Method, device, readable storage medium and computer program product for safe control of deployment operation of unmanned aerial vehicle ground station protection box

Abstract

The application relates to the technical field of unmanned aerial vehicle safety control, in particular to a deployment operation safety control method and device of an unmanned aerial vehicle ground station protection box, a readable storage medium and a computer program product. The method generates a deployment state version by establishing a physical deployment dependency graph; determines the required instruction continuity of a to-be-sent key flight control instruction according to an instruction type, and determines a resource path bundle according to the physical deployment dependency graph; sends a resource reservation request to each resource path in the resource path bundle, and generates a bound one-time permission lease after feedback is qualified; sends the key flight control instruction based on the one-time permission lease and an instruction transaction; when a new event that changes the physical deployment dependency graph is detected, the deployment state version is updated, and the one-time permission lease is executed for invalidation disposal, state reconciliation or safety rollback according to the instruction transaction of the current stage. When the physical deployment state of the protection box dynamically changes, the key flight control instruction is ensured to have sufficient continuity in the whole execution cycle.

Description

Technical Field

[0001] This application relates to the field of unmanned aerial vehicle (UAV) safety control technology, and in particular to methods, equipment, readable storage media, and computer program products for the deployment and operation safety control of UAV ground station protective boxes. Background Technology

[0002] Portable UAV ground stations typically integrate a computer, monitor, joystick, communication radio, power module, and antenna into a transportable protective case. Once in the field, operators open the case, deploy the antenna, connect cables, and plug in an external power source to perform telemetry monitoring and flight control. In this process, the case serves as both a protective transport structure and a mounting platform for the electronic equipment.

[0003] For example, the multifunctional portable UAV ground station control device disclosed in Chinese Patent Publication No. CN104977939A integrates an industrial control computer, dual displays, a main keyboard, a joystick, and a battery cavity into a housing. The top cover contains a screen switching button and a support column, and the panel includes multiple interfaces and shortcut keys, achieving integrated control and video playback functions. Another example is a UAV nest self-checking system and method disclosed in Chinese Patent Publication No. CN114261528A. This system directly acquires battery status, video monitoring, and meteorological data through the BMS for nest self-checking, and combines this with the remote controller status to determine the UAV's health. By fusing the independent self-check results of the UAV and nest and weighting the evaluation, it identifies risk scenarios where individual components are normal but the overall system is abnormal, improving the accuracy and safety of pre-flight self-checks and avoiding accidents caused by information delays or localized malfunctions.

[0004] However, current portable UAV ground stations only focus on whether the static conditions at the moment of takeoff are met, without considering the complete time window required for specific commands to be issued and confirmed for execution. In actual field use, the angle of the cover may simultaneously affect the display interface, antenna pattern, and heat dissipation channels; external power interruption may force the system to switch batteries; adjusting the cover or closing the vents when rain comes may weaken communication and the operating interface. If the system opens or closes all commands only based on the instantaneous safety score, it may lead to the continued use of expired permissions during state changes after authorization but before execution, or it may prematurely cut off the command and control paths that still need to be maintained in order to protect the enclosure.

[0005] The above content is only used to help understand the technical solution of this application and does not represent an admission that the above content is prior art. Summary of the Invention

[0006] The main purpose of this application is to provide a method, device, readable storage medium and computer program product for the deployment and operation safety control of a UAV ground station protective box, aiming to solve the technical problem of how to ensure that key flight control commands have sufficient continuity throughout the entire execution cycle when the physical deployment state of the protective box changes dynamically.

[0007] To achieve the above objectives, this application proposes a method for safe deployment and operation control of a UAV ground station protective box, the method comprising:

[0008] Based on the physical deployment status, environmental status, power status, communication status, and operation interface status of the protective box, a physical deployment dependency graph is established, and a deployment status version is generated.

[0009] In response to a critical flight control command to be sent, the required command continuity of the critical flight control command is determined according to the command type, and the resource path bundle of the critical flight control command is determined according to the physical deployment dependency graph;

[0010] Send resource reservation requests to each resource path in the resource path bundle, and after receiving a qualified response, generate a one-time permission lease that binds the deployment status version and the resource path bundle;

[0011] Based on the one-time permission lease and instruction transaction, the key flight control instructions are sent;

[0012] When a new event that changes the physical deployment dependency graph is detected, the deployment state version is updated, and the one-time permission lease is invalidated, reconciled, or rolled back according to the instruction transaction of the current stage.

[0013] In one embodiment, the step of determining the resource path bundle of the critical flight control commands based on the physical deployment dependency graph includes:

[0014] Based on the physical deployment dependency graph, determine the candidate resource path bundle for the key flight control commands;

[0015] Calculate the power supply availability continuity, thermal availability continuity, communication link availability continuity, physical deployment availability continuity, and user interface availability continuity for each candidate resource path bundle to obtain the total availability continuity value for each candidate resource path bundle.

[0016] Based on the total available continuity value, the instruction continuity, and the safety margin, the resource path bundle is obtained by filtering from each of the candidate resource path bundles.

[0017] In one embodiment, the step of sending the critical flight control command based on the one-time permission lease and command transaction includes:

[0018] Send an intent message to the drone, the intent message including the instruction intent, transaction identifier and necessary parameters;

[0019] Perform drone recitation and readiness verification, receive the recitation content and current flight status returned by the drone, and verify the recitation content based on the operator's intention and the one-time permission lease;

[0020] Once the recitation content has been verified and the deployment status version has not changed, the key flight control command is sent to the drone.

[0021] Execution receipt reception: Receive the execution result and current flight control status returned by the UAV;

[0022] During the instruction transaction, the critical flight control instructions are subjected to anti-replay verification based on the transaction sequence number, and the instruction execution results are subjected to integrity verification and status reconciliation based on the transaction sequence number and deployment status version.

[0023] In one embodiment, the steps of updating the deployment state version when a new event that changes the physical deployment dependency graph is detected, and performing invalidation, state reconciliation, or security rollback on the one-time permission lease according to the instruction transaction at the current stage, include:

[0024] If the new event occurs before the step of sending the critical flight control command to the drone, the one-time permission lease is invalidated, and the sending of the critical flight control command is terminated.

[0025] If the new event occurs when sending an intent message to the drone, or when performing drone repetition and readiness verification, maintain critical bus power supply and certified communication links, suspend non-critical traffic, and query the current flight status based on the transaction sequence number;

[0026] If the new event occurs during the receipt of the execution receipt, and the UAV has already executed the key flight control command, a safe rollback strategy is selected based on the current flight control status and current physical conditions.

[0027] In one embodiment, before the steps of updating the deployment state version when a new event that changes the physical deployment dependency graph is detected, and performing invalidation, state reconciliation, or security rollback on the one-time permission lease according to the instruction transaction of the current stage, the method further includes:

[0028] When environmental degradation, power degradation, or communication link quality degradation is detected, alternative resource paths are determined based on the physical deployment dependency graph.

