TWI891159B - Control system and control method for flight vehicle - Google Patents

Abstract

A control system, for controlling a flight vehicle, including the following elements. A first buffer and a second buffer, coupled to a motor unit of the flight vehicle. A master control unit, for generating a first actuating signal. A slave control unit, for generating a second actuating signal. The first actuating signal and the second actuating signal are selectively provided to the motor unit through a first buffer and a second buffer respectively. A logic determination unit, for generating a switch control signal for controlling the first buffer and the second buffer to be turned-on or turned-off. The first actuating signal and the second actuating signal are selectively provided to the motor unit. The master control unit and the slave control unit monitor each other whether operating normally. When the master control unit operates abnormally, the second actuating signal is provided to the motor unit.

Description

Control system and control method for aircraft

This disclosure relates to a vehicle control mechanism, and more particularly to an aircraft control system and control method.

To maintain stable navigation, the vehicle's control platform can be equipped with two or more control units to support each other. If one control unit malfunctions, control can be seamlessly transferred to another unit, ensuring that the vehicle is always under the control of at least one control unit, preventing control interruptions.

For vehicles on the ground or ships on the water, a slight interruption in control is acceptable. However, for aircraft in the air, even the slightest interruption in control can cause the aircraft to stall and crash. Aircraft typically have two or more control units supporting each other. However, excessive feedback from the two control units can cause excessive flight corrections and lead to a stall.

Therefore, an improved control mechanism is needed to enable the two control units of an aircraft to monitor and coordinate with each other to ensure seamless switching between the two control units.

According to one aspect of the present disclosure, a control system for controlling an aircraft is provided. The control system includes the following components: a first buffer coupled to a motor unit of the aircraft; a second buffer coupled to the motor unit; a primary control unit for generating a first braking signal, which is selectively provided to the motor unit via the first buffer; a secondary control unit for generating a second braking signal, which is selectively provided to the motor unit via the second buffer; and a logic determination unit for generating a switching control signal to control the first and second buffers to be on or off. The main control unit and sub-control unit monitor each other for normal operation. If the main control unit is operating abnormally, the secondary braking signal is provided to the motor unit in response to the switching control signal.

According to another aspect of the present disclosure, a control method for controlling an aircraft is provided. The control method includes the following steps: a main control unit generates a first braking signal. A first buffer selectively provides the first braking signal to a motor unit. A sub-control unit generates a second braking signal. A second buffer selectively provides the second braking signal to the motor unit. A logic determination unit generates a switching control signal to control the first and second buffers to be on or off. The main control unit and the sub-control unit monitor each other for normal operation. When the main control unit is operating abnormally, the second braking signal is provided to the motor unit in response to the switching control signal.

Other aspects and advantages of the present disclosure will be apparent from a review of the following drawings, detailed description, and claims.

1000: Control System

2000: Aircraft Platform

100a, 200a: Flight Management Unit

100: Main control unit

200: Sub-control unit

150: First buffer

250: Second buffer

300: Relay component

310,320: Inverter

400:Logical judgment unit

410: Mutual exclusion or logical blocking

420: Reverse

500: Peripheral components

510: Motor unit

520: Brake

530: Camera

540:Sensor

600: Input/output switch bus

Tx1, Tx2: Transmitter circuit

Rx1, Rx2: Transmitter circuit

MA_RECV: First monitoring signal

SL_RECV: Second monitoring signal

MA_CTRL: First control signal

SL_CTRL: Second control signal

MA_SL_SWH: Switching control signal

MA_ACT: First braking signal

SL_ACT: Second braking signal

S300~S310: Steps

S600~S616: Steps

Figure 1 is a block diagram of an aircraft platform 2000 according to an embodiment of the present disclosure.

Figure 2 is a detailed functional block diagram of the control system 1000 in Figure 1.

Figure 3 is a flow chart showing how the sub-control unit 200 monitors the first monitoring signal MA_RECV to determine whether the main control unit 100 is operating normally.

