JPH04211898A - System for controlling sensor reconstruction - Google Patents

Abstract

PURPOSE:To provide a sensor reconstruction control system reducing the weight, volume, power consumption and reducing the load of computer processing by simplifying the configuration of a fault detection circuit. CONSTITUTION:The system is provided with double sensors A1 to AN respectively detecting various kinds of states for control object are provided, and a reconstruction control rule 16 controlling the above-mentioned control object is operated by the average value of the detection output of the above-mentioned double sensors A1 to AN. It is also provided with fault detection parts 121 to 12N detecting the fault of the sensors by mutually comparing sensor data outputted from the above-mentioned double sensors A1 to AN, and the construction of the reconstruction control part 16 is switched to the construction where the data of the above-mentioned fault sensor is not used when the fault of the sensors A1 to An are detected by these fault detection parts 121 to 12N.

Description

[Detailed description of the invention]

0001

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a sensor reconfiguration control method applied to a redundant system having multiple sensors.

0002

2. Description of the Related Art Conventionally, for example, in a flight control system for an aircraft control system, failure detection and signal selection are performed by mutual comparison of triple sensor data and majority decision processing, as shown in FIG. is used to control the system.

That is, various sensors A1, A2,...AN
are sensors that detect, for example, pitch rate, vertical acceleration, angle of attack, etc., each having a triple sensor configuration of #1 to #3, and outputs the detection output to the computer processing section 1. The computer processing unit 1 includes failure detection/signal selection units 21, 22,..., 2N corresponding to each sensor and a control law 3, and the output of each sensor A1, A2,..., AN is detected by the failure detection/signal selection unit 21, 22,..., 2N corresponding to each sensor. 22,...,2N. Failure detection/signal selection section 21 , 22 ,...
, 2N are the respective sensors A1 , A2 , ..., A
Fault detection and signal selection are performed by mutual comparison of triple sensor data from N and majority decision processing, and the selected signal is output to control law 3. Control law 3 is based on each sensor 21
, 22 , . . . , 2N , the manipulated variable is output according to a predetermined rule.

[0004] The above failure detection/signal selection sections 21 and 22
,..., 2N is composed of a failure detection section 4 and a signal selection section 5, as shown in FIG. The failure detection unit 4 is
Failure detection is performed by mutual comparison of triple sensor data, and the detection results are output to another computer. The signal selection unit 5 selects 3 based on data from other computers.
The heavy sensor data is selected by majority voting, and the selected value is output to the control law 3. If a signal cannot be selected, a Fail Safe signal is output to control law 3.

[0005]

[Problem to be solved by the invention] In the above control method,
Each detection part requires three identical sensors,
and failure detection/signal selection units 21 , 22 ,..., 2N
has a fairly complicated configuration as shown in FIG. In particular, when the number of types of sensors A1, A2, ..., AN increases, the weight, volume, and power consumption increase, which poses a problem when installed in an actual system. Further, there is a problem in that the load on the computer processing unit 1 that executes the processing of the failure detection/signal selection units 21 , 22 , . . . , 2N increases.

The present invention has been made in view of the above circumstances, and provides a sensor reconfiguration control method that can reduce weight, volume, and power consumption, simplify the configuration of a failure detection circuit, and reduce computer processing load. The purpose is to

[0007]

[Means and effects for solving the problems] The present invention has a dual sensor configuration for detecting various states of a controlled object, and operates a control law based on the average value of the detection outputs of these dual sensors. , compare the sensor data output from the dual sensors to determine whether the sensor is faulty, and when a sensor fault is detected, configure the control law based on the data of the faulty sensor. This configuration allows switching to a configuration that is not used.

[0008] Once the data is retrieved from the dual sensor,
The difference between the data is taken, and sensor failure is detected based on whether the difference exceeds a set range. If the sensor is not faulty, the control law is operated based on the average value of the dual sensors. If a sensor failure is detected, the configuration of the control law is switched to a configuration that does not use the data of the failed sensor, and the control operation is continued. As a result, stable control operations can be performed with the dual sensor configuration, and weight, volume, power consumption, etc. can be reduced.

