A method, system, device and medium for unmanned aerial vehicle ground station operation instruction arbitration

Abstract

The application discloses a kind of unmanned plane ground station operation instruction arbitration method, system, equipment and medium, it is related to unmanned plane ground control and flight safety technical field.The method includes: obtaining the current task context of unmanned plane and operator interactive data, determines candidate operation intention before instruction enters uplink channel;Risk state model containing node risk value and risk correlation weight is constructed;Based on the same task state snapshot, build double prediction branch, candidate operation intention and safety baseline strategy are respectively input into model as operation intervention, and the risk trajectory in future time window is deduced;According to the difference of two-branch comprehensive risk value, operation risk increment is calculated and operation arbitration level is determined according to the uncertainty degree, and then the ground station interface control, confirmation process and instruction channel state are controlled in stages.The present application realizes risk pre-arbitration and channel cascade control before instruction issuing, which significantly improves flight safety.

Description

Technical Field

[0001] This invention relates to the field of UAV ground control and flight safety technology, specifically to a method, system, device, and medium for arbitrating UAV ground station operation commands. Background Technology

[0002] The UAV ground control station is mainly used for mission planning, flight monitoring, status display, and command control. In scenarios such as low battery return-to-home, degraded link quality, approaching restricted areas, abnormal positioning, or unstable attitude, operator actions such as canceling the return-to-home, switching flight modes, uploading new flight paths, and disabling safety protections may alter the subsequent state of the UAV and amplify mission risks.

[0003] Existing ground control stations can typically issue alerts for events such as low battery, weak link, abnormal positioning, abnormal attitude, and airspace incursions. They can also set secondary confirmation, permission verification, or fixed threshold restrictions for some high-risk operations. Additionally, UAV operation risk prediction solutions can calculate overall risk based on operating parameters, scene information, and flight control information, and issue warnings or trigger mitigation measures such as route replanning, return to home, or landing when the risk reaches a threshold.

[0004] However, the above solution still has the following shortcomings: 1. Most solutions are based on the current state, a single alarm threshold, or an overall risk assessment, making it difficult to determine how much a certain pending operation instruction will increase the risk of future tasks; 2. The granularity of alarm prompts, secondary confirmations, permission verifications, remote control cutoffs, or safety action takeovers is too coarse, making it difficult to distinguish between low-risk accidental activations, operations with emergency avoidance value, and high-risk operations that should be blocked. 3. There is a lack of unified linkage between risk assessment, interface alarms and command issuance channels, and high-risk commands may still bypass interface prompts and enter the uplink channel; 4. Some risk prediction schemes lack explanation and degradation mechanisms, making it difficult to meet the reliability and traceability requirements of security control scenarios when input is missing, model confidence is low, link is abnormal, or computing power is insufficient. Summary of the Invention

[0005] The purpose of this invention is to address the current problems of UAV ground stations, such as difficulty in assessing risk changes before operation commands enter the uplink channel, single alarm thresholds, coarse control granularity, and lack of linkage between interface and channel. This invention provides a method, system, device, and medium for arbitrating operation commands for UAV ground stations. Based on dual-prediction branch deduction of candidate operation intentions and safety baseline strategies, it calculates and extracts the pure operation risk increment, realizing pre-arbitration of high-risk operations before the actual issuance of commands, as well as physical and logical hierarchical control over interface control status, operation confirmation process, and command issuance channel.

[0006] The technical solution of the present invention is as follows: A method for arbitrating unmanned aerial vehicle (UAV) ground station operation commands includes: Step S1: Obtain the current mission context data of the UAV and the interaction data with the ground station operator; Step S2: Before the operation command enters the uplink command channel, determine the candidate operation intention based on the ground station operator interaction data; Step S3: Based on the task context data and the candidate operation intention, construct or update the risk status model corresponding to the current task. The risk status model includes risk nodes and the associated edges between the risk nodes, and is configured with node risk values ​​and risk association weights. The risk status model is used to characterize the risk association relationship between task status, flight status, energy status, link status, environmental constraints, alarm events, operation intentions and command channel status. Step S4: Based on the current task context, determine the security baseline policy corresponding to the current task state from the security baseline policy library; Step S5: Construct a first prediction branch and a second prediction branch based on the same task state snapshot, wherein the first prediction branch corresponds to executing the candidate operation intent, and the second prediction branch corresponds to executing the security baseline policy; Step S6: Input the candidate operation intention and the safety baseline policy as corresponding operation intervention inputs into the risk state model, and combine the node risk value and the risk association weight in the risk state model to predict the risk trajectory of the first prediction branch and the second prediction branch in the future time window respectively. Step S7: Calculate the operational risk increment corresponding to the candidate operational intent based on the difference in comprehensive risk values ​​between the first and second prediction branches within the future time window, the time of risk occurrence, and the uncertainty of risk projection; Step S8: Determine the operation arbitration level based on the operation risk increment and the current task risk status; Step S9: Based on the operation arbitration level, perform hierarchical control on at least two of the following: the status of the ground station interface controls, the operation confirmation process, and the status of the instruction issuance channel.

[0007] Further, in step S3, constructing or updating the risk state model corresponding to the current task includes: The task context data, including the task phase, flight status, energy status, link status, environmental constraints, alarm events, and command channel status, as well as at least a portion of the candidate operation intentions, security baseline policies, and preset risk barriers, are mapped to the risk nodes. Based on at least one of the following relationships: state influence relationship, alarm trigger relationship, operation influence relationship, risk suppression relationship, and latency influence relationship, establish the associated edges between the risk nodes.

[0008] Further, the operational intervention input includes candidate operational intent intervention input in the first prediction branch and safety baseline policy intervention input in the second prediction branch; step S6 includes: The set of affected nodes is determined based on the instruction type and instruction parameters of the candidate operation intention, and the candidate operation intention is used as the intervention input to the set of affected nodes. The security baseline policy is used as the security baseline policy intervention input and applied to the corresponding set of affected nodes. For any risk node in the risk state model, the node risk value of the risk node at the next prediction time is updated based on the current node risk value of the risk node, the node risk values ​​of other risk nodes that are related to the risk node, the risk association weight, and the operation intervention input, so as to obtain the risk trajectory within the future time window.

[0009] Further, in step S7, calculating the operational risk increment corresponding to the candidate operational intent includes: Calculate the combined risk value of the first prediction branch and the second prediction branch within a future time window. The combined risk value is determined based on the node importance, node risk consequence severity, and node risk value at the prediction time of the risk state model in the corresponding branch. Based on the portion of the comprehensive risk value of the first prediction branch that is higher than the comprehensive risk value of the second prediction branch, and combined with the time discount factor, the risk trajectory difference is calculated. The risk projection uncertainty is determined based on at least one of the following: the proportion of missing task context data, the historical prediction error of the model, the degree of link status fluctuation, and the difference between the projection results of different models. The risk trajectory difference is corrected based on the uncertainty of the risk projection to obtain the operational risk increment corresponding to the candidate operational intention.

[0010] Further, determining the operational arbitration level in step S8 includes: Determine whether the current task status triggers a hard rule. The hard rule includes at least one of the following: the remaining power is lower than the minimum safe power corresponding to the current task stage; the candidate operation intention will cause the route to enter restricted airspace or break through the geofence; the link quality is lower than the command security issuance requirements; the candidate operation intention is used to disable the security protection that must be enabled in the current task stage. If the hard rule is not triggered, the operation arbitration level will be determined as release, prompt, strong confirmation or restricted issuance according to the preset threshold range to which the operation risk increment belongs. If the hard rule is triggered, or if the increase in operational risk exceeds the highest preset threshold, the operational arbitration level will be determined as blocking.

[0011] Furthermore, step S9 involves hierarchical control of the command issuance channel status, including: The operation instructions to be issued are packaged into an instruction envelope, which includes at least some of the following: instruction content, instruction parameters, risk simulation identifier, operation arbitration level, validity period, and issuance mode. The instruction envelope is subjected to a condition verification at the instruction channel layer. The condition verification includes at least one of the following: verifying whether the risk simulation identifier corresponds to the current operation instruction to be issued, whether the operation arbitration level allows the current issuance mode, whether the validity period has expired, and whether the deviation between the current task status and the task status during the simulation exceeds a preset threshold. If the verification passes, the operation instruction to be sent is sent according to the corresponding sending mode; if the verification fails, the operation instruction to be sent is blocked.

[0012] Furthermore, it also includes: When critical task context data is missing, the confidence level of risk trajectory prediction is lower than the preset threshold, the simulation results are abnormal, computing resources are insufficient, or the link status is lower than the preset requirements, switch to the degraded arbitration mode. In the downgraded arbitration mode, unnecessary high-risk operation commands are restricted, and one or more of hovering, return to home, landing, link reconnection, and alarm confirmation are retained as the minimum set of safe actions.