[0029] Establish the alternative resource path and obtain confirmation feedback;

[0030] After receiving the confirmation feedback, switch the critical instruction queue to the alternative resource path, update the deployment status version, and generate a new one-time permission lease;

[0031] Release the original resource path.

[0032] In one embodiment, the step of determining alternative resource paths based on the physical deployment dependency graph when environmental degradation, power degradation, or communication link quality degradation is detected includes:

[0033] When rain or dust levels exceed limits and actions such as reducing the opening of the protective enclosure lid or adjusting the ventilation openings are required, assess the negative impact of these actions on communication link quality or heat dissipation capacity, and obtain the assessment results.

[0034] Based on the evaluation results, the backup communication link, remote operation interface, and / or reduced non-critical load power consumption that are not affected by the action or are minimally affected by the action are selected as the alternative resource path.

[0035] In one embodiment, the deployment and operation safety control method of the UAV ground station protective box further includes:

[0036] When unauthorized opening, impact to the enclosure, tilting of the enclosure, or abnormal power supply is detected, an abnormal event record is generated, and the deployment status version is updated.

[0037] Revoke unsubmitted one-time permission leases, lock the local operating interface, protect critical data, and isolate non-critical devices;

[0038] If the drone is in flight and a verified backup control link exists, maintain the minimum control path and switch to the emergency command dedicated mode.

[0039] In addition, to achieve the above objectives, this application also proposes a safety control device for a UAV ground station protective box, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the safety control method for the UAV ground station protective box as described above.

[0040] In addition, to achieve the above objectives, this application also proposes a readable storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the safety control method for the UAV ground station protective box as described above.

[0041] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the safety control method for the UAV ground station protective box as described above.

[0042] One or more technical solutions proposed in this application have at least the following technical effects:

[0043] By establishing a physical deployment dependency graph and explicitly modeling the downstream dependencies between various state variables, changes in physical states such as the enclosure angle, support locking, and antenna deployment can be propagated to critical command nodes that depend on them via directed edges. When the upstream physical state changes, the state of downstream nodes in the dependency graph can be automatically traced and re-evaluated. Furthermore, the deployment state version increments with any event that changes the dependency conditions, binding a one-time permission lease to the complete physical deployment snapshot at the time the lease is generated. Simultaneously, by requiring reservation requests to resource paths and reading actual feedback, the risk of execution interruption caused by resource reservation failures despite command transmission is avoided. This achieves dynamic binding between the protective enclosure's physical deployment state and critical flight control command permissions. Attached Figure Description

[0044] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0045] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0046] Figure 1 A flowchart illustrating the first embodiment of the deployment and operation safety control method for the UAV ground station protective box of this application;

[0047] Figure 2 A flowchart illustrating the second embodiment of the deployment and operation safety control method for the UAV ground station protective box of this application;

[0048] Figure 3 A simplified flowchart illustrating the deployment and operation safety control method for the UAV ground station protective box provided in the third embodiment of this application;

[0049] Figure 4 A flowchart illustrating the fourth embodiment of the deployment and operation safety control method for the UAV ground station protective box of this application;

[0050] Figure 5This is a schematic diagram of the equipment structure of the hardware operating environment involved in the deployment and operation safety control method of the UAV ground station protective box in the embodiments of this application.

[0051] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0052] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0053] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0054] The main solution of this application embodiment is to form a closed-loop control chain by constructing a physical deployment dependency graph, calculating the continuity budget specific to the instruction, reserving the execution resource feedback, binding the state version lease, and migrating the transaction phase failure, so as to ensure that each critical flight control instruction is issued only when the actual physical deployment of the protective box and the selected resource path can continuously cover the complete transaction cycle of the instruction.

[0055] In existing technologies, ground station safety control logic primarily relies on instantaneous state scoring, lacking consideration of the continuity of command execution throughout the entire lifecycle and the dynamic changes in physical state. This leads to risks such as expired permissions, misuse, or disconnection of the flight control link to protect the enclosure in complex field environments. For example, if an operator obtains takeoff permission with the enclosure lid open, and the lid is accidentally closed or the antenna is moved during command execution, the existing system cannot revoke the issued command permission, potentially allowing the UAV to take off without complete ground support. Similarly, when rain occurs, the operator needs to close the enclosure lid to prevent water damage, but closing the lid obstructs the antenna and display. If the system directly executes the lid-closing action, it may disconnect the ongoing command and control link, causing the UAV to lose contact. This application overcomes these problems by establishing a physical deployment dependency graph, version-bound permission leases, and a build-then-retreat resource migration mechanism.

[0056] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as an embedded controller within the enclosure, a ground station computer, or a standalone flight control command gateway, or an electronic device capable of performing the aforementioned functions. The following description uses the safety control device of the UAV ground station protective enclosure as an example to illustrate this embodiment and the subsequent embodiments.

[0057] Based on this, this application provides a safety control method for a UAV ground station protective enclosure. In this embodiment, the safety control device first acquires the physical deployment status, environmental status, power status, communication status, and operation interface status of the protective enclosure, and establishes a physical deployment dependency graph and generates a deployment status version accordingly. Then, in response to a critical flight control command to be sent, it determines the command continuity required by the command and determines the available resource path bundles based on the dependency graph. Next, it sends a reservation request to the selected resource path and obtains feedback. After the feedback is qualified, it generates a one-time permission lease binding the current status version and the path bundle. Subsequently, it sends the critical flight control command based on the lease and the command transaction. Finally, when a new event that changes the dependency graph is detected, the status version is updated and the lease is processed accordingly based on the current stage of the command transaction. (Refer to...) Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the safety control method for the UAV ground station protective box of this application.

[0058] In this embodiment, the safety control method for the UAV ground station protective box includes steps S100 to S500:

[0059] Step S100: Based on the physical deployment status, environmental status, power status, communication status, and operation interface status of the protection box, establish a physical deployment dependency graph and generate a deployment status version.

[0060] It should be noted that the physical deployment status includes at least the opening angle of the container lid. Support locking state Antenna deployment status Cable connection status Box tilt angle. It can be obtained through an angle sensor or magnetic encoder at the hinge, with a measurement range of 0° to 180°; It can be detected by limit switches or strain gauges, and the output value is "locked" or "not locked"; It can be detected by the corner sensor, and the output value is "deployed" or "not deployed"; Resistance detection can be identified via a plug-in switch or connector, with an output value of "connected" or "not connected"; the box tilt angle can be obtained via a triaxial accelerometer, with a measurement range of -90° to +90°.

[0061] Environmental conditions should include at least the internal temperature (T), internal relative humidity (RH), and rainfall detection status. Dust detection status Temperature (T) can be obtained through an NTC thermistor, with a measurement range of -40℃ to +85℃; humidity (RH) can be obtained through a capacitive humidity sensor, with a measurement range of 0% to 100%RH. It can be obtained through an electrode-type raindrop sensor, and the output value is "rainy" or "no rain"; The dust concentration can be obtained through a laser scattering dust sensor, and the output value is the current dust concentration.