[0009]Furthermore, the present invention determines not only normality and failure but also abnormality based on the sensor failure flag, holds the operation amount for the controlled object at the time when it is determined to be abnormal, and then determines that it is failure. The system replaces the faulty sensor data with a control law that does not use it until the fault occurs, and during that time the internal state of the control law is set to a steady state, and at the time it is determined that a fault has occurred, it switches to a new control law that is in a steady state. It is composed of With the above configuration, it is possible to suppress transients during control law switching after a sensor failure occurs, and a highly reliable system can be constructed.

0010

DESCRIPTION OF THE PREFERRED EMBODIMENTS An embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing the basic concept of a sensor reconfiguration control method according to the present invention. As shown in the figure, each of the various sensors A1, A2, . The computer processing unit 11 includes failure detection units 121 , 122 , . . . , 1 corresponding to each sensor.
2N, normal control law 13, A1 sensor failure control law 141 to AN sensor failure control law 14N, and control law switching circuit 15, each sensor A1, A2,
..., AN's output is the failure detection section 121, 122,...
, 12N.

[0012] Failure detection units 121, 122,..., 12
N is for each sensor A1 and A2, respectively, as shown in FIG.
, ..., AN double sensor data of #1 and #2 is input to a subtracter 21, the difference is taken, and the difference is input to a failure determination circuit 23 via a filter 22 for preventing false detection. , a failure is determined based on whether or not the difference data is within the set level range "-Δ~Δ", and the sensor failure flag F is determined.
1 to FN are output to the control law switching circuit 15. The sensor failure flags F1 to FN are "0" when the sensor is normal, and "1" when the sensor is malfunctioning. Furthermore, if the sensors are normal, the failure detection units 121 , 122 , ..., 12N calculate the average value of each sensor #1, #2, and calculate the average value of each sensor #1, #2, and calculate the normal control law 13 and the A1 sensor failure control law 141 -
AN Output to control law 14N in case of sensor failure. In this case, the average value of the sensor subject to failure is not input to A1 sensor failure control law 141 to AN sensor failure control law 14N. For example, the A1 sensor failure control rule 141 does not receive the output of the failure detection unit 121 of the A1 sensor, but receives the sensor average values from the failure detection units 122 to 12N for the A2 to AN sensors.

[0013]The above normal control law 13 and A1
The manipulated variable output from the sensor failure control law 141 to AN sensor failure control law 14N is controlled by the control law switching circuit 1.
5 is input. This control law switching circuit 15 switches the normal control laws 13 and A1 based on the sensor failure flags F1 to FN sent from the failure detection units 121 to 12N.
Select and output the manipulated variables from sensor failure control law 141 to AN sensor failure control law 14N. That is, as shown in FIG. 3, the control law switching circuit 15 selects the normal control law 13 if the sensor failure flags F1 to FN are all "0" (normal), but when they become "1" (failure). If there is a flag that corresponds to the flag, the corresponding A1 sensor failure control law 141 to AN sensor failure control law 14N is selected. FIG. 3 shows the relationship between the sensor failure flags F1 to FN and the selected control laws 13, 141 to 14N.

As mentioned above, the control law is normal control law 13.
In addition, control laws 141 to 14N for each sensor failure are required, resulting in a total of N+1 control laws, but in reality, it is composed of one control law as shown in FIG.
This can be realized by switching and reconfiguring the feedback gain according to the sensor failure flags F1 to FN, and does not require large-scale software processing.

That is, as shown in FIG. 4, the target value r is input to the + terminal of the subtracter 31, and the feedback
It is input to gains KR0 and KR1. The output signal of the subtracter 31 is input to an integrator 32 and integrated, then amplified by a feedback gain K1, and input to an integrator 34 via an adder 33. Then, the output of this integrator 34 is passed through an adder 35 to the manipulated variable u of the control law.
The signal is taken out as a signal and sent to the controlled object 40, and is also input to the adder 36 via the feedback gain KU1.

