Abstract:
A method and a system are provided for controlling an aircraft in the form of a multicopter which has a plurality of redundant rotors ( 4 ), preferably arranged in a common rotor plane, in order, on the one hand, to generate lift, and, on the other hand, also propulsion by inclining the at least one rotor plane, wherein the regulation of the position and the control of the multicopter are carried out by changing rotor rotational speeds as a function of pilot control instructions. The system is characterized in that the rotors ( 4 ) are connected to one another in terms of data technology via a failsafe network ( 8 ), and they communicate their respective operating state, in particular their rotor rotational speed, in the network ( 8 ), and in that the network contains a first multiplicity of redundant sensors which determine control-relevant data and make it available in the network, in particular inclination, acceleration, rotational speed and/or position in all three spatial axes of the multicopter.

Description:
BACKGROUND 
       [0001]    The invention relates to a method for controlling an aircraft in the form of a multicopter, which multicopter comprises several, preferably redundant rotors arranged in a common rotor plane, in order to generate lift, on the one hand, and propulsion, on the other hand, by inclining at least one rotor plane, with the adjustment of the position and the control of the multicopter occurring by changing the rotor speeds depending on pilot control instructions. 
         [0002]    Additionally, the invention relates to a control system for an aircraft in the form of a multicopter, which multicopter comprises several redundant rotors, preferably arranged in a common rotor plane, in order to generate lift, on the one side, and also propulsion, on the other side, by inclining at least one rotor plane, with the adjustment of the position and the control of the multicopter occurring by changing the rotor speeds depending on pilot control instructions. 
         [0003]    Additionally, the invention relates to an aircraft in the form of a multicopter, which multicopter comprises several redundant rotors, preferably arranged in a common rotor plane, including respectively at least one electric motor and one propeller, in order to generate lift, on the one side, and also propulsion, on the other side, by inclining at least one rotor plane in the space, with the adjustment of the position and the control of the multicopter occurring by changing the rotor speeds depending on pilot control instructions. 
         [0004]    An aircraft is known from DE 20 2012 001 750 U1 in the form of a vertically starting and landing multicopter, which aircraft can be controlled via a generic method and/or shows a respective generic control system. 
         [0005]    A “multicopter” is considered here and in the following an aircraft, which uses several rotors or propellers preferably arranged in a common plane and acting vertically downwards, in order to generate lift and also propulsion, by inclining particularly one rotor plane. A multicopter is considered a rotor aircraft and thus can land and take-off vertically. 
         [0006]    Unlike conventional helicopters, multicopters use no mechanical control elements. The rotors and/or propellers exhibit a fixed pitch and are not adjustable, which lowers the production costs and reduces the need for maintenance. 
         [0007]    Any changes of the lift occur exclusively by increasing or reducing (changing) the motor speeds at the electric motors used for driving the propellers. Here and in the following “rotor” represents the combination of electric motor and propeller, while “propeller” only refers to the actual airscrew itself. 
         [0008]    In a multicopter the rotors move in opposite directions, one half in the clockwise direction, the other half in the counter-clockwise direction. This way the torque about the vertical axis, developing by the propellers upon the support frame of the multicopter, compensate each other when the totals of the forces of the clockwise and/or the counter-clockwise spinning propellers are equivalent. 
         [0009]    A rotation of the multicopter about the vertical axis (yaw axis) can be achieved by different rotations of the clockwise and counter-clockwise spinning rotors. For an incline about the pitch axis (pitching) the rotary speeds of the frontal and the rear rotors are varied, for an incline about the longitudinal axis (rolling) the speeds of the rotors located at the left and at the right. By the incline, here propulsion is possible not only in the vertical direction but also in the horizontal one, thus allowing a motion in any arbitrary direction. 
         [0010]    Multicopters are aerodynamically instable. A stable flight behavior can only be achieved by a permanent adjustment of the rotary speeds of the individual rotors. 
         [0011]    The pilot of the multicopter controls not the rotary speed of the individual motors, but only sets parameters, such as direction of flight, speed, rate of incline or decline, etc. This can occur for example by joysticks, switches, and similar control elements. 
         [0012]    In a multicopter used for transporting persons it is mandatory that the entire control operates with utmost reliability. The failure of individual components, e.g., individual sensors, control processors, or motors, may not lead to any risks for maneuverability or to a crash of the multicopter. 
         [0013]    Additionally, several unmanned multicopters are known from prior art, for example for model aviation or used as monitoring drones, which typically exhibit a central control, which determines the target rotary speeds for all rotors and forwards them to the respective motor controllers. Any failure of this central adjustment leads quasi mandatorily to a loss of control of the multicopter and to its crash. 
         [0014]    In manned aviation it is common to provide critical components in redundant numbers, e.g., in duplicate or triplicate. In this context then mandatorily a superordinate decision maker is provided, the so-called “voter” or “arbiter”, which monitors and decides, which of the critical components still operate correctly. This decision maker may represent the pilot him/herself, who for example decides in the event of deviations between the statements of various instruments based on criteria “majority” and “plausibility” and perhaps shuts off or ignores certain components. The decision maker may also be embodied in the form of an electronic unit, which compares the output (the output signals) of the redundant components and renders a decision according to the majority principle. 
