Method for redundant transfer of control between primary and secondary remote controls and remote control system

Abstract

The application discloses a master-slave remote controller control right redundancy transfer method and a remote controller remote control system, relates to the field of remote controllers, and through the arrangement of a master remote controller simultaneously bearing two independent wireless link roles of a wireless sending end facing an external controlled device and a wireless receiving end facing a slave remote controller, and the superposition of a wired link between the master remote controller and the slave remote controller as a redundancy backup, a topology of three links of 'double wireless + wired' integration can be formed without increasing hardware cost and without changing the product structure; meanwhile, cooperating with a three-level redundancy degradation decision mechanism of an output end, link redundancy degradation of millisecond-level zero interruption can be realized between the wired link, the second wireless link and a default safety value, so that the control output of the external controlled device end is not perceptible to channel jumping in the master-slave control right switching process.

Description

Technical Field

[0001] This application relates to the field of remote control technology, and in particular to a method for redundant transfer of control rights between master and slave remote controllers and a remote control system. Background Technology

[0002] In the scenario of collaborative remote control of UAVs by master and slave controllers, the reliable transfer of control between the master and slave controllers is the core foundation for ensuring flight safety, supporting teaching and training, and safe takeover.

[0003] In existing technologies, the transfer of control between primary and secondary remote controllers generally relies on a single wired PPM / Trainer link or a single wireless Trainer link to achieve control data transmission. When the wired link experiences loose cables or poor contact, or the wireless link is affected by electromagnetic interference or frequency band obstruction, the control transfer link between the primary and secondary remote controllers will be directly interrupted, leading to a failure in control takeover and consequently posing a flight safety hazard. Summary of the Invention

[0004] This application provides a method for redundant transmission of control rights between master and slave remote controllers, as well as a remote controller system, to eliminate the risk of single-point failure of the control rights transmission link due to scenarios such as loose cables, poor contact, electromagnetic interference, or interference with a single radio frequency band, thereby improving the redundancy and reliability of control rights transmission between master and slave remote controllers.

[0005] In a first aspect, this application provides a remote control system, including a master remote control and a slave remote control; the master remote control includes a first wireless transmitting module, a first wireless receiving module, a first wired link interface, and a redundancy decision module; the slave remote control includes a second wireless transmitting module and a second wired link interface;

[0006] The first wireless transmission module is used to establish a first wireless link with an external controlled device;

[0007] The first wireless receiving module is used to establish a second wireless link between the main remote controller and the secondary remote controller in conjunction with the second wireless transmitting module;

[0008] The first wired link interface is connected to the second wired link interface to establish a wired link between the master remote controller and the slave remote controller;

[0009] The redundancy decision module is used to select the final output channel data from the channel data transmitted by the wired link, the channel data transmitted by the second wireless link, and the default security value based on the link status of the wired link and the second wireless link when the control right belongs to the secondary remote controller, and then send the final output channel data to the external controlled device through the first wireless link.

[0010] Secondly, this application provides a method for redundant transfer of control rights between a master and slave remote controller, applied to the remote controller system described in the first aspect, comprising:

[0011] Two independent wireless remote control protocol stacks run on the main remote controller: a first wireless link and a second wireless link; wherein, the first wireless link is the wireless link between the first wireless transmitting module of the main remote controller and the external controlled device, and the second wireless link is the wireless link between the second wireless transmitting module of the secondary remote controller and the first wireless receiving module of the main remote controller.

[0012] A wired link is established between the master remote controller and the slave remote controller by connecting the first wired link interface and the second wired link interface;

[0013] When control is held by the secondary remote controller, based on the link status of the wired link and the second wireless link, the final output channel data is selected from the channel data transmitted by the wired link, the channel data transmitted by the second wireless link, and the default security value, and the final output channel data is sent to the external controlled device through the first wireless link.