Figure 4 is a circuit diagram of the logic judgment unit 400 in Figure 2.

Figure 5 is a schematic diagram of another embodiment of the sub-control unit 200 confirming the potential change of the first monitoring signal MA_RECV.

Figure 6 is a flow chart showing how the control system 1000 controls the motor unit 510.

The technical terms used in this specification are based on customary terminology in the art. If this specification provides explanations or definitions for certain terms, the interpretation of such terms shall be subject to the explanations or definitions in this specification. Each embodiment disclosed herein has one or more technical features. Where feasible, a person skilled in the art may selectively implement some or all of the technical features of any embodiment, or selectively combine some or all of the technical features of these embodiments.

Figure 1 is a block diagram of an aircraft platform 2000 according to an embodiment of the present disclosure. As shown in Figure 1, aircraft platform 2000 includes a control system 1000 and peripheral components 500. Aircraft platform 2000 is mounted on an aircraft and is used to control the aircraft's flight and peripheral functions. For example, the aircraft may be an unmanned aerial vehicle (UAV) of various types, including military or civilian drones of various sizes. Control system 1000 includes two flight management units (FMUs) 100a and 200a. FMUs 100a and 200a support each other in controlling the aircraft's flight functions. In addition, the flight management unit 100a and the flight management unit 200a can also assist in controlling the aircraft's peripheral functions (such as photography, cargo loading and unloading, weapon control, etc.).

Control system 1000 further includes an input/output switch bus (I/O switch bus) 600. Flight management units 100a and 200a control aircraft peripheral components 500 via I/O switch bus 600. Peripheral components 500 include, for example, a motor unit 510, an actuator 520, a camera 530, and a sensor 540. Motor unit 510 is a servo motor module used to provide power to the aircraft for flight. Actuator 520 is used to adjust the aircraft's flight attitude and the power output of motor unit 510. Furthermore, aircraft platform 2000 may include a remote control module and a power supply module (not shown in FIG. 1).

Figure 2 is a detailed functional block diagram of the control system 1000 in Figure 1. The control system 1000 in Figure 2 includes a master control unit 100, a slave control unit 200, a relay element 300, inverters 310 and 320, a logic determination unit 400, a first buffer 150, and a second buffer 250. The control system 1000 is used to control the motor unit 510 (the input/output switch bus 600 in Figure 1 is omitted in Figure 2). The master control unit 100 and slave control unit 200 in Figure 2 are the two flight management units 100a and 200a of the control system 1000 in Figure 1, respectively.

Both the main control unit 100 and the sub-control unit 200 can be microcontrollers (MCUs), such as 32-bit ARM (Advanced RISC Machine) processors. Alternatively, both the main control unit 100 and the sub-control unit 200 can be central processing units (CPUs) or field programmable gate arrays (FPGAs). In operation, the main control unit 100 and the sub-control unit 200 exchange data to monitor each other's normal operation.

More specifically, the main control unit 100 is provided with a transmitting circuit Tx1 and a receiving circuit Rx1. Correspondingly, the sub-control unit 200 is provided with a transmitting circuit Tx2 and a receiving circuit Rx2. The main control unit 100 transmits a first monitoring signal MA_RECV to the sub-control unit 200 via the transmitting circuit Tx1. The sub-control unit 200 receives the first monitoring signal MA_RECV via the receiving circuit Rx2. In this embodiment, the first monitoring signal MA_RECV is, for example, a signal that periodically switches between high and low levels, such as a clock signal. When the first monitoring signal MA_RECV is a clock signal, it has a first period P1, which is, for example, equal to 2 ms. From another perspective, the first monitoring signal MA_RECV switches between high and low levels according to the first period T1. The first monitoring signal MA_RECV switches from high to low, or from low to high, every first period T1. The first period T1 is half of the first cycle P1 (i.e., the first period T1 is, for example, equal to 1 ms).