[0013] This invention also proposes an unmanned aerial vehicle (UAV) ground station operation command arbitration system to implement the aforementioned UAV ground station operation command arbitration method, comprising: The status access module is used to acquire the current mission context data of the UAV and the interaction data of the ground station operator; The operation intent capture module is used to determine candidate operation intents based on the ground station operator interaction data before the operation command enters the uplink command channel; The risk state model construction module is used to construct or update the risk state model corresponding to the current task based on the task context data and the candidate operation intention. The risk state model includes risk nodes and the associated edges between the risk nodes, and is configured with node risk values ​​and risk association weights. The risk state model is used to characterize the risk association relationship between task state, flight state, energy state, link state, environmental constraints, alarm events, operation intentions and command channel state. The security baseline selection module is used to determine the security baseline policy corresponding to the current task state from the security baseline policy library based on the current task context. The dual-branch inference module is used to construct a first prediction branch and a second prediction branch based on the same task state snapshot. The candidate operation intention and the safety baseline strategy are respectively used as corresponding operation intervention inputs and input into the risk state model. The module combines the node risk value and the risk association weight in the risk state model to predict the risk trajectory of the first prediction branch and the second prediction branch in the future time window. The risk increment calculation module is used to calculate the operational risk increment corresponding to the candidate operational intention based on the difference in comprehensive risk values ​​between the first prediction branch and the second prediction branch within a future time window, the time of risk occurrence, and the uncertainty of risk projection. The tiered arbitration module is used to determine the operation arbitration level based on the operational risk increment and the current task risk status; The command channel control module is used to perform hierarchical control on at least two of the following: the status of the ground station interface controls, the operation confirmation process, and the status of the command issuance channel, based on the operation arbitration level.

[0014] The present invention also proposes an electronic device, comprising: At least one processor; and a memory communicatively connected to said at least one processor; The memory stores instructions that can be executed by the at least one processor, and the at least one processor executes the instructions stored in the memory to perform the method described above.

[0015] The present invention also proposes a computer-readable storage medium for storing instructions that, when executed, cause the method described above to be implemented.

[0016] Compared with existing technologies, the advantages of this invention are: 1. Achieve true pre-arbitration. Risk assessment is completed before the actual issuance of the instruction (before entering the uplink channel), effectively solving the lag problem caused by existing technologies that rely solely on post-event alarms or fixed threshold interception, thus nipping risks in the bud before the instruction is issued.

[0017] 2. More accurate risk assessment. By using a "dual-branch parallel comparison and deduction" of candidate operational intentions and safety baseline strategies, the interfering factors caused by the deterioration of the environment itself are cleverly eliminated, and the true "incremental operational risk" brought about by the operation itself in different task contexts of the same operation is accurately distinguished.

[0018] 3. Hardware and software linkage constraints. The arbitration result is applied synchronously to the front-end interface controls, confirmation process, and back-end command issuance channel. This allows the risk assessment result to directly constrain command flow, issuance after prompting, strong confirmation, restricted issuance, or blocking at the channel layer, completely eliminating the possibility of malicious or erroneous command issuance by bypassing interface prompts.

[0019] 4. Enhance system robustness and continuity. By introducing command envelopes, degradation arbitration, and alternative operation generation mechanisms, the system significantly improves parameter consistency during command issuance, robustness against system crashes under extreme conditions, and traceability of accident responsibility, while maximizing mission continuity while adhering to safety standards. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0021] Figure 1 This is a schematic diagram of the structure of the UAV ground station operation command arbitration system provided in an embodiment of the present invention; Figure 2 A flowchart illustrating the UAV ground station operation command arbitration method provided in an embodiment of the present invention; Figure 3 A schematic diagram of a two-branch risk extrapolation based on candidate operation intentions and a security baseline strategy provided for an embodiment of the present invention; Figure 4 This is a schematic diagram of hierarchical arbitration for the instruction issuance channel provided in an embodiment of the present invention. Detailed Implementation

[0022] The features and performance of the present invention will be further described in detail below with reference to embodiments.

[0023] Example 1 This embodiment provides a method for arbitrating unmanned aerial vehicle (UAV) ground station operation commands. This method can be applied to applications such as... Figure 1 In the UAV ground station operation command arbitration system shown, the system architecture provides underlying data acquisition, model computing power, and channel control hardware support for the method of this embodiment. For example... Figure 2 The diagram shown is a flowchart illustrating the UAV ground station operation command arbitration method provided in this embodiment. The method specifically includes the following steps: Step S1: Obtain the current mission context data of the UAV and the interaction data with the ground station operator; As a preferred implementation, the UAV ground station can obtain the aforementioned mission context data in real time or near real time from the flight control system, mission management module, link management module, alarm management module, map and airspace management module, and payload management module.

[0024] The mission context data specifically includes: mission phase (such as takeoff, flight path, target operation, return, landing, or emergency response status), flight status (such as position, altitude, speed, attitude, and track deviation), energy status (such as remaining battery power, remaining flight time, energy margin required for return and diversion), link status (such as remote control link strength, C2 link latency, packet loss rate, image transmission delay, and primary / backup link status), environmental constraints (such as no-fly zones, restricted flight zones, obstacles, terrain, wind speed and direction, and densely populated areas), alarm events, and command channel status.

[0025] Step S2: Before the operation command enters the uplink command channel, determine the candidate operation intention based on the ground station operator interaction data; In this embodiment, the ground station monitors the operator's interactive behavior on interface controls, keyboard, mouse, touch screen, gamepad, voice input device, or other input devices. These interactive behaviors include, but are not limited to, control clicking, control focusing, mouse hovering, menu entry, waypoint dragging, route editing, parameter modification, joystick pre-positioning, shortcut key input, and voice commands.

[0026] When the interaction behavior points to an operation that may change the UAV's flight status, mission path, safety protection status, or command channel status, the ground station generates candidate operation intentions (such as: cancel return to home, switch flight mode, upload route, modify waypoint, change flight altitude, turn off obstacle avoidance or geofence protection, clear alarm, payload control, link switching, and emergency takeover, etc.).

[0027] To achieve proactive arbitration, for explicit operations (such as directly clicking a control), the ground station directly generates corresponding candidate operation intentions; for implicit operations (such as an operator focusing on a high-risk control for an extended period or repeatedly entering advanced control menus), the ground station combines historical operation sequences, control access paths, and parameter modification behaviors to predict candidate operation intentions using an intent recognition algorithm. This proactive interception mechanism fundamentally solves the problem of the delayed nature of existing technologies that rely solely on post-event alerts, leading to risks already occurring.

[0028] Step S3: Based on the task context data and the candidate operation intention, construct or update the risk status model corresponding to the current task. The risk status model includes risk nodes and the associated edges between the risk nodes, and is configured with node risk values ​​and risk association weights. The risk status model is used to characterize the risk association relationship between task status, flight status, energy status, link status, environmental constraints, alarm events, operation intentions and command channel status. Specifically, the step S3 of constructing or updating the risk status model corresponding to the current task includes: The task context data, including the task phase, flight status, energy status, link status, environmental constraints, alarm events, and command channel status, as well as at least a portion of the candidate operation intentions, security baseline policies, and preset risk barriers, are mapped to the risk nodes. Based on at least one of the following relationships: state influence relationship, alarm trigger relationship, operation influence relationship, risk suppression relationship, and latency influence relationship, establish the associated edges between the risk nodes.

[0029] In this embodiment, the risk state model can be visualized as a task context risk graph. Risk nodes represent risk factors in the current task, and risk-related edges represent the influence relationships between risk factors. For example, a low battery node can affect the return margin node, a weak link node can affect the manual takeover reliability node, and an obstacle avoidance protection node can suppress the risk of obstacle collision.

[0030] To facilitate unified calculations in subsequent models, the node risk value of each risk node is normalized to the range [0,1] (0 represents extremely low risk, and 1 represents extremely high risk). The specific normalization calculation method is as follows: For power risk nodes, the determination is based on the current remaining power and the safe power threshold corresponding to the current task stage:

[0031] in: express The current battery risk value; This indicates the safe power threshold corresponding to the current task stage; express The drone's remaining battery power at any time; This means that the calculation result will be restricted to the interval [0,1].

[0032] For the risk point of return margin:

[0033] in: express The risk value of the return margin at any given moment; This indicates the energy required for the drone to return from its current location.

[0034] For risky nodes on the link:

[0035] in: express Link risk value at any given time; and These are the weighting coefficients; Indicates the current link latency; Indicates the current link packet loss rate Indicates the maximum allowable link delay; This indicates the maximum allowed packet loss rate.

[0036] For nodes with restricted airspace risks:

[0037] in: express Time-limited airspace risk value; Indicates the preset safe distance; This indicates the distance from the drone's current location to the restricted airspace boundary.

[0038] For route deviation risk points:

[0039] in: express The risk value of flight path deviation at any given time; Indicates the current flight path deviation; This indicates the maximum permissible deviation from the flight path.

[0040] Based on the above model construction logic, those skilled in the art can reasonably deduce the normalization methods for other nodes such as attitude stability and positioning reliability, which will not be elaborated here.

