A method and system for controlling the flight of a drone

Abstract

The application discloses a kind of unmanned aerial vehicle flight control method and system, for solving the protection level failure caused by navigation error non-gaussian distribution and the problem of frequent false trigger of flight control of unmanned aerial vehicle in complex electromagnetic environment of city low altitude. Method includes obtaining bottom sensor original observation value, using robust filtering algorithm to suppress multipath interference and output residual error;Non-gaussian error boundary is constructed based on set theory geometric envelope algorithm, and the rigidity quantitative index of navigation reliability is deduced by protection level;Dynamic mapping operation risk alarm limit, and introduce time anti-shake tolerance window to filter transient signal burr;When reliability is continuously broken down, trigger state machine to execute stepwise autonomous degradation. The application breaks the limitation of traditional gaussian hypothesis, and considers the absolute safety and task continuity of flight.

Description

Technical Field

[0001] This invention belongs to the field of interdisciplinary technology of UAV navigation and automatic control, and in particular relates to a UAV flight control method and system. Background Technology

[0002] With the explosive growth of the "low-altitude economy" and urban air traffic (UAM), drones are increasingly being used in urban logistics, precision inspection, and emergency rescue. However, the urban low-altitude environment (such as urban canyons, high-rise buildings, and under overpasses) presents extremely complex electromagnetic and physical obstructions. In such scenarios, Global Navigation Satellite System (GNSS) signals are highly susceptible to severe multipath effects and non-line-of-sight propagation interference, causing traditional single-satellite navigation or loosely coupled navigation systems to frequently experience positioning drift of tens of meters, seriously threatening the flight safety and mission execution of drones.

[0003] To enhance the safety of navigation systems, the aviation industry has introduced Receiver Autonomous Integrity Monitoring (RAIM) technology. However, existing traditional integrity monitoring and filtering algorithms (such as standard Kalman filtering) heavily rely on the theoretical assumption that "observation errors follow a Gaussian white noise distribution." In complex urban environments, the actual positioning errors caused by multipath interference and deception often exhibit long-tailed non-Gaussian distribution characteristics. In this situation, the Protection Level (PL) calculated by traditional algorithms will shrink significantly or even fail completely, resulting in fatally misleading information (HMI). This means that even when the navigation system is actually in a high-risk state, it still blindly outputs a "safe" assessment result to the flight control system, causing the "credibility" of the underlying navigation data to completely collapse, which can easily lead to serious accidents such as collisions with buildings.

[0004] On the other hand, at the level of UAV flight control systems, existing mainstream industrial-grade flight controllers (such as open-source PX4 and ArduPilot) often employ overly rigid and fragmented strategies when handling navigation anomalies and reliability assessments. Current flight controllers typically rely on loosely defined metrics such as the number of available satellites, geometric precision factor (DOP), or filter variance to judge signal quality, lacking rigorous physical boundary quantification tailored to specific operational risks (such as the SORA standard). This leads to frequent and ineffective alarms triggered by transient signal glitches, particularly common in urban canyons, abruptly cutting off automatic flight path control and forcing the UAV to land or become uncontrollable. This one-size-fits-all bottom-line defense mechanism significantly sacrifices the continuity and operational availability of the UAV system.

[0005] In summary, existing UAV navigation and flight control systems generally suffer from significant shortcomings when dealing with complex urban low-altitude environments, including poor front-end data anti-interference capabilities, lack of absolute physical boundary support for mid-end reliability assessment, and abrupt back-end control takeover that is highly susceptible to glitches. The industry urgently needs a systematic flight control architecture solution that can penetrate the limitations of the Gaussian assumption, accurately quantify the absolute reliability of navigation, and effectively filter transient interference to achieve smooth and safe takeover. Summary of the Invention

[0006] In view of this, the present invention aims to overcome the shortcomings of the above-mentioned problems in the prior art and proposes a UAV flight control method and system. By introducing a multi-source tightly coupled integrity monitoring mechanism and a non-Gaussian geometric envelope algorithm, a navigation reliability assessment system and anti-shake degradation logic that change in real time with the risk of the operating environment and signal quality are constructed. This solves the protection level failure caused by the non-Gaussianization of UAV positioning error in complex urban low-altitude environments, as well as the imbalance between the accuracy of safety assurance and mission continuity of existing flight control systems under the conditions of missing integrity monitoring and transient interference.