[0014] The method for redundant transfer of control rights between master and slave remote controllers and the remote controller system provided in this application have the following beneficial effects:

[0015] By configuring the main remote controller to simultaneously act as both a wireless transmitter for external controlled devices and a wireless receiver for the secondary remote controller, and by adding a wired link between the main and secondary remote controllers as a redundant backup, a "dual wireless + wired" three-link integrated topology can be formed without increasing hardware costs or changing the product structure. Furthermore, with the output end's three-level redundancy degradation decision mechanism, millisecond-level zero-interruption link redundancy degradation can be achieved between the wired link, the second wireless link, and the default safety value, ensuring imperceptible channel transitions in the control output of the external controlled devices during the switch between main and secondary control. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] Figure 1 This is a structural block diagram of a remote control system provided in an embodiment of this application;

[0018] Figure 2 This is a flowchart illustrating the redundant transfer of control rights between the master and slave remote controllers in the redundant decision-making module of this application embodiment. Detailed Implementation

[0019] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0020] like Figure 1 As shown, the remote control system provided in this application embodiment includes a master remote controller 1 and a slave remote controller 2. The master remote controller 1 includes a first wireless transmitting module 11, a first wireless receiving module 12, a first wired link interface 13, and a redundancy decision module 14; the slave remote controller 2 includes a second wireless transmitting module 21 and a second wired link interface 22.

[0021] The first wireless transmitting module 11 is configured as a wireless transmitter to establish a first wireless link L with an external controlled device. t .

[0022] The first wireless receiving module 12 is configured as a wireless receiver to wirelessly connect with the second wireless transmitting module 21 to establish a second wireless link L between the main remote controller 1 and the secondary remote controller 2. r .

[0023] The first wired link interface 13 is connected to the second wired link interface 22 to establish a wired link L between the master remote controller 1 and the slave remote controller 2. p This is to transmit channel data of the corresponding link between the main remote controller 1 and the secondary remote controller 2.

[0024] The redundant decision module 14 is used to select the final output channel data from the channel data transmitted by the wired link and the channel data transmitted by the second wireless link and the default security value based on the link status of the wired link and the second wireless link when the control is given to the secondary remote controller, and then send the final output channel data to the external controlled device through the first wireless link.

[0025] The first wireless transmitting module, the first wireless receiving module, and the second wireless transmitting module can be implemented using the ExpressLRS (ELRS) long-range remote control protocol based on the SX127x / SX1280 series LoRa RF chip. The first wireless transmitting module, the first wireless receiving module, and the second wireless transmitting module are each configured with independent UID namespaces, and their protocol stacks operate independently without interference between links.

[0026] It should be understood that the wireless link implementation of this solution is not limited to the ELRS protocol. Its equivalent protection scope includes: various long-range remote control protocols implemented using LoRa series RF chips such as SX127x / SX1280 / SX1276 / SX1262 / LR1121 and their subsequent compatible chips; and wireless remote control links with physical layer using any of the modulation methods OOK, FSK, GFSK, LoRa-CSS, and FLRC, and protocol layer using any of the frame formats CRSF, GHST, IBUS, and TBS-Crossfire.

[0027] Among them, the wired link transmits control information through a single signal line using pulse position modulation or pulse width modulation. Its specific implementation includes, but is not limited to, traditional PPM, CPPM, inverted SBUS, single-wire UART and other single-wire transmission forms.

[0028] It should be noted that the master and slave remote controllers are pre-configured as master and slave roles respectively during the factory configuration phase, and the corresponding role configuration parameters are stored in the device's non-volatile storage medium. During system power-on initialization, this persistent configuration is read by default, causing the master and slave remote controllers to enter operating states as master and slave roles respectively. In actual use, users can trigger a hot-switching process by operating designated physical buttons or button combinations on the remote controllers, swapping the master and slave roles of the two remote controllers. After the switch is complete, the wireless link transceiver roles, wired link port directions, and functional module loading logic of both the master and slave remote controllers are synchronously updated and adapted. The original master remote controller switches to the slave role, and the original slave remote controller switches to the master role.

[0029] It should be noted that the control ownership in this application is used to identify which remote control's joystick and button acquisition module the final control channel data currently output to the external controlled device originates from, and is a dynamic operating status indicator. Control ownership defaults to the master remote control, and two switching modes are supported:

[0030] First, there is the option of active or manual switching. Control handover commands can be triggered via a dedicated physical switch, designated function key, or combination key on the main or secondary remote control. After the system detects the control handover command, it updates the global control status flag and completes the active handover of control.

[0031] Secondly, there is an automatic switchback mechanism in case of anomalies. When control is held by the secondary remote controller, if both the wired link and the second wireless remote control link continue to fail and the failure duration exceeds the preset protection time, the system will automatically switch the control status flag back to the primary control status and output the channel data collected by the primary remote controller itself. This prevents the controlled device from being in the default safe value output state for a long time, which could lead to security risks.

