graph of Figure 8), the servo-control devices, in this case the PID regulators of the angular rate controllers 35 of the flight controllers FC-1, FC-2 and FC-3, are not coupled. The three curves ôrl, ôr2 and ôr3 describing their respective productions show an increasing divergence and very marked oscillations. On the other hand, the implementation of the invention shows an immediate coupling as soon as the correction coefficient Kc is greater than zero. A very low value, five hundredths according to the example illustrated by the central graph of Figure 8, causes an almost perfect superposition of the three curves ôl'l, ôr2 and Br3. The same is true for a total coupling provided by the choice of a value of the correction coefficient Kc equal to one.The curves ôrl, Ôr2 and Ôr3 are perfectly superimposed, synonymous with a very strong coupling and a great cohesion. If we consider more precisely the two central and lower graphs relating respectively to the values ​​five hundredths and one of the correction coefficient Kc, we can see, beyond the coherent productions of the three flight controllers FC-1, FC-2 and FC-3, that the value of the correction coefficient Kc equal to five hundredths maintains a great reactivity. Indeed, the slope of the curves ôrl, Sr2 and Ô1'3 is very steep or vertical at an instant tj for which the system responds to an instruction likely to cause a marked inflection of the value of the said components Ôrl, ôr2 and 5r3. Such a slope is however less vertical, if we consider the values ​​of the said components ôrl, Ôr2 and ôr3 induced by a higher value of the correction coefficient Kc (value equal to one, in this case for the lower graph of [Fig.8]).On the other hand, the said superimposed curves are smoother or more stable than those represented on the central graph. This [Fig.8] confirms that the choice of the correction coefficient value Kc thus makes it possible to determine the compromise between the desired reactivity and stability of the system.

[0100] The invention has been described through different configurations of an actuator control system, more precisely of thrust groups of an aircraft. The invention cannot be limited to this single example of an actuator control system. It relates more generally to any control system comprising one or more multiple redundancy servo devices applied to home automation, industry, land, sea, air or spatial, that said actuators allow them to move or to regulate the temperature, the atmosphere or even the brightness prevailing within them.

Claims

Claims

1. Method (100) implemented by a processing unit of a servo device among several redundant servo devices (FC-1, FC-2, FC-3) of a system (30) for controlling an actuator (TS), each redundant servo device producing values ​​of the same quantity (G) from the same setpoint (Gsp) and the same measurement data (Gs), said produced values ​​being used by said system (30) to control the actuator (TS), said redundant servo devices (FC-1, FC-2, FC-3) being furthermore mutually in communication so that each redundant servo device accesses in reading the last values ​​produced of said quantity (G) by said redundant servo devices, said method being characterized in that it iteratively comprises (SP): - a production step (110) of the current value (Gl) of quantity (G) from the setpoint (Gsp) and the data ofmeasurement (Gs); - a step (120) of reading the last values ​​of the quantity (G) produced by the redundant servo devices and of constituting a set (q) of current values ​​of said quantity (G); - a step (130) of determining a reference value (Gr) of said quantity taken from said set (q); - a step (140) of calculating a difference (Ge) between the current value (Gl) of the quantity (G) produced and said reference value (Gr); - a step (150) of correcting the current value (Gl) and producing a corrected current value (Gl') of the quantity (G) consisting of subtracting from said current value (Gl) a correction (Gc) resulting from a calculation according to which said difference (Ge) is multiplied by a correction coefficient (Kc) of said current value (Gl).

2. Method (100) according to the preceding claim, for which: - the system comprises at least three redundant servo devices capable of producing a value of the quantity (G); - the step (130) of determining the reference value (Gr) consists of choosing the median of the values ​​of the set (q) of current values ​​of the quantity (G).

3. Method (100) according to claim 1, for which: - the system comprises only two redundant servo devices capable of producing a value of the quantity (G); - the step (130) of determining the reference value (Gr) consists of choosing one of the values ​​from the set (q) of current values ​​of the quantity (G).

4. Method (100) according to any one of the preceding claims, for which the value of the correction coefficient (Kc) is predetermined.

5. Method (100) according to any one of claims 1 to 3, comprising a step (151) of recording the current (Gl) or corrected (GF) value of the quantity (G) in a data memory (M) of the first servo device to constitute a history of a determined number of values ​​and, prior to the correction step (150), a step (101) of producing the value of the correction coefficient (Kc) which is a function of the variability of the values ​​taken from said history and of the iteration frequency (SP) of the step (120) of reading the last values ​​of the quantity (G) produced by the redundant servo devices.

6. Method according to any one of the preceding claims for which the calculation of the value of the correction (Gc) is arranged so that said value of the correction (Gc) does not exceed in absolute value a predetermined limit value (L).

7. Method (100) according to any one of the preceding claims for which the redundant servo devices each comprise a PID corrector delivering three components of an output signal describing respectively a proportional action, an integral action and a derivative action and, for which, the quantity (G) consists in the component describing said integral action of said PID corrector.

8. Method according to any one of the preceding claims, when the control system (30) comprises redundant sources arranged to jointly deliver a plurality of setpoint values ​​comprising a step (102) for producing said setpoint (Gsp) so that the latter takes as its value: - one of the values ​​of said plurality of values ​​(q^) when the control system (30) comprises only two redundant sources; - the median of said plurality of values ​​(q^) said control system comprises at least three redundant sources.

9. Method according to any one of the preceding claims, when the control system (30) comprises redundant sources arranged to jointly deliver a plurality of values ​​of the measurement data (^), comprising a step (103) for producing said measurement data (Gs) so that the latter (Gs) takes as value: - one of the values ​​of said plurality of values ​​(^) when the control system comprises only two redundant sources; - the median of said plurality of values ​​(q|) when the control system comprises at least three redundant sources.

10. A device for controlling a control system (30) of an actuator (TS), said system (30) comprising a plurality of redundant control devices (FC-1, FC-2, FC-3) each producing a value (Al, A2, A3) of the same quantity from the same setpoint (Gsp, q^) and the same measurement data (Gsl, Gs2, Gs3), said redundant control devices (FC-1, FC-2, FC-3) being in mutual communication (B) so that each control device accesses in reading the last values ​​(Al, A2, A3) of said quantity produced by the redundant control devices, said control device (FC-1, FC-2, FC-3) being arranged to implement a method (100) according to any one of the preceding claims.

11. Control system (30) of an actuator (TS) comprising a plurality of redundant servo devices (FC-1, FC-2, FC-3) according to the preceding claim, said command (a, A) being produced from the plurality of values ​​produced (A 1, A2, A3) of the quantity jointly by the redundant servo devices.

12. System (30) according to the preceding claim, for which said command (A) is produced from: - one of the values ​​of said plurality of values ​​produced (a, Al, A2, A3) of the quantity by the redundant servo devices when said plurality of values ​​(a, Al, A2, A3) comprises only two values; - the median of said plurality of values ​​produced (a, A1, A2, A3) of the quantity by the redundant servo devices when said plurality of values ​​(a, Al, A2, A3) comprises at least three values.

13. Vehicle (10) of a load consisting of a driver, a passenger and / or goods or merchandise comprising one or more actuators in the form of at least one thrust group (TSa, TSb, TSc, TSd) for moving said vehicle (10) of which a command (a, A) is produced by a control system (30) according to the preceding claim.

14. Vehicle according to the preceding claim consisting of an aircraft (10).

15. Computer program product comprising one or more program instructions interpretable by a processing unit (Ut) of a servo device among a plurality of redundant servo devices (FC-1, FC-2, FC-3) of a control system (30) of an actuator (TS), said program instructions being loadable into a non-volatile memory (M) of the servo device and designed so that the execution of said instructions by said processing unit (Ut) causes the implementation of a method (100) according to any one of claims 1 to Q

16. y. Computer-readable storage medium comprising the ins- instructions of a computer program product according to the preceding claim.

Images