Unmanned ship seven-degree-of-freedom digital twin semi-physical simulation system and method

Abstract

The application discloses an unmanned ship seven-degree-of-freedom digital twin semi-physical simulation system and method, relates to the technical field of unmanned ship semi-physical simulation, and comprises a digital twin module, a trusted consistency evaluation module and a semi-physical module.The digital twin module is used for generating a virtual unmanned ship target state and a simulation environment state.The semi-physical module is used for reproducing a motion instruction into entity motion and feeding back an entity pose, and comprises a six-degree-of-freedom platform, a single-degree-of-freedom horizontal turntable and an unmanned ship entity model which are assembled in a bottom-up and layer-by-layer mode, and an attitude measurement unit is arranged on the unmanned ship entity model.The trusted consistency evaluation module is used for performing virtual-physical data mapping, trusted consistency evaluation and hardware instruction generation, and a motion instruction is generated and issued only after the trusted consistency gate is passed.The application effectively reduces virtual-physical misjudgment caused by asynchronous feedback, mechanical constraints and sensing abnormalities, and improves the verifiability and reusability of semi-physical simulation.

Description

Technical Field

[0001] This invention relates to the field of hardware-in-the-loop simulation technology for unmanned vessels, and in particular to a seven-DOF digital twin hardware-in-the-loop simulation system and method for unmanned vessels. Background Technology

[0002] Before entering real-ship testing, unmanned surface vessel (USV) control algorithms typically require software simulation, hardware-in-the-loop (HIL) simulation, and real-ship verification. Software simulation facilitates the rapid construction of environments and control strategies, but it is difficult to fully represent real actuators, sensor latency, communication jitter, and mechanical motion boundaries. Hardware-in-the-loop (HIL) simulation can connect to real hardware, but if the simulation results are simply sent directly to the motion platform, it is easy to remain at the level of motion playback or hardware integration.

[0003] Existing hardware-in-the-loop (HIL) testing platforms for unmanned surface vessels (USVs) can already achieve virtual environment construction, status display, sensor data access, and testing and evaluation. Components such as ROS simulation, Stewart platform, horizontal turntable, inertial pose measurement unit, and virtual-physical feedback can all be implemented using known devices and conventional methods in the field. However, existing HILs share a common structural flaw: the lack of an independent intermediate link between the digital twin and the physical replica to online determine the reliability of the virtual-physical replica and decide whether to implement it. This results in an open-loop mapping between the virtual and physical worlds—a "direct connection—i.e., replication." This structural flaw manifests in the following four prominent engineering problems: First, there is asynchronous feedback between the digital twin and the physical replica. The ROS simulation clock, hardware command sending clock, and sensor feedback clock are not consistent. If the physical feedback is not time-aligned and the deviation caused by the asynchrony is not distinguished from the model error, the communication and feedback delays are easily misjudged as model errors. Time alignment is a common practice in this field. The key is to introduce a reliable consistency assessment after time alignment to distinguish the delay deviation from the real model error. Second, the virtual and physical residuals are affected by model uncertainty, sensor noise, delay estimation error, and the platform's mechanical replicability. Without a reliability assessment, the erroneous feedback will be continuously amplified. Third, the combination of the Stewart platform and the horizontal turntable is not a direct linear correspondence. Continuous yaw, large-angle rotation, platform singular configuration, and boundary limiting need to be handled in the same constraint allocation problem. Fourth, if the mismatch conditions that occur in the hardware-in-the-loop simulation cannot be automatically recorded and replayed as the next scenario, the system will find it difficult to form a reusable verification evidence chain.

[0004] More importantly, current technologies lack an independent, reliable consistency assessment mechanism between the ROS digital twin and the physical semi-physical module to centrally determine whether and how the virtual-physical replication is distributed to the motion platform. Therefore, a closed-loop system and method is needed that is architectured around the collaborative efforts of the ROS digital twin module, the reliable consistency assessment module, and the semi-physical module, and is designed for verifiable virtual-physical consistency. This system and method is not simply a direct parallel of existing hardware or software. Summary of the Invention

[0005] To overcome the aforementioned problems in the existing technology, this invention proposes a seven-degree-of-freedom digital twin hardware-in-the-loop simulation system and method for unmanned vessels.

[0006] The technical solution adopted by this invention to solve its technical problem is: a seven-degree-of-freedom digital twin semi-physical simulation system for unmanned vessels, including a digital twin module, a reliability and consistency assessment module, and a semi-physical module. The digital twin module is used to generate a virtual unmanned vessel target state, a virtual sea state disturbance, and a simulation task state. The semi-physical module is used to reproduce motion commands as physical motion and feed back the physical pose. It includes a six-degree-of-freedom platform, a single-degree-of-freedom horizontal turntable, and an unmanned vessel physical model assembled from bottom to top. An attitude measurement unit is installed on the unmanned vessel physical model. The trusted consistency assessment module is located between the digital twin module and the semi-physical module. It is used to align the entity pose time fed back by the semi-physical module to the simulation clock of the digital twin module, construct virtual and real residuals with covariance description for the virtual pose of the digital twin module and the time-aligned entity feedback pose, and perform trusted consistency gating. Motion commands are generated and issued only after the trusted consistency gating is passed.

[0007] The aforementioned unmanned vessel seven-degree-of-freedom digital twin semi-physical simulation system includes a credible consistency assessment module comprising a time alignment unit, an uncertainty residual observation unit, a credible consistency evaluation unit, a seven-degree-of-freedom constrained motion allocation unit, a safety degradation unit, and a counterexample scenario playback and regression verification unit. The time alignment unit is used to align the physical feedback pose of the semi-physical module to the simulation clock of the digital twin module; the uncertainty residual observation unit is used to form virtual and real residuals with covariance description after time alignment; the credibility consistency evaluation unit is used to generate credibility consistency coefficients based on virtual and real residuals, residual covariance and validity flags, perform credibility consistency gating and update residual corrections accordingly; the seven-degree-of-freedom constrained motion allocation unit is used to solve and generate six-degree-of-freedom platform pose commands and single-degree-of-freedom horizontal turntable angle commands when the credibility consistency gating passes; the safety degradation unit is used to perform multi-level safety degradation when the credibility consistency gating fails; the counterexample scenario playback and regression verification unit is used to record the working conditions with insufficient credibility consistency as counterexample segments, write them into the scenario library and reconstruct similar working conditions for re-simulation and retesting.

[0008] In the aforementioned unmanned surface vessel seven-DOF digital twin hardware-in-the-loop simulation system, the uncertainty residual observation unit uses the difference between the virtual pose and the time-aligned entity feedback pose as the virtual-real residual. : The uncertainties of the virtual model, sensor measurement, time alignment, and hardware reproduction are integrated into a residual covariance matrix. : in, For virtual pose, These are the time-aligned entity pose estimates. For the simulated clock time of the digital twin module, This is the estimated feedback delay. , , , These are the covariance components corresponding to virtual model uncertainty, sensor measurement uncertainty, time alignment uncertainty, and hardware reproduction uncertainty, respectively.

