CN116125870A - Redundancy control method, arbitration unit, flight control system and storage medium - Google Patents

Redundancy control method, arbitration unit, flight control system and storage medium Download PDF

Info

Publication number
CN116125870A
CN116125870A CN202211659720.XA CN202211659720A CN116125870A CN 116125870 A CN116125870 A CN 116125870A CN 202211659720 A CN202211659720 A CN 202211659720A CN 116125870 A CN116125870 A CN 116125870A
Authority
CN
China
Prior art keywords
flight control
actuator
processor
control computer
control
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202211659720.XA
Other languages
Chinese (zh)
Inventor
赵大玮
江立为
李道斌
周文杰
黄思策
彭继平
朱明辉
薛松柏
郭亮
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Chengdu Wofeitianyu Technology Co ltd
Zhejiang Geely Holding Group Co Ltd
Original Assignee
Chengdu Wofeitianyu Technology Co ltd
Zhejiang Geely Holding Group Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Chengdu Wofeitianyu Technology Co ltd, Zhejiang Geely Holding Group Co Ltd filed Critical Chengdu Wofeitianyu Technology Co ltd
Priority to CN202211659720.XA priority Critical patent/CN116125870A/en
Publication of CN116125870A publication Critical patent/CN116125870A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
    • G05B19/0423—Input/output
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/20—Pc systems
    • G05B2219/25—Pc structure of the system
    • G05B2219/25257—Microcontroller

Landscapes

  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Engineering & Computer Science (AREA)
  • Automation & Control Theory (AREA)
  • Safety Devices In Control Systems (AREA)

Abstract

The invention discloses a redundancy control method, an arbitration unit, a flight control system and a storage medium. When a certain flight control computer is judged to be faulty, the signal output of the flight control computer with the fault is cut off, and the flight control computer which controls the normal work sends a received control instruction to an actuator processor so as to realize the control of the actuator processor. Compared with the prior art, the arbitration unit can determine whether the flight control computer has faults or not only according to the current control instruction and the check code of the flight control computer, and perform corresponding control, so that the calculation pressure on the arbitration unit in the fault detection process of the redundancy flight control computer is reduced.

