Redundant architecture unmanned aerial vehicle brake control system and brake control method

Abstract

The invention discloses an unmanned aerial vehicle brake control system and a brake control method of a redundant architecture. The system comprises an arbitration circuit board, a double-circuit power supply board, a first control board and a second control board, wherein the first control board and the second control board are backup for each other. The two control panels are in communication connection with the flight control computer and used for collecting wheel speed and brake pressure signals, receiving target brake pressure, generating brake pressure control quantity through a control algorithm, converting the brake pressure control quantity into brake current signals and outputting the brake current signals to the brake driving device when receiving corresponding enable signals. A main power supply module and an auxiliary power supply module are arranged in the two-way power supply board to supply redundant power to the system. The arbitration circuit board is electrically connected with the power board and the two control boards, monitors the working states of the control boards and the power state, outputs a first enable signal or a second enable signal according to the monitoring result, and controls the corresponding control boards to output brake current signals. According to the invention, full-link hardware redundancy from power supply, communication, control panel to arbitration is realized, and the reliability and safety of the brake control system are remarkably improved.

Description

Technical Field

[0001] This invention belongs to the field of unmanned aerial vehicle (UAV) technology, and more specifically, relates to a redundant architecture UAV braking control system and braking control method. Background Technology

[0002] With the increasing application of drones in logistics delivery, environmental monitoring, military reconnaissance, and industrial inspection, takeoff and landing safety has become one of the key technological bottlenecks restricting the large-scale commercial application of drones. As the core actuator during the ground taxiing phase of a drone, the reliability and stability of the braking control system are directly related to flight safety. Once a malfunction occurs, it may lead to brake lock-up or failure, which in turn may cause serious accidents such as tire blowout, runway deviation, or even fuselage rollover.

[0003] Currently, most UAV braking control systems employ a single-redundancy architecture design. Specifically, typical implementations in existing technologies include: a single-channel mode with a single control acquisition board, single-bus communication, and single power supply; a partial redundancy mode using a single control board integrating dual microcontrollers (MCUs); or a communication redundancy mode using a single control board with dual communication buses. However, none of these solutions achieve full-link redundancy coverage from power supply, signal acquisition, control computation to execution drive, and still suffer from the following technical shortcomings: First, the risk of single-point failure is high. In a single-control-board architecture, once the control board hardware fails, the entire braking system will directly lose its controllability. Even with a single-board dual-MCU mode, if the common circuits on the control board (such as power conversion circuits, signal acquisition circuits, and drive output circuits) fail, the system still cannot maintain normal operation.

[0004] Second, power supply reliability is insufficient. In existing systems, if only a single power supply module is used, if that module stops outputting due to faults such as overvoltage, overcurrent, or short circuit, the entire controller will face the risk of power failure, resulting in the loss of braking function. Even with dual power supplies, there is a lack of rapid fault isolation and seamless switching mechanisms.

[0005] Third, the switching mechanism is unreliable. Some solutions use a software watchdog timer to achieve primary / standby switching, but the software watchdog itself depends on the normal operation of the microcontroller unit. In the event of a software crash or program malfunction, the watchdog timer may fail to trigger the switching in time, causing the system to enter a state of no output. In addition, software switching usually has a millisecond-level delay, making it difficult to achieve a smooth switching between primary and standby control boards.

[0006] Fourth, insufficient communication redundancy. Most existing systems use single-channel bus communication. When the communication bus experiences an open circuit, interference, or a bus controller failure, the flight control computer cannot send control commands to the brake controller, causing braking failure. Even if dual-channel communication exists, it is usually integrated only on the same control board, failing to achieve complete cross-redundancy with dual control boards.

[0007] In summary, existing UAV braking control systems have significant shortcomings in terms of redundancy design, fault isolation, and switching reliability, making it difficult to meet the requirements of high-safety-level application scenarios. Therefore, there is an urgent need to design a highly reliable braking control system with full-link redundancy and independent hardware arbitration capabilities, capable of achieving microsecond-level seamless switching in the event of a single point of failure, ensuring continuous availability of the braking function. Summary of the Invention

[0008] The purpose of this invention is to propose a redundant architecture for UAV braking control system and braking control method, which solves the technical problems of existing UAV braking control systems, such as high risk of single point of failure, insufficient power reliability, large switching delay and susceptibility to software failure, and incomplete communication redundancy, due to the lack of full-link redundancy and reliance on software switching mechanisms. It achieves full-link hardware redundancy from power supply, communication, control board to arbitration, and realizes microsecond-level seamless switching through an independent hardware arbitration circuit that does not rely on software, significantly improving the reliability and safety of the braking control system.

[0009] To achieve the above objectives, in a first aspect, the present invention proposes a redundant architecture-based UAV braking control system, comprising: Arbitration circuit board, dual power supply board, and first and second control boards that serve as backups for each other; The first control board and the second control board are respectively connected to the flight control computer for communication, and both are configured as follows: Collect signals from wheel speed sensor and brake pressure sensor; Receive the target braking pressure sent by the flight control computer; Based on the wheel speed sensor signal, the brake pressure sensor signal, and the target brake pressure, a brake pressure control quantity is generated through a control algorithm. In addition, the brake pressure control quantity is converted into a brake current signal, and the brake current signal is output to the brake drive device when the corresponding enable signal is received; The dual-power supply board has a built-in main power module and a secondary power module, which are used to provide redundant power to the arbitration circuit board, the first control board and the second control board. The arbitration circuit board is electrically connected to the dual-power supply board, the first control board, and the second control board, respectively, and is used to monitor the working status of the first control board and the second control board, and output a first enable signal or a second enable signal according to the monitoring results; and to monitor the power status of the dual-power supply board. The first enable signal is sent to the first control board to control it to output the brake current signal, and the second enable signal is sent to the second control board to control it to output the brake current signal.

[0010] Optionally, the first control board integrates a first communication channel and a second communication channel, and the second control board integrates a third communication channel and a fourth communication channel; The first communication channel, the second communication channel, the third communication channel, and the fourth communication channel are all connected to the same external connector interface; The flight control computer is connected to the external connector interface, and then establishes bidirectional redundant data communication with the first control board and / or the second control board through the first communication channel, the second communication channel, the third communication channel and the fourth communication channel.

[0011] Optionally, both the first control board and the second control board include: The microcontroller unit includes a first analog-to-digital converter, a first conditioning circuit, a second analog-to-digital converter, a second conditioning circuit, a digital-to-analog converter, a voltage-to-current conversion circuit, a first bus transceiver, a second bus transceiver, a fault status input circuit, an enable signal input circuit, and a heartbeat signal generation circuit. The microcontroller unit is electrically connected to the first analog-to-digital converter, the second analog-to-digital converter, the digital-to-analog converter, the first bus transceiver, the second bus transceiver, the fault status input circuit, the enable signal input circuit, and the heartbeat signal generation circuit, respectively. The input terminal of the first conditioning circuit is connected to the wheel speed sensor, and its output terminal is connected to the first analog-to-digital converter; The input of the second conditioning circuit is connected to the brake pressure sensor, and its output is connected to the second analog-to-digital converter. The input terminal of the voltage-to-current conversion circuit is connected to the digital-to-analog converter, and its output terminal is connected to the brake drive device. The input terminal of the fault status input circuit is connected to the dual-power supply board; The input terminal of the enable signal input circuit is connected to the arbitration circuit board; The output of the heartbeat signal generation circuit is connected to the arbitration circuit board. In the first control board, the first bus transceiver constitutes the first communication channel, and the second bus transceiver constitutes the second communication channel; in the second control board, the first bus transceiver constitutes the third communication channel, and the second bus transceiver constitutes the fourth communication channel.

