Parachute coordinated triggering and attitude holding method and device for manned multicopter

Abstract

This invention discloses a method and apparatus for coordinated parachute triggering and attitude maintenance of a manned multirotor aircraft. The method includes: acquiring multi-source state data of the aircraft in real time; after determining that the aircraft is in an unrecoverable loss of control state, activating attitude pre-adjustment control logic; generating a reverse attitude correction command based on the deviation values ​​of pitch and roll angles; driving the remaining available rotors to generate an incremental vector of available rotor thrust; ensuring that the aircraft converges its pitch and roll angles to a preset attitude safety window before parachute deployment; sending an emergency braking signal to the rotor motors; and generating parachute trigger permission after confirming that the rotors meet preset shutdown confirmation conditions, allowing the parachute to deploy within a predetermined deployment time. This invention, by coordinating and interlocking loss of control determination, attitude pre-adjustment, rotor shutdown confirmation, and parachute trigger permission, improves the safety and reliability of emergency landing of manned multirotor aircraft under extreme failure conditions.

Description

Technical Field

[0001] This invention relates to the field of manned multirotor aircraft technology, specifically to a method and apparatus for parachute coordinated triggering and attitude maintenance of manned multirotor aircraft. Background Technology

[0002] With the rapid development of urban air mobility (UAM) and low-altitude manned aircraft, the safety of manned multi-rotor aircraft has increasingly become a core bottleneck restricting their commercial application. These aircraft typically rely on multiple rotors working in concert to achieve stable hovering and maneuvering, and their safe operation is highly dependent on multiple safeguards from the power system, flight control system, and structural integrity. In actual operation, once a serious power system failure, flight control instability, or a combination of malfunctions occurs, redundant control strategies alone may not be sufficient to effectively restore flight status, necessitating the introduction of an emergency landing mechanism with independent safety assurance capabilities.

[0003] Among them, the emergency parachute system is considered a key technology for the "last line of defense" for manned multi-rotor aircraft. Its basic principle is to rapidly deploy a parachute to decelerate and stabilize the descent when the aircraft loses controllable flight capability, thereby maximizing the protection of the occupants' lives. However, the effective deployment of the parachute not only depends on the precise judgment of the trigger timing, but also highly depends on the aircraft's attitude state, rotor operation, and surrounding airflow environment at the moment of deployment.

[0004] While some existing technologies incorporate parachute devices, certain complex failure scenarios may still present challenges due to insufficient coordination between the parachute triggering logic and aircraft attitude control. On one hand, the lack of an active pre-adjustment mechanism for the aircraft's current attitude angles (such as pitch and roll) leads to direct parachute deployment at large angles of tilt or high-speed rotation, easily causing canopy entanglement, line breakage, or deployment failure. On the other hand, the absence of coordinated control logic between rotor shutdown and parachute triggering means that deployment while the rotor is still spinning at high speed can result in the canopy being caught in the rotor area, severely threatening deployment reliability. Furthermore, existing triggering strategies are mostly based on single threshold judgments (such as altitude or vertical descent rate), lacking intelligent decision-making models that integrate multi-source fault diagnosis information (such as power output anomaly rate, attitude angular rate mutations, IMU data consistency, etc.), making it difficult to accurately identify the optimal deployment window in complex failure scenarios. These deficiencies make it difficult for existing emergency parachute systems to achieve safe, stable, and reliable landings under real-world extreme conditions, failing to meet the stringent requirements of high-integrity safety systems for manned aircraft. Summary of the Invention

[0005] To address the problems existing in the prior art, this invention provides a method and apparatus for parachute coordinated triggering and attitude maintenance of a manned multi-rotor aircraft. By coordinating and interlocking the loss of control determination, attitude pre-adjustment, rotor stop confirmation and parachute trigger authorization, the aircraft can complete an emergency landing in a safer, smoother and more reliable manner under extreme failure conditions.

[0006] Other features and advantages of the invention will become apparent from the following detailed description, or may be learned in part by practice of the invention.

[0007] According to a first aspect of the present invention, a method for parachute cooperative triggering and attitude maintenance of a manned multi-rotor aircraft is provided, comprising: Real-time acquisition of multi-source status data of the aircraft, and determination of whether the aircraft is in an irrecoverable out-of-control state based on the multi-source status data; After determining that the state of loss of control is unrecoverable, the attitude pre-adjustment control logic is activated. The attitude pre-adjustment control logic generates a reverse attitude correction command based on the deviation value of the pitch angle and roll angle of the aircraft, drives the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, so that the aircraft converges the pitch angle and roll angle to the preset attitude safety window before the parachute opens. After the attitude pre-adjustment meets the preset attitude safety window, an emergency braking signal is sent to the rotor motor of the aircraft to make the rotor of the aircraft perform stop control. When it is confirmed that the rotor of the aircraft meets the preset stop confirmation conditions, and the pitch and roll angles of the aircraft are still within the preset attitude safety window, a parachute trigger permission is generated, so that the parachute of the aircraft can be deployed within a predetermined deployment time.

[0008] In some embodiments of the present invention, based on the foregoing scheme, determining whether the aircraft is in an irrecoverable runaway state based on the multi-source state data includes: Based on the multi-source state data, the attitude angular rate mutation amplitude, power output anomaly rate, attitude consistency deviation and vertical descent rate are normalized respectively to obtain the normalized attitude angular rate mutation amplitude, normalized power output anomaly rate, normalized attitude consistency deviation and normalized vertical descent rate. The composite fault judgment score is calculated based on each normalized state variable and its corresponding weight, where each weight is a non-negative weight and the sum of all weights is 1. When the composite fault judgment score is greater than or equal to the judgment score threshold and continues to exceed the duration threshold, the aircraft is determined to meet the preset judgment condition of the unrecoverable runaway state; wherein, the preset judgment condition of the unrecoverable runaway state is used to characterize that the current state of the aircraft has exceeded the preset recoverable range of the conventional redundant control strategy.

[0009] In some embodiments of the present invention, based on the foregoing scheme, the activation attitude pre-adjustment control logic, wherein the attitude pre-adjustment control logic generates a reverse attitude correction command based on the deviation between the pitch angle and roll angle of the aircraft, and drives the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, including: Let the pitch angle of the aircraft be... The roll angle is The corresponding reference targets are respectively and , , Then the errors in pitch angle and roll angle are respectively:

[0010]

[0011] Based on the pitch angle error and roll angle error, calculate the pitch correction moment and roll correction moment respectively:

[0012]

[0013] in, , , These are the proportional, integral, and derivative control parameters for the pitch channel. , , These are the proportional, integral, and derivative control parameters for the roll channel. and They are respectively direction and The direction is based on the feedforward compensation term derived from the location of the failed rotor and the amount of thrust loss. For the body The control torque of the shaft corresponds to the roll correction. For the body The control torque of the axis corresponds to pitch correction; The generalized control vector is composed based on the desired control torque:

[0014] in, This is the additional total thrust along the vertical direction of the fuselage, used to compensate for changes in total lift. This is the control torque about the z-axis of the aircraft, corresponding to yaw suppression or maintenance. It is a generalized control vector; Establish a power distribution matrix based on the available rotor set:

[0015]

[0016] in, For the collection of available rotors, For the first One usable rotor, For the first The x-coordinate, y-coordinate, and rotation direction of the rotor can be used in the airframe coordinate system. This is the rotor anti-torque coefficient. Assign a dynamics matrix; A linearized power distribution relationship is established based on the generalized control vector and the power distribution matrix to obtain the available rotor thrust increment vector. :

[0017] in, This indicates that saturation constraints are applied based on the upper and lower limits of rotor thrust. The thrust increment of the failed rotor is set to 0 and is not included in the available rotor power distribution matrix. The construction; Assign matrix to available rotor power The generalized inverse matrix; The thrust limit for each available rotor is obtained based on the available rotor thrust increment vector:

[0018] in, For the first Each available rotor relative to the current baseline thrust The thrust increment to be allocated This is the actual thrust increment command after saturation limiting; and The first The minimum and maximum thrust allowed by each available rotor; , , respectively representing the first The lower and upper limits of the available rotor thrust increment.

