A heterogeneous flight control core circuit and system

Abstract

This invention belongs to the field of flight control computer hardware architecture technology, specifically relating to a heterogeneous flight control core circuit and system. This invention integrates a microcontroller unit and an artificial intelligence coprocessor unit on the same printed circuit board, achieving data and command interaction through isolated high-speed interconnect channels. The microcontroller unit constitutes the safety control and real-time decision-making domain, used to execute safety-critical and hard real-time tasks, and to implement operational management and fault isolation for the artificial intelligence coprocessor unit; the artificial intelligence coprocessor unit constitutes the intelligent sensing and computing domain, used to execute computationally intensive and non-real-time critical tasks. This architecture achieves decoupling and collaboration between the safety domain and the computing domain at the hardware level, ensuring both high functional safety and determinism in flight control, while fully releasing the high-performance computing power required for intelligent sensing, thus meeting the dual requirements of advanced aircraft for highly reliable flight control and intelligent function expansion.

Description

Technical Field

[0001] This invention belongs to the field of flight control computer hardware architecture technology, specifically relating to a heterogeneous flight control core circuit and system. Background Technology

[0002] With the rapid popularization and intelligent evolution of advanced aircraft such as electric vertical takeoff and landing (EVTOL) aircraft and drones in logistics, urban air traffic, and emergency response, the performance of the flight control core circuit, as the control and computing center of the entire aircraft, directly affects the aircraft's flight safety and operational capabilities. In actual operation, these aircraft need to stably perform safety-critical real-time tasks such as attitude calculation, navigation control, and multi-channel actuator actuation. Simultaneously, they need to possess intelligent functions such as environmental perception, real-time path planning, and autonomous obstacle avoidance decision-making. This places stringent requirements on the flight control core circuit to ensure the synergistic compatibility of high-performance computing power and high functional safety levels.

[0003] Currently, the flight control field commonly employs a single enhanced microcontroller as the core processing unit. This approach relies on mature automotive-grade or industrial-grade microcontroller hardware platforms, possessing robust functional safety mechanisms such as lockstep kernels, memory protection units, and hardware fault diagnosis. It can perform aircraft attitude calculations and control law execution with high determinism and low latency, meeting the functional safety and real-time requirements of basic aircraft flight control. However, limited by the on-chip computing resources and parallel processing capabilities of microcontrollers, this approach faces significant bottlenecks in hardware computing power. When performing computationally intensive tasks such as real-time environmental perception based on deep learning, high-resolution visual semantic segmentation, or complex 3D path planning, a single microcontroller architecture struggles to provide stable and sufficient computing power, failing to meet the functional expansion needs of advanced aircraft striving for higher levels of autonomy and intelligence, thus hindering further improvements in the overall aircraft's intelligence level.

[0004] On the other hand, AI processing chips exhibit significant advantages in computing power density and energy efficiency, making them particularly suitable for data-driven tasks such as convolutional neural network inference and multi-sensor data fusion. However, relying entirely on AI processing chips for core flight control tasks presents inherent risks, including unstable algorithm states, uncertain output results, and black-box characteristics in internal logic. The inference process of AI-related algorithms is susceptible to input disturbances and model boundary conditions, and may experience probabilistic failures or accuracy degradation under long-term continuous operation. Their real-time performance and continuity cannot be adequately guaranteed, failing to meet the high functional safety standards required for aircraft flight control and significantly increasing safety hazards during flight.

[0005] In summary, the existing processing architecture is unable to simultaneously meet the dual requirements of advanced aircraft for high functional safety and high-performance intelligent perception. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention provides a heterogeneous flight control core circuit and system that integrates a microcontroller and an artificial intelligence coprocessor.

[0007] The present invention aims to provide a core processing architecture for flight control that can meet the dual requirements of high functional safety level and high computing power intelligent perception for aircraft flight control, and also has efficient and stable data interaction capabilities.

[0008] The first aspect of this invention provides a heterogeneous flight control core circuit, comprising: The microcontroller unit forms the safety control and real-time decision domain, used to perform safety-critical and hard real-time tasks; Artificial intelligence coprocessor units constitute intelligent sensing and computing domains, used to perform computationally intensive and non-real-time critical tasks; The microcontroller unit and the artificial intelligence coprocessor unit are integrated on the same printed circuit board and interact with data commands through isolated high-speed interconnect channels; The microcontroller unit is also used to manage the operation and isolate faults of the artificial intelligence coprocessor unit.

