Battery replacement operation control method and system for multi-rotor aircraft and storage medium

Abstract

This invention relates to the interdisciplinary field of aerospace and intelligent transportation systems, and discloses a method, system, and storage medium for battery swapping control of multirotor aircraft. The method includes: acquiring operator authentication results and aircraft shutdown status data; when operator authentication is successful and the aircraft meets preset shutdown conditions, sending a battery swapping mode activation command to lock the aircraft; acquiring battery installation status signals collected by a multimodal sensor array during battery installation and removal; performing a logic consistency check based on the above signals; performing a power-on self-test after successful verification, and sending a battery swapping completion command to restore aircraft functionality after successful self-test; maintaining a safety lock state and outputting alarm information when verification or self-test fails. This invention can reduce the risks of accidental start-up during battery swapping, restoring aircraft functionality before the battery is fully installed, and restoring aircraft functionality under abnormal electrical connection conditions.

Description

Technical Field

[0001] This invention relates to the field of interdisciplinary technology of aerospace and intelligent transportation systems, specifically to a battery swapping operation control method, system, and storage medium for multi-rotor aircraft. Background Technology

[0002] With the rapid development of urban air mobility (UAM) and electric vertical takeoff and landing (eVTOL) aircraft, manned multirotor aircraft have an urgent need for efficient and safe energy replenishment methods. Battery swapping, due to its speed and convenience, is considered a key solution to the range bottleneck. While improving operational efficiency, it also poses unprecedented challenges to the safety of ground operations.

[0003] Battery swapping for manned multi-rotor aircraft involves several high-risk aspects, including high-voltage electrical systems, precision mechanical connections, flight control command interaction, and coordination with the airfield environment. Related technical solutions have significant shortcomings in addressing this complex scenario: on the one hand, some solutions focus on power redundancy and fault tolerance during flight, such as achieving power continuity through multiple power management units, but completely fail to cover the safety control logic during the ground battery swapping phase; on the other hand, while other solutions optimize the quick-release structure or thermal safety design of the battery modules, they lack status linkage and interlocking mechanisms with the flight control system and the airfield operation platform. Summary of the Invention

[0004] To address the shortcomings of existing battery swapping solutions for multirotor aircraft, such as lack of personnel access control, shutdown status verification, high-voltage circuit control, flight control command locking, battery installation integrity verification, and pre-recovery self-test linkage during the ground battery swapping phase, this invention provides a battery swapping control method, system, and storage medium for multirotor aircraft.

[0005] In a first aspect, the present invention provides a control method for battery swapping operations of multi-rotor aircraft, applied to a central controller at a site within a battery swapping system. The central controller is communicatively connected to an authentication terminal, an aircraft-side safety interlock unit, and a multi-modal sensor array. The method includes the following steps: acquiring the operator authentication result output by the authentication terminal and acquiring the target aircraft's shutdown status data; when the operator authentication result is successful and the shutdown status data meets preset shutdown conditions, sending a battery swapping mode activation command to the aircraft-side safety interlock unit; and controlling the target aircraft to proceed according to the battery swapping mode activation command. The system locks the battery compartment door actuator and controls it to enter a battery swapping safety state; it performs battery removal and installation operations and acquires the battery installation status signal collected by the multimodal sensor array; it performs a logical consistency check based on the battery installation status signal; when the logical consistency check passes, it generates a safety confirmation signal and controls the target aircraft to perform a power-on self-test; when the power-on self-test passes, it sends a battery swapping completion command to the safety interlock unit on the aircraft and controls the target aircraft to unlock according to the battery swapping completion command; when the logical consistency check fails or the power-on self-test fails, it maintains the locked state of the target aircraft and outputs an alarm message.

[0006] In one optional implementation, the shutdown status data satisfying preset shutdown conditions includes: the motor speed command in the flight control telemetry data is zero, and the motor speed is zero or less than a preset speed threshold; the ground speed of the target aircraft is zero or less than a preset ground speed threshold; the power circuit bus current detected by the airfield side is less than a preset current threshold; and the effective value of the vibration acceleration detected by the airfield side is less than a preset vibration threshold.

[0007] In one optional embodiment, controlling the battery compartment door actuator to enter the battery swapping safety state includes: when the high-voltage main circuit is not disconnected, the motor drive output is not disabled, or the flight control command input channel is not locked, controlling the battery compartment door actuator to maintain the door closed and locked state; after confirming that the high-voltage main circuit has been disconnected, the motor drive output has been disabled, and the flight control command input channel has been locked, allowing the battery compartment door actuator to enter the maintenance open state; and after the logic consistency check and the power-on self-test have both passed, controlling the battery compartment door actuator to enter the closed and locked state.

[0008] In one optional implementation, obtaining the operator identity authentication result output by the identity authentication terminal includes: obtaining the fingerprint recognition result and the face recognition result collected by the identity authentication terminal; matching the fingerprint recognition result and the face recognition result with the operator information in the permission database; and determining that the operator identity authentication result is successful when the fingerprint recognition result, the face recognition result, the operator authorization level, and the authorization validity period all meet the preset access conditions.