[0062] Power status includes at least the external power supply status. Battery state of charge . The voltage can be obtained through a voltage detection circuit, and the output value is "connected" or "disconnected" as well as the current voltage value; It can be obtained through the battery management chip, expressed as a percentage, ranging from 0% to 100%.

[0063] Communication status includes at least the quality of the primary and backup communication links. User interface status . It can be comprehensively evaluated by signal-to-noise ratio, bit error rate and latency, and the output values ​​are the signal-to-noise ratio value and the link quality level; The heartbeat signal and communication status of the input device can be obtained from the display, and the output value is "available" or "unavailable".

[0064] After acquiring the above-mentioned state quantities, the safety control equipment performs a validity check on each state quantity.

[0065] Specifically, for analog inputs from sensors, such as temperature and angle, it is verified whether they are within the sensor's effective measurement range; if they exceed the range, they are marked as invalid. For inputs from digital switches, such as support locks and cable connections, it is verified whether a stable level signal is received within a preset time; if the signal fluctuates frequently, it is marked as invalid. For status quantities from communication protocols, such as link quality and battery state of charge, it is verified whether their timestamps are recent, for example, the difference from the current time should not exceed 500ms; if they exceed the timeout, they are marked as invalid. For critical sensor inputs that affect takeoff, return cancellation, or handover of control, "no data collected" is not interpreted as a condition being met. If a critical sensor times out, disconnects, contradicts itself, or fails to provide feedback on the executed command, the corresponding deployment node is set to unknown, a conservative permission state is adopted, and a list of objects to be checked is output.

[0066] The safety control equipment establishes a physical deployment dependency graph G=(N,E) based on the current enclosure structure and wiring relationships. The node set N includes at least physical deployment nodes (such as enclosure covers, supports, antennas, cables, and vents), resource path nodes (such as main power buses, backup radios, and local displays), and critical command nodes (such as takeoff, return cancellation, route change, and payload operation). The directed edge set E represents how changes in the state of upstream nodes alter the availability or duration of downstream nodes.

[0067] Understandably, the rules for establishing dependencies are predefined by the product configuration table and wiring configuration, and are dynamically corrected based on the actual connection status detected on-site.

[0068] For example, the cover angle node points to the "local display visibility" node via a directed edge, indicating that the display is not visible if the cover is closed; it points to the "antenna effective deployment" node, indicating that the antenna pattern is affected if the cover does not reach the preset deployment angle; and it points to the "heat dissipation channel cross-sectional area" node, indicating that the natural convection heat dissipation area decreases if the cover opening is reduced.

[0069] External power supply nodes are directed to the "critical bus power supply" node via directed edges. If the external power is disconnected, the critical bus needs to be switched to the battery. They are also directed to the "non-critical computing branch" node. If the external power is abnormal, non-critical loads can be unloaded first.

[0070] The main communication link node points to the "telemetry feedback" node, the "command sending" node, and the "execution receipt" node via directed edges.

[0071] The security control appliance generates a deployment state version based on the current dependency graph and input snapshot. The version generation method involves the security control device maintaining a globally monotonically increasing counter. Whenever an event occurs that alters the dependencies of critical instruction nodes, this counter is incremented by 1, and the current timestamp and event summary are associated and stored. Events that trigger version incrementing include, but are not limited to, changes in the cover angle exceeding a preset threshold (e.g., ±3°), changes in antenna retraction or extension status, changes in support unlocking or locking status, changes in cable plugging / unplugging status, loss or restoration of external power, communication link primary / backup switching, user interface migration, vent operation, temperature exceeding a preset threshold (e.g., exceeding 60°C or falling below -10°C), or sensor failure status changes.

[0072] Optionally, for high-frequency numerical fluctuations that are only used for display and do not change the dependencies, such as temperature fluctuations within ±0.5℃ or humidity fluctuations within ±2%RH, a hysteresis comparator can be used. For example, the hysteresis can be set to 2% of the full scale of the measured value, or the duration can be de-jittered. If the state remains stable for more than 1 second, it is considered a valid change, thus avoiding meaningless and frequent version updates.

[0073] In practical applications, the version can be a monotonic count value, an event digest hash, or a timestamped configuration identifier; its purpose is not encryption itself, but to enable the command gateway to determine whether the physical facts on which an authorization is based are still valid.

[0074] Step S200: In response to the critical flight control command to be sent, determine the command continuity required for the critical flight control command according to the command type, and determine the resource path bundle of the critical flight control command according to the physical deployment dependency graph.

[0075] It should be noted that critical flight control commands refer to commands that, if sent incorrectly, repeatedly, with delayed confirmation, or lost mid-flight, would alter the safety or mission status of the UAV. These commands include, at a minimum, takeoff, return-to-home cancellation, route change, and payload manipulation. The safety control equipment pre-stores configuration tables for various types of critical flight control commands. These tables include, at a minimum, the following: criticality (high / medium / low), reversibility (reversible / irreversible), maximum execution time limit (e.g., 15 seconds for takeoff commands, 30 seconds for route change commands), required confirmation level (levels 1 to 4, with level 4 being the highest), required feedback type (feedback required / no feedback required), a list of candidate resource paths, allowed degradation methods, and a safety takeover strategy after loss of contact. For example, the takeoff command is configured as follows: criticality "high", reversibility "reversible" (can be cancelled if not lifted off the ground), maximum execution time "15s", required confirmation level "Level 3", and safety takeover strategy "maintain ground safety status if not taken off"; the return cancellation command is configured as follows: criticality "extremely high", reversibility "irreversible" (re-determine the course after cancelling the return), maximum execution time "5s", required confirmation level "Level 4", and safety takeover strategy "keep the return valid if there is ambiguity".

[0076] Instruction continuity This refers to the length of time from when the ground station operator generates an instruction until the drone completes execution confirmation or enters a preset safe takeover state, during which the system needs to maintain the continuous availability of critical resources. The specific calculation method is as follows: the security control device reads the configuration table of the instruction, adds up the estimated sending time, the UAV repeat processing time, the submission transmission time, the execution receipt waiting time, and the time to enter the security takeover state in case of an anomaly, and adds an additional 10% system time margin to cover instantaneous link jitter and processor scheduling latency. For different instructions, the required continuous time and acknowledgment level are different, and the system calculates them independently according to their respective configurations.

[0077] In this embodiment, the estimated transmission time depends on the message length and transmission rate under the current link quality; the UAV repeat processing time depends on the response cycle of the UAV flight control computer, which is generally 500ms to 2s; the submission transmission time depends on the link round-trip time; the execution receipt waiting time depends on the response time of the UAV actuator, such as 3s for the takeoff unlocking mechanism and 2s for the payload operation; the time to enter the safe takeover state in case of an anomaly is such as the trigger delay of the airborne lost contact return procedure.