         [0015]    However, an electronic “voter” itself represents a “single point of failure”, because due to its purpose it must be able to ignore or overwrite the output of certain components. Accordingly, in case of a faulty behavior of the “voter” it may occur that correct control pulses are suppressed and instead faulty control pulses are forwarded. Additionally it may occur that the “voter” itself generates faulty pulses, which may endanger the safety of the flight behavior. 
         [0016]    Even in case of a triplicate redundancy of the individual control components and a theoretically considered infallible “voter”, a multicopter could crash in case of a failure of only two control components. Accordingly in such a solution extremely high requirements are set for the reliability of the components involved, which would lead to respectively increased production, maintenance, and cost expenses. 
       SUMMARY 
       [0017]    The objective of the present invention is to provide a method and a system for a failsafe electronic position adjustment, control, and operation of such a multicopter as reliable as possible. 
         [0018]    This objective is attained according a method, a system, and an aircraft having one or more features of the invention. Advantageous further developments are described below and in the claims. 
         [0019]    In order to attain the above-stated objective and to avoid the above-discussed problems, in a method of the above-stated type it is suggested within the scope of the present invention that the rotors are connected to each other by data technology in a failsafe network and communicate their respective operating state in said network, particularly their rotor speeds; a first plurality of redundant sensors is included in the network, which determines the control-relevant (sensor) data and renders it available in the network, particularly the incline, acceleration, yaw rate, and/or position in all three spatial axes of the multicopter; furthermore, a second plurality of controls is included in the network, which autonomously and decentralized respectively determines the control signal for at least one rotor each, preferably also based on the rotor operating states, and renders said signal available in the network; the rotors are controlled via control signals such that any flight behavior of the multicopter is essentially equivalent to the specifications of the pilot control instructions. Here, the pilot control instructions not necessarily originate in a human pilot, but may also be generated automatically (e.g., by an autopilot or the like). 
         [0020]    Accordingly, in a control system of the type mentioned at the outset it is provided within the scope of the present invention that the rotors are connected to each other by data technology in a failsafe network and are embodied for the purpose to communicate in said network their respective operating state, particularly their rotor speeds; a first plurality of redundant sensors is provided in the network, embodied to determine control-relevant data and to render it available in the network, in particular the incline, acceleration, yaw rate, and/or position in all three spatial axes of the multicopter; furthermore a second plurality of controls is included in the network, which is embodied to determine autonomously and decentralized, based on sensor data, and particularly additionally based on the rotor operating states, respectively one control signal for at least one rotor each and render it available in the network; here it is possible to control the rotors via the control signals such that a flight behavior of the multicopter is essentially equivalent to a specification of the pilot control instruction. Here, the pilot control instruction does not necessarily originate in a human pilot, but may also be generated automatically (e.g. by autopilot or the like). 
         [0021]    An aircraft according to the invention is therefore characterized in that it has a control system according to the invention, which preferably is embodied to execute a method according to the invention. 
         [0022]    A stable flight behavior is preferably achieved within the scope of the present invention by a control circuit comprising sensors, a control algorithm, and actuators. The control algorithm is executed on at least one appropriately embodied control. The sensors provide actual data, which is processed by the control algorithm and serves for the control to appropriately address the actuators. The sensors measure, e.g., the incline, acceleration, yaw rate, and position in all three (spatial) axes. Here the electric motors of the rotors serve as actuators, with preferably the motors representing brushless direct current motors. Each of the motors itself can be controlled in its rotary speed independent from the others. As already mentioned, the control algorithm is executed on one or more processors, which form the above-mentioned controls or represent components of these controls. Preferably one such processor/control is used for every actuator. 
         [0023]    The new solution suggested within the scope of the present invention can therefore operate entirely without any central units. Instead thereof, a decentralized architecture is used, which comprises a plurality of distributed sensors, controls, and actuators. The above-mentioned components are connected to each other via a failsafe network, with said network preferably being embodied with a high degree of redundancy. Within the scope of a respective further development of the invention the same (control) algorithm can be executed on every control and/or network hub and all important decisions are made in a decentralized fashion. This way, the failure of a number of sensors, controls, and/or actuators can be compensated by the overall system and accordingly tolerated. Here, no “voter” is present, except for the physical reality, i.e. gravity and inertia. 
         [0024]    This can be shown by the following example and illustrated without restriction thereof: As long as the plurality of the rotors generate lift, a faulty rotor spinning with an insufficient rotor speed, is not capable to disrupt the overall system and risk the flight safety of the multicopter. The missing propulsion is compensated by the other rotors according to the above-stated explanations. 
         [0025]    In the following, a few particularly advantageous further developments of the fundamental concept according to the invention are explained explicitly: 
         [0026]    Advantageously the suggested system provides, within the scope of a respective further development, many controls, i.e. considerably more than three, preferably one control each per actuator. 