[0009] In one alternative embodiment, the multimodal sensor array includes: at least one microswitch for detecting the physical position of the battery; at least one Hall sensor for detecting the closed position of the mechanical latch; and at least one set of four-wire resistance measurement circuits for detecting the contact resistance of the electrical connection points; wherein the four-wire resistance measurement circuits determine the contact resistance of the electrical connection points based on constant current excitation and voltage sampling.

[0010] In one optional implementation, the logical consistency check based on the battery installation status signal includes: determining whether all microswitches are in the triggered state; determining whether the output signal of the Hall sensor is within a preset latch closure threshold range; determining whether the contact resistance of each electrical contact point is less than or equal to a preset contact resistance threshold; when all the above determination results are yes, the logical consistency check is determined to be passed; when any of the above determination results are no, the logical consistency check is determined to be failed, and the corresponding fault sensor location is output.

[0011] In one optional implementation, the power-on self-test includes: acquiring battery management system data of the newly installed battery and determining whether the battery voltage equalization meets the preset voltage equalization conditions; performing an insulation resistance test on the high-voltage main circuit and determining whether the insulation resistance is greater than a preset insulation resistance threshold; performing an integrity verification on the communication link between the station central controller and the target aircraft; determining that the power-on self-test is passed when the battery voltage equalization, the insulation resistance test, and the communication link integrity verification are all passed; and maintaining the safety lock state of the target aircraft and outputting self-test fault information when any one of them fails, wherein the safety lock state includes a high-voltage main circuit cut-off state, a motor drive output disabled state, and a flight control command input channel locked state.

[0012] Secondly, the present invention provides a battery swapping operation control system for a multi-rotor aircraft, comprising an authentication terminal, a site central controller, an aircraft-side safety interlock unit, a multi-modal sensor array, and a communication module; the authentication terminal is used to collect operator authentication information and output operator authentication results; the site central controller is used to acquire the operator authentication results and the target aircraft's shutdown status data, and when the operator authentication result is successful and the shutdown status data meets preset shutdown conditions, it sends a battery swapping mode activation command to the aircraft-side safety interlock unit through the communication module; the aircraft-side safety interlock unit is used to control the target aircraft according to the battery swapping mode activation command. The aircraft is locked, and the battery compartment door actuator is controlled to enter the battery swapping safety state. The multimodal sensor array is used to collect battery installation status signals during battery removal and installation operations. The station central controller is also used to perform a logical consistency check based on the battery installation status signal, and after the logical consistency check passes and the power-on self-test passes, it sends a battery swapping completion command to the aircraft-side safety interlock unit. The aircraft-side safety interlock unit is also used to control the target aircraft to unlock according to the battery swapping completion command. The station central controller is also used to control the aircraft-side safety interlock unit to maintain the safety lock state of the target aircraft and output alarm information when the logical consistency check fails or the power-on self-test fails.

[0013] In one optional embodiment, the system further includes a site environment monitoring module, which is used to collect at least one environmental parameter among temperature, humidity, combustible gas concentration, and ground load-bearing status in the battery swapping area. When the environmental parameter exceeds the corresponding safety threshold, the site central controller terminates the battery swapping process and maintains the target aircraft's high-voltage main circuit cut-off state, motor drive output disabled state, and flight control command input channel locked state. The communication module includes a main communication channel and a backup communication channel. The main communication channel is used to transmit control commands, and the backup communication channel is used to transmit heartbeat packets. When N consecutive heartbeat packets are lost, the site central controller controls the system to roll back to a safety lock state. The safety lock state includes the high-voltage main circuit cut-off state, the motor drive output disabled state, and the flight control command input channel locked state, where N is a preset positive integer greater than or equal to 2.

[0014] Thirdly, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements any of the above-described battery swapping operation control methods for multi-rotor aircraft.

[0015] Compared with the prior art, the present invention has at least the following beneficial technical effects: First, by linking operator authentication, aircraft shutdown status confirmation, and aircraft lock control, the risk of accidental start-up or erroneous response to flight control commands during the battery swapping process can be reduced.

[0016] Second, by acquiring battery installation status signals through a multimodal sensor array and performing logical consistency checks on these signals, the reliability of battery installation integrity judgment can be improved.

[0017] Third, by performing a power-on self-test before restoring the aircraft's functions and keeping the aircraft in a safe locked state when the logic consistency check or power-on self-test fails, the risk of restoring flight functions in cases of incorrect battery installation, abnormal electrical connections, or abnormal communication links can be reduced.

