On-board system for remote redundancy of aircraft on-board equipment

Abstract

FIELD: aircraft.SUBSTANCE: group of inventions relates to an on-board system for remote redundancy of on-board equipment (OE) of an aircraft and an aircraft comprising such a system. The system comprises OE, an on-board control unit (OCU) configured to monitor the OE state, an on-board communication unit (OCoU) connected to the OCU and configured to transmit / receive data to / from a remote computing resource(s) via a wireless communication channel. The aircraft comprises OE and OCU connected to the on-board data transmission bus, as well as a OCoU connected to the OCU.EFFECT: reliability and survivability of the aircraft are increased, as well as the weight of the combat equipment is reduced by ensuring automatic, adaptive and trouble-free operation of the combat equipment of the aircraft in the event of failure of its elements by using remote computing resources located outside the aircraft.14 cl, 4 dwg

Description

[0001] The invention relates to aviation technology, in particular to redundancy systems for on-board equipment (BE) of aircraft (AC), and is intended to increase the reliability and survivability of AC by using remote computing resources located outside the structural boundaries of the AC.

[0002] There are known methods for redundant aircraft systems and components installed on the aircraft itself (for example, triple redundancy of automatic control system channels). The disadvantage of such solutions is a significant increase in the aircraft's weight, size, cost, and power consumption, which is especially critical for unmanned aerial vehicles (UAVs). Furthermore, the service life of such redundant systems is also limited and susceptible to the same external influences as the primary equipment.

[0003] Also known are solutions for remote aircraft control, in which some functions (e.g., navigation) are performed by a ground control station. However, such systems do not provide automatic, instantaneous, and transparent backup for other aircraft systems in the event of a failure of a specific unit or module of the control system. They merely provide aircraft control in place of the crew using the aircraft's control system. They do not provide flexible management of backup equipment readiness modes (hot / cold standby) depending on system criticality and flight phase, nor do they address the issues of intelligent data flow redistribution or communication channel delay compensation for time-critical systems.

[0004] The closest in technical essence to the claimed invention is the System and method for automatic control of the trajectory of a vehicle, based on the remote activation of the on-board automatic control system of an aircraft (AC) and (or) an autopilot, as well as the deactivation of the on-board controls of the AC and the controls for engaging / disengaging the automatic control system or autopilot in order to improve flight safety by eliminating unauthorized access to the control of the AC [see, for example, patent US 7142971 B2, IPC G05D 1 / 0061, B64D 45 / 0015, B64D 45 / 0031, published 28.11.2006].

[0005] This method improves flight safety solely by eliminating unauthorized access to aircraft controls by remotely activating the onboard ACS and disabling all controls. Furthermore, the method involves disabling the controls responsible for activating and disabling the onboard ACS. Thus, the method enables safe aircraft flight using the onboard ACS in the event of emergency situations related to unauthorized access to aircraft controls, crew error, or inability to continue controlling the aircraft, and other onboard situations that require the cockpit to be excluded from aircraft control.

[0006] The disadvantages of this method include the lack of remote backup control systems, including ground-based ones, that would allow for fully remote control of the aircraft. This method only functions if the onboard control system is operational, does not account for its complete failure, and does not provide for redundancy of onboard equipment or the transfer of all computing equipment functions, including the control system, to remote backup computing resources.

[0007] A modernization of the PFN / TRAC system by the US Federal Aviation Administration is known to ensure responsible remote and robotic control in order to prevent unauthorized use of aircraft, as well as to improve equipment management and ensure public safety in transport, based on the use of the PFN / TRAC system, which allows for remote monitoring of the parameters and flight trajectory of all aircraft connected to the system, and also, in the event of emergency situations, including unauthorized access, to carry out remote control (radio control) of the aircraft with the help of a crew located on the ground, or with the help of automatic simulators that take into account the experience of pilots in controlling the aircraft [see, for example, patent US 6965816 B2, IPC G07C 5 / 008, B64C 13 / 20, B64D 45 / 0015, B64D 45 / 0031, B64D 45 / 0034, B64D 45 / 0053, B64D 45 / 0059, G08B 13 / 1965, G08B 27 / 008, G08B 31 / 00, Y02T 50 / 40, published 15.11.2005].

[0008] A disadvantage of this invention is the use of onboard equipment. When switching to remote radio control, only control commands are transmitted from the ground equipment to the aircraft. These commands are used by the standard onboard equipment, instead of commands from the crew. This certainly improves flight safety in the context of unauthorized access to aircraft control. However, it does not account for onboard equipment failures, which can lead to loss of aircraft functionality, which can only be restored through the use of remote backup. Therefore, in the event of onboard equipment failure, this method is impossible to implement, since it relies on the standard automatic control system and autopilot and does not allow for their computational functions to be performed remotely.This invention does not provide for remote (distant) backup of the aircraft and restoration of its operability by switching to ground-based backup equipment, but is based only on remote control of the aircraft using pilots, simulators and other means.

[0009] A flight control emergency system is known. It is a method and system that prevent control of an aircraft from the cockpit. In one embodiment, the system can be activated externally. For example, an air traffic control (ATC) station may determine that an aircraft has deviated from its planned flight path. If ATC personnel determine that the deviation is not due to the actions of the authorized flight crew, they can transmit a signal to the aircraft that disables all normal cockpit controls. After disabling normal flight controls, the aircraft can execute a preprogrammed emergency flight plan using the autopilot system, with or without the flight management system (FMS).An emergency flight plan may result in the aircraft being diverted to a sparsely populated area and entering a holding pattern, or landing in a sparsely populated area or at an airport using an automatic landing system [see, for example, US Patent 7568662 B1, IPC B64D 45 / 0031, B64D 45 / 0034, B64D 45 / 0059, published 04.08.2009].

[0010] A disadvantage of this invention is the use of standard onboard equipment to control the aircraft, which does not account for its possible failures. Therefore, if the onboard equipment fails, this method cannot be implemented, as it relies on the standard automatic control system and autopilot and does not provide for remote execution of their computing functions, i.e., redundancy.

[0011] A known anti-theft system, which in an emergency disables onboard flight control systems and allows remote control of the aircraft using the autopilot. In the anti-theft system for aircraft equipped with an autopilot, a transceiver communicates with at least one remote control device. In the event of a hijacking, the flight crew activates a panic button. The control device is connected to the transceiver and panic button, as well as to the existing avionics, including the aircraft's main computer and autopilot. Optionally, a relay is connected between the pilot's controls and selected aircraft flight systems. The control device recognizes predefined interlock input signals, such as the activation of the panic button or the receipt of interlock signals from the remote control device.In response to the interlock input, the control unit deactivates the on-board control of selected aircraft flight systems and the autopilot system and commands the autopilot to guide the aircraft to a safe landing. Flight and landing instructions are received from the remote control unit or by independently assessing nearby airports, taking into account the aircraft's position and various preset criteria [see, for example, US Patent 6,641,087 B1, IPC G05D 1 / 0061, B64D 45 / 0031, B64D 45 / 0034, published 04.11.2003].

[0012] A drawback of this system is the use of onboard equipment, namely the autopilot and, consequently, the automatic control system, to control the aircraft. This system allows for the reception of control commands from the ground station and the transmission of them to the autopilot, which presumes the autopilot and other aircraft control systems are in good working order. This drawback can be eliminated by remote redundancy of the onboard aircraft control system, which is not addressed in the above-mentioned inventions.

[0013] Aviation system and ground station for off-route aircraft control and emergency communications is known. An avionics system and ground station for off-route aircraft control and emergency communications, consisting of an on-board electronic device installed on board an aircraft with a memory unit for storing data on the flight path, runways, orography and obstacles; processors for processing stored or received data received from sensors monitoring the situation on board. The processors will calculate commands that will be transmitted to the aircraft's autopilot for temporary control of the aircraft and its return to specified flight levels or positions in space; communication devices designed to transmit information about the situation on board in real time to ground control stations when potentially hazardous events occur [see, for example, patent EP 1527432 B1, MPK G08G 5 / 26, G08G 5 / 52, G08G 5 / 53, G08G 5 / 54, G08G 5 / 55, G08G 5 / 727, H04B 7 / 18506, H04B 7 / 18508, publ. 05 / 03 / 2006].

[0014] A disadvantage of this invention is the use of the standard aircraft control system for its operation, which does not account for its failures. Consequently, the developed system is only feasible with a functioning control system. This disadvantage can only be resolved by using redundancy, including remote redundancy. This invention does not address redundancy of onboard equipment, whereby ground equipment would perform the functions of onboard equipment and transmit information to the aircraft's actuators. This invention involves an additional unit that generates commands for the onboard automatic control system, specifically the autopilot.

[0015] A method for preventing unauthorized movement of an aircraft is known. The invention relates to the field of ensuring air traffic safety. The method is implemented by activating the automatic flight and landing control system of the aircraft, remotely switched to autonomous mode from onboard an interceptor aircraft. The aircraft is transferred to a flight path to the airfield, followed by landing. Airspace control means are used to detect unauthorized movement of the aircraft. The invention is aimed at improving passenger safety [see, for example, patent RU 2214934 C2, IPC B60R 25 / 02, G05G 5 / 02, B64D 45 / 00, published 27.10.2003].

[0016] The disadvantage of this method is the use of the aircraft's standard onboard equipment, namely the automatic control system and autopilot, to control the aircraft. This does not account for possible onboard equipment failures and makes this method unfeasible. Furthermore, the method does not provide for remote execution of onboard equipment functions or the transmission of control commands directly to the aircraft's actuators, rather than to the autopilot. Thus, remote redundancy of onboard equipment is not considered in principle.

[0017] Thus, the inventions discussed above do not address restoring aircraft operability in the event of a flight control failure by activating a remote backup computing resource to replace the failed flight control system elements (systems). All of the above inventions are based on the use of the aircraft's standard flight control system, as well as the transfer of aircraft control from the cockpit (crew) to the autopilot, ground crew, ground station, interceptor aircraft, etc. Replacing a failed flight control system with non-airborne equipment is not considered in the inventions considered. These inventions assume a functioning flight control system.

[0018] Solutions in the field of telemetry and remote control of aircraft are known, where data on the status of onboard systems is transmitted to a ground station for monitoring, analysis, and the generation of control commands. However, in such systems, ground-based computing resources perform tasks such as overall control or diagnostics, but do not replace the functions of a specific failed element of the aircraft. In contrast, the present invention implements the principle of remote redundancy at the level of modules, elements, or / and systems of the aircraft, in which ground equipment functions in place of the failed aircraft, processing its input data and returning ready-made output signals. This ensures not just remote control, but also the continuity of critical functions while maintaining the architectural integrity of the onboard systems.

[0019] The technical result achieved by the invention consists in increasing the reliability and survivability of the aircraft, as well as in reducing the weight and cost of its BO by ensuring automatic, adaptive and failure-free operation of the BO of the aircraft in the event of failure of its elements by using remote computing resources located outside the aircraft.

[0020] The stated technical result is achieved in that the onboard system for remote equipment backup of an aircraft comprises onboard equipment connected to the aircraft's onboard data bus and additionally comprises an onboard control unit (OCU) and an onboard communication unit (OCU). The OCU is connected to the onboard bus and is capable of monitoring the state of the OB systems, deciding on the need for remote backup, redirecting input data to the OCU, receiving output data from the remote resource, and transmitting it to the OB systems. The OCU is capable of exchanging data with the remote computing resource via a wireless communication channel. Moreover, the OCU is additionally capable of adaptively selecting the readiness mode of the remote computing resource (e.g., hot or cold standby) based on the criticality of the OB element's function and / or the flight phase.

[0021] The essence of the invention is explained by drawings, where:

[0022] Fig. 1 shows the general structural diagram of the remote backup system with the participation of the declared on-board system.

[0023] Fig. 2 shows a block diagram of the operating algorithm of the on-board control unit (OCU).

[0024] Fig. 3 shows a block diagram of the adaptive redundancy control method implemented by the control unit.

[0025] Fig. 4 shows a diagram of the implementation of distributed redundancy with selection of the best communication channel.

[0026] The device is implemented as follows.

[0027] The declared on-board system is installed on the aircraft (1) and includes on-board equipment systems (2) connected to the on-board data bus (3). An on-board control unit (OCU) (4) and an on-board communication unit (OCU) (5) are connected to the bus (3). The OCU (5) communicates via an antenna (6) over a wireless communication channel (7) with a remote complex (8). The remote complex (8) contains a remote communication unit (RCU) (9) with an antenna (10), a remote control unit (RCU) (11) and a remote computing resource (12). The remote computing resource (12) may include physical duplicates of the OC (13), universal computing servers (14) and servers with virtual machines (15). The remote OCU (11) is connected to a database (16) storing, among other things, digital twins of the aircraft systems.

[0028] The on-board control unit (OCU) (4) can be implemented using an on-board computer with a processor, memory, and associated software. The on-board communication unit (OCU) (5) is a hardware and software complex containing transceivers for operation in various frequency ranges (satellite, VHF, etc.), modulation / demodulation modules, and communication protocols. The OCU (4) and OCU (5) can be structurally combined into a single unit or implemented as software modules operating as part of the aircraft's standard computing device.

[0029] Fig. 2 shows the operating algorithm of the control unit (4), the beginning of which is block 20. At step 21, the control unit continuously monitors the state of the BO systems (2) and the data bus (3). At step 22, a check is performed: whether an event requiring the activation of redundancy (failure, overload forecast, external command) has been recorded. If not, monitoring continues. If yes, then at step 23, the control unit redirects the input data intended for the failed (or redundant) system to the BUS (5) for transmission to the remote complex (8). Simultaneously, at step 24, the control unit performs switching, preparing the corresponding channel on the on-board bus (3) for receiving output data from the ground. At step 25, the control unit receives output data from the BUS (5) from the remote computing resource (12). At step 26, the received data is verified (e.g., comparison with predicted values, calculated limits, checking of checksums). If the data is correct (step 27), it is fed into the BO systems (2) (step 28).If the data fails verification, it is blocked (step 29), and an emergency response procedure is activated (step 30), which may include attempting to reconnect, using an alternative communication channel, or activating the onboard backup. This process continues until the end of the backup session.

[0030] The VCU (4) implements the adaptive redundancy management method. The process begins (Block 30). At step 31, data is continuously collected: flight phase parameters (takeoff, cruise, approach) and system reliability metrics (error rate, temperature, mean time between failures). At step 32, the collected data is analyzed. Based on predefined rules or with the help of the AI ​​module, a decision is made at step 33 to select the redundancy mode. If the system is critical and the flight phase is critical (step 34), the VCU initiates the activation of the hot standby mode (step 35), which is transmitted to the remote complex (8). If the system is non-critical and allows for an interruption in operation (step 36), the cold standby mode is activated (step 37). The process is repeated cyclically throughout the flight (step 38).

[0031] To enhance reliability, the claimed system supports operation with multiple communication channels. An aircraft (1) can simultaneously communicate with several remote complexes via its BCU (5): for example, via a satellite communication channel (40) with a satellite (41) and a ground complex (42), as well as via an airborne repeater (43) on another aircraft (44) with its own channel to a ground complex (45). The BCU (4) continuously evaluates quality metrics (latency, packet loss, signal strength, etc.) for each available channel (46) and dynamically selects for use the channel and the remote complex that provide the highest communication quality at a given moment.

[0032] Before or during a flight, the control unit (4) determines the list of systems to be backed up and their backup modes based on the flight plan and current telemetry. For critical systems (e.g., the automatic control system), the remote backup equipment is switched to hot standby mode. In this mode, the state synchronization module in the control unit (4) ensures constant identity of the internal states of the ground-based computer and the onboard system. In this mode, the backup equipment continuously receives input data from the aircraft via channel (7), processes it in real time, and is fully prepared to immediately transmit output data to the aircraft. If the onboard automatic control system fails, the control unit (4) immediately switches the channel, and control from the ground resumes without interruption.

[0033] For systems that are not latency-critical (e.g., the onboard diagnostic system), cold standby mode is used. If an onboard system fails, the control unit (4) detects the failure and transmits information and data to the remote system (8), which launches and configures the computing resource. Once ready, data processing begins and the results are transmitted to the onboard system.

[0034] Data verification (Fig. 2, steps 26-27) is an important element of safety. For example, for the navigation system, the BCU (4) can calculate predicted coordinates based on inertial system data. If the coordinates received from the remote backup differ statistically significantly from the predicted coordinates, the data is blocked.

[0035] The invention can be used in the aviation industry to equip next-generation manned and unmanned aerial vehicles, as well as to upgrade existing aircraft. The system can be implemented using commercially available components (onboard computers, servers, communications equipment) and standard software (real-time operating systems, virtualization environments), confirming its industrial applicability.

[0036] The claimed onboard system is new because it is unknown in the prior art. No known solutions exist in which an onboard control unit connected to the aircraft's data bus monitors the status of onboard equipment, decides whether its functions should be performed by a remote computing resource, redirects input data through the onboard communication unit, receives and verifies output data, and adaptively selects the remote resource's readiness mode based on the criticality of the function being performed and the flight phase, ensuring seamless switching and proactive redundancy.