[0009] In the aforementioned unmanned surface vessel seven-DOF digital twin hardware-in-the-loop simulation system, the reliability consistency evaluation unit uses the residual covariance matrix to normalize the virtual and real residuals to obtain consistency statistics. : Combined with communication validity flags Valid markers of movement boundaries and feedback valid indicators Generate a reliable consistency coefficient : in, For the difference between the real and virtual, Let n be the residual covariance matrix, and n be the residual dimension. The value can be 0 or 1. The value range is [0,1]; The credible consistency evaluation unit performs a bounded update on the residual correction using the following formula: in The attenuation coefficient is... For residual correction gain, For The upper bound function of the amplitude, This represents the upper limit of the residual correction magnitude. This is the residual correction amount for the k-th simulation cycle. This is the residual correction amount for the (k-1)th simulation cycle; the residual correction amount only applies to the seven-degree-of-freedom constrained motion allocation process and does not reverse-write the dynamic model of the digital twin module.

[0010] The aforementioned unmanned surface vessel seven-DOF digital twin hardware-in-the-loop simulation system, wherein the trusted consistency evaluation unit performs trusted consistency gating according to the following criterion: when and When deemed reliable, the virtual and real residuals are allowed to enter the seven-degree-of-freedom constrained motion assignment; when or If the system is deemed untrustworthy, the residual correction amount is frozen, attenuated, or cleared to zero, and the security degradation unit is triggered; wherein, To preset a confidence threshold, To preset a consistency statistical threshold; the trusted consistency evaluation unit also sets an entry threshold and an exit threshold, when the trusted consistency coefficient is continuously... When the number of simulation cycles falls below the exit threshold, the system enters an untrusted state. When the trust consistency coefficient is continuously... When the simulation cycle recovers to above the threshold, it exits the untrusted state to suppress frequent jumps in the trusted state near the threshold.

[0011] The aforementioned unmanned surface vessel seven-degree-of-freedom digital twin hardware-in-the-loop simulation system, wherein the seven-degree-of-freedom constrained motion allocation unit uses the heave, roll, pitch, small-range yaw of the six-degree-of-freedom platform, the equivalent tilt component used to simulate longitudinal acceleration by tilting, and the continuous bow roll of the single-degree-of-freedom horizontal turntable as joint decision quantities; the seven-degree-of-freedom constrained motion allocation unit solves for the hardware candidate instructions according to the following formula: And satisfy constraints ,in To achieve the optimal control quantity that minimizes the weighted squared error; These are candidate instructions for the k-th simulation cycle. This is a mapping function from hardware union instructions to entity poses. Let W be the six-DOF pose vector of the virtual unmanned surface vessel in the k-th simulation cycle. t To reproduce the error weight matrix, , , These are the weighting coefficients. and These are the singular configuration penalty term and the motion boundary penalty term, respectively. For consistency statistics, The reliability and consistency coefficient. and These are the consistency statistics threshold and the confidence threshold, respectively. This is the residual correction amount for the k-th simulation cycle; and These are the lower and upper bounds for each component of the hardware union instruction, respectively. For single-cycle instruction increments, , This refers to the actual command sent during the (k-1)th simulation cycle. This refers to the actual command sent during the k-th simulation cycle. This represents the upper limit of instruction increment per cycle.

[0012] The singular configuration penalty term in the aforementioned unmanned surface vessel seven-DOF digital twin hardware-in-the-loop simulation system is specifically as follows: The motion boundary penalty term is specifically as follows: in, For a six-DOF Stewart platform, the Jacobian matrix is... Its minimum singular value, To prevent positive numbers with a denominator of zero, j is a hardware union instruction. The component index, where j∈{1,2,…,7}, For the j-th component of the hardware joint instruction in the k-th simulation cycle, These are the allowed lower bound and allowed upper bound for the component, respectively.

[0013] The aforementioned unmanned surface vessel seven-degree-of-freedom digital twin hardware-in-the-loop simulation system includes a safety degradation unit with multiple degradation states: Under normal conditions, candidate instructions obtained through constraint optimization are executed; under mild anomalies, the single-cycle instruction increment is limited and the residual correction is frozen; under moderate anomalies, the six-degree-of-freedom platform and the single-degree-of-freedom horizontal turntable are controlled to return to a safe neutral position at a preset speed; under severe anomalies or when an emergency stop signal is valid, the transmission of tracking instructions is stopped and a bottom-level emergency stop is triggered; wherein the actual transmitted instructions are obtained from the candidate instructions through single-cycle increment limitation. in, These are candidate instructions for the k-th simulation cycle. This refers to the actual command sent during the (k-1)th simulation cycle. This refers to the actual command sent during the k-th simulation cycle. This represents the upper limit of instruction increment per cycle.

[0014] In the aforementioned unmanned surface vessel seven-DOF digital twin semi-physical simulation system, the counterexample scenario playback and regression verification unit records data from the current period and several periods before and after it as counterexample segments when the credibility consistency coefficient is lower than a preset credibility threshold, the virtual-real residual continues to increase, the feedback delay suddenly changes, the sensor feedback fails, or the six-DOF platform and the single-DOF horizontal turntable approach the motion boundary. And write it into the scene library: in, For the difference between the real and virtual, The residual covariance matrix is... The reliability and consistency coefficient. These are candidate instructions for the k-th simulation cycle. This is the estimated feedback delay. These are communication, motion boundary, and feedback validity flags, respectively. Let be the virtual sea state disturbance vector for the kth simulation cycle. The target trajectory reference vector for the kth simulation cycle is used. The counterexample segments are classified into delay anomalies, sensing anomalies, mechanism boundary anomalies, virtual-real mismatch anomalies, and communication anomalies. These classifications serve as the basis for generating the next round of simulation scenario parameters, sea state disturbance parameters, target trajectory parameters, and hardware limiting parameters, thereby reconstructing similar working conditions for re-simulation and retesting.

[0015] A seven-DOF digital twin hardware-in-the-loop simulation method for unmanned surface vessels, based on the aforementioned seven-DOF digital twin hardware-in-the-loop simulation system for unmanned surface vessels, specifically includes the following steps in each simulation cycle: Step 1: The trusted consistency assessment module obtains the virtual pose of the digital twin module and the entity feedback of the semi-physical module, and aligns the entity feedback poses in time. Step 2: Calculate the virtual and real residuals based on the virtual pose and the time-aligned entity pose. And it integrates multi-source uncertainties into a residual covariance matrix. ; Step 3, Calculate the consistency statistic With the credibility consistency coefficient , and according to and Perform trusted consistency gating, where For the confidence threshold, This is the consistency statistical threshold; Step 4: When the gate passes, the seven-degree-of-freedom constrained motion allocation unit generates a six-degree-of-freedom platform pose command and a single-degree-of-freedom horizontal turntable angle command and sends them to the hardware module. Step 5: When the gate fails, perform a safety degradation and record the condition as a counterexample after classifying it into anomaly categories; Step 6: Write the counterexample fragments into the scenario library, and use the digital twin module to reconstruct similar working conditions for re-simulation and retesting.

[0016] The beneficial effects of this invention are: (1) It improves the virtual-real consistency evaluation from simple error comparison to a credible judgment with uncertain covariance, reducing the false corrections caused by delay, noise and feedback anomalies; (2) It transforms the seven-degree-of-freedom allocation of the six-degree-of-freedom Stewart platform and the single-degree-of-freedom horizontal turntable into an optimization problem with mechanism boundaries, single-cycle increments, singular penalties and consistency constraints, improving the safety of continuous yaw and complex attitude reproduction; (3) It automatically forms counterexample fragments of mismatch conditions and writes them into the scene library, so that the semi-physical simulation has a traceable, reproducible and iteratively verifiable evidence chain; (4) The ROS digital twin module does not directly call the underlying hardware protocol. When replacing hardware, it mainly modifies the protocol adaptation layer in the credible consistency evaluation module, thereby reducing the coupling between the twin model and the underlying hardware.