The sub-control unit 200 monitors the first monitoring signal MA_RECV and determines whether the main control unit 100 is operating normally based on the first monitoring signal MA_RECV. Figure 3 is a flow chart illustrating how the sub-control unit 200 monitors the first monitoring signal MA_RECV to determine whether the main control unit 100 is operating normally. Referring to Figures 2 and 3, first, in step S300, the main control unit 100 transmits the first monitoring signal MA_RECV to the sub-control unit 200. The first monitoring signal MA_RECV switches between high and low levels according to a first period T1, and the sub-control unit 200 receives the first monitoring signal MA_RECV.

Next, in step S302, the sub-control unit 200 monitors the first monitoring signal MA_RECV during the second period P2 to determine whether the level of the first monitoring signal MA_RECV changes. In this embodiment, the second period P2 is shorter than the first period P1. For example, the second period P2 is equal to 1 μs. The sub-control unit 200 checks the first monitoring signal MA_RECV every second period P2 to determine whether the level of the first monitoring signal MA_RECV changes from a high level to a low level, or vice versa.

If the confirmation result of step S302 is "yes" (i.e., the potential change of the first monitoring signal MA_RECV is confirmed in the second period P2), it can be determined that the main control unit 100 is operating normally, and then step S304 is executed: the sub-control unit 200 sets the second control signal SL_CTRL to a logical low potential "L" to represent a logical value "0", and the sub-control unit 200 transmits the second control signal SL_CTRL to the main control unit 100 and the logic judgment unit 400 via the transmitting circuit Tx2. Furthermore, step S300 is executed again: the main control unit 100 continues to transmit the first monitoring signal MA_RECV to the sub-control unit 200, and the first monitoring signal MA_RECV switches between high and low levels according to the first period T1.

On the other hand, if the result of step S302 is "No" (i.e., no change in the level of the first monitoring signal MA_RECV is detected during the second period P2), step S306 is then executed to determine whether the level of the first monitoring signal MA_RECV remains unchanged after the second period T2. The second period T2 is slightly longer than the first period T1, and is, for example, 1.2 ms.

If the result of step S306 is "yes" (i.e., the level of the first monitoring signal MA_RECV remains unchanged for more than the second period T2), then step S308 determines that the main control unit 100 is operating abnormally. Step S310 then proceeds: the sub-control unit 200 sets the second control signal SL_CTRL to a logically high level "H" to indicate a logical value of "1." The sub-control unit 200 then transmits the second control signal SL_CTRL to the main control unit 100 and the logic determination unit 400 via the transmit circuit Tx2.

The second control signal SL_CTRL is transmitted directly to the logic determination unit 400 (without passing through the relay element 300 and the inverter 310). Based on the second control signal SL_CTRL, the logic determination unit 400 switches control of the aircraft from the main control unit 100 to the sub-control unit 200.

Referring again to Figure 2, the sub-control unit 200 transmits the second monitoring signal SL_RECV to the main control unit 100 via the transmitting circuit Tx2. In this embodiment, the second monitoring signal SL_RECV is similar to the first monitoring signal MA_RECV. The second monitoring signal SL_RECV is also a periodic high-low switching clock signal. The period of the second monitoring signal SL_RECV is also equal to the first period P1 (i.e., 2ms). The second monitoring signal SL_RECV switches from high to low, or from low to high, every first period T1.

The main control unit 100 receives the second monitoring signal SL_RECV via the receiving circuit Rx1. The main control unit 100 monitors the second monitoring signal SL_RECV and determines whether the sub-control unit 200 is operating normally based on the second monitoring signal SL_RECV. Similar to how the sub-control unit 200 determines whether the main control unit 100 is operating normally, the main control unit 100 also monitors the second monitoring signal SL_RECV at the monitoring frequency corresponding to the second cycle P2 to confirm whether the second monitoring signal SL_RECV changes in level.