[0007] To achieve the above objectives, the technical solution of the present invention is implemented as follows:

[0008] In a first aspect, the present invention provides a flight control method for an unmanned aerial vehicle (UAV), comprising the following steps:

[0009] Step 1: Synchronously acquire pseudorange and Doppler observations from the GNSS receiver, as well as specific force and angular velocity data from the inertial measurement unit, to construct an initial reliable data source for navigation;

[0010] Step 2: Input the reliable data source obtained in Step 1 into the tightly coupled filter, use high-frequency data for time updates and observations for measurement updates, suppress non-Gaussian noise, output the posterior state estimation vector and extract the observation residual vector of the current epoch to complete the basic reliability reconstruction.

[0011] Step 3: Based on the non-Gaussian set theory algorithm, receive the observation residual vector output in Step 2, and construct a geometric envelope that encapsulates the true error by combining the residual and the error boundary. Dimensionally reduce and project the geometric envelope to extract the horizontal protection level (HPL) and vertical protection level (VPL), which serve as rigid quantitative indicators for measuring navigation reliability.

[0012] Step 4: Receive the posterior state estimation vector output from Step 2, extract the three-dimensional position sub-vector, obtain the corresponding environmental feature parameters based on the current position of the UAV, and calculate the comprehensive operational risk level in combination with the environmental feature parameters; dynamically map and generate real-time horizontal alarm limit HAL and vertical alarm limit VAL according to the comprehensive operational risk level, thereby establishing the tolerance bottom line for navigation reliability failure in the current operating scenario.

[0013] Step 5: Compare the horizontal protection level and vertical protection level obtained in Step 3 with the horizontal alarm limit and vertical alarm limit obtained in Step 4 in real time. If the limit is exceeded, start the anti-shake timer. If the time exceeds the tolerance window, the credibility is confirmed to be lost. If the value drops within the window, it is determined to be a glitch and the timer is reset to zero. Maintain the current route to filter invalid alarms.

[0014] Step 6: Upon receiving a bankruptcy order, forcibly revoke the automatic flight path permissions that rely on absolute coordinates, and autonomously switch to the corresponding safety degradation mode based on the health status of the onboard visual sensors and barometers.

[0015] Furthermore, in step 2, during the filtering process, the tightly coupled filter uses the specific force and angular velocity output by the inertial measurement unit to predict the state transition, and uses the pseudorange and Doppler frequency shift output by the GNSS receiver to update the measurement.

[0016] Extract the observation residual vector of the current epoch. The calculation process satisfies the following relationship:

[0017]

[0018] in, This is the actual measurement vector output by the multi-source sensing module at the current epoch. For filter-based prior state estimation The theoretical observation vector of the projection.

[0019] Furthermore, the tightly coupled filter employs an extended... filter.

[0020] Furthermore, step 3 specifically includes:

[0021] Construct a ring-shaped polyhedron centered at zero error to enclose all state estimation errors; the posterior generating matrix of the ring-shaped polyhedron... It satisfies the following relationship:

[0022]

[0023] in, For the prior generation matrix, Here is the Kalman gain matrix. To measure the Jacobian matrix, The absolute boundary matrix of the measurement noise is determined by the receiver channel characteristics. The identity matrix represents the inherent prior uncertainty of the state system. The order reduction operator is used to limit the dimensional expansion of the ring zone polyhedron during the iteration process. The multidimensional interval envelope box is solved for the posterior ring zone polyhedron after iterative order reduction. The maximum diagonal error distance of the envelope box in the horizontal plane is taken as the horizontal protection level, and its projection limit boundary in the vertical direction is taken as the vertical protection level.

