1. Method for controlling an aircraft (1), in particular a vertical take-off and landing multi-rotor aircraft, in which method a flight influencing unit (2.1, ·, 2.N), in particular a drive unit, preferably an electrically driven drive unit, of the aircraft (1):

a) supplying, by a first computing unit (COM), via a first channel or a control channel, a control command (SB) from or derived from pilot inputs (PE), and in the method,

b) monitoring the control command (SB) by means of a second channel or monitoring channel and a second computing unit (MON) which checks whether the control command (SB) applies to the existing physical state of the aircraft (1) and to the pilot input (PE) in such a way that,

c) determining, by means of the second calculation unit (MON), whether the current navigational state of the aircraft (1) coincides with the pilot input (PE), which has preferably been converted into the desired navigational state by means of the second calculation unit (MON), within a predefined deviation, and in the method,

d) generating a control signal (SS) for controlling the aircraft (1) depending on the determination made in step c).

2. Method according to claim 1, wherein in step c) at least one of the following navigation state attributes of the navigation state is checked:

-attitude, for example according to euler angle inspection;

-a rotational speed;

-a change in rotational speed;

-a position;

-velocity relative to air and/or ground;

-height, in particular pneumatic, inspection;

-acceleration.

3. Method according to claim 1 or 2, wherein it is additionally preferred to check by means of the second calculation unit (MON) with an opposite control relationship whether the control command (SB) would achieve a first force/torque vector τ of the aircraft (1) when maneuvering the flight influencing unit (2.1,. ·, 2.N) of the aircraft (2)_CmdSaid first force/torque vector being adapted to the existing physical state of said aircraft (1) in such a way that,

i) the first and second force/torque vectors τ derived from the control command (SB) are combined_MONComparing, determining said second force/torque vector independently of said first force/torque vector, and/or by,

ii) for the first force/torque vector, it is preferably checked by the second calculation unit (MON) whether the axis and/or the amount of the torque contained in the first force/torque vector lies within a predefined tolerance range and/or in that way,

iii) for the first force/torque vector, it is preferably checked by the second computing unit (MON) whether the first force/torque vector corresponds to the pilot input (PE) within a predefined deviation,

and in which method, in step d), an adapted control signal (SS) for controlling the aircraft (1) is generated on the basis of the inspection results of the inspections carried out in steps i) to iii).

4. A method according to claim 3, wherein the first force/torque vector τ derived from the control command (SB)_CmdGiven by:

the equation has a matrix K, the elements m and f of which are given by the configuration of the aircraft (1) and the N flight influencing units (2.1, 1.., 2.N) of the aircraft, and a vector Ω having the control commands (SB) of the first computing unit (COM) for the N flight influencing units (2.1, 1.., 2. N).

5. Method according to any of claims 1 to 4, wherein in step c) and/or in referring to claim 3 in steps i) to iii) a plurality of check/comparison methods are performed, respectively, in order to obtain a plurality of check/comparison results accordingly, which are subsequently weighted, respectively, and then merged with each other in order to obtain a merged determination result for use in step d) and/or in referring to claim 3.

6. The method according to claim 5, wherein each of the plurality of checking/comparing methods is assigned at least one first weight coefficient and at least one second weight coefficient, and wherein, for each checking/comparing method, the first weight coefficient and the second weight coefficient are combined into one overall weight coefficient, with which the respective checking/comparing method is weighted.

7. The method of claim 6, wherein, for each check/compare method, the first and second weight coefficients are multiplied.

8. The method according to any of claims 5 to 7, wherein a plurality of weighted inspection/comparison results are summed in order to obtain a combined inspection result for use in step d).

9. The method according to any one of claims 5 to 8, wherein the first weight coefficient is a severity weight coefficient indicating the severity of an error of the aircraft (1) or its control identifiable by a given checking/comparison method.

10. The method according to any one of claims 5 to 9, wherein the second weight coefficient is a confidence weight coefficient which indicates with what accuracy an error of the aircraft (1) or its control identifiable by a given inspection/comparison method can be quantitatively given.

11. The method according to any of claims 5 to 10, wherein the checking/comparing method is selected from the group comprising:

-a frequency analysis;

-a kalman filter;

-CBIT and PBIT results;

-out-of-range assessment (e.g. flight envelope);

expected values obtained from a model (e.g. a pilot model).

12. A control device (4) for an aircraft (1), in particular a vertical take-off and landing multi-rotor aircraft, having a first computing unit (COM) and a first channel or control channel for supplying a control command (SB) of the first computing unit (COM), in particular a drive unit, preferably an electrically driven drive unit, of a flight influencing unit (2.1, 1.., 2.N), in particular of a drive unit, of the aircraft (1), via the control channel, the control command (SB) coming from or being derived from pilot inputs (PE), and

the control device has a second channel or monitoring channel and a second computing unit (MON) which is designed and set to monitor the first computing unit (COM) in such a way that the second computing unit (MON) checks whether the control commands (SB) apply to the existing physical state of the aircraft (1) and to the pilot inputs (PE),

in that the second calculation unit (MON) is designed to determine whether the current flight state of the aircraft (1) corresponds to the pilot input (PE) within a predefined deviation, the pilot input (PE) preferably being converted into a desired flight state of the aircraft (1) by the second calculation unit (MON), and the second calculation unit (MON) being further designed to generate and output a control signal (SS) for controlling the aircraft (1) as a function of the determination.