[0017] This invention introduces an independent trustworthy consistency evaluation module between the digital twin module and the semi-physical module, which is centrally scheduled by the module. This transforms the open-loop mapping of "direct connection - immediate reproduction" into a closed loop of "evaluation - gating - reproduction" at the system architecture level. Under this architecture, the uncertainty residual observation unit, the trustworthy consistency evaluation unit, the seven-degree-of-freedom constrained motion allocation unit, and the counterexample scenario playback and regression verification unit work together to achieve trustworthy determination of virtual and real consistency, constraint allocation, and counterexample verification, rather than a simple superposition of the above functional modules. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall system structure and overall data flow of the present invention; Figure 2This is a schematic diagram of the three-clock synchronization and delay estimation process; Figure 3 This is a schematic diagram of the process for evaluating the reliability and consistency of uncertain residuals. Figure 4 A schematic diagram of the optimization process for seven-degree-of-freedom constrained motion assignment; Figure 5 This is a schematic diagram illustrating the evidence chain for replaying counterexample scenarios and regression verification. Figure 6 This is a schematic diagram of a semi-physical module structure; Figure 7 This is a schematic diagram of the execution flow of each simulation cycle of the method of the present invention. Detailed Implementation

[0019] To enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

[0020] Unless otherwise specified, the following terminology is used uniformly for rotation about the vertical axis in this paper: "bow" refers to the continuous rotational motion of the unmanned vessel's bow, which is mainly reproduced by the single-degree-of-freedom horizontal turntable 32 in this invention; "yaw" refers to the small-range attitude disturbance of the six-degree-of-freedom Stewart platform 31 moving platform about the vertical axis, serving as a secondary channel for bow reproduction; "bow angle" refers to the angular state quantity of the unmanned vessel's bow. The above terms all correspond to rotation about the vertical axis (yaw direction), and their channel division is detailed in the description of the seven-degree-of-freedom constrained motion allocation unit 25.

[0021] I. Overall Solution and Hardware Platform Setup like Figure 1 As shown, this invention introduces a trusted consistency assessment module between the digital twin module and the hardware-in-the-loop module, thereby forming a collaborative seven-DOF digital twin hardware-in-the-loop simulation system for unmanned surface vessels (USVs) consisting of three modules: digital twin module 1, trusted consistency assessment module 2, and hardware-in-the-loop module 3. Digital twin module 1 is a ROS digital twin module, but other simulation systems capable of outputting USV target states and scene parameters can also be used. This invention is not a simple parallel arrangement of ROS simulation, motion platform, sensors, and display interface, but rather a closed-loop architecture with the trusted consistency assessment module centrally managing and trusted-gated control over whether and how the virtual-to-real replication is distributed.

[0022] The difference in this invention lies in combining the six-DOF Stewart platform, the unmanned vessel physical model, and the ROS digital twin module. An independent reliable consistency evaluation module is introduced between the digital twin module and the semi-physical module for central scheduling. Reliable gating is performed using virtual and real residuals described with covariance, thereby determining whether and how motion commands are issued.

[0023] like Figure 6As shown, the semi-physical module 3 includes a six-DOF Stewart platform 31, a single-DOF horizontal turntable 32, an unmanned vessel physical model 33, and an inertial attitude measurement unit 34. The single-DOF horizontal turntable 32 is mounted on the moving platform of the six-DOF Stewart platform 31, the unmanned vessel physical model 33 is mounted on the single-DOF horizontal turntable 32, and the inertial attitude measurement unit 34 is mounted on the unmanned vessel physical model 33.

[0024] In one implementation, the six-DOF Stewart platform 31 primarily handles heave, roll, pitch, and small-range yaw disturbances, as well as the tilt component of longitudinal acceleration equivalently simulated through attitude degree-of-freedom reuse; the single-DOF horizontal turntable 32 primarily handles continuous yaw and large-angle rotation. The installation direction of the unmanned vessel physical model 33 corresponds to the zero-position direction of the single-DOF horizontal turntable 32. After installation, the inertial attitude measurement unit 34 undergoes zero-bias calibration so that its output roll, pitch, and heading angles can establish a corresponding relationship with the attitude quantities in the ROS digital twin module 1.

[0025] During the system calibration phase, the trustworthy consistency assessment module 2 records the installation relationships between the virtual unmanned surface vessel coordinate system, the six-DOF Stewart platform moving platform coordinate system, the single-DOF horizontal turntable coordinate system, and the inertial pose measurement unit 34 coordinate system, forming a fixed extrinsic parameter table. This extrinsic parameter table is used to convert the virtual attitude output by the ROS digital twin module 1 into an executable hardware target of the hardware-in-the-loop module 3, and to back-calculate the physical feedback data into a physical pose consistent with the ROS simulation clock.

[0026] II. Overall Structure and Data Flow of Subsystems II. The overall data flow of the system is as follows (the execution flow of each simulation cycle is as follows): Figure 7 As shown): ROS digital twin module 1 generates the virtual unmanned surface vessel target state and scene parameters and sends them to trusted consistency assessment module 2; trusted consistency assessment module 2 performs time alignment on the entity pose fed back by the hardware-in-the-loop module 3, constructs virtual-real residuals with covariance description, and performs trusted consistency assessment; when the assessment passes, trusted consistency assessment module 2 generates six-degree-of-freedom Stewart platform pose commands and single-degree-of-freedom horizontal turntable angle commands through seven-degree-of-freedom constrained motion allocation and sends them to hardware-in-the-loop module 3; when the assessment fails, trusted consistency assessment module 2 triggers safety degradation and records the working condition as a counterexample fragment into the scene library, for ROS digital twin module 1 to reconstruct similar working conditions for re-verification. The three modules thus form a closed loop of problem discovery, counterexample construction, re-verification, and result recording. Trusted consistency assessment module 2, as the centralized execution entity for virtual-real data mapping and trusted judgment, is preferably implemented with centralized or unique hardware bridging, and ROS digital twin module 1 does not directly access the underlying hardware protocol of hardware-in-the-loop module 3.

[0027] Specifically, upon system startup, the Trusted Consistency Assessment Module 2 first establishes a mapping table of ROS topics, hardware communication ports, and sensor feedback ports, and sets a data number, timestamp field, validity flag, and failure retention time for each input. The ROS digital twin module 1 only publishes the target state and scene parameters to the Trusted Consistency Assessment Module 2, and does not directly access the six-DOF Stewart platform 31, the single-DOF horizontal turntable 32, or the inertial pose measurement unit 34. The hardware-in-the-loop module 3 also does not directly rewrite the ROS digital twin module, but instead feeds back the platform pose, turntable angle, and inertial pose to the Trusted Consistency Assessment Module 2. The Trusted Consistency Assessment Module 2 then completes the trust determination before deciding whether to proceed to the next cycle allocation.

