CN1945546A - Redundant method for micro aircraft GNC system - Google Patents

Abstract

A redundancy method for the GNC system of a micro-aircraft: number the multiprocessors; configure and connect the pulse sending end, pulse receiving end, serial data sending end, serial Line data receiving end, reset signal sending end, and reset signal receiving end make the processors mutually redundant to form a redundant chain; if the processor in the system communicates with external hardware devices, the external hardware devices communicate with the processing connected with multiple processors so that they can communicate with multiple processors respectively; two modes are designed: the normal mode program framework and the emergency mode program framework, the normal mode program framework enables the processor to perform its own tasks; the emergency mode program framework is used to judge faults Processor numbers, try to fix failures, and by reducing the amount of tasks per unit time, the system will exhibit redundant characteristics. The invented system has the advantages of high reliability, small volume, low power consumption and low cost.

Description

A Redundancy Method for Micro-aircraft GNC System

technical field

The invention relates to a redundancy method for a miniature electronic system, in particular to a redundancy method suitable for a navigation, guidance and control (GNC) system of a miniature aircraft. It can be applied to occasions that require high system reliability, small size and low power consumption.

Background technique

In order to realize autonomous and safe flight of micro-aircraft, its navigation, guidance and control (GNC) system needs to have high reliability. Redundant design is the most effective way to improve system reliability. A redundant system is generally a multi-machine system that is implemented based on hardware and cooperates with software. There are three kinds of existing redundancy methods: static redundancy, dynamic redundancy and hybrid redundancy. In a static redundant system, redundant modules constitute a permanent part of the system, and they cover up faults in the system through their own existence, so that the function of the system will not be affected in the end. The static redundancy mode generally consists of N (N ≥ 1) master devices, K (K ≥ 1) backup devices and at least one monitoring computer. The monitoring computer monitors the status of the system and decides whether to use the primary device or the backup device. A system using static redundancy will add at least K+1 devices, which will double the size and power consumption of the system. Dynamic redundancy is to replace faulty modules with non-faulty modules, and realize update combination for the system. After the fault is repaired, it can be put into the system again. The dynamic redundancy mode generally consists of N (N≥1) master devices, at least one backup device and at least one monitoring computer. The state of the monitoring system is monitored by the monitoring computer, and when a master device is found to be faulty, the backup device is used to replace the master device. After the failure of the main equipment is repaired, it will be put into the system again, and the backup equipment will exit the system. A system using dynamic redundancy will add at least two devices, which will also greatly increase the size and power consumption of the system. The mixed use of static redundancy and dynamic redundancy in a system is called hybrid redundancy. The volume and power consumption of the system adopting the hybrid redundancy mode are between the static redundancy mode and the dynamic redundancy mode.

Due to the very limited load of the micro-aircraft, the GNC system needs to have the characteristics of small size, light weight, and low power consumption. However, the existing redundancy methods require multiple devices to varying degrees for backup, monitoring and decision-making, which will greatly increase the size and power consumption of the system, and cannot meet the requirements of the above-mentioned occasions at all.

Contents of the invention

The technical solution problem of the present invention is: overcome the deficiency of existing redundant technology, provide a kind of under the situation that does not increase the volume and power consumption of GNC system, be applicable to the redundant method of navigation, guidance and control system of miniature aircraft .

The technical solution of the present invention is: a kind of redundant method that is used for the GNC system of miniature aircraft, and its characteristic is: utilize the existing multi-processor resource in the system, through multiplexing between processors and crossover on the hardware channel , the variable structure software system is adopted to produce redundant effects when necessary. The specific implementation method is as follows: firstly, the system hardware is designed:

(1) Number each processor according to the assignment of system tasks;

(2) According to the cascade rules, configure and connect the pulse sending end, pulse receiving end, serial data sending end, serial data receiving end, reset signal sending end, and reset signal receiving end of each processor respectively, so that each processing The devices are redundant with each other to form a redundant chain;

(3) If the processor in the system communicates with external hardware devices, the external hardware devices need to be connected to the processor through analog switches so that they can communicate with multiple processors respectively. The processor in the system controls the analog switch according to a certain logical relationship, so that the external hardware device can communicate with the appropriate processor under certain conditions. Then, according to the hardware configuration of the system, the system software is designed: the software system of each processor in the system is designed as a variable structure software system, that is, the software system of each processor contains two program frameworks: normal mode program framework and emergency mode program Frame, the switching between the two program frames is controlled by a soft switch. The normal mode program framework enables the processor to perform its own tasks and monitor the status of other related processors. At this time, the system does not show redundant features; the emergency mode program framework judges the number of the faulty processor, tries to repair the fault, and reduces the unit time The method of task volume enables the normal processor to perform the tasks that the faulty processor should perform while performing its own tasks. At this time, the system shows the characteristics of redundancy.