[0012] Optionally, the dual-power supply board includes: Power input interface, first EMI filter circuit, second EMI filter circuit, first DC / DC module, second DC / DC module, Oring circuit and power status output circuit; The first EMI filter circuit and the first DC / DC module together constitute the main power supply module, and the second EMI filter circuit and the second DC / DC module together constitute the auxiliary power supply module. The power input interface is connected to the input terminals of the first EMI filter circuit and the second EMI filter circuit, respectively. The output terminal of the first EMI filter circuit is connected to the input terminal of the first DC / DC module, and the output terminal of the second EMI filter circuit is connected to the input terminal of the second DC / DC module. The output terminals of the first DC / DC module and the second DC / DC module are both connected to the input terminal of the Oring circuit; The Oring circuit is used to realize parallel redundant power supply of the main power module and the auxiliary power module, and has the function of automatically isolating faulty power supply. The input terminal of the power status output circuit is connected to the Oring circuit and is used to monitor the working status of the dual power supply board in real time. When the main power module or the auxiliary power module fails, the power status output circuit sends the corresponding fault status signal to the arbitration circuit board.

[0013] Optionally, the arbitration circuit board includes: First control board interface, second control board interface, power status signal input interface, first signal conditioning circuit, second signal conditioning circuit, first heartbeat detection circuit, second heartbeat detection circuit, power status monitoring circuit, and fault logic voting circuit; The input terminal of the first control board interface is connected to the first control board, and its output terminal is connected to the input terminal of the first signal conditioning circuit. The output terminal of the first signal conditioning circuit is connected to the input terminal of the first heartbeat detection circuit; The input terminal of the second control board interface is connected to the second control board, and its output terminal is connected to the input terminal of the second signal conditioning circuit. The output of the second signal conditioning circuit is connected to the input of the second heartbeat detection circuit; The input terminal of the power status signal input interface is connected to the power status output circuit of the dual-power supply board, and its output terminal is connected to the input terminal of the power status monitoring circuit. The outputs of the first heartbeat detection circuit, the second heartbeat detection circuit, and the power status monitoring circuit are all connected to the input of the fault logic voting circuit. The first heartbeat detection circuit is used to monitor the heartbeat signal of the first control board and output the first monitoring result; The second heartbeat detection circuit is used to monitor the heartbeat signal of the second control board and output a second monitoring result; The power status monitoring circuit is used to monitor the working status of the dual-power supply board and output the power status monitoring results. The fault logic voting circuit is used to perform redundant logic judgment based on the monitoring results output by the first heartbeat detection circuit, the second heartbeat detection circuit and the power status monitoring circuit, and output the first enable signal, the second enable signal and the fault status signal. The fault status signal is forwarded to the flight control computer via the first control board and / or the second control board.

[0014] Optionally, the arbitration circuit board is configured as a secure arbitration unit based on pure hardware logic; The fault logic voting circuit consists of hardware logic gates, comparators, and flip-flops, and can realize real-time detection of the heartbeat signals of the first control board and the switching of the enable signal without relying on software program execution. When an abnormal heartbeat is detected on any control board, the fault logic voting circuit directly pulls down the enable signal of the corresponding control board and pulls up the enable signal of the other control board at the hardware level to achieve microsecond-level fault switching.

[0015] Optionally, the step of generating the brake pressure control quantity through a control algorithm based on the wheel speed sensor signal, the brake pressure sensor signal, and the target brake pressure includes: The slip ratio is calculated based on the wheel speed sensor signal, and pressure closed-loop control is performed based on the slip ratio, the brake pressure sensor signal, and the target brake pressure to generate the brake pressure control quantity.

[0016] In a second aspect, the present invention proposes a drone braking control method, applied to a drone braking control system with a redundant architecture as described in any one of the first aspects, comprising: After the system is powered on, the main power module and the auxiliary power module of the dual power supply board work simultaneously to supply power to the system; After initialization, the first control board and the second control board respectively send heartbeat signals to the arbitration circuit board; The arbitration circuit board monitors the heartbeat signals of the first control board and the second control board. If both are normal, one of them is selected as the main control board by default and outputs the corresponding first enable signal or second enable signal to enable the main control board to output the braking current signal. The other one is a backup control board in backup state and synchronizes the data of the main control board in real time. The main control board acquires wheel speed sensor signals and brake pressure sensor signals, receives target brake pressure sent by flight control computer, generates brake pressure control quantity based on wheel speed sensor signals, brake pressure sensor signals and target brake pressure, and converts brake pressure control quantity into brake current signal and outputs it to brake drive device. The arbitration circuit board continuously monitors the system. When it detects an abnormality or loss of the heartbeat signal from the main control board, it immediately switches the enable signal through hardware logic, cuts off the current output enable of the main control board, and simultaneously outputs an enable signal to the backup control board. The backup control board takes over the system control and continues to complete the braking task.

[0017] Optionally, when the heartbeat signal of the faulty control board returns to normal, the switched control board remains as the main control board until the current braking task is completed; only after the system enters standby mode and receives a reset command can the control be switched back to the original main control board or a new main control board be elected.

[0018] Optionally, when a single power module fails, the dual-power supply board automatically isolates the faulty branch through the Oring circuit of the dual-power supply board and the other power module assumes the entire load, achieving seamless switching of the output voltage. The power status output circuit of the dual-power supply board also reports the fault status information to the arbitration circuit board.

[0019] The beneficial effects of this invention are as follows: By setting up a first control board and a second control board that serve as backups for each other, a dual-power supply board with built-in main power module and auxiliary power module, and an arbitration circuit board electrically connected to the first control board, the second control board, and the dual-power supply board respectively, this invention achieves full-link hardware redundancy from power supply and control calculation to execution drive; the arbitration circuit board independently monitors the working status of the first control board and the second control board, as well as the power status of the dual-power supply board, and independently outputs a first enable signal or a second enable signal based on the monitoring results, realizing pure hardware fault detection and main / backup switching without relying on software programs, avoiding the switching failure problem caused by software watchdog due to software crashes or program crashes, and the switching time can reach the microsecond level, achieving a disturbance-free switching of the control board; the first control board The first and second control boards are respectively connected to the flight control computer and are both configured to collect wheel speed sensor signals and brake pressure sensor signals, receive target brake pressure, generate brake pressure control quantities, and convert them into brake current signal outputs. Combined with the enable signal control of the arbitration circuit board, it is ensured that the other control board can seamlessly take over when one control board fails, and the braking function remains available. The dual-power supply board has a built-in main power module and a secondary power module, which provide redundant power supply for the arbitration circuit board, the first control board, and the second control board. When a single power module fails, the other module can bear the entire load, achieving uninterrupted power supply. This significantly improves the reliability and safety of the UAV braking control system and effectively solves the technical problems of high single-point failure risk, insufficient power reliability, unreliable switching mechanism, and incomplete communication redundancy in the existing technology.