[0032] Specifically, when selecting the final output channel data within each control output cycle, the redundancy decision module of the main remote controller uses the valid status of the wired link and the second wireless link as the basis for judgment. It performs a progressively degrading selection according to the priority order: wired link transmission channel data takes precedence, followed by the second wireless link transmission channel data, with a preset default safety value as a fallback. When a high-priority link is valid, the channel data transmitted by that link is selected for output; only when a high-priority link fails does it switch to the next lower-level data source, ultimately using the default safety value as a fallback output in case of a complete link failure. The final output channel data is transmitted by the main remote controller to the external controlled device (such as an aircraft) via the first wireless link.

[0033] Through the above architecture, the master remote controller can simultaneously serve as both a wireless transmitter for external controlled devices and a wireless receiver for the secondary remote controller, acting as two independent wireless links. A wired link is also added for redundancy, enabling a unified "dual wireless + wired" three-link topology without increasing hardware costs or altering the product structure. Furthermore, the three-level redundancy degradation decision mechanism at the output end achieves millisecond-level, zero-interruption link redundancy degradation between the wired link, the second wireless link, and the default safety value. This ensures imperceptible channel transitions in the control output of external controlled devices during master-slave control switching.

[0034] Optionally, see Figure 2 The provided redundant decision-making module involves a flowchart of the redundant transfer of control rights between the master and slave remote controllers, such as... Figure 2 As shown, the redundant decision module selects the final output channel data through the following steps:

[0035] First, determine if the wired link is valid;

[0036] If yes, then select the channel data transmitted via the wired link as the final output channel data; otherwise, determine whether the second wireless link is valid.

[0037] If the second wireless link is valid, the channel data transmitted through the second wireless link is selected as the final output channel data; otherwise, the default security value is selected as the final output channel data.

[0038] Taking a wired link configured as a ppm wired link as an example, when the redundancy decision module detects that the local machine (i.e., the main remote controller) is in the master role and the control belongs to the secondary remote controller, the output value of each channel k satisfies the following rules:

[0039] ;

[0040] ;

[0041] ;

[0042] Among them, L ppm This is the link status flag for the ppm wired link. A value of 1 indicates that the ppm wired link is valid, and a value of 0 indicates that the ppm wired link is invalid. r This indicates the link status flag of the second wireless link; a value of 1 indicates validity, and a value of 0 indicates invalidity. out For the final output channel data, c ppm This represents the channel data transmitted via the ppm wired link, c rx c represents the channel data transmitted from the second wireless link. def This indicates the default safety value.

[0043] When the redundant decision module detects that the local device (i.e., the master remote controller) is in the master control role and control belongs to the master remote controller, or that the local device is in the slave control role, it directly selects the channel data c mapped by the local ADC for each channel k. adc As output, i.e., c out =c adc .

[0044] Optionally, the redundancy decision module determines the link status of the wired link and the second wireless link through the following steps:

[0045] Based on the number of valid frames in the sliding window corresponding to the current frame of the corresponding link, the CRC is calculated using the number of frames and heartbeat monitoring data to determine the link quality of the corresponding link in the current frame.

[0046] If the link quality of the current frame and all previous historical frames is greater than or equal to the entry threshold, or the link quality of the current frame is greater than or equal to the exit threshold, then the link status of the corresponding link is confirmed to be valid.

[0047] If the link quality of the current frame and its historical frames is less than the entry threshold, or the link quality of the current frame is less than the exit threshold, then the corresponding link is considered invalid.

[0048] Specifically, the effective frame rate within the sliding window corresponding to the current frame is calculated by the number of effective frames within the sliding window corresponding to the current frame, the heartbeat delay penalty is calculated based on the heartbeat monitoring data, the CRC pass rate is calculated based on the number of CRC passes, and the effective frame rate, heartbeat delay penalty and CRC pass rate are weighted and calculated to obtain the link quality of the corresponding link.

[0049] More specifically, the link Link quality is calculated using the following formula:

[0050] ,

[0051] in, Indicates link The link quality is denoted by a value ranging from 0 to 100, where α, β, and γ are weights, and the sum of their weights equals 1. N represents the number of valid frames in the sliding window corresponding to the current frame, and N is the total number of frames in the sliding window corresponding to the current frame. This is the measured heart rate interval, in milliseconds (ms). This is the nominal value of the heart rate interval, in milliseconds (ms). This represents the number of frames that have passed the CRC check of the sliding window corresponding to the current frame.