[0018] Fourth, through environmental monitoring and dual-channel communication mechanisms, the battery swapping process can be stopped and rolled back to a safe lockout state when environmental parameters or communication links are abnormal, which facilitates the improvement of the safety and traceability of the battery swapping operation process. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating the battery swapping operation control method for multi-rotor aircraft provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the system architecture for a battery swapping system for multi-rotor aircraft provided in an embodiment of the present invention. Detailed Implementation

[0020] To facilitate understanding of this application, a more complete description will be provided below with reference to the accompanying drawings, which illustrate embodiments of the present application. However, the present application can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided so that the disclosure of this application will be thorough and complete.

[0021] This invention relates to battery swapping stations for manned multirotor aircraft in urban air mobility (UAM) operations. These stations are deployed in ground support areas of high-density takeoff and landing points or hub airports, and must complete a safe and reliable battery swapping operation within 5 minutes to support high-frequency flight scheduling. To achieve this goal, this invention constructs a highly integrated safe operation system for battery swapping stations and implements a closed-loop safe operation method.

[0022] The system includes an authentication terminal, a central controller at the airfield, a safety interlock unit on the aircraft side, a multimodal sensor array, a communication module, and an airfield environment monitoring module. The authentication terminal collects operator authentication information and outputs the authentication result; the central controller acquires the authentication result and the target aircraft's shutdown status data, and sends a battery swapping mode activation command when preset shutdown conditions are met; the safety interlock unit controls the target aircraft to cut off the high-voltage main circuit, disable motor drive output, lock flight control command input channels, and control the battery compartment door actuator to enter the battery swapping safety state according to the battery swapping mode activation command; the multimodal sensor array collects battery physical positioning signals, mechanical latch closure signals, and electrical connection contact resistance signals; the communication module enables the transmission of control commands and heartbeat packets between the central controller at the airfield and the safety interlock unit on the aircraft side; and the airfield environment monitoring module collects environmental parameters of the battery swapping area.

[0023] First, the battery swapping station's safe operation system is constructed from a system architecture perspective, comprising five core subsystems: a personnel access authentication subsystem, a station central controller subsystem, an aircraft-side safety interlock subsystem, a battery status sensing and verification subsystem, and an environmental and communication support subsystem. These subsystems are interconnected via a hybrid network topology of industrial-grade Ethernet and CAN bus, forming a control and data fusion platform.

[0024] The personnel access authentication subsystem is deployed at the entrance of the battery swapping station. Its core hardware includes an industrial-grade embedded identity authentication terminal, which integrates a fingerprint recognition module (using a capacitive sensor array with a resolution of 500 dpi) and a binocular 3D structured light face recognition camera (supporting liveness detection, with a false recognition rate (FAR) not exceeding a preset false recognition rate threshold). This terminal synchronizes in real-time with the access control server in the station's central controller subsystem via a gigabit Ethernet interface. The access database uses a role-based access control (RBAC) model, storing operators' biometric templates, authorization levels, validity periods, and historical operation records. The authentication response time has been tested and controlled to within 1.8 seconds, facilitating personnel access authentication.

[0025] The central controller subsystem of the airfield, as the core control unit of the entire system, adopts a dual-redundant industrial server architecture. The primary and backup servers achieve memory mirroring synchronization via a PCIe Gen4 x16 high-speed interconnect channel. Its core functional modules include: a task scheduling engine, a safety state machine, log storage services, and an environmental monitoring interface. This controller establishes a connection with the aircraft via a dual-channel encrypted communication protocol: the primary channel uses an AES-256-GCM encrypted TCP / IP protocol stack to transmit critical control commands such as battery swapping mode activation commands and battery swapping completion commands; the backup channel is a UDP-based heartbeat monitoring channel with a heartbeat period set to 100 milliseconds. If N consecutive heartbeats are lost, the central controller determines that the communication link is abnormal and controls the system to roll back to a safety lock state. In the safety lock state, the aircraft-side safety interlock unit maintains a high-voltage main circuit cut-off state, a motor drive output disabled state, and a flight control command input channel locked state. Here, N is a preset positive integer greater than or equal to 2; preferably, the heartbeat period is 100 milliseconds and N is 3.

[0026] The aircraft-side safety interlock subsystem is integrated into the avionics system of the manned multirotor aircraft, including the Flight Control Computer (FCC), High-Voltage Power Distribution Unit (HVPDU), and battery compartment door actuator. The FCC uses a dual-core lock-step architecture automotive-grade ARM Cortex-R52 processor, running a real-time operating system certified to DO-178C Level A. The HVPDU integrates a solid-state relay (SSR) array for cutting off or closing 400V. The 800V DC high-voltage main circuit has a disconnection time of less than 5 milliseconds. The battery compartment door actuator can be implemented using a 24V DC powered push-pull electromagnet or other electronically controlled locking mechanism. The battery compartment door actuator is used to keep the door closed and locked when the battery swapping safety conditions are not met. It is allowed to enter the maintenance open state after the high-voltage main circuit has been disconnected, the motor drive output has been disabled, and the flight control command input channel has been locked. It enters the closed and locked state after the battery installation integrity verification and power-on self-test have both passed.

