CN115951573A

CN115951573A - Remote electronic unit of flight control actuation system and control method thereof

Info

Publication number: CN115951573A
Application number: CN202211627687.2A
Authority: CN
Inventors: 黄健; 吕延平; 徐若玥; 段定杰; 安杨
Original assignee: Commercial Aircraft Corp of China Ltd
Current assignee: Commercial Aircraft Corp of China Ltd
Priority date: 2022-12-16
Filing date: 2022-12-16
Publication date: 2023-04-11

Abstract

A remote electronic unit for a flight control actuation system and a method for controlling the same are disclosed. The remote electronic unit may include a command branch and an analog branch. The instruction branch receives a digital control plane control command from the flight control computer and generates a first control plane driving instruction. The remote electronic unit may also include a bus processor that converts the control plane control commands in digital form from the flight control computer into analog control commands. The simulation branch generates a second control surface drive command based on the simulation control command provided by the bus processor. Either the first control surface drive command or the second control surface drive command may be selected as the drive command to control the actuators associated with the control surfaces. A method of controlling a remote electronic unit of a flight control actuation system is also disclosed.

Description

Remote electronic unit of flight control actuation system and control method thereof

Technical Field

The invention relates to the field of aircrafts, in particular to a remote electronic unit of a flight control actuation system and a control method thereof.

Background

Modern large passenger aircraft widely adopt a full-time full-limit distributed electric flight control system which comprises a flight control actuation system. In flight control actuation systems, multiple redundant actuators and remote electronic units are typically used to control the control surfaces of an aircraft. Under a distributed architecture, a master flight control computer controls a Remote Electronic Unit (REU) associated with an actuator through a bus, so that the technical complexity of core electronic components of the master flight control computer is reduced, and the weight of the whole flight control system is reduced. The REU converts a control plane instruction signal of the flight control computer into a servo mechanism instruction, and is communicated with the actuator circuit through a digital bus. Therefore, the integrity of the electrical signals output by the REU and the digital/serial interface between the REU and other electronic devices is highly desirable to maintain safety in flight control.

For fly-by-wire systems, a Remote Electronic Unit (REU) as a complex hardware electronics has common mode problems. In a typical flight control architecture, multiple actuator sub-circuits are employed on the same control plane, each circuit employing a non-similar remote electronic unit to mitigate common mode problems, and a non-similar command/supervisory channel design is employed in each remote electronic unit to meet data integrity requirements. The design method has the characteristics of high research and development cost, complex design, poor universality, poor usability and the like.

Accordingly, there is a need in the art for an improved remote electronic unit for a flight control actuation system and method of controlling the same.

Disclosure of Invention

The invention provides an improved remote electronic unit for a flight control actuation system and a control method thereof. The remote electronic unit can realize a redundancy (for example, three-redundancy) control channel, can effectively relieve the integrity requirement of a dual-channel architecture, and reduces the design specification of single-channel integrity. Compared with a system architecture adopting a plurality of non-similar remote electronic units for a single control surface, the redundancy remote electronic unit can reduce the complexity of hardware, improve the universality and effectively relieve the common-mode problem.

In addition, the remote electronic unit of the redundancy control channel can reduce the hidden fault exposure time of the command/monitoring channel and the number of monitors to a certain extent, thereby improving the usability of equipment. The remote electronic unit can be particularly applied to a distributed fly-by-wire system, and can efficiently realize local control and monitoring of the actuator.

Compared with a flight control system only using a single bus, the invention also provides a backup digital bus, reduces the risk of failure of a single actuating loop caused by the failure of the bus, and has higher flexibility and universality.

In one embodiment of the present invention, there is provided a remote electronic unit of a flight control actuation system, comprising: the control plane driving control system comprises an instruction branch, a first control plane driving control unit and a second control plane driving control unit, wherein the instruction branch receives a control plane control command from a flight control computer through a first digital bus and generates a first control plane driving command at least partially based on the control plane control command; a bus processor that receives the control plane control command from the flight control computer via the first digital bus and converts the control plane control command into an analog control command; the simulation branch generates a second control surface driving instruction based on a simulation control command provided by the bus processor; the instruction selection module selects the first control surface driving instruction or the second control surface driving instruction as a driving instruction; and a drive circuit that controls an actuator associated with the control surface according to the drive instruction.

In one aspect, when the command branch is active, the command selection module selects the first control surface driving command generated by the command branch as a driving command; and when the instruction branch fails, the instruction selection module selects the second control surface driving instruction generated by the simulation branch as a driving instruction.

In an aspect, the command branch receives a first sensor feedback signal associated with the control surface and the analog branch receives a second sensor feedback signal associated with the control surface when the command branch fails, wherein the command branch receives the second sensor feedback signal from the analog branch and uses the first sensor feedback signal to verify the integrity of the second sensor feedback signal.

In one aspect, the remote electronic unit further comprises: the monitoring branch receives the control surface control command from the flight control computer through the first digital bus and generates a third control surface driving command at least partially based on the control surface control command, wherein the monitoring branch compares the first control surface driving command with the third control surface driving command to determine the effectiveness of the first control surface driving command.