[0009] As a further optimization of the aforementioned heterogeneous flight control core circuit, the microcontroller unit is a microcontroller compliant with the ASIL-D standard, integrating a lockstep core, a high-precision timer, a memory protection unit, and communication peripherals.

[0010] As a further optimization of the aforementioned heterogeneous flight control core circuit, the artificial intelligence coprocessor unit is a system-on-a-chip that integrates a neural network processing unit and a high-speed visual data receiving interface. The high-speed visual data receiving interface is used to directly couple multiple visual sensors to obtain high-bandwidth environmental perception data streams.

[0011] As a further optimization of the aforementioned heterogeneous flight control core circuit, the isolated high-speed interconnect channel includes multiple communication interfaces isolated by digital isolation devices. The communication interfaces include a first interface for high-frequency deterministic data transmission and a second interface for low-frequency status and command interaction.

[0012] A second aspect of the present invention provides a heterogeneous flight control system, comprising any of the above-described heterogeneous flight control core circuits, wherein: The microcontroller unit is used to perform the following safety-critical and hard real-time tasks: data acquisition and multi-sensor fusion of safety-critical sensors, calculation of flight attitude and navigation information, real-time calculation of flight control laws and generation of actuator control signals, and fault diagnosis and safety management of the whole system. The AI ​​coprocessor unit is specifically used to perform the following computationally intensive and non-real-time critical tasks: processing high-bandwidth data streams from multiple visual sensors through its high-speed visual data receiving interface, running environmental perception and recognition models based on deep neural networks, and performing path planning and behavioral decisions based on perception results.

[0013] As a further optimization of the aforementioned heterogeneous flight control system, the microcontroller unit is also configured to perform a power-on self-test process after power-on, which includes power and clock checks, memory integrity verification, lockstep kernel consistency verification, and key peripheral function tests; only after the self-test results are qualified will the microcontroller unit output an enable signal to start the power supply and initialization process of the artificial intelligence coprocessor unit.

[0014] As a further optimization of the aforementioned heterogeneous flight control system, the process by which the microcontroller unit initiates the artificial intelligence coprocessor unit includes: Power on the AI ​​coprocessor unit is enabled via a control pin; A start command is sent to the AI ​​coprocessor unit via the second interface in the isolated high-speed interconnect channel; Receive and verify the status indication signals periodically sent by the AI ​​coprocessor unit after initialization to confirm that the AI ​​coprocessor unit has entered normal working state.

[0015] As a further optimization of the aforementioned heterogeneous flight control system, the data interaction between the microcontroller unit and the artificial intelligence coprocessor unit adopts a combination of periodic and event-triggered methods; wherein, high real-time status data is transmitted through the first interface in the isolated high-speed interconnect channel at a first preset frequency, and perception planning result data is transmitted through the second interface in the isolated high-speed interconnect channel at a second preset frequency; the interaction data adopts a data frame format that includes integrity verification and sequence identification.

[0016] As a further optimization of the aforementioned heterogeneous flight control system, the microcontroller unit runs an instruction fusion management logic, which simultaneously receives intelligent planning instructions from the artificial intelligence coprocessor unit and basic control instructions generated based on preset strategies or remote control instructions. When the artificial intelligence coprocessor unit is working normally, the instruction fusion management logic uses a weighted fusion strategy to generate the final control instructions, so that the aircraft mainly follows the intelligent planning instructions and retains the stability of the basic control instructions. When an abnormal operating state of the AI ​​coprocessor unit is detected, the instruction fusion management logic switches to an independent control mode that relies entirely on basic control instructions.

[0017] As a further optimization of the aforementioned heterogeneous flight control system, the microcontroller unit is also configured to continuously monitor the artificial intelligence coprocessor unit. When at least one fault condition is detected, including status signal timeout, data rationality exceeding limits, communication verification failures accumulating to a preset threshold, or abnormal power supply parameters, fault isolation and safety degradation operations are performed. Fault isolation operations include: at the logical level, stopping the incorporation of AI coprocessor unit instructions into control instruction fusion and switching to a safe control mode that relies entirely on the microcontroller unit's internal basic instructions; at the physical level, cutting off the power supply to the AI ​​coprocessor unit and / or disabling isolated high-speed interconnect channels. After completing fault isolation, the microcontroller unit executes a simplified safety control law based on the current flight status and preset safety strategy, using data from its directly connected sensors, to control the aircraft to perform hovering, return to home, or landing operations, and outputs fault status information through the telemetry link.