The sensor data yA1, yA2, ..., yAN for the control object 40 are feedback gains K01, K02, ..., K0N and K11, K.
12,..., K1N. The outputs of the feedback gains K01, K02, ..., K0N are sent to the adder 37.
After being added in the adder 38, it is added with the output of the feedback gain KR0, and is input to the adder 35. Also, the feedback gain K11,K
12,...,K1N are added in an adder 39, and then added in an adder 36 with a feedback gain KU1.
, KR0 and is input to the adder 33. Further, the sensor data y, which is the control amount of the controlled object 40, is input to the - terminal of the subtracter 31. If the sensor that obtains the sensor data y that is the control amount for the controlled object 40 fails, it is necessary to switch to another normal sensor.

In the above configuration, as shown in FIG. 5, the feedback gains K1, K01 to K1N, KR
0, KR1, KU1 as sensor failure flag F1 ~FN
By switching accordingly, the normal control law 13 and the A1 sensor failure control law 141 to 14N can be reconfigured. In this case, the feedback gain of the faulty sensor data is set to "0", and the other feedback gains are set to the gain value of the designed control law "*" without using the faulty sensor data. good.

To summarize the above, the control method of the present invention is as follows:
As shown in FIG. 6, the computer processing section 11 is composed of the failure detection sections 121 to 12N, the reconfiguration control law 16, and the control law gain switching logic 17. Failure detection section 12
1 to 12N have the configuration shown in FIG. 2, and A1 to A
Check the presence or absence of sensor failure and create sensor failure flags F1 to FN, and if the sensors are normal, average values yA1 to y for each sensor A1 to AN
AN is determined, and the sensor average values yA1 to yAN are output to the reconstruction control law 16, and sensor failure flags F1 to FN are output.
is output to the control law gain switching logic 17. The reconfiguration control law 16 is configured as shown in FIG. 4 above. Further, the control law gain switching logic 17 switches the control law gain shown in FIG. 5 for the reconfigured control law 16 according to the sensor failure flags F1 to FN. Next, a case in which the present invention is applied to flight control of an aircraft control system will be described with reference to FIG.

As shown in FIG. 7, the aircraft control system serving as the controlled object 40 normally receives feedback of sensor data such as angle of attack α, pitch rate q, and vertical acceleration nz.
In addition, a stabilizer steering angle command isc is output as the manipulated variable from the reconfiguration control law 16. The sensors for the above-mentioned angle of attack α, pitch rate q, and vertical acceleration nz are each configured in duplicate, and each sensor output α1, α2,
q1, q2, nz1, nz2 are the failure detection unit 121
, 122 , 123 , this failure detection unit 1
21, 122, and 123 check the sensor outputs to determine whether the sensor is malfunctioning, and output the sensor failure flags Fα, Fq, FN to the control law gain switching logic 17, and also output the sensor outputs α1 to the control law gain switching logic 17. ,α
2, q1, q2, average values α, q of nZ1, nZ2
, nz are determined and output to the reconstruction control law 16. This reconfiguration control law 16 includes a data switching logic 41 as shown in FIG.
, 123, the sensor data of angle of attack α, vertical acceleration nz, and pitch rate q are set as sensor failure flag Fα,
It switches according to Fq and FN and outputs as ys1, ys2, and y.

[0020] When the sensor is normal, the failure detection unit 121,1
The average value of the dual sensor data is output from 22 and 123, and in the reconstruction control law 16, the stabilizer steering angle command isc is determined using the normal gain shown in FIG. In this example, the pitch rate q is used as the control amount.

Furthermore, when a sensor fails, the control law gain switching logic 17 changes the control law gain switching logic 17 according to the failed sensor.
The stabilizer steering angle command isc is determined by switching to the feedback amount and gain as shown in FIG. In particular, if the pitch rate q, which is a controlled variable, fails, control is performed by switching the controlled variable to the vertical acceleration nz.