[0019] In some embodiments of the present invention, based on the foregoing scheme, the preset posture safety window includes a first posture safety window or a second posture safety window; If the aircraft can converge both pitch and roll angles to an absolute value less than or equal to the first angle threshold before parachute deployment within the attitude pre-adjustment time window, then the preset attitude safety window is the first attitude safety window. If the aircraft cannot converge both pitch and roll angles to an absolute value less than or equal to the first angle threshold before parachute deployment within the attitude pre-adjustment time window, then the preset attitude safety window is the second attitude safety window. The second attitude safety window includes: the absolute values ​​of pitch angle and roll angle are both less than or equal to a second angle threshold, and the absolute values ​​of angular rates of pitch angle and roll angle are both less than or equal to a preset angular rate threshold, wherein the second angle threshold is greater than the first angle threshold.

[0020] In some embodiments of the present invention, based on the foregoing scheme, the step of sending an emergency braking signal to the rotor motor of the aircraft after the attitude pre-adjustment meets the preset attitude safety window, so as to cause the rotor of the aircraft to perform stop control, includes: The rotor motor of the aircraft adopts a dual-redundant braking strategy. The first stage is electronic braking, which is used to control the rotor motor to generate braking torque through the speed controller. The second stage is mechanical braking. When the electronic braking fails to make the rotor meet the preset stop confirmation conditions within the rotor stop time window, the mechanical locking mechanism is automatically activated to restrict the rotor from continuing to rotate. The mechanical locking mechanism includes at least one of an electromagnetic clutch, a brake disc, a brake caliper, or a mechanical limiting component.

[0021] In some embodiments of the present invention, based on the foregoing scheme, the step of ensuring that the parachute of the aircraft deploys within a predetermined deployment time after confirming that the rotational speed of all rotors is below a preset safe rotational speed threshold and continuing this confirmation for a preset time includes: The parachute is deployed by a gas generator, which is activated by a dual ignition circuit, including a main ignition circuit and a backup ignition circuit. The main ignition circuit and the backup ignition circuit are isolated from each other. When either circuit receives a valid trigger signal, the gas generator is activated. The parachute adopts a cross-shaped strip stabilizer structure. The preset area value, preset overload threshold, and predetermined length are determined based on the aircraft's maximum takeoff weight, minimum opening altitude, descent speed before opening, and allowable occupant overload range.

[0022] In some embodiments of the present invention, based on the foregoing solution, the invention further includes: After confirming that the parachute has fully deployed, flight data is recorded at a preset sampling rate. The flight data includes the aircraft's three-axis acceleration, barometric altitude, GPS position, and internal clock. The flight data is written to non-volatile memory in a circular buffer manner. Before overwriting old data, a CRC32 check must be performed. The writing process continues until the aircraft's power is exhausted after landing or the power is manually cut off.

[0023] In some embodiments of the present invention, based on the foregoing scheme, the following is further included before the start-up attitude pre-adjustment control logic: Obtain a first manually triggered request, which contains dual authentication information of a digital certificate and a one-time token; After the dual authentication information is verified, a flight status confirmation is performed. The flight status confirmation includes at least the following: the current altitude is greater than the minimum parachute deployment altitude threshold, the vertical descent rate is greater than the trigger threshold, and the attitude angular rate meets the parachute deployment window requirements. After the flight status is confirmed, a second manual trigger request is obtained. The second manual trigger request is only used as an authorization signal to start the attitude pre-adjustment control logic. After receiving the second manual trigger request, the aircraft still needs to perform attitude pre-adjustment, rotor stop confirmation and parachute trigger permission judgment in sequence.

[0024] According to a second aspect of the present invention, a parachute-assisted triggering and attitude-maintaining device for a manned multi-rotor aircraft is provided, comprising: The data acquisition module is used to acquire multi-source status data of the aircraft in real time, and determine whether the aircraft is in an unrecoverable out-of-control state based on the multi-source status data. The adjustment module is used to activate the attitude pre-adjustment control logic after determining that the state is unrecoverable and out of control. The attitude pre-adjustment control logic generates a reverse attitude correction command based on the deviation value of the pitch angle and roll angle of the aircraft, drives the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, so that the aircraft converges the pitch angle and roll angle to the preset attitude safety window before the parachute opens. The braking module is used to send an emergency braking signal to the rotor motor of the aircraft after the attitude pre-adjustment meets the preset attitude safety window, so that the rotor of the aircraft performs a stop control. The deployment module is used to generate a parachute trigger permission when it is confirmed that the rotor of the aircraft meets the preset stop confirmation conditions and the pitch angle and roll angle of the aircraft are still within the preset attitude safety window, so that the parachute of the aircraft can be deployed within a predetermined deployment time.

[0025] According to a third aspect of the present invention, a manned multi-rotor aircraft is provided, comprising: The multi-source state awareness subsystem includes: A high-precision inertial measurement unit is used to acquire the attitude consistency deviation of the aircraft. A power output sensor, used to acquire the power output anomaly rate of the aircraft; A digital barometric altimeter is used to obtain the altitude of the aircraft. An ultrasonic vertical rate meter is used to obtain the vertical descent rate of the aircraft. An angular rate gyroscope array is used to obtain the magnitude of the attitude angular rate change of the aircraft; The dual-flight control hot standby computing subsystem includes: One or more processors; A memory for storing executable instructions of the processor, which, when executed by the one or more processors, cause the one or more processors to implement the method described above; An independent event recording subsystem is used to record the aircraft's three-axis acceleration, barometric altitude, positioning information, and time information at a preset sampling rate after receiving an emergency trigger signal, and write the flight data into a non-volatile memory; The rotor braking actuation subsystem includes several speed controllers, which are used to reduce the speed of the rotor motor; The parachute deployment mechanism subsystem includes a parachute, a gas generator for driving the parachute to deploy, and a dual ignition circuit for driving the gas generator to start.

[0026] The beneficial effects of this invention are as follows: (1) The parachute-assisted triggering and attitude maintenance method and device for manned multi-rotor aircraft provided by the present invention abandons the traditional single threshold triggering logic and uses multi-source state data fusion to obtain a composite fault judgment score. It can accurately identify complex operating conditions such as severe power system failure, flight control instability, or composite faults. By using the composite fault judgment score, it effectively distinguishes between recoverable disturbances and unrecoverable loss of control, avoiding false triggering or missed triggering. The accuracy of this intelligent decision-making mechanism in real extreme scenarios is significantly improved, meeting the stringent requirements of manned aircraft for high integrity safety systems.

[0027] (2) The parachute coordinated triggering and attitude maintenance method and device for manned multi-rotor aircraft provided by the present invention adopts a dual-redundancy or multi-protection design in key links, including a dual-ignition parachute mechanism, dual flight control computer hot backup, dual-stage rotor braking strategy and ground remote intervention interface, to ensure that the emergency landing procedure can still be reliably executed in the event of single-point or multi-point failure. The overall safety integrity of the system can be configured according to the preset safety level, which is conducive to improving the reliability, redundancy safety and engineering applicability of the emergency landing system for manned multi-rotor aircraft.