Description

Redundancy control method, arbitration unit, flight control system and storage medium
Technical Field
The invention relates to the technical field of aircrafts, in particular to a redundancy control method, an arbitration unit, a flight control system and a storage medium.
Background
Along with the development of the design technology, the production and manufacturing technology and related matched industries of the small-sized aircrafts, the functions, the performances and the output of the small-sized aircrafts are gradually stable and mature, and the operation of the small-sized aircrafts is gradually developed to the civil navigation fields of logistics transportation, manned transportation and the like. However, due to the particularities of the flying platform itself, an entirely new challenge is presented to the safety of the aircraft.
In the related art, when performance and fault detection are performed on two flight control computers, the singlechip arbitration unit receives state information output by the two flight control computers and performs next state prediction based on historical state information, and if the next state output of one flight control computer is not matched with the prediction range of the arbitration unit, the flight control computer is determined to be invalid. However, the arbitration unit needs to analyze the historical state information and predict the next output range of the flight control computer, and has high requirement on the computing power of the arbitration unit.
Disclosure of Invention
The embodiment of the application aims to reduce the calculation pressure on an arbitration unit in the fault detection process of a redundancy flight control computer by providing the redundancy control method, the arbitration unit, the flight control system and the storage medium.
The embodiment of the application provides a redundancy control method of a flight control system applied to an arbitration unit, wherein the redundancy control method of the flight control system comprises the following steps:
receiving control information of at least two flight control computers, wherein the control information comprises a control instruction and a check code;
determining whether the flight control computer has faults according to the control information;
cutting off the signal output of the flight control computer with faults;
and the flight control computer controlling normal work sends the received control instruction to the actuator processor.
In addition, in order to achieve the above object, the present invention also provides an arbitration unit including: the redundancy control method comprises the steps of a memory, a processor and a redundancy control program of a flight control system, wherein the redundancy control program is stored in the memory and can run on the processor, and the redundancy control program of the flight control system is executed by the processor to realize the redundancy control method of the flight control system.
In addition, in order to achieve the above purpose, the present invention also provides a flight control system, which includes an arbitration unit.
In addition, in order to achieve the above object, the present invention further provides a computer readable storage medium, on which a redundancy control program of a flight control system is stored, where the redundancy control program of the flight control system implements the steps of the redundancy control method of the flight control system when executed by a processor.
According to the technical scheme of the redundancy control method, the arbitration unit, the flight control system and the storage medium, the arbitration unit is added to receive the control instruction and the check code of each flight control computer, and then whether the flight control computer has faults or not is determined according to the control instruction and the check code. When a certain flight control computer is judged to be faulty, the signal output of the flight control computer with the fault is cut off, and the flight control computer which controls the normal work sends a received control instruction to an actuator processor so as to realize the control of the actuator processor. Compared with the prior art, the arbitration unit can determine whether the flight control computer has faults or not only according to the current control instruction and the check code of the flight control computer, and perform corresponding control, so that the calculation pressure on the arbitration unit in the fault detection process of the redundancy flight control computer is reduced.
Drawings
FIG. 1 is a flow chart of a first embodiment of a redundancy control method of a flight control system according to the present invention;
FIG. 2 is a flow chart of a second embodiment of a redundancy control method of the flight control system of the present invention;
FIG. 3 is a schematic diagram of the hardware architecture of the arbitration unit of the present invention;
Fig. 4 is a schematic structural diagram of the flight control system of the present invention.
The achievement of the objects, functional features and advantages of the present application will be further described with reference to embodiments, with reference to the accompanying drawings, which are only illustrations of one embodiment, but not all of the inventions.
Detailed Description
In the application, the problem that the calculation capability and the storage energy requirement of the arbitration unit are high is solved by considering that the arbitration unit needs to analyze the historical state information and predict the next output range of the flight control computer in the related technology. The application provides a redundancy control method of a flight control system. The application adds an arbitration unit. The arbitration unit detects the output of the flight control computers, each flight control computer should be accompanied with a group of verification codes when outputting instructions to prove that the flight control computers are still working normally, and the arbitration unit judges whether the flight control computers have faults or not by comparing the output control instructions of the flight control computers and checking the verification codes. If judging that the verification code output by one flight control computer has a fault, disconnecting the flight control computer to output a control signal, and selecting the other flight control computer to output the control signal; if the output control instructions of the two flight control computers are not matched, all the flight control computer output control signals are cut off, manual control instruction control signals are obtained, the calculation pressure on an arbitration unit in the fault detection process of the redundant flight control computers is reduced, and the flight safety of the aircraft is improved.
In order that the above-described aspects may be better understood, exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.
As shown in fig. 1, in a first embodiment of the present application, the redundancy control method of the flight control system of the present application is applied to an arbitration unit, where the arbitration unit is configured to determine whether a flight control computer has a fault, and determine a corresponding control policy according to a determination result, so that an aircraft may fly safely. The redundancy control method of the flight control system comprises the following steps:
step S110, control information of at least two flight control computers is received, wherein the control information comprises a control instruction and a check code.
In this embodiment, the flight control computer of the present application may be configured to be redundant. That is, in the flight control system, the number of flight control computers can be two or even more, and the number of flight control computers can be set according to actual use conditions and specific application scenes. When all the flight control computers work normally, different flight control computers can be used for executing different control functions. When a certain flight control computer fails, the flight control computer which works normally can be adopted to replace the failed flight control computer to execute the control function of the failed flight control computer. It is assumed that there are two flight control computers, a first flight control computer and a second flight control computer. When the first flight control computer and the second flight control computer are normal, the first flight control computer is used for controlling the control surface to work, and the second flight control computer is used for controlling the tilting unit to work. When the first flight control computer fails, the second flight control computer can be adopted to control the control surface and the tilting unit to work. Similarly, when the second flight control computer fails, the first flight control computer can be adopted to control the control surface and the tilting unit to work.
In this embodiment, each flight control computer sends a control instruction to the actuator processor in real time during the flight, so that the actuator processor can control the actuator based on the control instruction sent by the flight control computer. In order to improve the flight safety performance, the control information of each flight control computer is required to be sent to an arbitration unit, the arbitration unit is adopted to judge whether the flight control computer has faults in real time, and the corresponding control strategy is determined to control the actuator processor according to the judgment result, so that the flight safety is improved.
Optionally, the control information of each flight control computer can be synchronously sent to the arbitration unit at intervals of preset time, so that inaccurate fault judgment caused by asynchronous data transmission is avoided, and the stability of the aircraft is further affected.
Optionally, each flight control computer outputs a corresponding control instruction, where the control instruction is an instruction for controlling operations of the motor, the control surface, the accelerator, and the like. The control commands include, for example, throttle commands, rudder bias commands, motor speed commands, motor torque commands, etc.
Optionally, each flight control computer outputs a check code, and the check code is used for checking and judging whether the flight control computer has failure. The format of the check code can be preset according to different models.
And step S120, determining whether the flight control computer has faults according to the control information.
In this embodiment, when each flight control computer outputs a control command, a group of verification codes are attached to prove that the flight control computer is still working normally, and the arbitration unit can judge whether the flight control computer has a fault condition by comparing the control command output by each flight control computer with the verification codes.
Optionally, a preset check code is preset in the arbitration unit, and the format and type of the preset check code should be consistent with those of the check code sent by the flight control computer. That is, after the arbitration unit receives the check codes of the flight control computers, format matching and type matching are performed on the received check codes of the flight control computers and preset check codes respectively. If the check code of the flight control computer is not matched with the preset check code, determining that the flight control computer which is not matched is the flight control computer with the fault, namely the failed flight control computer. Alternatively, a flight control computer having no signal output or no scrambling code output may be determined as a faulty flight control computer. Optionally, when the flight control computer outputs the control instruction at a constant frequency, the arbitration unit determines that the flight control computer is a flight control computer with a fault if the output frequency is detected to be disconnected.
For example, assume that there is a first flight control computer and a second flight control computer. If the check code of the first flight control computer is inconsistent with the preset check code, determining the first flight control computer as the flight control computer with the fault; if the check code of the second flight control computer is inconsistent with the preset check code, determining the second flight control computer as the flight control computer with the fault; and if the check codes of the first flight control computer and the second flight control computer are inconsistent with the preset check codes, determining the first flight control computer and the second flight control computer as the flight control computer with faults.
Optionally, when the matched flight control computer includes at least two, then an error between the control instructions received by the matched flight control computer is determined. The flight control computers with the determined errors larger than the preset errors are all the flight control computers with faults.
Alternatively, the control instruction includes a plurality of types, which may be a discrete control instruction, a continuous control instruction, a boolean control instruction, or the like. The preset errors set by the different types of control instructions are different. For example: regarding discrete control commands, such as throttle commands: 10% of the value range; regarding continuous control instructions, such as rudder deflection instructions: 5% of the value range per se; regarding boolean control instructions, such as take-off instructions: 0 (i.e., zero margin).
For example, assume that the flight control computers for which the check codes match are a first flight control computer and a second flight control computer. And the types of control instructions adopted by the first flight control computer and the second flight control computer are discrete types. Then, an error between the control command of the first flight control computer and the control command of the second flight control computer can be calculated, and when the error is greater than 10% of the value range of the first flight control computer and the second flight control computer, the first flight control computer and the second flight control computer are determined to be the flight control computers with faults. When the error is smaller than 10% of the value range, the first flight control computer and the second flight control computer are determined to be the flight control computers working normally.