[0028] Protocol isolation interface 21 encapsulates ROS messages, platform drive commands, turntable control commands, and inertial pose feedback into unified data frames. Each data frame includes at least a frame number, data source, generation time, reception time, state variables, a check field, and a validity flag. Through this encapsulation method, the trustworthy consistency assessment module 2 can replace the simulation software, motion platform, or sensors without changing the ROS simulation model and underlying hardware protocol.

[0029] III. ROS Digital Twin Subsystem and its Modules The ROS digital twin module 1 is used to generate the virtual unmanned surface vessel target state, virtual sea state disturbance, and simulation mission state, while maintaining the independence of its simulation model and control algorithm throughout the simulation process. This module includes a simulation scenario and sea state configuration module, a six-degree-of-freedom dynamics model module, a sea state disturbance injection module, a target trajectory and mission planning module, a virtual state packaging module, a model independence preservation unit, and an angle continuity preprocessing unit.

[0030] Specifically, the simulation scenario and sea state configuration module generates sea state conditions such as wind, waves, and currents, and the desired trajectory based on the scenario parameters obtained from the playback and regression verification of preset working conditions or counterexample scenarios; the six-degree-of-freedom dynamic model module performs propulsion, maneuvering, and hydrodynamic simulations of the virtual unmanned vessel's heave, roll, pitch, yaw, sway, and sway, and outputs the virtual unmanned vessel's attitude and velocity; the sea state disturbance injection module injects random wind, wave, and current disturbances as virtual environmental disturbances; the target trajectory and mission planning module generates target trajectories and motion commands based on the mission; and the virtual state packaging module packages the above results into virtual states in a unified format and publishes them to the trustworthy consistency assessment module 2 via ROS topics.

[0031] In one possible implementation, the virtual state output by the ROS digital twin module 1 is represented as follows: in, Let be the six-DOF pose vector of the virtual unmanned surface vessel in the k-th simulation cycle. Let be the generalized velocity vector of the virtual unmanned vessel in the k-th simulation cycle. Let be the virtual sea state disturbance vector for the kth simulation cycle. Let be the target trajectory reference vector for the kth simulation cycle.

[0032] When defining state variables, all variables adopt a unified unit and symbol convention: position variables are expressed in meters, angle variables in radians or angles after unified conversion, angular velocities in radians per second, and time variables in seconds. For heading angles or single-degree-of-freedom horizontal turntable angles, the credible consistency assessment module 2 performs angle expansion processing before calculating residuals to avoid misjudging a large virtual-to-real mismatch when the angle jumps from π to -π.

[0033] This design ensures that the ROS digital twin module 1 retains its original simulation model and control algorithm, preventing direct contamination from hardware platform installation errors, sensor noise, or mechanical limitations. In other words, the ROS digital twin module 1 is responsible for providing the target motion that should be reproduced, while the reliability and consistency assessment module 2 is responsible for determining whether the current hardware can reliably reproduce it and how to reproduce it safely.

[0034] IV. Trusted Consistency Assessment Subsystem and its Modules The trusted consistency assessment module 2, which intervenes between the ROS digital twin module 1 and the semi-physical module 3, is the core of this invention. This module performs trusted consistency gating with covariance description on the time-aligned virtual and physical residuals, and determines whether and how motion commands are issued accordingly. This module includes a time alignment unit 22, an uncertainty residual observation unit 23, a trusted consistency evaluation unit 24, a seven-DOF constrained motion allocation unit 25, a security degradation unit 26, and a counterexample scenario playback and regression verification unit 27; among them, the protocol isolation interface 21 is an implementation component of this module and serves as a functional prerequisite for trusted consistency assessment.

[0035] Time alignment is achieved through three-clock synchronization and delay estimation. The three-clock synchronization and delay estimation are functional prerequisites for reliable consistency assessment in this field and are conventional methods in this field. The specific implementation is as follows: like Figure 2 As shown, the trusted consistency assessment module 2 records the ROS simulation clock of the target state published by the ROS digital twin module 1. The clock for sending hardware commands from the trusted consistency assessment module 2 to the hardware-in-the-loop module 3. And the feedback clock for the inertial pose measurement unit 34 and the motion platform feedback data. This forms the three-clock set for the k-th simulation cycle: The three-clock synchronization queue is maintained using a sliding window method, with the window length determined based on the ROS simulation cycle, hardware feedback cycle, and maximum allowable delay. For the same ROS simulation cycle, the trusted consistency assessment module 2 allows multiple physical feedback samples and selects the sample that is closest in time to the compensation time and has a valid feedback flag during calculation. For out-of-order data frames, they are first rearranged by frame number and timestamp before delay estimation.

[0036] The three-clock synchronization queue establishes periodic buffer units according to the ROS simulation clock. Each periodic buffer unit includes virtual target state, platform feedback, turntable feedback, inertial pose feedback, communication validity flag, motion boundary validity flag, and feedback validity flag.

[0037] When any of the communication validity flag, motion boundary validity flag, or feedback validity flag is abnormal, the cycle is still retained in the queue, but not directly used for trusted consistency correction. Instead, it serves as candidate data for subsequent negative example scenario replay and regression verification. This avoids the situation where the source of the problem cannot be reproduced after simply discarding abnormal data.

[0038] Since hardware communication, sensor sampling, and host computer scheduling may all introduce delays, the time alignment unit 22 does not directly compare the virtual and real states according to the data reception order. Instead, it performs a weighted matching of the virtual pose sequence and the physical feedback pose sequence within a preset delay search interval to obtain the feedback delay estimate. In the formula Here, N is the weight matrix for delayed matching, N is the sliding window length, and the index difference is... With delay All calculations are based on simulation cycles. During delay search, the reliability consistency assessment module 2 prioritizes matching components sensitive to motion changes, such as roll, pitch, heading angle, or their angular velocity, and reduces the weight of samples in the low dynamic range. If the delay estimates obtained over multiple consecutive cycles change too much, a limiting update method is used to update the delay estimates to prevent sudden changes in time alignment caused by a single abnormal feedback.

[0039] When the sampling time of the feedback data is between two adjacent periods, the reliable consistency assessment module 2 uses interpolation to obtain the alignment state; when the feedback data is briefly missing but does not exceed the holding window, it is filled in using the holding method; when the feedback data exceeds the holding window or time reversal occurs, the feedback is determined to be invalid and reset. .

[0040] After time alignment is completed, the credible consistency assessment module 2 packages the aligned entity pose, the corresponding virtual target state, the delay estimate, and various valid flags into a credible assessment input for the same period. This input is not directly used as a platform control command, but instead first enters the uncertainty residual observation unit 23 to calculate residuals and covariance.

[0041] like Figure 3 As shown, the uncertainty residual observation unit 23 first obtains the entity pose estimate based on the delayed-compensated physical feedback data. Then calculate the virtual and real residuals: The estimated entity pose can be determined jointly by the attitude parameters of the inertial pose measurement unit 34, the feedback pose of the six-DOF Stewart platform 31, and the feedback angle of the single-DOF horizontal turntable 32. For the heading channel, the reliability consistency assessment module 2 verifies the consistency between the absolute rotation angle of the single-DOF horizontal turntable 32 and the heading change fed back by the inertial pose measurement unit 34; for the roll and pitch channels, the feedback from the inertial pose measurement unit 34 is the primary factor, combined with the feedback stroke from the six-DOF Stewart platform 31 to determine whether there is insufficient mechanical reproduction.