[0028] (3) The parachute-assisted triggering and attitude-maintaining method and device for manned multi-rotor aircraft provided by this invention supports post-event analysis and continuous optimization. Through an independent backup sensor module, emergency event data is recorded throughout the process, providing high-fidelity data support for accident review, system improvement, and airworthiness certification. This capability not only improves the safety level of a single flight but also lays the technical foundation for safe iteration throughout the entire product lifecycle.

[0029] It should be understood that the above general description and the following detailed description are merely exemplary and explanatory, and do not limit the invention. Attached Figure Description

[0030] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are intended to explain the invention, but do not constitute an undue limitation thereof. In the drawings: Figure 1 This is a flowchart of a parachute coordinated triggering and attitude maintenance method for a manned multi-rotor aircraft according to the present invention; Figure 2 This is a schematic diagram of a parachute coordinated triggering and attitude maintenance device for a manned multi-rotor aircraft according to the present invention; Figure 3 This is a schematic diagram of a manned multi-rotor aircraft according to the present invention. Detailed Implementation

[0031] To make the objectives, features, and advantages of this invention more apparent and understandable, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described below are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0032] It should be understood that the terms "comprising" and other similar expressions in the specification, claims, and accompanying drawings of this invention are intended to cover a non-exclusive inclusion, such as a process, method, system, or apparatus that includes a series of steps or units and is not limited to the listed steps or units. Furthermore, "first" and "second" are used to distinguish different objects and are not intended to describe a specific order.

[0033] Example 1 This embodiment applies to an emergency safety system for a four-seat manned multirotor aircraft in an urban air mobility (UAM) scenario. The aircraft employs an octocopter X-shaped configuration, with a maximum takeoff weight of 1200 kg and a cruising altitude between 30 and 300 meters. In such a low-altitude, densely populated operating environment, traditional redundant control strategies may fail to maintain a stable attitude in the event of a combined failure such as simultaneous failure of both motors or a crash in the flight control main computer. Therefore, a highly complete and highly coordinated emergency parachute triggering and attitude maintenance mechanism is urgently needed. To this end, this embodiment deploys a dedicated safety system that deeply integrates hardware architecture and control logic.

[0034] First, such as Figure 3 As shown, from an architectural perspective, in this embodiment, the aircraft's hardware platform consists of five core subsystems: a multi-source state perception subsystem, a dual-flight control hot standby computing subsystem, a rotor braking execution subsystem, a parachute deployment mechanism subsystem, and an independent event recording subsystem. These subsystems are interconnected via a high-speed, low-latency hybrid bus network and feature multiple electrical and functional isolation designs.

[0035] The multi-source state perception subsystem includes a high-precision inertial measurement unit (IMU) that integrates a three-axis MEMS gyroscope (zero-bias stability ≤0.5° / hr), a three-axis accelerometer (range ±16g, noise density ≤100μg / √Hz), and a three-axis magnetometer to obtain attitude consistency deviation; four power output sensors, respectively installed at the bus terminals of eight brushless DC motor drivers, are used to monitor the current, voltage, and PWM (Pulse Width Modulation) duty cycle of each phase in real time, thereby calculating the actual output thrust percentage of a single rotor to obtain the power output anomaly rate; a digital barometric altimeter (resolution 0.1m, update rate 100Hz) and an ultrasonic vertical descent rate meter (range ±20m / s, accuracy ±0.1m / s); in addition, it also includes an angular rate gyroscope array, which is dedicated to detecting instantaneous angular velocity changes of the body around the X, Y, and Z axes to obtain the attitude angular rate change amplitude. All sensors are powered by a 24V aviation-grade power supply. The signal output is connected to the analog / digital hybrid data acquisition card of the main flight control computer via shielded twisted-pair cables. Sampling synchronization is uniformly controlled by hardware trigger signals to ensure that the timestamp alignment error is less than 1 millisecond.

[0036] The dual-flight control hot standby computing subsystem employs two industrial-grade embedded computers with real-time computing capabilities. Each embedded computer includes a processor, memory, and a real-time communication interface, used to execute regular flight control tasks and emergency parachute collaborative triggering control tasks, respectively. The main flight control unit (FCU-M) runs the regular flight control law, responsible for attitude stabilization, trajectory tracking, and mission management; the backup flight control unit (FCU-B) is dedicated to executing the emergency parachute collaborative logic and trigger permission judgment logic described in this invention. The two are synchronized via two independent gigabit fiber optic links, one a periodic heartbeat packet channel (10ms period) and the other an event-driven data mirroring channel. The switching logic is monitored by a dedicated watchdog circuit. When the main flight control unit fails to send three consecutive valid heartbeats or a critical process crashes, the backup flight control unit takes over all emergency control within 10 milliseconds. Both flight control units run a partitioned real-time operating system based on the ARINC653 standard, ensuring that safety-critical tasks have the highest scheduling priority.

[0037] The rotor braking actuation subsystem consists of eight electronic speed controllers (ESCs) and a matching mechanical braking module. Each ESC regulates the speed of one rotor. Each ESC has a built-in electronic / mechanical braking unit with back EMF detection circuitry and active short-circuit braking function. Upon receiving an emergency stop command, it can reduce the motor speed from the rated speed (approximately 3000 rpm) to below 500 rpm within 0.3 seconds. If the encoder feedback indicates that the speed has not dropped to the threshold (set to 50 rpm) within 0.5 seconds, the second-stage mechanical braking is automatically activated: a normally closed electromagnetic clutch is energized and released, causing the brake disc to press against the rotor shaft and lock forcibly through frictional torque. This clutch is powered by an independent 12V backup battery to ensure operation even in the event of a main power failure. Each rotor shaft is equipped with a speed feedback and stop confirmation unit, which is an incremental photoelectric encoder (1024PPR resolution). Its real-time speed data is transmitted back to the backup flight controller via CAN bus (1Mbps baud rate) to confirm the stop completion status.

[0038] The parachute deployment mechanism subsystem is installed within the fairing on the top of the fuselage and includes a parachute pack, a gas generator / ejection mechanism, and primary / backup dual ignition circuits. The parachute adopts a cross-shaped stabilized parachute structure, made of high-strength nylon fabric, with a deployment area of ​​60 square meters. The parachute lines are made of aramid fiber and are 12 meters long. In an optional embodiment, the parachute deployment mechanism can be configured to deploy above a preset minimum deployment altitude and reduce the aircraft's descent speed to a preset safe range. The gas generator contains a gas generating agent or energy storage drive mechanism for rapidly generating driving gas. This gas generating agent or energy storage drive mechanism can drive the parachute to deploy within a preset response time after receiving a valid trigger signal. The ejection mechanism is used to drive the parachute to deploy within the preset response time. The ignition circuit adopts a dual redundancy design: the main ignition circuit is directly driven by the GPIO (General Purpose Input / Output) pin of the backup flight controller to drive the MOSFET (Metal-Oxide-Semiconductor Field-Effect Transistor) switch, while the backup ignition circuit is controlled by an independent safety relay module. The two are completely isolated electrically, sharing the same set of trigger signals but with independent paths.