Step S130, cutting off the signal output of the flight control computer with fault.
Optionally, each flight control computer is connected to the arbitration unit and the actuator processor through a signal switch. The default state of the signal switch is the closed state. When the arbitration unit detects that the flight control computer has a fault, an off signal is sent to a signal switch connected with the fault flight control computer, so that the signal output of the flight control computer with the fault is cut off.
And step S140, the flight control computer controlling normal work sends the received control instruction to the actuator processor.
In this embodiment, if it is determined that the check code output by one of the flight control computers has a fault, the flight control computer is disconnected to output a control instruction, and the control instruction output by the other flight control computer that works normally is selected to be sent to the actuator processor.
Alternatively, the actuator processor may be a redundancy setting in addition to the flight control computer. The actuator processor of this application includes two at least, and under the circumstances that all flight control computers normally work, every flight control computer accessible corresponding signal switch control corresponds actuator processor. However, when one of the flight control computers fails, the flight control computer that can control normal operation controls all of the actuator processors. Optionally, a signal switch corresponding to the flight control computer capable of controlling normal operation is closed, so that the signal switch is connected with all actuator processors.
For example, if it is detected that the first flight control computer has a fault and the second flight control computer is normal, the arbitration unit transmits an off signal to a signal switch connected to the first flight control computer, thereby cutting off the signal output of the first flight control computer. And sending a closing signal to a signal switch corresponding to the second flight control computer, so that the signal switch corresponding to the second flight control computer can be connected with all actuator processors, and further the second flight control computer is controlled to send the received control instruction to all actuator processors. Thereby realizing the control of all actuators by the second flight control computer.
Optionally, when all the flight control computers have faults, signal output of all the flight control computers is cut off, a signal channel between the control lever and the actuator processor is communicated, and then a control signal output by the control lever is sent to the actuator processor, so that the control is performed in a manual control mode, and the influence on flight safety of the aircraft is avoided when all the flight control computers have faults.
When the check codes of all the flight control computers are not matched with the preset check codes, a signal channel between the control lever and the actuator processor is communicated, and then a control signal output by the control lever is sent to the actuator processor, so that the control is performed in a manual control mode, and the influence on the flight safety of the aircraft is avoided when all the flight control computers fail.
And when the check codes of all the flight control computers are matched with the preset check codes, but the error between the control instructions received by the matched flight control computers is larger than the preset error, the signal channel between the control lever and the actuator processor is communicated, and further, the control signal output by the control lever is sent to the actuator processor, so that the control is performed in a manual control mode, and the influence on the flight safety of the aircraft is avoided when all the flight control computers are in failure.
And when the output frequency of the control instructions of all the flight control computers fluctuates, the signal channels between the control rod and the actuator processor are communicated, and then the control signals output by the control rod are sent to the actuator processor, so that the control is performed in a manual control mode, and the influence on the flight safety of the aircraft is avoided when all the flight control computers fail.
Optionally, the flight control system of the present application further comprises a display. The arbitration unit may send the determination result of the flight control computer having the fault to the display for display. The determination result is specifically which flight control computer has a fault, and may be the serial number of the faulty flight control computer. Optionally, the arbitration unit may also send a reason for the fault determination to the display, where the reason for the fault determination may be that the check codes are inconsistent, the error between the control commands is greater than a preset error, and so on.
Optionally, the present application may switch to a manual control mode in addition to controlling an actuator or an actuator connected to the actuator processor by the flight control computer, and send a control signal output by the joystick to the actuator processor by connecting a signal channel between the joystick and the actuator processor, so as to control the actuator or the actuator. When all flight control computers fail, the actuators or the executing mechanisms can be controlled in a manual control mode, and the flight safety of the flight system is improved.
Optionally, the joystick is connected to the actuator processor through a signal switch, and the default state of the signal switch is an off state. A closing signal is sent to the signal switch at the arbitration unit, indicating receipt of an arbitration intervention instruction. At this time, the arbitration unit cuts off the signal output of all flight control computers. In addition, when the signal switch is closed, a signal channel between the control rod and the actuator processor is communicated, so that a control signal output by the control rod is sent to the actuator processor. Specific control modes include, but are not limited to, the following:
for example, an operator may select at any time in which manner to control the aircraft. When all flight control computers work normally and receive arbitration intervention instructions, control output of all flight control computers is cut off, a signal channel between a control rod and the actuator processor is communicated, and control signals output by the control rod are sent to the actuator processor.
In the second example, when all the flight control computers have faults or a certain flight control computer has faults, when an arbitration intervention instruction is received, the control output of all the flight control computers is cut off, and a signal channel between a control lever and the actuator processor is communicated, so that a control signal output by the control lever is sent to the actuator processor.
In a third example, when it is detected that the check code of a certain flight control computer is not matched with a preset check code, an arbitration intervention instruction is received, control outputs of all flight control computers are cut off, and a signal channel between a joystick and the actuator processor is connected so as to send a control signal output by the joystick to the actuator processor.
In a fourth example, when the error of the control command of each flight control computer is detected to be greater than the preset error, an arbitration intervention command is received, the control outputs of all flight control computers are cut off, and a signal channel between a joystick and the actuator processor is communicated, so that a control signal output by the joystick is sent to the actuator processor.
According to the technical scheme, the arbitration unit is added to receive the control instruction and the check code of each flight control computer, and then whether the flight control computer has faults or not is determined according to the control instruction and the check code. When a certain flight control computer is judged to be faulty, the signal output of the flight control computer with the fault is cut off, and the flight control computer which controls the normal work sends a received control instruction to an actuator processor so as to realize the control of the actuator processor. Compared with the prior art, the arbitration unit can determine whether the flight control computer has faults or not only according to the current control instruction and the check code of the flight control computer, and perform corresponding control, so that the calculation pressure on the arbitration unit in the fault detection process of the redundancy flight control computer is reduced. In addition, when all the flight control computers are detected to be faulty, the control is switched to manual control.
In an embodiment, in the flight control system of the present application, the number of flight control computers, actuator processors and actuators may be two or more, and the number of flight control computers, actuator processors and actuators may be set according to actual use situations and specific application scenarios. The application is exemplified by a flight control computer, an actuator processor, and an actuator with dual redundancy settings.
Before the actuator receives control, the actuator processor is required to convert the main control instruction sent by the flight control computer into output current to the actuator. In order to enable normal control, it is necessary to ensure that the actuator processor is able to function properly. Therefore, the application adopts a mechanism that actuator processors mutually monitor, each actuator processor receives control instructions of all flight control computers, wherein one control instruction is a main control instruction of the own and is used for being output to an actuator to drive an executing mechanism; the other flight control computer control command has the effect of verifying whether the other actuator processor is normal. When a single actuator processor fails, the other normal actuator processor intervenes to cut off the output of the failed actuator processor, and simultaneously the two separated actuators are locked, so that all the actuators are operated by the normal actuators.
Furthermore, each actuator processor processes two tasks in double threads in parallel, the first thread task is to convert a main flight control instruction to a corresponding actuator motor, and the second thread is to check whether the output is reasonable or not according to the input and the output of the opposite actuator processor. The use of a dual thread design is intended to avoid conflicts between the checking process and the primary computing job.
Further, an algorithm is performed in the second thread, including an input algorithm and an output algorithm. First, an input checking algorithm is performed. The input checking algorithm comprises the following steps: judging whether the main flight control instruction received by the opposite side is matched with the checking flight control instruction received by the processor, if not, informing the main flight control computer of the processor of the opposite side of the error and cutting off the power output of the processor of the opposite side actuator. If so, performing an output checking algorithm. The output checking algorithm is as follows: when the checking calculation shows that the output of the processor of the opposite actuator is unreasonable, a disconnection signal is output to a power switch of the opposite actuator, and a locking signal is output to a locking mechanism between the execution mechanisms, so that the own actuator can control the two execution mechanisms simultaneously.
Because the mutual detection method of the dual-redundancy actuator processors is adopted, the dual-redundancy mutual detection should allow the two actuator processors to share all data, including the data output to the actuator processor by the flight control computer, the output data of the actuator processor and the feedback data of the sensor corresponding to the actuator, when one actuator processor finds that the input or the output of the other actuator processor is not matched, the other actuator processor cuts off the output power of the other actuator processor, so that the operability of the whole actuator is protected. In addition, the mutual detection of the two actuator processors judges whether the opposite actuator processor outputs errors through a parallel verification algorithm, so that the situation that the input and output of the other actuator processor are checked by a main driving algorithm is avoided, the verification algorithm is independent of the main driving, and even if the main driving algorithm has a problem, the independent verification algorithm is not affected. The other actuator processor can close the output of the fault actuator processor immediately, so that the flight stability and safety are improved.
Optionally, when the redundancy control method of the flight control system of the present application is applied to the first actuator processor, the first actuator processor may receive control instructions of all flight control computers under the condition that the first actuator processor and the second actuator processor work normally, including a verification flight control instruction sent by the first flight control computer and a main flight control instruction sent by the second flight control computer. Similarly, the second actuator processor may also receive control instructions from all the flight control computers, including a verification flight control instruction sent by the second flight control computer and a main flight control instruction sent by the first flight control computer. The first actuator processor and the second actuator processor can send own main flight control instructions to the opposite actuator processor so as to check whether the opposite actuator processor can work normally.