[0052] At the same time, the following rules are used to determine whether the corresponding link is valid or invalid:

[0053] ,

[0054] ;

[0055] Where t represents the current frame time, in milliseconds (ms). The link at time t in the current frame The link status is defined as follows: a value of 1 indicates validity, and a value of 0 indicates invalidity. These represent the entry threshold and exit threshold, respectively.

[0056] Compared to the existing binary judgment method of "discarding several frames before switching", this solution quantifies and scores the link quality by using the number of effective frames, the number of CRC frames, and heartbeat monitoring data. Combined with hysteresis dual threshold source selection, it can significantly reduce the number of link switching times. Moreover, it does not require adding extra communication fields on the wired link and the second wireless link side, effectively eliminating switching jitter and making the control output of the external controlled device smoother.

[0057] In one optional implementation, the master remote controller maintains two independent link status fields in the shared configuration variables, corresponding to the operating states of the first and second wireless links, respectively. External modules such as LEDs, voice, buttons, buzzers, and application decision-making only read these two fields to obtain link information and do not directly access the internal state machines of the first wireless transmitting module and the first wireless receiving module. Each field is updated atomically during state machine transitions to avoid read-write conflicts. This design avoids the loss of another link status field during a change in the local controller's role and eliminates the need for external modules to refactor their state machines, achieving zero-modification adaptation for external modules.

[0058] Compared to the traditional "local perspective" single status field design, this solution achieves link status decoupling through two independent status fields. The "aircraft frequency pairing indicator" and "master-slave interconnection indicator" of the master remote controller do not interfere with each other, and can be displayed correctly after role switching.

[0059] In one optional implementation, the master remote controller establishes a three-slot preemptive scheduling mechanism for different types of data frames on the UART interface of the wireless module (including the first wireless transmitting module and the first wireless receiving module): high priority is used to transmit control frames (frequency pairing commands, WiFi configuration, and control switching instructions), medium priority is used to transmit parameter reading and writing and link statistics data, and low priority is used to transmit RC channel data. During the frequency pairing window, the controller switches to the blocking transmission path to ensure the real-time performance of key frames.

[0060] As an optional implementation, the master remote controller can also be configured with a third wireless transmission module. The first and third wireless transmission modules can operate in different radio frequency bands, or establish a dual-path wireless remote control link with the external controlled device using spatial diversity mode. The wired link is superimposed to form a four-link redundant topology, which further improves the redundancy and reliability of the ground-to-air communication link.

[0061] Optionally, to prevent the secondary remote controller from mistakenly connecting to the wireless receiver of an external controlled device, the secondary remote controller also includes a peer authentication module, which is used for:

[0062] Specific bits in the telemetry frame payload of the CRSF protocol are reused as peer identification bits. The peer identification bits are used to distinguish at least two types of peers: controlled devices and remote controllers.

[0063] During frequency pairing or connection, if the secondary remote controller detects that the peer's identification bit corresponds to the controlled device, it will terminate the current frequency pairing session and trigger the false connection protection process.

[0064] Specifically, when the second wireless transmitting module of the secondary remote controller is in frequency pairing or connected state, it continuously listens for link received frames. When a custom telemetry frame of type 0x5010 in the CRSF protocol is captured, the identity verification process begins:

[0065] First, the payload field of frame 0x5010 is parsed, and bits 4 and 5 of the payload[5] byte are extracted as the identity identifier of the peer device (referred to as "peer identity identifier"). Branch judgment is then performed based on the peer identity identifier:

[0066] When the peer identification bit corresponds to the remote controller (RC), the peer is determined to be a legitimate master remote controller, the current frequency pairing or data transmission session is maintained, and the verification process ends;

[0067] When the peer identification bit corresponds to the flight controller (FC), the peer is determined to be an external controlled device, which belongs to the false connection scenario, and enters the false connection protection branch;

[0068] The remaining peer identity identifiers are determined to be unknown (UNK) devices, the current session is maintained and the unknown state is marked.

[0069] The corresponding identity determination formula is:

[0070] ,

[0071] ,

[0072] ;

[0073] Among them, I peer The other end's identity is indicated by bit4 and bit5 of the payload[5] of frame 5010.