[0078] The safety control equipment determines the mandatory dependency nodes of the command based on the physical deployment dependency graph, which is the set of all upstream nodes that the command node depends on in the dependency graph. For example, the upstream nodes that the takeoff command node depends on simultaneously include the support locking node, the canopy angle node, the antenna deployment node, the critical bus power supply node, the bidirectional link node, and the operator verification interface node. Understandably, the support locking node ensures the stability of the ground station operating platform; the canopy angle node ensures the visibility of the display and the correct antenna direction; the antenna deployment node ensures the effectiveness of the communication link; the critical bus power supply node ensures the operation of the command gateway and radio; the bidirectional link node ensures message transmission and reception; and the operator verification interface node ensures manual confirmation. These dependencies are determined by the directed edges of the dependency graph. For example, starting from the "support locking" node and reaching the "takeoff command" node along the directed edge indicates that the support locking is a prerequisite dependency of the takeoff command.

[0079] Based on this, paths that do not meet the mandatory dependency conditions are excluded from the candidate resource path list. A candidate resource path refers to a combination of physical or logical channels that can provide the resources required for critical instructions. The security control device retains valid candidate paths with mandatory dependency nodes and removes candidate paths with invalid mandatory dependency nodes, resulting in a set of candidate resource path bundles.

[0080] In one possible implementation, step S200 may include:

[0081] Based on the physical deployment dependency graph, determine the candidate resource path bundle for the key flight control commands;

[0082] Calculate the power supply availability continuity, thermal availability continuity, communication link availability continuity, physical deployment availability continuity, and user interface availability continuity for each candidate resource path bundle to obtain the total availability continuity value for each candidate resource path bundle.

[0083] Based on the total available continuity value, the instruction continuity, and the safety margin, the resource path bundle is obtained by filtering from each of the candidate resource path bundles.

[0084] In this embodiment, the safety control device extracts all upstream resource path nodes that the critical command node depends on from the dependency graph, and traverses all currently available physical resources and logical channels to form a candidate resource path bundle list. For example, for a takeoff command, the dependency graph shows that it requires four types of resources: power path, communication path, physical deployment path, and interface path. Candidate power paths include "external power supply, AC / DC module, critical bus" and "battery, DC / DC module, critical bus"; candidate communication paths include "main radio link" and "backup radio link"; physical deployment paths include the currently deployed enclosure, support, and antenna attitude; and interface paths include "local display, joystick" and "remote terminal, touchscreen". The safety control device arranges all feasible combinations of the above paths and eliminates combinations containing invalid forced dependency nodes. For example, if the quality of the main radio link is lower than a preset threshold, all combinations containing the main radio are eliminated, resulting in a candidate resource path bundle set, denoted as . .

[0085] Then, for each candidate resource path bundle Calculate the available continuity prediction values ​​for each of the five dimensions.

[0086] Specifically, power supply continuity This estimate is based on a comprehensive assessment of current battery availability, external power supply reliability, critical bus load power, switching time, and reserved operating energy. If the external power supply is currently stably connected and its voltage fluctuation is verified to be within ±3% and its frequency within 50Hz ± 0.5Hz, then... The expected continuous power supply time from the external power source is taken. This is generally considered infinitely long under normal circumstances without external interruption; however, considering that field generators may have limited fuel, a conservative value, such as 2 hours, can be taken based on the fuel meter reading or the time agreed upon in the power supply contract. If the external power source is abnormal or not connected, then... =(Battery state of charge) × Nominal battery capacity × Depth of discharge factor × Battery health factor) / Total power of critical bus load, minus the time allocated for energy reserved for link switching, data write-to-disk, and actuator actions. For example, assuming a nominal battery capacity of 1000Wh, currently... Assuming a discharge rate of 80%, a depth-of-discharge factor of 80% to ensure the battery is not over-discharged, and a health factor of 95% (reflecting the degree of battery aging), with a total load power of 150W on the critical bus, the basic power supply time is (1000×0.8×0.8×0.95) / 150≈4.05 hours. After deducting the energy reserved for link switching (e.g., 0.028Wh), data write-to-disk (e.g., 0.028Wh), and actuator operation (e.g., 0.042Wh), the time deduction is calculated as follows: ≈4.04 hours. In rapid evaluation scenarios, it can also be... Discretize into four levels: sufficient (>30 min), restricted (5 to 30 min), critical (1 to 5 min), and unusable (<1 min).

[0087] Thermal continuity This estimate is based on the current temperature, enclosure heat capacity, heating power, heat dissipation channel status, ambient temperature, and temperature rise trend. Safety control equipment uses the current internal temperature. Starting from this point, obtain temperature samples over a recent period, such as the past 5 minutes; calculate the rate of temperature change dT / dt using a least-squares linear fit; and combine this with the current state of the heat dissipation channels. (e.g., fan speed duty cycle 0% to 100%, vent opening 0% to 100%) and ambient temperature It is estimated that the temperature will rise from the current level to the protection threshold. (For example, the remaining time at 70°C). Specifically, the calculation is as follows: if dT / dt is positive (temperature increase), then... The coefficient reflects the effect of proactive thermal management measures such as frequency reduction and suspending non-critical loads on mitigating temperature rise. For example, if suspending non-critical loads reduces the temperature rise rate to 50%, the coefficient is 2. If dT / dt is negative (temperature reduction), then... Choose a large preset value (e.g., 24 hours) because the temperature is moving away from the protection threshold.

[0088] Link continuity Based on the current primary and backup link signal strength / signal-to-noise ratio, bit error rate / packet loss rate, latency, jitter, quality degradation rate, and backup link status, the security control device estimates the remaining time before the SNR drops to the minimum usable threshold (e.g., 10dB) by obtaining the current link's signal strength RSSI (in dBm) and signal-to-noise ratio SNR (in dB). Referring to a preset link quality mapping table (e.g., SNR > 20dB is excellent, 15-20dB is good, 10-15dB is usable, <10dB is unusable), and considering the SNR trend over a past period (e.g., 1 minute), it predicts the remaining time before the SNR drops to the minimum usable threshold (e.g., 10dB). Simultaneously, if a backup link exists and is in hot standby mode (i.e., authentication handshake and frequency synchronization have been completed), then... This can be extended to a weighted combination of the primary link prediction time and the backup link prediction time after the switchover. For example, if the current primary link SNR is 25dB, decreasing at a rate of 0.5dB / min, the remaining time to reach the 10dB threshold is 30 minutes; if the backup link SNR is 20dB, decreasing at a rate of 0.2dB / min, the remaining time to reach the 10dB threshold is 50 minutes; because the backup link can be switched over, therefore... Take the larger of the two values, i.e., 50 minutes, but deduct the link switching time (e.g., 3 seconds) and the verification time of the first packet after the switch (e.g., 1 second).