13. The control device (4) according to claim 12, wherein the second calculation unit (MON) is further configured for checking with an opposite control relationship whether the control instruction (SB) would achieve a first force/torque vector of the aircraft (1) when handling the flight influencing unit (2.1, 1., 2.N) of the aircraft (2), which first force/torque vector is applicable to an existing physical state of the aircraft (1) in such a way that the second calculation unit (MON) is configured for,

i) comparing the first force/torque vector derived from the control command (SB) with a second force/torque vector, determining the second force/torque vector independently of the first force/torque vector, and/or,

ii) for the first force/torque vector, preferably by the second calculation unit (MON), checking whether the axis and/or the amount of the torque contained in the first force/torque vector lies within a predefined tolerance range, and/or

iii) for the first force/torque vector, it is preferably checked by the second computing unit (MON) whether the first force/torque vector corresponds to the pilot input (PE) within a predefined deviation,

and generating an adapted control signal (SS) for controlling the aircraft (1) as a function of the inspection results of the inspections carried out in i) to iii).

14. The control device (4) according to claim 12 or 13, wherein the second calculation unit (MON) is further configured for using a plurality of checking/comparison methods in order to obtain a plurality of checking/comparison results respectively, subsequently weighting the checking/comparison results respectively and then combining them with each other in order to produce a combined determination result, and/or in referring to claim 13, to produce a combined checking result, and to output the combined determination result in order to produce the control signal (SS) or in referring to claim 13 in order to produce an adaptively adjusted control signal (SS).

15. The control device (4) according to any of claims 12-14, wherein the second calculation unit (MON) is further configured for performing the method according to any of the further claims 2, 4 and 6-11.

16. An aircraft (1), in particular a vertical take-off and landing multi-rotor aircraft, having a plurality of flight influencing units (2.1,.., 2.N), in particular drive units, preferably electrically driven drive units, and having a control device (4) according to one of claims 12 to 15, the control device (4) being operatively connected to the flight influencing units (2.1,.., 2.N) and being configured for sending control commands (SB) to the flight influencing units (2.1,.., 2. N).

Background

In general, the present disclosure relates to monitoring functions used during flight control or in the operation of an aircraft or spacecraft and therefore having a high degree of safety relevance.

Such a function may in particular be implemented in the form of a software program or algorithm and affect any type of (control) operation of the aircraft. These functions must be monitored periodically and repeatedly so that the aircraft can be operated safely.

This includes, but is not limited to, monitoring of stability, navigation, brakes, landing methods (particularly landing corridors), monitoring of all internal control circuitry (e.g., hydraulic, motor or electric motors).

The "traditional" monitoring form used by default in aviation usually duplicates the functions to be monitored, that is, each function exists or is implemented at least doubly. The two functions, that is to say the function to be monitored and its "copy", are usually, but not necessarily, already implemented at the time of manufacture by different teams, which use their own processes and hardware in order to avoid the presence of common errors/faults which could jeopardize the operational safety of the two functions in the same way. The components of an aircraft that provide the relevant functions are generally referred to as "commands" (Command, abbreviated to COM) and the relevant monitoring components as "monitors" (MON).

COM is the only component that communicates with other components of the aircraft or with the drive output, that is to say that allows control commands to be sent. By "drive output" is meant a control output by means of which control commands are transmitted to a flight influencing unit of the aircraft, in particular to a drive unit, preferably an electrically driven drive unit, and/or to a control surface in order to influence the movement of the aircraft. MON only allows the ability to receive Input or Input signals (Input) and COM to generate and switch control outputs (i.e., corresponding control signals). In this way, a failure in both components (COM or MON) can result in a failure of both components and a loss of functionality provided by the COM.

This conventional monitoring approach creates several problems, and these are obvious when looking at the life cycle of an aircraft or plane.

Concept design and planning

First, errors that occur during the concept design and planning phase cannot be intercepted because monitoring is only part of the later stages of development. Usually, the system "aircraft" is not monitored at a higher level, but rather the monitoring involves only functions and subfunctions. In principle, the monitor can only identify errors that have been taken into account during its design.

Standard design (Spezifikation)

Second, there is a requirement that COM and MON functions must be provided by different personnel. This may lead to common errors if COM and MON functions are developed by the same person, since it is likely that the same person will make the same error in COM and in MON for similar parts of the function.

Design scheme

Third, if the design effort is performed by the same person, some of the same specifications will implement a design solution with possible, common errors.