[0027] In this embodiment, the battery swapping safety state refers to the controlled safety state formed by the target aircraft during the ground battery swapping process. The battery swapping safety state includes at least: the high-voltage main circuit is in a disconnected state, the motor drive output is in a disabled state, and the flight control command input channel is in a locked state. Furthermore, the battery compartment door actuator switches between a closed-lock state, a maintenance-open state, and a closed-lock state according to the battery swapping process stage.

[0028] Specifically, when the high-voltage main circuit is not disconnected, the motor drive output is not disabled, or the flight control command input channel is not locked, the battery compartment door actuator remains closed and locked. When it is confirmed that the high-voltage main circuit has been disconnected, the motor drive output has been disabled, and the flight control command input channel has been locked, the battery compartment door actuator is allowed to enter the maintenance open state so that battery removal and installation operations can be performed under safe interlock conditions. When the battery installation integrity verification and power-on self-test both pass, the battery compartment door actuator enters the closed and locked state.

[0029] The battery status sensing and verification subsystem is deployed inside the aircraft's battery compartment. This subsystem includes a multimodal sensor array, its mounting location designed with tolerances to improve detection stability under vibration conditions. It includes: Microswitches: Three industrial-grade microswitches are embedded in the front, left, and right limiting slots of the battery holder, with an installation depth designed for a trigger travel of 2.5mm ± 0.1mm. The switch surface is covered with a rubber dust cover, and the internal circuitry is connected in series. Pull-up resistors are used to prevent signal lines from being left floating and introducing interference.

[0030] Hall effect sensor: Two linear Hall elements, along with neodymium iron boron permanent magnets, are mounted on the side of the mechanical locking rotating shaft. The air gap between the sensor and the magnet is strictly controlled within the range of 3.0mm ± 0.2mm. To prevent electromagnetic interference from the high-voltage busbar, the sensor signal line uses twisted-pair shielded cable, and the sensor installation position is at least [distance missing] from the high-voltage power cable. The physical distance.

[0031] Resistance measurement circuit: Four sets of four-wire (Kelvin) resistance measurement circuits, each corresponding to a pair of positive and negative power supply contacts, are excited by a constant current source (1A) and the voltage drop is acquired through a 24-bit ADC to calculate the contact resistance. In addition, to provide redundancy verification, the system is also equipped with an additional set of non-contact displacement sensors based on laser triangulation. Its transmitter / receiver probe is installed on the top of the battery compartment and can perform three-dimensional scanning of the upper surface of the battery with a measurement accuracy of ±0.1 mm. This is used to cross-verify the final installation position of the battery in the X, Y, and Z dimensions.

[0032] The environmental and communication support subsystem includes environmental monitoring nodes deployed around the battery swapping area. These nodes collect real-time data on temperature, humidity, combustible gas concentration, and ground load-bearing capacity. If any environmental parameter exceeds a safety threshold, the battery swapping process is immediately terminated, and the target aircraft is kept in a safe locked state. Specifically, this includes a temperature and humidity sensor (SHT45, accuracy ±1.8% RH), a catalytic combustion combustible gas detector (range 0-100% LEL, response time <15 seconds), and a distributed fiber optic grating (FBG) ground load-bearing monitoring system. All environmental data is aggregated to the site's central controller via Modbus / TCP protocol. If any parameter exceeds a preset safety threshold (e.g., temperature > 45℃, combustible gas concentration > 10% LEL, local ground pressure > preset load-bearing threshold), the system will immediately terminate the battery swapping process.

[0033] Preferably, the battery compartment is equipped with a redundant installation positioning detection mechanism. In addition to a micro switch, it is also equipped with a non-contact displacement sensor based on the laser ranging principle. Its measurement accuracy meets the preset accuracy requirements and is used to cross-verify the final position of the battery in three-dimensional space.

[0034] Preferably, the central controller at the airfield and the safety interlock unit at the aircraft end employ a dual-channel communication protocol. The primary communication channel is used to transmit control commands, and the backup communication channel is used to transmit heartbeat packets. When N consecutive heartbeat packets are lost, the central controller at the airfield rolls the control system back to the safety lock state, where N is a preset positive integer greater than or equal to 2.

[0035] Preferably, in some embodiments, the operation log of the entire battery swapping operation can be saved using hash verification, distributed storage, or blockchain notarization methods to improve the anti-tampering capability of log data and support post-event traceability and responsibility determination.

[0036] After the above system architecture is built, the safe operation method of the present invention is executed according to the following dynamic process: Step 1. Establish a safe access mechanism for battery swapping operations: Deploy an identity authentication terminal at the entrance of the battery swapping station to perform biometric identification and authorization verification for operators. Only when the operator has valid authorization and the aircraft is currently in a stopped state are they allowed to enter the battery swapping operation process. The identity authentication terminal uses both fingerprint and facial recognition biometric verification methods, with an authentication response time less than or equal to a preset time threshold. The authorization database is synchronized in real time with the station's central controller to ensure the immediate validity of the operator's authorization status.