[0042] To avoid misjudging sensor noise, delay errors, or insufficient mechanical reproducibility as deviations from the true model, the uncertainty residual observation unit 23 further constructs a residual covariance matrix: in, This indicates the uncertainty of the ROS virtual model. This represents the uncertainty in physical sensing measurements. This indicates the uncertainty in delay estimation (i.e., time alignment uncertainty). This indicates the uncertainty in hardware reproduction for a six-DOF Stewart platform and a single-DOF horizontal turntable.

[0043] The terms in the residual covariance matrix do not need to be fixed and can be adjusted online based on system calibration results, sensor noise levels, current delay estimate fluctuations, and the degree to which the platform approaches the boundary. The closer the platform is to the travel boundary or singular configuration, the greater the uncertainty in hardware reproduction. The larger the value, the more pronounced the fluctuation in the feedback timestamp, and the greater the uncertainty in the delay estimate. The larger.

[0044] Credible consistency evaluation unit 24 normalizes the virtual and real residuals using the residual covariance matrix to obtain consistency statistics: Unlike methods that only compare Euclidean errors, this invention considers the reliability of different state components when calculating consistency statistics. For channels with high noise, residuals of the same size do not necessarily trigger a fault immediately; for channels already labeled as high reliability, smaller but persistent residuals are also retained for subsequent judgment.

[0045] Based on this, the trusted consistency evaluation unit 24 combines the communication validity flag. Valid markers of movement boundaries and feedback valid indicators Calculate the credible consistency coefficient: Where n is the residual dimension. When and When, it is considered that the current feedback can be used for motion allocation in the next cycle; when or If the current feedback is deemed unreliable, the credible consistency assessment module 2 freezes, decays, or clears the residual correction amount.

[0046] Specifically, the credibility consistency coefficient The value range is [0,1], and the closer it is to 1, the more reliable the consistency between virtual and real data; each valid flag takes the value of 0 or 1: when the communication link is normal =1, otherwise =0, when the commands and feedback of each degree of freedom do not exceed the mechanism boundary. =1, otherwise =0, when the feedback data is within the hold window and the timestamp has not been reversed. =1, otherwise =0; when any valid flag is 0 Set it to 0, and use it together with the above threshold gating to determine whether the current feedback is reliable.

[0047] To avoid frequent jumps in the trusted state around the threshold, the trusted consistency evaluation unit 24 can be set with an entry threshold and an exit threshold. If the simulation cycles are below the exit threshold for M1 consecutive cycles or When the statistical threshold is exceeded for M1 consecutive simulation cycles, the system enters an untrusted state; when The simulation recovered to above the threshold after M2 consecutive simulation cycles and When the system returns to normal, it exits the untrusted state.

[0048] In this invention, the residual correction only applies to the hardware motion allocation process in the trustworthy consistency assessment module 2, and does not directly reverse-write the unmanned vessel dynamics model in the ROS digital twin module 1. The residual correction can be updated in a bounded manner as follows: in, Let be the residual correction amount for the k-th period. The attenuation coefficient is... For residual correction gain, This is the amplitude limiting function. In this way, the ROS twin domain maintains model independence, while the bridging domain of the reliable consistency assessment module is responsible for absorbing hardware and synchronization errors.

[0049] When the current period's reliable consistency is insufficient, Instead of accumulating new residual information, the residuals are gradually reduced or cleared to zero according to a preset attenuation coefficient. When trusted consistency is restored, the residual correction amount is reintroduced in a limited manner. This avoids the continuous amplification of error feedback and also prevents hardware instructions from jumping at the moment the trusted state is restored.

[0050] The seven degrees of freedom consist of a six-degree-of-freedom Stewart platform 31 and a single-degree-of-freedom horizontal turntable 32. The longitudinal acceleration is simulated by equivalent tilt reuse of the attitude degrees of freedom of the six-degree-of-freedom Stewart platform and is not counted separately in the degree of freedom.

[0051] like Figure 4 As shown, the seven-DOF constrained motion assignment unit 25 assigns pose commands to the six-DOF Stewart platform. and single-degree-of-freedom horizontal turntable angle commands As a joint decision-making factor, the hardware candidate instructions are solved with the objectives of virtual target reproduction error, hardware instruction smoothing, singular configuration penalty, and motion boundary penalty: During the solution process, the Trusted Consistency Assessment Module 2 first forms the ideal entity pose based on the target pose output by the ROS Digital Twin Module 1, and then superimposes the residual correction amount allowed by the Trusted Consistency Assessment to obtain the expected reproduction target for this week. Subsequently, the seven-DOF constrained motion assignment unit 25 searches for a suitable target within the feasible region. and If the optimization problem has no feasible solution within the time limit, then abandon precise tracing and switch to the safety degradation branch.

[0052] The optimization model satisfies the following constraints: in, This is a mapping function from hardware union instructions to entity poses. To reproduce the error weight matrix, , and represents the weighting coefficient. Wherein, This represents the increment of the current cycle's hardware joint instructions relative to the previous cycle's hardware joint instructions, i.e. .

[0053] The constraints include at least the travel range, velocity range, acceleration range, and attitude angle range of the six-DOF Stewart platform 31, the angular velocity range of the single-DOF horizontal turntable 32, the range of single-cycle command increments, and the hardware enable state. These constraints can be obtained from hardware specifications, calibration data, or safety tests, and are stored as configurable parameters in the Trusted Compliance Assessment Module 2.

[0054] As one embodiment, the above parameters can take the following example ranges, and can be determined according to the specific hardware calibration results: Delay search interval [0, ]middle The timeout can be 50–500 milliseconds; the feedback hold window can be 1–5 simulation cycles; the confidence threshold... It is advisable to select and take the data in conjunction with the consistency statistical threshold. Near-normal values ​​(e.g., 0.1–0.5) are used to coordinate the confidence consistency coefficient gating with the consistency statistic gating; consistency statistic threshold It can be determined according to the 0.90 to 0.99 quantiles of the chi-square distribution of degrees of freedom n; the upper limit of single-cycle instruction increment. The maximum travel of each degree of freedom can be taken as 1% to 10%; the boundary safety margin can be taken as 5% to 15% of the maximum travel; the minimum singularity safety threshold for singularity avoidance can be taken as 10% to 30% of the nominal minimum singularity of the Stewart platform; the residual correction attenuation coefficient β can be taken as 0.80 to 0.98. The above values ​​are only examples and are not intended to limit the scope of protection of this invention.

[0055] In one specific implementation, the real-time implementation of the system can be configured as follows: the simulation cycle of the ROS digital twin module 1 can be 10–100 milliseconds (e.g., 20 milliseconds); the feedback cycle between the six-DOF Stewart platform 31 and the single-DOF horizontal turntable 32 can be 1–10 milliseconds; and the output frequency of the inertial pose measurement unit 34 can be 100–400 Hz. The optimization problem of seven-DOF constrained motion assignment can be solved by mapping the function T(u... kThe problem is linearized at the current working point and, after a second approximation of the penalty term, transformed into a quadratic programming problem with box constraints. It is solved using the effective set method, interior point method, or sequential quadratic programming solver, with the feasible solution from the previous cycle used as the initial value for the current cycle's warm-up. A single-cycle time limit is set for the solution (e.g., 50% of the simulation cycle). If no feasible solution is obtained within the time limit, a safety degradation branch is applied. The components of the residual covariance matrix can be updated online: the uncertainty of the virtual model can be determined based on the sliding window statistical variance of the model calibration residuals; the uncertainty of sensor measurement can be determined based on the nominal noise parameters of the inertial pose measurement unit 34 and the static calibration results; the uncertainty of time alignment can be determined based on the sliding window fluctuation of the feedback delay estimate; and the uncertainty of hardware reproduction can be amplified according to a preset function based on the platform's current travel distance from the boundary and the minimum singular value of the Jacobian matrix.