[0074] Furthermore, after determining it to be a false connection, the following operations are performed in sequence:

[0075] Set the WrongAircraftPending flag to submit the abnormal event to the system's main loop;

[0076] The system's main loop consumes this flag, triggering a "misconnected aircraft" voice broadcast and buzzer prompt, and synchronizing the abnormal status to the operator;

[0077] Actively abort the current frequency pairing session, disconnect the radio frequency connection with the peer, and avoid continuous transmission of control data through abnormal links;

[0078] Automatically enter WiFi unbinding state, clear the currently bound peer UID information, and maintain voice hold state during the unbinding process to avoid repeated alarm messages;

[0079] After unbinding is completed, it enters standby mode, waiting for the user to trigger the frequency pairing operation again.

[0080] Compared to the open-source ELRS solution that distinguishes peers solely by UID, this solution overlays an identity identifier on the reserved bits of the protocol frame, enabling the secondary remote controller to accurately identify the peer type in the same protocol RF environment, thus eliminating the security risks of misbinding controlled devices.

[0081] Optionally, the main remote control and the secondary remote control also include a button fuzzy routing module, which is used for:

[0082] In response to the physical frequency pairing button trigger event, the button event is mapped to one of the following execution logics based on the current primary / secondary role of the device and the status of the corresponding wireless link: receiving end frequency pairing, transmitting end frequency pairing, WiFi unbinding, or operation rejection.

[0083] Specifically, when the main remote control / secondary remote control detects a long press event on the physical frequency pairing button, it enters the button routing judgment process:

[0084] If the local machine is the master controller, the link status of the first wireless receiving module (master-slave interconnection receiving end) on the master controller side is selected as the judgment object;

[0085] If the local machine is the secondary controller, the link status of the second wireless transmitting module (the primary and secondary interconnecting transmitting end) on the secondary controller side is selected as the judgment object.

[0086] The following branch processing is executed based on the selected link state:

[0087] If the link status is in frequency pairing, play an error prompt tone, exit the current button press process directly, and refuse to trigger frequency pairing again;

[0088] If the link status is connected, the WiFi unbinding process is triggered, disconnecting the current primary and secondary interconnection link, i.e., the second wireless link;

[0089] If the link status is any other state (such as disconnected, frequency pairing failure, etc.), then enter the frequency pairing start branch and start the corresponding frequency pairing mode according to the local role.

[0090] Meanwhile, when the device is in the role of the master controller, the first wireless receiving module enters the frequency pairing mode of "waiting for secondary controller access" and waits for the secondary controller to broadcast the frequency pairing signal; when the device is in the role of the secondary controller, the second wireless transmitting module enters the frequency pairing mode of "broadcast NEW_UID" and sends the frequency pairing broadcast signal to the outside.

[0091] The corresponding routing decision formula is:

[0092] ,

[0093] ,

[0094] ,

[0095] .

[0096] Where K represents the output result of fuzzy routing by button, s represents the link status after role mapping, REJECT represents operation rejection, WIFI_EXIT represents WiFi unbinding, RX_BIND represents frequency pairing at the receiving end, TX_BIND represents frequency pairing at the sending end, BIND represents the current wireless link is in the process of pairing and binding and has not yet established a data connection, and CONN represents the current wireless link has completed pairing and established a data transmission link.

[0097] Compared to the traditional design where different roles correspond to different buttons, this solution adaptively assigns four behaviors to the same physical button. The operation panel and product manual do not need to be designed separately for primary and secondary roles, reducing the learning cost for users.

[0098] In one optional implementation, the main remote controller and the secondary remote controller further include a voice management module, which is used for:

[0099] The current state of received voice events is recorded using a global bitmap;

[0100] The voice event is enqueued on the rising edge of the voice event state.

[0101] During the switching between master and slave roles on the remote control, the voice suppression window is opened. Voice events generated within the voice suppression window will not be played temporarily and will only be played after the voice suppression window closes.