[0020] The system of the present invention has other features and advantages that will be apparent from or will be set forth in detail in the accompanying drawings and following detailed description, which together serve to explain the particular principles of the invention. Attached Figure Description

[0021] The above and other objects, features and advantages of the present invention will become more apparent from the accompanying drawings, in which like reference numerals generally denote like parts.

[0022] Figure 1 A schematic diagram of a drone braking control system with a redundant architecture according to Embodiment 1 of the present invention is shown.

[0023] Figure 2 A schematic diagram of a first control board and a second control board according to Embodiment 1 of the present invention is shown.

[0024] Figure 3 A schematic diagram of a dual-power supply board according to Embodiment 1 of the present invention is shown.

[0025] Figure 4 A schematic diagram of an arbitration circuit board according to Embodiment 1 of the present invention is shown.

[0026] Figure 5 A flowchart illustrating the steps of a drone braking control method according to Embodiment 2 of the present invention is shown. Detailed Implementation

[0027] The invention will now be described in more detail with reference to the accompanying drawings. While preferred embodiments of the invention are shown in the drawings, it should be understood that the invention can be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that the invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0028] Example 1

[0029] like Figure 1 As shown, this embodiment provides a redundant architecture drone braking control system, including: Arbitration circuit board, dual power supply board, and first and second control boards that serve as backups for each other; The first and second control boards are respectively connected to the flight control computer for communication, and both are configured as follows: Collect signals from wheel speed sensor and brake pressure sensor; Receive the target braking pressure sent by the flight control computer; Based on the wheel speed sensor signal, the brake pressure sensor signal, and the target brake pressure, a brake pressure control quantity is generated through a control algorithm. In addition, the brake pressure control quantity is converted into a brake current signal, and the brake current signal is output to the brake drive device when the corresponding enable signal is received; The dual-power supply board has a built-in main power module and a secondary power module, which are used to provide redundant power to the arbitration circuit board, the first control board and the second control board. The arbitration circuit board is electrically connected to the dual-power supply board, the first control board, and the second control board, respectively, and is used to monitor the working status of the first control board and the second control board, and output a first enable signal or a second enable signal according to the monitoring results; and to monitor the power status of the dual-power supply board. The first enable signal is sent to the first control board to control its output of the braking current signal, and the second enable signal is sent to the second control board to control its output of the braking current signal.

[0030] Specifically, this redundant architecture UAV braking control system mainly consists of three parts: an arbitration circuit board, a dual-power supply board, and a first control board and a second control board that serve as backups for each other. The first and second control boards are communicatively connected to the flight control computer to issue control commands and upload status data. Both control boards are configured with complete and equivalent functions: First, they acquire wheel speed sensor signals from the wheel speed sensor and brake pressure sensor from the brake pressure sensor to obtain real-time data on wheel speed and actual brake pressure; simultaneously, they receive the target brake pressure command sent by the flight control computer. Based on this, each control board generates a corresponding brake pressure control quantity using an internally integrated control algorithm, based on the acquired wheel speed sensor signals, brake pressure sensor signals, and the received target brake pressure. Then, this brake pressure control quantity is converted into a brake current signal. Finally, upon receiving the corresponding enable signal, the brake current signal is output to the brake drive device, thereby driving the actuator to complete the braking action. The dual-power supply board integrates a main power module and a secondary power module. These two modules operate in parallel, providing redundant power to the arbitration circuit board, the first control board, and the second control board. This ensures that if one power module fails, the other can seamlessly take over the entire load and maintain continuous system power. The arbitration circuit board is electrically connected to the dual-power supply board, the first control board, and the second control board, and undertakes the core responsibility of system safety monitoring: on one hand, it monitors the real-time operating status of the first and second control boards, including key indicators such as heartbeat signals and voltage health status; on the other hand, it simultaneously monitors the power status of the dual-power supply board, including whether the main and secondary power modules are functioning correctly. Based on these monitoring results, the arbitration circuit board performs redundant logic judgments and selectively outputs a first enable signal or a second enable signal. The first enable signal is sent to the first control board to control whether it outputs a braking current signal; the second enable signal is sent to the second control board to control whether it outputs a braking current signal. Through the above architecture, the system achieves full-link hardware redundancy from power supply and control calculation to drive output. The arbitration circuit board independently completes status monitoring and master / slave switching decisions, ensuring that the system can quickly and seamlessly switch to backup resources and maintain the continuous availability of braking function when any control board or power module fails.

[0031] In this embodiment, the first control board integrates a first communication channel and a second communication channel, and the second control board integrates a third communication channel and a fourth communication channel; The first communication channel, the second communication channel, the third communication channel, and the fourth communication channel are all connected to the same external connector interface; The flight control computer connects to the external connector interface and then establishes bidirectional redundant data communication with the first control board and / or the second control board through the first communication channel, the second communication channel, the third communication channel and the fourth communication channel.

[0032] Specifically, the first control board integrates a first communication channel and a second communication channel, while the second control board integrates a third communication channel and a fourth communication channel. The first and second communication channels belong to the first control board, while the third and fourth communication channels belong to the second control board. These four communication channels are physically independent, forming a quadruple-redundant communication bus architecture. All four communication channels are connected to the same external connector interface. This external connector interface serves as a unified physical interface between the system and an external flight control computer, converging the four communication channels in one place and simplifying external cable connections. The flight control computer connects to this external connector interface and then establishes bidirectional redundant data communication with the first and / or second control boards through the first, second, third, and fourth communication channels. Specifically, the flight control computer can transmit data with the first or second control board through any one or more communication channels. When one of the communication channels fails, the flight control computer can automatically switch to another normal communication channel to continue communicating with the corresponding control board. Simultaneously, when a control board fails, the flight control computer can obtain the fault status through the communication channel connected to the failed control board and establish communication with the health control board through the communication channel corresponding to another control board, ensuring that the issuance of control commands and the uploading of status data are not affected. Through this quadruple-redundant communication bus design, the system achieves complete redundancy of the communication links, significantly improving the reliability of data transmission. At the same time, by sharing external connector interfaces, system wiring is simplified, and the complexity of connectors is reduced.