[0039] The independent event recording subsystem is a physically isolated black box module containing an independent 3.7V lithium polymer battery (2000mAh capacity), a three-axis MEMS accelerometer (range ±50g), a barometric altimeter, a GPS receiver (supporting L1 / L5 dual-frequency), and a non-volatile memory chip (8GB capacity). This module does not rely on the main flight controller for power or communication. It includes an emergency trigger receiver unit, which receives the "emergency trigger" activation signal only via a hardwired connection. Once triggered, the three-axis accelerometer / altitude / positioning recording unit continuously records parameters such as three-axis acceleration, altitude, latitude and longitude, and timestamps at a frequency of 100Hz, and encrypts and writes them to the memory. It can operate continuously for more than 12 minutes, and the non-volatile memory unit meets the data preservation requirements for the entire process from triggering to landing.

[0040] Based on the above architecture, the workflow of this embodiment strictly follows the step sequence in the invention and achieves deep coupling between hardware and algorithm.

[0041] like Figure 1 As shown, this embodiment provides a method for parachute cooperative triggering and attitude maintenance of a manned multi-rotor aircraft, including the following steps: Step S1: Acquire multi-source status data of the aircraft in real time, and determine whether the aircraft is in an unrecoverable out-of-control state based on the multi-source status data.

[0042] In some embodiments of this example, the multi-source state data includes the amplitude of attitude angular rate abrupt changes. Abnormal power output rate Posture consistency deviation and vertical descent rate The magnitude of the sudden change in attitude angular rate Abnormal power output rate Posture consistency deviation and vertical descent rate Normalization is performed (all values ​​are mapped to [0,1]), and the composite fault judgment score is calculated using the following formula:

[0043] in, These represent the magnitudes of the attitude angular rate change. Abnormal power output rate Posture consistency deviation and vertical descent rate weight and , Score for determining complex faults; when And the duration is greater than or equal to When the situation is deemed irreversibly out of control, then... To determine the score threshold, This is the duration threshold.

[0044] Preferably, , And in conventional low-altitude scenarios , , , Furthermore, for different aircraft models / safety levels, weights are preset through a parameter table; when continuous variation with altitude is required, piecewise linear interpolation is used to update the weights, while maintaining a weight sum of 1. If the duration exceeds 500ms, the backup flight control determines that the aircraft has entered an unrecoverable loss of control state and immediately proceeds to step S2.

[0045] In this embodiment, the attitude pre-adjustment time window refers to the preset time period from the time the aircraft is determined to meet the preset judgment conditions of an unrecoverable runaway state and the attitude pre-adjustment control logic is initiated, until the aircraft meets the preset attitude safety window or enters the suboptimal attitude safety window. The rotor stop time window refers to the preset time period from the time the aircraft's rotor motor receives the emergency braking signal, until the rotor is confirmed to meet the preset stop confirmation conditions. The attitude pre-adjustment time window is used to limit the attitude convergence process, and the rotor stop time window is used to limit the rotor braking process; the two correspond to different control stages.

[0046] Step S2: After determining that the unrecoverable loss of control is in a state of no return, the attitude pre-adjustment control logic is activated. The attitude pre-adjustment control logic generates a reverse attitude correction command based on the deviation value of the pitch angle and roll angle of the aircraft, drives the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, so that the pitch angle and roll angle of the aircraft converge to the preset attitude safety window before the parachute opens. That is, the absolute value of the pitch angle and roll angle of the aircraft is less than or equal to the preset angle threshold within the safety range before the parachute opens.

[0047] In some embodiments of this example, the attitude pre-adjustment control logic in step S2 adopts a proportional-integral-derivative closed-loop controller, whose proportional gain coefficient, integral time constant and derivative time constant are all set to preset control parameters, and a feedforward compensation term is introduced to offset the torque asymmetry caused by partial rotor failure.

[0048] In this embodiment, the proportional gain Integral time Differential time The controller input is the pitch angle. With roll angle The output, relative to the horizontal plane (0°), represents the thrust adjustment for each remaining usable rotor. Since some rotors may have failed, the set of rotors still capable of thrust output is identified via the power distribution matrix. Specifically, the backup flight controller establishes a health flag for each rotor. When the rotor satisfies the condition that "the commanded thrust duty cycle is higher than the threshold and the speed / current feedback is in continuous operation..." If the response time falls below the response threshold, the rotor is deemed to have failed. ,otherwise Assemble all available rotors. .

[0049] Specifically, the step of generating a reverse attitude correction command based on the deviation between the pitch angle and the roll angle, and driving the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, specifically involves: Let the pitch angle of the aircraft be... The roll angle is The reference targets are respectively , Then the errors in pitch angle and roll angle are respectively:

[0050]

[0051] Based on the pitch angle error and roll angle error, calculate the pitch correction moment and roll correction moment respectively:

[0052]

[0053] in, , , These are the proportional, integral, and derivative control parameters for the pitch channel. , , These are the proportional, integral, and derivative control parameters for the roll channel, respectively. , The feedforward compensation term is derived from the location of the failed rotor and the thrust loss. Thus, the controller introduces this feedforward compensation term, which pre-calculates the unbalanced torque to be offset based on the location of the failed rotor and the thrust loss, thereby avoiding integral saturation. For the body The control torque of the shaft corresponds to the roll correction. For the body The control torque of the axis corresponds to pitch correction; The generalized control vector is composed based on the desired control torque:

[0054] in, This is the additional total thrust along the vertical direction of the fuselage, used to compensate for changes in total lift. This is the control torque about the z-axis of the aircraft, corresponding to yaw suppression or maintenance. It is a generalized control vector; Establish a power distribution matrix based on the available rotor set:

[0055]

[0056] in, For the collection of available rotors, For the first One usable rotor, For the first The x-coordinate, y-coordinate, and rotation direction of the rotor can be used in the airframe coordinate system. This is the rotor anti-torque coefficient. For the dynamic allocation matrix, Based on the complete power distribution matrix according to the available rotor set Extract the corresponding column to obtain; A linearized power distribution relationship is established based on the generalized control vector and the power distribution matrix to obtain the available rotor thrust increment vector:

[0057] in, This indicates that saturation constraints are applied based on the upper and lower limits of rotor thrust. The thrust increment of the failed rotor is set to 0 and is not included in the available rotor power distribution matrix. The construction; for example, in an octocopter, if motors #2 and #6 fail, the remaining six rotors are redistributed to generate available rotor thrust increment vectors around the X and Y axes; The available rotor power allocation matrix The generalized inverse matrix is ​​used to find the remaining available rotor set. The generalized control vector u is then mapped to an available rotor thrust increment vector; preferably, the... It is either the Moore-Penrose pseudo-inverse matrix or a weighted generalized inverse matrix that takes into account rotor weights, thrust saturation constraints, or damping terms.

[0058] The thrust limit for each available rotor is obtained based on the available rotor thrust increment vector:

[0059] in, For the first Each available rotor relative to the current baseline thrust The thrust increment to be allocated This is the actual thrust increment command after saturation limiting; and The first The minimum and maximum thrust allowed by each available rotor; , , respectively representing the first The lower and upper limits of the available rotor thrust increment.

[0060] In some embodiments of this example, the preset posture safety window includes a first posture safety window or a second posture safety window; If the aircraft can converge both pitch and roll angles to an absolute value less than or equal to the first angle threshold before parachute deployment within the attitude pre-adjustment time window, then the preset attitude safety window is the first attitude safety window. If the aircraft cannot converge both pitch and roll angles to an absolute value less than or equal to the first angle threshold before parachute deployment within the attitude pre-adjustment time window, then the preset attitude safety window is the second attitude safety window. The second attitude safety window includes: the absolute values ​​of pitch angle and roll angle are both less than or equal to a second angle threshold, and the absolute values ​​of angular rates of pitch angle and roll angle are both less than or equal to a preset angular rate threshold, wherein the second angle threshold is greater than the first angle threshold.