Integration and installation (including common mode)

Furthermore, in principle, integration or installation errors cannot be recognized by conventional monitoring. This relates in particular to so-called Common Mode faults (CMF; "homogeneous errors") known to the person skilled in the art. In risk analysis, this is a failure of several components or operating means of the same type, whose failure can lead to damage events. This may involve errors that are not triggered by common causes. The term CMF therefore differs from Common Cause Failure (Failure due to Common causes).

Operation and maintenance

During operation, conventional monitoring approaches deal with errors or failures by shutting down functions. That is, this approach relies heavily on the redundant arrangement of functions, which is provided by other components. This way it is not possible to prevent failure, in particular due to ageing or wear. Such conventional monitoring does not provide assistance for maintenance work, since such maintenance work is based on purely occasional failures.

Disposal and extended service life

Finally, with conventional monitoring, no relevant data can be obtained that would help extend the useful life of the relevant function.

Disclosure of Invention

The object of the present disclosure is to provide a solution for this and to provide a method for controlling an aircraft, in particular a vertical take-off and landing multi-rotor aircraft, a control device for such an aircraft and such an aircraft itself, which method or which control device and aircraft comprise a novel form of monitoring, so that this monitoring function cannot be exhausted by switching off one of the two systems (COM or MON) in the event of a failure of the two systems and causing the function provided by the COM to be lost.

The present disclosure is achieved by a method having the features of scheme 1, a control device having scheme 12, and by an aircraft having scheme 16. Preferred developments are defined in the dependent claims.

According to a first aspect of the present disclosure, a method for controlling an aircraft, in particular a vertical take-off and landing multi-rotor aircraft, is achieved in which a flight influencing unit, in particular a drive unit, preferably an electrically driven drive unit and/or a control surface (so-called control surface) of the aircraft:

a) the control commands are supplied by a first computing unit (COM) via a first channel (control channel), the control commands being derived from or derived from pilot input, and in the method,

b) the control commands are monitored via a second channel (monitoring channel) and a second computing unit (MON) which checks whether the control commands are applicable to the existing physical state of the aircraft and to pilot inputs in such a way that,

c) determining, by means of a second calculation unit (MON), whether the current flight state of the aircraft, which corresponds to the physical state of the aircraft or represents this state, coincides with pilot inputs that are preferably converted into the desired flight state by means of the second calculation unit (i.e. the physical state that the aircraft desires in dependence on the pilot inputs), within predefined deviations, and in the method,

d) generating a control signal for controlling the aircraft on the basis of the determination determined in step c).

The control signal may be an error signal indicating that there is an impermissible deviation of the desired navigational state from the current navigational state.

Said physical state (actual state) of the aircraft is preferably determined by means of sensors suitable therefor, which may include, without limitation, IMU (inertial measurement unit), radar, lidar, optical sensors, cameras and the like.

The pilot input may come from a human pilot or the pilot input may be generated by automated equipment (autopilot).

The pilot input is converted, that is to say converted by a computer, so that it can be compared with the determined actual state.

In general, the control signal generated in step d) effects a continuous normal operation of the aircraft if the determination in step c) indicates that said error remains within predefined limits; otherwise, the control signal generated in step d) causes the normal operation of the aircraft to be interrupted or changed and/or the display/output of an alarm indication to be effected.

According to a second aspect of the disclosure, a control device for an aircraft, in particular a vertical take-off and landing multi-rotor aircraft, is realized, having a first computing unit (COM) and a first channel (control channel) for supplying control commands of the first computing unit (COM) to a flight influencing unit, in particular a drive unit, preferably an electrically driven drive unit and/or control surfaces (so-called control surfaces), of the aircraft via the control channel, which control commands are derived from or are derived from pilot inputs, and having a second channel (monitoring channel) and a second computing unit (MON) which are configured and set up to monitor the first computing unit (COM) in such a way that the second computing unit (MON) checks whether the control commands are applicable to the existing physical states of the aircraft and to the pilot inputs, in that the second calculation unit (MON) is configured to determine whether the current flight state of the aircraft corresponds to a pilot input within a predefined deviation, which pilot input is preferably converted into a desired flight state of the aircraft by the second calculation unit (MON), and to generate and output a control signal for controlling the aircraft as a function of the determination obtained.

Such a control device according to the present disclosure is capable of implementing a method according to the present disclosure.

The current flight state (actual state) of the aircraft can be expressed mathematically or in control technology as a flight state vector.

According to a third aspect of the present disclosure, an aircraft, in particular a vertical take-off and landing multi-rotor aircraft, is realized, which is equipped with a plurality of flight influencing units, in particular drive units, preferably electrically driven drive units and/or control surfaces (so-called control surfaces), and with a control device according to the present disclosure, which is operatively connected with the flight influencing units and is configured for sending control commands to the flight influencing units.

Such an aircraft may be operated or controlled in accordance with the methods of the present disclosure.