If the second monitoring signal SL_RECV changes in level (within the second period T2) based on the monitoring frequency during the second period P2, the sub-control unit 200 is determined to be operating normally. The main control unit 100 sets the first control signal MA_CTRL to a logically low level "L," indicating a logical value of "0." The first control signal MA_CTRL is transmitted directly to the sub-control unit 200 and then to the logic determination unit 400 via the relay element 300 and inverter 310. The relay element 300 is, for example, a relay microprocessor unit (MCU). The inverter 310 can invert the voltage level of the first control signal MA_CTRL and also functions as a buffer to delay the first control signal MA_CTRL.

On the other hand, if the level of the second monitoring signal SL_RECV does not change after the second period T2, the sub-control unit 200 is determined to be operating abnormally. At this time, the main control unit 100 sets the first control signal MA_CTRL to a logical low level "H" to represent a logical value "1".

Figure 4 is a circuit diagram of the logic decision unit 400 in Figure 2. Please refer to both Figures 2 and 4 for an explanation of the operation of the logic decision unit 400. The logic decision unit 400 includes an exclusive OR (XOR) logic gate 410 and an inverter 420. The second control signal SL_CTRL is transmitted directly to the logic decision unit 400, and the first control signal MA_CTRL is transmitted to the logic decision unit 400 via the relay element 300 and the inverter 310.

The two inputs of the exclusive OR logic gate 410 receive the second control signal SL_CTRL and the delayed and inverted first control signal MA_CTRL, respectively. The output of the exclusive OR logic gate 410 generates the switching control signal MA_SL_SWH. The output of the exclusive OR logic gate 410 is inverted and then inverted again by the inverter 420. When the slave control unit 200 detects a change in the first monitoring signal MA_RECV and determines that the master control unit 100 is operating normally, the second control signal SL_CTRL assumes a logical value of "0." Furthermore, the main control unit 100 confirms that the second monitoring signal SL_RECV has changed and determines that the sub-control unit 200 is operating normally. Therefore, the first control signal MA_CTRL has a logical value of "0." At this time, the exclusive OR logic gate 410 of the logic determination unit 400 receives the second control signal SL_CTRL with a logical value of "0" and the first control signal MA_CTRL with a logical value of "0." Therefore, the switching control signal MA_SL_SWH output by the exclusive OR logic gate 410 has a logical value of "0." The switching control signal MA_SL_SWH with a logical value of "0" is output by the logic determination unit 400 to the first buffer 150 and the second buffer 250.

The first buffer 150 is associated with the main control unit 100, and the second buffer 250 is associated with the slave control unit 200. The first buffer 150 receives the switching control signal MA_SL_SWH and the first braking signal MA_ACT generated by the main control unit 100. The second buffer 250 receives the second braking signal SL_ACT generated by the slave control unit 200 and transmits the switching control signal MA_SL_SWH to the second buffer 250 via the inverter 320. The switching control signal MA_SL_SWH serves as the switching control signal for the first buffer 150 and the second buffer 250. When the switching control signal MA_SL_SWH is at a logical value of "0," the first buffer 150 is open, allowing the first braking signal MA_ACT to be provided to the motor unit 510 via the first buffer 150. On the other hand, the switching control signal MA_SL_SWH, after being acted upon by the inverter 320, becomes a logical value of "1" and is input to the second buffer 250, causing the second buffer 250 to be closed. Therefore, the second braking signal SL_ACT cannot be provided to the motor unit 510 via the second buffer 250. At this point, the motor unit 510 receives only the first braking signal MA_ACT from the main control unit 100. In other words, the main control unit 100 alone controls the motor unit 510.

