Shipboard platform unmanned aerial vehicle safe take-off and landing method with emergency protection mechanism

Abstract

The application discloses a shipborne platform unmanned aerial vehicle safety take-off and landing method with an emergency protection mechanism and relates to the technical field of unmanned aerial vehicle take-off and landing control methods, and comprises the following steps: obtaining first operation data of a first data transmission channel and obtaining second operation data of a second data transmission channel; when the first operation data meets first preset conditions and the second operation data meets second preset conditions, synchronously activating a first protection strategy and a second protection strategy; when the first protection strategy is executed, target constraint data is generated, and the target constraint data is written into a target cache area; when the second protection strategy is executed, target idle time of the first data transmission channel is extracted, and multiple target frame data are injected into the first data transmission channel; and the application enhances the safety of shipborne platform unmanned aerial vehicle take-off and landing.

Description

Technical Field

[0001] This invention relates to the technical field of unmanned aerial vehicle (UAV) take-off and landing control methods, specifically to a safe take-off and landing method for shipborne UAVs with an emergency protection mechanism. Background Technology

[0002] Currently, shipborne drones typically use a three-axis self-balancing platform to maintain a level platform for takeoff and landing, and the drone lands through cooperative communication with the platform.

[0003] In extreme sea conditions, the platform needs to send servo commands at high frequency to counteract the ship's rolling motion, which consumes a large amount of motion control bus bandwidth. This results in emergency protection commands not being transmitted in a timely manner. Existing emergency solutions usually rely on normal bus channels, and the protection function is essentially ineffective when the bus is blocked. Alternatively, hardware emergency stops or mechanical brakes are used to lock the platform, which causes the platform to lose its compensation capability, exacerbates the risk of take-off and landing, and makes it difficult to ensure the safe take-off and landing of UAVs when the bus channel is completely blocked. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a safe take-off and landing method for shipborne platform unmanned aerial vehicles with an emergency protection mechanism.

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution: This invention provides a method for the safe take-off and landing of a shipborne platform unmanned aerial vehicle (UAV) with an emergency protection mechanism, comprising the following steps: Acquire the first operating data of the first data transmission channel, and acquire the second operating data of the second data transmission channel; When the first running data meets the first preset condition and the second running data meets the second preset condition, the first protection strategy and the second protection strategy are activated simultaneously. When executing the first protection strategy, target constraint data is generated and written to the target buffer so that the target solving module can limit the target attitude data to the range defined by the target constraint data when generating target attitude data. When executing the second protection strategy, the target idle time of the first data transmission channel is extracted, the target control command is determined based on the effective status of the first protection strategy, the target control command is decomposed into multiple target frame data based on the target idle time, and the multiple target frame data are injected into the first data transmission channel.

[0006] As a preferred embodiment of the present invention, the method further includes: Acquire target object data for the drone, including the drone's target location data and target confidence score; When the target confidence score is greater than the confidence threshold, target constraint data is generated based on the target location data; When the target confidence score is less than or equal to the confidence threshold, target constraint data is generated based on the historical effective location sequence of the target from the UAV.

[0007] As a preferred embodiment of the present invention, target constraint data is generated based on the historical effective location sequence of the target from the UAV, including: Extrapolate the historical valid location sequence of the target to obtain the predicted location range of the UAV; Obtain the output torque data of the target actuator; When the output torque data is greater than the torque threshold, the corresponding degree of freedom direction is marked as the first degree of freedom direction; The predicted location range is superimposed with the first degree of freedom direction for analysis and processing to generate target constraint data; Among them, the first maximum permissible tilt angle in the first degree of freedom direction of the target constraint data is smaller than the second maximum permissible tilt angle in the second degree of freedom direction, and the second degree of freedom direction is not the first degree of freedom direction.

[0008] As a preferred embodiment of the present invention, determining the target control command based on the effective state of the first protection strategy includes: Obtain the write timestamp of the target cache and the read timestamp of the target solving module; When the written timestamp is earlier than the read timestamp, and the time difference is greater than or equal to the preset calculation period, it is determined that the first protection strategy has taken effect, and the landing guidance correction command is identified as the target control command. When the written timestamp is later than the read timestamp, or the time difference is less than the preset calculation period, it is determined that the first protection strategy has not been fully effective, and the emergency go-around command is determined as the target control command.

[0009] As a preferred embodiment of the present invention, the target control command is decomposed into multiple target frame data based on the target idle time, including: Extract the length of the target idle time; Based on the length and segmentation ratio coefficient, the load data of the target control command is segmented to obtain multiple target segment data. Add a sequence number identifier, a total count identifier, and a priority identifier to each of the multiple target segment data to obtain multiple target frame data; The value of the priority identifier is dynamically determined based on the effective status of the first protection strategy.

[0010] As a preferred embodiment of the present invention, after injecting multiple target frame data into the first data transmission channel, the method further includes: Obtain the current bandwidth utilization of the first data transmission channel; When the current bandwidth utilization rate is greater than the bandwidth threshold, the transmission priority of each target frame data is adjusted, and the proportion of idle time occupied by the target carrying the target control command is adjusted.

[0011] As a preferred embodiment of the present invention, after extracting the target idle time of the first data transmission channel, the method further includes: When the length of the target idle time is less than the microframe adaptation threshold and the duration exceeds the first timeout threshold, a priority downgrade signal is generated. In response to the priority downgrade signal, the target control command is switched to the third data transmission channel for transmission, and the transmission mode is switched to single complete transmission mode. The third data transmission channel is independent of the first data transmission channel.

[0012] As a preferred embodiment of the present invention, the method further includes: When the number of failed attempts to write target constraint data to the target cache reaches the write failure threshold, a first communication message and a second communication message are generated. The first communication message carrying the target constraint data is sent to the computing node where the target solution module is located, and the second communication message is sent to the monitoring center through the target communication module.

[0013] As a preferred embodiment of the present invention, the method further includes: Acquire the status confirmation information of the UAV, as well as the truncation information generated by the target calculation module due to the limitation of target constraint data; When the status confirmation information indicates a safe touch disk status, clear the target constraint data in the target buffer and stop injecting multiple target frame data; When the status confirmation information indicates a go-around and climb status, and the truncation information continues to meet the preset periodic conditions, the target constraint data in the target buffer is maintained, and the injection of target frame data for landing guidance into the first data transmission channel is stopped.