Alternatively, the present application exemplifies the execution of an input check algorithm in the first actuator processor. For the first actuator processor, in order to verify whether the second actuator processor can work normally, the first actuator processor can acquire a main flight control instruction sent by the second actuator processor, and the main flight control instruction is sent to the second actuator processor by the first flight control computer. The second actuator processor sends the main flight control instruction to the first actuator processor so as to verify the second actuator processor by adopting the first actuator processor. Optionally, the first actuator processor may match the main flight control instruction with the own verification flight control instruction, when the main flight control instruction is not matched with the verification flight control instruction, it indicates that the first actuator processor verifies that the second actuator processor may have a fault, at this time, an off signal may be sent to a power switch corresponding to the second actuator processor, and meanwhile, the first actuator processor may also send a locking signal to the locking mechanism to lock the corresponding executing mechanism, so that the first actuator processor may synchronously control the executing mechanism locked together.
Similarly, the redundancy control method of the flight control system is also applicable to the second actuator processor, and an input checking algorithm can be executed in the second actuator processor. Optionally, for the second actuator processor, in order to verify whether the first actuator processor can work normally, the second actuator processor can obtain a main flight control instruction sent by the first actuator processor, where the main flight control instruction is sent to the first actuator processor by the second flight control computer. The first actuator processor sends the main flight control instruction to the second actuator processor so as to verify the first actuator processor by adopting the second actuator processor. Optionally, the second actuator processor may match the main flight control instruction with the own verification flight control instruction, when the main flight control instruction is not matched with the verification flight control instruction, it indicates that the second actuator processor verifies that the first actuator processor may have a fault, at this time, the second actuator processor may send a disconnection signal to a power switch corresponding to the first actuator processor, and meanwhile, the second actuator processor may also send a locking signal to the locking mechanism, so that the corresponding executing mechanism is locked, and the second actuator processor can synchronously control the executing mechanism locked together.
Optionally, a third party monitoring module may be further provided, and an input checking algorithm may be performed in the third party monitoring module. The redundancy control method of the flight control system is also applicable to the third party monitoring module. And an inspection algorithm is arranged in the third party monitoring module, and can acquire a verification flight control instruction sent to the first actuator processor by the first flight control computer and simultaneously acquire a main flight control instruction sent to the second actuator processor by the first flight control computer.
Optionally, the third party monitoring module may match the verification flight control instruction with the main flight control instruction, when the main flight control instruction is not matched with the verification flight control instruction, it indicates that the second actuator processor may fail in verification calculation, at this time, the first actuator processor may send a disconnection signal to a power switch corresponding to the second actuator processor, and at the same time, the first actuator processor may also send a locking signal to the locking mechanism, so that the corresponding executing mechanism is locked, and the first actuator processor may synchronously control the executing mechanism locked together.
Similarly, the third party monitoring module also obtains a verification flight control instruction sent to the second actuator processor by the second flight control computer, and simultaneously obtains a main flight control instruction sent to the first actuator processor by the second flight control computer. Optionally, the third party monitoring module may match the verification flight control instruction with the main flight control instruction, when the main flight control instruction is not matched with the verification flight control instruction, it indicates that the first actuator processor may fail in verification calculation, at this time, the second actuator processor may send a disconnection signal to a power switch corresponding to the first actuator processor, and at the same time, the second actuator processor may also send a locking signal to the locking mechanism, so that the corresponding executing mechanism is locked, and the second actuator processor may synchronously control the executing mechanism locked together.
Optionally, when the input checking algorithm is executed, if the main flight control instruction is not matched with the verification flight control instruction, informing the main flight control computer of the processor of the opposite actuator of the error, and cutting off the power output of the processor of the opposite actuator.
Optionally, for the first actuator processor, when the first actuator processor determines that the main flight control instruction of the second actuator processor is not matched with the self verification flight control instruction, error information including the mismatch between the main flight control instruction and the verification flight control instruction can be generated, and the error information is sent to the main flight control computer of the second actuator processor, namely the first flight control computer, so that the error information can be timely fed back and corresponding correction can be timely made, and flight accidents are avoided.
Similarly, for the second actuator processor, when the second actuator determines that the main flight control instruction of the first actuator processor is not matched with the self verification flight control instruction, error information including the mismatch between the main flight control instruction and the verification flight control instruction can be generated, and the error information is sent to the main flight control computer of the first actuator processor, namely the second flight control computer, so that the error information can be timely fed back and corresponding correction can be timely made, and flight accidents are avoided.
Optionally, if the first actuator processor and the second actuator processor both verify that the other has a fault. In order to avoid the problem that all actuator processors are completely closed, actuators or actuating mechanisms cannot be controlled, and therefore an aircraft cannot fly normally, the device is further provided with a limiter, the limiter is connected with the actuator processors and the power switch and used for controlling the power switch connected with at least one actuator processor to be closed when receiving disconnection signals sent by all actuator processors or controlling the at least one actuator processor to send locking signals to the locking mechanism when receiving disconnection signals sent by all actuator processors. I.e. to ensure that at least one actuator processor is present for proper control.
Optionally, to improve accuracy of the calculation result, synchronization of calculation of the first actuator processor and the second actuator processor needs to be ensured, that is, the first actuator processor and the second actuator processor are controlled to execute the calculation algorithm simultaneously.
Optionally, if the first actuator processor and the second actuator processor both verify that the opponent exists an input fault, the output of the actuator of the opponent actuator processor of the actuator processor that first verifies that the opponent exists the fault may be disconnected. For example, if the first actuator processor most a priori calculates that the second actuator processor is malfunctioning, then an off signal may be sent to the corresponding power switch of the second actuator processor. Optionally, a disconnection signal is sent to the limiter, so that when the second actuator processor also verifies that the first actuator processor has an input fault, the corresponding power switch of the first actuator processor is prevented from being disconnected.
Optionally, if the first actuator processor and the second actuator processor verify that the opposite side has the input fault, the power switch corresponding to the actuator server meeting the conditions of the maximum number of historical faults, the minimum historical use frequency, the minimum service quality and the like can also send a disconnection signal.
Alternatively, for redundancy control of the entire flight control system, different flight control computers may be used to perform different control functions while all flight control computers are operating properly. When a certain flight control computer fails, the flight control computer which works normally can be adopted to replace the failed flight control computer to execute the control function of the failed flight control computer. Similarly, while all of the actuator processors are operating normally, different actuator processors may be used to perform different data processing functions and control the operation of the connected actuators. When a certain actuator processor fails, the normal operating actuator processor can be adopted to replace the failed actuator processor, and the actuator connected with the failed actuator processor can be controlled. Similarly, when all actuators are operating normally, different actuators may be used to drive their corresponding actuators. However, when a certain actuator fails, an actuator processor connected with the normal working actuator can be used for sending a locking signal to the locking mechanism, so that the actuator processor in normal working can synchronously control the execution mechanism locked together.
Alternatively, it is assumed that the flight control computer, actuator processor and actuator are all configured for dual redundancy. The flight control computer comprises a first flight control computer and a second flight control computer; the actuator processor comprises a first actuator processor and a second actuator processor; the actuator comprises a first actuator and a second actuator; the actuator comprises a first actuator and a second actuator. Then there are, but not limited to, the following:
first, for all flight control computers, all actuator processors and all actuators operating normally. The control flow is as follows: the first flight control computer sends a main flight control instruction to the first actuator processor; the first actuator processor converts the main control instruction into a current signal and sends the current signal to the first actuator, and the first actuator sends the current signal to the first executing mechanism, so that the first flight control computer drives the first executing mechanism. Simultaneously, the second flight control computer sends a main flight control instruction to a second actuator processor; the second actuator processor converts the main control instruction into a current signal and sends the current signal to the second actuator, and the second actuator sends the current signal to the second executing mechanism, so that the second flight control computer drives the second executing mechanism. Therefore, under the condition that all the devices work normally, each device can perform its own function, so that the aircraft can work normally.
Secondly, aiming at the condition that the first flight control computer fails or the second flight control computer fails, all actuator processors work normally. The control flow for the first flight control computer fault is as follows: the second flight control computer sends the main flight control instruction to the first actuator processor and the second actuator processor simultaneously. So that the first actuator processor and the second actuator processor respectively perform control. Alternatively, only the main flight control command of the second flight control computer may be sent to the second actuator processor connected thereto, and the second actuator processor may be used to control all actuators and actuators. Similarly, the control flow for the second flight control computer fault is as follows: the first flight control computer sends the main flight control instruction to the first actuator processor and the second actuator processor simultaneously. So that the first actuator processor and the second actuator processor respectively perform control. Alternatively, only the main flight control command of the first flight control computer may be sent to the first actuator processor connected thereto, and all actuators and actuators may be controlled by using the first actuator processor. Therefore, when a certain flight control computer fails, all the normal actuators and executing mechanisms can be controlled by the flight control computer working normally, and the flight safety is improved.
Thirdly, aiming at the situation that all flight control computers are normal and the first actuator processor or the second actuator processor is in fault. The control flow for the first actuator processor failure is: the second flight control computer sends a main control instruction to the second actuator processor, and the second actuator processor converts the main control instruction into a current signal and sends the current signal to the second actuator. Meanwhile, the second actuator processor sends a locking signal to the locking mechanism to lock the actuating mechanism, and sends a disconnection signal to a power switch corresponding to the first actuator processor, so that the flight control computer which works normally can control all the actuating mechanisms through the second actuator processor. Similarly, the control flow for the second actuator processor failure is: the first flight control computer sends a main control instruction to the first actuator processor, and the first actuator processor converts the main control instruction into a current signal and sends the current signal to the first actuator. Meanwhile, the first actuator processor sends a locking signal to the locking mechanism to lock the actuating mechanism, and sends a disconnection signal to a power switch corresponding to the second actuator processor, so that the flight control computer which works normally can control all the actuating mechanisms through the first actuator processor. Therefore, when one actuator processor fails, the normal working actuator processor can be controlled by the normal working flight control computer to control all the actuating mechanisms, so that the flight safety is improved.