[0061] Specifically, if the aircraft can be within the attitude pre-adjustment time window Inside, adjust the pitch angle before opening the parachute. With roll angle All converge to an absolute value less than or equal to the first angle threshold. The preset angle threshold is the first angle threshold. ; If the aircraft cannot be within the attitude pre-adjustment time window Inside, adjust the pitch angle before opening the parachute. With roll angle All converge to an absolute value less than or equal to the first angle threshold. The preset angle threshold is then the second angle threshold. And pitch angle With roll angle absolute value of angular velocity All are less than or equal to the preset angular velocity threshold. .

[0062] In this embodiment, the first angle threshold is the angle threshold of the safe attitude window, that is, the upper limit of the absolute value of the maximum pitch / roll angle allowed under the preferred attitude condition before parachute deployment. Under the preferred attitude condition, the aircraft can converge both the pitch and roll angles to an absolute value less than or equal to the first angle threshold before parachute deployment within the attitude pre-adjustment time window. The preset angle threshold is the first angle threshold. The second angle threshold is the angle threshold of the suboptimal attitude window, that is, before parachute deployment, the aircraft cannot converge both the pitch and roll angles to an absolute value less than or equal to the first angle threshold within the attitude pre-adjustment time window before parachute deployment. This allows the aircraft to enter the parachute deployment process within a more relaxed attitude range, but is simultaneously constrained by the angular rate threshold. and .

[0063] Specifically, attitude pre-adjustment time window Take 0.5 3s; Take 10° 20°; another preset angle threshold Take 20° 35°; Preset angular rate threshold Take 20° / s 40° / s; if the condition is not met within the attitude pre-adjustment time window. If the condition is met, the system enters the suboptimal attitude window and continues to perform attitude correction control; when the condition is met... When the absolute values ​​of both pitch rate and roll rate are less than or equal to the preset angular rate threshold, the rotor stop and parachute deployment process is allowed.

[0064] In one embodiment, the pitch angle is continuously monitored. and roll angle The absolute value, , If the angle converges to ≤15° within 2 seconds, the parachute deployment attitude condition is met; otherwise, the suboptimal attitude window mode is activated: the allowable pitch angle is... and roll angle It converges to 25°, but requires the corresponding angular velocity. or This decision is made in real time by the state machine within the backup flight controller.

[0065] Step S3: After the attitude pre-adjustment meets the preset attitude safety window, an emergency braking signal is sent to the rotor motor of the aircraft to make the rotor of the aircraft perform stop control within the rotor stop time window, and the stop confirmation result is output after the preset stop confirmation condition is met.

[0066] Specifically, the backup flight controller broadcasts an emergency stop command to the electronic speed controllers corresponding to each rotor motor. Upon receiving the emergency stop command, each electronic speed controller switches to electronic braking mode, controlling the rotor motors to generate braking torque. Simultaneously, the rotor speed detection unit continuously reports the rotational speed feedback of each rotor. If any rotor fails to meet the preset stop confirmation conditions within the rotor stop time window, the corresponding mechanical locking mechanism is activated to restrict the rotor from continuing to rotate.

[0067] The preset stop confirmation conditions include: the rotational speed of each rotor is lower than a preset safe rotational speed threshold, and this confirmation continues for a preset time. Only when all rotors meet the preset stop confirmation conditions can the backup flight control output a stop confirmation result. This confirmation mechanism is used to reduce the risk of parachute canopy or parachute lines getting caught in the rotor area.

[0068] Preferably, the rotor forced stop control in step S3 employs a dual-redundant braking strategy. The first stage is electronic braking, which is used to control the rotor motor to generate braking torque through a speed governor. The second stage is mechanical braking, which automatically activates a mechanical locking mechanism to restrict the rotor from continuing to rotate if the electronic braking fails to make the rotor meet the preset stop confirmation conditions within the rotor stop time window. The mechanical locking mechanism includes at least one of an electromagnetic clutch, a brake disc, a brake caliper, or a mechanical limiting component.

[0069] Step S4: When it is confirmed that the rotor of the aircraft meets the preset stop confirmation conditions, and the pitch angle and roll angle of the aircraft are still within the preset attitude safety window, a parachute trigger permission is generated.

[0070] Specifically, after confirming that the aircraft's rotor meets the preset stop confirmation conditions and that the aircraft's pitch and roll angles are still within the preset attitude safety window, the backup flight control generates a parachute trigger permission. This parachute trigger permission is used to allow the subsequent parachute deployment mechanism to enter the ignition or ejection process; if the rotor does not meet the preset stop confirmation conditions, or if the pitch and roll angles are not within the preset attitude safety window, then the parachute trigger permission is not generated.

[0071] Step S5: Based on the parachute trigger permission, the parachute of the aircraft is deployed within the predetermined deployment time by the parachute deployment mechanism.

[0072] Specifically, after confirming that the rotor meets the preset stop confirmation conditions and the attitude remains within the preset attitude safety window, the backup flight controller generates a parachute trigger permission and triggers the parachute deployment mechanism through the dual ignition circuit, enabling the parachute to deploy within the predetermined deployment time. The backup flight controller simultaneously outputs a high-level trigger signal to both the main and backup ignition circuits for 100ms. The dual ignition design ensures that even if one circuit fails due to cable breakage or switch tube breakdown, the other can still reliably ignite. After the gas generator is activated, the high-pressure gas pushes the piston, first unlocking the parachute compartment door's mechanical lock, then pulling the pull ring inside the parachute pack, guiding the parachute to deploy first and inflate, subsequently pulling the parachute to unfold. The entire process is completed within 1 second, and the parachute opening impact load is limited to less than 8g by the buffer device to avoid secondary injury to the occupants. After activating the suboptimal attitude window mode, the backup flight controller continues to perform attitude corrections, but limits / freezes the integral term and reduces the proportional gain to 50%–80% of its original value, while also limiting the thrust adjustment to balance rapid convergence and parachute deployment stability.

[0073] Preferably, the parachute deployment mechanism subsystem in step S5 is configured with a dual ignition redundancy design, with the main ignition circuit and the backup ignition circuit isolated from each other. The gas generator can be started as soon as either circuit receives a valid trigger signal, and the ignition response delay is less than a preset time threshold.

[0074] Preferably, in step S5, the parachute adopts a cross-shaped strip stabilizer structure, the canopy area is a preset area value, the opening impact load is limited to a preset overload threshold, and the parachute rope length is a predetermined length, ensuring sufficient stable descent time when deployed above the predetermined minimum deployment height.

[0075] Step S6: After confirming that the parachute has fully deployed, record the emergency event data for later review.

[0076] Specifically, the independent event recording subsystem records triaxial acceleration, barometric altitude, GPS position, and internal clock at a sampling rate of 100Hz, starting from the rising edge of the "emergency trigger" signal. All data is written to non-volatile memory in a circular buffer, and a CRC32 check is performed before overwriting old data. This module continues to operate until its power is exhausted after landing or manually powered off, ensuring that the entire process from the occurrence of the fault to touchdown can be completely reproduced afterward.