[0033] In this embodiment, as Figure 2 As shown, both the first control board and the second control board include: The microcontroller unit includes a first analog-to-digital converter, a first conditioning circuit, a second analog-to-digital converter, a second conditioning circuit, a digital-to-analog converter, a voltage-to-current conversion circuit, a first bus transceiver, a second bus transceiver, a fault status input circuit, an enable signal input circuit, and a heartbeat signal generation circuit. The microcontroller unit is electrically connected to the first analog-to-digital converter, the second analog-to-digital converter, the digital-to-analog converter, the first bus transceiver, the second bus transceiver, the fault status input circuit, the enable signal input circuit, and the heartbeat signal generation circuit, respectively. The input of the first conditioning circuit is connected to the wheel speed sensor, and its output is connected to the first analog-to-digital converter. The input of the second conditioning circuit is connected to the brake pressure sensor, and its output is connected to the second analog-to-digital converter. The input of the voltage-to-current conversion circuit is connected to the digital-to-analog converter, and its output is connected to the brake drive device. The input terminal of the fault status input circuit is connected to the dual-power supply board; The input terminal of the enable signal input circuit is connected to the arbitration circuit board; The output of the heartbeat signal generation circuit is connected to the arbitration circuit board; In the first control board, the first bus transceiver constitutes the first communication channel, and the second bus transceiver constitutes the second communication channel; in the second control board, the first bus transceiver constitutes the third communication channel, and the second bus transceiver constitutes the fourth communication channel.

[0034] Specifically, the first and second control boards are completely identical in hardware architecture, both adopting a modular design. Each independently integrates a microcontroller unit, a first analog-to-digital converter (ADC), a first conditioning circuit, a second ADC, a second conditioning circuit, a digital-to-analog converter (DAC), a voltage-to-current conversion circuit, a first bus transceiver, a second bus transceiver, a fault status input circuit, an enable signal input circuit, and a heartbeat signal generation circuit. The microcontroller unit, as the core processor of the control board, is electrically connected to the first ADC, the second ADC, the DAC, the first bus transceiver, the second bus transceiver, the fault status input circuit, the enable signal input circuit, and the heartbeat signal generation circuit, respectively, enabling unified control and data interaction across all functional modules. At the signal acquisition front end, the input of the first conditioning circuit is connected to the wheel speed sensor to receive the raw signal output by the wheel speed sensor and perform preprocessing such as filtering, amplification, and level conversion on the signal. Its output is connected to the first analog-to-digital converter (ADC), which converts the conditioned analog wheel speed signal into a digital signal and sends it to the microcontroller unit (MCU). Similarly, the input of the second conditioning circuit is connected to the brake pressure sensor to receive the raw pressure signal output by the brake pressure sensor and perform preprocessing. Its output is connected to the second ADC, which converts the conditioned analog pressure signal into a digital signal and sends it to the MCU. At the control output back end, the input of the digital-to-analog converter (DAC) is connected to the MCU to receive the digital brake pressure control quantity calculated by the MCU and convert it into a corresponding analog voltage signal. The input of the voltage-to-current conversion circuit is connected to the DAC to receive the analog voltage signal and linearly convert it into a 4-20mA standard current signal. Its output is connected to the brake drive device, thereby precisely controlling the opening of the electro-hydraulic servo valve in a current loop drive mode to achieve high-precision adjustment of the brake pressure. Regarding the communication interface, the first bus transceiver and the second bus transceiver are electrically connected to the microcontroller unit, together forming a dual-redundant communication channel for the control board. Specifically, in the first control board, the first bus transceiver constitutes the first communication channel, and the second bus transceiver constitutes the second communication channel; in the second control board, the first bus transceiver constitutes the third communication channel, and the second bus transceiver constitutes the fourth communication channel. All four communication channels converge to the same external connector interface, establishing bidirectional redundant data communication with the flight control computer.In terms of status monitoring and arbitration interaction, the input terminal of the fault status input circuit is connected to the dual-power supply board to receive the power module fault status signal sent by the power supply board and transmit the signal to the microcontroller unit. The input terminal of the enable signal input circuit is connected to the arbitration circuit board to receive the first enable signal or the second enable signal sent by the arbitration circuit board. The microcontroller unit determines whether to allow drive output based on the status of the enable signal. The output terminal of the heartbeat signal generation circuit is connected to the arbitration circuit board to periodically generate a heartbeat signal representing the operating status of the control board and send it to the arbitration circuit board for real-time monitoring of whether the control board is working properly. Through the above circuit architecture, the first control board and the second control board each have complete signal acquisition, control calculation, drive output, communication interaction and status reporting capabilities, providing a solid hardware foundation for the system to achieve dual-redundancy hot backup and independent hardware arbitration.

[0035] In this embodiment, as Figure 3 As shown, the dual-power supply board includes: Power input interface, first EMI filter circuit, second EMI filter circuit, first DC / DC module, second DC / DC module, Oring circuit and power status output circuit; The first EMI filter circuit and the first DC / DC module together constitute the main power supply module, and the second EMI filter circuit and the second DC / DC module together constitute the auxiliary power supply module. The power input interface is connected to the input terminals of the first EMI filter circuit and the second EMI filter circuit, respectively. The output of the first EMI filter circuit is connected to the input of the first DC / DC module, and the output of the second EMI filter circuit is connected to the input of the second DC / DC module. The output terminals of both the first and second DC / DC modules are connected to the input terminal of the Oring circuit. The Oring circuit is used to realize parallel redundant power supply of the main power module and the auxiliary power module, and has the function of automatically isolating faulty power supply. The input of the power status output circuit is connected to the Oring circuit to monitor the working status of the dual-power supply board in real time. When the main power module or the auxiliary power module fails, the power status output circuit sends the corresponding fault status signal to the arbitration circuit board.

[0036] Specifically, the dual-power supply board, as the core of the system's energy supply, adopts a parallel redundant architecture design of main and auxiliary power modules. It includes a power input interface, a first EMI filter circuit, a second EMI filter circuit, a first DC / DC module, a second DC / DC module, an Oring circuit, and a power status output circuit. The first EMI filter circuit and the first DC / DC module together constitute the main power module, while the second EMI filter circuit and the second DC / DC module together constitute the auxiliary power module. The main and auxiliary power modules are physically independent and electrically isolated, forming two completely independent power supply paths. The power input interface serves as the access point for external power, connecting to the input terminals of both the first and second EMI filter circuits, simultaneously introducing external power into both the main and auxiliary power supply paths. The output terminal of the first EMI filter circuit connects to the input terminal of the first DC / DC module, filtering the input power for electromagnetic interference, suppressing common-mode and differential-mode interference, and providing surge protection and transient voltage suppression to ensure the first DC / DC module receives clean input power. Similarly, the output terminal of the second EMI filter circuit connects to the input terminal of the second DC / DC module, providing the same filtering and protection functions for the auxiliary power module. The first and second DC / DC modules convert the input DC voltage into the stable operating voltage required by the system (such as 5V, 3.3V, etc.), and output them to the input of the Oring circuit (also known as an "OR gate circuit" or "power redundancy combiner circuit," a hardware circuit used to realize parallel redundant power supply of multiple power sources). The Oring circuit consists of ideal diodes or high-performance power diodes. Its input receives the output voltages of the main power module and the auxiliary power module, respectively, and its output provides the final power supply voltage to the arbitration circuit board, the first control board, and the second control board. The core function of the Oring circuit is to realize parallel redundant power supply of the main power module and the auxiliary power module: under normal operation, the main power module and the auxiliary power module supply power to the load simultaneously, and both output current equally, sharing the load current; when any power module fails (such as input power failure, output overvoltage, output short circuit, or internal damage), the Oring circuit can automatically isolate the faulty branch, preventing the fault from flowing back to the other normal power module or affecting the load, and the other healthy power module seamlessly takes over the entire load current, realizing uninterrupted power supply. The switching process is completed autonomously by the hardware circuitry without software intervention, with a switching time in the microsecond range and no significant drop in output voltage. Simultaneously, the input of the power status output circuit is connected to the Oring circuit for real-time monitoring of the dual-power supply board's operating status, including whether the voltages of the main and auxiliary power modules are normal, and whether fault information such as overcurrent or short circuits has occurred. When a fault occurs in either the main or auxiliary power module, the power status output circuit immediately sends the corresponding fault status signal to the arbitration circuit board for system status recording and fault reporting.Through the above dual-redundant power supply architecture design, the dual power supply board significantly improves the reliability of the system power supply, ensuring that the system can continue to operate stably when a single power supply module fails, and providing a solid energy guarantee for the full-link redundancy of the entire braking control system.