In one aspect, the bus processor is further connected to the flight control computer or a different flight control computer via a second digital bus, and when the first digital bus fails, the bus processor receives a control plane control command from the flight control computer via the second digital bus.

In one aspect, the analog branch comprises: starting logic; and an instruction generation circuit, wherein the start-up logic starts up the instruction generation circuit when receiving a start-up instruction from an flight control computer via the bus processor, so that the instruction generation circuit generates the second control surface driving instruction based on a simulation control command provided by the bus processor.

In one aspect, the starting logic further generates a selection signal, where the selection signal causes the instruction selection module to select the first control surface driving instruction generated by the instruction branch as the driving instruction when the starting logic does not receive the starting instruction, and the selection signal causes the instruction selection module to select the second control surface driving instruction generated by the analog branch as the driving instruction after the starting logic receives the starting instruction.

In an aspect, the drive circuit comprises one or more of a servo valve (EHSV) drive circuit and a mode selection valve (SOV) drive circuit, the drive signals comprising servo drive instructions for the servo valve drive circuit and/or mode selection instructions for the mode selection valve drive circuit.

In one aspect, the control surface comprises a spoiler, rudder, elevator, or aileron.

In one embodiment of the present invention, a method of controlling a remote electronic unit of a flight control actuation system is provided, comprising: receiving a control plane control command from a flight control computer through a first digital bus in a command branch, and generating a first control plane driving command at least partially based on the control plane control command; receiving, in a bus processor, the control plane control command from the flight control computer via the first digital bus, and converting the control plane control command into an analog control command; generating a second control surface drive instruction in the simulation branch based on the simulation control command provided by the bus processor; selecting the first control surface driving instruction or the second control surface driving instruction as a driving instruction; and controlling an actuator associated with the control surface in accordance with the drive command.

In one aspect, when the command branch is valid, the first control surface driving command generated by the command branch is selected as a driving command; and when the instruction branch fails, selecting the second control surface driving instruction generated by the simulation branch as a driving instruction.

In one aspect, receiving a first sensor feedback signal associated with the control surface in the command branch when the command branch fails; receiving a second sensor feedback signal associated with the control surface in the analog branch; and receiving the second sensor feedback signal in the command branch from the analog branch and verifying the integrity of the second sensor feedback signal using the first sensor feedback signal.

In one aspect, the control method further comprises: receiving the control plane control command from the flight control computer via the first digital bus in a monitoring branch, and generating a third control plane drive instruction based at least in part on the control plane control command; and comparing the first control surface drive command with the third control surface drive command in the monitoring branch to determine the validity of the first control surface drive command.

In one aspect, the control method further comprises: and when the first digital bus has a fault, receiving a control plane control command from the flight control computer or a different flight control computer in the bus processor through a second digital bus.

In one aspect, the control method further comprises: when a starting instruction from a flight control computer is received in the simulation branch through the bus processor, the instruction generating circuit in the simulation branch is started, so that the instruction generating circuit generates the second control surface driving instruction based on a simulation control command provided by the bus processor.

In one aspect, the control method further comprises: generating a selection signal in the simulation branch, wherein the selection signal causes the first control surface driving instruction generated by the instruction branch to be selected as the driving instruction when the starting instruction is not received, and the selection signal causes the second control surface driving instruction generated by the simulation branch to be selected as the driving instruction after the starting instruction is received.

In one aspect, the drive signal comprises servo drive commands for a servo valve drive circuit and/or mode selection commands for a mode selection valve drive circuit.

Drawings

FIG. 1 is a block diagram of an architecture of an aircraft actuation system according to one embodiment of the invention.

Fig. 2 is an architectural diagram of a remote electronic unit according to one embodiment of the present invention.

Fig. 3 is a schematic signal input diagram of a remote electronic unit in accordance with one embodiment of the present invention.

Fig. 4 is a flow chart of the activation of the analog branch of the remote electronic unit in accordance with one embodiment of the present invention.

Fig. 5 is a flow chart of a method of controlling a remote electronic unit according to one embodiment of the present invention.

Detailed Description

The present invention will be further described with reference to the following specific examples and drawings, but the scope of the present invention should not be limited thereto.

The invention provides an improved remote electronic unit for a flight control actuation system and a control method thereof. The remote electronic unit may include a command branch that receives control plane control commands in digital form from the flight control computer via a digital bus and generates control plane drive commands based on the control plane control commands. The remote electronic unit may further comprise a bus processor connected to the digital bus for converting control plane control commands in digital form from the flight control computer into analog control commands. The remote electronic unit may also include an analog branch that generates control surface drive instructions based on analog control commands provided by the bus processor. The control surface drive command generated by the command branch or the control surface drive command generated by the mimic branch may be provided as a drive command to a drive circuit to control an actuator associated with the control surface.

The remote electronic unit can realize a redundancy (for example, three-redundancy) control channel, and the digital instruction branch, the monitoring branch and the analog branch form a non-similar channel, so that the integrity requirement of a dual-channel architecture can be effectively relieved, and the design specification of the single-channel integrity is reduced.

FIG. 1 is a block diagram of an architecture of a flight control actuation system 100 according to one embodiment of the invention. The flight control actuation system 100 is used to control various motions and operations of an aircraft or spacecraft. Flight control actuation system 100 can include one or more flight control computers 110, one or more of which can serve as a master flight control computer and the remaining of which can serve as backup flight control computers. The flight control computer 110 may communicate with various onboard electronic devices and ground facilities, such as with onboard avionics systems, satellite systems, and the like.