[0024] Furthermore, in step 4, the specific strategy for dynamically mapping and generating real-time horizontal and vertical alarm limits includes:

[0025] The drone's current latitude and longitude coordinates are obtained in real time, and combined with three-dimensional geographic information data or airspace division data, the comprehensive operational risk level of the airspace where the drone is currently located is determined, so as to establish the minimum requirement benchmark for navigation reliability in the current operating scenario.

[0026] When it is determined that the drone is in a densely populated area or the buffer zone outside the no-fly zone, the overall operational risk level is increased and the numerical thresholds of the horizontal and vertical alarm limits are reduced.

[0027] When it is determined that the drone is in an open, uninhabited area, the overall operational risk level is reduced, and the numerical thresholds of the horizontal and vertical alarm limits are increased proportionally.

[0028] Furthermore, step 5 specifically includes:

[0029] Define the time step of a single epoch as Initialize the anti-shake timer ;

[0030] When any epoch detects or At that time, the anti-shake timer is accumulated according to the following formula:

[0031]

[0032] In subsequent consecutive epochs, if the protection level continues to exceed the limit, then a judgment is made. Is it greater than the preset tolerance time window? ;like If a true integrity failure occurs, an integrity failure command is output.

[0033] If detected at any epoch and The preceding out-of-bounds behavior is determined to be a transient signal glitch, and a reset instruction is immediately executed, causing... And maintain normal automatic flight path.

[0034] Furthermore, in step 6, the security degradation mode includes:

[0035] When the vision sensor and barometer are functioning normally, switch to vision-assisted hovering mode; when the vision sensor fails but the barometer is functioning normally, switch to altitude-stabilized mode; when the barometer also fails or the distance exceeds visual range, trigger emergency stationary blind descent mode.

[0036] Furthermore, prior to step 1, a pre-flight integrity convergence self-check and safety unlocking procedure is included, specifically:

[0037] While the UAV is powered on and initialized and the power system is not unlocked, continue to execute steps 1 to 4 to monitor the convergence trend of the horizontal protection level (HPL) and the vertical protection level (VPL) in real time.

[0038] Set a takeoff self-test time window. If, within the takeoff self-test time window, the HPL is continuously and stably below the HAL and the VPL is continuously and stably below the VAL, then generate and illuminate the "takeoff clearance" flag, allowing the flight control to unlock the power system.

[0039] If the protection level cannot converge to within the alarm limit within the self-test time window, the motor start permission will be forcibly locked, and an alarm message "takeoff environment integrity not up to standard" will be output through the ground station or fuselage indicator light.

[0040] Secondly, the present invention provides a drone flight control system, comprising:

[0041] The multi-source sensing module is used to synchronously acquire pseudorange and Doppler observations from the GNSS receiver, as well as specific force and angular velocity data from the inertial measurement unit, to build an initial reliable data source for navigation.

[0042] The joint estimation module is used to input the reliable data source obtained by the multi-source sensing module into the tightly coupled filter, use high-frequency data for time updates and observation values ​​for measurement updates, and output the posterior state estimation vector by suppressing non-Gaussian noise and extracting the observation residual vector of the current epoch to complete the basic reliability reconstruction.

[0043] The envelope inference module is used to receive the observation residual vector output by the joint estimation module based on a non-Gaussian set theory algorithm, and construct a geometric envelope that wraps the real error by combining the residual and the error boundary. The geometric envelope is then dimensionally reduced and projected to extract the horizontal protection level (HPL) and vertical protection level (VPL), which serve as rigid quantitative indicators for measuring navigation reliability.

[0044] The risk mapping module is used to receive the posterior state estimation vector output by the joint estimation module, extract the three-dimensional position sub-vector, obtain the corresponding environmental feature parameters based on the current position of the UAV, and calculate the comprehensive operational risk level in combination with the environmental feature parameters; and dynamically map and generate real-time horizontal alarm limit HAL and vertical alarm limit VAL according to the comprehensive operational risk level, thereby establishing the tolerance bottom line for navigation reliability failure in the current operating scenario.