[0037] In this embodiment, as Figure 4 As shown, the arbitration circuit board includes: First control board interface, second control board interface, power status signal input interface, first signal conditioning circuit, second signal conditioning circuit, first heartbeat detection circuit, second heartbeat detection circuit, power status monitoring circuit, and fault logic voting circuit; The input terminal of the first control board interface is connected to the first control board, and its output terminal is connected to the input terminal of the first signal conditioning circuit. The output of the first signal conditioning circuit is connected to the input of the first heartbeat detection circuit; The input terminal of the second control board interface is connected to the second control board, and its output terminal is connected to the input terminal of the second signal conditioning circuit. The output of the second signal conditioning circuit is connected to the input of the second heartbeat detection circuit; The input terminal of the power status signal input interface is connected to the power status output circuit of the dual-power supply board, and its output terminal is connected to the input terminal of the power status monitoring circuit. The outputs of the first heartbeat detection circuit, the second heartbeat detection circuit, and the power status monitoring circuit are all connected to the input of the fault logic voting circuit. The first heartbeat detection circuit is used to monitor the heartbeat signal of the first control board and output the first monitoring result; The second heartbeat detection circuit is used to monitor the heartbeat signal of the second control board and output a second monitoring result; The power status monitoring circuit is used to monitor the operating status of the dual-power supply board and output the power status monitoring results; The fault logic voting circuit is used to perform redundant logic judgment based on the monitoring results output by the first heartbeat detection circuit, the second heartbeat detection circuit and the power status monitoring circuit, and output the first enable signal, the second enable signal and the fault status signal. The fault status signal is forwarded to the flight control computer via the first control board and / or the second control board.

[0038] Specifically, the arbitration circuit board includes a first control board interface, a second control board interface, a power status signal input interface, a first signal conditioning circuit, a second signal conditioning circuit, a first heartbeat detection circuit, a second heartbeat detection circuit, a power status monitoring circuit, and a fault logic voting circuit.

[0039] The input terminal of the first control board interface is connected to the first control board to receive status information such as heartbeat signals, voltage detection signals, and fault status signals from the first control board. The output terminal of the first control board interface is connected to the input terminal of the first signal conditioning circuit, which performs preprocessing such as filtering, shaping, and level conversion on the received signals to eliminate noise interference and convert them into standardized signals suitable for subsequent circuit processing. The output terminal of the first signal conditioning circuit is connected to the input terminal of the first heartbeat detection circuit, which monitors in real time whether the heartbeat signal sent by the first control board exists and whether the frequency is normal, and combines it with the voltage detection signal to determine the health status of the first control board, finally outputting the first monitoring result.

[0040] Similarly, the input terminal of the second control board interface is connected to the second control board to receive heartbeat signals, voltage detection signals, and fault status signals from the second control board; the output terminal of the second control board interface is connected to the input terminal of the second signal conditioning circuit, and after signal conditioning, it is output to the second heartbeat detection circuit. The second heartbeat detection circuit is used to monitor the heartbeat signal and voltage status of the second control board in real time and output the second monitoring result.

[0041] The input terminal of the power status signal input interface is connected to the power status output circuit of the dual-power supply board. It is used to receive the working status signals of the main power module and the auxiliary power module sent by the power board, including key information such as whether the voltage is normal and whether a fault has occurred. The output terminal of the power status signal input interface is connected to the input terminal of the power status monitoring circuit. The power status monitoring circuit is used to analyze and judge the received power status signals and output the power status monitoring results.

[0042] The outputs of the first heartbeat detection circuit, the second heartbeat detection circuit, and the power status monitoring circuit are all connected to the input of the fault logic voting circuit, aggregating the first monitoring result, the second monitoring result, and the power status monitoring result obtained by each circuit to the fault logic voting circuit. The fault logic voting circuit consists of hardware logic gates, comparators, and RS flip-flops. It does not rely on software program execution; it only uses pure hardware logic to comprehensively judge the input monitoring results. When all monitoring results indicate that the system is normal, the fault logic voting circuit outputs an enable signal according to a preset master / standby strategy. For example, by default, it outputs the first enable signal to enable the first control board, while the second enable signal remains invalid. When the fault logic voting circuit determines, based on the first monitoring result fed back by the first heartbeat detection circuit, that the first control board has experienced a heartbeat loss, abnormal voltage, or program crash, it immediately pulls the first enable signal low at the hardware level and simultaneously pulls the second enable signal high, instantly completing the master / standby switch from the first control board to the second control board. Conversely, if the second control board fails, the opposite switching operation is performed. Simultaneously, when the power status monitoring circuit reports a power module fault, the fault logic voting circuit generates a corresponding fault status signal for system recording and reporting.

[0043] The fault logic voting circuit ultimately outputs a first enable signal, a second enable signal, and a fault status signal. The first enable signal is sent to the enable signal input circuit of the first control board to control whether the first control board outputs a braking current signal; the second enable signal is sent to the enable signal input circuit of the second control board to control whether the second control board outputs a braking current signal; and the fault status signal is forwarded to the flight control computer through the first and / or second control boards to achieve real-time monitoring and reporting of the system's health status.

[0044] In this embodiment, the arbitration circuit board is configured as a secure arbitration unit based on pure hardware logic; The fault logic voting circuit consists of hardware logic gates, comparators, and flip-flops, and can realize real-time detection of the heartbeat signals of the first control board and the switching of the enable signals of the second control board without relying on software program execution. When an abnormal heartbeat is detected on any control board, the fault logic voting circuit directly pulls down the enable signal of the corresponding control board and pulls up the enable signal of the other control board at the hardware level to achieve microsecond-level fault switching.