[0037] Specifically, when an operator approaches the battery swapping station entrance, the authentication terminal automatically activates. The operator sequentially completes fingerprint and facial alignment, with the terminal simultaneously collecting two biometric data streams and extracting features locally. Subsequently, the terminal calls the station's central controller's authorization verification service via an encrypted API. The verification logic not only checks the biometric matching accuracy (threshold set at 95%) but also queries the operator's current authorization status in real time (e.g., whether they are on leave or in a restricted period). Simultaneously, the station's central controller queries the target aircraft's current status via the aircraft communication link. Entry is only permitted when the operator has valid authorization and the system confirms through "data-physical" dual cross-verification that the aircraft meets preset shutdown conditions.

[0038] In some embodiments, the preset shutdown conditions include data layer shutdown conditions and physical layer shutdown conditions. Data layer shutdown conditions include a zero motor speed command in the flight control telemetry data, and the motor speed being zero or less than a preset speed threshold, as well as the target aircraft's ground speed being zero or less than a preset ground speed threshold. Physical layer shutdown conditions include a power circuit bus current detected at the airfield side being less than a preset current threshold, and an effective value of vibration acceleration detected at the airfield side being less than a preset vibration threshold. Only when both data layer shutdown conditions and physical layer shutdown conditions are met will the airfield central controller send a battery swapping mode activation command and submit a battery swapping task to the task scheduling engine.

[0039] Step 2. Trigger the battery swapping mode and establish the aircraft's battery swapping safety state: After the operator is authenticated and the target aircraft meets the preset shutdown conditions, the station's central controller sends a battery swapping mode activation command to the aircraft's safety interlock unit. Upon receiving the battery swapping mode activation command, the aircraft's safety interlock unit controls the target aircraft to sequentially execute the following actions: high-voltage main circuit cutoff, motor drive output disabling, flight control command input channel locking, and battery compartment door actuator state switching, thus putting the target aircraft into the battery swapping safety state.

[0040] Specifically, after receiving the successful access signal, the task scheduling engine of the airfield central controller generates a battery swapping mode activation command and sends it to the aircraft-side safety interlock unit via the main communication channel. After parsing and verifying the battery swapping mode activation command, the aircraft-side safety interlock unit first sends a disconnect command to the high-voltage power distribution unit, causing the high-voltage power distribution unit to cut off the high-voltage main circuit, thereby isolating the battery output from the motor drive circuit. Secondly, the aircraft-side safety interlock unit controls the flight control computer to disable the motor drive output and locks the flight control command input channels of the remote controller, autopilot, and ground station, preventing the target aircraft from responding to takeoff, movement, or attitude adjustment commands during the battery swapping process.

[0041] When the high-voltage main circuit is not disconnected, the motor drive output is not disabled, or the flight control command input channel is not locked, the aircraft-side safety interlock unit controls the battery compartment door actuator to remain closed and locked, and sends interlock incomplete information to the station central controller; when it is confirmed that the high-voltage main circuit has been disconnected, the motor drive output has been disabled, and the flight control command input channel has been locked, the aircraft-side safety interlock unit controls the battery compartment door actuator to enter the maintenance open state, so as to allow operators to perform battery removal and installation operations under safety interlock conditions.

[0042] If any of the above interlocking actions are not completed within the preset time, the central controller of the station will stop the power swapping process and control the target aircraft to maintain the high-voltage main circuit cut-off state, the motor drive output disabled state, and the flight control command input channel locked state, while outputting alarm information.

[0043] In some embodiments, if the logic consistency check fails, the power-on self-test fails, environmental parameters exceed limits, or N consecutive heartbeat packets are lost, the station's central controller controls the battery swapping system to enter an abnormal hold-lock state. In the abnormal hold-lock state, the aircraft-side safety interlock unit maintains the high-voltage main circuit disconnected, the motor drive output disabled, and the flight control command input channel locked, and feeds back the abnormality type and location to the station's central controller.

[0044] Step 3. Perform battery removal and installation operations and monitor the installation status in real time: Under the guidance of mechanical assistance devices, the operator completes the removal of the old battery and the installation of the new battery. The system uses a multimodal sensor array integrated in the battery compartment to simultaneously collect the physical positioning signal of the battery, the closing status of the mechanical latch, and the conduction resistance value of the electrical connection contact points to determine whether the battery has been correctly installed. Preferably, the multimodal sensor array includes at least three microswitches for detecting the physical positioning of the battery, two Hall sensors for monitoring the closing position of the mechanical latch, and four sets of four-wire resistance measurement circuits for detecting the contact resistance of the electrical connection contact points. The contact resistance threshold is set to be less than or equal to a preset resistance threshold.