[0045] The anti-shake decision module is used to compare the horizontal protection level and vertical protection level obtained by the envelope inference module with the horizontal alarm limit and vertical alarm limit obtained by the risk mapping module in real time. If the limit is exceeded, the anti-shake timer is started. If the timer continues to exceed the tolerance time window, the credibility is confirmed to be lost. If the timer falls back within the window, it is determined to be a glitch and the timer is reset to zero. The current route is maintained to filter out invalid alarms.

[0046] The downgrade module is used to forcibly revoke the automatic flight path permissions that rely on absolute coordinates when a bankruptcy order is received, and to autonomously switch to the corresponding safety downgrade mode based on the health status of the onboard visual sensors and barometers.

[0047] Compared with existing technologies, the UAV flight control method and system described in this invention have the following advantages:

[0048] This invention can eliminate Gaussian dependency and improve the absolute security of credibility assessment: for the first time, it extends... The introduction of filtering and Zonotope non-Gaussian geometric envelope into the flight control layer abandons statistical probability assumptions and uses absolute physical boundaries to deduce the protection level. Even in severe multipath environments, it can still achieve "zero misleading information" and build a solid navigation reliability quantification index.

[0049] This invention introduces time-based anti-shake technology to eliminate false alarms from flight control systems: by uniquely incorporating an "anti-shake tolerance time window" into the decision between protection level and alarm limit, it perfectly filters transient signal glitches in complex electromagnetic environments, avoids frequent false triggering and degradation of flight control systems, and significantly improves the continuity and availability of UAV missions.

[0050] Compared to existing open-source flight controllers that immediately trigger failsafe protection when encountering positioning drift, the anti-shake tolerance window of this invention can effectively filter out 1-3 second GNSS transient obstruction glitches commonly found between urban buildings, thereby avoiding frequent false triggering of the flight controller caused by this in terms of physical mechanism, greatly reducing the number of unexpected interruptions to the flight path, and significantly improving the availability of UAVs.

[0051] This invention enables multi-dimensional health linkage and achieves intelligent tiered degradation: it constructs a complete state machine network from "reliability monitoring" to "heterogeneous sensor takeover", and switches to hovering, altitude hold or blind landing in a tiered manner according to the status of the remaining sensors, ensuring the bottom-line survivability of the drone under extreme denial conditions. Attached Figure Description

[0052] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an undue limitation of the invention. In the drawings:

[0053] Figure 1 This is a schematic diagram of the method flow of the present invention;

[0054] Figure 2 This is a schematic diagram of the system of the present invention. Detailed Implementation

[0055] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other.

[0056] In the description of this invention, it should be understood that the terms "center," "longitudinal," "lateral," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, are only for the convenience of describing the invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the invention. Furthermore, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined with "first," "second," etc., may explicitly or implicitly include one or more of that feature. In the description of this invention, unless otherwise stated, "a plurality of" means two or more.

[0057] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art will understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0058] The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0059] Example 1

[0060] like Figure 1 As shown, the present invention provides a flight control method for unmanned aerial vehicles (UAVs), comprising the following steps:

[0061] Step 1: Synchronously acquire pseudorange and Doppler observations from the GNSS receiver, as well as specific force and angular velocity data from the inertial measurement unit, to construct an initial reliable data source for navigation and provide physical support for reliability assessment.

[0062] Step 2: Input the reliable data source obtained in Step 1 into a tightly coupled filter, use high-frequency data for time updates and observations for measurement updates, suppress non-Gaussian noise, output the posterior state estimation vector, and extract the observation residual vector of the current epoch to complete the basic reliability reconstruction; specifically including:

[0063] During the filtering process, the specific force and angular velocity output by the inertial measurement unit are used for state transition prediction, and the pseudorange and Doppler frequency shift output by the GNSS receiver are used for measurement update.

[0064] Extract the observation residual vector of the current epoch. The calculation process satisfies the following relationship:

[0065]

[0066] in, This is the actual measurement vector output by the multi-source sensing module at the current epoch. For filter-based prior state estimation The theoretical observation vector of the projection.