Each flight control computer may be connected to one or more remote control units (REU) 120 via a digital bus 112. The REU120 may be located at the fuselage near the aircraft control surfaces and be connected to and in communication with the actuators such that the actuators drive the respective aircraft control surfaces. The control surface may be, for example, a spoiler, rudder, elevator, aileron, or the like.

Flight control computer 110 may generate control plane control commands based on sensor signals from cockpit steering sensors and various aircraft sensors and communicate the control plane control commands to REU120 via digital bus 112. Cockpit steering sensors are used to detect operation of the cockpit and provide operational inputs, and aircraft sensors are used to sense aircraft state and motion and provide feedback information. The REU120 may resolve the control plane control command from the flight control computer 110 via a processor, generate and output a servo drive command (or control plane position command) to a servo valve (EHSV) drive circuit. The EHSV drive circuit can make the EHSV actuator perform corresponding movement based on the servo drive command so as to drive the control surface to deflect.

Alternatively, the REU120 may include a mode selection valve (SOV) drive circuit, and the REU120 may resolve control plane control commands from the flight control computer 110 via a processor, outputting mode valve drive commands to the SOV drive circuit. The SOV drive circuit may control the SOV valve based on the modal valve drive command. The SOV valve may be used to control the operating mode (e.g., on or off) of the actuator 130. For example, when the SOV valve is turned on, the actuator is in an operating state and the hydraulic source is turned on, and the actuator normally operates, wherein the EHSV controls the amount of flow into the actuator cylinder, thereby controlling the position of the actuator and determining the position of the control surface. When the SOV valve is disconnected, the actuator is in a damping mode, and the EHSV does not drive the control surface to move.

Fig. 2 is an architectural diagram of a remote electronic unit, according to one embodiment of the present invention. The present invention provides a Remote Electronic Unit (REU) 220 for redundant (e.g., tri-redundant) control channels, the REU 220 being coupled to an actuator 230 to form an independent servo actuation circuit system. The REU 220 may be an example of the REU120 described with reference to fig. 1. The REU120 may be connected to a flight control computer (e.g., flight control computer 110) via a first digital bus 212. By way of example, and not limitation, first digital Bus 212 may be an ADB Bus (actor Data Bus) that may employ, for example, physical layer protocol RS485 for point-to-point transmission. It should be understood that other suitable buses and communication protocols may be employed.

In one embodiment, the REU 220 may be a three-channel architecture, respectively an instruction branch (COM Lane) 221, an optional monitor branch (MON Lane) 225, and an Analog Lane 260. The command leg 221 and the monitoring leg 225 may receive and resolve ADB signals transmitted by the flight control computer via the first digital bus 212 and generate drive commands for actuator (EHSV and/or SOV) drive circuits. The instruction branch 221 may also send the resolved generated driver instructions back to the flight control computer for verification. The command branch 221 and the monitoring branch 225 may electronically implement calculations of servo valve (EHSV) drive commands and mode selector valve (SOV) drive commands via complex hardware. For example, the instruction branch 221 and the monitoring branch 225 may be implemented using a processor, an integrated circuit, a programmable logic device, a complex Field Programmable Gate Array (FPGA), a microprocessor, a controller, a microcontroller, a state machine, or the like. It should be noted that the instruction branch 221 and the monitor branch 225 shown in fig. 2 employ FPGAs by way of example only and not limitation.

Preferably, the command branch 221 (or called command channel) and the monitoring branch 225 (or called monitoring channel) can process bus signals, analyze command and enable signals by adopting programmable logic devices with dissimilar designs, and process and upload feedback signals of sensors (such as a position sensor and a pressure sensor) related to a control surface or an actuator. The command branch 221 may generate control plane drive commands (e.g., servo drive commands 222 and/or mode selection commands 223) by resolving, filtering, and amplifying control plane control commands from the flight control computer. The monitoring branch 225 adopts a hardware and/or software structure dissimilar to that of the instruction branch 221, calculates a control plane driving instruction based on a control plane control command from the flight control computer, and compares and monitors the control plane driving instruction with the control plane driving instruction generated by the instruction branch 221 to ensure signal integrity.

For example, the monitoring branch may provide an error message when the control plane drive commands calculated by the COM branch and the MON branch do not match (e.g., differ by more than a threshold). Conversely, if the control plane drive commands calculated by the COM branch and the MON branch are identical (e.g., differ by a threshold value), then the control plane drive command is correct, and the control plane drive command generated by the command branch (COM) may be provided to the command selection module 270. The control plane drive commands (e.g., servo drive commands 222 and/or mode selection commands 223) provided by command selection module 270 by command leg 221 may be in analog form. Feedback signal monitoring and fault handling logic may also be implemented in the monitoring branch 225 and may have servo drive and modal valve drive shut-off functionality.

The REU 220 may also include a bus processor 250, the bus processor 250 being connected between the flight control computer and the simulation branch 260. The bus processor 250 receives control plane control commands (in digital form) from the flight control computer via the digital bus, parses the digital bus data to convert it to control commands in analog form, and passes the control commands in analog form to the analog branch 260.