[0089] Physical continuity Based on the current support / cover / antenna locking feedback status, enclosure attitude angle, rain / dust variation trends, and expected operational actions, the safety control equipment estimates whether all physical locking mechanisms are in the locked state (e.g., support locked in place, cover hinge locked in place, antenna deployed and locked in place) and obtains the current enclosure attitude angle (roll angle, pitch angle). If all locking states are valid and the attitude angles are within the allowable operating range (e.g., roll angle < 5°, pitch angle < 5°), then... Use a longer timeframe (e.g., 24 hours). If an increasing trend in rainfall or dust is detected, for example, if the raindrop sensor count has been continuously increasing over the past minute, then... The required adjustment period needs to be calculated based on the anticipated protection level maintenance time. For example, under heavy rain conditions, an IP54 protection level enclosure can maintain internal dryness for approximately 30 minutes. If a locking feedback signal is "not locked" or its confidence level is below a preset threshold (e.g., strain gauge signal is within the effective range but deviates from the normal value by more than ±20%), then that physical deployment node is set to "unavailable". =0.

[0090] Interface continuity The status is estimated based on the display status, input device status, operator verification interface, and remote interface status. The safety control equipment confirms normal display function by periodically sending query commands to the display and reading frame synchronization signals, and confirms online input devices by reading the communication heartbeats of the joystick, keyboard, and touchscreen. For commands requiring operator verification, such as return-to-home cancellation and payload release, it is also necessary to confirm that the verification interface (e.g., a confirmation dialog box) has popped up and that the operator has completed a preliminary confirmation. The calculation method is as follows: if all necessary display and input devices respond normally, then Use a longer time period (e.g., 24 hours); if intermittent loss of the display's frame synchronization signal or input device heartbeat timeout is detected, for example, if no joystick data packet is received for more than 500ms, then The estimated remaining time from the current moment until the interface becomes completely unusable can be calculated based on historical failure rate statistics or preset health thresholds.

[0091] After calculating the five continuous components mentioned above, for the candidate resource path bundle Take the minimum value of each component and deduct the path switching time. For example, the contactor action time required for power switching is 3ms, the bus stabilization time is 50ms; the protocol re-establishment time required for communication link switching is 1s to 3s; and the actuator response time required for physical attitude maintenance is 100ms. This yields the total available continuity value of the path bundle. .

[0092] The security control device applies to all candidate resource path bundles. Comparing its Continuity required with instructions Plus safety margin The size relationship. The value is determined statistically based on historical link jitter data, power switching test data, and thermal test data. For example, in field environments where link quality fluctuates significantly, Desirable 20%; under power supply conditions with frequent power switching, A fixed value of 3 seconds can be taken. Only when... Only then is the candidate resource path bundle deemed to meet the requirements. The safety control device selects the appropriate path bundle from all meeting the requirements, according to... Sort the values ​​from largest to smallest, and select the path bundle corresponding to the largest value as the final selected resource path bundle. If none of the candidate path bundles meet the requirements, the safety control device will reject the critical command request, return a message to the operation interface stating "Insufficient current resources, unable to safely execute the command," and switch the system to restricted monitoring mode or derated flight control mode.

[0093] Thus, by taking the minimum value of each component and deducting the switching time, this embodiment avoids misjudgments caused by sufficient resources in one dimension but scarce resources in other dimensions, compared to the weighted scoring methods commonly used in the prior art. For example, a weighted scoring method might assign weights of 40% to power continuity, 30% to communication continuity, and 30% to physical continuity. When the power continuity score is extremely high but the physical continuity score is 0, the weighted total score may still reach more than 40 points (assuming a maximum score of 100), thus misjudging it as "safe." However, the minimum value strategy of this embodiment directly propagates a physical continuity of 0 to a total available continuity value of 0, thereby accurately rejecting the instruction and avoiding permission for takeoff when physical conditions such as the enclosure cover not being locked or the antenna not being deployed are not met. At the same time, using the actual feedback of resource reservation as a prerequisite for path selection further ensures that the selected path bundle not only meets the continuity requirements in prediction but has also been pre-verified at the actual operation level. Taking link switching as an example, when the quality of the primary link degrades, the system predicts that the backup radio link can meet the communication continuity requirements. However, only after completing the authentication handshake and bidirectional test message transmission and reception of the backup link and receiving successful feedback is the backup link included in the available path bundle set, thus avoiding the risk of switching failure where the link is predicted to be available but is actually unavailable. This achieves quantitative assessment and path optimization of the resource continuity required for critical flight control commands.

[0094] Step S300: Send resource reservation requests to each resource path in the resource path bundle, and after receiving a qualified response, generate a one-time permission lease that binds the deployment status version and the resource path bundle.

[0095] In this embodiment, after selecting a resource path, a resource reservation request is first sent to each resource path in that path, and then the actual feedback is awaited.

[0096] Specifically, for the power path, a request to "maintain critical bus power and reserve power for command gateway and selected radio" is sent to the power management unit, and the critical bus voltage and contactor feedback signal are read. The power reserve feedback is qualified only when the bus voltage is stable within a preset range, such as 24V±5%, and the contactor feedback is "closed".

[0097] For the communication path, a request to "set priority queues and reserve bandwidth for control messages and acknowledgments" is sent to the communication routing unit, and the link reachability is confirmed by sending bidirectional test messages, such as PING commands or handshake sequences. The communication reservation feedback is only qualified if the round-trip delay of the test messages is lower than the maximum allowable delay of the instruction, such as no more than 200ms for takeoff instructions, and the packet loss rate is less than 1%.

[0098] For the thermal management path, if the current thermal margin is tight, the safety control device sends a request of "suspending video encoding, artificial intelligence inference or other non-critical loads" to the environment adjustment unit, and reads the current drop feedback of the non-critical loads. The thermal management reservation feedback is qualified only when the critical load current remains stable and the temperature rise rate drops to a preset value, for example, no more than 0.5°C / min.

[0099] For the physical deployment path, if it is necessary to maintain the attitude of the antenna or the box cover, the safety control device sends an instruction of "maintaining the current attitude" to the deployment state acquisition unit, and continuously monitors the feedback of the angle sensor. The physical attitude maintenance feedback is qualified only when the angle fluctuation does not exceed the allowable range, such as ±1°, within a preset window, such as 100ms.

[0100] For the operation interface path, send a request of "maintaining the necessary display / input interface" to the operation interface management unit, and read the frame synchronization signal of the display and the heartbeat signal of the input device. The interface reservation feedback is qualified only when both of them exist continuously.

[0101] After confirming that the feedbacks of all paths are qualified, the safety control device determines that the resource reservation has been successfully established on the actually available resources. At this time, the safety controller generates a one-time permission lease . including the instruction type and transaction identifier , the current deployment state version , the path identifier of the selected resource path bundle , the validity period , the anti-replay sequence number Seq, the acknowledgment level Ack, and the invalidation policy Policy after state change or timeout. It should be noted that is used to uniquely identify this instruction transaction; is used for subsequent validity verification; includes the power path ID, communication path ID, physical path ID and interface path ID; is calculated from the generation moment to the duration plus the safety margin ; Seq is a monotonically increasing count value, which is used to prevent historical instruction messages from being maliciously replayed; Ack is read from the configuration table and used for verification on the unmanned aerial vehicle side; Policy is, for example, "terminate directly if invalid before submission" or "enter status query if invalid after submission". This lease is only used for the single transaction of the key flight control instruction to be sent this time, and will not be reused by subsequent similar instructions.