[0067] In this invention, the tightly coupled filter preferably employs an extended... An EHF filter is used to address unknown non-Gaussian measurement noise disturbances in urban low-altitude environments.

[0068] Step 3: Based on the non-Gaussian set theory algorithm, receive the observation residual vector output in Step 2, and construct a geometric envelope containing the true error by combining the residual and the error boundary. Dimensionally reduce and project the geometric envelope to extract the horizontal protection level (HPL) and vertical protection level (VPL), which serve as rigid quantitative indicators for measuring navigation reliability; specifically including:

[0069] Construct a zonotope centered at zero error to enclose all state estimation errors; the posterior generating matrix of the zonotope... The following relationship is satisfied:

[0070]

[0071] in, For the prior generation matrix, Here is the Kalman gain matrix. To measure the Jacobian matrix, The absolute boundary matrix of the measurement noise, determined by the receiver channel characteristics, is represented algebraically by the Minkowski Sum in Zonotope theory as the physical superposition of two geometric error envelopes (i.e., the prior state envelope and the measurement noise envelope). For the generating matrix, the equivalent matrix operation of the Minkowski Sum is simply the horizontal column concatenation of the matrix, not algebraic addition. The formula contains... Term and measurement noise mapping term Having the same number of rows (state dimension) However, the number of columns is different, therefore, we use... Perform horizontal splicing. In the state update formula, The term characterizes the error shrinkage operator of the system, where The identity matrix represents the inherent prior uncertainty of the state system. This represents the information gain introduced by the current epoch measurement update. The order reduction operator is used to limit the dimensional expansion of the ring polyhedron during the iteration process. The multidimensional interval Hull Box is solved for the posterior ring polyhedron after iterative order reduction. The maximum diagonal error distance of the envelope box in the horizontal plane is taken as the horizontal protection level, and its projection limit boundary in the vertical direction is taken as the vertical protection level.

[0072] Step 4: Receive the posterior state estimation vector output from Step 2, extract the 3D position sub-vector, obtain the corresponding environmental feature parameters based on the current position of the UAV, and calculate the comprehensive operational risk level based on the environmental feature parameters; dynamically map and generate real-time horizontal warning limit (HAL) and vertical warning limit (VAL) according to the comprehensive operational risk level, thereby establishing the tolerance threshold for navigation reliability failure in the current operating scenario; specifically including:

[0073] The system acquires the current latitude and longitude coordinates of the UAV in real time and combines this with 3D geographic information data or airspace classification data to obtain the ground risk index (e.g., classified as uninhabited area, sparsely populated area, or densely populated area) and air risk index (e.g., classified as uncontrolled airspace or controlled airspace) of the current area. The system has a built-in risk mapping matrix that integrates the above ground risk index and air risk index to calculate the current comprehensive operational risk level.

[0074] Establish a negative correlation mapping table between comprehensive operational risk level and alarm limit (HAL / VAL): When the UAV is in a high-risk area (such as a densely populated urban area), the system outputs a smaller HAL and VAL threshold to implement extremely stringent integrity monitoring; when the UAV enters a low-risk area (such as the sea or wilderness), the system proportionally amplifies the HAL and VAL thresholds to maximize the tolerance for satellite multipath jitter while ensuring absolute safety, thus ensuring mission continuity.

[0075] Step 5: Compare the horizontal and vertical protection levels obtained in Step 3 with the horizontal and vertical alarm limits obtained in Step 4 in real time. If the limits are exceeded, start the anti-shake timer. If the time exceeds the tolerance window, the reliability is confirmed to be invalid. If the level drops within the window, it is determined to be a glitch and the timer is reset to zero. Maintain the current flight path to filter invalid alarms. Specifically, this includes:

[0076] Define the time step of a single epoch as Initialize the anti-shake timer ;

[0077] When any epoch detects or At that time, the anti-shake timer is accumulated according to the following formula:

[0078]

[0079] In subsequent consecutive epochs, if the protection level continues to exceed the limit, then a judgment is made. Is it greater than the preset tolerance time window? ;like If a true integrity failure occurs, an integrity failure command is output.