[0102] Specifically, a global voice event bitmap V is maintained for each type of voice event (connected, disconnected, successful frequency pairing, failed frequency pairing, mistaken connection to aircraft, low battery, over-range, etc.). Each event corresponds to a bit in the bitmap, with a value of 0 or 1, representing that the event has not been triggered or has been triggered, respectively. Voice enqueueing is triggered only once on the rising edge of the flipping bit corresponding to the event within each frame period to avoid duplicate enqueueing of the same event. The voice queue supports merging adjacent duplicate events, and dequeueing is performed based on changes in the BUSY signal of the voice chip during playback. During the switching between primary and secondary roles, a voice suppression window is opened. Voice events generated within the suppression window are only enqueued but not played; they are played in queue order after the suppression window ends.

[0103] The corresponding formula for determining voice queue entry is:

[0104] ,

[0105] Among them, Trig i (t) represents the enqueue trigger flag for the i-th type of speech event at time t, V i H(t) represents the state of the i-th speech event bit at time t, and H(t) is the speech suppression window flag, which takes the value of 0 or 1.

[0106] Compared to the problem of repeated voice broadcasts caused by repeated state transitions in existing solutions, this solution only triggers broadcasts on the rising edge of state transitions and uses a voice suppression window to block repeated events during switching transients, which can significantly reduce the auditory load on operators and avoid false alarms.

[0107] Optionally, the main control remote controller also includes a power-on / power-off transient protection module, which is used for:

[0108] During the system power-up phase, the final output channel data is locked to the default safe value until the link quality of at least one of the wired link and the second wireless link continuously meets the preset time, at which point the lock on the final output channel data is released.

[0109] When the power supply voltage is detected to be lower than the preset power-down threshold, the transmission action of the first wireless transmission module is stopped, and the level of the output pin of the wired link is pulled low.

[0110] Specifically, upon power-on, the MCU forcibly locks the final output channel data to the external controlled device to a preset default safety value, prohibiting the output of unstable random channel data. The first wireless transmitting module, the first wireless receiving module, and the first wired link interface peripheral are initialized sequentially, completing the basic hardware and protocol stack configuration. It checks whether the first wireless transmitting module and the first wireless receiving module have completed online initialization; if not, it waits continuously, maintaining the output locked state; if both are online, it enters the link quality assessment process: simultaneously assessing the link quality of the wired link and the second wireless link, determining whether the maximum link quality of the two links reaches the power-on unlock threshold and remains stable for the specified duration; if not, it continues to cycle through the assessment, maintaining the output locked state. Once the link quality consistently meets the standard, the default safety value lock of the output channel is released, and a redundancy decision is executed. That is, based on the link states of the wired link and the second wireless link, the final output channel data is selected from the channel data transmitted via the wired link, the channel data transmitted via the second wireless link, and the default safety value.

[0111] The corresponding power-on lockout formula is:

[0112] ,

[0113] in, Indicates the duration of continuous compliance before power-on unlocking, default 500ms, Q boot This indicates the link quality threshold for power-on unlocking, with a default value of 60. t0 is the power-on time.

[0114] During normal system operation, the power supply voltage Vcc is monitored in real time via the MCU's built-in PVD (Programmable Voltage Detector) / BOR (Undervoltage Reset) peripheral. The current power supply voltage is continuously compared to a preset power-down threshold. If the power supply voltage is higher than the preset power-down threshold, normal operation and continuous monitoring continue. When the power supply voltage is detected to be lower than the preset power-down threshold, the following safety shutdown operation is immediately executed:

[0115] Actively call the abort interface of the first wireless transmission module to terminate the current radio frequency transmission action and avoid sending incomplete abnormal control frames;

[0116] Pulling down the output pin level of the wired link terminates data output from the wired channel;

[0117] The system enters a safe shutdown state to ensure that the controlled devices do not receive abnormal control signals.

[0118] Compared to existing solutions that output the channel value "first and then correct" upon power-up, this solution forcibly locks the default safety value during the power-up phase and only unlocks it when the link stabilizes. Upon power-down, it actively terminates transmission and pulls the pin low, thus preventing transient abnormal outputs bidirectionally and improving system safety.

[0119] Optionally, the master remote controller also includes a state bus multiplexing module, which is used for:

[0120] The designated channel in the SBUS16 channel frame output to the external controlled device is redefined as a status bus channel. Based on the reference pulse width, it carries at least one of the following status information of the master remote controller and the slave remote controller through low-bit pulse width encoding: low power status, control ownership status, and master-slave interconnection status.