In one embodiment, bus processor 250 can be connected to an flight control computer (e.g., flight control computer 110) via a first digital bus 212. In this case, the bus processor 250 may receive the same control plane control commands from the flight control computer as the command branch 221 and the monitoring branch 225.

In another embodiment, the bus processor 250 can be connected to the same flight control computer 110 or a different other flight control computer via a separate second digital bus 214. In this case, the bus processor 250 may receive the same or different control plane control commands from the same or different flight control computers via a different digital bus than the instruction branch 221 and the monitoring branch 225.

In another embodiment, the bus processor 250 can be connected to an flight control computer (e.g., flight control computer 110) via a first digital bus 212, and can also be connected to the same flight control computer 110 or a different another flight control computer via a separate second digital bus 214. Thus, the bus processor 250 may receive the same control plane control commands from the flight control computer 110 as the command branch 221 and the monitoring branch 225 via the first digital bus 212, and the bus processor 250 may receive control plane control commands from the same flight control computer 110 or a different other flight control computer via the second digital bus 214. By way of example and not limitation, the flight control computer (or actuator control electronics ACE) may enable the second digital bus 214 (backup bus) when the first digital bus (primary communication bus) 212 fails, or is unavailable.

The analog branch 260 receives an analog quantity (a control command in an analog form) output from the bus processor 250, and resolves the control command in the analog form to generate a control surface drive command. In the event of a failure of the command branch 221, the control surface drive command generated by the simulation branch 260 may be provided as a drive command to the drive circuit to control the actuators (EHSV and/or SOV). The analog branch 260 calculates the SOV command and the EHSV command through various analog circuits. For example, the analog branch 260 may include an SOV instruction generating circuit 261 and an EHSV instruction generating circuit 262, which may each employ a microprocessor/microcontroller such as an FPGA, PLD, DSP, MCU, or ASIC to perform analog operations to constitute dissimilar or different types of hardware from the instruction branch 221 and the monitoring branch 225 (e.g., a complex FPGA).

By way of example and not limitation, the analog branch 260 implements a servo closed loop algorithm to calculate SOV and EHSV commands based on control commands in analog form, and the calculated commands are filtered and amplified for provision to the command selection module 270. The analog branch 260 may provide the SOV command and the EHSV command in analog form to the command selection module 270.

Bus processor 250 may take a hot standby form to continue receiving bus signals. The analog branch 260 may employ a cold backup approach. The analog branch 260 may include enable logic 263. In the cold standby state, the SOV instruction generating circuit 261 and the EHSV instruction generating circuit 262 may be in a power saving or power down mode, and the startup logic 263 may be in an active/power on state. The start logic 263, upon receiving a start instruction transmitted from the flight control computer via the bus processor 250, starts the SOV instruction generating circuit 261 and the EHSV instruction generating circuit 262 to start calculating corresponding drive instructions.

The instruction branch 221 and the monitoring branch 225 report the circuit state to the flight control computer through the ADB bus, and the flight control computer determines whether the instruction/monitoring channel is invalid. When the command branch 221 and the monitoring branch 225 are valid, the enable logic 263 may receive a signal from the flight control computer indicating that the command branch is normal, or may not receive a signal from the flight control computer, so as not to enable the SOV command generating circuit 261 and the EHSV command generating circuit 262. In this case, the activation logic 263 outputs a selection signal 266 to the command selection module 270 to cause the command selection module 270 to select the control surface drive commands (e.g., the servo drive commands 222 and/or the mode selection commands 223) provided by the command branch 221 to be provided as drive commands to the actuator drive circuitry to control the operation of the actuators 230.

If the flight control computer determines that the command branch 221 and/or the monitoring branch 225 are/is disabled, an analog branch enable command may be sent over the bus, which is received by the bus processor 250 and converted into an analog enable command, which is passed to the enable logic 263. The startup logic 263 thus starts the SOV command generation circuit 261 and the EHSV command generation circuit 262, which generate the mode selection command 264 and the servo drive command 265, respectively. In addition, the selection signal 266 output by the enable logic 263 causes the command selection module 270 to select a control surface drive command (e.g., a mode selection command 264 and/or a servo drive command 265) output by the analog branch 260 to be provided as a drive command to the actuator drive circuit to control operation of the actuator 230. The instruction selection module 270 may be implemented as a switch, multiplexer, or the like.

In one embodiment, when the command branch 221 and the monitoring branch 225 are active, the command selection module 270 selects and provides the servo drive command (EHSV command) 222 provided by the command branch 221 to the EHSV drive circuit for controlling the control surface position. Optionally, the command selection module 270 selects and provides a mode selection command (SOV command) 223 provided by the command branch 221 to the SOV drive circuit for controlling the operating state (e.g., on or off) of the actuator. When the command branch 221 and/or the monitoring branch 225 fail, the command selection module 270 selects and provides the servo drive command (EHSV command) 265 provided by the simulation branch 260 to the EHSV drive circuit for controlling the control surface position. Optionally, the command selection module 270 selects a mode selection command (SOV command) 264 provided by the simulation branch 260 and provides it to the SOV drive circuit for controlling the operating state (e.g., on or off) of the actuator.