[0080] If detected at any epoch and The preceding out-of-bounds behavior is determined to be a transient signal glitch, and a reset instruction is immediately executed, causing... And maintain normal automatic flight path.

[0081] Step 6: Upon receiving a bankruptcy order, forcibly revoke the automatic flight path authority that relies on absolute coordinates, and autonomously switch to the corresponding safety degradation mode based on the health status of the onboard visual sensors and barometer, including: switching to visual-assisted hovering mode when the visual sensors and barometer are normal; switching to altitude-stabilized mode when the visual sensors fail but the barometer is normal; and triggering emergency in-situ instrument landing mode when the barometer also fails or is beyond visual range.

[0082] In this embodiment, before step 1, there is also a pre-flight integrity convergence self-check and safety unlocking step, which specifically includes:

[0083] While the UAV is powered on and initialized and the power system is locked on the ground, steps 1 to 4 are continuously executed to monitor the convergence trend of the horizontal protection level (HPL) and vertical protection level (VPL) in real time. A takeoff self-test time window is set. If, within the takeoff self-test time window, the HPL is continuously and stably below the HAL and the VPL is continuously and stably below the VAL, a "takeoff clearance" flag is generated and illuminated, allowing the flight control to unlock the power system. If, within the takeoff self-test time window, the protection level cannot converge to within the alarm limit, the motor start permission is forcibly locked, and an alarm message "Takeoff environment integrity not up to standard" is output through the ground station or fuselage indicator light to prevent dangerous takeoffs from the source.

[0084] Example 2

[0085] A drone flight control system includes:

[0086] The multi-source sensing module is used to synchronously acquire pseudorange and Doppler observations from the GNSS receiver, as well as specific force and angular velocity data from the inertial measurement unit, to build an initial reliable data source for navigation.

[0087] The joint estimation module is used to input the reliable data source obtained by the multi-source sensing module into the tightly coupled filter, use high-frequency data for time updates and observation values ​​for measurement updates, and output the posterior state estimation vector by suppressing non-Gaussian noise and extracting the observation residual vector of the current epoch to complete the basic reliability reconstruction.

[0088] The envelope inference module is used to receive the observation residual vector output by the joint estimation module based on a non-Gaussian set theory algorithm, and construct a geometric envelope that wraps the real error by combining the residual and the error boundary. The geometric envelope is then dimensionally reduced and projected to extract the horizontal protection level (HPL) and vertical protection level (VPL), which serve as rigid quantitative indicators for measuring navigation reliability.

[0089] The risk mapping module is used to receive the posterior state estimation vector output by the joint estimation module, extract the three-dimensional position sub-vector, obtain the corresponding environmental feature parameters based on the current position of the UAV, and calculate the comprehensive operational risk level in combination with the environmental feature parameters; and dynamically map and generate real-time horizontal alarm limit HAL and vertical alarm limit VAL according to the comprehensive operational risk level, thereby establishing the tolerance bottom line for navigation reliability failure in the current operating scenario.

[0090] The anti-shake decision module is used to compare the horizontal protection level and vertical protection level obtained by the envelope inference module with the horizontal alarm limit and vertical alarm limit obtained by the risk mapping module in real time. If the limit is exceeded, the anti-shake timer is started. If the timer continues to exceed the tolerance time window, the credibility is confirmed to be lost. If the timer falls back within the window, it is determined to be a glitch and the timer is reset to zero. The current route is maintained to filter out invalid alarms.

[0091] The downgrade module is used to forcibly revoke the automatic flight path permissions that rely on absolute coordinates when a bankruptcy order is received, and to autonomously switch to the corresponding safety downgrade mode based on the health status of the onboard visual sensors and barometers.