[0121] Specifically, the idle channels in the SBUS16-channel frame (such as channel 14) are redefined as a multi-bit status bus. Based on a 1000µs reference pulse width, the low-power status of the master remote controller, the low-power status of the slave remote controller, the control ownership status, and the master-slave interconnection status are encoded using the lower 4 bits of the pulse width difference. After each frame's RC output, the redundancy decision module calls the status bus multiplexing module to rewrite the pulse width of the corresponding channel. The flight controller of the external controlled device can then read the status information by decoding the channel pulse width difference, without needing to add a new frame type.

[0122] Compared to solutions that add new frame types or additional channels, this solution transmits status information by reusing existing SBUS channels, incurring zero protocol layer compatibility costs and can be directly adapted to existing flight control hardware.

[0123] Optionally, the master remote control and the slave remote control also include a role hot-switching coordination module, which is used for:

[0124] In response to the character switching trigger signal, perform the following operations in sequence:

[0125] Stop the current frequency pairing session, reset the link status field, update the persistent role configuration, switch the channel direction of the wired link, and enable the voice and LED display suppression window.

[0126] Specifically, when a user presses and holds the main / sub switch combination key, the role hot-switching coordination module stops the currently running frequency pairing session, resets the shadow status field, writes the persistent role configuration, reassigns the input / output direction of the wired link channel according to the new role (output comparison flip or input capture mode), and enables voice and LED suppression window anti-shake, thus achieving seamless hot-switching of roles.

[0127] Accordingly, this application also provides a method for redundant transfer of control rights between master and slave remote controllers, applied to the remote controller system provided in the above embodiments, comprising the following steps:

[0128] Two independent wireless remote control protocol stacks run on the main remote controller: a first wireless link and a second wireless link; wherein, the first wireless link is the wireless link between the first wireless transmitting module of the main remote controller and the external controlled device, and the second wireless link is the wireless link between the second wireless transmitting module of the secondary remote controller and the first wireless receiving module of the main remote controller.

[0129] A wired link is established between the master remote controller and the slave remote controller by connecting the first wired link interface and the second wired link interface;

[0130] When control is held by the secondary remote controller, based on the link status of the wired link and the second wireless link, the final output channel data is selected from the channel data transmitted by the wired link, the channel data transmitted by the second wireless link, and the default security value, and the final output channel data is sent to the external controlled device through the first wireless link.

[0131] The method for redundant transfer of control rights between master and slave remote controllers provided in this application is based on the aforementioned remote controller system and can realize the processing flow and functional logic of each functional module in the system. The execution steps of the method correspond one-to-one with the module architecture of the system, and the technical principles and beneficial effects of the two are consistent.

[0132] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions. Modules described in the embodiments of this application can be implemented in software or hardware. The names of modules do not, in some cases, constitute a limitation on the module itself.

[0133] The above are only some embodiments of this application and do not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A remote control system, characterized in that, It includes a master remote controller and a slave remote controller; the master remote controller includes a first wireless transmitting module, a first wireless receiving module, a first wired link interface, and a redundancy decision module; the slave remote controller includes a second wireless transmitting module and a second wired link interface; The first wireless transmission module is used to establish a first wireless link with an external controlled device; The first wireless receiving module is used to establish a second wireless link between the main remote controller and the secondary remote controller in conjunction with the second wireless transmitting module; The first wired link interface is connected to the second wired link interface to establish a wired link between the master remote controller and the slave remote controller; The redundant decision module is used to perform the following decision when control belongs to the secondary remote controller: if the wired link is valid, the channel data transmitted by the wired link is selected as the final output channel data; if the wired link is invalid and the second wireless link is valid, the channel data transmitted by the second wireless link is selected as the final output channel data. If both the wired link and the second wireless link are invalid, then the default security value is selected as the final output channel data; The final output channel data is transmitted to the external controlled device via the first wireless link; The link states of the wired link and the second wireless link are determined through the following steps: The link quality of the corresponding link in the current frame is calculated based on the number of valid frames in the sliding window corresponding to the current frame, the CRC through the number of frames, the measured value of the heartbeat interval, and the nominal value of the heartbeat interval. If the link quality of the current frame is greater than or equal to the entry threshold, or if the corresponding link of the previous frame is valid and the link quality of the current frame is greater than or equal to the exit threshold, then the link status of the corresponding link is determined to be valid. If the link quality of the current frame is less than the exit threshold, or if the corresponding link of the previous frame is invalid and the link quality of the current frame is less than the entry threshold, then the link status of the corresponding link is determined to be valid.