[0018] Beneficial effects This invention heterogeneously integrates a microcontroller unit and an artificial intelligence coprocessor unit on a single printed circuit board, achieving independent division and efficient collaboration of the safety control and real-time decision-making domain, and the intelligent sensing and computing domain at the hardware level. This ensures high functional safety and operational determinism of the system while fully releasing the high-performance computing power of intelligent sensing and computing, realizing integrated collaborative operation of high functional safety, high-performance intelligent sensing, and high-reliability flight control. The microcontroller unit and the artificial intelligence coprocessor unit complete stable data and command interaction through isolated high-speed interconnect channels, while natively supporting high-reliability access from multiple GMSL cameras, effectively simplifying system wiring and improving the anti-interference capability and stability of signal transmission. The high integration of core computing, sensing access, and communication interaction functional units significantly reduces the overall system complexity, weight, and power consumption. Combined with the fault isolation, safety management, and safety degradation operation mechanism led by the microcontroller unit, the system's fault tolerance and operational resilience are significantly improved. This solution is based on mature commercial chips for integrated design, achieving excellent performance and reliability while effectively avoiding the R&D costs and cycle risks of customized chips, greatly improving the engineering feasibility and productization efficiency of the solution. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the heterogeneous flight control core circuit system architecture that integrates a microcontroller and a coprocessor according to the present invention.

[0020] Figure 2 This is a flowchart illustrating the software task collaboration and security monitoring process between the microcontroller and the coprocessor. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the present invention clearer, the heterogeneous flight control core circuit and the heterogeneous flight control system including the circuit will be clearly and completely described below with reference to the accompanying drawings and specific embodiments.

[0022] The heterogeneous flight control core circuit includes a microcontroller unit and an artificial intelligence coprocessor unit integrated on the same printed circuit board.

[0023] The microcontroller unit adopts a microcontroller compliant with the ASIL-D standard, forming the circuit's safety control and real-time decision domain. It integrates a lockstep kernel, high-precision timers, memory protection units, and communication peripherals, and is responsible for executing all safety-critical and hard real-time tasks, including: data acquisition and multi-sensor fusion from safety-critical sensors such as the inertial measurement unit and barometer; calculation of flight attitude, position, and navigation information; real-time calculation of flight control laws and generation of multi-channel PWM control signals; and fault diagnosis, health management, and safety monitoring of the entire system.

[0024] The AI ​​coprocessor unit employs a system-on-a-chip integrating a neural network processing unit, forming the intelligent sensing and computing domain of the circuit. It possesses parallel floating-point and integer computing capabilities and is responsible for running computationally intensive and non-real-time critical tasks, including: receiving and processing raw high-bandwidth data streams from multiple GMSL cameras and other sensors via a high-speed serial-to-deserializer interface; running deep learning models to achieve real-time environmental perception, target recognition, semantic segmentation, and visual odometry; and executing real-time path planning and behavioral decision-making based on AI models.

[0025] The two systems interact via an isolated high-speed interconnect channel, with the microcontroller unit controlling the operation and fault isolation of the AI ​​coprocessor unit. This heterogeneous flight control system achieves integrated collaborative operation of high functional safety, high-performance intelligent perception, and high-reliability flight control through the decoupled integration of the hardware-level safety domain and the computing power domain.

[0026] The present invention is further illustrated below with specific embodiments. These embodiments are exemplary and intended to illustrate the problem and explain the present invention, and are not intended to be limiting. Example

[0027] like Figure 1 The heterogeneous flight control system shown uses an automotive-grade NXP S32K342 chip as its microcontroller unit, and integrates a GMSL deserializer and an NVIDIA Jetson Orin Nano module in its artificial intelligence coprocessor unit. The microcontroller unit and the artificial intelligence coprocessor unit are mounted on the same printed circuit board.

[0028] The microcontroller unit connects to the corresponding interface of the AI ​​coprocessor unit via its SPI and UART pins and the ADI ADuM162N series digital isolation chip, forming an isolated bidirectional communication channel. Multiple GMSL cameras are directly connected to the GMSL input interface of the AI ​​coprocessor unit via coaxial cables.