On the other hand, if the level of the first monitoring signal MA_RECV remains unchanged for more than the second period T2, the main control unit 100 is determined to be operating abnormally, and the sub-control unit 200 sets the second control signal SL_CTRL to a logical value of "1." At this time, the exclusive OR logic gate 410 of the logic determination unit 400 receives the second control signal SL_CTRL with a logical value of "1" and the first control signal MA_CTRL with a logical value of "0." Therefore, the switching control signal MA_SL_SWH output by the exclusive OR logic gate 410 is a logical value of "1." When the switching control signal MA_SL_SWH is a logical value of "1," the first buffer 150 is closed, and the first braking signal MA_ACT cannot be provided to the motor unit 510 via the first buffer 150. On the other hand, the switching control signal MA_SL_SWH is converted to a logical value of "0" by the inverter 320 and input to the second buffer 250, turning the second buffer 250 on. Therefore, the second braking signal SL_ACT can be provided to the motor unit 510 via the second buffer 250. At this time, the motor unit 510 only receives the second braking signal SL_ACT from the sub-control unit 200. In other words, the sub-control unit 200 alone controls the motor unit 510.

According to the above embodiment, when the main control unit 100 is operating normally, the switching control signal MA_SL_SWH has a logical value of "0," the first braking signal MA_ACT of the main control unit 100 can be provided to the motor unit 510 via the first buffer 150, and the second braking signal SL_ACT of the slave control unit 200 is not provided to the motor unit 510. Conversely, when the main control unit 100 is operating abnormally, the switching control signal MA_SL_SWH has a logical value of "1," the second braking signal SL_ACT of the slave control unit 200 can be provided to the motor unit 510 via the second buffer 250, and the first braking signal MA_ACT of the main control unit 100 is not provided to the motor unit 510. Therefore, the motor unit 510 only receives control from either the main control unit 100 or the sub-control unit 200 at a time, preventing confusion or excessive control between the main control unit 100 and the sub-control unit 200, which could affect the aircraft's flight status.

Next, please refer to Figure 5, which is a schematic diagram of another embodiment of the sub-control unit 200 confirming the potential changes of the first monitoring signal MA_RECV. In this embodiment, the sub-control unit 200 compares the number of logical values "1" (i.e., high potential) and the number of logical values "0" (i.e., low potential) of the first monitoring signal MA_RECV to confirm whether the main control unit 100 is operating normally. For example, the first period T1 (i.e., 1ms) of the first monitoring signal MA_RECV is taken as one time unit, and five time units are taken as one monitoring interval R1. During monitoring interval R1, the slave control unit 200 detects that the logical value of the first monitoring signal MA_RECV is "01010," which consists of three logical values "0" and two logical values "1." If the number of logical values "0" and "1" differs by one, the master control unit 100 is determined to be operating normally.

Next, monitoring interval R1 is shifted by one time unit to become monitoring interval R2. During monitoring interval R2, the slave control unit 200 detects that the logical value of the first monitoring signal MA_RECV is "10101," which consists of three logical "1" values and two logical "0" values. The difference between the number of logical "0" and "1" values is only one, but the master control unit 100 is still judged to be operating normally. Similarly, monitoring interval R2 is shifted by one time unit to become monitoring interval R3. During monitoring interval R3, the slave control unit 200 detects that the logical value of the first monitoring signal MA_RECV is "01010," which consists of three logical "0" values and two logical "1" values. Although the number of logical "0" and "1" values differs by one, the master control unit 100 is still judged to be operating normally.

Then, during monitoring interval R(n-1), the first monitoring signal MA_RECV is detected to have a logical value of "01011," consisting of three logical "1" values and two logical "0" values. The number of logical "0" and "1" values differs by one, and the master control unit 100 is still judged to be operating normally. Then, during monitoring interval R(n), the first monitoring signal MA_RECV is detected to have a logical value of "10111," consisting of four logical "1" values and one logical "0." The number of logical "0" and "1" values differs by three, and the master control unit 100 is judged to be operating abnormally. The last two consecutive logical values of "11" in the monitoring interval R(n) of "10111" indicate that the potential of the first monitoring signal MA_RECV has not changed. The main control unit 100 is indeed operating abnormally, eliminating any misjudgment due to factors such as the frequency or sampling time of the first monitoring signal MA_RECV.