[0045] Specifically, the arbitration circuit board is configured as a security arbitration unit based on pure hardware logic. Its core design concept is to eliminate reliance on software programs and achieve fault detection and master / slave switching functions entirely through hardware circuits. Specifically, the fault logic voting circuit consists of hardware logic gates, comparators, and RS flip-flops. It can achieve real-time detection of the heartbeat signals of the first and second control boards and the switching of their enable signals without relying on software program execution. The comparator compares the received control board heartbeat signal with a preset normal threshold to determine whether the frequency and amplitude of the heartbeat signal are within the normal range. The hardware logic gates perform combinational logic operations on the comparison results output by the comparator to comprehensively determine the health status of the control board. The RS flip-flop latches the output state of the enable signal, ensuring that the enable signal can stably flip and remain in place when a fault occurs until the next switching event occurs.

[0046] During operation, the fault logic voting circuit continuously receives the first monitoring result from the first heartbeat detection circuit and the second monitoring result from the second heartbeat detection circuit. When the monitoring results show that the heartbeat signal of the current main control board is normal and the heartbeat signal of the backup control board is normal, the fault logic voting circuit maintains the existing enable signal output state unchanged. For example, it keeps the first enable signal in an active state to enable the first control board and the second enable signal in an inactive state to disable the second control board. When the fault logic voting circuit detects that the heartbeat signal of the current main control board is abnormal or lost, such as the heartbeat signal frequency of the first control board deviating from the normal range, the amplitude being too low, or the signal disappearing completely, the comparator immediately outputs a fault indication signal. The hardware logic gate instantly changes the combinational logic output state according to the fault indication signal, triggering the RS flip-flop to flip its state. At the hardware level, it directly pulls down the enable signal of the corresponding control board (i.e., the faulty first control board) and simultaneously pulls up the enable signal of the other control board (i.e., the backup second control board), instantly completing the switching between the first and second enable signals. Similarly, when the second control board, as the main control board, fails, the fault logic voting circuit performs the opposite switching operation.

[0047] The switching process is entirely autonomously completed by the hardware circuitry, without any software interrupt response, status polling, or program execution. Therefore, the switching latency depends only on the propagation delay of the hardware logic gates and the toggling time of the RS flip-flops, typically reaching the microsecond level. During the switching process, since both control boards are in hot backup mode and synchronize control parameters in real time, the backup control board can immediately output a braking current signal upon receiving the enable signal, achieving a seamless switching between the primary and backup control boards without fluctuations or interruptions in braking pressure. Through the above pure hardware logic design, the arbitration circuit board effectively avoids switching failures caused by software watchdog timers due to software crashes, program errors, or interrupt response delays. This significantly improves the real-time performance of fault detection and the reliability of switching actions, providing a solid hardware foundation for the high-safety redundancy architecture of the UAV braking control system.

[0048] In this embodiment, the brake pressure control quantity is generated by a control algorithm based on the wheel speed sensor signal, the brake pressure sensor signal, and the target brake pressure, including: The slip ratio is calculated based on the wheel speed sensor signal, and pressure closed-loop control is performed based on the slip ratio, brake pressure sensor signal and target brake pressure to generate the brake pressure control quantity.

[0049] Specifically, the process by which the control algorithm generates the brake pressure control quantity is as follows: First, the control board calculates the slip ratio based on the collected wheel speed sensor signals. The slip ratio is a key parameter characterizing the relative slippage between the wheels and the runway. Its calculation formula is: Slip Ratio = (Aircraft Ground Speed ​​- Wheel Linear Speed) / Aircraft Ground Speed. The aircraft ground speed can be obtained from the reference speed provided by the flight control computer, while the wheel linear speed is calculated from the rotational speed signal collected by the wheel speed sensor. By calculating the slip ratio in real time, the system can accurately determine whether the wheels are about to lock up. When the slip ratio exceeds the optimal slip ratio range (usually set between 10% and 20%), it indicates that the wheels may be entering a deep slip state, requiring a reduction in brake pressure to prevent lockup. When the slip ratio is too low, it indicates insufficient braking efficiency, requiring an increase in brake pressure to improve deceleration.

[0050] Based on the calculated slip ratio, the control board simultaneously acquires the actual pipeline pressure signal fed back by the brake pressure sensor and compares it with the target brake pressure command issued by the flight control computer to obtain the pressure deviation. The control algorithm adopts a slip ratio-pressure dual closed-loop control strategy: the outer slip ratio controller uses the target slip ratio as a given value and the currently calculated slip ratio as a feedback value, and dynamically adjusts the target pressure correction value of the inner pressure controller through a proportional-integral-derivative (PID) control algorithm; the inner pressure controller uses the corrected target pressure as a given value and the actual brake pressure sensor signal as a feedback value, and calculates the required brake pressure control amount in real time through a PID control algorithm. The dual closed-loop control structure enables the system to adaptively adjust the brake pressure under different runway conditions (such as dry runways, wet runways, and icy runways), making full use of the ground adhesion coefficient to achieve maximum braking efficiency while effectively preventing wheel lock-up.

[0051] By combining the slip ratio calculation with pressure closed-loop control, the control algorithm ultimately generates a precise brake pressure control quantity. This control quantity is output in digital form to a digital-to-analog converter, which converts it into a 4-20mA standard current signal via a voltage-to-current conversion circuit. This signal drives the electro-hydraulic servo valve to adjust the brake pressure, achieving high-precision and high-reliability control of the braking process during the UAV's landing roll.

[0052] In this embodiment, the specific workflow of the UAV braking control system is as follows: After the system is powered on, the main power module and the auxiliary power module of the dual-power supply board start working simultaneously. They are connected in parallel with redundant power supply via the Oring circuit, jointly providing stable power to the arbitration circuit board, the first control board, and the second control board. At this time, the main power module and the auxiliary power module are in a current-sharing state, sharing the load current. If either power module fails, the Oring circuit will automatically isolate the faulty branch, and the other healthy power module will seamlessly take over the entire load without any voltage drop, ensuring continuous and reliable power supply to the system.

[0053] After initialization, the first and second control boards send periodic heartbeat signals to the arbitration circuit board through their respective heartbeat signal generation circuits. These heartbeat signals characterize the operating status of the control boards, including key information such as whether the microcontroller is working properly and whether the program has crashed. The arbitration circuit board monitors the heartbeat signals sent by the two control boards in real time through the first and second heartbeat detection circuits. If the heartbeat signals of both control boards are normal, the fault logic voting circuit inside the arbitration circuit board outputs the corresponding first enable signal to the first control board according to the preset master / backup strategy (such as defaulting to selecting the first control board as the master control board), while keeping the second enable signal invalid. After receiving the first enable signal, the output stage circuit of the first control board is activated, and it has the authority to output the braking current signal; the second control board, as the backup control board, is in backup mode, synchronizing the control parameters of the first control board in real time (including braking pressure control amount, slip ratio, operating status, etc.) to ensure seamless continuation of the current control task when a switch occurs.