[0102] In step S400, the key flight control instruction is sent based on the one-time permission lease and the instruction transaction.

[0103] After the lease is generated, critical flight control commands are sent according to the preset command transaction process. The command transaction employs a multi-phase interaction protocol. During the transmission process, the safety controller re-verifies before executing each transaction phase whether the current deployment state version is still equal to the version recorded in the lease. Is the current time still valid? The system checks whether the feedback from the selected resource path remains valid. If any of the above checks fail, the transaction is terminated and a safe rollback is performed based on the current state.

[0104] Step S500: When a new event that changes the physical deployment dependency graph is detected, update the deployment status version, and perform invalidation, status reconciliation, or security rollback on the one-time permission lease according to the instruction transaction of the current stage.

[0105] Continuously monitor state changes during command transaction execution. Upon detecting a new event that alters the physical deployment dependency graph, such as an accidental move of the enclosure cover, an antenna being touched and folded, an external power plug being unplugged, a communication link interruption, or an unresponsive user interface, immediately record the event type, occurrence time, triggering sensor ID, currently ongoing command transaction ID, and current lease status to the event logging unit; increment the deployment state version. (For example from) Change to Then, based on the specific stage the current instruction firm is in, a differentiated handling strategy is implemented for the lease.

[0106] For example, if the event occurs before the instruction is submitted, the lease is invalidated and no flight control instructions are sent; if the instruction has been issued but the final execution confirmation has not yet been received, critical bus power supply and certified communication links are maintained, non-critical traffic is suspended, and the current status of the UAV is queried by the transaction sequence number to confirm whether the UAV has received and executed the instruction; if the UAV has completed the execution, a subsequent rollback strategy is selected based on the current flight control status and the latest physical conditions. For example, if the return-to-home cancellation instruction has been executed but the link is subsequently interrupted, the course after cancellation is maintained and communication is monitored for recovery.

[0107] In the technical solution provided in this embodiment, by establishing a physical deployment dependency graph and explicitly modeling the downstream dependencies between various state variables, changes in physical states such as lid angle, support locking, and antenna deployment can be propagated to critical command nodes that depend on them through directed edges. When the upstream physical state changes, the state of downstream nodes in the dependency graph can be automatically traced and re-evaluated. Furthermore, the deployment state version increments with any event that changes the dependency conditions, binding a one-time permission lease to the complete physical deployment snapshot at the time the lease is generated.

[0108] Taking the takeoff scenario as an example, when the operator completes deployment... Get version-based After the takeoff lease expires, if At +2 seconds, the antenna folded due to accidental touch (triggering a version update). ), then in At +3 seconds, when the operator attempts to use the lease to send takeoff instructions, the safety control equipment verifies the current version. Tied to the lease The inconsistency leads to the rejection of the instruction. This avoids the vulnerability where permissions remain valid once granted, meaning that buttons that were previously enabled on the interface can still be clicked to send instructions even after their physical state has changed.

[0109] Meanwhile, this embodiment avoids the risk of execution interruption caused by resource reservation failure but instruction already being sent by requiring a reservation request to be sent to the resource path and reading the actual feedback.

[0110] For example, in power switching scenarios, existing solutions may consider the switching complete simply by sending a "please switch to battery" command to the battery management system. However, in reality, the voltage may drop after switching due to contactor sticking or the bus capacitor not being fully charged. This embodiment reads the actual value of the key bus voltage as feedback to ensure that the switching has actually been completed and the voltage has stabilized before allowing the command to be sent, thereby improving the reliability of command execution.

[0111] In summary, this embodiment achieves dynamic binding between the physical deployment status of the protective box and the permissions of key flight control commands.

[0112] Based on the first embodiment of this application, in the second embodiment of this application, the same or similar content as the above embodiment can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 2 Step S400 may include steps S410 to S450:

[0113] Step S410: Send an intent message to the drone. The intent message includes the instruction intent, transaction identifier, and necessary parameters.

[0114] It should be noted that after confirming the lease is valid and the current version remains unchanged, the intent message is encapsulated and sent according to the communication protocol agreed upon with the UAV flight control system. The intent message includes at least the following: command type field, transaction identifier field, command parameters, and lease summary. The command type field, for example, "TAKEOFF" indicates takeoff, and "RTL_CANCEL" indicates return-to-home cancellation; the transaction identifier field is generated by the safety controller and includes the low-order bits of the timestamp, the low-order bits of the safety controller ID, and the low-order bits of the sequence number; command parameters, for example, a takeoff target altitude of 50m, or a list of new waypoint latitude and longitude coordinates after a route change; the lease summary includes the lease validity period and confirmation level for UAV verification. The intent message uses forward error correction coding, such as convolutional codes or Reed-Solomon codes, to improve anti-interference capabilities and is sent through a priority queue on the selected communication path.

[0115] Step S420: Perform drone recitation and readiness verification, receive the recitation content and current flight status returned by the drone, and verify the recitation content based on the operator's intention and the one-time permission lease.

[0116] In this embodiment, after receiving the intent message, the UAV's flight control computer parses the instruction type, parameters, and transaction identifier. Based on its current flight mode (e.g., ground standby, in flight, return-to-home, etc.) and state machine stage (e.g., self-test complete, GPS locked, engine / motor started, etc.), it determines whether the instruction can be executed. If execution is possible, the UAV encodes the parsed instruction type and parameters along with its own understanding, and encapsulates this information, along with its current flight status including flight mode, latitude and longitude, altitude, ground speed, heading, remaining battery power, and other key telemetry data, in a repeat message. This message is then sent back to the ground station via the communication link. If the UAV determines that the instruction cannot be executed, the repeat message includes a rejection reason code, such as "Currently in return-to-home mode, cancellation refused" or "Battery power below safety threshold, takeoff refused."

[0117] After receiving the repeat message, the safety controller performs a verification operation:

[0118] Verify that the type of instruction repeated is consistent with the operator's original intent. For example, if the operator's intent is to take off to an altitude of 50m, but the drone repeats "take off to an altitude of 30m", then there is a discrepancy, and an alarm should be issued.

[0119] Verify that the repeated instruction parameters are consistent with the parameters entered by the operator, such as whether any errors occurred in the latitude and longitude coordinate data during transmission;

[0120] Verify that the transaction identifier in the repeat message matches the sent transaction identifier to prevent the repeat message from being associated with an incorrect instruction transaction;

[0121] Verify that the drone's current flight status meets the prerequisites for executing the command. For example, a takeoff command requires the drone to be in a ground standby state and have its GPS locked; a return-to-home cancellation command requires the drone to be in return-to-home mode.

[0122] Verify that the current deployment version is still equal to the one recorded in the lease. ,like If changes have been made, the transaction should be terminated immediately.