[0041] Step S4: Based on the current task context, determine the security baseline policy corresponding to the current task state from the security baseline policy library; The safety baseline policy does not simply mean "do not perform any operation," but rather refers to a relatively safe and executable reference action under the current task state, serving as a benchmark for comparing candidate operational intentions. The system first filters executable safety baseline policies under the current state, and then selects one as the intervention input for the second prediction branch based on the predicted risk, task objective compatibility, and safety threshold corresponding to each safety baseline policy.

[0042] For example, according to the baseline strategy selection rules: when the battery level is below the safety margin and the return path is reachable, the priority strategy is "return home"; when the battery level is below the safety margin and the return path is not reachable, the strategy is "land at the nearest location"; when approaching an obstacle or triggering an obstacle avoidance alarm, the strategy is "climb to avoid obstacles or stop moving forward"; when the positioning is abnormal but the attitude and link are stable, the strategy is "hover or return home at low speed".

[0043] Step S5: Construct a first prediction branch and a second prediction branch based on the same task state snapshot, wherein the first prediction branch corresponds to executing the candidate operation intent, and the second prediction branch corresponds to executing the security baseline policy; like Figure 3 The diagram illustrates a two-branch risk extrapolation based on candidate operational intentions and a safety baseline strategy. The two branches share identical initial physical and task states (i.e., the same task state snapshot), differing only in the applied intervention input. By constructing a "parallel universe"-like two-branch system, this invention cleverly isolates uncontrollable environmental factors, enabling a quantitative assessment of the pure risk increment brought about by a single operational intention.

[0044] Step S6: Input the candidate operation intention and the safety baseline policy as corresponding operation intervention inputs into the risk state model, and combine the node risk value and the risk association weight in the risk state model to predict the risk trajectory of the first prediction branch and the second prediction branch in the future time window respectively. Specifically, the operational intervention input includes candidate operational intent intervention input in the first prediction branch and safety baseline policy intervention input in the second prediction branch; step S6 includes: The set of affected nodes is determined based on the instruction type and instruction parameters of the candidate operation intention, and the candidate operation intention is used as the intervention input to the set of affected nodes. For example, if the candidate operation intent is to cancel the return trip, the set of nodes affected may include mission phase nodes, return trip margin nodes, remaining range nodes, energy risk nodes, and continue mission nodes; if it is to switch to manual mode, the set of nodes affected may include flight mode, link risk, manual takeover reliability, and attitude stability nodes.

[0045] The security baseline policy is used as the security baseline policy intervention input and applied to the corresponding set of affected nodes. For any risk node in the risk state model, the node risk value of the risk node at the next prediction time is updated based on the current node risk value of the risk node, the node risk values ​​of other risk nodes that are related to the risk node, the risk association weight, and the operation intervention input, so as to obtain the risk trajectory within the future time window.

[0046] At the underlying algorithm implementation level, the evolution prediction of node states can be performed using the following iterative formula:

[0047] in: Represents a node exist Risk value at any given moment; Represents nodes Nodes with risk-related relationships exist Risk value at any given moment; Represents a node For nodes Risk propagation weight; Represents a node Self-risk maintenance coefficient; Indicates operational intent or security baseline policy for nodes Intervention input; Indicates intervention input to nodes Influence weight; Indicates the bias term; The normalization function can be either the sigmoid function or the clip function.

[0048] In addition to the iterative formulas mentioned above, the risk simulation can also employ one or more of the following: weighted risk propagation model, causal graph model, Bayesian network model, time series prediction model, graph neural network model, state-space model, or lightweight simulation model.

[0049] The size of the future time window is not fixed but can be dynamically adjusted based on the current machine status. Specifically, the time span and step size can be determined based on the mission stage, drone speed, link latency, energy margin, or operation type. The risk trajectory described here can be represented as a single sequence of overall mission risk changing over time, or as a multidimensional matrix or sequence of risk value changes at multiple risk nodes within the future time window.

[0050] In one implementation, to balance computing power and accuracy, the ground station first uses a local risk state model for rapid simulation to obtain a preliminary risk trajectory; then, it uses a complete risk state model or high-precision simulation to correct the trajectory, and the correction results are used to update the edge weights, thresholds, or risk propagation parameters in subsequent arbitration. The difference between the rapid simulation and the corrected simulation results can also serve as the basis for calculating the "risk simulation uncertainty U" in subsequent steps.

[0051] Step S7: Calculate the operational risk increment corresponding to the candidate operational intent based on the difference in comprehensive risk values ​​between the first and second prediction branches within the future time window, the time of risk occurrence, and the uncertainty of risk projection; Calculate the combined risk value of the first prediction branch and the second prediction branch within a future time window. The combined risk value is determined based on the node importance, node risk consequence severity, and node risk value at the prediction time of the risk state model in the corresponding branch. For any prediction branch , its in The overall risk value at any given time is calculated as follows:

[0052] in: Indicates the prediction branch exist The overall risk value at any given moment; Indicates risk nodes Importance in the current task; Indicates risk nodes The severity of the corresponding risk consequences; Indicates the prediction branch Middle node exist Risk value at any given moment.

[0053] Furthermore, based on the portion of the comprehensive risk value of the first prediction branch that is higher than the comprehensive risk value of the second prediction branch, and in conjunction with the time discount factor, the risk trajectory difference is calculated; The risk projection uncertainty is determined based on at least one of the following: the proportion of missing task context data, the historical prediction error of the model, the degree of link status fluctuation, and the difference between the projection results of different models. The risk trajectory difference is corrected based on the uncertainty of the risk projection to obtain the operational risk increment corresponding to the candidate operational intention.

[0054] Increased operational risk The complete fusion calculation formula is as follows:

[0055] in: Indicates the time discount factor; The first prediction branch is in The overall risk value at any given moment; The second prediction branch is in The overall risk value at any given moment; Indicates the uncertainty weight; This represents the uncertainty in risk simulation; it can be determined based on the proportion of missing input data, historical prediction errors of the model, link status stability, or the difference between the simulation results of two models. For example, when critical task context data is missing, link status fluctuates significantly, or the rapid simulation results differ greatly from the corrected simulation results, the uncertainty is increased. This has led to a more conservative approach to arbitration.

[0056] Overall initial risk status of the current task This can be expressed as: .

[0057] Step S8: Determine the operation arbitration level based on the operation risk increment and the current task risk status; Specifically, step S8 includes: determining whether the current task status triggers a hard rule, wherein the hard rule includes at least one of the following: the remaining battery power is lower than the minimum safe battery power corresponding to the current task stage; the candidate operation intention will cause the flight path to enter restricted airspace or break through the geofence; the link quality is lower than the command security issuance requirements; the candidate operation intention is used to disable the safety protection that must be enabled in the current task stage; a serious flight control alarm has not been cleared; the command channel status is abnormal and the risk simulation identifier or arbitration level verification cannot be completed; the validity period of the pending command has expired, or the deviation between the current task status and the task status during risk simulation exceeds a threshold.

[0058] If the hard rule is not triggered, the operation arbitration level will be determined as allow, prompt, strong confirmation, or restricted issuance according to the preset threshold range to which the operation risk increment belongs; if the hard rule is triggered, or the operation risk increment is higher than the highest preset threshold, the operation arbitration level will be determined as block.

[0059] The preset threshold ranges used to determine the level (such as incremental thresholds, low-risk task thresholds, uncertainty thresholds, etc.) can be dynamically determined based on the type of UAV, task type, flight stage, historical task data, or manual configuration.

[0060] As a special scenario exemption mechanism, if the candidate operation intention can reduce the current risk (e.g., performing climb obstacle avoidance or emergency return under dangerous proximity conditions), (If the risk is negative), the ground station can directly lower the arbitration level; in addition, when the operational risk increases... If the risk level is high, but the candidate operation intent has emergency avoidance value, and the safety baseline strategy cannot reduce the immediate risk in time, the system can downgrade the arbitration level from L4 blocking to L3 restricted issuance.

[0061] Step S9: Based on the operation arbitration level, perform hierarchical control on at least two of the following: the status of the ground station interface controls, the operation confirmation process, and the status of the instruction issuance channel.

[0062] Specifically, step S9 involves hierarchical control of the instruction delivery channel status, including: encapsulating the operation instruction to be delivered into an instruction envelope, wherein the instruction envelope includes at least some of the following: instruction content, instruction parameters, risk simulation identifier, operation arbitration level, validity period, and delivery mode. The instruction envelope is subjected to a delivery condition verification at the instruction channel layer. The delivery condition verification includes at least one of the following: verifying whether the risk simulation identifier corresponds to the current operation instruction to be delivered, whether the operation arbitration level allows the current delivery mode, whether the validity period has expired, and whether the deviation between the current task status and the task status during the simulation exceeds a preset threshold. If the verification passes, the operation instruction to be delivered is sent according to the corresponding delivery mode. If the verification fails, the operation instruction to be delivered is blocked.