[0014] As a preferred embodiment of the present invention, the method further includes: If no status confirmation information is obtained within the second timeout threshold, and the deviation data corresponding to the truncation information meets the safety deviation condition, the target constraint data in the target buffer is maintained. Based on the period dynamically determined by the frequency of target idle time occurrence, target frame data carrying emergency go-around instructions is periodically injected into the first data transmission channel.

[0015] The beneficial effects of this invention are: 1. When the first running data meets the first preset condition and the second running data meets the second preset condition, this application simultaneously activates the first protection strategy and the second protection strategy. By writing the target constraint data into the target cache area, the target attitude data generated by the target calculation module is restricted to the range defined by the target constraint data. This can block dangerous actions of the platform from the source without occupying bus bandwidth, solving the problem that emergency commands cannot be transmitted due to bus blockage in the prior art, and improving the timeliness of emergency response.

[0016] 2. This application extracts the target idle time of the first data transmission channel, determines the target control command based on the effective state of the first protection strategy, decomposes the target control command into multiple target frame data and injects them into the first data transmission channel, and uses the inherent time gap of the bus command stream to transmit emergency commands. At the same time, it realizes the coordinated linkage between platform constraints and UAV control, solves the problem that the UAV cannot be effectively controlled when the bus is completely blocked, and significantly enhances the safety of UAV take-off and landing on the shipborne platform. Attached Figure Description

[0017] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0018] Figure 1 This is a schematic diagram illustrating the workflow of the safe take-off and landing method for a shipborne platform unmanned aerial vehicle (UAV) according to the present invention. Figure 2 This is a schematic diagram of the vertical movement range of the take-off and landing platform in the shipborne unmanned aerial vehicle platform of the present invention; Figure 3 This is a schematic diagram of the structure of the take-off and landing platform in the shipborne unmanned aerial vehicle platform of the present invention, which reaches the maximum roll angle. Figure 4 This is a schematic diagram of the structure of the take-off and landing platform in the shipborne unmanned aerial vehicle platform of the present invention, showing the maximum pitch angle. Detailed Implementation

[0019] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this application, and not all embodiments. The components of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of this application provided in the accompanying drawings is not intended to limit the scope of the claimed application, but merely to illustrate selected embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0020] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0021] like Figure 1 As shown in the embodiment of this application, a method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism is provided. This method solves the problems of bus storms and communication failure caused by high-frequency attitude compensation under extreme sea conditions by constructing an active directional dual protection system in an edge computing chip (such as a DSP or MCU).

[0022] The overall execution flow of this method includes: The system obtains the first operating data of the first data transmission channel and the second operating data of the second data transmission channel through the system.

[0023] In engineering practice, the first data transmission channel is specifically manifested as a motion control bus channel running on a physical bus (such as an EtherCAT bus or a CAN bus), used to carry the flow of high-frequency servo interpolation control commands; the second data transmission channel is specifically manifested as a ship-machine cooperative wireless communication link (such as a proprietary radio frequency data link), used to carry the relative pose data and control service flow between the shipborne platform and the UAV. The first operating data and the second operating data respectively reflect the actual congestion status of the control bus and the delay and packet loss status of the application layer ship-machine communication.

[0024] The system continuously compares the first running data and the second running data with the preset first judgment threshold and the second judgment threshold, respectively.

[0025] When the first running data meets the first preset condition (such as the data frame queuing depth continuously exceeding the limit), and the second running data meets the second preset condition (such as a sudden increase in wireless link round-trip latency), the system determines that an upper-layer collaborative blockage has occurred due to mechanical control occupying lower-level resources, i.e., a bus storm has occurred. At this time, the system immediately generates an activation signal and simultaneously activates the first protection strategy and the second protection strategy.

[0026] When executing the first protection strategy, the system generates target constraint data.

[0027] The target constraint data is specifically embodied in a set of safety attitude envelope parameters (such as the maximum allowable tilt angle and the maximum allowable motion speed) that define the multi-degree-of-freedom motion boundaries of the take-off and landing platform.

[0028] The system directly writes the target constraint data into the target cache area.

[0029] The target cache area is manifested in the hardware architecture as a shared cache area in the memory of the edge computing node running the attitude calculation process.

[0030] The target solution module is embodied as an attitude solution process or a kinematic inverse solution control algorithm component. When the target solution module generates the next frame of target attitude data (such as conventional position / velocity interpolation target value) for driving the platform electric cylinder within its own solution cycle, it will forcibly read the target constraint data that is currently in effect in the target buffer.

[0031] If the calculated original target attitude data exceeds the envelope boundary defined by the target constraint data in any degree of freedom, the target solving module automatically truncates the target value to the constraint boundary value and replaces the original calculation result with the truncated data.

[0032] Because this operation is completed within the process, it consumes zero bandwidth on the motion control bus, thus preventing dangerous mechanical actions that could increase the risk of drone collisions from the source without exacerbating bus congestion.

[0033] The system starts synchronously when the second protection strategy is executed.

[0034] The system extracts the target idle time of the first data transmission channel. The target idle time is specifically reflected as the microsecond-level time gap that objectively exists between consecutive high-frequency servo interpolation command frames on the physical bus, as identified through micro-timing analysis.

[0035] Based on the current effective status of the first protection strategy (such as whether the envelope constraint has been successfully written and read), the system dynamically determines the most scarce and urgent target control command to be sent (such as choosing to send a correction command to guide the UAV to continue to land safely, or choosing to send an emergency go-around command to abort the landing).

[0036] Subsequently, based on the target idle time (i.e. the length of the current bus gap), the system breaks down the target control command into smaller target frame data that fits the time gap.

[0037] The target frame data is represented at the underlying layer as a data link layer microframe structure that has been fragmented, disassembled, and repackaged.

[0038] Finally, the system injects the target frame data into the idle time window identified in the first data transmission channel for transmission. The communication module on the UAV end collects and splices the target frame data through this covert channel, restores the complete target control command, and sends it to the flight control system for execution.