Fourth, to all flight control computer abnormality, the first actuator processor and/or the second actuator processor normal condition, but switch to manual control mode, adopt manual control's mode to control to avoid all flight control computer trouble time, cause the influence to the flight safety of aircraft.
In summary, relative redundancy control is designed by each of three levels of output from the flight control computer, actuator processor, and actuator. An arbitration unit is set at the level of the flight control computer to judge whether the flight control computer fails or not, and a solution strategy is judged according to the failure condition. The actuator processors are mutually supervised and detected at the actuator processor level, and when the output of the processor of the opposite actuator is not matched with the input, the output of the opposite actuator is cut off. Therefore, when one device discovers that the other device fails, the power output of the other device can be cut off in time, and normal devices are adopted to control all the actuating mechanisms, so that the operability of the whole actuating mechanism is protected, and the flight safety is improved.
In one embodiment, when the input checking algorithm determines that the main flight control command received by the opposite party matches the checking flight control command received by the actuator processor. The output checking algorithm is further executed. The output checking algorithm is as follows: when the checking calculation shows that the output of the processor of the opposite actuator is unreasonable, a disconnection signal is output to a power switch of the opposite actuator, and a locking signal is output to a locking mechanism between the execution mechanisms, so that the own actuator can control the two execution mechanisms simultaneously.
Alternatively, the present application exemplifies the execution of an output checking algorithm in the first actuator processor. For the first actuator processor, in order to further verify whether the second actuator processor can work normally, when the first actuator processor verifies that the main flight control instruction is matched with the verification flight control instruction, the first actuator processor acquires a first output instruction generated by the first actuator processor according to the verification flight control instruction, and after acquiring a second output instruction generated by the second actuator processor according to the main flight control instruction, an output checking algorithm is executed as follows: the first output instruction is matched with the second output instruction. When the first output instruction is not matched with the second output instruction, the first actuator processor is indicated to check that the output of the second actuator processor is likely to have faults, at the moment, a disconnection signal is sent to a power switch corresponding to the second actuator processor, and meanwhile, the first actuator processor also sends a locking signal to a locking mechanism to lock the corresponding executing mechanism, so that the executing mechanism locked together can be synchronously controlled by the first actuator processor.
Similarly, the present application may execute an output checking algorithm in the second actuator processor. Optionally, for the second actuator processor, in order to verify whether the output of the first actuator processor is normal, thereby verifying whether the first actuator processor can work normally, when the main flight control verification instruction matches with the flight control verification instruction, the second actuator processor obtains a second output instruction generated by the second actuator processor according to the flight control verification instruction, and after obtaining a first output instruction generated by the first actuator processor according to the main flight control instruction, an output checking algorithm is executed as follows: the first output instruction is matched with the second output instruction. When the first output instruction is not matched with the second output instruction, the second actuator processor is indicated to check that the output of the first actuator processor is likely to have faults, at the moment, a disconnection signal is sent to a power switch corresponding to the first actuator processor, and meanwhile, the second actuator processor also sends a locking signal to a locking mechanism to lock the corresponding executing mechanism, so that the executing mechanism locked together can be synchronously controlled by the second actuator processor.
Optionally, a third party monitoring module may be further provided, and an output checking algorithm may be performed in the third party monitoring module.
Optionally, when the third party monitoring module verifies that the main flight control instruction of the first flight control computer (the main flight control instruction is sent to the second actuator processor by the first flight control computer) matches the verification flight control instruction, the output checking algorithm may be further executed: and acquiring a first output instruction generated by the first actuator processor according to the verification flight control instruction, and acquiring a second output instruction generated by the second actuator processor according to the main flight control instruction. The third party monitoring module can match the first output instruction with the second output instruction, when the first output instruction is not matched with the second output instruction, the first actuator processor is indicated to check that the output of the second actuator processor is likely to have faults, at the moment, a disconnection signal is sent to a power switch corresponding to the second actuator processor, and meanwhile, the first actuator processor also sends a locking signal to the locking mechanism to lock the corresponding executing mechanism, so that the executing mechanism locked together can be synchronously controlled by the first actuator processor.
Optionally, if the first actuator processor and the second actuator processor both verify that there is a fault in the output of the other. In order to avoid the problem that all actuator processors are completely closed, actuators or actuating mechanisms cannot be controlled, and therefore an aircraft cannot fly normally, the device is further provided with a limiter, the limiter is connected with the actuator processors and the power switch and used for controlling the power switch connected with at least one actuator processor to be closed when receiving disconnection signals sent by all actuator processors or controlling the at least one actuator processor to send locking signals to the locking mechanism when receiving disconnection signals sent by all actuator processors. I.e. to ensure that at least one actuator processor is present for proper control.
Optionally, to improve accuracy of the calculation result, synchronization of calculation of the first actuator processor and the second actuator processor needs to be ensured, that is, the first actuator processor and the second actuator processor are controlled to execute the calculation algorithm simultaneously.
Optionally, if the first actuator processor and the second actuator processor both verify that the opposite side has an output fault, the output of the actuator of the opposite side actuator processor of the actuator processor that first verifies that the opposite side has the output fault may be disconnected. For example, if the first actuator processor most a priori calculates that the second actuator processor has an output fault, then an off signal may be sent to the power switch corresponding to the second actuator processor. Optionally, a disconnection signal is sent to the limiter, so that when the second actuator processor also verifies that the first actuator processor has an output fault, the corresponding power switch of the first actuator processor is disconnected, and all actuator processors are closed, so that the flight safety is influenced.
Optionally, if the first actuator processor and the second actuator processor verify that the opposite side has the output fault, the power switch corresponding to the actuator server meeting the conditions of the maximum number of historical faults, the minimum historical use frequency, the minimum service quality and the like can also send a disconnection signal.
In summary, through making the mutual supervision detection of actuator treater in actuator treater level, when the output of opponent actuator treater mismatch input, can cut off the output of opponent actuator to connect locking mechanism, make another normal actuator control two actuating mechanism simultaneously. Therefore, when one device discovers that the other device fails, the power output of the other device can be cut off in time, and normal devices are adopted to control all the actuating mechanisms, so that the operability of the whole actuating mechanism is protected, and the flight safety is improved.
In an embodiment, each of the actuator processors processes two tasks in parallel in a dual-thread manner, where the task of the first thread is to convert the main flight control instruction to the corresponding actuator motor, and the execution process of the second thread is described in the first embodiment and the second embodiment, which are not described herein again. The use of a dual thread design is intended to avoid conflicts between the checking process and the primary computing job. Alternatively, the second thread may be executed in real time while the first thread is executing. In one embodiment, after executing the second thread, the first thread is executed when it is determined that there is no fault.
Optionally, the first actuator processor may receive the main flight control instruction of the second flight control computer to control while receiving the verification flight control instruction of the first flight control computer to perform checking calculation, and send the main flight control instruction to an actuator corresponding to the first actuator processor. Optionally, the first actuator processor converts the main flight control command into a current signal and sends the current signal to the first actuator. The first actuator processor side is also provided with a first power switch which is connected with the first actuator and the first actuating mechanism. The default state of the first power switch is a closed state, so that a current signal of the first actuator can be transmitted to the first executing mechanism, and the control of the first executing mechanism is realized.
Similarly, the second actuator processor can receive the main flight control instruction of the first flight control computer to control the second actuator processor while receiving the verification flight control instruction of the second flight control computer to perform checking calculation, and send the main flight control instruction to an executing mechanism corresponding to the second actuator processor. Optionally, the second actuator processor converts the main flight control command into a current signal and sends the current signal to the second actuator. And a second power switch is arranged on the processor side of the second actuator, and the second power switch is connected with the second actuator and the second actuating mechanism. The default state of the second power switch is a closed state, so that a current signal of the second actuator can be transmitted to the second actuating mechanism, and the control of the second actuating mechanism is realized.
In one embodiment, at the actuator level, the actuator is divided into two parts to be synchronously executed by the actuator, for example, an aileron control surface is cut into a left part and a right part, and a locking mechanism is arranged in the middle and can be used for locking the two parts into a whole after receiving signals. Each actuator controls the left part and the right part respectively, and when the control quantity fed back by one actuator is not matched with the control output of the processor of the corresponding actuator, the actuator is cut off, and a locking mechanism is connected, so that the other actuator simultaneously controls the two actuators.
The dual redundancy protection of the level is used for ensuring that the actuating mechanism can work normally under the failure of a motor of the actuator on one side or the failure of the actuating mechanism. This hierarchy of algorithms is calculated by the actuator processor directly upstream of the failed actuator, and the inputs to the algorithms are the actual amount of actuation of the actuator, such as the actual angle of deflection of the aileron, as detected by the actuator's sensor. And when the actual manipulation quantity of the downstream actuator is not matched with the instruction output by the actuator processor, judging that the motor of the downstream actuator fails or the actuator fails. The processing method is similar to the processing result of the previous layer, namely, the output of the downstream actuator is cut off, and a locking signal is transmitted to the locking mechanism, and all the actuating mechanisms are controlled by the processor and the actuators of the actuator at the other side.
Optionally, on the premise that all actuator processors work normally, the redundancy control method of the present application further includes: acquiring the actual manipulation quantity of a first actuating mechanism corresponding to a second flight control computer at the processor side of the first actuator; judging whether the actual manipulation quantity is matched with the theoretical manipulation quantity of the main flight control instruction of the second flight control computer; when the actual manipulation quantity is not matched with the theoretical manipulation quantity of the main flight control instruction of the second flight control computer, indicating that a first actuator or a first actuating mechanism has faults, and sending a disconnection signal to a first actuator corresponding to a first actuator processor; and sending a locking signal to the locking mechanism to lock the corresponding actuating mechanism, so that the second actuator processor can synchronously control the actuating mechanisms locked together. Optionally, when the actual manipulation variable matches the theoretical manipulation variable of the main flight control instruction of the second flight control computer, a closing signal is sent to the first actuator, so that the main control instruction of the second flight control computer is sent to the first actuator corresponding to the first actuator processor.