The drive unit is advantageously a distributed-arrangement, electrically operated motor/rotor arrangement. Preferably, the aircraft has a plurality of, for example 18, drive units, which can be arranged in a plane.

The term "flight influencing unit" may also comprise other units which may influence the flight behavior of the aircraft, such as (active) payloads, winches or the like, but in particular also control surfaces (so-called control surfaces), such as leading-edge flaps, stabilizing flaps, ailerons or stabilizers (if adjustable).

Within the scope of the present disclosure, different differences or advantages are achieved with respect to the prior art:

concept design and planning

First, the proposed conceptual design of the monitoring can be made independent of the development phase of the aircraft. This also makes it possible to retrofit existing aircraft.

Specification design

Secondly, the proposed monitor type is essentially different from monitors according to the prior art. Such monitors are not implemented by copying of functions, and essentially all effort here is to avoid failure of the copy to have occurred. Accordingly, it is an object of the present disclosure to take advantage of different characteristics of monitors. Furthermore, by adding a context (konext) that forces the monitoring problem to be viewed from another perspective, the specification design of the monitor (second computing unit) does not have the same error as the instruction unit (first computing unit) in terms of its nature, even if the monitor is developed by the same person. "adding context" means in particular using information other than the state vector. On the one hand, these may be the (physical) limits of the state vector, but also other states or relationships between states (e.g. state B < ═ 5 if state a ═ 10).

Design scheme

Third, the proposed display requires a different design solution due to the completely different specification design, even if the same person is developing it. When monitoring a particular function, the design of the monitor requires a deeper understanding of the function by carefully analyzing the failure modes, and COM can even be improved if an iterative approach is used. This may mean that the context must be known, i.e. information other than the state vector is used. These may in turn be the (physical) limits of the state vector, but also other states or relationships between states (see above).

Integration and installation (including common mode)

Furthermore, some integration and installation errors, in particular systematic errors, can be detected by the proposed monitoring solution. Systematic errors are almost unavoidable and often require multiple staff to perform the same action or additional verification steps. The introduction of context information (see above) that cannot be provided to COM and MON using conventional means can be used to reveal the systematic failure. For example, when installed incorrectly, the relationship between states behaves differently than expected. For example, if a mounting error of 180 ° occurs, an adjustment signal is generated in the positive direction, but a negative movement is performed.

Operation and maintenance

Furthermore, maintenance measures can potentially be derived from the proposed monitoring scheme. The proposed solution, however, aims not only to identify accidental faults, but also to characterise the deterioration or wear/tear of a function, which may eventually lead to errors or faults if no appropriate measures are taken. This applies in particular to sensor-related functions, that is to say functions based on sensor signals, for example the monitoring of the motor by means of a temperature sensor. Sensor aging typically occurs and filters are commonly used in the prior art to improve the signal, but such filters may mask the aging problem of the sensor. In the present case, sensor aging or aging of the sensor-fixed structure can be detected from the sensor output (signal or measured value), since, for example, noise, deviations or measured amplitudes, which indicate the presence of errors of a certain size, can differ significantly between different flights.

Waste disposal and extended service life

In a similar manner to the already described process, which can be used for maintenance measures and which involves the aging process of the functions, an increase in service life can be facilitated by targeted, timely replacement of the functions when aging of the functions is detected.

In a further development of the method according to the disclosure, it is provided that in step c) the navigation state is checked by comparing the actual state with the pilot input for at least one of the following navigation state properties of the navigation state, for which purpose corresponding sensor signals can be used:

-the flight attitude of the aircraft, for example according to an euler angle check;

-a rotational speed;

-a change in rotational speed;

-a position;

height (in particular pneumatic inspection);

-velocity relative to air and/or ground;

-acceleration.

The foregoing list is not exhaustive. Each measured/measurable or (measurement-derived) characteristic or property of the navigational state can in principle be used for the check in step c). In this way, in particular, a given function can be monitored in different ways.

In a further development of the method according to the disclosure, it is provided that the second computing unit additionally preferably uses the inverse control relationship to check whether the control commands, when actuating the flight influencing unit of the aircraft, will achieve the first force/torque vector τ of the aircraft_CmdSaid first force/torque vector being adapted to the existing physical state of the aircraft in such a way that,

i) the first and second force/torque vectors τ derived from the control command_MONComparing, determining the second force/torque vector independently of the first force/torque vector, and/or, in such a way,

ii) for the first force/torque vector, it is preferably checked by the second computing unit whether the axis and/or the amount of the torque contained in the first force/torque vector lies within a predefined tolerance range and/or, in that way,

iii) for the first force/torque vector, it is preferably checked by the second computing unit whether the first force/torque vector corresponds to the pilot input within predefined deviations,

and in the method, in step d), an adapted control signal for controlling the aircraft is generated as a function of the examination results of the examinations carried out in steps i) to iii).

Steps i) to iii) can be carried out separately or in any combination in addition to the checking according to variant 1, and thus a malfunction function not found by the checking can be identified here. Conversely, steps i) to iii) make it possible to classify the identified apparent fault function as admissible after the fact.