[0022] A comparison of the step response during normal operation and during failure is shown in FIGS. 10 and 11. Figure 10(a) shows the step response characteristic during normal operation, Figure 10(b) shows the step response characteristic when the q sensor fails, Figure 11(a) shows the step response characteristic when the nz sensor fails, and Figure 11(b) shows the step response characteristic when the z sensor fails. This shows the step response characteristics when a sensor fails. Even when a sensor fails, the same step response as when it is normal can be obtained. (Second example)

In the first embodiment, each gain of the control law shown in FIG. 4 is switched by the control law gain switching logic shown in FIG. The circuit configuration can be simplified. but,
In the first embodiment, the change in the manipulated variable u when switching the control law when a sensor failure is detected is relatively large, and there is a possibility that a transient may occur in the output of the controlled object. The control law includes an integrator, and since it takes time for the output of this integrator to settle down to a steady state, the smaller the transient, the better. This second embodiment is configured to reduce the occurrence of the above-mentioned transients and obtain higher reliability, and the details thereof will be explained below.

In this second embodiment, the failure detection section 12 (121, 122,..., 12N) and the reconfiguration control section 16 in FIG. 6 are replaced by a failure detection section 12A as shown in FIG.
, is configured as a reconfiguration control unit 16A.

The failure detection unit 12A detects #1 from each sensor A1, A2,..., AN as shown in detail in FIG.
, #2 are input to the subtracter 21, the difference is taken, and the difference is input to the failure determination circuit 23A via the filter 22 to prevent false detection, and the difference data is set at the set level " -Δ1, -Δ2, +Δ2, +Δ1", a failure determination is made and a sensor failure flag F is output. In other words, failure determination level Δ
In addition to 1, abnormality judgment level Δ2 (However, Δ2 < Δ1
), and is configured to be able to determine ``abnormal'' in addition to ``normal'' and ``failure.'' In this case, the sensor failure flag F is, for example, "0" when the sensor is normal, and "0" when the sensor is malfunctioning.
The flag content is displayed as ``1'', and ``2'' in the case of an abnormality.

The sensor failure flag F output from the failure detection section 12A is sent to the control law switching circuit 15, and is also sent as a switching control signal to the switches SW1 to SW4 for the reconfiguration control section 16A, as shown in FIG. It will be done. The reconfiguration control unit 16A includes switches SW1 and SW2 between the adder 35 and the controlled object 40, a switch SW3 on the output side of the integrator 34, and a feedback control unit 16A shown in FIG. A switch SW4 is provided on the output side of the gain K1. Above switch SW1
~SW4 each includes switching contacts a, b and a common contact c, and the common contact c is switched to the a side contact or the b side contact depending on the contents of the sensor failure flag F.

The b-side contacts of the switches SW1 and SW2 are directly connected, and the a-side contacts are connected via a zero-order hold circuit 51. Switch SW1, SW2
A common contact c of the switch SW2 is connected to the output terminal of the adder 35, and a common contact of the switch SW2 is connected to the controlled object 40. Switch SW1 has a sensor failure flag F of “0-2”.
The a side contact closes when the temperature changes to , otherwise the b
Side contacts are closed. The switch SW2 closes the a side contact when the sensor failure flag F is "0" or "1".
In other cases, the b-side contact is closed.

Further, the switch SW3 has a common contact c connected to the integrator 34, an a side contact connected to the common contact of the switch SW1 and the a side contact of the switch SW4, and a b side contact connected to the adder 35. When F changes to "0-2", the a side contact is closed, and in other cases the b side contact is closed.

In the switch SW4, the common contact c is connected to the feedback gain K1, and the a side contact is connected to the switch SW.
3 to the a side contact and the common contact c of switch SW1,
The b side contact is connected to the adder 33, and the sensor failure flag F
When the value changes to "0-2", the a-side contact is closed, and in other cases, the b-side contact is closed.

In the above configuration, the sensor failure flag F
When the value changes from "0" (normal) to "2" (abnormal), the output of the reconfiguration control unit 16A is held by the switches SW1 and SW2. Then, the control law gain is switched to a control law gain that does not use the faulty sensor data according to FIG.