[0039] Furthermore, in the business process where the shipborne take-off and landing platform is operating and the first protection strategy is triggered, the system needs to accurately construct a safe attitude envelope that can avoid the risk of the UAV tipping over. To this end, the system obtains the target object data of the UAV through the system.

[0040] The target object data, at the physical level, originates from a stereo vision sensor assembly or a UAV's down-view optoelectronic sensing unit installed on the outside of the landing deck, and is used to represent the spatial interaction status during the current landing process.

[0041] Specifically, the target object data includes the target location data and target confidence score of the UAV.

[0042] The target location data is represented as a three-dimensional spatial relative coordinate vector of the UAV relative to the center point of the shipborne take-off and landing platform. The target confidence score is the confidence probability value of the target recognition and matching algorithm for the recognition result of the UAV boundary contour in the current image frame, and its value range is usually normalized to between 0 and 1.

[0043] Because the marine operating environment is often accompanied by highly dynamic salt spray, strong light refraction on the sea surface, and highly dynamic water mist agitated by the downwash airflow of multi-rotor aircraft, the positioning accuracy output by the visual perception link has the physical characteristic of sudden degradation. Therefore, the system must perform a conditional judgment branch on the target confidence score.

[0044] The system's internal storage area has a preset confidence threshold, which serves as a fixed decision boundary for evaluating the reliability of the current visual positioning. Its value range is determined based on the visual defocus and feature point loss rates under different sea state levels after statistical analysis of multiple sets of comparative experiments, for example, it is set to 0.65.

[0045] In the specific calculation process, the system will compare the target confidence score obtained in real time with the confidence threshold using floating-point numbers.

[0046] When the target confidence score is greater than the confidence threshold, the current visual guidance link is determined to be in a reliable state.

[0047] At this point, the system triggers the first envelope generation mechanism, directly generating the target constraint data based on the target location data that is collected in real time and has high reliability.

[0048] Under this processing strategy, the target calculation module directly uses the real-time three-dimensional spatial relative coordinates in the target position data as the reference point, extends outward to the preset safety radius, and reversely converts it into the maximum allowable tilt angle and motion speed limit of each degree of freedom of the platform, thereby quickly writing it into the target buffer area to achieve high-precision real-time safety limiting protection.

[0049] When the target confidence score is less than or equal to the confidence threshold, it is determined that the current target position data contains uncontrollable step noise or drift error due to sudden environmental interference such as dense fog, salt spray on the lens, or strong backlight. If used directly, it will cause the control system to produce incorrect rigid actions.

[0050] In response to this perception degradation state, the system refuses to use the target location data of the current frame, automatically switches to the second envelope generation mechanism, and instead retrieves the target historical valid location sequence of the UAV stored in the cache, and generates the target constraint data based on the target historical valid location sequence.

[0051] The target's historical valid location sequence is represented by a set of historical high-confidence relative location coordinate data successfully received and temporarily stored in a circular data queue within multiple consecutive sampling periods before the target confidence score falls below the confidence threshold.

[0052] The system performs temporal extrapolation and trend interpolation calculations on the historical coordinates of multiple frames in the target's historical valid position sequence to obtain the predicted position envelope of the UAV during the current link break window, and generates the target constraint data based on the predicted position envelope.

[0053] At this time, the system's internal status register synchronously sets the defense flag bit to the perception degradation protection state. Through this technology of dynamically switching the generation source based on perception quality, it is ensured that even under extreme conditions of instantaneous visual failure, the target constraint data still has a scientific basis for deduction, effectively preventing the take-off and landing platform from undergoing violent large tilt angle compensation actions due to incorrect control input.

[0054] Furthermore, the generation of the target constraint data based on the target's historical effective location sequence of the UAV includes the following cascaded solution steps: First, the system extrapolates the historical valid location sequence of the target to obtain the predicted location range of the UAV.

[0055] At the data construction level, the target's historical valid location sequence is temporarily stored in a circular data queue cache with timestamps as indexes. The system retrieves the last stored valid relative coordinate X0 and the historical average velocity V1 obtained through differential calculation from the circular data queue cache. Combined with the blind flight duration Δt after the target confidence score falls below the confidence threshold, the system uses the first-order kinematic extrapolation equation to calculate the spatial prediction center of the UAV in the current sampling period.

[0056] To compensate for the drift uncertainty caused by sudden shear winds on the sea surface to the UAV, the system constructs the predicted position range, which includes the upper spatial boundary H1 and the lower spatial boundary L1, by superimposing or subtracting a preset safety margin distance D1 on the spatial prediction center. The specific calculation formula is as follows: ; ; Wherein, Δt is the current blind flight duration; D1 is the preset safety margin distance, the value of which is usually set to 0.5 meters to 1.5 meters based on the physical size of the UAV's wingspan and the empirical value of wind field disturbance at sea, in order to delineate the physical envelope space in which the UAV may fall without guidance.

[0057] For example, if the last stored valid relative coordinates X0 are (0.2m, 0.1m, 3.5m) (corresponding to the horizontal, vertical, and altitude coordinates in the platform coordinate system, respectively), the historical average velocity V1 is (0.05m / s, 0.03m / s, -0.8m / s), the blind flight duration Δt is 0.2s, and the safety margin distance D1 is 0.8m, then the calculated spatial prediction center is (0.21m, 0.106m, 3.34m), and the corresponding upper spatial boundary H1 is (1.01m, 0.906m, 4.14m), indicating that the UAV may reach a maximum distance of 1.01m in front of the platform in the x-direction. The furthest point that the drone can reach in the y direction is 0.906m to the left of the platform, and the highest point that it can reach in the z direction is 4.14m above the platform. The lower boundary L1 of the space is (-0.59m, -0.694m, 2.54m), which means that the drone can reach as close as 0.59m behind the platform in the x direction, as close as 0.694m to the right of the platform in the y direction, and as low as 2.54m above the platform in the z direction. The 1.6m×1.6m×1.6m cube space determined by these two vertices is the total possible range of activity of the drone during the 0.2s blind flight time, taking into account its own motion inertia and the disturbance of the sea surface shear wind.

