CN113504720A - Backup control system based on distributed fly-by-wire architecture and working method - Google Patents

Abstract

One aspect of the present disclosure relates to a backup control system based on a distributed fly-by-wire architecture, including: a backup control module; and a plurality of remote electronic control units distributed at a set of control surfaces of the aircraft and used for operating the set of control surfaces, each remote electronic control unit having dual control signal ports respectively corresponding to the main control channel and the backup control channel and being coupled to the backup control module on the backup control channel, wherein when the aircraft has an actuator control electronic unit which fails and the number of failures is greater than a threshold value, the backup control module provides a backup control command for the set of control surfaces to the plurality of remote electronic control units through the backup control channel. Other aspects of the disclosure also relate to a method of operation of the backup control system and a remote electronic control unit.

Description

Backup control system based on distributed fly-by-wire architecture and working method

Technical Field

The present application relates generally to distributed fly-by-wire systems for civil aircraft, and more particularly to a backup control system based on a distributed fly-by-wire system.

Background

In accordance with regulatory requirements, fail-safe requirements are met for catastrophic failure conditions. That is, a single failure, regardless of probability, cannot lead to catastrophic consequences. However, development (common mode) errors may cause multiple Actuator Control Electronics (ACE) to fail simultaneously. Such common mode problems can undermine the independence of redundant architectures. Therefore, attention must be paid to the safety hazard that flight control systems may fail due to common mode issues.

With the development of fly-by-wire flight control technology, the influence of common mode factors caused by external factors such as lightning is considered in the design of a flight control system, and currently, a Backup Control System (BCS) or a final backup control system (U-BCS) is configured in the mainstream passenger plane. Due to the improvement of the backup capability, the backup control system can realize the control capability of continuous safe flight and landing. Some mainstream new models even adopt a control (backup) mode (such as adopting BHA, EMA and the like) with more advanced performance and more backup objects. In essence, the backup system is a design that is beyond airworthiness requirements.

To further improve the safety and availability of an flight control system, there is a need in the art for an improved backup control system based on a distributed fly-by-wire flight control system.

Disclosure of Invention

One aspect of the present disclosure relates to a backup control system based on a distributed fly-by-wire architecture, including a backup control module; and a plurality of remote electronic control units distributed at a set of control surfaces of the aircraft and used for operating the set of control surfaces, each remote electronic control unit having dual control signal ports respectively corresponding to the main control channel and the backup control channel and being coupled to the backup control module on the backup control channel, wherein when the aircraft has an actuator control electronic unit which fails and the number of failures is greater than a threshold value, the backup control module provides a backup control command for the set of control surfaces to the plurality of remote electronic control units through the backup control channel.

According to at least some example embodiments, each remote electronic control unit is further coupled to the actuator control electronic unit on the master control channel, wherein the plurality of remote electronic control units steer the set of control surfaces and the other control surfaces based on master commands received from the actuator control electronic unit through the master control channel when the actuator control electronic unit of the aircraft is not disabled or the number of failures is not greater than a threshold value.

According to at least some example embodiments, the backup control module is coupled to the actuator control electronics of the aircraft to receive the status signals and determine whether the aircraft has a failure of the actuator control electronics and the number of failures based on the status signals.

In accordance with at least some exemplary embodiments, each remote electronic control unit further comprises a power module having dual power input ports respectively coupled to the power conditioning module and the backup control module of the aircraft, wherein the power module is powered by the power conditioning module of the aircraft when the actuator control electronic unit of the aircraft is not disabled or the number of failures is not greater than a threshold value; or when the actuator control electronic unit of the airplane fails and the number of the failed actuator control electronic units is larger than the threshold value, the power supply module is powered by the backup control module.

According to at least some example embodiments, the power supply module includes an anti-backup device that prevents the power conditioning module and the backup control module from being powered simultaneously.

According to at least some example embodiments, the backup control commands provided by the backup control module through the backup control tunnel are determined based at least in part on signals received from a plurality of position sensors distributed at a set of effectors of the aircraft.

According to at least some example embodiments, the set of steering devices includes a sidebar and a rudder foot peg.

According to at least some example embodiments, the set of control surfaces includes an inner left elevator side, an inner left aileron side, a mid-rudder side, an inner right elevator side, and an inner right aileron side.

Another aspect of the disclosure relates to a method of operating a distributed fly-by-wire architecture-based backup control system, including receiving, by a backup control module, status signals from a plurality of actuator control electronics units of an aircraft; determining the failure of the actuator control electronic unit of the airplane and the number of failures based on the state signal; and when the number of the actuator control electronic units of the airplane which fail is larger than a threshold value, activating the backup control module to provide backup control commands for a group of control surfaces to a plurality of remote electronic control units distributed at the group of control surfaces of the airplane, wherein each remote electronic control unit is provided with two control signal ports which respectively correspond to the main control channel and the backup control channel, and the backup control commands are provided through the backup control channels.

According to at least some example embodiments, each remote electronic control unit is further coupled to the actuator control electronic unit on the master control channel, wherein the plurality of remote electronic control units steer the set of control surfaces and the other control surfaces based on master commands received from the actuator control electronic unit through the master control channel when the actuator control electronic unit of the aircraft is not disabled or the number of failures is not greater than a threshold value.

In accordance with at least some example embodiments, the backup control module activating includes the backup control module powering up from a sleep mode, and the method of operation further includes, after the backup control module activating, receiving, by the backup control module, signals from a plurality of position sensors distributed at a set of effectors of the aircraft; and determining a backup control command for the set of control surfaces based at least in part on signals received from the plurality of position sensors.

According to at least some example embodiments, the actuator control electronics unit of the aircraft includes four actuator control electronics units, and the threshold value includes two, wherein, when there are three actuator control electronics units that fail, the backup control module provides the backup control command to the remote electronic control unit through the backup control channel while the remaining one actuator control electronics unit provides the master control command to the remote electronic control unit through the master control channel; or when the remote electronic control unit is powered off due to the fact that all four actuator control electronic units fail, the backup control module supplies power to the remote electronic control unit, and provides a backup control command to the remote electronic control unit through the backup control channel after the remote electronic control unit is initialized successfully.

According to at least some example embodiments, the method of operation further comprises performing a pre-flight power-up initialization and a self-test of the backup control module while the aircraft is in a ground state; and when the initialization and the self-detection are successful, the backup control module sets the self state to be effective and cuts off the power so as to be in a dormant state.

According to at least some example embodiments, the backup control module activating further comprises activating the backup control module from the dormant state only when the aircraft is in an airborne state and the state of the backup control module is active.

Another aspect of the disclosure relates to a remote electronic control unit comprising a control module having dual control signal ports, including a master control channel for receiving master control commands from an actuator control electronic unit, and including a backup control channel for receiving backup control commands from a backup control module, wherein the control module includes an arbitration means for determining a command to be employed based on priorities of the received master control commands and backup control commands; the power supply module is provided with a dual-power input port and is used for respectively receiving power supply from a power supply adjusting module of the airplane or power supply from a backup control module corresponding to the main control channel; and an electro-hydraulic servo actuator for actuating the associated control surface of the aircraft in accordance with the command to be applied.