[0029] During flight, the AI ​​coprocessor unit acquires camera video streams via the GMSL interface, runs visual perception algorithms, and sends the identified obstacle locations and planned waypoint results to the microcontroller unit via an isolated serial port. The microcontroller unit simultaneously collects and integrates data from its connected high-precision IMU, magnetometer, and barometer to calculate the precise aircraft attitude, position, and velocity. Subsequently, the microcontroller unit combines its own calculated state with instructions from the AI ​​coprocessor unit to execute the final control law, generating PWM signals to drive the motors and control surfaces. Throughout the process, the microcontroller unit continuously monitors the AI ​​coprocessor unit's "heartbeat" signals and data integrity. If any anomalies are detected, the microcontroller unit cuts off its reliance on the AI ​​coprocessor unit's instructions and uses its built-in basic algorithms to control the aircraft for a safe landing.

[0030] The following combination Figure 2 The system architecture shown above will be explained in detail, along with its specific working process.

[0031] After the system is powered on, the microcontroller unit first performs a complete power-on self-test and initialization process, including the following steps: Step 1: Power Supply and Clock Check. Upon power-up, the integrated power supply monitoring module and clock monitoring unit immediately activate. The monitoring module first checks whether the core supply voltage (VDD) and backup domain voltage are both stable within the nominal value of 3.3V ± 5% to confirm that the power supply system is not experiencing undervoltage or overvoltage abnormalities. Simultaneously, the clock monitoring unit checks whether the main clock (external crystal oscillator) and internal RC clock can oscillate stably, ensuring the stable and reliable power supply and clock foundation of the microcontroller unit.

[0032] Step 2: Memory Self-Test. The microcontroller unit sequentially performs integrity and functional checks on its Flash memory and SRAM. For the Flash memory, it calculates and verifies the Cyclic Redundancy Check (CRC) code to confirm that the stored program code has not been corrupted or tampered with. For the SRAM, it checks the read / write functionality of each bit by writing a specific test code (0xAA55AA55) to each storage bit and then comparing the data at that location, ensuring that the memory can store and retrieve data normally.

[0033] Step 3: Lockstep Kernel Self-Test. The lockstep dual cores of the microcontroller unit will execute the same test code sequence synchronously. The self-test logic will compare the output results of the two cores in real time at each clock cycle. By verifying that the calculation results of the two cores are completely consistent and there is no loss of synchronization, the reliability of the lockstep kernel is ensured, and the accuracy of subsequent control instruction calculation is guaranteed.

[0034] Step 4: Peripheral Function Verification. Perform rapid functional verification on analog / digital peripherals that are highly relevant to system safety. Specifically, this includes: verifying that the conversion value of the ADC peripheral is within the preset error range by sampling the known reference voltage provided by the internal bandgap reference, ensuring the accuracy of ADC sampling; verifying that the frequency and duty cycle of the output PWM / Timer meet preset requirements by outputting a test PWM pulse and reading it back through another input capture function; and verifying that the watchdog peripheral's reset function is effective by triggering an independent watchdog timeout test, ensuring timely system reset in abnormal situations.

[0035] Step 5: Communication Interface Loopback Test. After initialization and configuration, set the CAN FD controller and SPI interface used for communication to internal loopback mode. Verify the normal operation of the communication controller's underlying functions by automatically sending and receiving a set of preset test data.

[0036] Self-test pass criteria: All the above self-test steps must be completed within a preset time (100ms), and each test result must meet the expected result for the microcontroller unit to be considered to have passed the power-on self-test. If any step fails, the microcontroller unit will immediately record the error code to non-volatile memory and, depending on the severity of the fault, maintain a limited fail-safe state (maintaining only its own power supply and basic clock). In this state, the microcontroller unit will not issue start commands to the downstream AI coprocessor unit, nor will it drive any actuators, to avoid the fault escalating and causing system damage or flight safety accidents.

[0037] After the microcontroller unit completes its own power-on self-test and passes the test, it enters the startup process of the artificial intelligence coprocessor unit, which includes the following steps: Step 1: Microcontroller unit controls power-on and enable. The microcontroller unit controls the power management chip through a GPIO pin to power on the core power rail (5V_IN) of the AI ​​coprocessor module, ensuring a stable power supply for the AI ​​coprocessor module. Subsequently, the microcontroller unit sends a high-level pulse through another GPIO pin (JETSON_PWR_EN) to trigger the hardware power-on sequence of the AI ​​coprocessor module, initiating the power-on process of the AI ​​coprocessor module.