[0063] Regarding specific front-end UI and control actions: Under L0 clearance status, the ground station does not change the operator's normal operating procedure, and the instructions enter the channel through the conventional protocol; In L1 alert status, the ground station can display and record risk warnings near the controls, in the status bar, or in pop-ups; In L2 strong confirmation status, the ground station requires the operator to complete secondary confirmation, delayed confirmation, authorization confirmation or fill in the reason for operation before allowing the transmission to continue; In L3 restricted command delivery mode, the ground station restricts the scope of command execution by means of splitting, rate limiting, phased execution, supervisor authorization, or primary / backup link verification, depending on the command type. For example, if the candidate operation intent is to cancel the return trip and the arbitration is L3, the command delivery mode in the command envelope is configured as "phased execution". The command channel layer is only allowed to execute one short-distance waypoint, and is not allowed to issue commands to execute all remaining waypoints at once.

[0064] In L4 blocking status, the ground station not only blocks commands to be issued, but also provides alternative actions such as hovering, returning to home, landing, and link protection based on the current status.

[0065] Meanwhile, when the ground station performs prompts, strong confirmations, or blocking, the system generates an operation arbitration reason based on the node contribution, edge contribution, or risk path in the risk status model and displays the risk explanation information on the interface, thereby solving the problem of traditional alarms lacking explanations of risk causes.

[0066] Furthermore, to further enhance the system's robustness in extremely harsh environments, the method in this embodiment also includes: When critical task context data is missing, the confidence level of risk trajectory prediction is lower than the preset threshold, the simulation results are abnormal, computing resources are insufficient, or the link status is lower than the preset requirements, switch to the degraded arbitration mode. In the downgraded arbitration mode, unnecessary high-risk operation commands are restricted, and one or more of hovering, return to home, landing, link reconnection, and alarm confirmation are retained as the minimum set of safe actions.

[0067] For example, when the remaining battery power is below the minimum safe battery power, canceling the return trip or uploading a new route is prohibited; only returning, landing, or diverting to an alternate airport is allowed. When the C2 link is lost, switching to manual mode is prohibited. When the positioning is abnormal and the area is approaching a restricted zone, modifying waypoints or reducing flight altitude is prohibited. In degraded mode, the ground station disables, locks, or only displays safe action entries for relevant risk controls. Once the abnormal conditions that caused the degrade are resolved, the ground station rebuilds the risk state model and automatically resumes normal bi-branch simulation.

[0068] Optionally, when the original operational intent is blocked, but the mission still needs to be executed, the ground station can automatically generate and recommend alternative operational sequences. The generation process specifically includes: determining the mission objective based on the original operational intent, screening relevant candidate alternative instructions, constructing alternative prediction branches and calculating risks, and finally recommending them to the operator. For example, when the operator prepares to cancel the return trip during the low battery return phase, the system can generate an alternative sequence of "first maintaining the current safe altitude to execute the waypoint closest to the destination without compromising the return margin, and then immediately resuming the return trip." This sequence satisfies the following mathematical constraints: Target similarity constraints:

[0069] in: Indicates the similarity between task objectives; Indicates a sequence of substitution operations; Indicates the original candidate's operational intent; Indicates the similarity threshold; Risk reduction constraints:

[0070] in: Indicates predicted risk; This indicates a reduced risk margin; State-executable constraints:

[0071] in: Indicates whether the task is executable in the current state.

[0072] It should be noted that when the operator confirms and selects the alternative operation sequence recommended by the system, the ground station still needs to conduct a complete risk simulation, arbitration level confirmation and instruction envelope verification process for the alternative operation sequence. It must not bypass the bottom line of safety arbitration simply because it is a system recommended action.

[0073] Finally, after completing the aforementioned command arbitration, the method in this embodiment further includes the steps of recording the arbitration process and updating relevant parameters. Specifically, the log recording module records the current task context, operational risk increment, command envelope information, and UAV feedback results. These records are not only used for post-event traceability but also for dynamically updating the node importance, risk propagation weight, arbitration threshold, or candidate operation intent identification rules in the risk state model, enabling adaptive iteration of the model.

[0074] Example 2 Based on Embodiment 1, in order to enable those skilled in the art to more clearly understand the underlying working logic and specific algorithm flow process of the present invention, this embodiment combines... Figure 2 The flowchart shown provides a more detailed breakdown of the UAV ground station operation command arbitration method (divided into steps S101 to S110), and further elaborates on it in conjunction with specific numerical application scenarios. The method in this embodiment specifically includes the following steps: Step S101: Obtain the current task context data.

[0075] The UAV ground station obtains current mission context data from the flight control system, mission management module, link management module, alarm management module, map and airspace management module, and payload management module. The mission context data includes mission phase, flight path information, flight mode, position, altitude, speed, attitude, track deviation, energy margin, link quality, positioning status, environmental constraints, alarm events, and command channel status.

[0076] The mission phase can indicate whether the UAV is in takeoff, flight path, target operation, return, landing, or emergency response status; energy margin can be determined based on remaining battery power, remaining flight time, energy required for return, and energy required for alternate landing; link quality can be determined based on remote control link strength, C2 link latency, packet loss rate, image transmission delay, and primary / backup link status; environmental constraints can include information such as no-fly zones, restricted flight zones, obstacles, terrain, wind speed and direction, and densely populated areas.

[0077] Step S102: Obtain ground station operator interaction data and determine candidate operation intentions.

[0078] The ground station monitors the operator's interactive behavior on interface controls, keyboard, mouse, touch screen, gamepad, voice input device, or other input devices. These interactive behaviors may include control clicking, control focusing, mouse hovering, menu entry, waypoint dragging, route editing, parameter modification, joystick pre-positioning, shortcut key input, and voice commands.

[0079] When an interaction points to an operation that may change the UAV's flight status, mission path, safety protection status, or command channel status, the ground station generates candidate operation intentions. These candidate operation intentions may include canceling return-to-home, switching flight modes, uploading flight paths, modifying waypoints, changing flight altitude, disabling obstacle avoidance or geofencing protection, clearing alarms, payload control, link switching, and emergency takeover.

[0080] For explicit operations, such as clicking the "Cancel Return" or "Upload Route" controls, the ground station can directly generate corresponding candidate operation intentions. For implicit operations, such as an operator focusing on high-risk controls for an extended period, continuously entering advanced control menus, continuously editing waypoints and approaching the upload step, the ground station can predict candidate operation intentions by combining historical operation sequences, control access paths, and parameter modification behaviors.

[0081] Step S103: Build or update the risk status model corresponding to the current task.

[0082] The ground station constructs a risk state model based on the current mission context data. This risk state model characterizes the risk relationships between mission state, flight state, energy state, link state, environmental constraints, alarm events, candidate operational intentions, safety baseline policies, risk barriers, and command channel states.

[0083] In one implementation, the risk state model is a task context risk graph. This risk graph includes risk nodes, risk-related edges, and node risk values. Risk nodes represent risk factors in the current task, risk-related edges represent the influence relationships between risk factors, and node risk values ​​represent the risk level of the corresponding risk factor at the current or predicted time.

[0084] The risk nodes may include at least some of the following: task nodes, flight status nodes, energy nodes, link nodes, environmental constraint nodes, alarm nodes, operation intent nodes, safety baseline nodes, risk barrier nodes, and command channel nodes; the risk-related edges may include at least one of the following: status influence edges, alarm trigger edges, operation influence edges, risk suppression edges, and latency influence edges.

[0085] For example, low battery nodes can affect return-to-home margin nodes, weak link nodes can affect manual takeover reliability nodes, nodes approaching no-fly zones can affect flight path risk nodes, and obstacle avoidance protection nodes can mitigate obstacle collision risks. After candidate operational intentions are determined, the ground station determines the set of affected nodes based on their command type and parameters, and inputs the candidate operational intentions as operational intervention inputs into the risk state model.

[0086] For ease of calculation, the node risk value of each risk node is normalized to the range [0,1]. Here, 0 indicates a low risk for the node, and 1 indicates a high risk. Risk nodes can be initialized based on task context data, or updated based on alarm events, changes in flight status, or operational intent.

[0087] For nodes with high power risk, their risk value can be determined based on the current remaining power and the safe power threshold corresponding to the current task stage:

[0088] in: express The current battery risk value; This indicates the safe power threshold corresponding to the current task stage; express The drone's remaining battery power at any time; This means that the calculation result will be restricted to the interval [0,1].

[0089] For nodes with return margin risk, their node risk value can be determined based on the energy required for return and the remaining available energy:

[0090] in: express The risk value of the return margin at any given moment; This indicates the energy required for the drone to return from its current location.

[0091] For risky nodes on a link, their risk value can be determined based on link latency and packet loss rate:

[0092] in: express Link risk value at any given time; and These are the weighting coefficients; Indicates the current link latency; Indicates the current link packet loss rate Indicates the maximum allowable link delay; This indicates the maximum allowed packet loss rate.

[0093] For restricted airspace risk nodes, their node risk value can be determined based on the distance between the current location of the UAV and the boundary of the restricted airspace:

[0094] in: express Time-limited airspace risk value; Indicates the preset safe distance; This indicates the distance from the drone's current location to the restricted airspace boundary.