According to at least some example embodiments, the power supply module includes a back-up prevention device for preventing back-up from occurring when the power conditioning module and the backup control module simultaneously supply power to the remote electronic control unit.

According to at least some example embodiments, the power module is further adapted to be powered by power from the power conditioning module when the actuator control electronics is operating normally; and when the actuator control electronic unit loses power supply from the power supply adjusting module due to failure and receives power supply from the backup control module, the power is re-supplied and the control module notifies the backup control module that the remote electronic control unit has been successfully initialized via the dual control signal port.

Drawings

Fig. 1 shows a schematic diagram of a distributed fly-by-wire system architecture according to the present disclosure.

Fig. 2 shows a schematic diagram of a distributed fly-by-wire system architecture according to the present disclosure.

Fig. 3 illustrates a schematic diagram of a distributed fly-by-wire flight control system architecture with a Backup Control System (BCS) in accordance with an aspect of the disclosure.

Fig. 4 illustrates a schematic diagram of a Backup Control System (BCS) architecture in accordance with an aspect of the present disclosure.

Fig. 5 illustrates a diagram of an exemplary Backup Control Module (BCM) operating principle in accordance with an aspect of the present disclosure.

Fig. 6 illustrates a schematic diagram of a dual ported control REU remote control actuator in accordance with an aspect of the present disclosure.

Fig. 7 illustrates a control schematic of a Backup Control System (BCS) in accordance with an aspect of the present disclosure.

Fig. 8 illustrates a schematic diagram of Backup Control System (BCS) startup logic in accordance with an aspect of the present disclosure.

Fig. 9 illustrates a flow chart of a method of operation of a distributed fly-by-wire architecture based Backup Control System (BCS) in accordance with an aspect of the disclosure.

Detailed Description

Fig. 1 shows a schematic diagram of a distributed fly-by-wire system architecture 100 according to the present disclosure. The distributed fly-by-wire flight control system architecture 100 of the civil aircraft adopts a digital fly-by-wire flight control system (FBW), also called an Electronic Flight Control System (EFCS).

The distributed fly-by-wire system architecture 100 may include a plurality of sensors mounted at a control device of an aircraft as control signal input portions. Specifically, the plurality of sensors may include a right-side sidebar pitch axis position sensor (e.g., 4) 102, a sidebar roll axis position sensor (e.g., 4) 104, a foot pedal position sensor (e.g., 2); and left foot peg position sensors (e.g., 2) 110, sidebar pitch axis position sensors (e.g., 4) 114, and sidebar roll axis position sensors (e.g., 4) 116. The plurality of sensors may also be installed at a brake pad handle and a switch (not shown) or the like as a control signal input device.

The position signals from the plurality of sensors 102 and 116 are input to a plurality of (e.g., 4) Actuator Control Electronic (ACE) units 120-1 to 120-4, respectively, in the form of analog signals. The ACEs 120-1 to 120-4 also receive backup rate signal inputs from Direct Mode Rate Sensors (DMRS) 1-4, respectively.

The ACEs 120-1 through 120-4 convert analog signals from the sensors 102 and 116 into digital signals and provide position signals in the form of digital signals on a dedicated internal bus to a plurality (e.g., 3) of command/monitor branch non-similar flight control computers (FCMs) 130-1 through 130-3, respectively.

The FCMs 130-1 through 130-3 solve the control laws based on the position signals received from the ACEs 120-1 through 120-4 from the various sensors 102 and 116 to determine the control plane commands, which are then transmitted back to the ACEs 120-1 through 120-4 over the internal dedicated bus.

The ACEs 120-1 to 120-4 convert the received control plane instructions in digital form into analog signals and transmit these control plane instructions to a plurality of (e.g., 19) remote control units (REU) 150 over a master channel for controlling the steering engine. Additionally, at least a portion of the ACEs may also communicate instructions to a task control electronics (MCE) unit 122. MCE 122 further receives inputs from horizontal stabilizer trim switch 118, etc., to control the attitude of the passenger aircraft during the mission, etc.

The instruction branch/monitoring branch non-similar flight control computers FCM 130-1 to 130-3, the actuator control electronics ACE 120-1 to 120-4 and 19 remote electronic control REUs are used as system control cores, the distributed fly-by-wire system architecture 100 provides full-time full-authority fly-by-wire system capability, control over corresponding control surfaces is achieved through calculation of control laws, and control over the attitude and the track of the airplane is achieved.

Fig. 2 shows a schematic diagram of a distributed fly-by-wire system architecture 200 according to the present disclosure. The distributed fly-by-wire flight control system architecture 200 may include a plurality of position sensors 202, a plurality of Actuator Control Electronics (ACE) units 204, a flight control computer (FCM) 206, and a plurality of remote control units (REU) 208 mounted at a manipulator of the aircraft.

According to an exemplary embodiment, the plurality of position sensors 202 correspondingly input the respective sensed position signals of the respective manipulators to the plurality of Actuator Control Electronic (ACE) units 204 in the form of analog signals.

The plurality of ACEs 204 convert analog signals from the plurality of position sensors 202 to digital signals and provide position signals in the form of digital signals to a flight control computer (FCM) 206.

The FCM 206 resolves the control laws based on the position signals received from the various sensors 202 from the various ACEs 204 to determine control plane instructions, which are then transmitted back to the various ACEs 204.

The ACE 204 then uses the control plane instructions in the form of received digital signals to control the plurality of REUs 208.

Fig. 3 illustrates a schematic diagram of a distributed fly-by-wire flight control system architecture 300 with a Backup Control System (BCS) in accordance with an aspect of the present disclosure.

As seen in fig. 3, distributed fly-by-wire architecture 300 is substantially similar in composition and operation to distributed fly-by-wire architecture 200 as described in connection with fig. 2, but with the addition of a separate position sensor 302 at least a portion of the operator, the architecture 200 of fig. 2, the retrofitting of at least a portion of the REU in the original remote control unit (REU) 208 to a new dual-ported control REU 308, and the further introduction of a separate Backup Control Module (BCM) 304. The dual-port control REU 308 is capable of receiving input from both the ACE as well as the BCM 304 as the original REU. The BCM 304 hydraulic provides a three-axis control capability to control the aircraft to continue safe flight and landing without loss of more than three ACEs.

Generally, when three to four ACEs are active and operating in normal mode, the system is in normal operating mode. When two ACEs are active, the system may be in normal, auxiliary, or direct mode depending on whether the ACE mode of operation and FCM are active. When only one or no ACE is active, the system enters backup mode and part or all of the control is taken over by the BCM 304.