[0056] The classification criteria for safety degradation can be configured as follows: when the credibility consistency coefficient is lower than the credibility threshold but communication and feedback are still valid, it is judged as a mild anomaly; when the feedback delay estimate reaches the upper limit of the delay search interval or multiple consecutive simulation cycles are located at the interval endpoint, or the six-DOF Stewart platform 31 and the single-DOF horizontal turntable 32 enter the boundary safety margin, it is judged as a moderate anomaly; when the communication validity flag is continuously invalid for more than the holding window, the feedback timestamp goes backward, any degree of freedom exceeds the mechanical travel, or the emergency stop signal is valid, it is judged as a severe anomaly.

[0057] The seven-DOF constrained motion distribution unit 25 distributes heave, roll, pitch, small-range yaw, and tilt disturbances equivalent to virtual longitudinal acceleration to the six-DOF Stewart platform 31, and distributes continuous or large-angle yaw to the single-DOF horizontal turntable 32. For the heave channel, the following can be used: For roll and pitch channels, the following can be used: Furthermore, to simulate the virtual longitudinal acceleration using tilt equivalence, the seven-DOF constrained motion distribution unit 25 approximates the virtual longitudinal acceleration a to be simulated according to the gravity component. x This is converted into a pitch angle, and after being washed out by a high-pass filter and limited, it is superimposed onto the pitch channel, i.e., it makes... in Let g be the virtual longitudinal acceleration to be simulated, g be the gravitational acceleration, and HP(·) be the high-pass shuffling operator used to filter out the continuous tilt component and avoid attitude drift. The pitch angle limiting function is used; the equivalent tilt only reuses the pitch attitude degree of freedom of the Stewart platform and does not count the degree of freedom separately, and its tilt angle is included in the mapping from hardware joint instructions to entity pose. .

[0058] For the bow roll channel, a single-DOF horizontal turntable handles the main continuous bow roll, while a six-DOF Stewart platform handles small-scale rapid disturbances. in, , , , These are the heave, roll, pitch, and heading components of the virtual target's pose, respectively. , , These are the heave, roll, and pitch command components assigned to the six-DOF Stewart platform 31. , , This represents the reproduction gain for the corresponding channel. , , , These are the residual correction amounts. The components on the corresponding channel, and These are the heave and roll limiting functions, respectively. An angle continuity operator; The small-range yaw component undertaken by the Stewart platform 31 can be obtained by taking the high-frequency small-amplitude component of the target heading angle after continuous processing and limiting it. Its allocation weight is continuously adjusted with the change in the target heading and the singular margin of the six-degree-of-freedom Stewart platform 31 to achieve continuous weight transition between the single-degree-of-freedom horizontal turntable 32 and the six-degree-of-freedom Stewart platform 31.

[0059] When assigning tasks to different channels, the reliable consistency assessment module 2 first processes the target heading angle into a continuous form, then assigns the low-frequency, large-amplitude, or continuous rotation components to the single-DOF horizontal turntable 32, while reserving the high-frequency, small-amplitude, or disturbance components coupled with roll and pitch components for the six-DOF Stewart platform 31. This task allocation can reduce the travel consumption caused by the long-term offset of the yaw channel of the six-DOF Stewart platform 31.

[0060] When the target heading change is less than a preset small angle threshold and the six-DOF Stewart platform 31 is far from the singular configuration, the six-DOF Stewart platform 31 can handle part of the yaw disturbance. When the target heading change exceeds the small angle threshold, the single-DOF horizontal turntable 32 is available, and the turntable speed meets the limit, the single-DOF horizontal turntable 32 handles the main heading reproduction. A continuous weight transition is used between the two to avoid significant attitude changes during channel switching.

[0061] When the six-DOF Stewart platform approaches a singular configuration or mechanism boundary, the seven-DOF constrained motion assignment unit 25 increases the weights of the singular configuration penalty term and the motion boundary penalty term, automatically biasing the optimization result towards a single-DOF horizontal turntable or a safer platform posture. The singular configuration penalty term and the motion boundary penalty term can be expressed as: in, For the Stewart platform Jacobian matrix, ε is the smallest singular value, and ε is a positive number to prevent the denominator from being zero.

[0062] The proximity to the boundary can be determined by the distance between the current travel distance and the maximum allowable travel distance, the distance between the current speed and the maximum allowable speed, and the minimum singular value of the Jacobian matrix. When any distance is lower than the preset safety margin, the credible consistency assessment module 2 increases the weight of the corresponding penalty term, so that the optimization result actively moves away from the boundary.

[0063] In practice, the singular configuration penalty term and motion boundary penalty term are not required to replace the safety protection of the underlying driver, but rather serve as an early avoidance mechanism at the level of the trusted consistency assessment module. Even if the underlying driver has not yet triggered the limit protection, the trusted consistency assessment module 2 can reduce the reproduction amplitude or transfer the motion to the single-degree-of-freedom horizontal turntable 32 in advance based on the penalty term.

[0064] The safety degradation unit 26 can be set to multiple states: under normal state, it executes candidate instructions obtained by constraint optimization; under mild anomaly, it limits the instruction increment and freezes the residual correction amount; under moderate anomaly, it makes the six-DOF Stewart platform 31 and the single-DOF horizontal turntable 32 return to the safe neutral position at a preset speed; under severe anomaly or when the emergency stop signal is valid, it stops sending tracking instructions and triggers the underlying emergency stop.

[0065] When communication is interrupted, feedback is abnormal, reliable consistency is insufficient, virtual and real residuals suddenly increase, or the six-DOF Stewart platform or single-DOF horizontal turntable approaches the motion boundary, the safety degradation unit 26 performs deceleration, centering, freezing of residual corrections, or emergency stop operations. The actual transmitted command can be obtained from candidate commands through single-cycle incremental constraints. When the security degradation flag is valid, the Trusted Consistency Assessment Module 2 prioritizes executing security instructions rather than continuing to track the target motion given by the ROS Digital Twin Module 1.

[0066] The security downgrade process simultaneously records the downgrade reason, trigger time, virtual state before and after triggering, entity feedback, hardware commands, and valid flags. These records are used both for operator troubleshooting and for the negative example scenario playback and regression verification unit 27 to determine whether the anomaly needs to be included in the scenario library.

[0067] like Figure 5 As shown, when the reliability consistency coefficient is lower than the threshold, the feedback delay changes abruptly, the sensor feedback fails, the virtual-real residual continues to increase, or the hardware is close to the boundary, the counterexample scenario playback and regression verification unit 27 records the data of the current period and several periods before and after it as counterexample segments: The truncation length of a counterexample segment can include several cycles before the anomaly is triggered, the entire duration of the anomaly, and several cycles after the anomaly is resolved. Each counterexample segment not only saves the original data but also the delay estimate, residuals, reliability consistency coefficient, constraint assignment results, security degradation status, and anomaly classification label.