         [0027]    Within the scope of another further development the system also comprises “many” redundant sensors and/or “many” redundant actuators, for example 18 electric motors and a respective number of propellers. 
         [0028]    As already discussed, the above-stated components are connected to each other by data technology via a failsafe data network. Preferably, here the data exchange occurs via “data flowing everywhere” so that particularly all controls are informed at all times about the status of the individual components within the network and thus can render their decisions appropriately, with preferably every control deciding autonomously. 
         [0029]    Within the scope of another further development the system comprises “many” power suppliers, for example in the form of one battery for each motor and control. 
         [0030]    Another further development of the system or method according to the invention provides that the output of all sensors is transmitted via the network to all controls. Furthermore it may be provided that every hub of the network (preferably also every control) reports regularly about its overall status, with it particularly being possible to transmit in the network the status signals “OK”, “ALARM”, or “DEFECT”. 
         [0031]    A certain further development of the method according to the invention provided in particular that the output is compared, i.e. the output signals of the sensors. This may occur preferably in every control, with them being aware of the output of all sensors within the scope of a certain embodiment of the invention. The selection of the “correct” value, i.e. the value of the respective sensor considered for the execution of the control algorithm, can occur by forming a median, preferably not by calculating an average value, because here any outliers outside a certain range of values are preferably ignored. 
         [0032]    Furthermore, it may be provided that in case of severe deviations of the sensor values (outliers) an ALARM-message is issued to the pilot. 
         [0033]    A particularly advantageous further development of the method according to the invention provides that the controls each calculate an output (the actuating variable) for several actuators or even for all of them, and preferably also send respective output signals to at least one of the actuators, to all actuators, or also to all network participants. 
         [0034]    Furthermore it may be provided that the controls compare their respective output with the output of the other controls. In a further development of this aspect it may also be provided that for the own actuator, i.e. the actuator physically or structurally allocated to a control, the selection of the “correct” value (actuating variable) occurs by forming the median, particularly not (calculating) the average value, from the own output and the output of the other controls. 
         [0035]    In this context it may be even provided that no paired, fixed allocation is provided of controls and actuators, but that every actuator, by forming the median, selects and/or determines a respective actuating variable from the output of several controls. In this context it is necessary that the actuator itself is provided with the respective intelligence in order to perform the above-described comparison and the selection, for example by providing an appropriate (micro) processor for the actuator or actuators. 
         [0036]    Another further development of the invention provides that in case of severe deviations (outliers) of the output values (actuating variables) an ALARM-message is issued, particularly to the pilot. Such a message may be issued acoustically and/or optically. 
         [0037]    In addition to the mere issuance of such an ALARM-message it may optionally be provided that the freedom of action of the pilot is limited by respective control commands within the system, for example the rate of inclining or declining, when an ALARM-message has been issued. 
         [0038]    Within the scope of a respective further development of the system according to the invention it comprises a “central” display device, which however acts preferably as a mere receiving terminal and is embodied with at least one redundancy. This central display is also connected to the network and provided with the appropriate knowledge regarding the entire data traffic within the network. 
         [0039]    In an appropriate embodiment the display is capable by a comparison of the data to permanently perform plausibility checks, and in case of alarm messages received also displaying said ALARM. In this context the display must be embodied with sufficient “intelligence”, for example by providing at least one suitable (micro) processor. 
         [0040]    Within the scope of the discussed plausibility checks it may be provided that the display can send to the pilot data and/or status signals only in case of a consistent data status, i.e. when all sensors, controls, and/or actuators transmit data and/or status signals, which are compatible within predetermined limits for a regular flight operation, and thus signaling “green light” for the release of the multicopter for flight operation. 
         [0041]    During the flight it may be provided in a respective further development that when an inconsistency is given or when at least one ALARM message has been issued, the display prompts the pilot to land immediately. As already mentioned, the display itself is only a receiving terminal, no “voter” according to prior art. This means that the malfunction of the display itself has generally no influence upon the overall system and/or the flight behavior of the multicopter. 
         [0042]    In order to operate the multicopter preferably operating elements are provided for operation by the pilot. As already mentioned, they may be embodied for example as joysticks or control sticks, as switches, and as displays, particularly also comprising a touchscreen function. Preferably all of these operating elements are provided in several versions and embodied redundantly. In case of a joystick this means for example that it comprises several redundant sensors per axis. 
         [0043]    According to a preferred embodiment of the invention the output of all operating elements is transmitted to all network components and is here rendered available as a signal to be potentially considered. This way it is possible to decentrally evaluate all operating specifications of the pilot (user input) within the system. 
         [0044]    In order to even further increase the operating safety of the aircraft it may be provided that a start and/or lifting off is only possible when a plurality, preferably all components of the system report a regular status signal (“OK”) and the entire data situation is consistent, as defined above. 
         [0045]    As a typical example for the above-described circumstance reference is made to a decentral control, which “knows” that there are two redundant start buttons. The above-mentioned control also knows the charging status of all batteries as well as the operating state of all other controls. Accordingly it may be provided that the corresponding motor, and thus also all other motors, can only be started when the control and/or the motor detects that both start buttons report the status “start”, all controls transmit the status signal “OK”, all batteries are charged by at least 80%, and all joystick and switch values are consistent. 