The BCM 304 may receive status signals from each of the plurality of ACEs 204 and enter a pre-bit and active state (described below) at the appropriate timing.

For example, normally, the multiple ACEs 204 use control plane instructions received from a flight control computer (FCM) 206 to control the multiple remote control units (REU) 208 on a master channel, as described above in connection with fig. 2.

When at least a portion of the plurality of ACEs 204 fail, the partially failed ACE 204 may send a particular status signal, such as an ACE failure enable signal, to the BCM 304.

In the case where at least two more ACEs 204 are operating properly, BCM 304 remains inactive. For example, in the system architecture described above in connection with fig. 1 with four ACEs, BCM 304 remains inactive when BCM 304 receives 0 to 2 ACE fault enable signals from different ACEs 204.

However, when the normally functioning ACE 204 has less than two (e.g., one, zero), the BCM 304 will activate. For example, in the system architecture described above in connection with fig. 1 with four ACEs, BCM 304 activates when BCM 304 receives 3 to 4 ACE fault enable signals from different ACEs 204.

The BCM 304, in an activated state, independently resolves a control law to determine an alternate control surface command based on the position signals independently received from the added position sensor 302.

Depending on whether or not another ACE 204 is functioning properly, the BCM 304 takes a different approach. When another ACE 204 is operating normally, the BCM 304 only takes over the control channel of the failed ACE to work in conjunction with the remaining one ACE 204. The BCM 304 communicates control commands to at least some of the control surfaces via a back-up control channel on the retrofit dual port control REU 308.

When no ACE 204 is working properly (i.e., the system loses all ACEs 204), the BCM 304 takes over all control. The BCM 304 effects control of at least some of the control surfaces by controlling the dual port control REU 308. This is described further below.

Fig. 4 illustrates a schematic diagram of a Backup Control System (BCS) architecture 400 in accordance with an aspect of the present disclosure. The exemplary Backup Control System (BCS) architecture 400 of fig. 4 may be implemented in the distributed fly-by-wire system architecture 300 of fig. 3.

According to an example embodiment, the Backup Control System (BCS) architecture 400 of FIG. 4 may include a backup control computer (BCM) 408, which may correspond to the Backup Control Module (BCM) 304 of FIG. 3.

According to an exemplary embodiment, the Backup Control System (BCS) architecture 400 of fig. 4 may include, but is not limited to, RVDT sensors (not shown) added to a rider pole 402, a copilot pole 404, foot pedals (left/right linkage) 406, etc., as position sensors (e.g., corresponding to the position sensors 202 of fig. 3). In this example, only the sidebar and the foot pedal sensor signals are used to provide the most basic control surface control. The present disclosure is not so limited and other solutions are contemplated, including, for example, adding more sensors, etc.

For example, in accordance with at least some example embodiments, each of the sidebars 402 and 404 may be retrofitted with 2 RVDT sensors, respectively, based on the original sensors to provide 2-way RVDT signal outputs, respectively, as inputs to a backup control computer (BCM) 408.

For example, according to at least some exemplary embodiments, foot pegs (left/right linkage) 406 may be supplemented with left and right 1-way RVDT sensors, respectively, based on the original sensors, to provide left and right 2-way RVDT signal outputs as inputs to a backup control computer (BCM) 408.

The Backup Control System (BCS) architecture 400 of fig. 4 may also include Actuator Control Electronics (ACE) units 1-4 (410), corresponding to the Actuator Control Electronics (ACE) unit 204 of fig. 3.

According to at least some example embodiments, the Actuator Control Electronics (ACE) units 1-4 (410) may provide respective status signals to a backup control computer (BCM) 408. In the event that the normally functioning ACE 410 is less than two (e.g., one, zero), the BCM408 will activate.

Depending on the number of ACEs 410 that are also functioning properly (e.g., one or zero), the BCM408 may take different schemes accordingly, for example, to take over only the failed ACE 410 to work in conjunction with the remaining ACEs 410 to control each REU, or to take over full control of each REU, as described above in connection with fig. 3.

In addition, the Backup Control System (BCS) architecture 400 of fig. 4 may also include a hydraulic source (HYD) 1# -3# (412). The ACE 204 provides control laws to various hydraulic sources (HYD) and spoiler actuators 418, aileron actuators 420, elevator actuators 422, and rudder (up, mid, down) actuators 424, etc. to hydraulically actuate the actuators via the hydraulic sources for control surface control.

These three sets of hydraulic pressure sources act on a spoiler actuator 418, an aileron actuator 420, an elevator actuator 422, and a rudder (up, middle, down) actuator 424, respectively, which may correspond to the remote control units REU (208 and 308) in fig. 3. As shown in the figure, redundancy and safety can be ensured by three sets of independent hydraulic systems for hydraulically actuating the corresponding spoiler actuator 418, aileron actuator 420, elevator actuator 422, rudder (up, middle, down) actuator 424, and the like.

According to an exemplary embodiment, for example, a first hydraulic pressure source (HYD 1 #) 412 may be used to hydraulically actuate the left outboard aileron Ail OB actuator 420, the left spoilers L2 and L5 actuator 418, the left outboard elevator ELE OB actuator 422, the right spoilers R2 and R5 actuator 418, and the upper rudder actuator 424.

According to an exemplary embodiment, for example, a second hydraulic pressure source (HYD 2 #) 412 may be used to hydraulically actuate the left spoiler L1 and L4 actuator 418, the right outer aileron Ail OB actuator 420, the right spoiler R1 and R4 actuator 418, the right outer elevator Ele OB actuator 422, and the lower rudder actuator 424.

According to an exemplary embodiment, for example, a third hydraulic source (HYD 3 #) 412 may be used to hydraulically actuate the left inner aileron Ail IB actuator 420, the left spoiler L3 actuator 418, the left inner elevator Ele IB actuator 422, the right inner aileron Ail IB actuator 420, the right spoiler R3 actuator 418, the right inner elevator Ele IB actuator 422, and the rudder mid-portion actuator 424.

In particular, according to an embodiment of the present disclosure, at least some of the actuators (REU) associated with the third hydraulic source (HYD 3 #) 412 are adapted as dual port control REU to receive control laws from the BCM408 in addition to control laws from the ACE. Thus, in the event that ACE 204 fails and BCM408 is activated, some or all of the control functions of ACE 412 are taken over. Actuators adapted to be a dual ported control REU may include, for example, a left inner aileron Ail IB actuator 420, a left inner elevator Ele IB actuator 422, a right inner aileron Ail IB actuator 420, a right inner elevator Ele IB actuator 422, and a rudder mid-section actuator 424

Although three sets of Hydraulic Sources (HYDs) 412 are described above as respectively providing distributed hydraulic actuation of respective actuators REU, one of ordinary skill in the art will appreciate that the above arrangement is not exclusive and that the present disclosure contemplates other distributed arrangements to provide some redundancy and safety through a reasonable arrangement.