2. The remote control system as described in claim 1, characterized in that, The secondary remote controller also includes a peer identity verification module, which is used for: A specific bit in the telemetry frame payload of the CRSF protocol is reused as a peer identification bit, which is used to distinguish at least two types of peers: controlled devices and remote controllers. During frequency pairing or connection, if the secondary remote controller detects that the peer identification bit corresponds to the controlled device, it will terminate the current frequency pairing session and trigger the false connection protection process.

3. The remote control system as described in claim 1, characterized in that, The main remote control and the secondary remote control each include a button fuzzy routing module, the button fuzzy routing module being used for: In response to the physical frequency pairing button trigger event, the button event is mapped to one of the following execution logics based on the current primary / secondary role of the device and the status of the corresponding wireless link: receiving end frequency pairing, transmitting end frequency pairing, WiFi unbinding, or operation rejection.

4. The remote control system as described in claim 1, characterized in that, The main remote controller and the secondary remote controller each include a voice management module, the voice management module being used for: The state of received voice events is recorded using a global bitmap; The voice event is enqueued on the rising edge of the voice event state. During the switching between primary and secondary roles of the remote control, a voice suppression window is opened, and voice events generated within the voice suppression window are temporarily suspended from playback until the voice suppression window ends.

5. The remote control system as described in claim 1, characterized in that, The main control remote controller also includes a power-on / power-off transient protection module, which is used for: During the system power-on phase, the final output channel data is locked to a default safe value until the link quality of at least one of the wired link and the second wireless link continuously meets the preset time limit, at which point the lock on the final output channel data is released. When the power supply voltage is detected to be lower than the preset power-down threshold, the transmission action of the first wireless transmission module is stopped, and the level of the output pin of the wired link is pulled low.

6. The remote control system as described in claim 1, characterized in that, The master remote controller also includes a state bus multiplexing module, which is used for: The designated channel in the SBUS16 channel frame output to the external controlled device is redefined as a status bus channel. Based on the reference pulse width, it carries at least one of the following status information of the master remote controller and the slave remote controller through low-bit pulse width encoding: low power status, control ownership status, and master-slave interconnection status.

7. The remote control system as described in claim 1, characterized in that, The main remote controller and the secondary remote controller each include a role hot-switching coordination module, which is used for: In response to the character switching trigger signal, perform the following operations in sequence: Stop the current frequency pairing session, reset the link status field, update the persistent role configuration, switch the channel direction of the wired link, and enable the voice and LED display suppression window.

8. A method for redundant transfer of control rights between master and slave remote controllers, characterized in that, The remote control system as described in any one of claims 1 to 7 is characterized in that it comprises: Two independent wireless remote control protocol stacks run on the main remote controller: a first wireless link and a second wireless link; wherein, the first wireless link is the wireless link between the first wireless transmitting module of the main remote controller and the external controlled device, and the second wireless link is the wireless link between the second wireless transmitting module of the secondary remote controller and the first wireless receiving module of the main remote controller. A wired link is established between the master remote controller and the slave remote controller by connecting the first wired link interface and the second wired link interface; When control is held by the secondary remote controller, the following decision is made: if the wired link is valid, the channel data transmitted via the wired link is selected as the final output channel data; if the wired link is invalid and the second wireless link is valid, the channel data transmitted via the second wireless link is selected as the final output channel data; if both the wired link and the second wireless link are invalid, a default safety value is selected as the final output channel data; and the final output channel data is transmitted to the external controlled device via the first wireless link. The link states of the wired link and the second wireless link are determined through the following steps: The link quality of the corresponding link in the current frame is calculated based on the number of valid frames in the sliding window corresponding to the current frame, the CRC through the number of frames, the measured value of the heartbeat interval, and the nominal value of the heartbeat interval. If the link quality of the current frame is greater than or equal to the entry threshold, or if the corresponding link of the previous frame is valid and the link quality of the current frame is greater than or equal to the exit threshold, then the link status of the corresponding link is determined to be valid. If the link quality of the current frame is less than the exit threshold, or if the corresponding link of the previous frame is invalid and the link quality of the current frame is less than the entry threshold, then the link status of the corresponding link is determined to be valid.

Images