In a corresponding preferred development of the control device according to the disclosure, it is provided that the second computing unit is configured to check, using the opposite control relationship, whether the control command, when activating the flight influencing unit of the aircraft, will achieve a first force/torque vector of the aircraft, which first force/torque vector is adapted to the existing physical state of the aircraft, in such a way that the second computing unit is configured to,

i) comparing a first force/torque vector derived from a control command with a second force/torque vector, determining the second force/torque vector independently of the first force/torque vector, and/or,

ii) for the first force/torque vector, it is preferably checked by the second computing unit whether the axis and/or the amount of the torque contained in the first force/torque vector lies within a predefined tolerance range and/or

iii) for the first force/torque vector, it is preferably checked by the second computing unit whether the first force/torque vector corresponds to the pilot input within predefined deviations,

and generating an adapted control signal for controlling the aircraft on the basis of the inspection results from the inspections carried out in i) to iii).

In particular, in a further development of the method according to the disclosure, a first force/torque vector τ derived from the control command is provided_CmdIs given by:

the equation has a matrix K of elementsAndgiven by the configuration of the aircraft and the N flight influencing units of the aircraft, and the equation also has a vector Ω with the control commands for the N flight influencing units of the first calculation unit.

Furthermore, in a further development of the disclosure, it can be provided that in step c) and/or in steps i) to iii) a plurality of test/comparison methods are each carried out in order to obtain a plurality of test/comparison results, the test/comparison results are then each weighted and then combined with one another in order to obtain a combined determination result for use in step d) and/or to obtain a combined test result.

In this way, the reliability of the monitoring can be improved, since the advantages specific to the different checking/comparing methods can complement each other and can counteract certain problems.

In a corresponding development of the control device according to the disclosure, it is provided that the second computing unit is further configured to use a plurality of checking/comparison methods in order to obtain a plurality of checking/comparison results in each case, to subsequently weight the checking/comparison results in each case and then to combine them with one another in order to produce a combined determination result and/or to produce a combined checking result, and to output the combined determination result in order to produce the control signal or in order to produce an adaptively adjusted control signal.

Furthermore, in a further development of the method according to the disclosure, it can be provided that each of the plurality of checking/comparing methods is assigned at least one first weighting factor and at least one second weighting factor, and wherein for each checking/comparing method the first weighting factor and the second weighting factor are combined to form a total weighting factor, with which the respective checking/comparing method is weighted.

This also makes it possible to further refine and improve the monitoring result.

On this premise, according to a further development of the method according to the disclosure, it is provided that for each checking/comparison method the first weighting factor and the second weighting factor are multiplied.

On this premise, according to a further development of the method according to the disclosure, it is provided that a plurality of weighted examination/comparison results are summed in order to obtain a combined examination result for use in step d).

On this premise, according to a further development of the method of the disclosure, it is provided that the first weighting factor is a severity weighting factor which indicates the severity of an error of the aircraft or of its control which can be recognized by a given checking/comparison method.

On this premise, according to a further development of the method according to the disclosure, it is provided that the second weighting factor is a confidence weighting factor which indicates with which accuracy an error of the aircraft or of its control which can be identified by a given checking/comparison method can be quantitatively given.

According to a preferred refinement of the method according to the disclosure, it is provided that the checking/comparing method is selected from the group comprising the following methods: analyzing the frequency; kalman filtering; CBIT and PBIT results; [ Continuous Built-In Test (Continuous Built-In Test)/Periodic Built-In Test (Periodic Built-In Test) ] Out-of-range-Bewerungen (e.g., flight envelope); expected values obtained from a model (e.g., a pilot model). This list is not exhaustive.

Errors, in particular due to aging, can be represented, for example, as frequency shifts and can be identified accordingly by frequency analysis.

The process may be evaluated assuming known process characteristics to obtain the expected values. If the expected value is significantly different from the measured value, there may be an error, which may be identified by the Kalman filter.

CBIT involves checking certain functions or parameters continuously. The same applies to PBIT, but is preferably limited to Power-up times.

The out-of-range assessment may be derived from specified and empirical values: if the aircraft allows/should have a pitch angle of maximum 10 deg., but at a pitch angle of 13 deg., there may be an error.

The same applies to the expected values obtained from the model: when a specific motor speed, for example specified by the flight control unit, is also achieved, a specific position change of the aircraft should take place depending on the model. If the aircraft responds in a different manner, an error may exist.

A further development of the control device provides that the second computing unit is also designed to carry out one of the developments of the method according to the disclosure.

As already described above, the so-called Lane-Computer Flight Control MONITOR (MON, also referred to below as "MON-Lane"), i.e. the second channel (monitoring channel) with the second computing unit, continuously verifies the output of the Command (COM) Lane Computer ("COM-Lane" or Control channel with the first computing unit) on the higher level during operation in a conventional manner. This means that the MON-Lane computer (second calculation unit) not only checks whether the COM-Lane produces an output that meets the specified inspection rule (checks for implementation failure), but also confirms whether the COM-Lane actually produces an output that can achieve stable and desired flight characteristics (checks for design error).

In general, the correct implementation of the mathematical-physical flight control rules is verified by complying with the corresponding development insurance process. However, errors in the design and specification of the requirements are difficult to identify using a simple verification method, since the output of the flight control rules, i.e. the corresponding control commands, may still be defective. The proposed extended check range of MON-Lane (second channel with second computing unit) comprises method steps for verifying the computed flight control law output, that is to say it can be checked whether the computed output of COM-Lane (control command of the first computing unit on the first channel) is applicable to the existing actual state of the aircraft and to the existing pilot commands.

A first approach underlying the present disclosure includes an inspection of the basic state of the aircraft. This basic approach consists in assessing whether the current state of the aircraft corresponds to the input commands of the pilot (pilot inputs). The input quantities for this basic check are the aircraft flight state (the actual state of the aircraft; in particular given by the aircraft flight state vector) and the pilot input command (pilot input), where the pilot input is converted ("interpreted") into the desired flight state.

In particular, the following navigation state attributes can be checked according to this method, for which the above has already been indicated: attitude (e.g., as an euler angle check), rotational speed, change in rotational speed, position, altitude, velocity (relative to air and/or ground), acceleration.

For example, in the case where the pilot commands a multi-rotor aircraft to have a particular bank angle, but the multi-rotor aircraft does not achieve this desired bank angle within a particular time frame, then such a conclusion may be reached: basic flight control laws do not function properly. In extreme cases, it may even be assumed that this is independent of pilot commands, since, for example, an (actual) flight attitude with a roll angle of +/-90 ° and/or a pitch angle of +/-90 ° is by definition not a safe attitude for a multi-rotor aircraft. That is, a corresponding correction control signal or error signal should be generated at this time.

This first approach generally leads to easy-to-implement rules, at least in comparison to the conventional COM/MON approach, which requires the same requirements to be fulfilled completely independently. However, said first approach may not be sufficient for practical applications, since external forces acting on the aircraft (e.g. wind) or faulty performance of the flight influencing units (actuators) may bring the aircraft into an undesired state. MON-Lane should not directly conclude that COM-Lane has calculated an erroneous output, i.e., it is malfunctioning. Therefore, the problem is additionally presented as to whether the COM-Lane output is appropriate for the current aircraft state and pilot control commands. In a development of the basic concept of the present disclosure, this leads to a refined approach:

as also already described above, the refined method includes a verification of the control output. This involves a check in MON-Lane, that is to say by the second calculation unit. The second computing unit preferably continuously reads the current control output (control command Ω) from COM (first computing unit) to the flight influencing unit (actuator) and executes the inverse N control relation (configuration) with the matrix K in order to find out whether the control command brings about a vector τ of torque and force_CmdSaid vector being adapted to the current situation or current state, in particular to the pilot reference or also to the flight envelope(Envelope) deviation of the current state. Said checking preferably comprises checking the vector τ_CmdAnalysis of the direction and magnitude (value) of (c). A specific example of such a vector has been given above.

That is, the control instruction of the first calculation unit COM constitutes a desired output value, denoted in the above by Ω. Desired vector τ derived from desired output value Ω_CmdVector τ, which can be calculated independently of the tracking by the monitor (second channel with second calculation unit)_MONAnd (6) comparing. This can be done in different ways, for example as a simple threshold comparison or also by checking the shaft angle rotation. At this point, the checking of the angular rotation of the shaft makes it possible to detect whether the shaft of the desired torque is reliably within a predefined tolerance and whether the magnitude (value) of the torque is moderate.

For example, it may happen that the aircraft has a tilt angle of +80 ° (this cannot pass the check or would trigger a corresponding signal of the second computing unit according to the first processing means, the pilot input would not require such an angle). But here if the commanded torque and force vectors (desired vector τ)_Cmd) Pointing in a direction corresponding to a pilot command (pilot input), the probability of an error in the command unit (first calculation unit) is low. In this case, it is assumed more that the aircraft enters an undesirable flight attitude due to external forces. But COM-Lane apparently responds appropriately to this given situation and other inspection rules may not improve the overall security. In this case, it is advantageous if, in the subsequent monitoring, it is concluded that, contrary to the first processing mode, no intervention in the operation of the first computing unit is required.

As mentioned above, in the proposed monitoring scheme, there are a number of ways of handling how to determine a possible abnormal functional behaviour. However, if only one of the monitoring methods is trusted to judge whether a function has normal performance, excessive false alarm results may be brought. "false alarm" means in this case that the second computing unit has identified an error, but the function is carried out within the desired tolerance range (envelope curve or envelope curve). False positive results are typically the result of envelope curve definitions that are too conservative due to the addition of too large an amount of safety margin. This situation may even be exacerbated by the use of more than one monitoring method and the use of an or gate to make the determination. The opposite is the case where an and gate is used to make the decision. As a result, the abnormal behavior may generally remain unrecognized.