According to an exemplary embodiment, the inner and outer flaps 420, the plurality of spoilers 418, the inner and outer elevators 422, and the upper, middle, and lower rudders 424 back up each other and assume a primary-primary mode of operation. For example, when both the inner and outer flaps 420 are operating properly, they each carry 50% of the workload together. However, if one of the ailerons (e.g., the outer aileron Ail OB 420) or the hydraulic source (HYD) that hydraulically actuates it fails, then the remaining other (e.g., the inner aileron Ail IB 420) takes over the failed one and assumes 100% of the workload, so that the set of ailerons 420 can still operate at 100% of the workload.

Similarly, the spoiler actuator 418, the elevator actuator 422, and the rudder actuator 424 also assume a primary-primary mode of operation that is backup to each other so that the actuators that are backup to each other can take over their workload in the event of a partial actuator failure, or a failure of their corresponding hydraulic source (HYD) 412.

In addition, the Backup Control System (BCS) architecture 400 of fig. 4 may also include a power supply regulation module 414, a display system 416, and a rate sensor 426, among other things.

According to at least some example embodiments, BCM408 also receives signals from sensors (not shown) mounted to hydraulic pressure source 1# -3# (412), spoilers 418, ailerons 420, elevators 422, and rudders (up, mid, down) 424, etc., and may receive three-axis rate signals from external or internal rate sensors 426. Although the present example describes the addition of new sensors to existing sensors, these sensors may alternatively or additionally utilize sensors already available in the original fly-by-wire architecture, where appropriate.

According to at least some example embodiments, BCM408 also receives sensor signals from Power Conditioning Module (PCM) 414.

According to an exemplary embodiment, the BCM408 may resolve backup control laws based on RVDT sensor signals from the sidebars 402, 404, foot pedals (left/right ganged) 406, etc., sensor signals from the PCM 414, signals from the rate sensor 426, and sensor signals from the various REUs, etc., to effect control of the respective control surfaces, and thus the aircraft attitude and trajectory. The REU includes, but is not limited to, hydraulic pressure source 1# -3# (412), spoiler 418, aileron 420, elevator 422, and rudder (up, mid, down) 424, etc.

Specifically, BCM408 may resolve backup control laws for each of the REUs, including, for example, backup control laws for each of hydraulic pressure sources 1# -3# (412), spoilers 418, ailerons 420, elevators 422, and rudders (up, mid, down) 424, and communicate the respective control laws to the respective REU.

The REU receives the control laws from each ACE 410 and BCM408 and decides the final control commands for the respective control surfaces based on the respective arbitration algorithms.

For example, according to some exemplary embodiments, when there is also one ACE 410 operating normally, the dual-port control REU receives control laws from that ACE 410 and from BCM408, and arbitrates the final control laws based on the priorities of the ACE 410 and BCM 408. According to an exemplary embodiment, since ACE 410 is generally higher priority than BCM408, in this case, the REU still implements control of the corresponding control surfaces, and thus aircraft attitude and trajectory, via hydraulic source 1# -3# (412) based on the control law of the last properly functioning ACE 410.

As can be seen, the solution of the present disclosure takes the existing architecture as a constraint, and makes minimum changes on the basis of being independent of the existing architecture, and takes into consideration the maximum engineering implementability. According to an exemplary embodiment, the backup control system architecture may have a sidebar, a rudder foot pedal as control signal input devices; taking a Backup Computer (BCM) and 5 remote control units (REU) as cores; data communication between the BCM and the REU/DMRS is provided through a single-direction data bus A429 and a two-direction data bus A429; providing communication between the backup control system and the avionics system through the ARINC664 or a dedicated data bus; providing communication between the backup control system and the IRU/SDS via the ARINC429 bus or discrete lines; 1, uniformly and intensively supplying power to the BCM direct-current power equipment through a PCM (pulse code modulation) power supply adjusting module; an electro-hydraulic servo actuator is taken as an execution part; and 2 independent DMRSs are used as backup rate signals to be input into the sensor, and the control of the corresponding control surface is realized through the calculation of a backup control law, so that the control of the attitude and the track of the airplane is realized.

When the double-generator fails, the RAT supplies power, the left direct current bus bar and the right direct current bus bar fail, and the important alternating current bus bar and the main storage battery of the airplane are effective. The hydraulic pressure sources 1# and 2# 412 are lost, and the hydraulic pressure source 3# 412 operates normally. At this point, the backup system 400 may still be powered by the PCM3 and normally acquire the ACE status enable signal. The hydraulically driven actuator in this case includes: the actuator comprises a left elevator inner side 422, a left aileron inner side 420, a left multifunctional spoiler L3, a middle part of a rudder 424, a right elevator inner side 422, a right aileron inner side 420 and a right multifunctional spoiler R3, so that the MAC control requirement is met.

Fig. 5 illustrates a diagram of an exemplary Backup Control Module (BCM) 500 operating principle in accordance with an aspect of the present disclosure. The backup control module BCM 500 may comprise a command branch (COM LANE) and a monitoring branch (MON LANE). Each branch consists of different subareas, and the two branches adopt independent PLD design.

The command branch and the monitoring branch each include a respective power supply portion and a control and interface (I/O) portion. For example, according to an exemplary embodiment, the command branch may include a COM power supply module 510 to generally provide power from a PCM3 located, for example, in an electronics rack such as the E-E cabin 4 in the middle of an aircraft. On the other hand, the monitoring branch may then include a monitoring power supply module 512, also typically powered from PCM3, such as the electronics rack located in the middle E-E cabin 4 of the aircraft.

The COM power supply module 510 and the monitoring power supply module 512 may supply power to the command branch and the monitoring branch of the BCM 500, respectively.

According to an exemplary embodiment, the instruction branch may also include an I/O interface 506 for receiving input from various sensors. Likewise, the monitoring branch may also include an I/O interface 508 for independently receiving input from each sensor.

According to an exemplary embodiment, the instruction branch may also include a BCM I/O control module 502 for receiving status signals from each of ACEs 1-4.

The I/O interface 506 of the command branch and the I/O interface 508 of the monitor branch pass the received sensor inputs to the command channel (backup) 504 of the command branch and the monitor channel (backup) 506 of the monitor branch, respectively. The command channel 504 resolves backup control laws based on inputs received from the sensors and status signals received from the ACEs. The supervisory channel 506 resolves the control laws based on the inputs received from the various sensors.

The command channel 504 and the supervisory channel 506 verify the respective resolved control laws against each other. In the event that the check is correct, the command branch sends the BCM status via the BCM I/O control module 502 and outputs control commands (discrete and/or analog) via the I/O interface 506 of the command branch to, for example, the ARINC429 bus. Similarly, in the case of a correct check, the monitoring branch outputs control commands (discrete and/or analog) via the I/O interface 508 of the monitoring branch to, for example, the ARINC429 bus.