In another embodiment, when the instruction branch 221 is valid, the flight control computer may also send 5 an analog branch start instruction to start the analog branch 260 via the bus, so that both the instruction branch 221 and the analog branch 260 are enabled

The control surface drive command is generated and may cause the command selection module 270 to select either the control surface drive command generated by the simulation branch 260 or the control surface drive command generated by the command branch 221 based on one or more criteria (e.g., priority, reliability, etc. of the command branch and the simulation branch).

In an alternative embodiment, the monitoring branch 225 may generate the servo shut off signal 226 to shut off the servo drive and the modal valve drive when the monitoring branch 225 detects a 0 fault in the feedback signal monitoring and fault handling.

When the command selection module 270 receives the servo shut off signal 226 from the monitoring branch 225, the servo shut off signal 226 may be provided to the SOV drive circuit to shut off the SOV servo valve. Accordingly, the EHSV drive circuit stops driving the control surface.

Although the instruction selection module 270 is shown in fig. 2 as being external to the EHSV driver circuit, the SOV driver circuit 5, in different embodiments, two or more of these modules may be implemented together. Example (b)

For example, the EHSV driver circuit and the SOV driver circuit may be implemented together. Alternatively, the command selection module may be implemented within the EHSV driver circuit and the SOV driver circuit, respectively, to select the corresponding input signal. For example, the first command selection module may receive a servo drive command (EHSV command) provided by the command branch 221

Instruction) 222 and/or the analog branch 260 and selects one of the servo drive commands 265 to provide to the 0EHSV drive circuit. Optionally, the second instruction selection module may receive the modality provided by the instruction branch 221

A selection instruction (SOV instruction) 223 and/or a mode selection instruction 264 provided by the analog branch 260 and provide one of them to the SOV driving circuit.

In normal mode, the REU 220 for controlling the actuator may receive a command via the first digital bus

In the control surface control command of the actuator, the command/monitoring channel of the REU 220 can independently resolve the control surface control command based on the effective bus signal 5 to generate a servo valve driving command, and the command channel outputs the servo driving command

And modal valve actuation commands. When the starting logic is triggered, the simulation channel starts to operate, and the servo driving command and the modal valve driving command are output by the simulation channel. The three channels are independent from each other, and the input of the monitoring channel, the input of the instruction channel and the input of the analog channel are isolated, so that common-mode faults of the inputs of the three branches can be avoided.

To ensure the integrity and availability of the REU data, the analog branch may employ periodic maintenance and critical signal monitoring. The sensor signals will be fed back to the three branches (i.e., command branch 221, monitoring branch 225, and analog branch 260) independently, i.e., each sensor signal will be fed into three conversion circuits. In the analog branch 260, the integrity design can be implemented using these three feedback signals.

For the command branch 221 and the monitoring branch 225, sensor feedback signals of two branches of the same type (e.g., LVDT position) may be compared between the two branches to detect whether the sensor signal has a fault in the transmission path, and to achieve fault location and fault isolation, thereby ensuring equipment integrity.

For the integrity of the analog branch circuit 260, on the one hand, a failure can be checked in a manner of regular maintenance, such as self-detection (e.g., at power-up or restart). Alternatively, the sensor signal of the analog branch 260 may be compared to the equivalent sensor feedback signal of the MON branch 225 (or the command branch 221). In one embodiment, after the COM/MON branch fails, the power supply may not be completely cut off, but the instruction branch 221 and/or the monitoring branch 225 continue to operate to verify the sensor feedback signal received by the analog branch 260, thereby implementing a certain degree of monitoring function.

For example, an AL (analog branch) instruction monitor circuit may be included in instruction branch 221. When the command branch 221 fails, the command branch 221 may receive a first sensor feedback signal associated with the control surface and the analog branch 260 may receive a second sensor feedback signal associated with the control surface. The first sensor feedback signal and the second sensor feedback signal may be feedback signals of the same type of sensor (e.g., a position sensor, a displacement sensor, an angle sensor, a velocity sensor, etc.).

The analog branch 260 may pass the received second sensor feedback signal to an AL command monitoring circuit in the command branch 221, which may use the first sensor feedback signal to verify the integrity of the second sensor feedback signal. When the second sensor feedback signal fails the integrity check, the AL instruction monitoring circuit may cause the instruction branch 221 and/or the monitoring branch 225 to report the sensor feedback signal fault problem of the simulation branch 260 to the flight control computer.

In another embodiment, an AL command monitor circuit may be implemented in the monitor branch 225, or in both the command branch 221 and the monitor branch 225, respectively, to verify the integrity of the second sensor feedback signal received by the analog branch 260.

Fig. 3 is a schematic signal input diagram of a remote electronic unit according to one embodiment of the present invention.

As described above, the REU 220 (and in particular the bus processor 250) can receive a first control command from an flight control computer via a first digital bus (e.g., the master communication bus 330) and can receive a second control command from the same flight control computer or a different other flight control computer via a second digital bus (e.g., the backup communication bus 340).