Principle of the present invention: as shown in FIG. 2 , under normal circumstances, the multiprocessors in the system run the normal mode program framework to perform different tasks respectively. Each processor detects the status of other processors through a specific port, and sends the results of their tasks and intermediate variables to the relevant processors. At this time, the system does not show any redundant features. When a processor fails, its pulses stop sending. Another normal processor associated with it does not detect this pulse, triggers a soft switch, and makes its program switch to the emergency mode program frame. The emergency mode program framework performs the following tasks: sends a reset pulse to the failed processor in an attempt to restart it; takes over the task of the failed processor. Since the normal processor has been receiving information such as the operation result and intermediate variables of the faulty processor before the fault occurs, the normal processor can seamlessly take over the tasks of the faulty processor. At this time, the normal processor also needs to execute the original task of the faulty processor while performing its own task. Due to its limited processing capacity, the method of halving the original system's unit time tasks is adopted to realize the normal operation of the system. At this time, the system shows redundant characteristics. When the faulty processor is successfully reset, it continues to send pulse signals. The normal processor detects the pulse signal, and sends the running results and intermediate variables of the task to the faulty processor. At the same time, it triggers a soft switch to switch the program back to normal mode. run. If the faulty processor fails fatally and cannot be restarted, the healthy processor continues to execute all tasks until the task ends. The dark redundancy method ensures reliable and uninterrupted operation of the system when one or several processors fail at the same time without increasing the system size and power consumption.

Compared with the prior art, the present invention has the advantages that the present invention utilizes existing multi-processor resources for different tasks, and greatly enhances system reliability without increasing system size and power consumption. Compared with the existing redundancy method, it does not require the backup of additional hardware systems, nor does it require additional monitoring and decision-making systems, so the system structure is simple, and the volume and power consumption are greatly reduced.

Description of drawings

Fig. 1 is the flowchart of the inventive method;

Fig. 2 is a flow chart of the working principle of the system of the present invention;

Fig. 3 is the system structural diagram when the system of the present invention takes double processor as example when the system works normally;

Fig. 4 is the system structural diagram when the system processor 1 of the present invention takes dual processors as an example to fail;

Fig. 5 is the system structural diagram when the system processor 2 failure of the present invention takes dual processor as an example;

Fig. 6 is the variable structure software system state when the present invention takes dual processor as an example when the system is in normal working state;

Fig. 7 is the state of the variable structure software system when the system with dual processors as an example breaks down in the present invention;

FIG. 8 is a system structure diagram of the system in the case of multiprocessors (more than three) in the present invention when the system works normally.

Detailed ways

As shown in Figures 1, 2, and 3, a dual processor is taken as an example to illustrate. For the situation shown in FIG. 3 , the system includes two processors, processor 1 and processor 2 , processor 1 needs to communicate with external hardware device 1 , and processor 2 needs to communicate with external hardware device 2 . In this case, the system needs to be processed as follows: ① First, set up the hardware: the No. 2 output terminal of processor 1, that is, the O-2 terminal is connected to the interrupt response terminal IRQ terminal of processor 2, and the O-2 terminal of processor 2 The terminal is connected to the IRQ terminal of processor 1, the TX terminal of the serial port of processor 1 is connected to the RX terminal of the serial port of processor 2, and the TX terminal of processor 2 is connected to the RX terminal of processor 1. The No. 3 output terminal of processor 1, that is, the O-3 terminal is connected to the Reset terminal of the processor 2, and the O-3 terminal of the processor 2 is connected to the Reset terminal of the processor 1; ②The external hardware device 1 and the processor Analog switch K1 is set at the communication interface of 1, and No. 1 end of K1 is connected to No. 1 input end of processor 1, namely I-1 end, and No. 2 end of K1 is connected to No. 2 input end of processor 2, namely I-1 end. -2 end, the switch control end of K1 is connected to the O-1 end of processor 2; The analog switch K2 is set at the communication interface of external hardware device 2 and processor 2, and No. 1 end of K2 is connected to I-1 of processor 2 Terminal 1, terminal 2 of K2 is connected to terminal I-2 of processor 1, and the switch control terminal of K2 is connected to output terminal 1 of processor 1, that is, terminal O-1; ③The terminals of processor 1 and processor 2 The software systems are all designed as variable-structure software systems, as shown in Figure 6, that is, the software systems of the two processors include two program frameworks: normal mode program framework and emergency mode program framework, and the switching of the two program frameworks is controlled by the soft switch SK .