On the other hand, in the event that the verification is incorrect, the BCM may be latched by latching, thereby not providing an output.

Fig. 6 illustrates a schematic diagram of a dual ported control REU remote control actuator 600 in accordance with an aspect of the present disclosure. The dual port control REU (remote control actuator) 600 of FIG. 6 may include a dual control signal port and dual power input port plus EHSA (electro-hydraulic servo actuator) configuration.

Dual port control REU 600 may include a control module 602 for receiving master commands from the ACE on a master channel and backup control commands from the BCM on a backup control channel, respectively, to form dual control signal ports.

The control module 602 may include an arbitration means 604 for deciding which command actuation to employ based on an arbitration algorithm (e.g., priority of master commands and backup control commands) when simultaneously receiving master commands from a master system (e.g., ACE) on a master channel and backup control commands from a backup control system (BCM) on a backup control channel.

The dual port control REU 600 may include electro-hydraulic servo actuators (EHSA) 610 to actuate the respective control surfaces in accordance with the command determined to be employed.

The dual port control REU 600 may include a power module 606 for receiving power from a power conditioning module PCM and from a BCM corresponding to the master control system, respectively, to form dual power input ports.

The power module 606 may include a back-fill prevention device 608 to prevent back-filling from occurring when the PCM and BCM are simultaneously supplying power to the REU 600.

When the backup system BCM is activated to work, the BCM provides an excitation voltage for the piston motion displacement LVDT sensor of the EHSA. The REU 600 completes the demodulation process of the LVDT signal, and the processed signal is used for EHSA position closed-loop control. According to an exemplary embodiment, when the REU 600 is a rudder actuator, a flutter suppression function may be added.

This two port control REU structure 600 is in ACE trouble, and under the circumstances of REU outage, the accessible dual supply interface carries out secondary power supply by BCM, makes REU 600 restart. When REU 600 powers up again, it notifies the backup control module, e.g., by the control module, that the REU has been successfully initialized and receives control instructions from the BCM through the dual control signal interface and receives wrap-around information (which takes useful information in the data packet) for the dual-port control REU. But the master link instruction has a control priority.

The dual power interface is connected to the power module 606 to supply power to the power module, but the power module is designed to have anti-reverse capability that prevents multiple power sources from supplying power simultaneously, and thus, does not affect the normal operation of the REU 600 when the PCM and BCM supply power simultaneously.

Fig. 7 illustrates a control schematic of a Backup Control System (BCS) 700 in accordance with an aspect of the present disclosure. BCS 700 is a backup control system independent of the primary control system, with control commands self-chaining, without interfering with the operation of the primary system (e.g., four ACEs). The cockpit control device uses side rods 702 and 704 and a foot pedal 706 to control each REU respectively, and comprises actuators such as an elevator 722, an aileron 720 and a rudder 724.

According to an exemplary embodiment, the BCM 708 performs gain adjustment on the control signals of each REU, with the same polarity as the master link. The control instruction has priority when the main system is normally controlled. If two paths (main control and backup) of control instructions arrive at the remote terminal control device REU at the same time due to failure of three ACEs, the REU has the authority of preferentially selecting the control instructions of the main control link, namely the main control instructions have an inhibiting effect on the backup instructions, and the backup instructions from the BCM 708 do not work at this time.

When the BCM 708 is powered up (28 VDC) into the pre-position, the RVDT sensors, which are switched by the secondary power supply to the sidebars 702 and 704, and the foot peg 706, and the slat direct mode position sensor RVDT provide excitation voltages and perform demodulation of the RVDT input signals. BCM 708 will also excite the LVDTs of the EHSV and MSV of the servo actuator. In addition, in the backup mode of operation, BCM 708 also provides power to the power modules of the REU.

To facilitate comparison and increase the level of fault tolerance, each of the side poles 702 and 704 and the rudder pedals 706 are configured with 2 RVDT signals, respectively, and the BCM receives the 2 RVDT signals of each of the side poles 702 and 704 and the RVDT signals of each of the left and right pedals 706 (left and right pedals 706 are linked together) for control law calculation. The BCM 708 firstly judges the effectiveness of the 2-path signals of the side rods 702 and 704 and the left pedal 706 and the right pedal 706, and when the 2-path signals are effective and the difference value is within a threshold, the BCM 708 takes an average value; when the 2 channels of signals are all valid and the difference value exceeds the threshold value, the BCM 708 takes an intermediate value (takes the valid use value of the previous frame to construct a third channel); if one path is valid and the other path is invalid, the BCM 708 takes a valid value.

The backup system REU adopts two different models, namely, on the basis of the original REU1 model and the REU2 model, a REU3 capable of simultaneously inputting in two ways is designed in a derivative mode, for example, the double-port control REU remote control actuator 600 described in the combination of fig. 6 is adopted. The REU3 model is used for controlling the actuators on the inner sides of the left and right flaps 720, the actuators on the inner sides of the left and right elevators 722, and the actuators on the middle portions of the rudders 724. The backup system REU3 of fig. 7 may correspond to the hydraulic source 3# and its controlled dual port control REU 308 in the Backup Control System (BCS) architecture 400 described above in connection with fig. 4.

In the example of fig. 7, BCM 708 has built in rate sensor 726 for measuring the three-axis rate signals (r) ((r))p,q,r) To achieve a closed loop of three-axis control and feedback. According to other embodiments, the rate sensor 726 may also be external (as shown in FIG. 4).

According to an aspect of the present disclosure, a Backup Control System (BCS) operation mode may be classified into two operation modes, i.e., a normal backup operation mode and a hybrid backup operation mode, according to the number of ACE failures. The details are as follows.

a) Backing up a normal working mode: while the aircraft is in the air, the system loses 4 ACEs 710 at the same time, and the BCM 708 obtains fault status enabling information from the ACEs 710. Under the action of the fault enable signal of the ACE 710, the BCM 708 quickly enters a power-on initialization pre-reset state from a power-on state and excites or supplies power to relevant devices. And then, according to the state of the terminal equipment REU, when relevant logic conditions are met, the backup system enters an activated state and takes over the airplane to implement control. At the same time, the BCM 708 also provides "pre-bit" and "active" status information to the avionics display system 716 via a separate dedicated bus. In the backup normal mode of operation, the BCM 708 receives control commands and external signals (e.g., velocity, slat dispersion signals, etc.) from the cockpit controls 702, 704, 706 and performs command calculations according to the direct mode control law. In particular, the BCM 708 is controlled by the states of the ACE 710 and the REU wrap information, and the BCM 708 cannot enter an active state to implement backup control without receiving the fail discrete state enable signal and the REU wrap information state from the ACE 710.

b) Backup hybrid operating mode: no matter what mode the master control system is in, when the system loses 3 ACEs 710, the backup system BCM 708 works in cooperation with the rest of the ACE 710 channels of the master control system, at this time, the backup system (BCS) 700 only takes over the control channels of the 3 failed ACEs 710, the rest of the ACEs 710 still executes FCM/ACE instructions, i.e., the rest of the ACEs 710 and the BCM 708 work in cooperation, and the BCS 700 does not execute FCM instructions. However, to ensure coordination and consistency between the commands, the control commands are calculated by the BCM 708 according to the direct mode control law. When the host system is in direct mode, the remaining one of ACEs 710 performs instruction computations on its own.

Fig. 8 illustrates a schematic diagram of Backup Control System (BCS) boot logic 800 in accordance with an aspect of the present disclosure. The Backup Control System (BCS) startup logic 800 may include the following three states: a pre-flight power-on initialization and self-test state (802), BCM pre-bit logic (808), and BCM activation logic (810).

1. Pre-flight power-on initialization and self-test state (802)

BCM pre-flight power-on initialization and self-detection (802) is only performed in a ground state, which may be defined as inertial navigation (receiving GPS signals) initialized (or manually initialized), but does not enter navigation mode and ground speed is less than a threshold (e.g., 30 knots) (and there is a ground-wheel signal). In the case that all (for example, 4) ACEs are completely normal and the power supply is normal, the functions of power-on initialization, state display, starting self-detection and the like of the BCM are realized by means of the ground logic state.

When the main system ACE is powered on, the BCM is also powered on by the PCM, but only the power supply module of the BCM is in a powered state, which is not controlled by the FCM and ACE. The 28VDC power supply from the PCM3 located in the central E-E compartment cabin 4 electronics rack is controlled by a manual switch (e.g., 2 switches on the PCM panel for maintenance replacement FCM, ACE). When the main system is powered on by the PCM, the BCM is powered on by the PCM4 (according to the requirement of system availability index, only one PCM is needed to supply power to meet the requirement of safety availability index), but only the BCM power supply module is in a powered-on state, when the 4 ACEs complete a normal power-on sequence (all 19 ACEs complete initialization at this time and report states to the ACEs within 250 ms), the BCM simultaneously receives power-on pre-position discrete enable signals (normally 0), namely 4 ACEs are normal and AND, when the normal state transmission between the ACEs and the BCM is detected to be normal, the BCM power supply module is switched on under the action of power-on logical AND, and the BCM completes power-on and initialization.

The BCM power module also powers on corresponding excitation modules including the REU directly, after the BCM is initialized normally (if the initialization is abnormal, the initialization can be repeated for 3 times), the BCM enters a self-detection state, and the detection includes all peripheral associated devices powered on by the BCM at the same time, particularly, items of detecting the REU by the BCM include: .

a. The power supply to the REU power supply module is normal;

b. the signal transmission is normal;

c. the status wrap-around information (including the normal power supply information) of the REU can be normally received.

If BCM initialization is not successfully completed or BCS system ground self-test is not passed, and the display system fails to receive any information, then the display system (e.g., display system 416 described above in conjunction with fig. 4, or display system 716 described above in conjunction with fig. 7) may display "FAILED".

And if BCM initialization and self-detection successfully pass, according to the 'quiet and dark concept', the display system can not display any information when receiving normal information. In the initialization and self-detection processes, if the BCM cannot be successfully completed or the system self-detection (including peripheral equipment and signal channels) is abnormal, the BCM is set to be invalid, otherwise, the BCM is set to be valid. However, whether the system is normal or effective, after the above ground process is completed, the BCM power module will automatically power off under the control of the time sequence (i.e., self-check power off 804), or forcibly power off when the ground speed exceeds 30 knots (i.e., forced power off 806). The difference is that although both are in the power-off state (at this time, the BCM is in the sleep state, and only the "power module" is in the power-on state), if the self-detection passes, the BCM has a prerequisite condition for entering the pre-positioning according to the ACE fault enabling signal in the state of being set to be effective, otherwise, the pre-positioning program of the next step cannot be entered even if the pre-positioning logic is satisfied. Furthermore, BCM initialization, self-test fail does not affect the dispatch or limit the dispatch.

BCM preposition logic (808)

The BCM pre-positioning logic (808) is only completed in an air state, after the BCM is initialized and self-detected before navigation, the BCM is in a dormant state, and only the power supply module of the BCM is in a power-on state. In the air state, if three or more ACEs are lost at the same time, the BCM power supply module is powered on under the action of three or more ACE fault state enabling signals. Since initialization and self-test are completed before the flight, the backup system enters a "Advanced RISC Machine (ARM) state" after power is applied, and re-powers the powered REU (including the excitation of the sensor). After the BCM is in the presetting state (ARM), the system cannot power off the BCM and cannot power off by itself, and the backup system is always in the presetting state (ARM).

Particularly, when the ACE fault is powered off, the secondary power supply of the REU is controlled by the BCM, and the BCM supplies power to the REU only on the premise that the BCM completes pre-positioning after being powered on and cannot receive state wrap-around information (including normal power supply information) of the REU. In addition, due to the safety requirement, in order to prevent the accident of simultaneous power supply of two paths, the REU power supply module is provided with a reverse-flow prevention measure, so that simultaneous power supply of two paths is allowed without influencing the normal function of the REU.

BCM activation logic (810)

When the ACE fails, a backup system is in a "Advance (ARM)" state, and power is supplied to the dual-port control REU again, the dual-port control REU completes initialization within 250ms, if the initialization is completed successfully, the dual-port control REU can inform a remote electronic control unit of successful initialization through a control module and establishes communication with a BCM, and the BCM sends a control instruction through an ARINC429 bus and receives rewinding information (useful information in a data packet) of the dual-port control REU. That is, the BCM releases the command control output interface, takes over the fault ACE to supply power to the corresponding double-port control REU and implement online monitoring, so as to enter an Activated (ACTIVE) state, and simultaneously, for example, "BCM ACTIVE" can be displayed in the system.

Once activated, the backup system takes over control of the aircraft, and cannot be manually or automatically exited or switched off. After the REU is powered on again by the BCM, if the initialization fails, the BCM should control the power on and off so that the REU has the opportunity of repeating the initialization (which can be set for 3 times), and if none of the 3 times passes, the corresponding control channel is not released (which corresponds to the control channel not being activated), and the corresponding control channel is not powered off so as to grasp the state information of the corresponding control channel and expect possible recovery.

Particularly, in the backup mixed mode, when the BCM sends a control signal to the normal dual-port control REU due to a logic error, the backup system does not affect the control work of the normal ACE due to the priority set in the dual-port control REU, thereby ensuring the safety and the independence of the backup system.

4. Failure and restart

In addition, when the ACE fails or fails, the ACE will send a fault enable signal to the BCM, and the backup system takes over control of the aircraft. However, at the same time, the influence of the main system after the fault on the operation of the backup system should be avoided, so that when the ACE fails, the main system sets itself to the default safe state while sending out the fault state information. Namely, the bus data connection with the computer and the data command sent to the back end are simultaneously cut off at the moment of the fault.