[0068] Counterexamples are categorized into delay anomalies, sensor anomalies, mechanism boundary anomalies, virtual-real mismatch anomalies, and communication anomalies, and then transformed into ROS scenario parameters, sea state disturbance parameters, target trajectory parameters, or hardware limiting parameters for the next round. In this way, the hardware-in-the-loop simulation system can turn failed operating conditions back into test inputs, forming a traceable, reproducible, and iterative chain of verification evidence.

[0069] When the counterexample fragment is used again in ROS simulation, the ROS digital twin module 1 reconstructs the same working condition according to the scene parameters, target trajectory, sea state disturbance or hardware limiting conditions in the counterexample fragment; the trust consistency assessment module 2 then performs a retest according to the same three-clock synchronization, trust consistency evaluation and seven-degree-of-freedom constraint allocation process, thus forming a closed loop of discovering problems, constructing counterexamples, re-verifying and recording results.

[0070] V. Semi-physical Subsystems and Their Modules The semi-physical module 3 is used to reproduce the motion commands issued by the trusted consistency assessment module 2 into physical motion, and to feed back the physical pose to the trusted consistency assessment module 2. This module includes a hardware configuration and execution module, a low-level driver and security protection unit, an inertial sensing feedback unit, a physical feedback quantity unit, and a hardware joint command quantity unit.

[0071] After receiving the joint hardware instructions, the hardware configuration and execution unit performs heave, roll, pitch, small-range yaw, and tilt reproduction by the six-degree-of-freedom Stewart platform 31, while the single-degree-of-freedom horizontal turntable 32 performs continuous yaw and large-angle rotation reproduction. Together, they bring the unmanned vessel physical model 33 to the physical pose to be reproduced.

[0072] The underlying drive and safety protection unit performs servo tracking on the received pose and angle commands, and sets up limit protection and emergency stop interlocking at the hardware level, independent of the trust consistency assessment module 2. When any degree of freedom exceeds the mechanical stroke, speed exceeds the limit, or an emergency stop signal is valid, the underlying safety protection immediately takes effect, forming a dual protection with the safety degradation unit 26 of the trust consistency assessment module 2.

[0073] The inertial sensor feedback unit measures the roll angle, pitch angle, heading angle and angular velocity of the unmanned vessel physical model 33 in real time by the inertial pose measurement unit 34, and collects the execution status of the six-degree-of-freedom Stewart platform 31 and the single-degree-of-freedom horizontal turntable 32. The physical feedback quantity module packages it into physical feedback and sends it back to the reliable consistency evaluation module 2.

[0074] The entity status reported by the semi-physical module 3 is represented as follows: in, , , These are the roll angle, pitch angle, and heading angle fed back by the inertial attitude measurement unit 34, respectively. For triaxial angular velocity, The status is provided for the six-DOF Stewart platform. This refers to the feedback angle of a single-degree-of-freedom horizontal turntable. The hardware joint instruction is represented as: Six-DOF Stewart platform pose instructions in hardware joint instructions It should include at least the translational and attitude components of the moving platform, and the angle command of the single-degree-of-freedom horizontal turntable. This includes at least the target angle, angular velocity limit, and enable flag. If the underlying driver only accepts control quantities in the form of pulses, strokes, or motor angles, then the protocol isolation interface 21 completes a mapping before transmission, and the seven-degree-of-freedom constraint allocation result is still based on... and As a unified expression.

[0075] After completing a simulation, the Trusted Consistency Assessment Module 2 outputs verification results. These results include at least the target state, entity feedback, delay estimate, virtual and real residuals, trusted consistency coefficient, constraint allocation instructions, safety degradation state, and counterexample segment number for each cycle. The operator can use these verification results to determine whether the current ROS control strategy, sea state scenario, or hardware reproduction conditions meet the requirements for continuing the experiment. Compared to ordinary platform combination schemes, this invention is not a simple connection of ROS simulation, motion platform, sensors, and display interface. Instead, the Trusted Consistency Assessment Module 2 uniformly executes a closed-loop mechanism encompassing three-clock synchronization, delay estimation, uncertainty residual observation, trusted consistency evaluation, seven-DOF constraint motion allocation, safety degradation, and counterexample playback.

[0076] Without departing from the concept of this invention, the ROS digital twin module 1 can be replaced with other simulation systems capable of outputting the target state of the unmanned vessel, the six-DOF Stewart platform 31 can be replaced with a motion platform with equivalent pose reproduction capability, and the inertial pose measurement unit 34 can be replaced with other attitude measurement devices; as long as the aforementioned reliable consistency constraint process is still executed between the virtual domain and the physical domain by the reliable consistency evaluation module 2, it is an alternative implementation of this invention.

[0077] The above embodiments are merely exemplary embodiments of the present invention and are not intended to limit the present invention. Those skilled in the art can make various modifications or equivalent substitutions to the present invention within its scope and spirit, and such modifications or equivalent substitutions should also be considered to fall within the scope of protection of the present invention.

Claims

1. A seven-DOF digital twin hardware-in-the-loop simulation system for unmanned surface vessels, characterized in that, It includes a digital twin module, a trustworthy consistency assessment module, and a semi-physical module. The digital twin module is used to generate the virtual unmanned vessel target state, virtual sea state disturbance, and simulated task state. The semi-physical module is used to reproduce motion commands into physical motion and feed back the physical pose. It includes a six-degree-of-freedom platform, a single-degree-of-freedom horizontal turntable, and an unmanned vessel physical model assembled from bottom to top in a stacked manner. The unmanned vessel physical model is equipped with an attitude measurement unit. The trusted consistency assessment module is located between the digital twin module and the semi-physical module. It is used to align the physical pose time feedback from the semi-physical module to the simulation clock of the digital twin module, construct virtual and real residuals with covariance description for the virtual pose of the digital twin module and the time-aligned physical feedback pose, and perform trusted consistency gating. Motion commands are generated and issued only after the trusted consistency gating is passed. The trusted consistency assessment module includes a time alignment unit, an uncertainty residual observation unit, a trusted consistency evaluation unit, a seven-degree-of-freedom constrained motion allocation unit, a security degradation unit, and a counterexample scenario playback and regression verification unit. The time alignment unit is used to align the physical feedback pose of the semi-physical module to the simulation clock of the digital twin module; the uncertainty residual observation unit is used to form virtual and real residuals with covariance description after time alignment; The trusted consistency evaluation unit is used to generate trusted consistency coefficients based on virtual and real residuals, residual covariance, and validity indicators, perform trusted consistency gating, and update residual correction quantities accordingly; the seven-degree-of-freedom constrained motion allocation unit is used to solve and generate six-degree-of-freedom platform pose commands and single-degree-of-freedom horizontal turntable angle commands when trusted consistency gating is passed; the safety degradation unit is used to perform multi-level safety degradation when trusted consistency gating fails; the counterexample scenario playback and regression verification unit is used to record working conditions with insufficient trusted consistency as counterexample segments, write them into the scenario library, and reconstruct similar working conditions for re-simulation and retesting. The uncertainty residual observation unit uses the difference between the virtual pose and the time-aligned entity feedback pose as the virtual-real residual. : ； The uncertainties of the virtual model, sensor measurement, time alignment, and hardware reproduction are integrated into a residual covariance matrix. : ; in, For virtual pose, These are the time-aligned entity pose estimates. For the simulated clock time of the digital twin module, This is the estimated feedback delay. , , , These are the covariance components corresponding to virtual model uncertainty, sensor measurement uncertainty, time alignment uncertainty, and hardware reproduction uncertainty, respectively. The trusted consistency evaluation unit uses the residual covariance matrix to normalize the virtual and real residuals to obtain the consistency statistic. : ; Combined with communication validity flags Valid markers of movement boundaries and feedback valid indicators Generate a reliable consistency coefficient : ; in, For the difference between the real and virtual, Let n be the residual covariance matrix, and n be the residual dimension. The value can be 0 or 1. The value range is [0,1]; The credible consistency evaluation unit performs a bounded update on the residual correction using the following formula: ; in The attenuation coefficient is... For residual correction gain, For The upper bound function of the amplitude, This represents the upper limit of the residual correction magnitude. This is the residual correction amount for the k-th simulation cycle. This is the residual correction amount for the (k-1)th simulation cycle; the residual correction amount only applies to the seven-degree-of-freedom constrained motion allocation process, and does not reverse-write the dynamic model of the digital twin module. For the difference between the real and virtual, This is the reliability and consistency coefficient.