[0123] Step S430: When the recitation content has been verified and the deployment status version has not changed, the key flight control command is sent to the drone.

[0124] Once all the above verification items have passed, the safety control equipment generates a submission message, which contains complete execution parameters and authorization information for key flight control commands. In addition to the repeat command type, transaction identifier, and necessary parameters, the submission message also includes the lease validity period and confirmation level fields for the UAV to verify again before execution. The submission message is sent through a priority queue on the selected communication path. After sending, the safety controller starts a timer, waiting for the execution confirmation.

[0125] Step S440: Receive receipt, receiving the execution result and current flight control status returned by the UAV.

[0126] After receiving the submission message, the UAV executes the command according to the confirmation level requirements in the lease. Upon completion of the command execution, or if an anomaly is encountered during execution, an execution receipt message is immediately generated. The execution receipt includes at least a transaction identifier, an execution result status code, the current flight control status, and an execution timestamp. It should be noted that the transaction identifier here is the same as that in the intent and submission messages; the execution result status code includes options such as success, failure, partial execution, and execution in progress; the current flight control status includes key telemetry data such as flight mode, position, and speed after execution. Upon receiving the execution receipt, the safety controller compares the transaction identifier to ensure the receipt corresponds to the current command transaction, records the execution result, and marks the lease as "used."

[0127] Step S450: During the instruction transaction, the critical flight control instruction is subjected to anti-replay verification according to the transaction sequence number, and the instruction execution result is subjected to integrity verification and status reconciliation according to the transaction sequence number and deployment status version.

[0128] Throughout the entire command transaction, the safety control equipment maintains the sequence number (Seq) of the current transaction, and all messages interacting with the UAV carry this sequence number. At the receiving end, the UAV's flight control system also records the sequence numbers of all transactions processed within a recent period (e.g., the past 5 minutes). When a message with the same sequence number as a processed transaction in the historical record is received, the UAV automatically discards the duplicate message and returns to the "processed" state. At the ground station, the safety control equipment also refuses to receive response messages with discontinuous sequence numbers or those that do not match the current transaction.

[0129] When the deployment status version changes, such as when a new event is triggered in step S500, the safety control device needs to query the current status of the drone based on the transaction sequence number to confirm whether the instructions sent before the version change have been executed by the drone. The specific reconciliation method includes the safety control device sending a status query message carrying the current transaction sequence number, and the drone returning the execution status of the instruction corresponding to that sequence number in the response (received and awaiting execution, executing, completed, timed out). If the query result shows "completed," the safety control device confirms that the instruction has been successfully executed, and subsequently selects a safety rollback strategy based on the current physical conditions. If the query result shows "received and awaiting execution" or "executing," the safety control device decides whether to allow continued execution based on the nature of the new event. For example, if the new event is a loss of external power but the battery switch is successful and continuity is sufficient, continued execution can be allowed; or a termination instruction can be issued. If the new event is a tilted enclosure causing the antenna to completely deviate from its pointing direction, a task pause instruction should be issued. If the query result shows "timed out," the safety control device considers the instruction lost, and the operator needs to re-initiate a new instruction transaction.

[0130] In the technical solution provided in this embodiment, a four-stage transaction model of intent, repetition, submission, and receipt is used. Each stage carries a unified transaction sequence number, enabling the ground station and the UAV to accurately restore the current execution status through status query and reconciliation mechanisms after a communication interruption occurs at any stage. Taking payload release as an example, when the ground station completes the submission stage and a communication interruption occurs during the receipt reception stage, the UAV status is first queried through the transaction sequence number after the interruption is restored. If the query result shows that it has been completed, the ground station confirms that the release has been successfully executed and will not resend, thereby avoiding the risk of repeated execution of irreversible instructions. At the same time, by incorporating the deployment status version into the verification conditions before each submission, it is ensured that the instruction is actually submitted only when the physical deployment conditions have not deteriorated throughout the entire transaction, further improving security.

[0131] As an optional implementation, step S500 may include steps S510 to S530:

[0132] Step S510: If the new event occurs before the step of sending the key flight control command to the drone, the one-time permission lease is invalidated, and the sending of the key flight control command is terminated.

[0133] Step S520: If the new event occurs when sending an intent message to the drone, or when performing drone repetition and readiness verification, maintain critical bus power supply and certified communication links, suspend non-critical traffic, and query the current flight status based on the transaction sequence number;

[0134] Step S530: If the new event occurs when the receipt is received, and the UAV has already executed the key flight control command, a safe rollback strategy is selected based on the current flight control status and current physical conditions.

[0135] It should be noted that when a new event is triggered, if the current command transaction is in a stage where a lease has been generated but the submission message has not yet been sent, the lease is directly marked as expired and removed from the lease cache. Simultaneously, a message "Permission expired; please reconfirm the physical status and initiate the command again" is returned to the operation interface. At this time, since the drone has not yet received any flight control messages related to this command, there is no need to send any revocation command to the drone; only the command transmission process within the ground station needs to be terminated. The safety control equipment simultaneously switches the system to deployment verification mode or restricted monitoring mode, waiting for the operator to confirm that the physical status has been restored or redeployment is completed before allowing the lease to be regenerated.

[0136] When a new event is triggered, if the current instruction transaction is in the stage where the intent message has been sent but the execution receipt has not yet been received, the protection action is executed:

[0137] First, the safety control equipment sends a critical bus lockout command to the power management unit to prevent any switching operations that could cause a power outage to the critical bus. For example, the system will not automatically shut down the critical bus due to energy-saving strategies, and the critical bus voltage is confirmed to remain within the normal range to ensure uninterrupted power supply to the critical bus.

[0138] Secondly, a communication link maintenance command is sent to the communication routing unit, and all non-critical data streams, including video backhaul data, non-real-time telemetry logs, and ground station status uploads, are suspended. All bandwidth is reserved for critical command messages and status query messages to ensure that the authenticated communication link remains open.

[0139] Then, a status query message is sent to the UAV through the existing communication link. This message carries the current transaction sequence number. The status query message is in the format of a lightweight query command, which does not contain any flight control content and only requests the UAV to return the current flight control status. After receiving the status query message, the UAV processes it with the highest priority and immediately returns a comprehensive status report containing the flight mode, position, speed, heading, and the execution status of the current command sequence number.

[0140] The safety control equipment determines the next action based on the "Instruction Sequence Number Execution Status" field in the status report. If the drone status report shows that the instruction corresponding to the transaction sequence number is "not yet received" or "received and pending processing," the safety control equipment marks the transaction as retryable. After the new event is processed, the physical status is restored, and a new version is generated, the operator decides whether to re-initiate the instruction transaction. If the drone status report shows that the instruction is "in execution," the safety control equipment continues to monitor until execution is complete or a timeout occurs. If a timeout occurs, the onboard contingency plan is followed. If the drone status report shows that the instruction is "completed," the safety control equipment marks the lease as used and then selects a safety rollback strategy based on the specific type of the new event.