[0058] The platform's safe attitude envelope will be strictly limited within the cube to ensure that even if the drone drifts to the maximum extent, it will not collide with the edge of the platform.

[0059] At the same time, the system acquires the output torque data of the target actuator.

[0060] like Figures 2-4As shown, the target actuator specifically refers to a group of servo electric cylinders that drive the lifting platform to perform multi-degree-of-freedom motion compensation. In this embodiment, the lifting platform is controlled by six sets of servo electric cylinders, which are connected to the lifting platform and the base respectively. Each pair of electric cylinders corresponds to the two drive points on both sides of a degree of freedom, enabling pitch / roll angle adjustment of ±20° and vertical displacement adjustment of 0-300mm. The output torque data is read in real time by the current sampling microchip inside the servo driver and written to the corresponding processor storage area. The system continuously monitors the output torque data corresponding to each degree of freedom and executes the stress state judgment branch.

[0061] The system's internal storage area contains a preset torque threshold T. v The torque threshold T v The safety ratio is calculated and fixed based on the rated dynamic load limit of the servo electric cylinder (e.g., the ultimate safe thrust corresponding to a rated power of 3kW). The servo electric cylinder of this platform has a rated power of 3kW. The torque threshold is a fixed value based on the maximum safe thrust under this rated power after a safety proportional calculation. The conversion factor is 0.8 to ensure that the electric cylinder operates within a safe load range for a long time. At the same time, the physical dimensions of the platform surface of 700mm×800mm serve as the design basis for a preset safety margin distance of 0.8m in this embodiment, ensuring that the UAV will not collide with the edge of the platform within the predicted location range.

[0062] The system will compare the acquired output torque data T1 in each degree of freedom direction with the torque threshold T. v A magnitude comparison is performed. When the output torque data T1 in a certain degree of freedom direction is greater than the torque threshold T... v When it is determined that the actuator in that direction of motion is experiencing a severe reverse physical impact caused by a large-cycle external swell, and continuing to perform large-angle attitude compensation would risk damage to the equipment hardware, the system automatically marks the corresponding degree of freedom direction as the first degree of freedom direction (such as the pitch degree of freedom direction); accordingly, the torque threshold T is not exceeded. v The remaining degrees of freedom remain in their default states.

[0063] Finally, the system performs superposition analysis on the predicted position range and the first degree of freedom direction to generate the target constraint data. This superposition processing logic is manifested as follows: based on the current predicted position range of the UAV (i.e., the relative height or distance determined by H1 and L1), the urgency of the UAV's touchdown landing is assessed; simultaneously, a forced mechanical motion limit is implemented for the first degree of freedom direction under high stress, thereby reconstructing and generating the target constraint data.

[0064] When calculating the action boundary restricting the first degree of freedom direction in the target constraint data, the system adopts a truncation conversion algorithm with nonlinear attenuation and hard structure protection boundary, and its specific calculation formula is as follows: ; Wherein, A1 represents the first maximum permissible tilt angle in the first degree of freedom direction in the target constraint data; A0 represents the maximum permissible tilt angle under the system default state, which corresponds to the maximum compensation angle of the take-off and landing platform under normal working conditions without torque over-limit, and is used here as the second maximum permissible tilt angle, for example, set to 20°, corresponding to the rated pitch travel ±20° and roll travel ±20° of the take-off and landing platform in the attached figure; A m K1 represents the preset minimum structural protection angle, used to prevent the platform movement from being excessively compressed and losing its basic stability function. Its value range is usually set to 5° to 8°. K1 represents the torque-angle attenuation sensitivity coefficient, the value of which is determined by simulation calculation based on the stiffness matrix of the parallel mechanism, and the value range is 0.02° / N·m to 0.05° / N·m.

[0065] In one embodiment, since the output torque data T1 in the first degree of freedom direction has exceeded the torque threshold Tv, the term K1×(T1-T) v The value is a positive floating-point number greater than 0, which dynamically compresses the first maximum allowable tilt angle A1 calculated by the formula (from 5° to 8°). However, for the second degree of freedom direction that is not overloaded (i.e., the direction other than the first degree of freedom direction), its maximum allowable tilt angle remains at the default value of A0.

[0066] The calculation using this formula ensures that the first maximum permissible tilt angle A1 of the target constraint data in the first degree of freedom direction is strictly smaller than the second maximum permissible tilt angle A0 in the second degree of freedom direction, both logically and physically.

[0067] Furthermore, determining the target control command based on the effective status of the first protection strategy includes the following judgment steps: The system uses the system timer or hardware global clock of the edge computing node to obtain the write timestamp of the target cache and the read timestamp of the target solution module.

[0068] The write timestamp records the moment when the target constraint data representing the safe attitude envelope is successfully written to the target buffer; the read timestamp records the moment when the target solving module last reads the current running parameters from the target buffer during the execution of the inverse kinematics calculation. By extracting these two sets of high-precision timestamps, the control flow can bypass complex inter-process synchronization protocols and achieve low-resource-consumption state judgment in a high-load computing environment caused by bus storms.

[0069] The system performs a subtraction operation between the write timestamp and the read timestamp, and compares the calculated time difference with a preset calculation period. The preset calculation period corresponds to a fixed calculation period of the target calculation module, and is exemplarily set to 1 millisecond.

[0070] When the written timestamp is earlier than the read timestamp, and the time difference is greater than or equal to the preset calculation cycle, the determination result indicates that the target constraint data has gone through at least one complete algorithm reading cycle, the target calculation module has successfully read the target constraint data into the current interpolation control process, and completed the boundary constraints on the target attitude data.

[0071] In response to this state, the system determines that the first protection strategy has taken effect and the physical movement of the take-off and landing platform has been restricted within the safety envelope. At this time, the system determines the landing guidance correction command as the target control command.

[0072] The landing guidance correction command includes the relative position offset and landing attitude suggestion value updated after the platform restricts the action, guiding the UAV to continue landing within the safe limits.

[0073] When the write timestamp is later than the read timestamp, or the time difference is less than the preset calculation period, the determination result indicates that although the target constraint data has been generated, it has not yet been read by the target calculation module, or the target calculation module is in the current calculation process and has not yet sent the new safety limit generation servo interpolation signal to each electric cylinder.