Under normal circumstances, the dual processors in the system execute different tasks respectively, processor 1 executes task 1, and processor 2 executes task 2. The O-1 terminals of processor 1 and processor 2 are both set to high level, so that the analog switches K1 and K2 are both in the default position of No. 1. The O-2 terminals of processor 1 and processor 2 send pulse signals at a specific frequency (such as 1000Hz), and the IRQ terminals of processor 1 and processor 2 detect each other’s pulse signals in real time to obtain the working status of the other party (normal or failure). Processor 1 and processor 2 send the results and intermediate variables of their respective tasks to the other processor through the serial port TX and RX. When the system is working normally, the soft switch SK of each processor software system is set at No. 1 position (as shown in Figure 6), the processor executes the normal mode program framework, and the system does not show any redundant features.

When the processor 1 breaks down, its pulse signal stops sending. At this time, the processor 2 cannot receive the pulse signal. After a certain period of time (such as 5ms), the soft switch SK is triggered to change to the No. 2 position, and the processor 2 executes the emergency mode program framework. At this time, its software system structure is transformed from Figure 6 Go to the state of Figure 7. In emergency mode: ①Processor 2 sends a reset signal to processor 1 through its O-3 terminal, trying to restart processor 1; ②The O-1 terminal of processor 2 is set to low level, so that the analog switch K1 changes to position No. 2, and the system hardware structure changes from Figure 3 to Figure 4; ③ Processor 2 communicates with external device 1 and external device 2 at the same time, and executes task 1 and task 2. Since the processor 2 has been receiving information such as the operation result and intermediate variables of the processor 1 before the failure, it can seamlessly take over the task 1. During the period when processor 1 is trying to restart, only processor 2 is working in the system, and its processing capacity is only half of that of the original system. Controller 2 executes 1/2 of task 1 and 1/2 of task 2 in unit time.

If processor 1 restarts successfully, its O-2 terminal continues to send pulse signals at the original frequency; processor 2 detects this pulse signal, triggers the soft switch SK to change to position 1, and makes processor 2 execute the normal mode program frame, At the same time, set its O-1 terminal to be high level, so that the analog switch K1 is changed to No. 1 position; Processor 2 sends the processing results, intermediate variables and other information of Task 1 to Processor 1 through the TX port of the serial port, so that the processing Server 1 seamlessly takes over Task 1 again. The system returns to normal state. If processor 1 has a fatal failure and cannot be restarted, processor 2 can continue to execute 1/2 of task 1 and 1/2 of task 2 until the end of the task.

Similarly, when the processor 2 fails, its pulse signal stops sending. At this time, the processor 1 cannot receive the pulse signal. After a certain period of time (such as 5ms), the soft switch SK is triggered to change to the No. 2 position, and the processor 1 executes the emergency mode program framework. At this time, its software system structure is transformed from Figure 6 Go to the state of Figure 7. In emergency mode: ① Processor 1 sends a reset signal to processor 2 through its O-3 terminal, trying to restart processor 2; ② The O-1 terminal of processor 1 is set to low level, so that the analog switch K2 changes to No. 2 position, and the system hardware structure changes from Figure 3 to Figure 5; ③ Processor 1 communicates with external device 1 and external device 2 at the same time, and executes task 1 and task 2. Since the processor 1 has been receiving information such as the operation result and intermediate variables of the processor 2 before the failure, it can seamlessly take over the task 2. During the period when processor 2 is trying to restart, only processor 1 is working in the system, and the processing capacity is only half of the original system. Machine 1 executes 1/2 of task 1 and 1/2 of task 2 in unit time.

If the processor 2 restarts successfully, its O-2 terminal continues to send pulse signals at the original frequency; processor 1 detects this pulse signal, triggers the soft switch SK to change to position 1, and makes processor 1 execute the normal mode program frame, At the same time, its O-1 terminal is set to be high level, so that the analog switch K2 is changed to the No. 1 position; processor 1 sends the processing results of task 2, intermediate variables and other information to processor 2 through the serial port TX terminal, so that the processing Controller 2 seamlessly takes over Task 2 again. The system returns to normal state. If processor 2 has a fatal failure and cannot be restarted, processor 1 can continue to execute 1/2 of task 1 and 1/2 of task 2 until the task ends.

For the case of multiple processors (more than three), the system is shown in Figure 8. The system contains n (n≥3) processors, among which m (m≤n) processors need to communicate with m external hardware devices. (Explanation: x is used below to represent the processor number, 1≤x≤n, when x=n, processor x+1 represents processor 1; y represents the external hardware device number, K(y) represents the analog switch number, 1 ≤y≤m, when y=m, the external device y+1 means the external device 1) In this case, the system needs to be processed as follows: ①First, number each processor according to the system task allocation; ②Then follow the cascade Formula rules, set the hardware so that each processor is redundant with each other to form a redundant chain: the O-2 terminal of processor x is connected to the IRQ terminal of processor x+1, and the TX terminal of processor x is connected to the processor The RX terminal of x+1, the O-3 terminal of processor x is connected to the Reset terminal of processor x+1, ③ the analog switch K(y) is set at the communication interface between external hardware device y and processor x, K(y ) is connected to terminal I-1 of processor x, terminal 2 of K(y) is connected to terminal I-2 of processor x+1, and the switch control terminal of K(y) is connected to processor x The O-1 terminal of +1; ④The software system of processor x is designed as a variable structure software system, as shown in Figure 6, that is, the software system of each processor contains two kinds of program frameworks: normal mode program framework and emergency mode program framework , the switching of the two program frames is controlled by the soft switch SK.