[0095] For nodes with route deviation risk, their node risk value can be determined based on the lateral deviation from the current position to the planned route:

[0096] in: express The risk value of flight path deviation at any given time; Indicates the current flight path deviation; This indicates the maximum permissible deviation from the flight path.

[0097] The above method for calculating node risk values ​​is merely an example. For risk nodes such as attitude stability, positioning reliability, obstacle proximity, manual takeover reliability, load status, and command channel status, normalization can be performed based on the relationship between the corresponding state variables and preset thresholds.

[0098] After the risk node is initialized, the system performs risk propagation calculations based on the risk-related edges. For risk nodes... The risk value of the next node can be updated according to the following formula:

[0099] in: Represents a node exist Risk value at any given moment; Represents nodes Nodes with risk-related relationships exist Risk value at any given moment; Represents a node For nodes Risk propagation weight; Represents a node Self-risk maintenance coefficient; Indicates operational intent or security baseline policy for nodes Intervention input; Indicates intervention input to nodes Influence weight; Indicates the bias term; The normalization function can be either the sigmoid function or the clip function.

[0100] When a candidate operational intent is detected, the system determines the set of affected nodes based on the instruction type and parameters of the candidate operational intent, and generates the operational intervention input for the first prediction branch. For example, if the candidate operational intent is to cancel the return trip, its set of affected nodes may include mission phase nodes, return margin nodes, remaining range nodes, energy risk nodes, and mission continuation nodes. If the candidate operational intent is to switch to manual mode, its set of affected nodes may include flight mode nodes, link risk nodes, manual takeover reliability nodes, and attitude stability nodes.

[0101] Accordingly, the system generates operational intervention inputs for the second prediction branch based on the safety baseline policy. For example, when the current state is low battery and the return path is reachable, the safety baseline policy can be to continue returning; when the current link quality is degraded but the positioning status is stable, the safety baseline policy can be to hover and perform link protection; when approaching an obstacle, the safety baseline policy can be to climb and avoid obstacles.

[0102] The first and second prediction branches are established based on the same task state snapshot. In the first prediction branch, the operational intervention input... Corresponding to the execution of candidate operation intentions; in the second prediction branch, the operation intervention input. The corresponding safety baseline policy is executed. The system calculates the two prediction branches for future time windows. Iterative calculations are performed within the time window to obtain the node risk value sequence for each risk node in the future time window.

[0103] For any prediction branch , , its in The overall risk value at any given time can be calculated using the following formula:

[0104] in: Indicates the prediction branch exist The overall risk value at any given moment; Indicates risk nodes Importance in the current task; Indicates risk nodes The severity of the corresponding risk consequences; Indicates the prediction branch Middle node exist Risk value at any given moment.

[0105] Operational risk increment is used to represent the increase in risk caused by executing a candidate operational intent relative to executing a safety baseline policy. In one implementation, the operational risk increment is calculated according to the following formula:

[0106] in: Indicates the time discount factor; The first prediction branch is in The overall risk value at any given moment; The second prediction branch is in The overall risk value at any given moment; Indicates the uncertainty weight; This represents the uncertainty in risk simulation; it can be determined based on the proportion of missing input data, historical prediction errors of the model, link status stability, or the difference between the simulation results of two models. For example, when critical task context data is missing, link status fluctuates significantly, or the rapid simulation results differ greatly from the corrected simulation results, the uncertainty is increased. This has led to a more conservative approach to arbitration.

[0107] Current mission risk status It can be determined based on the comprehensive risk value of each risk node at the current moment:

[0108] The system is based on the incremental operational risk. Current mission risk status Uncertainty And whether a hard rule is triggered determines the arbitration level. The specific arbitration level mapping rule can be determined using the arbitration matrix in step S108.

[0109] Step S104: Select a security baseline policy.

[0110] Based on the current mission phase, energy margin, link quality, positioning status, environmental constraints, alarm events, and the set of executable actions of the UAV, the ground station selects a safety baseline policy from the safety baseline policy library that corresponds to the current mission status. The safety baseline policy serves as a risk comparison object for candidate operational intentions; it does not simply mean "do not perform the operation," but rather a relatively safe and feasible reference handling method under the current mission status.

[0111] In one implementation, a security baseline policy library is pre-configured with multiple security baseline policies, each with feasibility conditions and a basic risk value. The system first filters the security baseline policies that are executable under the current state, and then selects one of them as the operational intervention input for the second prediction branch based on the predicted risk, task objective compatibility, and security threshold corresponding to each security baseline policy.

[0112] In one implementation, the security baseline policy selection rules are shown in the table below.

[0113] Table 1. Rules for Selecting Security Baseline Policies

[0114] For example, when the drone is in the low-battery return-to-home phase and the return-to-home path is reachable, if the candidate operation intention is to cancel the return-to-home and continue the mission, the safety baseline policy will prioritize continuing the return-to-home. When the drone is in a weak link state and the automatic flight is stable, if the candidate operation intention is to switch to manual mode, the safety baseline policy can choose to continue automatic flight or hover and perform link protection. When the drone approaches the restricted airspace boundary and the operator is preparing to upload a new flight path, the safety baseline policy can choose to maintain the original flight path or hover and wait for the flight path to be verified.

[0115] Step S105: Construct the first prediction branch and the second prediction branch.

[0116] The ground station constructs two prediction branches based on the same mission state snapshot. The first prediction branch corresponds to executing the candidate operation intent, and the second prediction branch corresponds to executing the safety baseline policy. The two prediction branches have the same initial mission state, differing only in the applied operational intervention inputs.

[0117] In the first prediction branch, the ground station applies candidate operational intentions to the operational intention nodes and their affected node set in the risk state model; in the second prediction branch, the ground station applies safety baseline policies to the safety baseline nodes and their affected node set in the risk state model.

[0118] For example, when the candidate operation intent is "cancel return and continue mission", the first prediction branch applies the intent to nodes such as mission phase, energy margin, return reachability and route execution status; the second prediction branch applies "continue return" as a safety baseline strategy to the corresponding nodes.

[0119] Step S106: Predict the risk trajectories of the two branches within the future time window.

[0120] The ground station performs risk projections for the first and second prediction branches within future time windows, respectively, to obtain the risk trajectories of the two branches. The future time window can be determined based on mission phase, UAV speed, link latency, energy margin, or operation type.

[0121] A risk trajectory can represent a sequence of changes in comprehensive task risk over time, or it can represent the changes in the risk values ​​of multiple risk nodes within a future time window. Risk simulation can employ one or more of the following models: weighted risk propagation model, causal graph model, Bayesian network model, time series prediction model, graph neural network model, state-space model, or lightweight simulation model.

[0122] In one implementation, the ground station first uses a local risk state model to quickly extrapolate and obtain a preliminary risk trajectory; then it uses a complete risk state model or a high-precision simulation method to correct the trajectory, and the correction results are used to update the risk association weights, thresholds or risk propagation parameters in subsequent arbitration.

[0123] Step S107: Calculate the operational risk increment corresponding to the candidate operational intent.

[0124] The ground station compares the risk trajectories of the first and second prediction branches and calculates the operational risk increment of the candidate operational intent relative to the safety baseline strategy.

[0125] In one implementation, the ground station calculates the combined risk values ​​of the first and second prediction branches within a future time window. When the combined risk value of the first prediction branch is higher than that of the second prediction branch, the difference between the two is taken as the risk trajectory difference. Then, the risk trajectory difference is corrected by combining the risk occurrence time, the severity of the risk consequences at each node, the model uncertainty, and the urgency of the current task, to obtain the operational risk increment.

[0126] In another implementation, if the candidate operation intent can reduce the current risk, such as performing climb obstacle avoidance or emergency return in a dangerous approach state, the ground station can reduce the arbitration level or allow entry into the restricted distribution process based on the degree of risk reduction of the first prediction branch relative to the second prediction branch.

[0127] Step S108: Determine the operational arbitration level based on the operational risk increment.

[0128] In one implementation, the ground station determines the operational arbitration level based on the operational risk increment, the current mission risk status, the uncertainty of risk projection, and the hard rule triggering status. The operational arbitration levels include L0 (allow), L1 (hint), L2 (strong confirmation), L3 (restricted issuance), and L4 (blocking).

[0129] In one implementation, the level of arbitration is determined according to the following table.

[0130] Table 2 Operational Arbitration Levels

[0131] in, , , , As the threshold for incremental operational risk, and ; $u1$ represents the low-risk threshold for the current mission; $u1$ represents the uncertainty threshold. These thresholds can be determined based on the UAV type, mission type, flight phase, historical mission data, or manual configuration.