[0038] Step 2: Boot Command and Program Loading. After the AI ​​coprocessor module is powered on, it first runs its onboard bootloader program. The microcontroller unit sends a predefined boot command frame (ASCII string "BOOT_LINUX") to the AI ​​coprocessor module's bootloader at a fixed baud rate (115200) through the initialized UART channel isolated by the ADI ADuM162N digital isolation chip. Upon receiving this valid boot command, the AI ​​coprocessor module's bootloader loads the preset operating system (a Linux system with the RT-Preempt patch) and application image from the local eMMC storage device, completing the program loading preparation.

[0039] Step 3: AI Initialization and Status Reporting. After the operating system of the AI ​​coprocessor unit starts up, the main control application will automatically run. The main control application first completes its own initialization operations, specifically including loading the neural network model into the GPU memory, initializing the GMSL deserializer and camera driver, and establishing a UART / SPI link with the microcontroller unit to ensure that the communication channel is normal. After initialization, the AI ​​coprocessor unit's application continuously sends "heartbeat" signals to the microcontroller unit at a fixed period (1Hz) through the same UART communication channel for the microcontroller unit to monitor its working status.

[0040] Step 4: Microcontroller Unit Confirmation and System Readiness. After sending a start command to the AI ​​coprocessor unit, the microcontroller unit immediately starts a timer and enters the stage of waiting to receive the "ready" status frame from the AI ​​coprocessor unit. If the microcontroller unit continuously receives valid "ready" status frames from the AI ​​coprocessor unit within the preset timeout period (30 seconds), it determines that the AI ​​coprocessor unit has started successfully, and the entire system enters the normal collaborative working mode. If the microcontroller unit does not receive a "ready" status frame within the timeout period, or the received "ready" status frame data is invalid, it determines that the AI ​​coprocessor unit has failed to start, and the microcontroller unit will enter the exception handling process.

[0041] When the microcontroller unit passes its self-test and the AI ​​coprocessor unit is in normal startup mode, the system can enter the normal collaborative working mode. In this mode, the microcontroller unit and the AI ​​coprocessor unit will achieve real-time collaboration and data interaction according to preset rules. The specific process is as follows: Real-time data interaction rules: The microcontroller unit and the artificial intelligence coprocessor unit interact with each other using a combination of periodic and event-triggered methods to ensure low latency and determinism in data transmission. Specifically, the microcontroller unit sends fused aircraft attitude, velocity, and raw IMU data to the artificial intelligence coprocessor unit via the SPI channel (with the microcontroller unit as the master device) at a fixed high frequency (100Hz), ensuring low latency and determinism. The artificial intelligence coprocessor unit sends obstacle locations and planned waypoints to the microcontroller unit via the UART channel at a slightly lower but fixed frequency (30Hz), enabling ordered data interaction. All interactive data is encapsulated into complete data frames. Each frame includes a frame header, frame length, timestamp, data payload, sequence number, and CRC16 checksum. Upon receiving a data frame, the receiver must verify the continuity of the CRC16 checksum and sequence number. If the verification fails, the frame is discarded and the error is recorded, ensuring reliable data transmission.

[0042] Control command fusion logic: The microcontroller unit runs an internal command fusion manager that simultaneously receives two input commands: an intelligent command (Cmd_AI) from the AI ​​coprocessor unit and a basic command (Cmd_Base) generated internally by the microcontroller unit based on preset waypoints or remote control commands. When the AI ​​coprocessor unit is functioning normally (normal heartbeat, reasonable data), the microcontroller unit employs a weighted fusion strategy. The final fused control command (Cmd_Final) is calculated as Cmd_Final = 0.7 × Cmd_AI + 0.3 × Cmd_Base, ensuring the aircraft primarily follows the intelligent planning of the AI ​​coprocessor unit while preserving the stability of the basic command. When the microcontroller unit detects an anomaly or failure in the AI ​​coprocessor unit's command, the fusion strategy immediately switches, and the final control command changes to Cmd_Final = 1.0 × Cmd_Base, relying entirely on the basic command within the microcontroller unit to control the aircraft and ensure flight safety.

[0043] AI Result Transmission Method: After completing visual perception, obstacle recognition, and path planning, the AI ​​coprocessor unit structures the results and compresses them into lightweight data packets. Each data packet contains a timestamp, the number of obstacles N, and the relative distance, azimuth angle, and type confidence level of each obstacle. It also includes the expected position coordinates (X, Y, Z) and expected yaw angle for the next moment. This data packet is serialized and sent to the microcontroller unit via the UART channel at fixed intervals. The microcontroller unit then fuses and processes control commands, ensuring that it can promptly obtain the planning results from the AI ​​coprocessor unit and achieve collaborative control between the two.