Optionally, on the premise that all actuator processors work normally, the redundancy control method of the present application further includes: acquiring the actual manipulation quantity of a second actuating mechanism corresponding to the first flight control computer at the processor side of the second actuator; when the actual manipulation quantity is not matched with the theoretical manipulation quantity of the main flight control instruction of the first flight control computer, indicating that a fault exists in the second actuator or the second actuating mechanism, and sending a disconnection signal to the second actuator corresponding to the second actuator processor; and sending a locking signal to the locking mechanism to lock the corresponding actuating mechanism, so that the first actuator processor can synchronously control the actuating mechanisms locked together. Optionally, when the actual manipulation variable matches the theoretical manipulation variable of the main flight control instruction of the first flight control computer, a closing signal is sent to the second actuator, so that the main control instruction of the second flight control computer is sent to a second executing mechanism corresponding to the second actuator processor.
In one embodiment, if the first actuator processor and the second actuator processor verify that the actuator or actuator itself is malfunctioning. In order to avoid the problem of an aircraft failing to fly properly as a result of all actuators or actuators being shut down, the present application also provides a limiter that connects the actuator processor to the power switch. The actuator level and the actuator processor level share a limiter for limiting that only one side signal can be cut off at the same time, namely, for controlling at least one actuator processor to send a locking signal to the locking mechanism when all the disconnection signals sent by the actuator processors are received.
According to the technical scheme, the actuating mechanism is divided into two parts at the output layer of the actuators, and each actuator synchronously executes the actuating mechanism. And when the control quantity fed back by one actuator is not matched with the control output of a processor of the corresponding actuator, the actuator is cut off, and the other actuator is connected with a locking mechanism to control all actuators at the same time, so that the operability of the whole actuator is protected, and the flight safety is improved.
Referring to FIG. 2, in one embodiment, the flight control system includes a first flight control computer, a second flight control computer, an arbitration unit, and a display. The redundancy control method comprises the following steps:
first, the first flight control computer sends a first flight control instruction and a check code of the first flight control computer to the arbitration unit, and the second flight control computer also sends a second flight control instruction and a check code of the second flight control computer to the arbitration unit.
Then, in the arbitration unit, the arbitration unit firstly checks whether the check codes of the two flight control computers are correct, and executes corresponding control strategies according to the check results, and the following cases are mainly divided:
and when the check code of the first flight control computer is wrong, the signal output of the first flight control computer is disconnected.
And secondly, when the check code of the second flight control computer is wrong, the signal output of the second flight control computer is disconnected.
And thirdly, when the check codes of the first flight control computer and the second flight control computer are wrong, the signal output of all flight control computers is disconnected and the control is switched to the control of the joystick.
Fourth, when the check codes of the first flight control computer and the second flight control computer are correct, comparing the error between the first flight control instruction of the first flight control computer and the second flight control instruction of the second flight control computer; when the error is smaller than the preset error, the signal output of all the flight control computers is disconnected and switched to the control of the control lever; when the error is larger than the preset error, all the flight control computers normally output and execute the related control strategy.
Finally, the arbitration unit sends arbitration information to the display for display in the execution process, so that an operator can decide whether to perform operations such as intervention or not according to the arbitration information, and the flight safety is improved.
Embodiments of the present invention provide embodiments of a redundancy control method for a flight control system, it being noted that although a logic sequence is shown in the flow chart, in some cases, the steps shown or described may be performed in a different order than that shown or described herein.
As shown in fig. 3, fig. 3 is a schematic structural diagram of a hardware running environment of the arbitration unit of the present invention.
As shown in fig. 3, the arbitration unit may include: a processor 1001, such as a CPU, memory 1005, user interface 1003, network interface 1004, communication bus 1002. Wherein the communication bus 1002 is used to enable connected communication between these components. The network interface 1004 may optionally include a standard wired interface, a wireless interface (e.g., WI-FI interface). The memory 1005 may be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. The memory 1005 may also optionally be a storage device separate from the processor 1001 described above.
It will be appreciated by those skilled in the art that the arbitration unit shown in fig. 3 is not limiting of the arbitration unit, and may include more or fewer components than shown, or may combine certain components, or a different arrangement of components.
As shown in fig. 3, a memory 1005, which is a storage medium, may include an operating system, a network communication module, a user interface module, and an redundancy control program of the flight control system. The operating system is a program for managing and controlling hardware and software resources of the arbitration unit, and the redundancy control program of the flight control system and other software or running of the program.
In the arbitration unit shown in fig. 3, the user interface 1003 is mainly used for connecting a terminal, and data communication is performed with the terminal; the network interface 1004 is mainly used for a background server and is in data communication with the background server; the processor 1001 may be used to invoke the redundancy control program of the flight control system stored in the memory 1005.
In this embodiment, the arbitration unit includes: a memory 1005, a processor 1001, and a redundancy control program of a flight control system stored on the memory and executable on the processor, wherein:
when the processor 1001 calls the redundancy control program of the flight control system stored in the memory 1005, the following operations are performed:
Receiving control information of at least two flight control computers, wherein the control information comprises a control instruction and a check code;
determining whether the flight control computer has faults according to the control information;
cutting off the signal output of the flight control computer with faults;
and the flight control computer controlling normal work sends the received control instruction to the actuator processor.
Based on the same inventive concept, the embodiment of the application also provides a flight control system, which comprises an arbitration unit, wherein the arbitration unit is used for judging whether the flight control computer has faults or not, and determining a corresponding control strategy according to a judgment result, so that the aircraft can fly safely.
Optionally, the flight control system comprises: at least two flight control computers;
the at least two signal switches are arranged corresponding to the flight control computer and are used for connecting the flight control computer and the actuator processing module;
the arbitration unit is respectively connected with each flight control computer and the signal switch and is used for sending an opening signal to the signal switch corresponding to the flight control computer with the fault when the flight control computer is in the fault, and the default state of the signal switch is a closed state.
Optionally, the flight control computer includes: a first flight control computer 110 and a second flight control computer 120, the signal switch comprising: a first signal switch 130 and a second signal switch 140; the first signal switch 130 and the second signal switch 140 are each coupled to the actuator processing module 160.
Optionally, the actuator processing module includes at least two actuation processing units, each actuation processing unit includes an actuator processor, an actuator, a power switch, and an actuator, the power switch being connected between the actuator and the actuator;
the locking mechanism is positioned between the execution mechanisms;
each actuator processor is respectively connected with a corresponding power switch and the locking mechanism, and is used for sending a disconnection signal to the power switch of the failed actuator processor and sending a locking signal to the locking mechanism when the actuator processor is detected to be failed; the default state of the locking mechanism is an off state.
Optionally, the actuator processor includes: the first signal switch and the second signal switch are connected with the first actuator processor; and/or, the first signal switch and the second signal switch are connected with the second actuator processor.
Optionally, the flight control system further comprises: and the limiter is connected with the actuator processors and the power switch and is used for controlling the power switch connected with at least one actuator processor to be closed when receiving the disconnection signals sent by all the actuator processors or controlling the at least one actuator processor to send locking signals to the locking mechanism when receiving the disconnection signals sent by all the actuator processors.
Optionally, the actuator is connected with the actuator processor, and the actuator processor is further configured to send a disconnection signal to the corresponding actuator and send a locking signal to the locking mechanism when detecting that the actuator fails.
Optionally, the flight control system further comprises: the detection sensor is connected with the actuating mechanism and the actuator processor and is used for collecting the actual operating quantity of the actuating mechanism and feeding back the actual operating quantity to the actuator processor so that the actuator processor detects whether the actuating mechanism fails according to the actual operating quantity.
Optionally, the actuating mechanism comprises a control surface, a landing gear retraction unit, a tilting unit or a cabin door.
Alternatively, the actuator is all the active components of the aircraft, which may include a control surface, a landing gear retraction unit, a tilting unit or a hatch door. The rotor wing tilting unit is used for tilting the rotor wing; the control surfaces comprise control surfaces on wings, control surfaces on vertical tails and control surfaces on horizontal tails.
Optionally, the flight control system further comprises: the third signal switch is connected with the control rod and the actuator processing module;
the arbitration unit is further configured to: when all the flight control computers fail, a closing signal is sent to the third signal switch; the default state of the third signal switch is an off state.
Optionally, the flight control system further comprises a display module, and the display module is connected with the arbitration unit and is used for displaying the determined result of the flight control computer with the fault.
The specific implementation manner of the flight control system of the present invention is basically the same as that of each embodiment of the redundancy control method of the flight control system, and will not be described herein.
Based on the same inventive concept, the embodiments of the present application further provide a computer readable storage medium, where the computer readable storage medium stores a redundancy control program of the flight control system, where each step of the redundancy control method of the flight control system described above is implemented when the redundancy control program of the flight control system is executed by the processor, and the same technical effects can be achieved, so that repetition is avoided and no further description is given here.
Because the storage medium provided in the embodiments of the present application is a storage medium used for implementing the method in the embodiments of the present application, based on the method described in the embodiments of the present application, a person skilled in the art can understand the specific structure and the modification of the storage medium, and therefore, the description thereof is omitted herein. All storage media used in the methods of the embodiments of the present application are within the scope of protection intended in the present application.
The foregoing description is only of the preferred embodiments of the present invention and is not intended to limit the scope of the invention, and all equivalent structural changes made by the specification and drawings of the present invention or direct/indirect application in other related technical fields are included in the scope of the present invention.