[0054] The enabled main control board (taking the first control board as an example) begins to execute the braking control task: First, it acquires wheel speed sensor signals through the first conditioning circuit and the first analog-to-digital converter, and acquires brake pressure sensor signals through the second conditioning circuit and the second analog-to-digital converter. At the same time, it receives the target brake pressure sent by the flight control computer through the communication bus. Then, the microcontroller calculates the slip ratio based on the wheel speed sensor signals, and combines the brake pressure sensor signals and the target brake pressure to run the slip ratio-pressure dual closed-loop control algorithm to generate a precise brake pressure control quantity. This control quantity is converted into an analog voltage signal by the digital-to-analog converter, and then converted into a 4-20mA standard current signal by the voltage-to-current conversion circuit. This current signal is then output as a brake current signal to the brake drive device (such as an electro-hydraulic servo valve), thereby achieving precise adjustment of the brake pressure.

[0055] Throughout the braking process, the arbitration circuit board continuously monitors the heartbeat signal of the main control board via the first heartbeat detection circuit. When an abnormality (such as frequency deviating from the normal range or amplitude being too low) or complete loss of the main control board's heartbeat signal is detected, the fault logic voting circuit immediately determines that the main control board has failed. Since the fault logic voting circuit consists of hardware logic gates, comparators, and RS flip-flops, it does not rely on any software program. This judgment and switching process is entirely autonomously completed by the hardware circuit: within microseconds, the fault logic voting circuit directly pulls down the enable signal corresponding to the current main control board, cutting off the output enable of the faulty board and causing its output stage circuit to enter a high-impedance state or a closed state; simultaneously, it pulls up the enable signal corresponding to the backup control board, activating the output permission of the backup control board. Because the backup control board is always in backup mode and synchronizes the control parameters of the main control board in real time, it can seamlessly continue the current braking task the instant it receives the enable signal, continuing to output the braking current signal to the brake drive device, achieving seamless switching between the main and backup control boards, and preventing fluctuations or interruptions in braking pressure.

[0056] Once the heartbeat signal of the faulty control board returns to normal, the system adopts a cautious control recovery strategy: before the current braking task is completed, the switched control board continues to execute the task as the main control board, without immediately switching back to the original control board, to avoid control disturbances caused by frequent switching during braking. Control is only allowed to be switched back to the original main control board or a new main control board will be elected based on the system status after the system enters standby mode (i.e., the current braking task has been completed and no new braking commands are waiting to be executed) and a reset command is received, ensuring the safety of the control switching process.

[0057] In terms of power management, the dual-power supply board continuously monitors the operating status of the main power module and the auxiliary power module. When a single power module fails (such as input power failure, overvoltage, overcurrent, or internal damage), the Oring circuit immediately and automatically isolates the faulty branch to prevent the fault from flowing back to the other normal power module or affecting the load. The other healthy power module seamlessly takes over the entire load current, achieving seamless switching of the output voltage. This process is completed autonomously by the hardware circuit, without any drop in output voltage, ensuring continuous and uninterrupted system power supply. Simultaneously, the power status output circuit reports the fault status information to the arbitration board in real time. The arbitration board records the fault status and forwards the fault information to the flight control computer through the first control board and / or the second control board, realizing real-time monitoring and reporting of the system's health status.

[0058] Through the above workflow, the system achieves full-link hardware redundancy from power supply and control calculation to drive output. In the event of a single point of failure, the arbitration circuit board independently completes fault detection and master / slave switching, ensuring that the UAV braking control system can continue to reliably complete the braking task under any single fault condition.

[0059] Example 2

[0060] like Figure 5 As shown, this embodiment provides a drone braking control method, applied to the drone braking control system with the redundant architecture described in Embodiment 1, including: S1. After the system is powered on, the main power module and the auxiliary power module of the dual power supply board work simultaneously to supply power to the system. After initialization, S2, the first control board and the second control board respectively send heartbeat signals to the arbitration circuit board; S3. The arbitration circuit board monitors the heartbeat signals of the first control board and the second control board. If both are normal, one of them is selected as the main control board by default and outputs the corresponding first enable signal or second enable signal to enable the main control board to output the braking current signal. The other one is used as a backup control board in backup state and synchronizes the data of the main control board in real time. S4. The main control board collects wheel speed sensor signals and brake pressure sensor signals, receives the target brake pressure sent by the flight control computer, generates a brake pressure control quantity based on the wheel speed sensor signals, brake pressure sensor signals and target brake pressure, and converts the brake pressure control quantity into a brake current signal and outputs it to the brake drive device. S5. The arbitration circuit board continuously monitors and, when it detects an abnormality or loss of the heartbeat signal from the main control board, immediately switches the enable signal through hardware logic, cuts off the current output enable of the main control board, and simultaneously outputs an enable signal to the backup control board. S6, the backup control board takes over the system control and continues to complete the braking task.

[0061] In this embodiment, when the heartbeat signal of the faulty control board returns to normal, the switched control board remains as the main control board until the current braking task is completed; only after the system enters standby mode and receives a reset command is the control switch back to the original main control board or a new main control board is elected.

[0062] In this embodiment, when a single power module fails, the dual-power supply board automatically isolates the faulty branch through the Oring circuit of the dual-power supply board and the other power module takes over the entire load, achieving seamless switching of the output voltage. The power status output circuit of the dual-power supply board also reports the fault status information to the arbitration circuit board.

[0063] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments.

Claims

1. A redundant architecture-based unmanned aerial vehicle (UAV) braking control system, characterized in that, include: Arbitration circuit board, dual power supply board, and first and second control boards that serve as backups for each other; The first control board and the second control board are respectively connected to the flight control computer for communication, and both are configured as follows: Collect signals from wheel speed sensor and brake pressure sensor; Receive the target braking pressure sent by the flight control computer; Based on the wheel speed sensor signal, the brake pressure sensor signal, and the target brake pressure, a brake pressure control quantity is generated through a control algorithm. In addition, the brake pressure control quantity is converted into a brake current signal, and the brake current signal is output to the brake drive device when the corresponding enable signal is received; The dual-power supply board has a built-in main power module and a secondary power module, which are used to provide redundant power to the arbitration circuit board, the first control board and the second control board. The arbitration circuit board is electrically connected to the dual-power supply board, the first control board, and the second control board, respectively, and is used to monitor the working status of the first control board and the second control board, and output a first enable signal or a second enable signal according to the monitoring results; and to monitor the power status of the dual-power supply board. The first enable signal is sent to the first control board to control it to output the brake current signal, and the second enable signal is sent to the second control board to control it to output the brake current signal.

2. The UAV braking control system with redundant architecture according to claim 1, characterized in that, The first control board integrates a first communication channel and a second communication channel, and the second control board integrates a third communication channel and a fourth communication channel; The first communication channel, the second communication channel, the third communication channel, and the fourth communication channel are all connected to the same external connector interface; The flight control computer is connected to the external connector interface, and then establishes bidirectional redundant data communication with the first control board and / or the second control board through the first communication channel, the second communication channel, the third communication channel and the fourth communication channel.