[0045] Specifically, after obtaining permission, operators enter the battery swapping area and, guided by mechanical aids (such as a lifting platform with guide rails), first unlock the mechanical latch of the old battery and horizontally pull it out of the tray. Then, the new battery is pushed in along the guide rail. During this process, a multi-modal sensor array continuously operates: three microswitches are pressed down when the battery is fully in place, outputting a high level; two Hall effect sensors output voltage reaching a preset threshold (e.g., 2.5V) when the latch rotates to the 90° closed position; and four sets of four-wire circuits calculate the contact resistance in real time, using the following formula:

[0046] Among them, Vsense For the voltage drop acquired by the ADC, I excite The test current is the output of the constant current source; preferably, I excite =1A. When R contact ≤R th When the corresponding electrical contact point meets the contact resistance requirement, it is determined that R... th The preset contact resistance threshold is preferably 5mΩ.

[0047] Step 4. Verify battery installation integrity and generate a safety confirmation signal: Based on the multimodal sensor data, the system performs a logic consistency check. If all sensor feedback meets the preset threshold range, the battery installation is determined to be complete, a safety confirmation signal is generated, and uploaded to the site's central controller. The logic consistency check uses an AND gate logic structure, meaning a high-level safety confirmation signal is only output when all sensor signals simultaneously meet the preset conditions. Any abnormal sensor signal will cause the check to fail and trigger the site's audible and visual alarm device.

[0048] Specifically, the central controller at the airfield periodically acquires raw data from all sensors at the aircraft. Upon receiving manual confirmation from the operator that "installation complete," the system initiates a logic consistency check. This check employs an AND gate logic structure, and its logical expression can be represented as: SafetyOK=(SW1 AND SW2 AND SW3) AND (H1 AND H2) AND (R1<=Rth AND R2<=Rth AND R3<=Rth AND R4<=Rth).

[0049] In this diagram, SW1, SW2, and SW3 represent the trigger states of three microswitches; H1 and H2 represent the two Hall effect sensors detecting that the mechanical latch is in the closed position; R1 to R4 represent the contact resistances of four sets of electrical contact points; and Rth represents the preset contact resistance threshold. The central controller generates a safety confirmation signal only when SafetyOK is true. If any condition is not met, such as a microswitch not triggering or a contact resistance greater than Rth, the logic consistency check fails, the central controller triggers an audible and visual alarm, and displays the location of the faulty sensor on the operating terminal.

[0050] In some embodiments, when the logic consistency check fails, the central controller of the station determines the fault location based on the identifier of the abnormal sensor and displays the fault location on the operating terminal. For example, when a micro switch fails to trigger, it indicates that the corresponding limit slot is not in place; when the output signal of a Hall sensor is not within the preset latch closure threshold range, it indicates that the corresponding mechanical latch is not closed; when the contact resistance of an electrical connection contact point is greater than the preset contact resistance threshold, it indicates that the corresponding electrical connection contact point has an abnormal contact.

[0051] Step 5. Perform a pre-restore power-on self-test and restore or maintain the lock based on the self-test results: After receiving the safety confirmation signal, the station's central controller does not directly release the battery swapping safety status, but instead sends a power-on self-test trigger command to the aircraft-side safety interlock unit. Upon receiving the power-on self-test trigger command, the aircraft-side safety interlock unit controls the target aircraft to execute the pre-restore power-on self-test procedure, which includes battery voltage equalization detection, insulation resistance testing, and communication link integrity verification.

[0052] Specifically, the aircraft-side safety interlock unit reads the battery management system data of the newly installed battery and determines whether the voltage difference between each cell is not greater than the preset voltage difference threshold; it performs insulation resistance testing on the high-voltage main circuit through the insulation monitoring device and determines whether the insulation resistance is greater than the preset insulation resistance threshold; it verifies the integrity of the communication link between the station central controller and the target aircraft through the communication module and determines whether the packet loss rate of the communication link is lower than the preset packet loss rate threshold.

[0053] When the battery voltage equalization test, the insulation resistance test, and the communication link integrity verification all pass, the aircraft-side safety interlock unit sends a power-on self-test pass message to the station central controller. The station central controller then sends a battery swapping completion command to the aircraft-side safety interlock unit. Based on this command, the aircraft-side safety interlock unit controls the battery compartment door actuator to enter a closed locking state and sequentially restores the high-voltage main circuit, motor drive output, and flight control command input channels, causing the target aircraft to exit the battery swapping safety state.

[0054] If any of the battery voltage equalization test, the insulation resistance test, or the communication link integrity verification fails, the aircraft-side safety interlock unit will not execute the battery swap completion command and will maintain the target aircraft's high-voltage main circuit cut-off state, motor drive output disabled state, and flight control command input channel locked state. At the same time, the aircraft-side safety interlock unit will send the corresponding self-test fault information to the station central controller, which will then output alarm information and indicate the fault type.

[0055] After the battery swapping process is completed, the central controller at the site records a battery swapping operation log. This log includes operator identification information, a timestamp, battery serial number, battery installation integrity verification results, power-on self-test results, and any abnormal alarm information. The battery swapping operation log is used for subsequent maintenance audits and fault tracing.