As described above, by comparing the number of logical values "1" and "0" of the first monitoring signal MA_RECV, it is possible to accurately determine whether the main control unit 100 is operating abnormally, eliminating misjudgments due to factors such as frequency or sampling time. If the monitoring interval is set to five times the first period T1, the threshold for determining the comparison result can be set to "3." When the difference between the number of logical values "0" and "1" is greater than or equal to the threshold value "3," the sub-control unit 200 determines that the main control unit 100 is operating abnormally. Similarly, the above mechanism can also be used when the main control unit 100 confirms changes in the potential of the second monitoring signal SL_RECV.

Next, please refer to Figure 6, which is a flow chart illustrating the control system 1000 controlling the motor unit 510. First, in step S600, the two flight control units 100a and 200a are activated (i.e., the main control unit 100 and the sub-control unit 200 are activated). Next, in step S602, the main control unit 100 monitors the second monitoring signal SL_RECV generated by the sub-control unit 200, and the sub-control unit 200 also monitors the first monitoring signal MA_RECV generated by the main control unit 100.

Next, in step S604, the main control unit 100 checks whether the level of the second monitoring signal SL_RECV has changed, and the sub-control unit 200 checks whether the level of the first monitoring signal MA_RECV has changed. If the confirmation result is "yes," the process returns to step S602. If the confirmation result is "no," it is determined that either the main control unit 100 or the sub-control unit 200 is operating abnormally, and step S606 is executed, where the logic judgment unit 400 switches control between the main control unit 100 and the sub-control unit 200.

Next, in step S608, the master control unit 100 or slave control unit 200 determines whether the control authority switch has been activated. Next, in step S610, it confirms whether the control authority switch is correct. If the confirmation result is "no," step S612 is executed: the control authority switch is forced through the relay device 300.

If the result of step S610 is "yes," step S614 is executed: the first buffer 150 or the second buffer 250 is turned on or off in response to the switching control signal MA_SL_SWH from the logic judgment unit 400. Next, in step S616, the first braking signal MA_ACT is transmitted to the motor unit 510 via the first buffer 150, or the second braking signal SL_ACT is transmitted to the motor unit 510 via the second buffer 250.

Although the present disclosure has been described in detail above with reference to preferred embodiments and examples, it should be understood that these examples are intended to be illustrative rather than restrictive. It is anticipated that those skilled in the art will be able to devise numerous modifications and combinations that fall within the spirit of the present disclosure and the scope of the appended patent applications.

1000: Control System 2000: Aircraft Platform 100a, 200a: Flight Management Unit 500: Peripheral Components 510: Motor Unit 520: Brakes 530: Camera 540: Sensors 600: Input/Output Switch Bus

Claims (20)