3. The UAV braking control system with redundant architecture according to claim 2, characterized in that, Both the first control board and the second control board include: The microcontroller unit includes a first analog-to-digital converter, a first conditioning circuit, a second analog-to-digital converter, a second conditioning circuit, a digital-to-analog converter, a voltage-to-current conversion circuit, a first bus transceiver, a second bus transceiver, a fault status input circuit, an enable signal input circuit, and a heartbeat signal generation circuit. The microcontroller unit is electrically connected to the first analog-to-digital converter, the second analog-to-digital converter, the digital-to-analog converter, the first bus transceiver, the second bus transceiver, the fault status input circuit, the enable signal input circuit, and the heartbeat signal generation circuit, respectively. The input terminal of the first conditioning circuit is connected to the wheel speed sensor, and its output terminal is connected to the first analog-to-digital converter; The input of the second conditioning circuit is connected to the brake pressure sensor, and its output is connected to the second analog-to-digital converter. The input terminal of the voltage-to-current conversion circuit is connected to the digital-to-analog converter, and its output terminal is connected to the brake drive device. The input terminal of the fault status input circuit is connected to the dual-power supply board; The input terminal of the enable signal input circuit is connected to the arbitration circuit board; The output of the heartbeat signal generation circuit is connected to the arbitration circuit board. In the first control board, the first bus transceiver constitutes the first communication channel, and the second bus transceiver constitutes the second communication channel; in the second control board, the first bus transceiver constitutes the third communication channel, and the second bus transceiver constitutes the fourth communication channel.

4. The UAV braking control system with redundant architecture according to claim 3, characterized in that, The dual-power supply board includes: Power input interface, first EMI filter circuit, second EMI filter circuit, first DC / DC module, second DC / DC module, Oring circuit and power status output circuit; The first EMI filter circuit and the first DC / DC module together constitute the main power supply module, and the second EMI filter circuit and the second DC / DC module together constitute the auxiliary power supply module. The power input interface is connected to the input terminals of the first EMI filter circuit and the second EMI filter circuit, respectively. The output terminal of the first EMI filter circuit is connected to the input terminal of the first DC / DC module, and the output terminal of the second EMI filter circuit is connected to the input terminal of the second DC / DC module. The output terminals of the first DC / DC module and the second DC / DC module are both connected to the input terminal of the Oring circuit; The Oring circuit is used to realize parallel redundant power supply of the main power module and the auxiliary power module, and has the function of automatically isolating faulty power supply. The input terminal of the power status output circuit is connected to the Oring circuit and is used to monitor the working status of the dual power supply board in real time. When the main power module or the auxiliary power module fails, the power status output circuit sends the corresponding fault status signal to the arbitration circuit board.

5. The UAV braking control system with redundant architecture according to claim 4, characterized in that, The arbitration circuit board includes: First control board interface, second control board interface, power status signal input interface, first signal conditioning circuit, second signal conditioning circuit, first heartbeat detection circuit, second heartbeat detection circuit, power status monitoring circuit, and fault logic voting circuit; The input terminal of the first control board interface is connected to the first control board, and its output terminal is connected to the input terminal of the first signal conditioning circuit. The output terminal of the first signal conditioning circuit is connected to the input terminal of the first heartbeat detection circuit; The input terminal of the second control board interface is connected to the second control board, and its output terminal is connected to the input terminal of the second signal conditioning circuit. The output of the second signal conditioning circuit is connected to the input of the second heartbeat detection circuit; The input terminal of the power status signal input interface is connected to the power status output circuit of the dual-power supply board, and its output terminal is connected to the input terminal of the power status monitoring circuit. The outputs of the first heartbeat detection circuit, the second heartbeat detection circuit, and the power status monitoring circuit are all connected to the input of the fault logic voting circuit. The first heartbeat detection circuit is used to monitor the heartbeat signal of the first control board and output the first monitoring result; The second heartbeat detection circuit is used to monitor the heartbeat signal of the second control board and output a second monitoring result; The power status monitoring circuit is used to monitor the working status of the dual-power supply board and output the power status monitoring results. The fault logic voting circuit is used to perform redundant logic judgment based on the monitoring results output by the first heartbeat detection circuit, the second heartbeat detection circuit and the power status monitoring circuit, and output the first enable signal, the second enable signal and the fault status signal. The fault status signal is forwarded to the flight control computer via the first control board and / or the second control board.

6. The UAV braking control system with redundant architecture according to claim 5, characterized in that, The arbitration circuit board is configured as a secure arbitration unit based on pure hardware logic; The fault logic voting circuit consists of hardware logic gates, comparators, and flip-flops, and can realize real-time detection of the heartbeat signals of the first control board and the switching of the enable signal without relying on software program execution. When an abnormal heartbeat is detected on any control board, the fault logic voting circuit directly pulls down the enable signal of the corresponding control board and pulls up the enable signal of the other control board at the hardware level to achieve microsecond-level fault switching.

7. The UAV braking control system with redundant architecture according to claim 1, characterized in that, The step of generating the brake pressure control quantity through a control algorithm based on the wheel speed sensor signal, the brake pressure sensor signal, and the target brake pressure includes: The slip ratio is calculated based on the wheel speed sensor signal, and pressure closed-loop control is performed based on the slip ratio, the brake pressure sensor signal, and the target brake pressure to generate the brake pressure control quantity.

8. A drone braking control method, applied to a drone braking control system with a redundant architecture as described in any one of claims 1-7, characterized in that, include: After the system is powered on, the main power module and the auxiliary power module of the dual power supply board work simultaneously to supply power to the system; After initialization, the first control board and the second control board respectively send heartbeat signals to the arbitration circuit board; The arbitration circuit board monitors the heartbeat signals of the first control board and the second control board. If both are normal, one of them is selected as the main control board by default and outputs the corresponding first enable signal or second enable signal to enable the main control board to output the braking current signal. The other one is a backup control board in backup state and synchronizes the data of the main control board in real time. The main control board acquires wheel speed sensor signals and brake pressure sensor signals, receives target brake pressure sent by flight control computer, generates brake pressure control quantity based on wheel speed sensor signals, brake pressure sensor signals and target brake pressure, and converts brake pressure control quantity into brake current signal and outputs it to brake drive device. The arbitration circuit board continuously monitors the system. When it detects an abnormality or loss of the heartbeat signal from the main control board, it immediately switches the enable signal through hardware logic, cuts off the current output enable of the main control board, and simultaneously outputs an enable signal to the backup control board. The backup control board takes over the system control and continues to complete the braking task.

9. The UAV braking control method according to claim 8, characterized in that, Once the heartbeat signal of the faulty control board returns to normal, the switched control board will remain as the main control board until the current braking task is completed. Control will only be allowed to switch back to the original main control board or re-elect the main control board after the system enters standby mode and receives a reset command.

10. The UAV braking control method according to claim 8, characterized in that, When a single power module fails, the dual-power supply board automatically isolates the faulty branch through its Oring circuit and allows the other power module to take over the entire load, achieving seamless switching of the output voltage. The power status output circuit of the dual-power supply board also reports the fault status information to the arbitration circuit board.

Images