         [0046]    With regards to particularly the operating elements joystick/control stick and/or switch, with it here being possible for the pilot to opt for the active joystick, the following further development according to the invention may be provided such: The above-mentioned switch is embodied with triple redundancy, and here the respective joystick is selected for which at least two or even three switches are consistent in their output signals. From this selected joystick then respectively the median per joystick parameter (e.g., left/right or up/down) is selected for control and/or adjustment purposes. 
         [0047]    The method of forming the median for selecting values is applied within the scope of certain embodiments of the present invention for the following reason: The median formation filters out in a simple fashion any “outliers” and particularly flawed values. When forming averages, however, particularly in case of few values considered, even a single error can lead to a severe deviation of the average. Example: five values (1, 1, 2, 1, 200 (=false value)); the median is 1, the average is however 41. 
         [0048]    In case of a “sufficiently great number” of values (&lt;&lt;100), individual outliers are also “smoothened out” in the average. Additionally or alternatively it is also common, for example to ignore the respective maximum or minimum. Within the scope of the present invention usually a “small” number of values is given, though, for example maximally 18 or even only three or five. The number of values per decision finding process may also vary temporarily, for example due to data loss within the network, which can be detected by determining test sums (for example CRC), when temporarily only three instead of five values are available, for example. The median solves this problem in an elegant fashion and is therefore very error-tolerant; additionally, due to the small numbers of existing values it can be easily calculated, which otherwise would lead in case of a large increase in values to a disadvantage, because the values for forming the median must be arranged in an increasing order, thus must be sorted. 
         [0049]    Within the scope of a respective further development of the invention it may be provided that for the formation of the median the definition of median as applicable for cardinally scaled measurements may be used, according to which in case of an even number of values the median is selected as the arithmetic average of the two central elements so that for example for median values 11 and 13 the value 12 results as the median. 
         [0050]    The above-discussed joystick or control stick is particularly critical in its treatment, because in a typical multicopter only “few of them” are provided, for example two or maximally three. Accordingly, the sensors in the joystick are preferably embodied with redundancy, for example three sensors per axis. The joystick itself communicates preferably all three sensor values to the network, and the median formation occurs in a respective further development of the invention in a decentralized fashion, connected to the preferably automatic triggering of alarms in case of deviations, as described. 
         [0051]    A selection can be made between the individual joysticks by also redundant switches and/or reversers, as also already described above. This way, all individual errors can be tolerated, only double-errors may potentially cause a problem. 
         [0052]    Otherwise, the error tolerance, realized within the scope of the invention in an appropriate embodiment, depends on the number of respectively available (sensor) values according to the following table: 
         [0000]                                    For one value   Error tolerance 0       For two   Error tolerance identical to median       values       For three   Error tolerance 1       values       For four   Error tolerance 1 or 2 (depending on the direction of the       values   deviation)       For five   Error tolerance 2 or 3 (depending on the direction of the       values   deviation)       For seven   Error tolerance at least 3       values       . . .   . . .                    
Within the scope of the invention the above-stated explanations are not limited to the joystick, which is only mentioned as an example, but can also be implemented for all operating elements, which yield respective operating parameters.
 
         [0053]    The network, within the scope of the present invention called failsafe network, can be embodied according to an appropriate further development of the invention with several redundancies. 
         [0054]    In general, for the practical embodiment of the network at least three different solutions are suitable: for example the network may include several parallel buses, e.g., three CAN busses. Alternatively several, redundantly embodied networks may be provided, for example three Ethernet networks with one switch or reverser each. A preferred embodiment of the invention provides that the network is embodied as an interlinked network (mesh network). A potential particular embodiment of such a mesh network is a two-dimensional torus, which shows no central element (in the form of a switch or the like). In a 2D-torus the individual network hubs are (theoretically) arranged in the form of an array of lines and columns, with the hubs in each line and/or column being connected to each other from one neighbor to the next. The last hub in each line and/or column is then in turn connected to the first hub of the respective line/column. 
         [0055]    For example, this way 25 hubs can be arranged in a grid with five columns and five lines, with during operation quasi an arbitrary number, maximally four, hubs in the same line or column may fail without this interrupting the communication within the network. 
         [0056]    Within the scope of a respective embodiment of the network each network hub comprises four connections to neighboring hubs. Within the scope of another further development of the invention based on this it may be provided that from the above-mentioned four connections two of them are used only for input signals and two only for output signals, in order to allow implementing the network in a simple fashion by an optic or electric transmission, which then accordingly provides only unidirectional connections. 
         [0057]    Another preferred further development of the invention provides that within the network only data and/or data combined to data packages are forwarded, if their so-called hop count (in particular according to the number of network hubs that have already forwarded an individual data package) has not yet exceeded a predetermined threshold, so that data packages are not endlessly circulating within the network. Additionally or alternatively it may also be provided that such data or data packages, which originate in a presently forwarding hub, are no longer forwarded by this hub. In this context it may be provided that a list of already visited hubs is added to every data package so that a recipient, who is already stated in the above-mentioned list, abstains from forwarding the respective data package. 