When the ACE recovers due to accidental factors or system instruction failure, the main system instruction has priority over the BCM instruction at the REU terminal, so the BCM instruction is restrained, meanwhile, the BCM detects the working state that the double-port control REU is powered by the PCM again through the wrap-around information, and the corresponding control channel or all the control channels of the backup system enter the pre-positioning state. At this point, the system will be in either the hybrid backup control mode or the "full bypass" pre-positioned backup mode.

Fig. 9 illustrates a flow chart of a method 900 of operation of a backup control system based on a distributed fly-by-wire architecture according to an exemplary aspect of the present disclosure.

The method 900 of operating a distributed fly-by-wire architecture based backup control system may include receiving, by a backup control module, status signals from a plurality of actuator control electronics units of an aircraft at block 902.

At block 904, the method 900 may include determining that the aircraft has an actuator control electronics unit failure and a number of failures based on the status signal.

At block 906, the method 900 may include activating, when the number of actuator control electronic units of the aircraft that fail is greater than a threshold value, a backup control module to provide backup control commands to a set of control surfaces distributed at the set of control surfaces of the aircraft to a plurality of remote electronic control units, wherein each remote electronic control unit has dual control signal ports corresponding to a primary control channel and a backup control channel, respectively, the backup control commands being provided through the backup control channels.

According to some exemplary embodiments, each remote electronic control unit is further coupled to the actuator control electronic unit on the master control channel, wherein the plurality of remote electronic control units manipulate the set of control surfaces and the other control surfaces based on master commands received from the actuator control electronic unit through the master control channel when the actuator control electronic unit of the aircraft is not disabled or the number of failures is not greater than a threshold value.

According to some exemplary embodiments, the backup control module activating includes the backup control module powering up from a sleep mode, and the method of operation may further include receiving, by the backup control module after the backup control module activating, signals from a plurality of position sensors distributed at a set of effectors of the aircraft; and determining a backup control command for the set of control surfaces based at least in part on the signals received from the plurality of position sensors.

According to some exemplary embodiments, the actuator control electronics of the aircraft includes four actuator control electronics, and the threshold includes two, wherein when there are three actuator control electronics that fail, the backup control module provides the backup control command to the remote electronic control unit through the backup control channel while the remaining one actuator control electronics provides the master control command to the remote electronic control unit through the master channel; or when the remote electronic control unit is powered off due to the fact that all four actuator control electronic units fail, the backup control module supplies power to the remote electronic control unit, and provides a backup control command to the remote electronic control unit through the backup control channel after the remote electronic control unit is initialized successfully.

According to some exemplary embodiments, the working method further comprises performing pre-flight power-on initialization and self-detection of the backup control module when the aircraft is in a ground state; and when the initialization and the self-detection are successful, the backup control module sets the self state to be effective and cuts off the power so as to be in a dormant state.

According to some exemplary embodiments, the backup control module activating further comprises activating the backup control module from the dormant state only when the aircraft is in an airborne state and the state of the backup control module is active.

What has been described above is merely exemplary embodiments of the present invention. The scope of the invention is not limited thereto. Any changes or substitutions that may be easily made by those skilled in the art within the technical scope of the present disclosure are intended to be included within the scope of the present disclosure.

The various illustrative logical blocks, modules, and circuits described in connection with the disclosure may be implemented or performed with a general purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable Logic Device (PLD), discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor, but in the alternative, the processor may be any commercially available processor, controller, microcontroller or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.

The steps of a method or algorithm described in connection with the disclosure may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. The software modules may reside in any form of storage medium known in the art. Some examples of storage media that may be used include Random Access Memory (RAM), Read Only Memory (ROM), flash memory, EPROM memory, EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, and so forth. A software module may comprise a single instruction, or many instructions, and may be distributed over several different code segments, among different programs, and across multiple storage media. A storage medium may be coupled to the processor such that the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor.

The methods disclosed herein comprise one or more steps or actions for achieving the described method. The method steps and/or actions may be interchanged with one another without departing from the scope of the claims. In other words, unless a specific order of steps or actions is specified, the order and/or use of specific steps and/or actions may be modified without departing from the scope of the claims.

The processor may execute software stored on a machine-readable medium. A processor may be implemented with one or more general and/or special purpose processors. Examples include microprocessors, microcontrollers, DSP processors, and other circuitry capable of executing software. Software should be construed broadly to mean instructions, data, or any combination thereof, whether referred to as software, firmware, middleware, microcode, hardware description language, or otherwise. By way of example, a machine-readable medium may include RAM (random access memory), flash memory, ROM (read only memory), PROM (programmable read only memory), EPROM (erasable programmable read only memory), EEPROM (electrically erasable programmable read only memory), registers, a magnetic disk, an optical disk, a hard drive, or any other suitable storage medium, or any combination thereof. The machine-readable medium may be embodied in a computer program product. The computer program product may include packaging material.

In a hardware implementation, the machine-readable medium may be a part of the processing system that is separate from the processor. However, as those skilled in the art will readily appreciate, the machine-readable medium, or any portion thereof, may be external to the processing system. By way of example, a machine-readable medium may include a transmission line, a carrier wave modulated by data, and/or a computer product separate from the wireless node, all of which may be accessed by a processor through a bus interface. Alternatively or additionally, the machine-readable medium or any portion thereof may be integrated into a processor, such as a cache and/or a general register file, as may be the case.

The processing system may be configured as a general purpose processing system having one or more microprocessors that provide processor functionality, and an external memory that provides at least a portion of the machine readable medium, all linked together with other supporting circuitry through an external bus architecture. Alternatively, the processing system may be implemented with an ASIC (application specific integrated circuit) having a processor, a bus interface, a user interface (in the case of an access terminal), support circuitry, and at least a portion of a machine readable medium integrated in a single chip, or with one or more FPGAs (field programmable gate arrays), PLDs (programmable logic devices), controllers, state machines, gated logic, discrete hardware components, or any other suitable circuitry, or any combination of circuitry that is capable of performing the various functionalities described throughout this disclosure. Those skilled in the art will recognize how best to implement the functionality described with respect to the processing system, depending on the particular application and the overall design constraints imposed on the overall system.

The machine-readable medium may include several software modules. These software modules include instructions that, when executed by a device, such as a processor, cause the processing system to perform various functions. These software modules may include a transmitting module and a receiving module. Each software module may reside in a single storage device or be distributed across multiple storage devices. As an example, a software module may be loaded into RAM from a hard drive when a triggering event occurs. During execution of the software module, the processor may load some instructions into the cache to increase access speed. One or more cache lines may then be loaded into a general register file for execution by the processor. When referring to the functionality of a software module below, it will be understood that such functionality is implemented by the processor when executing instructions from the software module.

If implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a web site, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, Digital Subscriber Line (DSL), or wireless technologies such as Infrared (IR), radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. Disk (disk) and disc (disc), as used herein, includes Compact Disc (CD), laser disc, optical disc, Digital Versatile Disc (DVD), floppy disk, and Blu-ray disc, wherein the disk (disk) usually reproduces data magnetically, while the disc (disc) reproduces data optically with a laser. Thus, in some aspects, computer-readable media may comprise non-transitory computer-readable media (e.g., tangible media). Additionally, for other aspects, the computer-readable medium may comprise a transitory computer-readable medium (e.g., a signal). Combinations of the above should also be included within the scope of computer-readable media.

Accordingly, certain aspects may comprise a computer program product for performing the operations presented herein. For example, such a computer program product may include a computer-readable medium having instructions stored (and/or encoded) thereon, the instructions being executable by one or more processors to perform the operations described herein. In certain aspects, a computer program product may include packaging materials.

It is to be understood that the claims are not limited to the precise configuration and components illustrated above. Various changes, substitutions and alterations in the arrangement, operation and details of the method and apparatus described above may be made without departing from the scope of the claims.

Claims (17)

1. A backup control system based on a distributed fly-by-wire architecture comprises:

a backup control module; and

a plurality of remote electronic control units distributed at and for manipulating a set of control surfaces of an aircraft, each remote electronic control unit having dual control signal ports corresponding to a master control channel and a backup control channel, respectively, and coupled to the backup control module on the backup control channel, wherein

When the aircraft has the actuator control electronic units which are out of work and the number of the out-of-work actuator control electronic units is larger than a threshold value, the backup control module provides backup control commands for the group of control surfaces to the plurality of remote electronic control units through the backup control channel.

2. The backup control system of claim 1, wherein each remote electronic control unit is further coupled to the actuator control electronic unit on a master channel, wherein the plurality of remote electronic control units manipulate the set of control surfaces and other control surfaces based on master commands received from the actuator control electronic unit through the master channel when the aircraft's actuator control electronic unit is not dead or a number of failures is not greater than a threshold.

3. The backup control system of claim 1, wherein the backup control module is coupled to the actuator control electronics of the aircraft to receive a status signal and determine whether and the number of actuator control electronics of the aircraft failed based on the status signal.

4. The backup control system of claim 2, wherein each remote electronic control unit further comprises a power module having dual power input ports coupled to the power conditioning module of the aircraft and the backup control module, respectively, wherein

The power module is powered by the power conditioning module of the aircraft when the actuator control electronics of the aircraft are not disabled or the number of failures is not greater than a threshold; or

And when the actuator control electronic units of the airplane fail and the number of failures is greater than a threshold value, the power module is powered by the backup control module.

5. The backup control system of claim 4, wherein the power module includes a back-up prevention device that prevents the power conditioning module and the backup control module from being powered simultaneously.

6. The backup control system of claim 1, wherein the backup control commands provided by the backup control module through the backup control channel are determined based at least in part on signals received from a plurality of position sensors distributed at a set of operators of an aircraft.

7. The backup control system of claim 6, wherein the set of manipulators comprises a sidebar and a rudder foot pedal.

8. The backup control system of claim 1, wherein the set of control surfaces comprises a left elevator inboard side, a left aileron inboard side, a rudder mid-section, a right elevator inboard side, a right aileron inboard side.

9. A working method of a backup control system based on a distributed fly-by-wire architecture comprises the following steps:

receiving, by a backup control module, status signals from a plurality of actuator control electronics units of an aircraft;

determining, based on the status signals, that the aircraft has an actuator control electronics unit failure and a number of failures; and

when the number of the actuator control electronic units of the airplane which fail is larger than a threshold value, the backup control module is activated to provide backup control commands for a group of control surfaces to a plurality of remote electronic control units distributed at the group of control surfaces of the airplane, wherein each remote electronic control unit is provided with two control signal ports which respectively correspond to a main control channel and a backup control channel, and the backup control commands are provided through the backup control channels.

10. The method of operation of claim 9, wherein each remote electronic control unit is further coupled to the actuator control electronic unit on the master control channel, wherein the plurality of remote electronic control units manipulate the set of control surfaces and other control surfaces based on master commands received from the actuator control electronic unit through the master control channel when the aircraft's actuator control electronic unit is not dead or a number of failures is not greater than a threshold value.

11. The method of operation of claim 9, wherein the backup control module activation includes the backup control module powering up from a sleep mode, and further comprising, after the backup control module activation:

receiving, by the backup control module, signals from a plurality of position sensors distributed at a set of effectors of the aircraft; and

determining a backup control command for the set of control surfaces based at least in part on signals received from the plurality of position sensors.

12. The method of operation of claim 9, wherein the aircraft's actuator control electronics includes four actuator control electronics, and the threshold value includes two, wherein,

when three actuator control electronic units fail, the backup control module provides a main control command to the remote electronic control unit through the main control channel and provides the backup control command to the remote electronic control unit through the backup control channel while providing the main control command to the remote electronic control unit through the remaining one actuator control electronic unit through the main control channel; or

When all four actuator control electronic units fail to work and the remote electronic control unit is powered off, the backup control module supplies power to the remote electronic control unit and provides the backup control command to the remote electronic control unit through the backup control channel after the remote electronic control unit is initialized successfully.

13. The method of operation of claim 9, further comprising:

when the airplane is in a ground state, performing power-on initialization and self-detection before flight of the backup control module; and

and when the initialization and the self-detection are successful, the backup control module sets the self state to be effective and cuts off the power so as to be in a dormant state.

14. The method of operation of claim 13, wherein the backup control module activation further comprises activating the backup control module from a dormant state only when the aircraft is in an airborne state and the state of the backup control module is active.

15. A remote electronic control unit comprising:

a control module having dual control signal ports, including a master control channel for receiving master control commands from the actuator control electronics unit and including a backup control channel for receiving backup control commands from the backup control module, wherein the control module includes an arbitration means for determining the command to be employed based on the priority of the received master control command and backup control command;

the power supply module is provided with a double-power-supply input port and is used for respectively receiving power supply from a power supply regulating module of the airplane or power supply from the backup control module corresponding to the main control channel; and

electro-hydraulic servo actuators for actuating the associated control surfaces of the aircraft in accordance with the commands to be employed.

16. The remote electronic control unit of claim 15, wherein the power module includes a back-up prevention device for preventing back-up from occurring when the power conditioning module and the backup control module are simultaneously supplying power to the remote electronic control unit.

17. The remote electronic control unit of claim 15, wherein the power module is further to:

when the actuator control electronic unit works normally, the power supply from the power supply adjusting module supplies power; and is

When the actuator control electronic unit loses power supply from the power supply adjusting module due to failure and receives power supply from the backup control module, the power supply is re-powered on and the control module informs the backup control module that the remote electronic control unit is successfully initialized through the dual control signal port.

Images