In the present case, in addition to the methods already discussed, a weighting model is proposed as an additional improvement, which combines the different methods into a total solution. The weights are defined by evaluating the severity of the security impact that can be identified by a given method. For purposes of explanation, the following exemplary table 1 is used for explanation. This table provides the first weight coefficients mentioned above.

Influence of the determined severity of the error	Severity weighting
		Has no influence on	0
Small influence	1
		Large influence	10
Influence of danger	100
		Catastrophic effects	1000

Table 1: error severity level and severity weight

The second weight (second weight coefficient, see above) depends on the type of (decision) method used for identifying the abnormal function. If a binary decision is involved, the weight is 0 when the function is expected to function and 1 when abnormal behavior is observed. However, if the method used has a confidence value (e.g. kalman filter) for identifying abnormal behavior, which can be given hierarchically or steplessly, this value can be normalized to the range 0,1 from zero to one and used as a so-called confidence weight. The proposed second (confidence) weights are summarized in table 2.

Method	Confidence weighting
		Two elements	0 or 1
Confidence range	0 to 1

Table 2: method and confidence weighting

By multiplying the confidence weight by the severity weight and summing all applied methods, a rating of the monitored function can be derived. The decision whether a function is working properly or not can be derived by defining a threshold. When the sum of the weighted methods exceeds a defined threshold, the function is deemed to be malfunctioning. If the sum of the weighted methods is below a defined threshold, the function is deemed to be functioning properly.

Drawings

Further characteristics and advantages result from the following description of embodiments with reference to the drawings.

Fig. 1 schematically shows an aircraft according to the disclosure with a control device according to the disclosure with reference to a block diagram;

FIG. 2 shows a flow diagram of a first design of a method for controlling an aircraft according to the disclosure;

FIG. 3 shows a flow diagram of a modification of the method according to FIG. 2; and

fig. 4 shows a further development of the method according to fig. 2.

Detailed Description

In fig. 1, an aircraft, in particular a multi-rotor helicopter, in the form of a vertical take-off and landing multi-rotor aircraft is shown at 1. The dashed box schematically shows the aircraft 1 at an abstract level.

The aircraft 1 comprises a number N of flight influencing units 2.1, …, 2.N, which are configured as electrically driven drive units in the form of motor/rotor units. Reference numeral 3 denotes a sensor for determining the actual state of the aircraft 1. The sensor 3 may comprise a plurality of sensor units 3.1, 3.2, which are configured as different types of sensor units 3.1, 3.2. Temperature sensors, tachometers, inertial measurement units, cameras, radar, lidar and the like may be mentioned here by way of example and without limitation. In contrast to the schematic illustration in fig. 1, these sensors 3 can be arranged distributed on the aircraft 1. For example, some sensor units 3.1, 3.2,. can be assigned directly to a single flight influencing unit (drive unit) 2.1, 2.2, … and be arranged there.

Reference numeral 4 denotes a superordinate flight control unit or flight control device of the aircraft 1. The flight control 4 receives pilot inputs PE from a corresponding input device 5, for example a joystick. The pilot input PE is not limited to human pilot input. The input device 5 may also be, in particular, an autopilot, other automatic input device or a remote control signal.

According to the schematic illustration in fig. 1, the flight control unit 5 comprises a first (control) channel (COM-Lane) with a first computing unit COM and a second (monitoring) channel (MON-Lane) with a second computing unit MON. The first computing unit COM may also be referred to as a command or an instruction (unit), and the second computing unit MON may also be referred to as a monitor. The pilot input PE first reaches the receiving device 6, which prepares the pilot input using signal technology and supplies it to the COM. From this, the COM calculates a control command SB, which it supplies to the flight influencing units 2.1, …, 2. N. MON monitors COM, in particular the control commands SB generated by COM, and here in particular receives the signals of the sensor 3, as shown. Depending on the result of the monitoring, MON generates a control signal SS which can be used in the flight control unit 4 for controlling the aircraft 1 in different ways. A detailed description thereof has been given above. MON can check in particular whether the control command SB applies to the existing physical state of the aircraft 1 and to the pilot input PE in that MON determines the current flight state of the aircraft 1 from the sensor signals and compares said flight state with the pilot input PE. To this end, the unit 6 is also operatively connected to MON, as shown. In this manner, the MON "recognizes" or converts the pilot input PE into a desired flight state for the aircraft 1, which is compared to the current flight state of the aircraft 1.

Additionally or alternatively, MON can check, by means of a reverse control relationship (steuerungszudung), whether control command SB, when activating flight influencing units 2.1, …, 2.N of aircraft 1, enables a first force/torque vector for the aircraft, which vector is adapted to the existing physical state of aircraft 1. A detailed description of this has also been given above. MON may specifically determine the force/torque vector τ from the control command SB_CmdAs shown, and the force/torque vector is compared to a second force/torque vector τ_MONIn comparison, the second force/torque vector is determined independently of the first force/torque vector. MON based on pilot input PE and sensingThe second force/torque vector is independently determined by the sensor signal (measurement).