[0077] This invention also includes a ground station remote intervention interface, wherein the manual trigger request sent by the ground station contains at least dual authentication information of "digital certificate + one-time token (OTP)"; after the backup flight control verification is successful, flight status confirmation is performed, wherein the flight status confirmation includes at least: current altitude. Greater than the minimum parachute opening height threshold Vertical descent rate Greater than the trigger threshold Furthermore, the attitude angular rate meets the parachute deployment window requirements (meeting either the safety window or the suboptimal window). After verification and confirmation are both passed, the manual trigger request is only used as an authorization signal to "enter the emergency procedure". The subsequent attitude pre-adjustment, rotor stop and ignition parachute deployment are still completed according to steps S2-S5 to prevent bypassing the critical safety interlock.

[0078] In summary, this embodiment, through precise hardware selection, redundant topology design, and strict timing control, fully maps the method logic in the steps to the physical system, realizing a closed-loop collaboration across the entire chain from fault perception, intelligent decision-making, attitude intervention, rotor braking to parachute deployment. This is beneficial for improving the survivability of manned multi-rotor aircraft in extreme failure scenarios.

[0079] Example 2 This embodiment targets a six-rotor manned aircraft used in high-altitude mountain search and rescue missions. The operating environment reaches altitudes of up to 4000 meters, where air density is only 62% of that at sea level, posing significant challenges to parachute deployment performance. In this scenario, traditional parachutes may experience excessive descent speed due to insufficient inflation. Therefore, this embodiment, while inheriting the core architecture of Embodiment 1, adaptively optimizes the parachute deployment mechanism subsystem and fault criterion model, and enhances ground-based remote intervention capabilities.

[0080] In terms of architecture, the multi-source state perception subsystem adds an atmospheric density sensor (a differential pressure measurement unit based on pitot tubes and temperature compensation) for real-time correction of the barometric altimeter output. The dual flight control hot standby computing subsystem is upgraded to an NVIDIA Jetson AGXOrin module supporting floating-point acceleration to handle more complex aerodynamic compensation algorithms. The rotor braking execution subsystem maintains its two-stage braking strategy, but the mechanical braking response threshold is adjusted to 40 rpm (due to the thin air at high altitudes, rotor drag is reduced, requiring earlier intervention). The independent event recording subsystem adds an in-cabin camera interface for recording crew status.

[0081] Key improvements are reflected in the parachute deployment mechanism subsystem: the parachute area has been increased to 75 square meters, and a smart fabric material with adjustable breathability is used. Its porosity automatically adjusts according to the deployment altitude—8% at 50-100 meters and decreasing to 3% above 100 meters to balance inflation speed and stability. The parachute lines are longer than 15 meters, extending the swing period and improving disturbance resistance. The gas generator incorporates a gas generating agent or energy storage mechanism for rapidly generating the driving gas. This mechanism can deploy the parachute within a preset response time after receiving a valid trigger signal.

[0082] In terms of methodology, step S1 introduces an altitude correction factor into the composite fault criterion model. Since the vertical descent rate is naturally higher in high-altitude environments, the original weight allocation may lead to misjudgments. Therefore, the weights are dynamically adjusted based on atmospheric density sensor readings: when the altitude > 3000 meters, the vertical descent rate weight is 0.05, while the attitude consistency deviation weight is 0.25, to place greater emphasis on attitude stability judgment. The corrected composite fault judgment score is calculated using the following formula:

[0083] Among them, weight , As altitude changes continuously, the criterion maintains constant sensitivity across different airspaces.

[0084] The attitude pre-tuning control logic in step S2 incorporates air density feedforward. The backup flight controller dynamically adjusts the output limit of the PID controller based on the current density value—in low-density environments, the torque generated by the same thrust is smaller, thus allowing for a larger rotor thrust output (the upper limit is increased from 80% to 95%) to ensure sufficient attitude correction capability. Simultaneously, the angular rate limit of the suboptimal attitude window is relaxed to 35° / s to adapt to the stronger airflow disturbances at high altitudes.

[0085] This embodiment particularly enhances the ground station's remote intervention interface. This interface connects to the ground command center via an L-band satellite communication link, supporting bidirectional encrypted data transmission. When a ground operator detects an aircraft anomaly via radar or ADS-B and it has not yet automatically triggered, they can send a manual trigger request. This request includes a digital certificate and a one-time token. Upon receiving the request, the backup flight controller first verifies the identity's legitimacy, then cross-checks the current flight status (which must meet the requirements of altitude > 30 meters and vertical descent rate > 5 m / s). Only after double confirmation can the parachute deployment procedure be executed.

[0086] Example 3 This embodiment focuses on manned multirotor aircraft that take off and land on offshore platforms, facing unique challenges such as salt spray corrosion, high humidity, and sudden crosswinds. To address these environmental factors, this embodiment has specifically enhanced hardware protection and sensor robustness, and optimized drift suppression strategies after parachute deployment.

[0087] In terms of architecture, all external sensors are encapsulated with IP68 protection rating. The IMU and altimeter housings are made of titanium alloy and filled with inert gas. The CAN bus communication cable adopts a double-shielded structure, improving common-mode interference immunity to 10kV / m. The cooling system of the dual flight control computers has been changed to a liquid cooling solution to prevent the fan from being clogged by salt particles. The electromagnetic clutch of the rotor brake actuator subsystem is chrome-plated to prevent seawater corrosion and jamming.

[0088] At the methodological level, the fault diagnosis in step S1 adds an environmental interference suppression module. The high-frequency noise power spectrum of the IMU output is continuously monitored. If abnormal energy concentration occurs in the 10-50Hz frequency band (typical contact jitter characteristics caused by salt spray), the confidence weight of the IMU data during that period is automatically reduced, and more reliance is placed on GPS-assisted attitude calculation. A temperature compensation algorithm is added to the power output sensor to eliminate thrust misjudgment caused by resistance drift in high humidity environments.

[0089] In step S5, the parachute deployment mechanism subsystem is equipped with an anti-tangling guide ring for the canopy. This ring, made of carbon fiber, is installed at the parachute compartment exit and provides radial constraint at the moment of parachute deployment, preventing the canopy from folding or twisting in strong crosswinds. Simultaneously, the parachute employs an asymmetrical design: the canopy area on the windward side is slightly larger than that on the leeward side, utilizing the aerodynamic difference to generate a weak yaw moment, automatically aligning with the wind direction and reducing lateral drift.

[0090] In step S6, the event logging subsystem is augmented with humidity and salinity sensors to assess the impact of the environment on system performance. The data logging format is expanded to a composite frame structure that includes environmental parameters, facilitating subsequent corrosion lifetime analysis.

[0091] In a simulated maritime malfunction test, the aircraft triggered an emergency procedure under a 15 m / s crosswind, completing attitude pre-adjustment (final roll angle 12°, angular rate 22° / s) within 1.8 seconds. Rotor shutdown confirmation took 0.48 seconds, and the parachute deployed successfully. Thanks to the asymmetrical parachute design, in simulated crosswind scenarios at sea, this design helps reduce lateral drift distance and improves positioning controllability after emergency landing.

[0092] The above embodiments illustrate that the present invention is applicable to different application scenarios such as cities, plateaus, and seas, and can adaptively configure fault criteria, attitude windows, and parachute deployment parameters according to different environmental parameters, fully demonstrating the core technical advantages of "cooperative triggering, active attitude maintenance, and multiple redundancy protection".