[0132] Hard rules can include one or more of the following: 1. The remaining battery power is lower than the minimum safe battery power corresponding to the current task stage; 2. The candidate operation intent will cause the route to enter restricted airspace or break through geofence; 3. C2 link is lost or link quality is below the requirements for secure command issuance; 4. The serious flight control alarm has not been cleared; 5. The candidate operation intent is used to disable security protections that must be enabled in the current task phase; 6. The command channel is in an abnormal state and cannot complete the risk simulation identification or arbitration level verification; 7. The validity period of the instruction to be issued has expired, or the deviation between the current task status and the task status during risk simulation exceeds the threshold.

[0133] In L0 clearance mode, the ground station does not alter the operator's normal operating procedures; operating commands enter the uplink command channel via standard protocols. In L1 alert mode, the ground station can display risk warnings near controls, in the status bar, or in pop-ups, and record the results of this risk simulation. In L2 strong confirmation mode, the ground station requires the operator to complete secondary confirmation, delayed confirmation, authorization confirmation, or provide a reason for the operation before allowing further transmission. In L3 restricted transmission mode, the ground station restricts the scope of command execution based on command type, using methods such as splitting, rate limiting, phased execution, supervisor authorization, or primary / backup link verification. In L4 blocking mode, the ground station blocks pending commands and provides alternative actions such as hovering, return to home, landing, link protection, or continuing the safety baseline strategy based on the current state.

[0134] When a candidate operation intent has emergency avoidance value, the system does not simply rely on... Instead of directly blocking, the arbitration level is further assessed to determine whether the safety baseline strategy can meet the current risk avoidance objectives. If the safety baseline strategy cannot reduce immediate risks in a timely manner, and the overall risk can be reduced after authorization confirmation, channel verification, and amplitude limiting constraints for the candidate operation intent, the arbitration level can be determined as L3 restricted issuance, and the validity period, parameter boundaries, and issuance mode of the operation instruction can be set.

[0135] Step S109: Implement hierarchical control according to the operation arbitration level.

[0136] Once the ground station determines the operation arbitration level, it will implement hierarchical control over at least two of the following: the status of interface controls, the operation confirmation process, and the status of the instruction issuance channel.

[0137] When the arbitration level is "clear," the ground station allows the operational command to enter the normal uplink command channel. When the arbitration level is "alert," the ground station displays a risk warning on the interface and allows the command to be issued after the warning conditions are met. When the arbitration level is "strong confirmation," the ground station requires the operator to perform secondary confirmation, delayed confirmation, authorization confirmation, or reason confirmation. When the arbitration level is "restricted issuance," the ground station delays, splits, limits, executes in stages, or authorizes the issuance of the operational command before issuing it. When the arbitration level is "blocked," the ground station prohibits the operational command from entering the uplink command channel and can switch to safety actions such as hovering, returning to home, landing, or link protection.

[0138] In one implementation, the operation instruction to be issued is encapsulated as an instruction envelope. The instruction envelope includes at least a portion of the following: instruction content, instruction parameters, risk simulation identifier, operation arbitration level, validity period, signature information, issuance mode, and task status summary. Specifically, the risk simulation identifier is used to associate with the current risk simulation record; the operation arbitration level indicates whether the operation instruction corresponds to a release, notification, strong confirmation, restricted issuance, or blocking result; the validity period limits the available time of the risk simulation result; the issuance mode indicates whether the operation instruction uses a direct pass, issuance after notification, delay, splitting, rate limiting, phased execution, issuance after authorization, or blocking method; and the task status summary records the key task context during the risk simulation.

[0139] Before an instruction enters the uplink instruction channel, the instruction channel control module performs at least one of the following checks: checks whether a risk simulation identifier exists and whether the risk simulation identifier corresponds to the current operation instruction to be issued; checks whether the operation arbitration level allows the current issuance mode; checks whether the validity period of the instruction envelope has expired; checks whether the signature information matches the instruction content, instruction parameters, and risk simulation record; checks whether the deviation between the current task status and the task status during risk simulation exceeds a preset threshold; and checks whether the current status of the instruction channel meets the issuance conditions corresponding to the arbitration level.

[0140] When the above verifications pass, the command channel control module sends the operation command according to the distribution mode in the command envelope. When any verification fails, the command channel control module blocks the operation command and records the reason for the block.

[0141] For example, if the candidate operation intent is to cancel the return trip, and the risk simulation result is L3 restricted issuance, then the issuance mode in the instruction envelope can be "phased execution". The instruction channel layer only allows the issuance of instructions that meet the phased constraints, such as allowing the execution of a short-distance waypoint or a task continuation instruction with a limited duration, but does not allow the issuance of instructions to cancel the return trip and execute all remaining waypoints at once.

[0142] For example, if the drone's status changes significantly after the risk simulation, such as continued battery depletion, significant deterioration of link quality, or the drone approaching restricted airspace, the deviation between the current mission status and the mission status during the risk simulation may exceed a preset threshold. In this case, even if the arbitration level in the command envelope originally allowed the issuance of the command, the command channel control module can reject the command and request a re-simulation of the risk.

[0143] In one implementation, to avoid unreliable outputs from the risk simulation model when inputs are missing, the model is unstable, or computing power is insufficient, the ground station sets up a degradation arbitration mechanism. The ground station enters degradation arbitration mode when any of the following conditions are met: critical mission context data is missing or updates time out; link status data, energy status data, positioning status data, or alarm event data are abnormal; the uncertainty of the risk simulation is higher than a preset threshold; the difference between the rapid simulation result and the corrected simulation result exceeds a preset threshold; the risk status model update fails, or the model output contains outliers; the ground station's computing power resources are insufficient to complete the risk simulation within a preset time; the command channel status is abnormal, and the risk simulation identifier, arbitration level, validity period, or signature verification cannot be completed; the UAV is in a critical safety state such as a serious flight control alarm, link lockout, positioning anomaly, or insufficient energy.

[0144] In the degraded arbitration mode, the ground station uses hard rules and a minimum set of safety actions for control. The minimum set of safety actions includes one or more of the following: hovering, return to home, landing, link reconnection, alarm confirmation, and maintaining the current safety control law.

[0145] In one implementation, when the remaining battery power is lower than the minimum safe battery power corresponding to the current mission phase, canceling the return flight, continuing the mission, or uploading new routes to extend the flight range is prohibited; only returning flight, landing, or making an emergency landing at the nearest airport is permitted. When the C2 link is lost or the link quality is lower than the safety requirements for issuing commands, switching to manual mode that relies on real-time manual control is prohibited; only link reconnection, hovering, returning flight, or maintaining automatic control is permitted. When the positioning status is abnormal and the UAV is approaching restricted airspace or obstacle areas, uploading new routes, modifying waypoints, or reducing flight altitude is prohibited; only hovering, returning flight, or climbing to avoid obstacles is permitted. When a serious flight control alarm has not been cleared, disabling safety protection, performing payload release, or performing unnecessary mission operations is prohibited; only safe actions permitted by flight control are permitted. When the command channel cannot complete the risk simulation identification or arbitration level verification, non-safe operation commands are prohibited from entering the uplink command channel.

[0146] In degraded arbitration mode, the ground station can disable, lock, or only display safety action entry points for relevant controls. For safety actions that must be retained, the ground station can issue them using a simplified confirmation process or a dedicated emergency channel, but still record the operator's identity, triggering reason, mission status, and instruction content. Once the abnormal conditions that caused the degrade are resolved, the ground station reacquires the mission context data, reconstructs the risk status model, and resumes the normal dual-branch risk simulation and graded arbitration process.

[0147] In one implementation, when the incremental operational risk corresponding to a candidate operational intent exceeds a preset threshold, but the current task objective still needs to be executed, or directly blocking the candidate operational intent would affect task continuity, the ground station generates an alternative operational sequence. The alternative operational sequence is used to preserve the task objective corresponding to the candidate operational intent as much as possible while reducing risk.

[0148] The process of generating alternative operation sequences includes: determining the task objective based on the candidate operation intent; filtering candidate alternative instructions related to the task objective from the current set of executable instructions; constructing alternative prediction branches for the candidate alternative instructions or combinations thereof, and calculating their predicted risks using the same risk extrapolation method as the candidate operation intent; calculating the task objective similarity between the candidate alternative instructions or alternative operation sequences and the original candidate operation intent; and selecting at least one alternative operation sequence from the candidate alternative operation sequences that satisfy the task objective similarity constraint, prediction risk constraint, and executability constraint to recommend to the operator.

[0149] In one implementation, the sequence of substitution operations satisfies the following constraint:

[0150] in: Indicates the similarity between task objectives; Indicates a sequence of substitution operations; Indicates the original candidate's operational intent; Indicates the similarity threshold; Risk reduction constraints:

[0151] in: Indicates predicted risk; This indicates a reduced risk margin; State-executable constraints:

[0152] in: Indicates whether the task is executable in the current state.

[0153] For example, during the low-battery return-to-home phase, when the operator prepares to cancel the return-to-home and continue executing all remaining waypoints, the system can generate an alternative operation sequence: first, maintain the current safe altitude, execute only the waypoint closest to the current location that does not compromise the return-to-home margin, and then immediately resume the return-to-home. As another example, when link quality deteriorates and the operator prepares to switch to fully manual mode, the system can generate an alternative operation sequence: maintain automatic flight mode, allow brief assisted manual corrections, limit the amplitude of control inputs, and prohibit continuous manual control until link quality recovers.