Fig. 2 shows a first flowchart of the method. The branches (modifications of the method) indicated by letters a and B included in this flowchart are explained in detail below with reference to fig. 3 or fig. 4.

The method according to fig. 2 starts with step S1. From this point on, there are two parallel routes of methods. According to step S2, the flight control unit 4 (see fig. 1) receives the pilot input PE (see fig. 1) and generates therefrom a control command SB (see fig. 1) for the flight influencing units 2.1, …, 2.N (see fig. 1) of the aircraft 1 (fig. 1), which control command is transmitted to the flight influencing units in step S3. This is achieved via COM channels. In parallel with this, the MON determines in step S4 whether the control commands apply to the existing physical state of the aircraft and to the pilot input. To this end, the MON determines in step S4 whether the current flight status of the aircraft corresponds to pilot input, in particular based on sensor data or sensor signals (see fig. 1). The monitoring of COM by MON is symbolized in fig. 2 by reference sign S5. Next, in step S6, the check already mentioned is carried out, i.e. whether the current flight state of the aircraft corresponds to a desired flight state of the aircraft, which is derived from pilot inputs, within a given deviation range. The comparison performed in step S6 may be performed in different ways and forms (branch B), which is explained in detail below with reference to fig. 4.

If the comparison of step S6 shows that a match exists within the predefined deviation range, a control signal for controlling the aircraft is generated in step S7, which control signal may in the simplest case comprise that the control can be continued unchanged. If, however, in step S6, it is concluded that there is no match within the specified deviation range, in step S8 control signals are generated for controlling the aircraft, which control signals make it possible to respond to the presence of a malfunction. In the simplest case, the method then terminates in step S9. However, it is also possible to provide a modification of the method (branch a), which is explained in more detail below with reference to fig. 3.

Since, as explained at the outset, the simple method according to fig. 2 leads to a large number of false results, it is provided according to the refinement of fig. 3 that, following step S7 or step S8 (see fig. 2), in step S10, in particular by MON, it is checked with a reversed control relationship whether the control command SB (fig. 1) would result in a force/torque vector τ for the aircraft when the flight influencing units 2.1, …, 2.N (fig. 1) of the aircraft are actuated_CmdSaid force/torque vector is adapted to the existing physical state of the aircraft, in particular in terms of direction and/or magnitude. For this purpose, the method branches to step S11, so that three possible alternative sequences S12 to S14 are obtained according to fig. 3, which sequences are also referred to above as steps i) to iii), and which, in contrast to the simple illustration in fig. 3, can also be executed cumulatively (in a combined manner). Next, in step S15, an adaptively adjusted control signal is generated for controlling the aircraft and is generated as a function of the check results from the respective checks according to S12 to S14. Thereafter, the method continues at a branch point a.

In step S12, the force/torque vector derived from the control command and the other force/torque vector τ are combined_MONIn contrast, here, it is preferred to be independent of the force/torque vector τ by MON_CmdDetermining a force/torque vector τ_MON. In step S13, force/torque vector τ is addressed_CmdPreferably included in the force/torque vector τ by MON checking_CmdWhether the axis and/or the value of the torque in (b) is within a predefined tolerance range. According to step S14, for force/torque vector τ_CmdPreferably also checking the force/torque vector τ by MON_CmdWhether it coincides with the pilot input PE (see fig. 1) within a predefined deviation.

It is shown in fig. 4 that, within the scope of a further development, a plurality of checking and comparison methods can be used in order to improve the accuracy of the checking, as explained in detail above. Three different checking/comparing methods are provided in fig. 4, but the present disclosure is not limited to this particular number.

The branch in step S16 branches off in each case to one of the mentioned checking/comparison methods. The flow of the checking/comparing method next branches to step S17, step S18, or step S19. In each of the methods, in a first substep S17.1, S18.1, S19.1, a first weighting factor is assigned to the respective checking/comparison method, as explained in detail above. Next, in a second substep S17.2, S18.2, S19.2, a second weighting factor is assigned to each checking/comparison method, as also explained in detail above. Then, in a third substep S17.3, S18.3, S19.3, for each checking/comparison method, the first and second weighting factors are combined into a total weighting factor, with which the corresponding checking/comparison result is weighted. In particular, it can be provided that in steps S17.3, S19.3, for each checking/comparison method, the first and second weighting factors are multiplied. Next, in step S20, the plurality of weighted check/comparison results are summed to obtain a combined check result for use in step S21. This merged check result is then processed further in accordance with step S6, as already explained above with reference to fig. 1.

The first weight coefficient may in particular be a so-called severity weight, as explained in detail above. The second weight coefficient may in particular be a confidence weight, as also explained in detail above.