Claims (11)

1. A redundancy control method for a flight control system, applied to an arbitration unit, the method comprising:
receiving control information of at least two flight control computers, wherein the control information comprises a control instruction and a check code;
determining whether the flight control computer has faults according to the control information;
cutting off the signal output of the flight control computer with faults;
and the flight control computer controlling normal work sends the received control instruction to the actuator processor.
2. The method of claim 1, wherein the step of determining whether the flight control computer has a fault based on the control information comprises:
matching the check code with a preset check code;
and determining the unmatched flight control computer as the flight control computer with the fault.
3. The method of claim 2, further comprising, after the step of matching the check code with a predetermined check code:
when the matched flight control computers comprise at least two, determining errors among control instructions received by the matched flight control computers;
the flight control computers with the determined errors larger than the preset errors are all the flight control computers with faults.
4. A method according to any one of claims 1-3, wherein the method further comprises:
when all the flight control computers have faults, the signal output of all the flight control computers is cut off;
and a signal channel which is communicated between the control rod and the actuator processor and is used for sending a control signal output by the control rod to the actuator processor.
5. The method of claim 1, wherein the step of the flight control computer controlling normal operation sending the received control command to an actuator processor comprises:
And closing a signal switch corresponding to the flight control computer which controls normal operation, so that the signal switch is connected with all actuator processors.
6. The method of claim 1, wherein said step of shutting off signal output from the faulty flight control computer comprises:
and sending a disconnection signal to a signal switch corresponding to the faulty flight control computer so as to cut off the signal output of the faulty flight control computer.
7. The method of claim 1, wherein the method further comprises:
and sending the determined result of the flight control computer with the fault to a display module for display.
8. A method according to any one of claims 1-3, wherein the method further comprises:
when an arbitration intervention instruction is received, signal output of all flight control computers is cut off;
and a signal channel which is communicated between the control rod and the actuator processor and is used for sending a control signal output by the control rod to the actuator processor.
9. An arbitration unit, characterized in that the arbitration unit comprises: memory, a processor and a redundancy control program of a flight control system stored on the memory and executable on the processor, which when executed by the processor, implements the steps of the redundancy control method of a flight control system according to any one of claims 1-8.
10. A flight control system, characterized in that it comprises the arbitration unit of claim 9.
11. A computer readable storage medium, characterized in that it has stored thereon a redundancy control program of a flight control system, which when executed by a processor implements the steps of the redundancy control method of a flight control system of any one of claims 1-8.
CN202211659720.XA 2022-12-22 2022-12-22 Redundancy control method, arbitration unit, flight control system and storage medium Pending CN116125870A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211659720.XA CN116125870A (en) 2022-12-22 2022-12-22 Redundancy control method, arbitration unit, flight control system and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211659720.XA CN116125870A (en) 2022-12-22 2022-12-22 Redundancy control method, arbitration unit, flight control system and storage medium