[0037] The invention involves an inventive step, as it is not clearly evident from the prior art for a person skilled in the art. The combination of essential features, including an onboard control device and an onboard communications device interacting to provide remote redundancy, and the implementation by this control device of adaptive selection of the remote computing resource readiness mode based on the flight situation, enables the achievement of a new technical result—the creation of a flexible, adaptive, and fault-tolerant onboard redundancy system that radically increases the reliability and survivability of the aircraft while simultaneously reducing the weight and cost of its onboard equipment by placing the backup computing modules outside the aircraft's structural boundaries.

Claims

1. An on-board system for remote backup of on-board equipment of an aircraft, containing on-board equipment (OE) connected to the on-board data transmission bus of the aircraft (AC), characterized in that it additionally contains: an on-board control unit (OCU) connected to the aircraft's on-board data transmission bus and configured to: - monitoring the state of defense systems; - making a decision on the need to perform the functions of at least one element and / or system of the aircraft’s combat system by a remote computing resource located outside the structural boundaries of the aircraft; - redirection of input data intended for the specified element and / or BO system to the on-board communication device; - receiving output data from a remote computing resource and submitting it to the corresponding LA BO systems and / or to actuators; an on-board communication unit (OCU) connected to the BCU and configured to: - transmission of input data via a wireless communication channel to a remote computing resource; - receiving output data from a remote computing resource via a wireless communication channel and transmitting them to the control unit.

2. The system according to paragraph 1, characterized in that the control unit is additionally configured with the capability of adaptively selecting at least one of two readiness modes of the remote computing resource, differing in the level of its operational readiness for data processing, based on at least one parameter characterizing the criticality of the function being performed.

3. The system according to paragraph 2, characterized in that the readiness modes are at least a hot standby mode, in which the remote computing resource continuously or periodically synchronizes its internal state with the state of the redundant on-board system and processes data in real time, and a cold standby mode, in which the remote computing resource is in an unloaded state until activation.

4. The system according to paragraph 1, characterized in that the control unit is configured to make a decision on the need to switch to a remote computing resource based on at least one of: the fact or forecast of failure of an element and / or a BO system, the fact or forecast of increased load on an element and / or a BO system, or an external command.

5. The system according to paragraph 1, characterized in that the control unit and the control system are structurally and / or functionally combined in one device and / or implemented in the form of a software module operating as part of the standard computing device of the aircraft.

6. The system according to paragraph 1, characterized in that it contains a plurality of on-board control units (OCU) and / or on-board communication units (OCU), wherein each OCU and / or OCU is intended for the backup of individual systems or groups of systems of the on-board equipment (OE) of the aircraft, functioning independently or jointly to implement remote backup.

7. The system according to claim 2, characterized in that the control unit contains a state synchronization module, configured to ensure the identity of the internal state of the remote computing resource and the state of the redundant on-board system in hot standby mode.

8. The system according to claim 1, characterized in that the control unit contains a verification module configured to check the correctness of the output data received from the remote computing resource by comparing it with the predicted values, and blocking the data in the event of a discrepancy.

9. The system according to paragraph 1, characterized in that the control unit contains an artificial intelligence module, designed with the ability to predict failures of the BO systems based on the analysis of current telemetry data and historical flight data.

10. The system according to claim 1, characterized in that the BUS is designed with the ability to simultaneously maintain communication with several remote computing resources, and the BUU is designed with the ability to dynamically select a communication channel and a remote resource based on communication quality metrics.

11. The system according to paragraph 1, characterized in that it additionally contains an on-board data storage device, designed with the ability to record and store critical parameters, algorithms and current states of the BO systems for subsequent transmission to a remote computing resource upon its activation.

12. The system according to paragraph 1, characterized in that the control unit is additionally configured with the capability of buffering and compressing data transmitted to a remote computing resource.

13. An aircraft containing on-board equipment (OE) connected to the on-board data transmission bus of the aircraft, characterized in that it additionally contains: an on-board control unit (OCU) connected to the aircraft's on-board data transmission bus and configured to: - monitoring the state of defense systems; - making a decision on the need to perform the functions of at least one element and / or system of the aircraft’s combat system by a remote computing resource located outside the structural boundaries of the aircraft; - redirection of input data intended for the specified element and / or BO system to the on-board communication device; - receiving output data from a remote computing resource and submitting it to the corresponding LA BO systems and / or to actuators; an on-board communication unit (OCU) connected to the BCU and configured to: - transmission of input data via a wireless communication channel to a remote computing resource; - receiving output data from a remote computing resource via a wireless communication channel and transmitting them to the control unit.

14. An aircraft according to paragraph 13, characterized in that it is an unmanned aerial vehicle (UAV).

Images