[0044] During normal collaborative operation of the system, the microcontroller unit always runs an independent monitoring thread to monitor the working status of the artificial intelligence coprocessor unit in real time. Once an anomaly is detected, the anomaly handling process is immediately initiated, as follows: Fault Detection and Judgment Conditions: The monitoring thread of the microcontroller unit continuously checks four conditions. If any one of these conditions is met, the AI ​​coprocessor unit is judged to have malfunctioned. These conditions are: 1. Heartbeat timeout: No "heartbeat" signal is received from the AI ​​coprocessor unit for more than a predetermined time (300ms); 2. Data validity error: Data is received from the AI ​​coprocessor unit, but the data content is outside the valid range, such as planned waypoints exceeding flight boundaries or excessive speed commands; 3. Communication verification failure: CRC verification errors occur in multiple consecutive (5 times) UART / SPI data frames received from the AI ​​coprocessor unit; 4. Hardware status abnormality: The core power supply current or voltage of the AI ​​coprocessor unit monitored by the ADC peripheral is abnormal.

[0045] The isolation and disconnection operation is as follows: When a fault is detected in the AI ​​coprocessor unit, the microcontroller unit immediately performs a dual isolation and disconnection operation. Firstly, there is logical isolation: the microcontroller unit immediately stops receiving and ignores all data and instructions from the AI ​​coprocessor unit, and simultaneously switches the control instruction fusion logic to rely 100% on internal base instructions (Cmd_Base), completely severing the dependence on AI coprocessor unit instructions. Secondly, there is physical isolation: the microcontroller unit controls the GPIO pin to pull low the AI ​​coprocessor unit's enable pin (JETSON_PWR_EN), and simultaneously sends a command to the power management chip to cut off the core power supply to the AI ​​coprocessor unit module (necessary standby power can be retained as needed). Furthermore, through the enable pin of the ADI ADuM162N digital isolation chip, the electrical connection of the SPI / UART communication channel is disabled, achieving complete physical isolation between the AI ​​coprocessor unit and the microcontroller unit, preventing fault propagation.

[0046] Switching to Pure MCU Safety Mode and Safe Return Procedure: After the isolation and disconnection operation is completed, the microcontroller unit immediately switches from cooperative intelligent mode to independent safety mode and executes a safe return or landing operation based on the current flight status and preset safety strategy. First, the microcontroller unit determines the current flight status of the aircraft, such as position, altitude, and battery level, through its directly connected IMU, barometer, and GPS (if available). Then, it calls the preset safety strategy stored in its own Flash memory and selects to perform one of the following operations: If the GPS signal is good and the airspace is safe, it controls the aircraft to hover stably in place; if the conditions for returning to home are met, it calculates and flies to the preset home point to perform automatic return; if returning to home is not possible (e.g., due to excessive distance or insufficient battery power), it performs a slow vertical descent at the current position. During the return or landing process, the microcontroller unit relies solely on its connected sensors for navigation calculations, runs a simplified, highly deterministic backup control law, and generates PWM signals to directly control the propulsion system until the aircraft touches the ground. Meanwhile, the microcontroller unit continuously sends status information such as "AI malfunction, entered safe mode, returning to home / landing" to the ground station via telemetry link, so that ground personnel can monitor the aircraft's status in real time.

[0047] The above embodiments are exemplary and are intended to illustrate the technical concept and features of the present invention, so that those skilled in the art can understand the content of the present invention and implement it accordingly. They should not be construed as limiting the scope of protection of the present invention. All equivalent changes or modifications made according to the spirit and essence of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A heterogeneous flight control core circuit, characterized in that, include: The microcontroller unit forms the safety control and real-time decision domain, used to perform safety-critical and hard real-time tasks; Artificial intelligence coprocessor units constitute intelligent sensing and computing domains, used to perform computationally intensive and non-real-time critical tasks; The microcontroller unit and the artificial intelligence coprocessor unit are integrated on the same printed circuit board and interact with data commands through an isolated high-speed interconnect channel; The microcontroller unit is also used to control the operation and isolate faults of the artificial intelligence coprocessor unit.