         [0058]    Another further development of the invention provides that a rate limitation is implemented for each sender (network hub), in order to prevent that the network is overloaded by a particularly active network hub. 
         [0059]    In this context it may be provided that the (direct) neighbors of the above-mentioned active hub remember the time and/or number of the most recent n data packages, with n being a predetermined integer. In the event that here a predetermined limit is exceeded, the respective data and/or data packages are discarded and an ALARM status is indicated. 
         [0060]    Within the scope of another further development of the invention it may also be provided that certain hubs, this means some or even all of them, act as information collection sites (“data brokers”). This way it can be implemented that not all data packages are immediately forwarded, but that the respective hub collects the corresponding data, such as sensor values, in a table and advantageously forwards it in a regular cycle. This is advantageous in that then a lower number of data packages needs to be forwarded within the network. 
         [0061]    Alternatively it may be provided that data incoming at the respective hub is immediately forwarded if it is newer than the data already included in the table. This is discernible e.g., from the time stamp of the data generator. 
         [0062]    A particularly advantageous implementation within the scope of the present invention provides that the system and/or aircraft comprises particularly 18 rotors, with each rotor being equipped with a separate electric motor, separate battery, and separate electronic control. Here, nine rotors spin clockwise, while another nine rotors spin counter-clockwise. The above-mentioned system furthermore comprises 18 control units (controls), which are respectively equipped with separate sensors for the decisive flight parameters. The operating elements are here particularly trice redundant joysticks provided with the above-mentioned switches. Furthermore, the exemplary system and/or aircraft comprise a twice redundant central display, and the network is equipped with optic transmission similar to a 2D-torus, which connects all components to each other. 
         [0063]    This way a particularly secure and reliable flight operation can be ensured particularly in an aircraft according to DE 20 2012 001 750 U1, with its disclosed content, particularly with regards to the mechanic-constructive design of a multicopter, being included here by way of reference. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0064]    Additional advantageous embodiments of the invention are discernible from the claims, particularly the dependent claims, as well as from the following description of exemplary embodiments based on the drawing. 
           [0065]      FIG. 1  shows schematically a control with a motor controller, motor, and propeller; 
           [0066]      FIG. 2  shows schematically the elements of  FIG. 1 , with the control and motor controller connected separately to the network; 
           [0067]      FIG. 3  shows schematically the detailed design of a motor controller, for example of  FIG. 1 ; 
           [0068]      FIG. 4  shows schematically a design of the sensor unit connected to the network; 
           [0069]      FIG. 5  shows schematically the detailed design of a control; 
           [0070]      FIG. 6  shows schematically the network interfaces in a control and/or micro-controller connected to the network; 
           [0071]      FIG. 7  shows schematically the design of an operating unit with a display; 
           [0072]      FIG. 8  shows schematically the design of an operating unit without a display; 
           [0073]      FIG. 9  shows schematically the design of the network in the form of a 2D-torus with a multicopter with 16 rotors and 16 controls; 
           [0074]      FIG. 10  shows a network similar to  FIG. 9 , however for a multicopter with twelve rotors and five controls; 
           [0075]      FIG. 11  shows essential elements of a control algorithm for a multicopter in the form of a flow chart; 
           [0076]      FIG. 12  shows the essential elements of a control algorithm for a multicopter in the case of a decentralized realization; 
           [0077]      FIG. 13  shows schematically an example for a median formation in a subset of sensors and controls; and 
           [0078]      FIG. 14  shows the error tolerance during the median formation based on a table. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0079]      FIG. 1  shows schematically a control with a motor controller for the use in a control system according to the invention for a multicopter, with the latter not being shown explicitly, here. For potential concrete physical-mechanical embodiments of a multicopter reference is made to the above-mentioned DE 20 2012 001 750 U1, particularly with regards to the arrangement of the propellers, the embodiment of the support system, the cockpit, and the like. 
         [0080]    In the present case, the reference character  1  indicates as an example the electric motor in the form of a brushless DC-motor, with a propeller  3  being mounted on its shaft (motor axis)  2 . According to common understanding of the present application the motor  1  (with the shaft  2 ) and the propeller  3  form a rotor  4 . 
         [0081]    A multicopter comprises accordingly several such rotors  4 , with the rotors  4  and/or the propellers  3  showing a fixed angle of arrangements, and thus they are not adjustable. This was pointed out in detail in the introductory part of the description. In order to control the multicopter only the respective motor speeds of the motors  1  are changed, which has also already been pointed out above. 
         [0082]    According to  FIG. 1  the motor  1  is connected to a motor controller  5 , which motor controller  5  actuates the motor  1 . The motor controller  5  received the respective control data (actuating variables) from a control  7  in the form of a micro-controller via a bus connection  6 , in the present case a CAN-bus. The control  7  is connected to a network  8 , which in  FIG. 1  is symbolized by respective inputs I 1 , I 2  and outputs O 1 , O 2 . The control  7  accordingly functions as a network hub and comprises two inputs I 1 , I 2  and two outputs O 1 , O 2 . The embodiment of the network  8  is discussed in greater detail in the following. 