A control system for controlling an aircraft includes: a first buffer coupled to a motor unit of the aircraft; a second buffer coupled to the motor unit; a main control unit for generating a first braking signal, a first monitoring signal, and a first control signal, the first braking signal being selectively provided to the motor unit via the first buffer; a secondary control unit for generating a second braking signal, the second braking signal being selectively provided to the motor unit via the second buffer; and a logic determination unit for generating a switching control signal to control the first buffer and the second buffer to be on or off. The first monitoring signal is provided to the sub-control unit, and the first control signal is provided to the logic judgment unit via a relay element and an inverter. The main control unit and the sub-control unit monitor each other to see if they are operating normally. When the main control unit is operating abnormally, the second braking signal is provided to the motor unit in response to the switching control signal. A control system as claimed in claim 1, wherein the main control unit and the secondary control unit are both flight management units of the aircraft. The control system of claim 1, wherein the main control unit and the sub-control unit are both 32-bit micro control units. As in the control system of claim 1, wherein the secondary control unit determines whether the main control unit is operating normally based on the first monitoring signal. The control system of claim 1, wherein the sub-control unit provides a second control signal to the logic judgment unit, and when the sub-control unit determines that the main control unit is operating abnormally, the logic judgment unit changes the potential of the switching control signal in response to the second control signal. The control system of claim 5, wherein the logic judgment unit includes an exclusive OR (XOR) logic gate, and the exclusive OR logic gate generates the switching control signal according to the first control signal and the second control signal. The control system of claim 4, wherein the first monitoring signal is a clock signal having a first period, the first monitoring signal changes between a first potential and a second potential according to a first period, and the first period is equal to half of the first period. As in the control system of claim 7, when the sub-control unit confirms that the first monitoring signal changes between the first potential and the second potential within a second period, the sub-control unit determines that the main control unit is operating normally, wherein the second period is greater than the first period. In the control system of claim 8, when the sub-control unit confirms that the first monitoring signal remains at the first potential or the second potential for longer than the second period, the sub-control unit determines that the main control unit is operating abnormally. A control system as claimed in claim 7, wherein the first potential of the first monitoring signal represents a first logical value and the second potential represents a second logical value, the first monitoring signal has a first quantity of the first logical value and a second quantity of the second logical value in a monitoring interval, and when a difference between the first quantity and the second quantity is greater than a threshold value, the sub-control unit determines that the main control unit is operating abnormally. A control method for controlling an aircraft comprises: generating a first braking signal, a first monitoring signal, and a first control signal by a main control unit; selectively providing the first braking signal to a motor unit by a first buffer; generating a second braking signal by a sub-control unit; selectively providing the second braking signal to the motor unit by a second buffer; and generating a switching control signal by a logic determination unit to control the first buffer and the second buffer to be on or off. The first monitoring signal is provided to the sub-control unit, and the first control signal is provided to the logic judgment unit via a relay element and an inverter. The main control unit and the sub-control unit monitor each other to see if they are operating normally. When the main control unit is operating abnormally, the second braking signal is provided to the motor unit in response to the switching control signal. As in the control method of claim 11, wherein the main control unit and the sub-control unit are both flight management units of the aircraft. The control method of claim 11, wherein the main control unit and the sub-control unit are both 32-bit micro control units. The control method of claim 11 further includes: Determining, by the secondary control unit, whether the primary control unit is operating normally based on the first monitoring signal. The control method of claim 11 further includes: Providing a second control signal to the logic determination unit via the sub-control unit; and When the sub-control unit determines that the main control unit is operating abnormally, the logic determination unit changes the potential of the switching control signal in response to the second control signal. The control method of claim 15, wherein the logic judgment unit includes an exclusive OR (XOR) logic gate, and the exclusive OR logic gate generates the switching control signal according to the first control signal and the second control signal. The control method of claim 14, wherein the first monitoring signal is a clock signal having a first period, the first monitoring signal changes between a first potential and a second potential according to a first period, and the first period is equal to half of the first period. The control method of claim 17 further includes: When the sub-control unit confirms a voltage change of the first monitoring signal within a second period, wherein the second period is longer than the first period; and When confirming that the first monitoring signal changes between the first voltage and the second voltage within the second period, the sub-control unit determines that the main control unit is operating normally. In the control method of claim 18, when it is confirmed that the first monitoring signal remains at the first potential or the second potential for more than the second period, the sub-control unit determines that the main control unit is operating abnormally. The control method of claim 17, wherein the first potential of the first monitoring signal represents a first logical value and the second potential represents a second logical value, the control method further comprising: calculating a first number of the first logical values and a second number of the second logical values of the first monitoring signal within a monitoring range; calculating a difference between the first number and the second number; comparing the difference with a threshold value; and when the difference is greater than the threshold value, determining by the secondary control unit that the primary control unit is operating abnormally.