[0154] When an operator selects an alternative operation sequence, the ground station still performs risk analysis, arbitration level confirmation, and instruction envelope verification for that alternative operation sequence, without directly bypassing the arbitration process simply because it is a recommended action.

[0155] Step S110: Record the arbitration process and update the relevant parameters.

[0156] The ground station records the current mission context, candidate operational intentions, safety baseline policies, risk trajectories of the two prediction branches, operational risk increments, arbitration levels, command envelope information, final issuance results, and UAV feedback results. These records can be used for post-event review and for updating node importance, risk association weights, thresholds, or candidate operational intention identification rules in the risk state model.

[0157] Through the above steps, this embodiment can perform a forward-looking risk comparison of candidate operation intentions in combination with the current task context before the operation command enters the uplink command channel, and perform linkage arbitration of the operation interface, confirmation process and command channel according to the increase in operation risk.

[0158] In this embodiment, specifically, the following example illustrates the risk state model, bi-branch deduction, and calculation process of operational risk increment, using the scenario of an operator preparing to cancel the return trip and continue performing the remaining waypoint tasks during the low battery return phase. It should be understood that the following values ​​are only used to illustrate the calculation method of this invention and do not constitute a limitation on specific thresholds or parameter values.

[0159] The drone is currently in the return-to-home phase. The ground station has obtained the following mission context data: the current remaining battery power is 24%, and the safe battery power threshold for the current mission phase is 30%; the estimated battery power required for returning from the current location is 18%, and the corrected battery power required for returning after considering headwind and safety margin is 28%; the C2 link latency is 180ms, and the maximum allowable latency is 300ms; the link packet loss rate is 8%, and the maximum allowable packet loss rate is 20%; the drone is 120m away from the nearest obstacle, and the preset safe distance is 200m.

[0160] The ground station normalizes the above state variables to obtain initial node risk values ​​for several risk nodes:

[0161]

[0162]

[0163]

[0164] in, Indicates power consumption risk. Indicates the risk of return margin. Indicates link risk, This indicates that an obstacle is approaching and poses a risk.

[0165] In this state, the operator enters the return-to-home control panel and prepares to click the "Cancel Return-to-Home" control. The ground station determines the candidate operation intent as canceling the return-to-home and continuing to execute the remaining waypoint missions. Based on the instruction type and parameters of this operation intent, the system determines that its affected node set includes mission phase nodes, return-to-home margin nodes, remaining range nodes, power risk nodes, and link handling nodes.

[0166] The safety baseline selection module selects continuing the return journey as the safety baseline strategy based on the current mission phase, energy margin, and return path reachability. The ground station establishes two prediction branches based on the same mission status snapshot: the first prediction branch A corresponds to canceling the return journey and continuing the mission, and the second prediction branch B corresponds to continuing the return journey.

[0167] The system uses a 30-second projection step and sets the future time window T to 4 steps, which means it predicts risk changes within the next 120 seconds.

[0168] In the first prediction branch A, as the drone continues to fly towards the remaining waypoints, the return distance increases, the remaining battery power decreases, and the weak link condition persists, gradually increasing the risk of return margin and battery power. After risk propagation calculations, the comprehensive risk values ​​for each future time point are shown in the table below: Table 3. Overall Risk Values ​​at Future Moments

[0169] In the second prediction branch B, the drone continues its return journey, with the return distance gradually shortening. Although the current battery margin is low and the link quality is deteriorating, the risk to the return margin does not continue to increase. After risk propagation calculations, the comprehensive risk values ​​for each future time point are as follows: Table 4. Overall Risk Values ​​at Future Moments

[0170] The system calculates the operational risk increment based on the difference in the combined risk values ​​of the two prediction branches. A time discount factor is set. The uncertainty of risk projection is 0.9. The uncertainty weight is 0.08. If it is 0.5, then the operational risk increment is... for:

[0171] Right now:

[0172]

[0173] In this embodiment, an arbitration threshold is set. , , , .

[0174] because greater than The system determines the arbitration level of the candidate operation intent as L4 blocking.

[0175] If in practical application... Normalization can be performed, and the result can be compared with the corresponding threshold; the arbitration logic remains unchanged.

[0176] The ground station implements tiered control based on the L4 blocking level: the "Cancel Return-to-Home" control is grayed out or locked on the interface; the operation confirmation process no longer provides a normal secondary confirmation entry; the command channel layer does not generate command envelopes that allow uplink, or generates command envelopes with a blocking status and records the reason for the blocking. The interface displays risk explanation information to the operator, such as: "Currently, there is low battery, insufficient return-to-home margin, and degraded link quality. Canceling the return-to-home and continuing the mission will significantly increase the risk of return-to-home failure." In another scenario, with 32% remaining battery power, 22% required for corrective return, a link latency of 90ms, and a packet loss rate of 3%, the risk difference between the two predicted branches is small. Therefore, the operational risk increment may fall into... to Within a given timeframe, the system can determine the arbitration level as either L1 prompt or L2 strong confirmation, rather than directly blocking. Therefore, the same "cancel return" operation can yield different arbitration results in different task contexts.

[0177] Through the above numerical calculations, this embodiment illustrates that the ground station does not simply handle the cancellation of the return operation based on the low battery alarm in a fixed manner, but uses the continued return as a safety baseline strategy, compares the differences in the future risk trajectories of the two branches of canceling the return and continuing the return, and determines the final arbitration level based on the incremental operational risk.

[0178] Example 3 As shown in Figure 1, this embodiment provides a UAV ground station operation command arbitration system. This system is based on the same inventive concept as the UAV ground station operation command arbitration methods described in Embodiments 1 and 2, and is used to implement the steps and functions in the above method embodiments. The system in this embodiment specifically includes: The status access module is used to acquire the current mission context data of the UAV and the interaction data of the ground station operator. Specifically, this module can connect to the flight control system, mission management module, link management module and alarm management module in real time to gather global context data including mission stage, flight status, energy status, link status and so on.

[0179] The operation intent capture module is used to determine candidate operation intents based on the ground station operator interaction data before the operation command enters the uplink command channel. This module acts as a pre-interception trigger, capable of real-time monitoring of the operator's explicit and implicit interaction behaviors on interface controls, joysticks, and other devices, and completing intent capture before the actual generation of the command.

[0180] The risk state model construction module is used to construct or update the risk state model corresponding to the current task based on the task context data and the candidate operation intention. The risk state model includes risk nodes and the associated edges between the risk nodes, and is configured with node risk values ​​and risk association weights. The risk state model is used to characterize the risk association relationships between task state, flight state, energy state, link state, environmental constraints, alarm events, operation intentions and command channel states.

[0181] The safety baseline selection module is used to determine the safety baseline policy corresponding to the current task state from the safety baseline policy library based on the current task context. This module aims to provide a relatively safe and executable "reference system" policy for subsequent two-branch comparison simulations under the current state.

[0182] The dual-branch extrapolation module constructs a first and second prediction branch based on the same task state snapshot. The candidate operational intent and the safety baseline policy are used as corresponding operational intervention inputs, respectively, and fed into the risk state model. Combining the node risk values ​​and risk association weights in the risk state model, the module predicts the risk trajectories of the first and second prediction branches within future time windows. By constructing parallel physical state branches, this module can isolate environmental interference and achieve risk evolution assessment purely from operational perspectives.

[0183] The risk increment calculation module is used to calculate the operational risk increment corresponding to the candidate operational intent based on the difference in comprehensive risk values ​​between the first prediction branch and the second prediction branch within a future time window, the time of risk occurrence, and the uncertainty of risk projection.

[0184] The tiered arbitration module is used to determine the arbitration level of an operation based on the incremental operational risk and the current task risk status. This module combines hard rule defenses with soft calculation (threshold determination) defenses, and outputs arbitration results such as release (L0), prompt (L1), strong confirmation (L2), restricted issuance (L3), or block (L4).

[0185] The command channel control module is used to perform hierarchical control on at least two of the following: the status of ground station interface controls, the operation confirmation process, and the command issuance channel status, based on the operation arbitration level. This module is responsible for encapsulating the operation command to be issued into a command envelope containing a risk simulation identifier and arbitration level, and performing issuance condition verification at the underlying command channel layer, thus achieving coordinated control between front-end interface prompts and back-end physical channel interception.

[0186] To further enhance the integrity and robustness of the system, based on actual business needs, the system in this embodiment may also include the following auxiliary modules: The risk explanation output module is used to generate operation arbitration reasons based on node contributions, edge contributions, or risk paths in the risk status model, and display them to the operator on the interface, solving the problem of traditional alarms lacking cause explanations.

[0187] The logging module is used to record task context data, candidate operation intentions, safety baseline policies, risk trajectories of the two prediction branches, operational risk increments, arbitration levels, instruction envelope information, final issuance results, and drone feedback results.