[0092] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for controlling the flight of an unmanned aerial vehicle (UAV), characterized in that: Includes the following steps: Step 1: Synchronously acquire pseudorange and Doppler observations from the GNSS receiver, as well as specific force and angular velocity data from the inertial measurement unit, to construct an initial reliable data source for navigation; Step 2: Input the reliable data source obtained in Step 1 into the tightly coupled filter, use high-frequency data for time updates and observations for measurement updates, suppress non-Gaussian noise, output the posterior state estimation vector and extract the observation residual vector of the current epoch to complete the basic reliability reconstruction. Step 3: Based on the non-Gaussian set theory algorithm, receive the observation residual vector output in Step 2, and construct a geometric envelope that encapsulates the true error by combining the residual and the error boundary. Dimensionally reduce and project the geometric envelope to extract the horizontal protection level (HPL) and vertical protection level (VPL), which serve as rigid quantitative indicators for measuring navigation reliability. Step 4: Receive the posterior state estimation vector output from Step 2, extract the three-dimensional position sub-vector, obtain the corresponding environmental feature parameters based on the current position of the UAV, and calculate the comprehensive operational risk level by combining the environmental feature parameters. Based on the comprehensive operational risk level, real-time horizontal alarm limit HAL and vertical alarm limit VAL are dynamically generated to establish the tolerance threshold for navigation reliability failure in the current operational scenario. Step 5: Compare the horizontal protection level and vertical protection level obtained in Step 3 with the horizontal alarm limit and vertical alarm limit obtained in Step 4 in real time. If the limit is exceeded, start the anti-shake timer. If the time exceeds the tolerance window, the credibility is confirmed to be lost. If the value drops within the window, it is determined to be a glitch and the timer is reset to zero. Maintain the current route to filter invalid alarms. Step 6: Upon receiving a bankruptcy order, forcibly revoke the automatic flight path permissions that rely on absolute coordinates, and autonomously switch to the corresponding safety degradation mode based on the health status of the onboard visual sensors and barometers.

2. The UAV flight control method according to claim 1, characterized in that: In step 2, during the filtering process, the tightly coupled filter uses the specific force and angular velocity output by the inertial measurement unit to predict the state transition, and uses the pseudorange and Doppler frequency shift output by the GNSS receiver to update the measurement. Extract the observation residual vector of the current epoch. The calculation process satisfies the following relationship: ； in, This is the actual measurement vector output by the multi-source sensing module at the current epoch. For filter-based prior state estimation The theoretical observation vector of the projection.

3. The UAV flight control method according to claim 1, characterized in that: The tightly coupled filter employs an extended... filter.

4. The UAV flight control method according to claim 1, characterized in that: Step 3 specifically includes: Construct a ring-shaped polyhedron centered at zero error to enclose all state estimation errors; the posterior generating matrix of the ring-shaped polyhedron... It satisfies the following relationship: ； in, For the prior generation matrix, Here is the Kalman gain matrix. To measure the Jacobian matrix, The absolute boundary matrix of the measurement noise is determined by the receiver channel characteristics. The identity matrix represents the inherent prior uncertainty of the state system. The order reduction operator is used to limit the dimensional expansion of the ring polyhedron during the iteration process. The multidimensional interval envelope box is solved for the posterior ring polyhedron after iterative order reduction. The maximum diagonal error distance of the envelope box in the horizontal plane is taken as the horizontal protection level (HPL), and its projection limit boundary in the vertical direction is taken as the vertical protection level (HVL).

5. The UAV flight control method according to claim 1, characterized in that: In step 4, the specific strategies for dynamically mapping and generating real-time horizontal and vertical alarm limits include: The drone's current latitude and longitude coordinates are obtained in real time, and combined with three-dimensional geographic information data or airspace division data, the comprehensive operational risk level of the airspace where the drone is currently located is determined, so as to establish the minimum requirement benchmark for navigation reliability in the current operating scenario. When it is determined that the drone is in a densely populated area or the buffer zone outside the no-fly zone, the overall operational risk level is increased and the numerical thresholds of the horizontal and vertical alarm limits are reduced. When it is determined that the drone is in an open, uninhabited area, the overall operational risk level is reduced, and the numerical thresholds of the horizontal and vertical alarm limits are increased proportionally.