Furthermore, the output of the adder 35 is determined by the amount of operation held by the switches SW3 and SW4 at the moment the sensor failure flag F changes from "0" (normal) to "2" (abnormal). control law output) to bring the internal state of the control law to a steady state quickly. Then, when the sensor failure flag F becomes "1" (failure), switch SW2
The output of the control law switched by is output as the manipulated variable u.

FIG. 14 shows the time history of the manipulated variable u, the controlled variable y, and the sensor failure flag F. Sensor failure flag F indicates sensor error “2” at time t1.
is detected, the manipulated variable u is held, and then t2
The control law is replaced with a control law that does not use the faulty sensor data until it is determined that the fault is "1". Also, during this period, the internal state of the control law (integrator 34) is settled to a steady state. Then, when the sensor failure flag F determines that the failure is "1" at time t2, the control law is switched to a new control law that is in a steady state. Therefore, the transient that occurs in the control amount y is extremely small.

Furthermore, from the viewpoint of computer load, execution of a new control law starts only after the sensor is determined to be abnormal, so there is no need to execute multiple control laws at the same time.
Load can be reduced. Next, a case where the second embodiment is applied to flight control of an aircraft control system will be described with reference to FIG. 15.

As shown in FIG. 15, the aircraft control system serving as the controlled object 40 normally receives feedback of sensor data such as angle of attack α, pitch rate q, and vertical acceleration nz, and also receives feedback from the reconfiguration control law 16A. A stabilizer steering angle command isc is output as the manipulated variable. The above angle of attack α,
The sensors for pitch rate q and vertical acceleration nZ are each configured in duplicate, and each sensor output α1, α2
, q1, q2, nz1, nz2 are the failure detection unit 1
The failure detection units 121 , 122 , 123 check the sensor output to determine whether the sensor is malfunctioning, and set the sensor failure flags Fα, Fq, FN according to the control law. In addition to outputting to the gain switching logic 17, each sensor output α1,
Average value α of α2, q1, q2, nz1, nz2,
q, nz is determined and output to the reconstruction control law 16A.

The reconfiguration control law 16A includes a data switching logic 41 as shown in FIG. The data is switched according to the sensor failure flags Fα, Fq, FN and output as ys1, ys2, y. The reconfiguration control unit 16A also includes a flag check unit 52, which checks the sensor failure flags Fα, Fq, FN, and selects the sensor failure flag F (“0”: normal, “1”: failure, “2”).
”: Abnormal) is output to the switches SW1 to SW4 as a switching control signal. Then, a signal taken out from the common contact c of the switch SW2 is sent to the controlled object as a stabilizer steering angle command isc. The rest of the configuration is the same as that of the reconfiguration control unit 16A shown in FIG. 12, so a detailed explanation will be omitted.

In the above configuration, the flag check section 52 checks three types of sensor failure flags Fα, Fq, FN.
is monitored, and when all are “0” (normal), “F=0”, 1
If there is any "2" (abnormal), "F=2", then "2"
When the sensor failure flag becomes “1” (failure), “
F=1" is output. This sensor failure flag F switches four switches SW1 to SW4, and when the sensor failure flag F changes from 0 to 2, the stabilizer steering angle command isc is held, and the output of each integrator 34 is replaced with the held value. do. Then, the control law gain is determined as K1, K00 according to FIG. 9 according to the sensor failure flag F.
~Switch the values of K12, KR0, KR1, and KU1.

Thereafter, when the sensor failure flag F becomes "1", the switch SW2 is switched to release the hold on the stabilizer steering angle command isc, and output the output of the new control law. This makes it possible to smoothly switch the control law when a sensor fails without causing a large transient.

[0038]

[Effects of the Invention] As detailed above, according to the present invention, since the redundancy of the sensor can be doubled, the weight, volume, and power consumption can be significantly reduced, and the circuit configuration of the failure detection section can be simplified. I can do it. Furthermore, since it is not necessary to simultaneously execute a plurality of control laws, it is possible to reduce the computer processing load on the computer. These effects become more pronounced as the number of sensor types increases.