[0093] Example 4 like Figure 2 As shown in the figure, this embodiment also provides a parachute cooperative triggering and attitude maintenance device for a manned multi-rotor aircraft, including: The data acquisition module is used to acquire multi-source status data of the aircraft in real time, and determine whether the aircraft is in an unrecoverable out-of-control state based on the multi-source status data. The adjustment module is used to activate the attitude pre-adjustment control logic after determining that the state is unrecoverable and out of control. The attitude pre-adjustment control logic generates a reverse attitude correction command based on the deviation value of the pitch angle and roll angle of the aircraft, drives the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, so that the aircraft converges the pitch angle and roll angle to the preset attitude safety window before the parachute opens. The braking module is used to send an emergency braking signal to the rotor motor of the aircraft after the attitude pre-adjustment meets the preset attitude safety window, so that the rotor of the aircraft performs a stop control. The deployment module is used to generate a parachute trigger permission and enable the parachute of the aircraft to deploy within a predetermined deployment time when it is confirmed that the rotor of the aircraft meets the preset stop confirmation conditions and the pitch angle and roll angle of the aircraft are still within the preset attitude safety window.

[0094] Specifically, the data acquisition module includes a multi-source state acquisition unit, a state quantity normalization unit, and a composite fault judgment unit. The multi-source state acquisition unit is used to acquire multi-source state data of the aircraft in real time. The state quantity normalization unit is used to normalize the multi-source state data. The composite fault judgment unit is used to determine whether the aircraft is in an unrecoverable runaway state based on the multi-source state data. The adjustment module includes an attitude error calculation unit, an available rotor identification unit, a power distribution unit, and an attitude window judgment unit. The attitude error calculation unit is used to obtain the deviation values ​​of the aircraft's pitch angle and roll angle. The available rotor identification unit is used to obtain the remaining available rotors of the aircraft. The power distribution unit is used to activate the attitude pre-adjustment control logic. The attitude pre-adjustment control logic generates a reverse attitude correction command based on the deviation values ​​of the aircraft's pitch angle and roll angle, drives the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, so that the aircraft converges the pitch angle and roll angle to a safe range with an absolute value less than or equal to a preset angle threshold before the parachute opens. The attitude window judgment unit is used to obtain a preset attitude safety window. The braking module includes an electronic braking control unit, a mechanical locking control unit, and a stop confirmation unit. The electronic braking control unit is used to send an emergency braking signal to the rotor motor of the aircraft. The mechanical locking control unit is used to enable the rotor of the aircraft to perform stop control. The stop confirmation unit is used to confirm that the rotor of the aircraft meets the preset stop confirmation conditions. The deployment module includes a trigger authorization unit, a dual ignition control unit, and a parachute deployment unit. The trigger authorization unit is used to generate a parachute trigger authorization, the dual ignition control unit is used to activate the parachute, and the parachute deployment unit is used to enable the aircraft's parachute to deploy within a predetermined deployment time.

[0095] Example 5 This embodiment provides a computer-readable storage medium storing a computer program thereon, the computer program including executable instructions that, when executed by a processor, implement the method described above.

[0096] The present invention can implement all or part of the processes in the above methods, or it can be accomplished by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable file, or some intermediate form. The computer-readable storage medium can include recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), and other non-volatile or volatile storage media capable of storing computer program code. It should be noted that the content contained in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0097] Example 6 like Figure 3 As shown, this embodiment provides a manned multi-rotor aircraft, including: The multi-source state awareness subsystem includes: A high-precision inertial measurement unit is used to acquire the attitude consistency deviation of the aircraft. A power output sensor, used to acquire the power output anomaly rate of the aircraft; A digital barometric altimeter is used to obtain the altitude of the aircraft. An ultrasonic vertical rate meter is used to obtain the vertical descent rate of the aircraft. An angular rate gyroscope array is used to obtain the magnitude of the attitude angular rate change of the aircraft; The dual-flight control hot standby computing subsystem includes: One or more processors; A memory for storing executable instructions of the processor, which, when executed by the one or more processors, cause the one or more processors to implement the method described above; An independent event recording subsystem is used to record the aircraft's three-axis acceleration, barometric altitude, positioning information, and time information at a preset sampling rate after receiving an emergency trigger signal, and write the flight data into a non-volatile memory; The rotor braking actuation subsystem includes several speed controllers, which are used to reduce the speed of the rotor motor; The parachute deployment mechanism subsystem includes a parachute, a gas generator for driving the parachute to deploy, and a dual ignition circuit for driving the gas generator to start.

[0098] The aircraft is represented in the form of a general-purpose computing device. The components of the aircraft may include, but are not limited to: at least one processor, at least one memory, and a bus connecting different system components (including memory and processor).

[0099] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor. The processor is the control center of a computer system, connecting all parts of the computer system through various interfaces and lines.

[0100] Memory can be used to store computer programs and / or modules. The processor implements various functions of the computer system by running or executing the computer programs and / or modules stored in the memory, and by accessing data stored in the memory. Memory can mainly include a program storage area and a data storage area. The program storage area can store the operating system and at least one application program required for a function (e.g., sound playback, image playback, etc.); the data storage area can store data created based on the use of the mobile phone (e.g., audio data, video data, etc.). Furthermore, memory can include high-speed random access memory, and can also include non-volatile memory, such as hard disks, RAM, plug-in hard disks, SmartMedia Cards (SMC), Secure Digital (SD) cards, Flash Cards, at least one disk storage device, flash memory device, or other volatile solid-state storage devices.

[0101] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, servers, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and memory) containing computer-usable program code.

[0102] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), servers, and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0103] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0104] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0105] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0106] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0107] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for parachute-assisted triggering and attitude maintenance of a manned multi-rotor aircraft, characterized in that, include: Real-time acquisition of multi-source status data of the aircraft, and determination of whether the aircraft is in an irrecoverable out-of-control state based on the multi-source status data; After determining that the state of loss of control is unrecoverable, the attitude pre-adjustment control logic is activated. The attitude pre-adjustment control logic generates a reverse attitude correction command based on the deviation value of the pitch angle and roll angle of the aircraft, drives the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, so that the aircraft converges the pitch angle and roll angle to the preset attitude safety window before the parachute opens. After the attitude pre-adjustment meets the preset attitude safety window, an emergency braking signal is sent to the rotor motor of the aircraft to make the rotor of the aircraft perform stop control. When it is confirmed that the rotor of the aircraft meets the preset stop confirmation conditions, and the pitch and roll angles of the aircraft are still within the preset attitude safety window, a parachute trigger permission is generated, so that the parachute of the aircraft can be deployed within a predetermined deployment time.

2. The method according to claim 1, characterized in that, The step of determining whether the aircraft is in an irrecoverable state of loss of control based on the multi-source state data includes: Based on the multi-source state data, the attitude angular rate mutation amplitude, power output anomaly rate, attitude consistency deviation and vertical descent rate are normalized respectively to obtain the normalized attitude angular rate mutation amplitude, normalized power output anomaly rate, normalized attitude consistency deviation and normalized vertical descent rate. The composite fault judgment score is calculated based on each normalized state variable and its corresponding weight, where each weight is a non-negative weight and the sum of all weights is 1. When the composite fault judgment score is greater than or equal to the judgment score threshold and continues to exceed the duration threshold, the aircraft is determined to meet the preset judgment condition of the unrecoverable runaway state; wherein, the preset judgment condition of the unrecoverable runaway state is used to characterize that the current state of the aircraft has exceeded the preset recoverable range of the conventional redundant control strategy.