6. The UAV flight control method according to claim 1, characterized in that: Step 5 specifically includes: Define the time step of a single epoch as Initialize the anti-shake timer ; When any epoch detects or At that time, the anti-shake timer is accumulated according to the following formula: ； In subsequent consecutive epochs, if the protection level continues to exceed the limit, then a judgment is made. Is it greater than the preset tolerance time window? ;like If a true integrity failure occurs, an integrity failure command is output. If detected at any epoch and The preceding out-of-bounds behavior is determined to be a transient signal glitch, and a reset instruction is immediately executed, causing... And maintain normal automatic flight path.

7. The UAV flight control method according to claim 1, characterized in that: In step 6, the security degradation mode includes: When the vision sensor and barometer are functioning normally, switch to vision-assisted hovering mode; when the vision sensor fails but the barometer is functioning normally, switch to altitude-stabilized mode; when the barometer also fails or the distance exceeds visual range, trigger emergency stationary blind descent mode.

8. The UAV flight control method according to claim 1, characterized in that: Before step 1, there is also a pre-flight integrity convergence self-check and safety unlocking step, which specifically includes: While the UAV is powered on and initialized and the power system is not unlocked, continue to execute steps 1 to 4 to monitor the convergence trend of the horizontal protection level (HPL) and the vertical protection level (VPL) in real time. Set a takeoff self-test time window. If, within the takeoff self-test time window, the HPL is continuously and stably below the HAL and the VPL is continuously and stably below the VAL, then generate and illuminate the "Takeoff Clearance" flag, allowing the flight control to unlock the power system. If the protection level cannot converge to within the alarm limit within the self-test time window, the motor start permission will be forcibly locked, and an alarm message "takeoff environment integrity not up to standard" will be output through the ground station or fuselage indicator light.

9. A flight control system for unmanned aerial vehicles (UAVs), characterized in that: include: The multi-source sensing module is used to synchronously acquire pseudorange and Doppler observations from the GNSS receiver, as well as specific force and angular velocity data from the inertial measurement unit, to build an initial reliable data source for navigation. The joint estimation module is used to input the reliable data source obtained by the multi-source sensing module into the tightly coupled filter, use high-frequency data for time updates and observation values ​​for measurement updates, and output the posterior state estimation vector by suppressing non-Gaussian noise and extracting the observation residual vector of the current epoch to complete the basic reliability reconstruction. The envelope inference module is used to receive the observation residual vector output by the joint estimation module based on a non-Gaussian set theory algorithm, and construct a geometric envelope that wraps the real error by combining the residual and the error boundary. The geometric envelope is then dimensionally reduced and projected to extract the horizontal protection level (HPL) and vertical protection level (VPL), which serve as rigid quantitative indicators for measuring navigation reliability. The risk mapping module is used to receive the posterior state estimation vector output by the joint estimation module, extract the three-dimensional position sub-vector, obtain the corresponding environmental feature parameters based on the current position of the UAV, and calculate the comprehensive operational risk level by combining the environmental feature parameters. Based on the comprehensive operational risk level, real-time horizontal alarm limit HAL and vertical alarm limit VAL are dynamically generated to establish the tolerance threshold for navigation reliability failure in the current operational scenario. The anti-shake decision module is used to compare the horizontal protection level and vertical protection level obtained by the envelope inference module with the horizontal alarm limit and vertical alarm limit obtained by the risk mapping module in real time. If the limit is exceeded, the anti-shake timer is started. If the timer continues to exceed the tolerance time window, the credibility is confirmed to be lost. If the timer falls back within the window, it is determined to be a glitch and the timer is reset to zero. The current route is maintained to filter out invalid alarms. The downgrade module is used to forcibly revoke the automatic flight path permissions that rely on absolute coordinates when a bankruptcy order is received, and to autonomously switch to the corresponding safety downgrade mode based on the health status of the onboard visual sensors and barometers.

Images