When only one signal arrives at the REU, the selector 320 may pass the one signal to the bus processing electronics 310 (e.g., the bus processor 250). If both signals arrive at the REU at the same time, the REU has priority over the primary communication bus so that the selector 320 passes the signals of the primary communication bus to the bus processing electronics 310. The additional input bus signals may be from the flight control computer or from other flight control computers (e.g., backup control modules).

Fig. 4 is a flow chart of the enabling of the analog branch of the remote electronic unit according to one embodiment of the present invention. The enabling procedure may be performed by a Remote Electronic Unit (REU).

In step 401, the REU may be initiated. For example, the REU may be initiated in response to a power up.

At step 402, the instruction branch and the monitor branch are initialized and connected.

In step 403, the instruction branch and the monitoring branch report the REU status to the flight control computer via the ADB bus. The flight control computer judges whether the command/monitoring channel is invalid or not, and transmits the judgment result to the REU.

At step 404, it is determined whether the instruction branch and the monitor branch have failed. If the instruction branch and monitor branch are valid (not invalidated), then proceed to step 405 where instruction processing, such as generating COM instructions and MON instructions, is performed by the instruction branch and monitor branch. After the COM command and the MON command are successfully verified, a driving command is output by the command branch to the actuator driving circuit to control the movement of the control surface in step 406.

Conversely, if the instruction branch and/or the monitoring branch is determined to be failed at step 404, a startup instruction may also be received from the flight control computer. In one embodiment, the flight control computer may send command/monitor channel failure information and start commands separately. In another embodiment, the flight control computer may send the command/monitor channel failure information and the start command together. In another embodiment, the flight control computer may send the launch instruction alone (e.g., send or not send instruction/monitor channel failure information).

At step 410, the enable logic of the REU enables the analog branch based on the enable instruction. For example, the simulation leg may begin to operate to generate control plane drive instructions (e.g., modality selection instructions and/or servo drive instructions) based on control plane control commands of the flight control computer.

In step 411, the command selection module 270 selects the control surface drive command output by the simulation branch 260. The simulation branch 260 takes over the control of the servo valve and the mode selection valve, and switches the output of the EHSV current command and the SOV driving command. The reu then outputs the control surface drive command provided by the analog branch 260 to the actuator drive circuit to control the control surface movement at step 412.

Steps 402-406, 410-412 in the flow of fig. 4 may be repeatedly performed until the flow is complete.

The present invention, by employing a redundancy (e.g., tri-redundancy) channel architecture, provides the following advantages:

a) By adopting the multi-channel architecture, when the monitoring/command channel fails, the analog channel can take over control and respond to commands, so that the integrity design of the dual-channel architecture can be reduced, and the equipment availability can be improved;

b) The analog channel adopts an analog circuit, so that the difficulty in developing an electronic circuit is reduced, the analog circuit is mature in technology and higher in reliability;

c) The remote electronic unit can be designed into a double-input form, provides extra bus backup for a simulation channel, relieves failure of a servo loop caused by bus failure, and can be used as extra backup input of a flight control system, so that the universality and flexibility of equipment are improved.

The bus processing electronic module (e.g., the bus processor 250) is used for analyzing and packaging the bus signal of the analog branch 260, and the microcontroller of the analog branch 260 and the microcontroller of the instruction/monitoring branch can be different or different types, so that two types of dissimilar REUs can be avoided, the common mode can be reduced, and the requirement of the main flight control system can be met by only one type of REU.

Fig. 5 is a flow chart of a method of controlling a remote electronic unit according to one embodiment of the present invention. The control method may be performed by a remote electronic unit, as described above, or by a processor, microprocessor, controller, microcontroller, or state machine, among others.

In step 501, a control plane control command from the flight control computer may be received via a first digital bus in a command branch of the remote electronic unit and a first control plane drive command may be generated based at least in part on the control plane control command.

In optional step 502, a control plane control command from the flight control computer may be received via the first digital bus in a monitoring branch of the remote electronic unit and a third control plane drive instruction may be generated based at least in part on the control plane control command; and comparing the first control surface drive command with the third control surface drive command in the monitoring branch to determine the validity of the first control surface drive command.

At step 503, it may be determined whether the instruction branch is normal. For example, if the monitoring branch determines that the first control surface driving command is valid, the command branch is considered to be normal; if the monitoring branch determines that the first control surface drive command is invalid, the commanded branch may be deemed abnormal. Additionally or alternatively, the flight control computer may determine whether the command leg is normal and send a determination to the remote electronic unit as to whether the command leg is normal.

If the command branch is normal, a first control surface drive command generated in the command branch of the remote electronic unit may be provided as a drive command to the drive circuit for controlling the actuator associated with the control surface (step 507). Furthermore, if the command branch is normal, the method may return to step 501 to continue generating the first control surface drive command in the command branch of the remote electronic unit.

If the instruction branch is not normal, then at step 504, the simulated branch may be initiated in response to the initiate instruction. For example, if a start instruction from the flight control computer is received via the bus processor in the analog branch of the remote electronic unit, the instruction generation circuit in the analog branch may be started.

In step 505, a second control surface drive command may be generated in the simulation branch based on the simulated control commands provided by the bus processor. For example, the instruction generation circuit may generate the second control surface drive instruction based on an analog control command provided by the bus processor after startup. The bus processor may receive control plane control commands from the flight control computer via a digital bus and convert the control plane control commands to analog control commands. In additional embodiments, the bus processor may receive control plane control commands from the flight control computer or a different flight control computer via the second digital bus when the digital bus fails.