3. The method according to claim 1, characterized in that, The initiation attitude pre-adjustment control logic generates a reverse attitude correction command based on the deviation between the aircraft's pitch and roll angles, driving the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, including: Let the pitch angle of the aircraft be... The roll angle is The corresponding reference targets are respectively and , , Then the errors in pitch angle and roll angle are respectively: Based on the pitch angle error and roll angle error, calculate the pitch correction moment and roll correction moment respectively: in, , , These are the proportional, integral, and derivative control parameters for the pitch channel. , , These are the proportional, integral, and derivative control parameters for the roll channel. and They are respectively direction and The direction is based on the feedforward compensation term derived from the location of the failed rotor and the amount of thrust loss. For the body The control torque of the shaft corresponds to the roll correction. For the body The control torque of the axis corresponds to pitch correction; The generalized control vector is composed based on the desired control torque: in, This is the additional total thrust along the vertical direction of the fuselage, used to compensate for changes in total lift. This is the control torque about the z-axis of the aircraft, corresponding to yaw suppression or maintenance. It is a generalized control vector; Establish a power distribution matrix based on the available rotor set: in, For the collection of available rotors, For the first One usable rotor, For the first The x-coordinate, y-coordinate, and rotation direction of the rotor can be used in the airframe coordinate system. This is the rotor anti-torque coefficient. Assign a dynamics matrix; A linearized power distribution relationship is established based on the generalized control vector and the power distribution matrix to obtain the available rotor thrust increment vector. : in, This indicates that saturation constraints are applied based on the upper and lower limits of rotor thrust. The thrust increment of the failed rotor is set to 0 and is not included in the available rotor power distribution matrix. The construction; Assign matrix to available rotor power The generalized inverse matrix; The thrust limit for each available rotor is obtained based on the available rotor thrust increment vector: in, For the first Each available rotor relative to the current baseline thrust The thrust increment to be allocated This is the actual thrust increment command after saturation limiting; and The first The minimum and maximum thrust allowed by each available rotor; , , respectively representing the first The lower and upper limits of the available rotor thrust increment.

4. The method according to claim 1, characterized in that, The preset posture safety window includes a first posture safety window or a second posture safety window; If the aircraft can converge both pitch and roll angles to an absolute value less than or equal to the first angle threshold before parachute deployment within the attitude pre-adjustment time window, then the preset attitude safety window is the first attitude safety window. If the aircraft cannot converge both pitch and roll angles to an absolute value less than or equal to the first angle threshold before parachute deployment within the attitude pre-adjustment time window, then the preset attitude safety window is the second attitude safety window. The second attitude safety window includes: the absolute values ​​of pitch angle and roll angle are both less than or equal to a second angle threshold, and the absolute values ​​of angular rates of pitch angle and roll angle are both less than or equal to a preset angular rate threshold, wherein the second angle threshold is greater than the first angle threshold.

5. The method according to claim 1, characterized in that, After the attitude pre-adjustment meets the preset attitude safety window, an emergency braking signal is sent to the rotor motor of the aircraft to cause the rotor of the aircraft to perform a stop control, including: The rotor motor of the aircraft adopts a dual-redundant braking strategy. The first stage is electronic braking, which is used to control the rotor motor to generate braking torque through the speed controller. The second stage is mechanical braking. When the electronic braking fails to make the rotor meet the preset stop confirmation conditions within the rotor stop time window, the mechanical locking mechanism is automatically activated to restrict the rotor from continuing to rotate. The mechanical locking mechanism includes at least one of an electromagnetic clutch, a brake disc, a brake caliper, or a mechanical limiting component.

6. The method according to claim 1, characterized in that, The step of ensuring that the aircraft's parachute deploys within a predetermined deployment time after confirming that the rotational speed of all rotors is below a preset safe rotational speed threshold and maintaining this confirmation for a preset time includes: The parachute is deployed by a gas generator, which is activated by a dual ignition circuit, including a main ignition circuit and a backup ignition circuit. The main ignition circuit and the backup ignition circuit are isolated from each other. When either circuit receives a valid trigger signal, the gas generator is activated. The parachute adopts a cross-shaped strip stabilizer structure. The preset area value, preset overload threshold, and predetermined length are determined based on the aircraft's maximum takeoff weight, minimum opening altitude, descent speed before opening, and allowable occupant overload range.

7. The method according to claim 1, characterized in that, Also includes: After confirming that the parachute has fully deployed, flight data is recorded at a preset sampling rate. The flight data includes the aircraft's three-axis acceleration, barometric altitude, GPS position, and internal clock. The flight data is written to non-volatile memory in a circular buffer manner. Before overwriting old data, a CRC32 check must be performed. The writing process continues until the aircraft's power is exhausted after landing or the power is manually cut off.

8. The method according to claim 1, characterized in that, Before the start-up attitude pre-adjustment control logic, the following is also included: Obtain a first manually triggered request, which contains dual authentication information of a digital certificate and a one-time token; After the dual authentication information is verified, a flight status confirmation is performed. The flight status confirmation includes at least the following: the current altitude is greater than the minimum parachute deployment altitude threshold, the vertical descent rate is greater than the trigger threshold, and the attitude angular rate meets the parachute deployment window requirements. After the flight status is confirmed, a second manual trigger request is obtained. The second manual trigger request is only used as an authorization signal to start the attitude pre-adjustment control logic. After receiving the second manual trigger request, the aircraft still needs to perform attitude pre-adjustment, rotor stop confirmation and parachute trigger permission judgment in sequence.

9. A parachute-assisted triggering and attitude-maintaining device for a manned multi-rotor aircraft, characterized in that, include: The data acquisition module is used to acquire multi-source status data of the aircraft in real time, and determine whether the aircraft is in an unrecoverable out-of-control state based on the multi-source status data. The adjustment module is used to activate the attitude pre-adjustment control logic after determining that the state is unrecoverable and out of control. The attitude pre-adjustment control logic generates a reverse attitude correction command based on the deviation value of the pitch angle and roll angle of the aircraft, drives the remaining available rotors of the aircraft to generate an incremental vector of available rotor thrust, so that the aircraft converges the pitch angle and roll angle to the preset attitude safety window before the parachute opens. The braking module is used to send an emergency braking signal to the rotor motor of the aircraft after the attitude pre-adjustment meets the preset attitude safety window, so that the rotor of the aircraft performs a stop control. The deployment module is used to generate a parachute trigger permission and enable the parachute of the aircraft to deploy within a predetermined deployment time when it is confirmed that the rotor of the aircraft meets the preset stop confirmation conditions and the pitch angle and roll angle of the aircraft are still within the preset attitude safety window.

10. A manned multi-rotor aircraft, characterized in that, include: The multi-source state awareness subsystem includes: A high-precision inertial measurement unit is used to acquire the attitude consistency deviation of the aircraft. A power output sensor, used to acquire the power output anomaly rate of the aircraft; A digital barometric altimeter is used to obtain the altitude of the aircraft. An ultrasonic vertical rate meter is used to obtain the vertical descent rate of the aircraft. An angular rate gyroscope array is used to obtain the magnitude of the attitude angular rate change of the aircraft; The dual-flight control hot standby computing subsystem includes: One or more processors; A memory for storing executable instructions of the processor, which, when executed by the one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 8; An independent event recording subsystem is used to record the aircraft's three-axis acceleration, barometric altitude, positioning information, and time information at a preset sampling rate after receiving an emergency trigger signal, and write the flight data into a non-volatile memory; The rotor braking actuation subsystem includes several speed controllers, which are used to reduce the speed of the rotor motor; The parachute deployment mechanism subsystem includes a parachute, a gas generator for driving the parachute to deploy, and a dual ignition circuit for driving the gas generator to start.

Images