[0056] Compared with the prior art, the present invention has the following advantages: 1. Closed-loop safety control throughout the entire process By constructing a complete closed-loop control chain from personnel access, shutdown confirmation, safety interlocks, installation monitoring to pre-recovery self-testing, the risk of accidental aircraft startup when the battery is not correctly installed or the high-voltage main circuit is not isolated can be reduced. Compared to solutions that only focus on power redundancy or mechanical quick-release, this invention can reduce the safety risks caused by human error.

[0057] 2. Multiple Redundancy State Awareness and Verification A combination of a multimodal sensor array and a non-contact displacement sensor is used to perform triple independent verification of the battery's physical positioning, mechanical locking, and electrical connection, and AND gate logic ensures that all conditions are met synchronously. This mechanism improves the reliability of battery installation status judgment, reduces the risk of misjudgment due to a single sensor malfunction, and helps improve the stability of battery installation integrity verification.

[0058] 3. System-level security interlock mechanism In battery swapping mode, the high-voltage main circuit is simultaneously cut off, motor drive is disabled, flight control commands are locked, and the status of the battery compartment door actuator is controlled, forming a dual physical and logical isolation barrier. Even if operators forcibly intervene in extreme circumstances, the system can still maintain the aircraft in a safe locked state where it cannot respond to takeoff or movement commands, which helps improve the safety of personnel and equipment during the battery swapping process.

[0059] 4. Intelligent environment and communication security protection By integrating site environment monitoring and a dual-channel communication mechanism, the battery swapping process can be aborted and rolled back to a safety lockout state when environmental parameters or communication links are abnormal. Combined with a log storage mechanism, the tamper-proof capability and traceability of battery swapping operation records can be improved, facilitating subsequent safety audits and fault analysis.

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0061] It is understood that spatial relation terms such as "below," "under," "below," "below," "above," "above," etc., can be used here to describe the relationship between one element or feature shown in the figure and other elements or features. It should be understood that, in addition to the orientation shown in the figure, spatial relation terms also include different orientations of the device in use and operation. For example, if the device in the figure is flipped, the element or feature described as "below" or "below" of the other element or feature will be oriented "above" the other element or feature. Therefore, the exemplary terms "below" and "below" can include both upper and lower orientations. Furthermore, the device may also include other orientations (e.g., rotated 90 degrees or other orientations), and the spatial descriptive terms used herein will be interpreted accordingly.

[0062] It should be noted that when one element is considered to be "connected" to another element, it can be directly connected to the other element or connected to the other element through an intermediary element. In the following embodiments, "connection" should be understood as "electrical connection," "communication connection," etc., if the connected circuits, modules, units, etc., have the transmission of electrical signals or data between them.

[0063] When used herein, the singular forms of “a,” “an,” and “the” may also include the plural forms unless the context clearly indicates otherwise. It should also be understood that the terms “comprising,” “including,” or “having,” etc., specify the presence of the stated feature, whole, step, operation, component, part, or combination thereof, but do not preclude the possibility of the presence or addition of one or more other features, wholes, steps, operations, components, parts, or combinations thereof.

[0064] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A control method for battery swapping operations of multi-rotor aircraft, applied to a central controller at a battery swapping station within a battery swapping system, wherein the central controller is communicatively connected to an authentication terminal, a safety interlock unit at the aircraft end, and a multimodal sensor array, characterized in that... Includes the following steps: The system obtains the operator's identity authentication result output by the identity authentication terminal and obtains the shutdown status data of the target aircraft. When the operator's identity authentication result is successful and the shutdown status data meets the preset shutdown conditions, the system sends a battery swapping mode activation command to the safety interlock unit at the aircraft end. The target aircraft is locked according to the battery swapping mode activation command, and the battery compartment door actuator is controlled to enter the battery swapping safety state. Perform battery disassembly and assembly operations, and acquire battery installation status signals collected by the multimodal sensor array; A logical consistency check is performed based on the battery installation status signal; when the logical consistency check passes, a safety confirmation signal is generated, and the target aircraft is controlled to perform a power-on self-test. When the power-on self-test passes, a power swap completion command is sent to the safety interlock unit at the aircraft end, and the target aircraft is unlocked according to the power swap completion command. If the logical consistency check fails or the power-on self-test fails, the target aircraft is kept locked and an alarm message is output.

2. The battery replacement operation control method for a multi-copter aircraft according to claim 1, characterized in that, The shutdown status data meets the preset shutdown conditions, including: The motor speed command in the flight control telemetry data is zero, and the motor speed is zero or less than the preset speed threshold; the ground speed of the target aircraft is zero or less than the preset ground speed threshold; the power circuit bus current detected by the airfield is less than the preset current threshold; the effective value of the vibration acceleration detected by the airfield is less than the preset vibration threshold.