         [0083]    As already discernible from  FIG. 1 , the network  8  is designed as a network for unidirectional transmission, i.e. each network connection of the control  7  functions either as an input or as an output. 
         [0084]    As already discussed, the control (or the control unit)  7  is embodied as a microcontroller, which accordingly includes a processor unit (CPU) and an appropriate memory unit (RAM) and (ROM), which are not explicitly displayed in  FIG. 1  but known per se to one trained in the art. The control  7  may this way be embodied, particularly in a program-controlled fashion, to execute certain control algorithms for actuating the motor controller  5 , in order to accordingly influence the motor  1  and thus the motor speeds and/or the speeds of the propeller  3  for the purpose of controlling the multicopter in the manner described. 
         [0085]      FIG. 2  shows an alternative arrangement of the elements of  FIG. 1 , with here and in the following identical or identically functioning elements respectively being marked with the same reference characters. 
         [0086]    According to  FIG. 2  the controls  7  are arranged separated from the motor controller  5  and respectively connected separately to the network  8 . Accordingly, the motor controller  5  shows its own inputs I 1 ′, I 2 ′ and its own outputs O 1 ′, O 2 ′. 
         [0087]    The motor controller  5  according to  FIG. 2  therefore receives the respective actuating signals concerned in a different fashion than in  FIG. 1 , not directly by the control  7  via a separated bus connection but via the network  8  from the control  7  shown or from another control within the network  8 , which has already been pointed out. 
         [0088]      FIG. 3  shows once more in detail the exemplary design of a motor controller  5 . 
         [0089]    The motor  1  is again embodied as a brushless direct current motor and comprises, according to  FIG. 3 , a sensor, in particular a Hall sensor  1   a , for providing information about the rotary speeds. The Hall sensor  1   a  is connected to a microcontroller  5   a  included in the motor controller  5 , which motor controller  5   a  furthermore comprises a CPU, RAM, and ROM, as well as digital and analog inputs/outputs, which design is known to one skilled in the art. Additionally the microcontroller  5   a  comprises a CAN-bus interface (cf.  FIG. 1 ). As discernible for one skilled in the art, the motor controller  5  in  FIG. 3  may also be embodied for a use shown in  FIG. 2 , and comprise the interfaces required, here. 
         [0090]    Furthermore, the motor controller  5  also comprises transistors  5   b  in the form of MOSFETs, which are connected to respective control outputs of the microcontroller  5   a  and in turn serve to actuate the motor  1  in order to influence its rotary speeds. 
         [0091]      FIG. 4  shows in detail the design of a sensor unit for a control system according to the invention of a multicopter. In  FIG. 4  the sensor unit in its entirety is marked with the reference character  9 . It comprises a microcontroller  9   a  integrated in the network  8  in a design known per se comprising CPU, RAM, and ROM, as well as the necessary network interfaces, which are not explicitly marked in detail in  FIG. 4 . Furthermore the sensor unit  9  comprises for example three sensors, namely a position sensor  9   b , a yaw rate sensor  9   c , as well as an acceleration sensor  9   d . The connection from and/or to the sensors  9   b ,  9   c ,  9   d  occurs for example via I2C, i.e. a special serial data bus, which is primarily used inside the device for the communication between various parts of the circuit, for example between a controller and peripheral integrated circuits. The sensors  9   b - d  provide data in three spatial directions (x/y/z-axes) regarding the yaw rate (sensor  9   c ), acceleration ( 9   d ), and position (sensor  9   b ), for example via GPS or magnetically like a compass. 
         [0092]      FIG. 5  shows in detail the design of the control for the control system of a multicopter, for example the control  7  according to  FIG. 1  or  FIG. 2 . As already discussed, the control  7  comprises a microcontroller with CPU, RAM, and ROM. Furthermore, the control  7  and/or the microcontroller also comprise digital serial interfaces, which may be realized via electronic circuits in the form of UART (universal asynchronous receiver transmitter). For this purpose, the above-mentioned CAN-bus and/or a IC2-bus are also included, particularly for communicating with the sensor units  9  according to  FIG. 4 . 
         [0093]    A voltage supply for the control  7  is also shown in  FIG. 5 , at the reference character  10 , which is preferably embodied in the form of a battery. Advantageously, a separate power and/or voltage supply  10  is provided for each arrangement comprising control  7 , motor controller  5 , and motor  1 . 
         [0094]      FIG. 6  once more discusses in greater detail the above-mentioned network interfaces with a microcontroller, for example the microcontroller of the control  7  according to  FIG. 5 . 
         [0095]    In  FIG. 6  the above-discussed microcontroller is explicitly marked with the reference character  7   a . It comprises the above-mentioned UART-circuits, with here it being differentiated between transmitting (TX) and receiving (RX). Accordingly the above-mentioned circuits are marked TX-UART  1 / 2  and RX-UART  1 / 2 , respectively comprising the inputs/outputs I 1 , I 2  and/or O 1 , O 2  marked in  FIG. 1  or  2 . 