At step 506, a second control surface drive command provided by the analog branch may be selected as the drive command. By way of example and not limitation, a selection signal may be generated in the analog branch, which selection signal causes a first control surface drive command generated by the command branch to be selected as a drive command when no start command is received, and which selection signal causes a second control surface drive command generated by the analog branch to be selected as a drive command after the start command is received.

In step 507, actuators associated with the control surface may be controlled based on the drive command. The control surface may include, for example, spoilers, rudders, elevators, or ailerons.

The present invention provides a remote control unit (REU) that employs a digital form of the command/monitoring branch and an additional analog form of the control branch, such that the branches have dissimilar designs, thereby reducing common mode failures. The REU may employ a processor (e.g., a programmable gate array device FPGA) that processes the data bus to provide bus information conversion for the analog branches, convert the digital bus instructions into analog instruction signals that the analog branches can recognize, and feed back the analog branch status and the enabling status to the flight control computer. The bus processor (FPGA) is not similar to the FPGA of the monitor/command channel. In addition, the bus processor may additionally receive a backup digital bus, which may enable a backup bus signal when the primary communication bus is disabled or unavailable, thereby reducing the probability of system failure.

For remote electronic units that only use the command/monitor dual channel architecture, the security index assigned to the REU by the system is typically 1E-11/FH, and the integrity of the control data generated by the single channel generally needs to be greater than 1E-5/FH to ensure that the dual channel architecture device meets the integrity requirements. Therefore, the remote electronic unit with the dual-channel architecture has high requirement on the integrity of a single channel, so that the design of each channel is complex, and the dissimilar design of the two channels increases the research and development cost and reduces the usability of the equipment. The remote electronic unit can realize redundant (for example, triple redundant) control channels, can effectively relieve the integrity requirement of a dual-channel architecture, and reduces the design specification of single-channel integrity. In other embodiments, dual redundancy (e.g., instruction branch and analog branch), quad redundancy, or more redundancy (e.g., multiple instruction branches, multiple monitor branches, or multiple analog branches may be included that employ non-similar structures) may be employed. Compared with a system architecture adopting a plurality of non-similar remote electronic units for a single control surface, the redundancy remote electronic unit can reduce the complexity of hardware, improve the universality and effectively relieve the common-mode problem.

In addition, the remote electronic unit of the redundancy control channel can reduce the hidden fault exposure time of the command/monitoring channel to a certain extent, reduce the number of monitors and further improve the usability of equipment. The remote electronic unit can be particularly applied to a distributed fly-by-wire flight control system, and can efficiently realize local control and monitoring of the actuator.

Compared with the flight control system only using a single bus, the invention also provides the backup bus, reduces the risk of single actuating circuit failure caused by bus failure, and has higher flexibility and universality.

The various steps and modules of the methods and apparatus described above may be implemented in hardware, software, or a combination thereof. If implemented in hardware, the various illustrative steps, modules, and circuits described in connection with the disclosure may be implemented or performed with a general purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), or other programmable logic component, hardware component, or any combination thereof. A general purpose processor may be a processor, microprocessor, controller, microcontroller, or state machine, among others. If implemented in software, the various illustrative steps, modules, etc. described in connection with the present disclosure may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. A software module implementing various operations of the present disclosure may reside in a storage medium such as RAM, flash memory, ROM, EPROM, EEPROM, registers, hard disk, a removable disk, a CD-ROM, cloud storage, and the like. A storage medium may be coupled to the processor such that the processor can read information from, and write information to, the storage medium, and execute the corresponding program modules to perform the various steps of the present disclosure. Furthermore, software-based embodiments may be uploaded, downloaded, or accessed remotely through suitable communication means. Such suitable communication means include, for example, the internet, the world wide web, an intranet, software applications, cable (including fiber optic cable), magnetic communication, electromagnetic communication (including RF, microwave, and infrared communication), electronic communication, or other such communication means.

The numerical values given in the embodiments are only examples and do not limit the scope of the present invention. In addition, other components or steps not recited in the claims or specification of the invention may be present as a whole. Moreover, the singular reference of a component does not exclude the plural reference of such components.

It is also noted that the embodiments may be described as a process which is depicted as a flowchart, a flow diagram, a structure diagram, or a block diagram. Although a flowchart may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be rearranged.

The disclosed methods, apparatus, and systems should not be limited in any way. Rather, the present disclosure encompasses all novel and nonobvious features and aspects of the various disclosed embodiments, alone and in various combinations and subcombinations with one another. The disclosed methods, apparatus, and systems are not limited to any specific aspect or feature or combination thereof, nor do any of the disclosed embodiments require that any one or more specific advantages be present or that a particular or all technical problem be solved.

The present invention is not limited to the above-described embodiments, which are intended to be illustrative rather than restrictive, and many modifications may be made by those skilled in the art without departing from the spirit and scope of the invention as defined by the appended claims.