[0074] In this state, the take-off and landing platform is still in a swaying state without safety restrictions, and if the drone continues to land, it will face an extremely high risk of collision.

[0075] In response to the incomplete synchronization state, the system immediately determines that the first protection strategy is not fully effective, the control flow automatically switches to the high security priority safety branch, and automatically identifies the emergency go-around command as the target control command.

[0076] The emergency go-around command is rapidly delivered to the UAV flight control system via subsequent frame-by-frame injection, terminating the current landing process and controlling the UAV to climb to a safe altitude. This time-stamp-based conditional judgment method ensures the consistency between platform-side motion constraints and UAV flight actions even in the absence of physical barriers.

[0077] Furthermore, the step of decomposing the target control command into target frame data based on the target idle time specifically includes the following calculation and encapsulation execution steps: In the first stage of the processing flow, the system extracts the length of the target idle time (inter-frame idle time slot of bus command) of the first data transmission channel.

[0078] Specifically, the system collects the transmission timestamp sequence of servo interpolation command frames continuously transmitted at high frequency on the first data transmission channel, extracts the idle time slot between two adjacent control frames, and in order to filter out the sudden changes in the length of the single-frame gap caused by hardware clock crystal jitter or transient bus noise, the system uses a sliding window statistical algorithm to calculate the average length of the target idle time, and the calculation formula is as follows: ; Among them, L a W1 represents the average length of the calculated target idle time; W1 represents the total number of bus cycles within the preset sliding statistical window, and its value range is usually set to 10 to 20 based on the interpolation period of the motion control bus (e.g., 1 millisecond) and the hardware queue depth of the control bus controller, for example, 16, to ensure timing smoothness while also taking into account rapid response to sudden changes in sea state; L g (k) represents the length of the original idle time gap measured in the kth bus cycle within the current sliding statistics window.

[0079] In the second stage of the processing flow, the system segments the load data of the target control command according to the length and segmentation ratio coefficient, resulting in multiple target segment data. To ensure that the disassembled target frame data can be safely inserted into the gap without compromising the real-time performance of the physical bus, the system introduces a segmentation ratio coefficient to dynamically determine the maximum boundary of the safe load. The formula for calculating the maximum data load length is as follows: ; Among them, S pR1 represents the maximum data payload length of a single target segment, in bytes; R1 represents the preset segmentation ratio coefficient, the value of which is determined by multiple sets of extreme load simulation calibrations based on the transmission rate of the physical layer protocol of the first data transmission channel, cable propagation delay, and clock synchronization error. The value range is 0.75 to 0.85, preferably 0.80. This means that the system retains a 20% time protection band in each idle time window to prevent the injected target frame data from overlapping and conflicting with subsequent high-priority servo interpolation command frames due to network jitter; S h This indicates the fixed header overhead length required for a single data link layer frame structure to accommodate subsequent additions of identification information.

[0080] Furthermore, in order to fully transmit the service instructions issued by the application layer, the system is based on the maximum data payload length S. p The complete load data of the target control command is segmented and sliced, and the total number of the target segmented data generated satisfies the following calculation formula: ; Where N0 represents the total number of target segment data obtained after slice calculation; D t ε represents the complete load data length of the target control command; ε represents the preset minimum zero-prevention bias constant, preferably 1×10⁻⁶. -6 By accumulating the minimum anti-zero bias constant ε in the denominator, S is effectively avoided. p In extreme operating conditions where abnormal degradation reaches zero, the system sequentially segments the complete load data of the target control command based on the calculated total number N0, and outputs the corresponding multiple target segment data.

[0081] In the third stage of the processing flow, the system constructs a target data frame structure with real-time transmission priority. The system adds a sequence number identifier, a total number identifier, and a priority identifier to each of the multiple target segment data, and finally repackages and generates the target frame data that conforms to the protocol specification.

[0082] The sequence number identifier records the sequential index value of the segment in the complete segment sequence, which is used for packet reordering after being received by the UAV terminal; the total number identifier records the value N0 calculated by the above equation, which is used by the receiving end to verify whether frame loss has occurred.

[0083] The priority identifier is used to specify the priority queue level of the frame data when participating in hardware arbitration at the underlying Media Access Control (MAC) layer. The value of the priority identifier is not fixed, but is determined by the system reading the value of the internal status register in the current storage area and making a conditional judgment based on the current effective state of the first protection policy. When the effective status indicator of the first protection strategy indicates that the envelope constraint has been successfully written into the target buffer and read and executed by the attitude calculation process (i.e., the physical motion on the platform side has been safely restricted), the system determines that the internal protection has been completed.

[0084] At this time, the priority identifier is assigned a first priority value (e.g., value 3, which corresponds to the conventional emergency priority in the industrial bus standard. Although the landing guidance correction command belongs to the emergency category, it does not involve an immediate risk of equipment damage, and its urgency is lower than that of the emergency go-around command. The priority value strictly follows the standard priority division system of mainstream industrial control buses (EtherCAT, CANopen), which will not be elaborated further). This allows the target frame data to participate in bus scheduling with the conventional emergency guidance priority, avoiding excessive occupation of the remaining resources of the core control bus. When the effective status identifier of the first protection strategy indicates that the target constraint data has not yet been written or has not undergone a complete calculation cycle after being written (i.e., the platform is still in a dangerous period of shaking without safety restrictions), the system determines that the UAV landing must be stopped immediately.

[0085] In response to this high-risk state, the system raises the control priority, and the priority identifier is automatically assigned a higher second priority value (such as a value of 1, which corresponds to the highest security priority at the application layer in the industrial bus standard, only lower than the hardware-level level 0 emergency stop). Through the dynamic adjustment of this priority identifier, it is ensured that the target frame data for emergency go-around used to abort landing can be transmitted through the bus storm with priority, achieving full-link protection response under the condition of no interception barrier.

[0086] Furthermore, after injecting the target frame data into the first data transmission channel, the method further includes the following adaptive adjustment step: The system obtains the current bandwidth utilization of the first data transmission channel through the system.

[0087] The system's storage area has a preset bandwidth threshold, which represents the maximum comprehensive load threshold that the physical bus can withstand while ensuring that hard real-time servo interpolation control does not experience delays or packet loss. Its value is usually determined by steady-state throughput simulation tests based on the bus transmission baud rate and the number of nodes, for example, 85%.

[0088] At the end of each instruction processing cycle, the control system compares the real-time calculated current bandwidth utilization rate with the bandwidth threshold using floating-point numbers.

[0089] When the current bandwidth utilization rate is greater than the bandwidth threshold, it is determined that the current first data transmission channel has shown early signs of command queuing spread and bus bandwidth collapse due to the concurrency of large-volume emergency interactions and extreme sea state compensation commands.

[0090] At this point, the system immediately activates the bandwidth defense mechanism, intervenes in the packet sending strategy of the application layer, adjusts the sending priority of each target frame data, and adjusts the proportion of the target idle time occupancy carrying the target control command.

[0091] Specifically, when adjusting the transmission priority, the system rewrites and downgrades the priority identifier in the target frame data packet generated subsequently, lowering its privilege level in the underlying Media Access Control (MAC) layer hardware arbitration queue (for example, from the highest privilege level 1 to the second highest level 2), thereby forcibly giving up some bus cycles to prioritize the position and speed interpolation requirements of the core multi-axis servo electric cylinder.

[0092] Simultaneously, when adjusting the occupancy ratio of the target idle time, the system initiates negative feedback compression targeting the timing segmentation boundary. This adjustment logic directly affects the segmentation ratio coefficient in the aforementioned segmentation process (e.g., dynamically reducing the original safe occupancy ratio from the default 0.80 to 0.50). As this occupancy ratio actively shrinks, the safe time protection band is multiplied when the system subsequently calculates the maximum payload length of a single segment. This reduces the number of effective payload bytes that can be encapsulated in a single target frame data, thereby macroscopically sparsifying the occupancy rate of the target control commands on the bus gap.

[0093] Furthermore, after extracting the target idle time of the first data transmission channel, the method further includes the following perception degradation and bypass takeover steps: The system continuously evaluates the current length of the extracted target idle time. In the decision loop of the control system, the storage area is pre-set with microframe adaptation threshold and first timeout threshold.

[0094] The microframe adaptation threshold represents the minimum time required to safely write a single frame of data to the bus. This minimum time is determined by the frame header overhead, the physical transmission time of the data verification field at the current bus baud rate, and the reserved anti-collision protection band. The first timeout threshold corresponds to the delay observation window for determining whether the bus has entered a continuous full saturation state. Its value range is usually calibrated according to the servo control cycle and the maximum allowable instruction loss time of the system, for example, 50 milliseconds.

[0095] The system compares the length of the target idle time with the microframe adaptation threshold in real time, and a timer synchronously records the duration of the abnormal state. When both conditions are met—that the length of the target idle time is lower than the microframe adaptation threshold and the duration of the state exceeds the first timeout threshold—it is determined that the current first data transmission channel is in a congested state of seamless interpolation of continuous reading instructions. The second protection strategy, which originally used micro-gap for fragmented injection, no longer has scheduling space at the physical level. In response to this severe situation of complete blockage, the underlying communication bus manager immediately generates a priority downgrade signal.

[0096] In response to the priority downgrade signal, the system strips the current target control command from the first data transmission channel, which has been completely blocked, and forcibly switches it to the third data transmission channel for transmission.

[0097] The third data transmission channel is independent of the first data transmission channel in both the physical layer and the logical link. Specifically, the third data transmission channel is a backup data link (such as a dedicated point-to-point low-frequency radio frequency wireless communication channel) that is independent of the shipborne platform servo motion control network and has separate physical medium and electrical isolation characteristics. This channel does not participate in the periodic interpolation and arbitration queuing of the main bus, so its transmission availability is completely unaffected by the underlying bus storm and computing power squeeze.

[0098] Simultaneously, due to the high anti-interference, low bandwidth, and large latency characteristics of the third data transmission channel, the system switches the transmission mode of the target control command from the aforementioned fragmented segmented injection mode to a single complete transmission mode.

[0099] Furthermore, the method also includes the following steps: The target cache is typically represented as a shared memory segment physically isolated within a multi-core digital signal processor (DSP) for the system and the target solution module to perform high-frequency asynchronous lock-free data regularization.

[0100] Under overload conditions of continuous and severe sea state compensation, the attitude calculation thread may occupy a very high number of bus cycles, which may cause a memory write deadlock exception, resulting in the target constraint data failing to be successfully written to the target buffer for multiple consecutive frames.

[0101] To this end, the control system registers a dedicated write counter status bit in the kernel task manager. When the system performs a single write attempt, if it does not receive a hardware write success confirmation signal from the target buffer within a preset microsecond clock cycle, the write attempt is determined to have failed, and the write counter is incremented.

[0102] The system's storage area has a preset write failure threshold, which represents the maximum consecutive cycle tolerance value allowed for local cache synchronization failures. Because the entire ship-aircraft coordinated landing approach decision window is extremely tight, a single, occasional failure can be covered by the next cycle, but a continuous accumulation of failures will cause the UAV to completely lose its protective envelope boundary constraints. Therefore, the write failure threshold is determined based on the hard real-time calculation cycle of the control bus after multiple sets of reliability simulation calibrations, for example, set to 3 times. The control system continuously compares the current cumulative value of the write counter with the write failure threshold as an integer.

[0103] When the current cumulative value of the write counter reaches the write failure threshold, it is determined that the current target cache has experienced a substantial bus blocking failure or storage hardware failure, and the conventional implicit memory write channel is completely unavailable. In response to this underlying anomaly, the system daemon immediately forcibly cuts off the conventional queuing control flow and generates a first communication message and a second communication message.

[0104] When processing the first local defense path, the system sends the first communication message carrying the target constraint data (i.e. the latest security attitude envelope boundary parameters) to the computing node where the target solution module is located. When executing at the lower level, the system bypasses the target buffer physical bus that has been locked or blocked, and directly enables an independent, highest priority inter-process communication bypass channel based on hardware bus pass-through (such as the hardware mailbox interrupt line inside the chip).

[0105] The first communication message is forcibly injected into the interrupt vector table of the computing node as an unmaskable interrupt signal, forcing the target solution module to interrupt the current normal calculation sequence, directly extract the target constraint data from the first communication message, and directly import the parameters into the current running main register, instantly performing boundary truncation restrictions on the target attitude data at the logical level.

[0106] Simultaneously, when processing the second remote linkage path, to ensure the right to know and the privileged safe intervention of the remote manual monitoring line, the system sends the second communication message to the monitoring center through the target communication module (such as an independent shipborne wireless radio frequency data transmission terminal). The second communication message is structurally encapsulated as an asynchronous privileged emergency data message, containing the fault code of the local storage area failure currently occurring on the take-off and landing platform and the current ship rolling attitude phasor.

[0107] The second communication message is burst-transmitted to the monitoring center located remotely or on land via an independent wireless link.

[0108] Furthermore, the method also includes the following steps: The system continuously acquires the status confirmation information of the UAV, as well as the truncation information generated by the target calculation module due to the limitation of the target constraint data.

[0109] The status confirmation information is obtained periodically from the UAV terminal via the second data transmission channel (such as a wireless cooperative communication link) through downlink telemetry, and is represented in a specific format binary status encoding field in terms of data structure; the truncation information comes from the internal running status log of the target calculation module (such as the attitude calculation process running in a digital signal processor DSP), which contains at least a Boolean truncation flag indicating whether the original target attitude data generated in the current period exceeds the safe attitude envelope boundary.

[0110] The system sends the obtained state confirmation information and truncation information into the multi-dimensional branch state machine to perform conditional routing.

[0111] When the status confirmation information indicates a safe touch-pan state, it is determined that the UAV has successfully overcome the bus storm and sea state interference, and its landing gear has safely landed on the platform of the shipborne take-off and landing platform.

[0112] In response to the safety touch state representing the completion of this phase of the task, the system triggers a full state recovery process: The system performs a memory clearing operation to remove the currently effective target constraint data in the target cache area, remove the underlying safety attitude envelope restriction, and control the target calculation module to immediately restore the highest precision real-time attitude compensation for the ship's full-degree-of-freedom sway. Simultaneously, the system stops injecting the target frame data into the idle time window of the first data transmission channel (such as the physical control bus) and releases the micro-timing gap channel.

[0113] When the status confirmation information indicates a go-around and climb status, and the cutoff information continuously meets the preset periodic conditions, the system determines that although the current landing guidance service has been terminated due to severe airflow conditions, the UAV flight control system has successfully received and is executing the emergency command to abort the landing, and the physical movement of the take-off and landing platform has been implicitly confined within the preset safety range by the safety envelope lock.

[0114] The fact that the truncation information continuously meets the preset periodic condition is manifested in that the Boolean truncation flag in the truncation information is true for a preset number of consecutive calculation cycles (e.g., 50 consecutive DSP interpolation cycles), indicating that the platform motion limiting is stably effective.

[0115] In response to this complex go-around alignment state, to prevent significant changes in platform attitude and airflow from causing secondary airflow wake interference to the UAV during its acceleration and climb phase, the system refuses to perform a full state recovery and automatically jumps to a partial recovery process: The system maintains the current target constraint data in the target buffer area, so that the platform's tilt angle and speed remain implicitly limited until the UAV leaves the danger zone; Simultaneously, the system adjusts its instruction generation type, ceasing the injection of target frame data for landing guidance into the first data transmission channel (i.e., cutting off the transmission of frame sequences containing relative position correction data), and only allowing the injection of monitoring frame data for tracking and monitoring the current altitude and attitude of the UAV within idle time windows.

[0116] Furthermore, the method also includes the following steps: During the dual protection process of the system, the processor continuously maintains a lost acknowledgment counter to count the bus clock cycles since the last successful receipt of the status acknowledgment information.

[0117] The system's storage area has a preset second timeout threshold, which represents the longest safe time boundary during which the system can not receive aerial feedback. Its value range is usually set safely based on the stable hovering window period of the UAV's dynamic wind shear resistance and the remaining battery power, such as 2000 milliseconds. The system performs a floating-point comparison between the duration calculated by the lost confirmation counter and the second timeout threshold.

[0118] If the status confirmation information is not obtained within the second timeout threshold, the system determines that the current ship-machine broadband wireless communication link has been interrupted.

[0119] At this point, the system immediately initiates cross-validation, retrieves the deviation data recorded in the local truncation information, and performs conditional verification against the preset safety deviation conditions.

[0120] The safety deviation condition is embodied in a set of multi-dimensional geometric constraint parameters used to characterize whether the current self-balancing platform mechanical cylinder is still within the safe follow-up limit range.

[0121] When the deviation data corresponding to the truncation information meets the safety deviation condition (such as the actual truncation displacement of each axis not exceeding the action threshold of the limit structure protection), the judgment result indicates that although external communication has been interrupted, the mechanical sway amplitude of the take-off and landing platform is still safely limited within the preset attitude envelope under the silent limitation of the first protection strategy, and no physical overload or jamming of the parallel mechanism has occurred.

[0122] In response to this combined safety condition, the system triggers the blind navigation safety maintenance strategy.

[0123] First, the system continues to maintain the current target constraint data in the target cache without making any modifications.

[0124] Under this processing strategy, the target calculation module still forcibly reads and applies the target constraint data in each subsequent periodic calculation loop, so that the tilt angle and vertical speed of the platform remain in a limited state during the disconnection window period, thus preventing the catastrophic consequences of abnormal control input caused by sudden communication interruption, which in turn causes the servo electric cylinder to swing in reverse and cause the drone to collide.

[0125] Simultaneously, the system initiates high-frequency gap injection based on physical layer timing gaps.

[0126] The system acquires the frequency of occurrence of the target idle time (inter-frame idle time slot of bus command) in real time. To achieve the correspondence between frequency and period, the system maintains an adaptive time slot correspondence table in its storage area. The adaptive time slot correspondence table uses the occurrence frequency as the lookup key and the microsecond-level injection period as the output value.

[0127] Its internal data correspondence and construction criteria are: based on the statistical distribution of bus idle gaps under different sea state loads in historical ship tests; when the servo interpolation density on the bus increases due to the intensification of swells, causing the frequency of occurrence to decrease, the injection cycle of the corresponding output is lengthened proportionally in a step-like manner to prevent the arbitration channel of the core motor interpolation command from being preempted. For example, when the idle time occurs 1000 times / second, the injection period is 1ms; when the frequency drops to 500 times / second, the injection period is extended to 2ms; when the frequency drops to 200 times / second, the injection period is extended to 5ms.

[0128] The processor uses the occurrence frequency obtained from the current statistics as the query key to perform a matching search or linear interpolation calculation in the adaptive time slot correspondence table, and outputs the current dynamically determined period online.

[0129] Subsequently, the system injects the target frame data into the idle time window of the first data transmission channel at high frequency and periodically according to the dynamically determined cycle. At this time, since the first protection strategy has not been lifted and the platform is in a fully controlled and limited period, the priority identifier in the target frame data packet is given the highest priority, and the target control command encapsulated within it has been automatically set to the emergency go-around command that does not depend on specific pose correction data.

[0130] Finally, it should be noted that the above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for safe take-off and landing of a shipborne platform unmanned aerial vehicle (UAV) with an emergency protection mechanism, characterized in that: Includes the following steps: Acquire the first operating data of the first data transmission channel, and acquire the second operating data of the second data transmission channel; When the first running data meets the first preset condition and the second running data meets the second preset condition, the first protection strategy and the second protection strategy are activated simultaneously. When executing the first protection strategy, target constraint data is generated and written to the target buffer so that the target solving module can limit the target attitude data to the range defined by the target constraint data when generating target attitude data. When executing the second protection strategy, the target idle time of the first data transmission channel is extracted, the target control command is determined based on the effective status of the first protection strategy, the target control command is decomposed into multiple target frame data based on the target idle time, and the multiple target frame data are injected into the first data transmission channel.

2. The method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism according to claim 1, characterized in that, The method further includes: Acquire target object data for the drone, including the drone's target location data and target confidence score; When the target confidence score is greater than the confidence threshold, target constraint data is generated based on the target location data; When the target confidence score is less than or equal to the confidence threshold, target constraint data is generated based on the historical effective location sequence of the target from the UAV.

3. The method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism according to claim 2, characterized in that, Target constraint data is generated based on the historical effective location sequence of the target from the UAV, including: Extrapolate the historical valid location sequence of the target to obtain the predicted location range of the UAV; Obtain the output torque data of the target actuator; When the output torque data is greater than the torque threshold, the corresponding degree of freedom direction is marked as the first degree of freedom direction; The predicted location range is superimposed with the first degree of freedom direction for analysis and processing to generate target constraint data; Among them, the first maximum permissible tilt angle in the first degree of freedom direction of the target constraint data is smaller than the second maximum permissible tilt angle in the second degree of freedom direction, and the second degree of freedom direction is not the first degree of freedom direction.

4. The method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism according to claim 1, characterized in that, The target control commands are determined based on the effective status of the first protection strategy, including: Obtain the write timestamp of the target cache and the read timestamp of the target solving module; When the written timestamp is earlier than the read timestamp, and the time difference is greater than or equal to the preset calculation period, it is determined that the first protection strategy has taken effect, and the landing guidance correction command is identified as the target control command. When the written timestamp is later than the read timestamp, or the time difference is less than the preset calculation period, it is determined that the first protection strategy has not been fully effective, and the emergency go-around command is determined as the target control command.

5. The method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism according to claim 1, characterized in that, Based on the target idle time, the target control command is broken down into multiple target frame data, including: Extract the length of the target idle time; Based on the length and segmentation ratio coefficient, the load data of the target control command is segmented to obtain multiple target segment data. Add a sequence number identifier, a total count identifier, and a priority identifier to each of the multiple target segment data to obtain multiple target frame data; The value of the priority identifier is dynamically determined based on the effective status of the first protection strategy.

6. The method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism according to claim 5, characterized in that, After injecting multiple target frame data into the first data transmission channel, the method further includes: Obtain the current bandwidth utilization of the first data transmission channel; When the current bandwidth utilization rate is greater than the bandwidth threshold, the transmission priority of each target frame data is adjusted, and the proportion of idle time occupied by the target carrying the target control command is adjusted.

7. The method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism according to claim 1, characterized in that, After extracting the target idle time of the first data transmission channel, the method further includes: When the length of the target idle time is less than the microframe adaptation threshold and the duration exceeds the first timeout threshold, a priority downgrade signal is generated. In response to the priority downgrade signal, the target control command is switched to the third data transmission channel for transmission, and the transmission mode is switched to single complete transmission mode. The third data transmission channel is independent of the first data transmission channel.

8. The method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism according to claim 1, characterized in that, The method further includes: When the number of failed attempts to write target constraint data to the target cache reaches the write failure threshold, a first communication message and a second communication message are generated. The first communication message carrying the target constraint data is sent to the computing node where the target solution module is located, and the second communication message is sent to the monitoring center through the target communication module.

9. The method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism according to claim 8, characterized in that, The method further includes: Acquire the status confirmation information of the UAV, as well as the truncation information generated by the target calculation module due to the limitation of target constraint data; When the status confirmation information indicates a safe touch disk status, clear the target constraint data in the target buffer and stop injecting multiple target frame data; When the status confirmation information indicates a go-around and climb status, and the truncation information continues to meet the preset periodic conditions, the target constraint data in the target buffer is maintained, and the injection of target frame data for landing guidance into the first data transmission channel is stopped.

10. The method for safe take-off and landing of a shipborne platform UAV with an emergency protection mechanism according to claim 9, characterized in that, The method further includes: If no status confirmation information is obtained within the second timeout threshold, and the deviation data corresponding to the truncation information meets the safety deviation condition, the target constraint data in the target buffer is maintained. Based on the period dynamically determined by the frequency of target idle time occurrence, target frame data carrying emergency go-around instructions is periodically injected into the first data transmission channel.

Images