Under normal circumstances, each processor in the system executes its own different tasks, that is, processor x executes task x. The O-1 terminals of the processor x are all set to high level, so that the analog switches K(y) are all in the default position of No. 1. The O-2 terminal of processor x sends a pulse signal at a specific frequency (such as 1000Hz), and the IRQ terminal of processor x+1 detects the pulse signal of processor x in real time to obtain the working status (normal or faulty) of the other party. Processor x sends the result of the task and intermediate variables to processor x+1 through the serial port TX and RX. When the system is working normally, the soft switch SK of each processor software system is set at No. 1 position (as shown in Figure 6), and the processor executes the normal mode program framework. The system does not exhibit any redundant features.

When processor x fails, its pulse signal stops sending. At this time, processor x+1 cannot receive this pulse signal. After a certain period of time (such as 5ms), its soft switch SK is triggered to change to position 2, and processor x+1 executes the emergency mode program framework. At this time, its software system The structure is transformed from Fig. 6 to Fig. 7 state. In emergency mode: ① processor x+1 sends a reset signal to processor x through its O-3 terminal, trying to restart processor x; ② the O-1 terminal of processor x+1 is set to low level, Thus, the analog switch K(y) is changed to position No. 2; ③ processor x+1 communicates with external device y and external device y+1 at the same time, and executes task x and task x+1. Since processor x+1 has been receiving information such as the running result and intermediate variables of processor x before the failure, it can seamlessly take over task x. During the period when processor x tries to restart, processor x+1 executes task x and task x+1 at the same time, and its processing capacity remains unchanged, so the task amount per unit time of the system at this time is also reduced to the original 1/2, that is, processor x+1 executes 1/2 of task x and 1/2 of task x+1 in unit time.

If processor x restarts successfully, its O-2 terminal continues to send pulse signals at the original frequency; processor x+1 detects this pulse signal, triggers the soft switch SK to change to position 1, and makes processor x+1 perform normally Mode program framework, and set its O-1 terminal to be high level at the same time, so that the analog switch K(y) is changed to the No. 1 position; processor x+1 passes the processing result of task x, intermediate variables and other information through the serial port TX end to processor x, so that processor x seamlessly takes over task x again. The system returns to normal state. If processor x has a fatal failure and cannot be restarted, processor x+1 can continue to execute 1/2 of task x and 1/2 of task x+1 until the end of the task.

The content that is not described in detail in the description of the present invention belongs to those skilled in the art

current technology.

Claims (3)

1, a kind of redundant method for GNC system of miniature aircraft, it is characterized in that: comprise the following steps: (1) Utilize the multiprocessor resources in the existing system according to the system task assignment, and number the multiprocessors; (2) According to the cascading rules, the hardware ports of the multiprocessors, i.e. the input and output ports, are connected so that each processor is redundant with each other to form a redundant chain; (3) If the processor in the system has a communication connection with the external hardware device, the external hardware device is connected to the processor through an analog switch, so that it can communicate with multiple processors respectively; (4) According to the hardware configuration of the system, the system software is designed: the software system of each processor in the system is designed as a variable structure software system, that is, the software system of each processor contains two kinds of program frameworks - normal mode program framework and emergency mode Mode program framework, the switching between the two program frameworks is controlled by a soft switch; the normal mode program framework enables the processor to perform its own tasks and monitor the status of other related processors. At this time, the system does not show redundant features; the emergency mode program The framework is used to judge the number of the faulty processor, try to repair the fault, and reduce the amount of tasks per unit time, so that the normal processor can perform the tasks that the faulty processor should perform while performing its own tasks. At this time, the system shows redundancy. remaining features. 2. The redundancy method for the GNC system of micro-aircraft according to claim 1, characterized in that: there are two or more multi-processing systems. 3. According to claim 1 or 2, the redundancy method for the GNC system of the miniature aircraft is characterized in that: the connection to the input and output ports is to connect the pulse sending end, the pulse receiving end, the serial port of each processor The data sending end, the serial data receiving end, the reset signal sending end, and the reset signal receiving end make each processor redundant with each other to form a redundant chain.

Images