[0188] The model update module is used to update the node importance, risk association weight, arbitration threshold, or candidate operation intent identification rules in the risk status model based on historical task data and feedback results.

[0189] The degradation control module is used to switch the system to degradation arbitration mode when task context data is missing, model confidence is insufficient, inference results are abnormal, computing resources are insufficient, or link status is lower than preset requirements. It uses a minimum set of safety actions as a safety fallback.

[0190] Furthermore, this embodiment also provides an electronic device, including a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements a UAV ground station operation command arbitration method as described in Embodiment 1 or Embodiment 2. This electronic device can be an industrial control host, a portable control terminal, or a cloud-based command and control server for a UAV ground control station.

[0191] This embodiment also provides a computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements a UAV ground station operation command arbitration method as described in Embodiment 1 or Embodiment 2. The computer-readable storage medium may include various media capable of storing program code, such as a USB flash drive, portable hard drive, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0192] The embodiments described above merely illustrate specific implementation methods of this application, and while the descriptions are detailed and specific, they should not be construed as limiting the scope of protection of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the technical solution of this application, and these modifications and improvements all fall within the scope of protection of this application.

Claims

1. A method for arbitrating unmanned aerial vehicle (UAV) ground station operation commands, characterized in that, include: Step S1: Obtain the current mission context data of the UAV and the interaction data with the ground station operator; Step S2: Before the operation command enters the uplink command channel, determine the candidate operation intention based on the ground station operator interaction data; Step S3: Based on the task context data and the candidate operation intent, construct or update the risk status model corresponding to the current task. The risk status model includes risk nodes and the associated edges between the risk nodes, and is configured with node risk values ​​and risk association weights. The risk status model is used to characterize the risk association relationships between task status, flight status, energy status, link status, environmental constraints, alarm events, operation intent, and command channel status. Step S4: Based on the current task context, determine the security baseline policy corresponding to the current task state from the security baseline policy library; Step S5: Construct a first prediction branch and a second prediction branch based on the same task state snapshot, wherein the first prediction branch corresponds to executing the candidate operation intent, and the second prediction branch corresponds to executing the security baseline policy; Step S6: Input the candidate operation intention and the safety baseline policy as corresponding operation intervention inputs into the risk state model, and combine the node risk value and the risk association weight in the risk state model to predict the risk trajectory of the first prediction branch and the second prediction branch in the future time window respectively. Step S7: Calculate the operational risk increment corresponding to the candidate operational intent based on the difference in comprehensive risk values ​​between the first and second prediction branches within the future time window, the time of risk occurrence, and the uncertainty of risk projection; Step S8: Determine the operation arbitration level based on the operation risk increment and the current task risk status; Step S9: Based on the operation arbitration level, perform hierarchical control on at least two of the following: the status of the ground station interface controls, the operation confirmation process, and the status of the instruction issuance channel.

2. The UAV ground station operation command arbitration method according to claim 1, characterized in that, The step S3 of constructing or updating the risk status model corresponding to the current task includes: The task context data, including the task phase, flight status, energy status, link status, environmental constraints, alarm events, and command channel status, as well as at least a portion of the candidate operation intentions, security baseline policies, and preset risk barriers, are mapped to the risk nodes. Based on at least one of the following relationships: state influence relationship, alarm trigger relationship, operation influence relationship, risk suppression relationship, and latency influence relationship, establish the associated edges between the risk nodes.

3. The UAV ground station operation command arbitration method according to claim 2, characterized in that, The operational intervention input includes candidate operational intent intervention inputs in the first prediction branch and safety baseline policy intervention inputs in the second prediction branch; step S6 includes: The set of affected nodes is determined based on the instruction type and instruction parameters of the candidate operation intention, and the candidate operation intention is used as the intervention input to the set of affected nodes. The security baseline policy is used as the security baseline policy intervention input and applied to the corresponding set of affected nodes. For any risk node in the risk state model, the node risk value of the risk node at the next prediction time is updated based on the current node risk value of the risk node, the node risk values ​​of other risk nodes that are related to the risk node, the risk association weight, and the operation intervention input, so as to obtain the risk trajectory within the future time window.

4. The UAV ground station operation command arbitration method according to claim 1, characterized in that, Step S7, which calculates the operational risk increment corresponding to the candidate operational intent, includes: Calculate the combined risk value of the first prediction branch and the second prediction branch within a future time window. The combined risk value is determined based on the node importance, node risk consequence severity, and node risk value at the prediction time of the risk state model in the corresponding branch. Based on the portion of the comprehensive risk value of the first prediction branch that is higher than the comprehensive risk value of the second prediction branch, and combined with the time discount factor, the risk trajectory difference is calculated. The risk projection uncertainty is determined based on at least one of the following: the proportion of missing task context data, the historical prediction error of the model, the degree of link status fluctuation, and the difference between the projection results of different models. The risk trajectory difference is corrected based on the uncertainty of the risk projection to obtain the operational risk increment corresponding to the candidate operational intention.

5. The UAV ground station operation command arbitration method according to claim 1, characterized in that, Determining the arbitration level in step S8 includes: Determine whether the current task status triggers a hard rule. The hard rule includes at least one of the following: the remaining power is lower than the minimum safe power corresponding to the current task stage; the candidate operation intention will cause the route to enter restricted airspace or break through the geofence; the link quality is lower than the command security issuance requirements; the candidate operation intention is used to disable the security protection that must be enabled in the current task stage. If the hard rule is not triggered, the operation arbitration level will be determined as release, prompt, strong confirmation or restricted issuance according to the preset threshold range to which the operation risk increment belongs. If the hard rule is triggered, or if the increase in operational risk exceeds the highest preset threshold, the operational arbitration level will be determined as blocking.

6. The UAV ground station operation command arbitration method according to claim 1, characterized in that, Step S9 involves hierarchical control of the command issuance channel status, including: The operation instructions to be issued are packaged into an instruction envelope, which includes at least some of the following: instruction content, instruction parameters, risk simulation identifier, operation arbitration level, validity period, and issuance mode. The instruction envelope is subjected to a condition verification at the instruction channel layer. The condition verification includes at least one of the following: verifying whether the risk simulation identifier corresponds to the current operation instruction to be issued, whether the operation arbitration level allows the current issuance mode, whether the validity period has expired, and whether the deviation between the current task status and the task status during the simulation exceeds a preset threshold. If the verification passes, the operation instruction to be sent is sent according to the corresponding sending mode; if the verification fails, the operation instruction to be sent is blocked.

7. The UAV ground station operation command arbitration method according to any one of claims 1-6, characterized in that, Also includes: When critical task context data is missing, the confidence level of risk trajectory prediction is lower than the preset threshold, the simulation results are abnormal, computing resources are insufficient, or the link status is lower than the preset requirements, switch to the degraded arbitration mode. In the downgraded arbitration mode, unnecessary high-risk operation commands are restricted, and one or more of hovering, return to home, landing, link reconnection, and alarm confirmation are retained as the minimum set of safe actions.

8. A UAV ground station operation command arbitration system, characterized in that, The method for arbitrating unmanned aerial vehicle (UAV) ground station operation commands according to any one of claims 1-7 includes: The status access module is used to acquire the current mission context data of the UAV and the interaction data of the ground station operator; The operation intent capture module is used to determine candidate operation intents based on the ground station operator interaction data before the operation command enters the uplink command channel. The risk state model construction module is used to construct or update the risk state model corresponding to the current task based on the task context data and the candidate operation intention. The risk state model includes risk nodes and the associated edges between the risk nodes, and is configured with node risk values ​​and risk association weights. The risk state model is used to characterize the risk association relationship between task state, flight state, energy state, link state, environmental constraints, alarm events, operation intentions and command channel state. The security baseline selection module is used to determine the security baseline policy corresponding to the current task state from the security baseline policy library based on the current task context. The dual-branch inference module is used to construct a first prediction branch and a second prediction branch based on the same task state snapshot. The candidate operation intention and the safety baseline strategy are respectively used as corresponding operation intervention inputs and input into the risk state model. The module combines the node risk value and the risk association weight in the risk state model to predict the risk trajectory of the first prediction branch and the second prediction branch in the future time window. The risk increment calculation module is used to calculate the operational risk increment corresponding to the candidate operational intention based on the difference in comprehensive risk values ​​between the first prediction branch and the second prediction branch within a future time window, the time of risk occurrence, and the uncertainty of risk projection. The tiered arbitration module is used to determine the operation arbitration level based on the operational risk increment and the current task risk status; The command channel control module is used to perform hierarchical control on at least two of the following: the status of the ground station interface controls, the operation confirmation process, and the status of the command issuance channel, based on the operation arbitration level.

9. An electronic device, characterized in that, include: At least one processor; and a memory communicatively connected to the at least one processor; The memory stores instructions executable by the at least one processor, which executes the instructions stored in the memory to perform the method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store instructions that, when executed, cause the method as described in any one of claims 1-7 to be implemented.

Images