Claims

1. A remote electronic unit for a flight control actuation system, comprising:

the control plane driving control system comprises an instruction branch, a first digital bus and a second digital bus, wherein the instruction branch receives a control plane control command from a flight control computer through the first digital bus and generates a first control plane driving command at least partially based on the control plane control command;

a bus processor that receives the control plane control command from the flight control computer via the first digital bus and converts the control plane control command into an analog control command;

the simulation branch generates a second control surface driving instruction based on a simulation control command provided by the bus processor;

the instruction selection module selects the first control surface driving instruction or the second control surface driving instruction as a driving instruction; and

a drive circuit that controls an actuator associated with a control surface according to the drive command.

2. The remote electronic unit of claim 1, wherein:

when the instruction branch is effective, the instruction selection module selects the first control surface driving instruction generated by the instruction branch as a driving instruction; and

and when the instruction branch fails, the instruction selection module selects the second control surface driving instruction generated by the simulation branch as a driving instruction.

3. The remote electronic unit of claim 2, wherein:

the command branch receiving a first sensor feedback signal associated with the control surface, the analog branch receiving a second sensor feedback signal associated with the control surface when the command branch fails,

wherein the command branch receives the second sensor feedback signal from the analog branch and verifies integrity of the second sensor feedback signal using the first sensor feedback signal.

4. The remote electronic unit of claim 1, further comprising:

a monitoring branch that receives the control plane control command from the flight control computer via the first digital bus and generates a third control plane drive instruction based at least in part on the control plane control command,

the monitoring branch circuit compares the first control surface driving instruction with the third control surface driving instruction to determine the validity of the first control surface driving instruction.

5. The remote electronic unit of claim 1, wherein:

the bus processor is further connected to the flight control computer or a different flight control computer through a second digital bus, and when the first digital bus fails, the bus processor receives a control plane control command from the flight control computer through the second digital bus.

6. The remote electronic unit according to claim 1, wherein said analog branch comprises:

starting logic; and

an instruction generating circuit for generating a command to be executed by a computer,

wherein the enable logic enables the instruction generation circuit upon receiving an enable instruction from an aircraft control computer via the bus processor to cause the instruction generation circuit to generate the second control surface drive instruction based on a simulated control command provided by the bus processor.

7. The remote electronic unit according to claim 6, wherein the enable logic further generates a selection signal, wherein the selection signal causes the command selection module to select the first control surface drive command generated by the command branch as the drive command when the enable logic does not receive the enable command, and wherein the selection signal causes the command selection module to select the second control surface drive command generated by the analog branch as the drive command after the enable logic receives the enable command.

8. The remote electronic unit of claim 1, wherein the drive circuit comprises one or more of a servo valve (EHSV) drive circuit and a mode selection valve (SOV) drive circuit, the drive signals comprising servo drive instructions for the servo valve drive circuit and/or mode selection instructions for the mode selection valve drive circuit.

9. The remote electronic unit of claim 1, wherein the control surface comprises a spoiler, rudder, elevator, or aileron.

10. A method of controlling a remote electronic unit of a flight control actuation system, comprising:

receiving a control plane control command from a flight control computer through a first digital bus in a command branch, and generating a first control plane driving command at least partially based on the control plane control command;

receiving, in a bus processor, the control plane control command from the flight control computer via the first digital bus, and converting the control plane control command into an analog control command;

generating a second control surface drive instruction in the simulation branch based on the simulation control command provided by the bus processor;

selecting the first control surface driving instruction or the second control surface driving instruction as a driving instruction; and

controlling an actuator associated with a control surface according to the drive command.

11. The control method according to claim 10, characterized in that:

when the command branch is effective, selecting the first control surface driving command generated by the command branch as a driving command; and

and when the instruction branch fails, selecting the second control surface driving instruction generated by the simulation branch as a driving instruction.

12. The control method according to claim 11, characterized in that:

receiving a first sensor feedback signal associated with the control surface in the command branch when the command branch fails;

receiving a second sensor feedback signal associated with the control surface in the analog branch; and

receiving the second sensor feedback signal in the command branch from the analog branch and verifying integrity of the second sensor feedback signal using the first sensor feedback signal.

13. The control method according to claim 10, further comprising:

receiving the control plane control command from the flight control computer via the first digital bus in a monitoring branch, and generating a third control plane drive instruction based at least in part on the control plane control command; and

comparing the first control surface drive command with the third control surface drive command in the monitoring branch to determine the validity of the first control surface drive command.

14. The control method according to claim 10, further comprising:

and when the first digital bus has a fault, receiving a control plane control command from the flight control computer or a different flight control computer in the bus processor through a second digital bus.

15. The control method according to claim 10, further comprising:

when a starting instruction from a flight control computer is received in the simulation branch through the bus processor, the instruction generating circuit in the simulation branch is started, so that the instruction generating circuit generates the second control surface driving instruction based on a simulation control command provided by the bus processor.

16. The control method according to claim 15, further comprising:

generating a selection signal in the simulation branch, wherein the selection signal causes the first control surface driving instruction generated by the instruction branch to be selected as the driving instruction when the starting instruction is not received, and the selection signal causes the second control surface driving instruction generated by the simulation branch to be selected as the driving instruction after the starting instruction is received.

17. A control method according to claim 10 wherein the drive signals comprise servo drive commands for a servo valve drive circuit and/or mode selection commands for a mode selection valve drive circuit.