2. The unmanned vessel seven-DOF digital twin semi-physical simulation system according to claim 1, characterized in that, The trusted consistency evaluation unit performs trusted consistency gating according to the following criteria: when and When deemed reliable, the virtual and real residuals are allowed to enter the seven-degree-of-freedom constrained motion assignment; when or If the system is deemed untrustworthy, the residual correction amount is frozen, attenuated, or cleared to zero, and the security degradation unit is triggered; wherein, To preset a confidence threshold, To preset a consistency statistical threshold; the trusted consistency evaluation unit also sets an entry threshold and an exit threshold, when the trusted consistency coefficient is continuously... When the number of simulation cycles falls below the exit threshold, the system enters an untrusted state. When the trust consistency coefficient is continuously... When the simulation cycle recovers to above the threshold, it exits the untrusted state to suppress frequent jumps in the trusted state near the threshold.

3. The unmanned surface vessel seven-DOF digital twin hardware-in-the-loop simulation system according to claim 1, characterized in that, The seven-degree-of-freedom constrained motion allocation unit uses the heave, roll, pitch, small-range yaw of the six-degree-of-freedom platform, the equivalent tilt component used to simulate longitudinal acceleration by tilting, and the continuous yaw of the single-degree-of-freedom horizontal turntable as joint decision quantities; the seven-degree-of-freedom constrained motion allocation unit solves for the hardware candidate instructions using the following formula: ; And satisfy constraints ,in To achieve the optimal control quantity that minimizes the weighted squared error; These are candidate instructions for the k-th simulation cycle. This is a mapping function from hardware union instructions to entity poses. Let W be the six-DOF pose vector of the virtual unmanned surface vessel in the k-th simulation cycle. t To reproduce the error weight matrix, , , These are the weighting coefficients. and These are the singular configuration penalty term and the motion boundary penalty term, respectively. For consistency statistics, The reliability and consistency coefficient. and These are the consistency statistics threshold and the confidence threshold, respectively. This is the residual correction amount for the k-th simulation cycle; and These are the lower and upper bounds for each component of the hardware union instruction, respectively. For single-cycle instruction increments, , This refers to the actual command sent during the (k-1)th simulation cycle. This refers to the actual command sent during the k-th simulation cycle. This represents the upper limit of instruction increment per cycle.

4. The unmanned surface vessel seven-DOF digital twin hardware-in-the-loop simulation system according to claim 3, characterized in that, The singular configuration penalty term is specifically as follows: ; The motion boundary penalty term is specifically as follows: ; in, For a six-degree-of-freedom platform, the Jacobian matrix is... Its minimum singular value, To prevent positive numbers with a denominator of zero, j is a hardware union instruction. The component index, where j∈{1,2,…,7}, For the j-th component of the hardware joint instruction in the k-th simulation cycle, These are the allowed lower bound and allowed upper bound for the component, respectively.

5. The unmanned surface vessel seven-DOF digital twin hardware-in-the-loop simulation system according to claim 1, characterized in that, The safety degradation unit is configured with multiple degradation states: Under normal conditions, candidate instructions obtained through constraint optimization are executed; under mild anomalies, the single-cycle instruction increment is limited and the residual correction is frozen; under moderate anomalies, the six-degree-of-freedom platform and the single-degree-of-freedom horizontal turntable are controlled to return to the safe neutral position at a preset speed; under severe anomalies or when an emergency stop signal is valid, the transmission of tracking instructions is stopped and a bottom-level emergency stop is triggered; wherein the actual transmitted instructions are obtained from the candidate instructions through single-cycle increment limitation. ; in, This is a candidate instruction for the k-th simulation cycle. This refers to the actual command sent during the (k-1)th simulation cycle. This refers to the actual command sent during the k-th simulation cycle. This represents the upper limit of instruction increment per cycle.

6. The unmanned surface vessel seven-DOF digital twin hardware-in-the-loop simulation system according to claim 1, characterized in that, The counterexample scenario playback and regression verification unit records the data of the current period and several periods before and after it as counterexample segments when the credibility consistency coefficient is lower than the preset credibility threshold, the virtual-real residual continues to increase, the feedback delay suddenly changes, the sensor feedback fails, or the six-degree-of-freedom platform and the single-degree-of-freedom horizontal turntable approach the motion boundary. And write it into the scene library: ; in, For the difference between the real and virtual, The residual covariance matrix is... The reliability and consistency coefficient. These are candidate instructions for the k-th simulation cycle. This is the estimated feedback delay. These are the communication validity flag, the motion boundary validity flag, and the feedback validity flag, respectively. Let be the virtual sea state disturbance vector for the kth simulation cycle. The target trajectory reference vector for the kth simulation cycle is used. The counterexample segments are classified into delay anomalies, sensing anomalies, mechanism boundary anomalies, virtual-real mismatch anomalies, and communication anomalies. These classifications serve as the basis for generating the next round of simulation scenario parameters, sea state disturbance parameters, target trajectory parameters, and hardware limiting parameters, thereby reconstructing similar working conditions for re-simulation and retesting.

7. A method for seven-DOF digital twin semi-physical simulation of an unmanned surface vessel, characterized in that, The unmanned vessel seven-degree-of-freedom digital twin semi-physical simulation system according to any one of claims 1-6 specifically includes the following steps in each simulation cycle: Step 1: The trusted consistency assessment module obtains the virtual pose of the digital twin module and the entity feedback of the semi-physical module, and aligns the entity feedback poses in time. Step 2: Calculate the virtual and real residuals based on the virtual pose and the time-aligned entity pose. And it integrates multi-source uncertainties into a residual covariance matrix. ; Step 3, Calculate the consistency statistic With the credibility consistency coefficient , and according to and Perform trusted consistency gating, where For the confidence threshold, This is the consistency statistical threshold; Step 4: When the gate passes, the seven-degree-of-freedom constrained motion allocation unit generates a six-degree-of-freedom platform pose command and a single-degree-of-freedom horizontal turntable angle command and sends them to the hardware module. Step 5: When the gate fails, perform a safety downgrade and record the failed gate conditions as exceptions after classifying them by abnormality category. Step 6: Write the counterexample fragments into the scenario library, and use the digital twin module to reconstruct similar working conditions for re-simulation and retesting.

Images