2. The heterogeneous flight control core circuit according to claim 1, characterized in that, The microcontroller unit is an ASIL-D compliant microcontroller that integrates a lockstep kernel, a high-precision timer, a memory protection unit, and communication peripherals.

3. The heterogeneous flight control core circuit according to claim 1, characterized in that, The artificial intelligence coprocessor unit is a system-on-a-chip that integrates a neural network processing unit and a high-speed visual data receiving interface. The high-speed visual data receiving interface is used to directly couple multiple visual sensors to obtain a high-bandwidth environmental perception data stream.

4. The heterogeneous flight control core circuit according to claim 1, characterized in that, The isolated high-speed interconnect channel includes multiple communication interfaces isolated by digital isolation devices. The communication interfaces include a first interface for high-frequency deterministic data transmission and a second interface for low-frequency status and command interaction.

5. A heterogeneous flight control system, characterized in that, Includes the heterogeneous flight control core circuit as described in any one of claims 1 to 4, wherein: The microcontroller unit is used to perform the following safety-critical and hard real-time tasks: data acquisition and multi-sensor fusion of safety-critical sensors, calculation of flight attitude and navigation information, real-time calculation of flight control laws and generation of actuator control signals, and fault diagnosis and safety management of the whole system. The AI ​​coprocessor unit is specifically used to perform the following computationally intensive and non-real-time critical tasks: processing high-bandwidth data streams from multiple visual sensors through its high-speed visual data receiving interface, running environmental perception and recognition models based on deep neural networks, and performing path planning and behavior decisions based on perception results.

6. The heterogeneous flight control system according to claim 5, characterized in that, The microcontroller unit is also configured to perform a power-on self-test process after power-on, which includes power and clock checks, memory integrity verification, lockstep kernel consistency verification, and key peripheral function tests; the microcontroller unit outputs an enable signal to start the power supply and initialization process of the artificial intelligence coprocessor unit only after the self-test result is qualified.

7. The heterogeneous flight control system according to claim 6, characterized in that, The process by which the microcontroller unit initiates the artificial intelligence coprocessor unit includes: Power on the AI ​​coprocessor unit is enabled via a control pin; A start command is sent to the artificial intelligence coprocessor unit through the second interface in the isolated high-speed interconnect channel; The status indication signal periodically sent by the artificial intelligence coprocessor unit after initialization is received and verified to confirm that the artificial intelligence coprocessor unit has entered a normal working state.

8. The heterogeneous flight control system according to claim 5, characterized in that, The data interaction between the microcontroller unit and the artificial intelligence coprocessor unit is carried out in a combination of periodic and event-triggered methods; wherein, high real-time status data is transmitted through the first interface in the isolated high-speed interconnect channel at a first preset frequency, and perception planning result data is transmitted through the second interface in the isolated high-speed interconnect channel at a second preset frequency; the interaction data adopts a data frame format that includes integrity verification and sequence identification.

9. The heterogeneous flight control system according to claim 5, characterized in that, The microcontroller unit internally runs instruction fusion management logic, which simultaneously receives intelligent planning instructions from the artificial intelligence coprocessor unit and basic control instructions generated based on preset strategies or remote control instructions; When the artificial intelligence coprocessor unit is working normally, the instruction fusion management logic uses a weighted fusion strategy to generate the final control instructions, so that the aircraft mainly follows the intelligent planning instructions and retains the stability of the basic control instructions; When an abnormal operating state of the artificial intelligence coprocessor unit is detected, the instruction fusion management logic switches to an independent control mode that relies entirely on the basic control instructions.

10. The heterogeneous flight control system according to claim 5, characterized in that, The microcontroller unit is also configured to continuously monitor the artificial intelligence coprocessor unit, and when at least one fault condition is detected, including status signal timeout, data rationality exceeding limits, communication verification failures accumulating to a preset threshold, or abnormal power supply parameters, fault isolation and security degradation operations are performed. The fault isolation operation includes: stopping the inclusion of instructions from the AI ​​coprocessor unit into control instruction fusion at the logic level, and switching to a safe control mode that relies entirely on the basic instructions inside the microcontroller unit; Physically disconnect the power supply to the AI ​​coprocessor unit and / or disable the isolated high-speed interconnect channel; After completing fault isolation, the microcontroller unit executes a simplified safety control law based on the current flight status and preset safety strategy, using data from its directly connected sensors, to control the aircraft to perform hovering, return-to-home, or landing operations, and outputs fault status information through the telemetry link.

Images