Furthermore, the present invention determines abnormality in addition to normality and failure based on the sensor failure flag, holds the manipulated variable at the time when it is determined to be abnormal, and then holds the operation amount until the next determination is made that failure occurs. In addition to replacing the control law with a control law that does not use sensor data, the internal state of the control law is set to a steady state during that time, and when a failure is determined, the new control law is switched to the steady state, so that the failure does not occur. After that, transients during control law switching can be suppressed, and a highly reliable system can be constructed.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing the basic concept of a sensor reconfiguration control method according to the present invention.

FIG. 2 is a configuration diagram of a failure detection section in FIG. 1.

FIG. 3 is a diagram showing the operation contents of the control law switching circuit in FIG. 1;

FIG. 4 is a block diagram showing a configuration example of a control law in the present invention.

FIG. 5 is a diagram showing control law gain switching logic for the control law of FIG. 4;

FIG. 6 is a block diagram showing a sensor reconfiguration control method according to the first embodiment of the present invention.

FIG. 7 is a block diagram showing a configuration when the present invention is applied to flight control of an aircraft control system.

FIG. 8 is a configuration diagram showing the reconfiguration control law in FIG. 7;

FIG. 9 is a diagram showing an example of data switching and gain switching in FIG. 7;

FIG. 10 is a diagram showing step response characteristics when the sensor is normal and step response characteristics when the sensor is faulty.

FIG. 11 is a diagram showing step response characteristics when a sensor fails.

FIG. 12 is a block diagram showing a configuration example of a reconfiguration control law portion in a second embodiment of the present invention.

FIG. 13 is a configuration diagram of a failure detection section in FIG. 12.

FIG. 14 is a diagram showing a time history at the time of control law switching in the second embodiment of the present invention.

FIG. 15 is a block diagram showing a configuration when a second embodiment of the present invention is applied to flight control of an aircraft control system.

FIG. 16 is a configuration diagram showing the reconfiguration control law in FIG. 15;

FIG. 17 is a block diagram showing a conventional sensor control method.

FIG. 18 is a detailed diagram of the failure detection section in FIG. 17.

[Explanation of symbols]

DESCRIPTION OF SYMBOLS 11... Computer processing part, 12, 12A... Failure detection part, 13... Control law at normal time, 141-14N... Control law at the time of sensor failure, 15... Control law switching circuit, 16, 16A... Reconfiguration control law, 17... Control law gain switching logic, 21
...Subtractor, 22...Filter, 23...Failure determination circuit, 31
...Subtractor, 32, 34... Integrator, 33, 35-39 output device, 40... Controlled object, 41... Data switching logic,
51... Zero-order hold circuit, 52... Flag check section.

Claims (2)

[Claims] [Claim 1] Dual sensors that respectively detect various states of a controlled object, a control law that operates based on the average value of the detection outputs of these dual sensors and controls the controlled object, and a control law that controls the controlled object, and A failure detection means for mutually comparing outputted sensor data to detect a sensor failure; and a configuration in which when a sensor failure is detected by this detection means, the control law is configured such that the data of the failure sensor is not used. 1. A sensor reconfiguration control method, comprising a switching means for switching to. [Claim 2] Dual sensors that respectively detect various states of a controlled object, a control law that operates based on the average value of the detection outputs of these dual sensors and controls the controlled object, and a control law that controls the controlled object, and A failure detection means that mutually compares the output sensor data to detect whether the sensor status is normal, abnormal, or faulty, and an output from the above control law when a sensor abnormality is detected by this detection means. holding means for holding the manipulated variable for the controlled object;
means for settling the internal state by replacing the control law with a control law that does not use the faulty sensor data when a sensor failure is detected by the detection means; A sensor reconfiguration control method comprising: switching means for outputting the output of the new control law as a manipulated variable.