         [0096]    According to  FIG. 6  the microcontroller  7   a  shown is embodied particularly for the connection to an optic network and accordingly also comprises respective optic-electric converters  7   b  in the area of the network interfaces, in order to convert electric signals generated by the microcontroller  7   a  into optic signal and vice versa. 
         [0097]      FIG. 7  shows an operating unit for the use in the control system of a multicopter, with said operating unit overall being marked with the reference character  11 . According to  FIG. 7  the operating unit  11  comprises a separate microcontroller  11   a  with CPU, RAM, and ROM, and again four network connections I 1 , I 2  and/or O 1 , O 2 . The microcontroller  11   a  is effectively connected with regards to signal technology to a graphic display  11   b , in order to address it. The display  11   b  can also include operating functions, for example like a touchscreen, however in general it only functions as a receiving terminal in order to display to the pilot for example an operating state of the multicopter. 
         [0098]    Furthermore, the microcontroller  11   b  is also connected with regards to signal technology to a control stick (joystick)  11   c  and a switch lld so that it can receive respective input from the joystick  11   c  and the switch  11   d.    
         [0099]    As already discernible from reading the introductory part of the description, the operating unit  11  is not limited in any way to the concrete embodiment shown here. In particular, several joysticks  11   c  and several switches lld may be connected to the microcontroller lla in order to select an active joystick by an appropriate activation of the switches. 
         [0100]      FIG. 8  shows an alternative embodiment of the operating unit  11 , in which the display  11   b  is not directly connected to the microcontroller  11   a , but is only effectively connected to the microcontroller  11   a  “indirectly” via the network  8 . Otherwise, reference is made to the explanations regarding  FIG. 7 . 
         [0101]      FIG. 9  shows a potential configuration of the network  8  and the principle arrangement of the logical elements provided therein (network hubs) based on a control system for a multicopter with 16 rotors and controls. 
         [0102]    The units comprising motors and controls, for example see  FIG. 1 , are marked with “M/R” in  FIG. 9  and require no detailed identification. The letter “S” marks seven sensor units, the letter “B” represents two operating units; all of the above-mentioned units (M/R, B, S) are connected in a network  8  like a unidirectional 2D-torus, with each of the network hubs M/R, B, S comprising two signal inputs and two signal outputs. The overall  25  network hubs are (theoretically) arranged in the form of a 5×5 matrix, which accordingly comprise five lines and five columns. Within each line, every network hub is connected from the left to the right with its respectively next neighbor, with the last hub of each line being connected to the first hub of the respective line. The same applies accordingly for each column, as shown in  FIG. 9 . The network  8  developing is particularly failsafe, due to the plurality and redundant signal connections, which has already been pointed out. 
         [0103]    As already mentioned, in the embodiment of  FIG. 9  the units “M/R” are embodied preferably according to the illustration in  FIG. 1 . The sensor units “S” may be embodied according to the illustration in  FIG. 4 . Furthermore, the operating units “B” may particularly be embodied according to  FIG. 7 . Of course it is also possible to separate the actual operating unit from the displays, see  FIG. 8 . With regards to the other network hubs, the embodiment according to  FIG. 9  is not limited to the embodiments according to the above-described  FIGS. 1 to 8 . 
         [0104]      FIG. 10  shows an alternative embodiment of the network  8 , comprising twelve units of motors and corresponding motor controls, which are marked “M/C” in  FIG. 10 , which may be equivalent to the embodiment in the right part of  FIG. 2 . The controls are here separated therefrom and marked with “R” in  FIG. 10 . The arrangement according to  FIG. 10  comprises fiver such controls R. 
         [0105]    Furthermore, the embodiment according to  FIG. 10  also comprises two operating units, which once more are marked “B”, as well as six sensor units “S”. The arrangement overall occurs once more like a 2D-torus. 
         [0106]    As easily discernible for one skilled in the art the present invention is not limited in any way to the exemplarily described embodiments according to  FIGS. 9 and 10 , particularly with regards to the number of motors, controls, sensors, and operating units. 
         [0107]      FIG. 11  shows essential elements of a control algorithm in the form of a flow chart, as preferably executed in every control of the control system according to the invention, see reference characters  7  and/or R in the above-explained figures. 
         [0108]    Essential elements of the discussed control algorithm include the detection of the sensor data in step S 1 , which sensor data subsequently being subjected to filtration in step S 2 ,for example using the Kalman filter mentioned here as an example. This and other suitable filtration methods are known to one trained in the art. In another processing step S 3  the conversion of the pilot control instructions, entered by a pilot, occurs via the operating elements into the respective target specifications, which target specifications in step S 4  being compared within the scope of a target-actual comparison with the filtered sensor data of Step S 2 . Furthermore, in step S 4  a calculation of the required lift occurs. Subsequently, in step S 5  the calculation of the rotary speed occurs for a corresponding rotor or, within the scope of an appropriate further development, for several or all existing rotors. Subsequently, in step S 6  the target rotary speed is issued like an actuating variable to the respective motor controller or controllers. 
         [0109]    The above-mentioned target specifications particularly include the desired flight speed, flight height, and flight direction. The control itself can occur with the use of standard processes known, for example using digital PID-controls. 
         [0110]      FIG. 12  shows, based on a flow chart, an alternative, decentralized control algorithm and/or its essential elements as an example for a decentral realization. Here, a “controller  1 ” shows the sensor data in step S 1 ′ and performs in step S 2 ′ the filtration explained based on  FIG. 11 . The sensor data filtered out of it is forwarded at the reference character S via network communication to a “controller  2 ”, which in step S 3 ′ and/or S 4 ′ is responsible for the above-described conversion of the pilot control instruction into target specifications and the target-actual comparison for the purpose of calculating the required lift. The data resulting therefrom is forwarded via additional network communication S 7  to a “controller  3 ”, which then in step S 5 ′ performs the calculation of the rotary speed and in step S 6 ′ performs the issuance of the target rotary speed to the motor controller or controllers. 
         [0111]      FIG. 13  shows schematically the formation of the median in a subset of sensors and controls, with in the upper section of  FIG. 13  three sensors S 1 , S 2 , S 3  and three controls R 1 , R 2 , R 3  being shown. Furthermore a motor controller M/R is shown. The dot-dash arrows mark only the flow of information within the network, not necessarily the direct technical signal connection. The continuously marked arrow symbolizes the electric connection between the motor controller M/C and the motor  1 . The above-mentioned motor  1  is in turn a part of a rotor  4  and drives via a shaft  2  a propeller  3 . 
         [0112]    The lower part of  FIG. 13  shows in the form of a table respectively a fictitious output of the sensors S 1 -S 3 , the median of the respective sensor values, the output of the rotary speeds of the controls R 1 -R 3 , the median of the motor speed, as well as an illustration in the display regarding the various points of time T 1  to T 4 . 
         [0113]    At the time T 1  all three sensors S 1 -S 3  provide a correct value, however slightly varying due to measurement imprecisions. The formation of the median occurs decentralized in all controls R 1 -R 3  with the same result, namely the value  11 . All three controls R 1 -R 3  calculate therefrom the same target rotary speed  300  for the motor  1 . The motor controller M/C uses the median therefrom, also  300 , and accordingly actuates the motor  1 . 
         [0114]    At the time T 2  the sensor S 3  is defective and provides a false value ( 200 ), which however is within the permitted range of values. By the formation of the median this false value is ignored, however. All three controls R 1 -R 3  calculate  320  as the target rotary speed, and the motor  1  is accordingly actuated. 
         [0115]    At the time T 3  the control R 2  also fails, for example due to an unnoticed RAM-malfunction. The formation of the median of the sensor values yields  18 , including in the defective control R 2 . The calculation of the rotary speed in the controls R 1  and R 3  results consistently in the value  340 . In the control R 2  the RAM-error falsifies the value to  999 . The motor controller M/C forms the value  340  as the median of the rotary speed, so that the motor  1  can still be correctly actuated. 
         [0116]    The central display, cf. for example  FIG. 7  or  8 , monitors the sensor values and rotary speeds, and checks them for plausibility. Brief deviations are preferably filtered out. However, if the values remain implausible over a certain period of time, i.e. they deviate from the median by more than 15% for more than two successive points of time, an alarm is triggered. In the present example this is reached for the sensor values at the time T 4 , and at the time T 5  (not shown) also for the value of the rotary speed. 
         [0117]    Preferably, in the present example the median definition for cardinally scaled parameters is used, according to which in case of an even number of values the median is calculated as the arithmetic average of the two central elements. For example, the values 11 and 13 result in a median value of 12. 
         [0118]    In  FIG. 14  it is finally shown that the median formation yields a good error tolerance even in a very small number of measurements, with in the table according to  FIG. 14  flawed values are marked (f). For example, in case of a number of only seven measurements, here three flawed values can already be tolerated, as illustrated in the last line of the table in  FIG. 14 . 
       LIST OF REFERENCE CHARACTERS  
       [0000]    
       
           1  motor 
           2  shaft 
           3  propeller 
           4  rotor 
           5  motor controller 
           6  CAN-bus 
           7  control, control unit 
           7   a  microcontroller 
           7   b  optic-electric converter 
           8  network 
           9  sensor unit 
           9   b  sensor 
           9   c  sensor 
           9   d  sensor 
           10  voltage supply, power supply 
           11  operating unit 
           11   a  microcontroller 
           11   b  graphic display 
           11   c  joystick, operating element 
           11   d  switch 
         M/R motor-control unit 
         M/C motor controller 
         B operating unit 
         R control 
         R 1  control 
         R 2  control 
         R 3  control 
         S sensor unit 
         S 1  sensor 
         S 2  sensor 
         S 3  sensor 
         I 1  input 
         I 2  input 
         O 1  output 
         O 2  output