3. The battery replacement operation control method for a multi-copter aircraft according to claim 1, wherein The process of controlling the battery compartment door actuator to enter the battery swapping safety state includes: When the high-voltage main circuit is not disconnected, the motor drive output is not disabled, or the flight control command input channel is not locked, the battery compartment door actuator is controlled to keep the door closed and locked. After confirming that the high-voltage main circuit has been disconnected, the motor drive output has been disabled, and the flight control command input channel has been locked, the battery compartment door actuator is allowed to enter the maintenance opening state. After the logic consistency check and the power-on self-test both pass, the battery compartment door actuator is controlled to enter the closed locking state.

4. The battery replacement operation control method for a multi-copter aircraft according to claim 1, wherein The step of obtaining the operator authentication result output by the authentication terminal includes: Obtain the fingerprint recognition results and face recognition results collected by the identity authentication terminal; The fingerprint recognition results and the facial recognition results are matched with the operator information in the permission database; When the fingerprint recognition result, the facial recognition result, the operator's authorization level, and the authorization validity period all meet the preset access conditions, the operator's identity authentication result is determined to be successful. 5.The battery replacement operation control method for a multi-copter according to claim 1, wherein The multimodal sensor array includes: At least one microswitch for detecting the physical position of the battery; At least one Hall sensor is used to detect the closed position of the mechanical latch; At least one four-wire resistance measurement circuit for detecting the contact resistance of electrical connection points; The four-wire resistance measurement circuit determines the contact resistance of the electrical connection point based on constant current excitation and voltage sampling. 6.The battery replacement operation control method for a multi-copter according to claim 5, wherein The logical consistency check based on the battery installation status signal includes: Determine whether all the microswitches are in the triggered state; Determine whether the output signal of the Hall sensor is within the preset latch closure threshold range; Determine whether the contact resistance of each electrical contact point is less than or equal to a preset contact resistance threshold. When all of the above judgment results are yes, the logical consistency check is determined to be passed; If any of the above judgment results are negative, it is determined that the logical consistency check has failed, and the corresponding fault sensor location is output. 7.The battery replacement operation control method for a multi-copter according to claim 1, wherein The power-on self-test includes: Obtain battery management system data for newly installed batteries and determine whether the battery voltage balance meets the preset voltage balance conditions. Perform an insulation resistance test on the high-voltage main circuit and determine whether the insulation resistance is greater than the preset insulation resistance threshold. Perform integrity verification on the communication link between the central controller of the airfield and the target aircraft; When the battery voltage equalization, insulation resistance test, and communication link integrity verification all pass, the power-on self-test is deemed to have passed. If any item fails, the target aircraft is kept in a safe lock state and a self-test fault message is output. The safe lock state includes high-voltage main circuit cut-off state, motor drive output disabled state, and flight control command input channel locked state.

8. A battery swapping operation control system for multi-rotor aircraft, characterized in that, This includes an identity authentication terminal, a central controller for the airfield, a safety interlock unit for the aircraft, a multimodal sensor array, and a communication module; The identity authentication terminal is used to collect operator identity authentication information and output operator identity authentication results; The central controller at the site is used to acquire the operator's identity authentication result and the target aircraft's shutdown status data. When the operator's identity authentication result is successful and the shutdown status data meets the preset shutdown conditions, the controller sends a battery swapping mode activation command to the aircraft's safety interlock unit through the communication module. The aircraft-side safety interlock unit is used to control the target aircraft to lock according to the battery swapping mode activation command, and to control the battery compartment door actuator to enter the battery swapping safety state. The multimodal sensor array is used to collect battery installation status signals during battery removal and installation operations; The central controller of the site is also used to perform a logical consistency check based on the battery installation status signal, and after the logical consistency check passes and the power-on self-test passes, it sends a battery swapping completion command to the aircraft-side safety interlock unit. The aircraft-end safety interlock unit is also used to control the target aircraft to unlock according to the battery swap completion command; The central controller of the site is also used to control the safety interlock unit at the aircraft end to maintain the safety lock state of the target aircraft and output alarm information when the logic consistency check fails or the power-on self-test fails.

9. The battery swapping control system for multi-rotor aircraft according to claim 8, characterized in that: The system also includes a site environment monitoring module, which is used to collect at least one environmental parameter among temperature, humidity, combustible gas concentration and ground load-bearing status in the battery swapping area. When the environmental parameter exceeds the corresponding safety threshold, the site central controller stops the battery swapping process and maintains the high-voltage main circuit cut-off state, motor drive output disabled state and flight control command input channel locked state of the target aircraft. The communication module includes a main communication channel and a backup communication channel. The main communication channel is used to transmit control commands, and the backup communication channel is used to transmit heartbeat packets. When N consecutive heartbeat packets are lost, the central controller of the station controls the system to roll back to the safety lock state. The safety lock state includes the high-voltage main circuit cut-off state, the motor drive output disabled state, and the flight control command input channel locked state, where N is a preset positive integer greater than or equal to 2.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the battery swapping operation control method for a multi-rotor aircraft as described in any one of claims 1 to 7.

Images