Publications (1)

Publication Number Publication Date
CN116125870A true CN116125870A (en) 2023-05-16

Family

ID=86300096

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202211659720.XA Pending CN116125870A (en) 2022-12-22 2022-12-22 Redundancy control method, arbitration unit, flight control system and storage medium

Country Status (1)

Country Link
CN (1) CN116125870A (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116661331A (en) * 2023-08-02 2023-08-29 成都正扬博创电子技术有限公司 Redundant flight control computer system utilizing software and hardware cooperation
CN117647925A (en) * 2024-01-30 2024-03-05 成都正扬博创电子技术有限公司 Redundancy flight control calculation method, device, equipment and storage medium

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116661331A (en) * 2023-08-02 2023-08-29 成都正扬博创电子技术有限公司 Redundant flight control computer system utilizing software and hardware cooperation
CN116661331B (en) * 2023-08-02 2023-09-26 成都正扬博创电子技术有限公司 Redundant flight control computer system utilizing software and hardware cooperation
CN117647925A (en) * 2024-01-30 2024-03-05 成都正扬博创电子技术有限公司 Redundancy flight control calculation method, device, equipment and storage medium
CN117647925B (en) * 2024-01-30 2024-04-09 成都正扬博创电子技术有限公司 Redundancy flight control calculation method, device, equipment and storage medium

Similar Documents

Publication Publication Date Title
CN116125870A (en) Redundancy control method, arbitration unit, flight control system and storage medium
CN115963717A (en) Redundancy control method, actuator processing module, flight control system and storage medium
US7567862B2 (en) Actuation response oscillation detection monitor
US9563523B2 (en) Architecture for scalable fault tolerance in integrated fail-silent and fail-operational systems
CN113311765B (en) Backup flight control system and backup flight control method
US7693616B2 (en) System and method of redundancy management for fault effect mitigation
US5927655A (en) Device for controlling the thrust of a multi-engine aircraft
CN112498664B (en) Flight control system and flight control method
CN110710164B (en) Flight control system
US10510243B2 (en) Method for processing an error when performing a predetermined avionics procedure, related computer program and detection and alert system
JPH10316097A (en) Control system
CN111026148A (en) System for controlling commands of a system controlled via a graphical interface and related control method
RU2485568C2 (en) Modular electronic flight control system
CN112816133B (en) High-safety active gravity center control system and method
CN113504720A (en) Backup control system based on distributed fly-by-wire architecture and working method
CN109976359B (en) Redundancy ship heading control method and control system
CN116243594B (en) Aircraft control system, flight control method and storage medium
US7577870B2 (en) Method and system for controlling command execution
CN115556924A (en) Flight control system and actuator control electronics and method
EP1980924B1 (en) System and method of redundancy management for fault effect mitigation
CN218675711U (en) Flight control system
KR102195968B1 (en) Method and system for failure monitoring of flying object
CA2660997C (en) Conversion system fault management system for tiltrotor aircraft
CN114114894B (en) Fly-by-wire backup control system and fly-by-wire backup control method
CN115743522B (en) Method and system for activating backup flight control system of large-sized conveyor

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination