Safety disaster recovery system based on flight control

Abstract

The present invention discloses a safety disaster recovery system based on flight control. The system first constructs three independent flight control units through heterogeneous computing resources, and deploys the flight control units in different positions to achieve spatial redundancy protection, avoiding single point failure causing system crash; each flight control unit transmits heartbeat signals and control instructions in real time through a redundant communication network; the main control system runs a hierarchical switching algorithm to achieve smooth transition output of instructions under redundant control, and simultaneously reports the fault status; the output of the parachute opening instruction integrates the fault status issued by the flight control and the fault status of the parachute-specific sensor, and is voted on uniformly by a voter. The present invention has high fault tolerance and can significantly reduce the probability of synchronous failure; the dual CAN bus redundant network reduces the bit error rate and communication delay; it can achieve seamless switching and ensure state continuity; the parachute opening control is reliable and fast, and can avoid premature / late parachute opening caused by single-node misjudgment.

Description

Technical Field

[0001] The present invention belongs to the technical field of disaster recovery of a flight control system (FCS) for a heavy-load aircraft, and in particular relates to a safety disaster recovery system based on flight control. Background Art

[0002] With the development of urban air mobility (UAM) and heavy-lift logistics drones, existing flight control systems have significant deficiencies in reliability, redundancy, and emergency response. Single flight control systems (such as CN111338377A) lack redundancy and present a high risk of single-point failure. A typical example is the Boeing 737 MAX loss of control caused by a single sensor failure. Traditional dual-redundancy architectures (such as CN106774367A) utilize homogeneous hardware, which carries the risk of systemic failure. For example, the Airbus A330 experienced a common-mode failure that caused the simultaneous failure of all three flight control computers. Furthermore, excessive software logic coupling led to frequent misjudgments of attitude angles between the primary and backup systems in strong crosswinds. Emergency parachute control systems (such as CN111338377A) rely on a single flight control command trigger, resulting in a high false trigger rate in complex urban airflow (e.g., a pressure sensor failure caused by turbulence could lead to the parachute deploying inadvertently). Furthermore, they lack multimodal data fusion capabilities. These deficiencies have severely hampered the commercialization of urban low-altitude logistics and manned eVTOLs. Summary of the Invention

[0003] The present invention aims to address the system disaster recovery issues of heavy-load aircraft, especially manned aircraft. By utilizing a three-controller non-similar redundant architecture, distributed location deployment, and intelligent switching algorithms, the flight control system achieves high disaster recovery reliability. Furthermore, a multi-channel linkage control mechanism with the parachute system is established to ensure safe parachute deployment in special circumstances. This comprehensive safety architecture, integrating non-similar hardware redundancy, physical location isolation, multi-level communication redundancy, a hierarchical switching algorithm, and coordinated emergency parachute deployment control, is proposed. This architecture is suitable for aircraft with stringent safety requirements, such as manned electric vertical take-off and landing (eVTOL) aircraft and hazardous materials transport drones.

[0004] In order to achieve the purpose of the present invention, the present invention discloses a safety disaster recovery system based on flight control. The system first constructs three independent flight control units through heterogeneous computing resources, and deploys the flight control units in different positions to achieve spatial redundancy protection to avoid single point failure causing system crash; each flight control unit transmits heartbeat signals and control instructions in real time through a redundant communication network; the main control system runs a hierarchical switching algorithm to achieve smooth transition output of instructions under redundant control, and at the same time reports the fault status; the output of the parachute opening instruction integrates the fault status issued by the flight control and the fault status of the parachute-specific sensor, and is voted on uniformly by a voter.

[0005] Furthermore, the system adopts a three-flight control hardware non-similar redundant architecture, where:

[0006] The A-core flight control is ARM Cortex-A7 + Xilinx Zynq UltraScale FPGA;

[0007] The M-core flight control is ARM Cortex-M7 + Microchip PolarFire FPGA;

[0008] The A / M hybrid core flight control is a dual ARM core heterogeneous collaborative Cortex-A8+Cortex-M4;

[0009] Through differentiated hardware design, basic computing power redundancy is established to provide heterogeneous computing resources for subsequent steps.

[0010] Furthermore, the system adopts a positional redundant deployment scheme, deploying flight control units in different spaces to ensure that regional failures will not cause cascading failures; the flight control units are distributed in the nose shield cabin, the fireproof compartment at the wing root or the root of the arm, and the independent cavity of the tail boom, with a spacing of 15%-25% of the fuselage length.

[0011] Furthermore, the communication redundant network adopts dual independent CAN buses deployed in parallel, and each node is equipped with dual CAN controllers and transceivers; a hybrid topology is adopted to optimize the quality and transmission delay of communication signals through repeaters; bus terminal matching resistors are used to suppress signal reflections, and optocoupler isolation is used to achieve electrical isolation between nodes; the cable uses double-shielded twisted pair cable, combined with magnetic ring filters to suppress common-mode interference.

[0012] Furthermore, the main control system runs a hierarchical switching algorithm, and through the sequential switching of A→B→C, ensures that the more reliable flight control is adopted each time to achieve safe disaster recovery of flight control switching; when switching to flight control C as the main flight control, it continuously monitors the recovery status of flight control A / B to ensure that the main flight control C still has a backup flight control at this time.

[0013] Furthermore, the fault switching logic adopts a hierarchical and progressive design, with the heartbeat signal as the core trigger condition. In the main switching logic, the main flight control A broadcasts an encrypted heartbeat packet. If two consecutive heartbeats are lost, the first-level backup flight control B immediately takes over control and starts sending heartbeats. If the heartbeat of flight control B also experiences an abnormality, the second-level backup flight control C takes over. During the takeover process, the backup flight control dynamically fuses and outputs the instructions of the first five cycles of the cache with real-time sensor data to ensure a smooth transition of instructions. The recovery detection module continuously detects the recovery status of flight control A / B: if the heartbeat of any node returns to normal after flight control C also fails, the system switches back to the flight control with a higher priority and re-enters the main logic loop. If all nodes fail, the ultimate fault alarm is triggered and the emergency response is initiated.

[0014] Redundant flight controllers achieve clock synchronization through handshaking; the primary flight controller A broadcasts an encrypted heartbeat packet every 20ms, containing a timestamp, control instructions, and power status; the primary backup flight controller B continuously monitors A's heartbeat packet. If it loses two consecutive heartbeat packets, it immediately initiates a control takeover request; the secondary backup flight controller C normally monitors B's heartbeat packet. When B is upgraded to the primary controller, it switches to directly monitoring B and takes over control if it detects its heartbeat loss.

[0015] Furthermore, the hierarchical switching algorithm adopts a seamless switching guarantee mechanism. Specifically, the backup flight controller caches the control instructions of the main flight controller for the last five cycles (100ms) in real time, and when switching, the new and old data are integrated to complete the gradual transfer of control rights.

[0016] The control instruction cache format is:

[0017] First-order difference Δθ: stores the difference in control quantity between adjacent cycles, indicating the instantaneous rate of change of control instructions between adjacent timestamps;

[0018] Δθ k =θ(t k )-θ(t k-1 )(k=1,2,…,5)

[0019] Second-order difference Δ 2 θ: The change in the stored difference, reflecting the acceleration of the first-order difference, is used to capture sudden trend changes in high-dynamic maneuvers;

[0020] Δ 2 θ k =Δθ k -Δθ k-1 (t=2,3,…,5)

[0021] If the flight control command change rate is small (hover state, cruise state, low-speed climb / descent state), it is more direct to store the original θ value; if the command dynamics are drastic (maneuvering flight state, obstacle avoidance mission state), store the second-order difference Δ 2 θ compresses the data volume and highlights trends;

[0022] Historical data reverse synthesis formula:

[0023]

[0024] Where t0 is the earliest timestamp of the cache window, t5 is the latest timestamp of the cache window, and β is the dynamic correction coefficient (dimensionless, the value is related to the scene);

[0025] The fusion formula is:

[0026] θ out (t) = α(t)·θ cache (t)+(1-α(t))·θreal (t)

[0027] Where, cache interpolation instruction θ cache (t) Generates the value through cubic spline interpolation based on the historical data in the cache window; calculates the instruction θ in real time real (t), the backup flight control is independently calculated based on the current sensor data; the mixing weight α(t)∈[0,1], the dynamic weight coefficient that decays with time;

[0028] The weight decay function is:

[0029] Use an exponential decay curve to balance smoothness and response speed:

[0030]

[0031] Where t0 is the switching trigger time (such as the beginning of the 8th cycle), T transition is the total transition duration (5 cycles); when t=t0+T transition When α(t) = 0.05, it is considered that the decay is complete;

[0032] Table 1 Flight control switching cycle example

[0033]

[0034] The flight control switching cycle during the fusion process is shown in Table 1.

[0035] Furthermore, the parachute controller integrates three optocoupler isolated input channels, and flight control A / B / C sends parachute deployment commands through independent RS-422 links; the parachute controller adds a barometer and IMU dedicated to the parachute; through voting between the redundant flight control and dedicated sensors, if more than two commands require parachute deployment, the parachute deployment is triggered; the parachute deployment command is embedded with a CRC-32 checksum and timestamp to prevent errors caused by electromagnetic interference; a safety interlock function is added, and the parachute deployment function is unlocked when the GPS speed is <50m / s and the altitude is >100m.

[0036] Compared with the existing technology, the significant progress of the present invention is: 1) the fault tolerance capability of the whole system is greatly improved; non-similar redundant architecture: the heterogeneous design of the three flight control hardware combined with dual-channel isolation eliminates the risk of common mode failure, and the system function has a higher preservation rate under single-point failure; dual power supply redundancy: main power supply (DCDC step-down) + backup battery power supply mode to ensure continuous power supply capability under extreme working conditions; improved space anti-destruction capability: the flight control modules are placed in the nose, wing root, and tail boom isolation cabins, combined with a carbon fiber shielding layer (60dB attenuation) and a six-degree-of-freedom vibration isolation platform to greatly reduce the probability of synchronization failure; 2) breakthroughs in communication real-time and stability; dual CAN bus redundant network: reduced bit errors through hybrid topology, repeater expansion and double-shielded cable design rate and communication delay; 3) Seamless switching and state continuity guarantee; Clock synchronization correction: A high-precision clock synchronization module is used to ensure the timing consistency of multiple flight control commands and avoid logical conflicts; Hierarchical heartbeat detection: The main flight control broadcasts an encrypted heartbeat packet every 20ms, and the backup flight control uses incremental command caching and interpolation algorithms to achieve smooth command transition when switching control rights; Sequential switching strategy: Avoids the residual state of the faulty flight control from contaminating the backup system; 4) High reliability and fast response of parachute opening control; The optocoupler isolated input channel (HCPL-072L) and RS-422 independent link design integrate the main flight control command priority and the backup flight control status confidence, dynamically optimizes the parachute opening trigger threshold, and avoids premature / late parachute opening caused by single-node misjudgment.

[0037] In order to more clearly illustrate the functional characteristics and structural parameters of the present invention, further description is given below with reference to the accompanying drawings and specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0039] Figure 1 This is a schematic diagram of the overall architecture of a safety disaster recovery system based on flight control;

[0040] Figure 2 It is a hierarchical heartbeat detection and switching flow chart. DETAILED DESCRIPTION

[0041] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0042] like Figure 1 As shown, Figure 1 This is the overall system architecture diagram, revealing the flight control-based safety and disaster recovery system architecture, including hardware redundancy, location redundancy, communication redundancy, a hierarchical switching algorithm, and a parachute control voting mechanism. Its core processes encompass hardware redundancy, dynamic switching, and emergency protection mechanisms. The system first utilizes heterogeneous computing resources to construct three independent flight control units, deploying them in different locations to achieve spatial redundancy and prevent single-point failures from causing system crashes. Each flight control unit transmits heartbeat signals and control commands in real time via a redundant communication network. The main control system executes a hierarchical switching algorithm to achieve smooth transition output of commands under redundant control and simultaneously reports fault conditions. The parachute deployment command output integrates the fault conditions signaled by the flight control unit with those of the parachute-specific sensors, and is then voted on by a voting machine.

[0043] like Figure 2 As shown, Figure 2 This is a hierarchical heartbeat detection and switchover flow chart, which primarily describes the switchover logic between the three redundant flight controllers. By sequentially switching from A to B to C, the more reliable flight controller is always selected, achieving safe and disaster-tolerant flight controller switching. When flight controller C is switched to the primary flight controller, the recovery status of flight controllers A and B is continuously monitored to ensure that the primary flight controller C still has a backup flight controller.

[0044] The system's fault switching logic employs a hierarchical and progressive design, with heartbeat signals as the core trigger condition. In the primary switching logic, primary flight controller A broadcasts an encrypted heartbeat packet. If two consecutive heartbeats are lost, the primary backup flight controller B immediately takes over control and begins sending heartbeats. If flight controller B also experiences a heartbeat anomaly, the secondary backup flight controller C takes over. During the takeover process, the backup flight controller dynamically fuses and outputs instructions based on the first five cached cycles (generated via cubic spline interpolation) with real-time sensor data to ensure a smooth transition of instructions. The recovery detection module continuously monitors the recovery status of flight controllers A and B. If flight controller C also fails, if the heartbeat of any node returns to normal, the system switches back to the higher-priority flight controller and re-enters the main logic loop. If all nodes fail, a final fault alarm is triggered and an emergency response (such as voting on parachute deployment instructions) is initiated.

[0045] Example

[0046] The present invention proposes a flight control system implementation method that deeply integrates a multi-level redundant architecture with a dynamic coordination mechanism. Through the comprehensive application of heterogeneous hardware, spatial anti-interference deployment and intelligent fault-tolerant algorithms, a full-dimensional fault-tolerant system covering hardware, data, environment and communication is constructed. The system adopts A / M hybrid core flight control (ARM Cortex-A / M series processors and FPGA collaboration) to achieve hierarchical scheduling of computing power, combined with parallel power supply of main and standby power supplies and spatial redundant deployment to ensure high availability at the physical level. At the communication level, a hybrid topology network based on dual independent CAN buses is combined with optical coupling isolation and double-shielded cables to form a redundant transmission channel that is resistant to electromagnetic interference, and seamless switching between the main and standby flight control is achieved through an incremental cache mechanism and a cubic spline interpolation algorithm. The emergency module builds a multi-level protection barrier through redundant instruction voting (CRC-32 check + UTC timestamp) of three optical coupling isolation input channels and safety interlock conditions (GPS speed <50m / s and altitude >100m) to ensure reliable parachute opening response under abnormal conditions. This solution innovatively integrates hardware heterogeneous dynamic scheduling, spatial anti-interference optimization, and data-driven fault tolerance to provide comprehensive reliability assurance for drone control in highly dynamic and highly interfering scenarios. The details are as follows:

[0047] 1. Three flight control hardware non-similar redundant architecture

[0048] Heterogeneous hardware configuration:

[0049] A-core flight control: ARM Cortex-A7 + Xilinx Zynq UltraScale FPGA

[0050] M-core flight control: ARM Cortex-M7 + Microchip PolarFire FPGA

[0051] A / M hybrid core flight control: dual ARM core heterogeneous collaboration (Cortex-A8 + Cortex-M4)

[0052] Each flight control unit reports its health status in real time (such as heartbeat signal, computing load rate, and sensor checksum). A watchdog circuit detects processor failures, and Kalman filter residual analysis detects control deviation anomalies.

[0053] 2. Power supply method

[0054] The main and backup power supplies are connected in parallel. The main power supply is a high-voltage battery that outputs 5V / 3.3V through a DCDC step-down module. The backup power supply uses an independently configured lithium thionyl chloride battery and supports 72 hours of standby.

[0055] 3. Location Redundancy Deployment Solution

[0056] Redundant flight controls are deployed in the nose shielded compartment, the wing root (or arm root) fireproof compartment, and the independent tail boom cavity, spaced 15%-25% of the fuselage length apart to minimize the impact of spatial failures. This creates a three-dimensional physical barrier to prevent regional failures from triggering cascading failures.

[0057] Anti-interference: Semiconductor cooling element (TEC1-12706) and PTC heating film work together to control temperature, covering a temperature range of -55°C to 105°C; orthogonal wiring + double-layer shielded cable (tinned copper mesh + aluminum foil) reduces electromagnetic crosstalk.

[0058] 4. Communication redundant network architecture

[0059] Dual independent CAN buses (primary bus and redundant bus) are deployed in parallel, and each node is equipped with dual CAN controllers (STM32F4 series chips) and transceivers (SN65HVD230DR); a hybrid topology (star and bus) is adopted, and the quality and transmission delay of communication signals are optimized through repeaters (CTM1051KT); bus terminal matching resistors are used to suppress signal reflections, and optocoupler isolation (HCPL-072L) is used to achieve electrical isolation between nodes; the cable uses double-shielded twisted pair (outer layer tinned copper mesh + aluminum foil), combined with magnetic ring filters to suppress common-mode interference.

[0060] 5. Flight control hierarchical switching

[0061] Redundant flight controllers achieve clock synchronization through handshaking. The primary flight controller (A) broadcasts an encrypted heartbeat packet every 20ms, containing a timestamp, control commands, and power status. The primary backup (B) continuously monitors A's heartbeat packets and, if they are lost twice in a row (with a 40ms timeout), immediately initiates a control takeover request. The secondary backup (C) normally monitors B's heartbeat packets. When B becomes the primary controller, it directly monitors B and takes control if it detects a heartbeat loss.

[0062] Seamless switching guarantee mechanism: The backup flight control system caches the control instructions of the main flight control system for the last five cycles (100ms) in real time, and a smooth transition is performed based on the cubic spline interpolation algorithm during switching.

[0063] 1) Incremental cache type

[0064] First-order difference (Δθ): stores the difference in control values between adjacent cycles, such as Δθ(t) = θ(t) - θ(tT). Second-order difference (Δ 2 θ): stores the change in the difference, such as Δ 2 θ(t)=Δθ(t)-Δθ(tT)

[0065] If the flight control command change rate is small (such as hovering state), it is more direct to store the original θ value; if the command dynamics are drastic (such as maneuvering flight), store the second-order difference Δ 2θ can compress the data volume and highlight trends.

[0066] 2) Historical data reverse synthesis formula

[0067]

[0068] t0: the earliest timestamp of the cache window;

[0069] t5: The latest timestamp of the cache window.

[0070] β: dynamic correction coefficient (dimensionless, value depends on the scenario).

[0071] 3) Fusion formula

[0072] θ out (t) = α(t)·θ cache (t)+(1-α(t))·θ real (t)

[0073] Cache interpolation instructions: θ cache (t), generated by cubic spline interpolation based on historical data in the cache window;

[0074] Real-time calculation instructions: θ real (t), the backup flight control is independently calculated based on the current sensor data;

[0075] Mixing weight: α(t)∈[0,1], a dynamic weight coefficient that decays over time.

[0076] 4) Weight decay function

[0077] Use an exponential decay curve to balance smoothness and response speed:

[0078]

[0079] t0: Switching trigger time (such as the beginning of the 8th cycle);

[0080] T transition : Total transition duration (5 cycles);

[0081] When t=t0+T transition When α(t)=0.05 (considered as decay completion).

[0082] 5) Fusion process:

[0083] Table 1 Flight control switching cycle example

[0084]

[0085] 6. Parachute opening coordinated control

[0086] The parachute controller integrates three optocoupler-isolated input channels, and flight controllers A / B / C send parachute deployment commands via independent RS-422 links. The parachute controller also adds a barometer and IMU dedicated to the parachute. Through voting between the redundant flight controller and dedicated sensors, parachute deployment is triggered if more than two commands require it. The parachute deployment command is embedded with a CRC-32 checksum and timestamp (synchronized with UTC) to prevent errors caused by electromagnetic interference. A safety interlock function has been added to unlock the parachute deployment function when the GPS speed is <50m / s and the altitude is >100m.

[0087] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0088] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A safety disaster recovery system based on flight control, characterized in that: The system first uses heterogeneous computing resources to build three independent flight control units, deploying them in different locations to achieve spatial redundancy and prevent single-point failures from causing system crashes. Each flight control unit transmits heartbeat signals and control commands in real time via a redundant communication network. The main control system runs a hierarchical switching algorithm to achieve smooth transition output of commands under redundant control and simultaneously report fault conditions. The output of the parachute deployment command integrates the fault conditions issued by the flight control and the fault conditions of the parachute-specific sensors, and is voted on uniformly by a voter. The main control system runs a hierarchical switching algorithm, switching from A to B to C in sequence, ensuring that the more reliable flight control is adopted each time, achieving safe disaster recovery for flight control switching. The fault switching logic adopts a hierarchical and progressive design, with the heartbeat signal as the core trigger condition. The hierarchical switching algorithm uses a seamless switching guarantee mechanism. Specifically, the backup flight controller caches the control instructions of the main flight controller in the last five cycles in real time, and when switching, it integrates the new and old data to complete the gradual transfer of control rights. The control instruction cache format is: First-order difference Δθ: stores the difference in control quantity between adjacent cycles, indicating the instantaneous rate of change of control instructions between adjacent timestamps; Dth k =θ(t k )-θ(t k-1 ),k=1,2,…,5 Second-order difference Δ 2 θ: The change in the stored difference, reflecting the acceleration of the first-order difference, is used to capture sudden trend changes in high-dynamic maneuvers; D 2 i k =Δθ k -Dth k-1 ,k=2,3,…,5 If the flight control command change rate is small, it is more direct to store the original θ value; if the command dynamics are drastic, store the second-order difference Δ 2 θ compresses the data volume and highlights trends; Historical data reverse synthesis formula: Where t0 is the earliest timestamp of the cache window, t5 is the latest timestamp of the cache window, and β is the dynamic correction coefficient; The fusion formula is: i out (t)=α(t)·θ cache (t)+(1-α(t))·θ real (t) Where, cache interpolation instruction θ cache (t) Generates the value through cubic spline interpolation based on the historical data in the cache window; calculates the instruction θ in real time real (t), the backup flight control is independently calculated based on the current sensor data; the mixing weight α(t)∈[0,1], the dynamic weight coefficient that decays with time; The weight decay function is: Use an exponential decay curve to balance smoothness and response speed: Where t0 is the switching trigger time, T transition is the total transition time; when t=t0+T transition When α(t) = 0.05, the decay is considered complete.

2. A flight control-based safety disaster recovery system according to claim 1, characterized in that: The system adopts a three-flight control hardware non-similar redundant architecture, including: The A-core flight control is ARM Cortex-A7 + Xilinx Zynq UltraScale FPGA; The M-core flight control is ARM Cortex-M7 + Microchip PolarFire FPGA; The A / M hybrid core flight control is a dual ARM core heterogeneous collaborative Cortex-A8+Cortex-M4; Through differentiated hardware design, basic computing power redundancy is established to provide heterogeneous computing resources for subsequent steps.

3. The flight control-based safety disaster recovery system according to claim 1, characterized in that: The system adopts a positional redundant deployment scheme, deploying flight control units in different spaces to ensure that regional failures will not cause cascading failures; the flight control units are distributed in the nose shielded cabin, the fireproof compartment at the wing root or the root of the arm, and the independent cavity of the tail boom, with a spacing of 15%-25% of the fuselage length.

4. The flight control-based safety disaster recovery system according to claim 1, characterized in that: The communication redundant network uses dual independent CAN buses deployed in parallel, with each node equipped with dual CAN controllers and transceivers. A hybrid topology is adopted, and repeaters are used to optimize the quality and transmission delay of communication signals. Bus terminal matching resistors are used to suppress signal reflections, and optocoupler isolation is used to achieve electrical isolation between nodes. The cable uses double-shielded twisted pair cable, combined with a magnetic ring filter to suppress common-mode interference.

5. The flight control-based safety disaster recovery system according to claim 1, characterized in that: When switching to flight control C as the main flight control, continuously monitor the recovery of flight control A / B to ensure that the main flight control C still has a backup flight control.

6. A flight control-based safety disaster recovery system according to claim 5, characterized in that: In the master switching logic, the primary flight controller A broadcasts an encrypted heartbeat packet. If two consecutive heartbeats are lost, the primary backup flight controller B immediately takes over control and starts sending heartbeats. If the flight controller B also experiences a heartbeat anomaly, the secondary backup flight controller C takes over. During the takeover process, the backup flight control system dynamically fuses and outputs the instructions of the first five cached cycles with real-time sensor data to ensure a smooth transition of instructions. The recovery detection module continuously monitors the recovery status of flight controllers A and B. If flight controller C also fails, if the heartbeat of any node returns to normal, the system switches back to the flight controller with a higher priority and re-enters the main logic loop. If all nodes fail, a final fault alarm is triggered and an emergency response is initiated. Redundant flight controllers achieve clock synchronization through handshaking; the primary flight controller A broadcasts an encrypted heartbeat packet every 20ms, containing a timestamp, control instructions, and power status; the primary backup flight controller B continuously monitors A's heartbeat packet. If it loses two consecutive heartbeat packets, it immediately initiates a control takeover request; the secondary backup flight controller C normally monitors B's heartbeat packet. When B is upgraded to the primary controller, it switches to directly monitoring B and takes over control if it detects its heartbeat loss.

7. The flight control-based safety disaster recovery system according to claim 1, characterized in that: The parachute controller integrates three optocoupler-isolated input channels, and flight controllers A / B / C send parachute deployment commands via independent RS-422 links. The parachute controller also incorporates a barometer and IMU dedicated to the parachute. Through voting between the redundant flight controllers and dedicated sensors, parachute deployment is triggered if more than two commands request it. The deployment command embeds a CRC-32 checksum and timestamp to prevent errors caused by electromagnetic interference. A safety interlock function has been added to unlock the parachute deployment function when the GPS speed is <50m / s and the altitude is >100m.

Images