[0141] When a new event is triggered, if the safety control equipment has already received an execution acknowledgment from the UAV, confirming that the critical flight control command has been executed by the UAV, then the lease has been consumed, and there is no possibility of revoking the executed command. At this time, the safety control equipment selects an appropriate strategy from a pre-set safety rollback strategy library based on the UAV's current flight control status (flight mode, position, altitude, etc. obtained from the execution acknowledgment) and the latest physical conditions of the ground station (cabin status, power status, communication status, etc. after the new event).

[0142] If a return-to-home cancellation command is executed and the ground station communication link is subsequently interrupted, the UAV will continue flying in the state after cancellation, such as continuing its original mission route. After the link is restored, the safety controller will check the UAV's current heading and position to confirm whether they match the expected state after the cancellation. If they do not match, the controller will prompt the operator to reassess the flight path instead of automatically resuming the return-to-home command or resending it. Understandably, return-to-home cancellation is irreversible, and resending the command could lead to state confusion.

[0143] For route change commands, if the ground station detects the container tilting and the antenna pointing completely off course after the execution confirmation, but the UAV has already flown along the changed route, the safety control equipment continuously monitors the UAV's status via a remote backup link, such as a cellular network. Simultaneously, the operator decides whether to send a mission pause or return-to-home command via the backup link based on the on-site situation, without automatically revoking the changed route.

[0144] For takeoff commands, if the ground station detects an unauthorized opening incident after the drone has taken off following the confirmation of the execution receipt, the safety control equipment maintains the minimum control path, that is, keeps the critical bus and the certified communication link uninterrupted, locks the local operating interface to prevent unauthorized personnel from operating, and sends an alarm to the remote command platform through the backup communication link, so that the remote operator can take over control.

[0145] For irreversible payload operations, such as drop, if the ground station detects any anomaly after the acknowledgment is executed, it cannot be reversed since the payload has already been released. In this case, the safety controller only records the complete timeline and evidence of the event, including the acknowledgment content, flight control status, and new event sensor data, for post-event traceability, without performing any automatic compensation actions.

[0146] If a new event occurs during the execution receipt reception stage but the receipt has not been fully received (i.e., the execution receipt was interrupted after being partially received), the safety control device will use the status query mechanism in step S520 to confirm whether the drone has actually executed the operation. If execution is confirmed, proceed to step S530; if execution is confirmed not to have been executed, proceed to step S520.

[0147] Thus, this application's embodiments, through a fine division of different transaction stages, specify three differentiated handling logics: direct termination before submission, maintaining the minimum path and querying the status after submission without confirmation, and selecting a rollback strategy based on the situation after confirmed execution. Taking the takeoff scenario as an example, if a new event occurs before the takeoff command is submitted, takeoff can be safely terminated and the ground status maintained; if a new event occurs after the takeoff command is submitted and the drone is in the taxiing acceleration phase, the link is maintained and the flight control status is queried, rather than directly cutting off the power, causing the radio to interrupt and the drone to lose contact at the critical point of takeoff; if a new event occurs after the takeoff execution receipt is confirmed, the minimum control path is maintained and the system switches to the emergency command dedicated mode, ensuring that the operator can still send return or hovering commands, thereby achieving a balance between container abnormalities and flight safety. This achieves differentiated protection measures while ensuring the continuity of the control link.

[0148] Based on the first embodiment of this application, in the third embodiment of this application, the same or similar content as the above embodiment can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3 Before step S500, the deployment and operation safety control method for the UAV ground station protection box further includes steps S610 to S640:

[0149] Step S610: When environmental degradation, power degradation, or communication link quality degradation is detected, an alternative resource path is determined based on the physical deployment dependency graph.

[0150] Step S620: Establish the alternative resource path and obtain confirmation feedback;

[0151] Step S630: After receiving the confirmation feedback, switch the critical instruction queue to the alternative resource path, update the deployment status version, and generate a new one-time permission lease;

[0152] Step S640: Release the original resource path.

[0153] It should be noted that environmental degradation includes situations where the internal temperature continues to rise and exceeds the warning threshold, for example, reaching 55°C, leaving only 15°C of clearance from the protection threshold of 70°C; or humidity continues to rise and exceeds the warning threshold, for example, relative humidity reaches 80%RH, approaching the risk of condensation; or the rainwater detection status changes from no rain to rain; or the dust detection concentration exceeds the equipment's allowable upper limit, for example, PM2.5 concentration exceeds 1000μg / m³.

[0154] Power state degradation includes external power supply voltage fluctuations exceeding permissible ranges, such as fluctuations exceeding ±10% for 220V AC input; or external power supply complete disconnection and battery state of charge falling below a preset threshold, for example... <30%.

[0155] Communication link quality degradation includes a continuous decrease in the main link signal-to-noise ratio below a preset low threshold, such as SNR < 15dB; or a continuous increase in latency exceeding a preset value, such as round-trip latency exceeding 500ms; or a packet loss rate exceeding a preset value, such as > 5%.

[0156] Upon detecting the aforementioned degradation, the safety control equipment first retrieves the current physical deployment dependency graph to identify the upstream resource nodes and their downstream dependent nodes affected by the degradation event. For example, a temperature rise affects the "heat dissipation channel cross-sectional area" node, which triggers frequency reduction due to temperature protection, thus affecting the "critical bus load power" node and the "command gateway operating temperature" node; rain detection affects the "cover opening" node, requiring the enclosure to be closed for rain protection, which in turn affects the "antenna effective deployment" and "local display visibility" nodes; external power disconnection affects the "external power supply" node, which in turn affects the "critical bus power supply" node.

[0157] Based on the propagation paths in the dependency graph, determine which alternative resource paths can mitigate the impact of the degradation event. For example, in a scenario where rain causes the need to retract the enclosure, the dependency graph shows "retracting the enclosure, reduced enclosure opening, antenna obstruction, and degraded main link quality." The alternative resource paths would be "activating the backup radio antenna (whose installation location is not obstructed by the enclosure cover)" or "switching to the cellular link (the antenna is located inside the enclosure, and retracting the enclosure does not affect it)." In a scenario where external power is disconnected, the dependency graph shows "loss of external power, critical bus needs to be switched to battery, limited battery capacity, and non-critical loads need to be unloaded." The alternative resource paths would be "pausing video backhaul loads and pausing storage expansion loads" to reduce bus power consumption.

[0158] For alternative communication links, the security control device sends a command to the communication routing unit to activate the backup radio / cellular module, perform frequency synchronization and authentication handshake, and waits for the backup radio to return a frequency lock signal and an authentication success response. Only when the backup radio completes frequency lock, for example, if the lock time is less than a preset value of 3 seconds and the device ID in the authentication response matches the preset value, is the feedback for establishing the alternative communication path considered successful.

[0159] For alternative power paths, the safety control device sends a command to the power management unit to put the battery DC / DC module into standby mode, preparing it to connect to the critical bus, and reads the output voltage feedback of the battery DC / DC module. The establishment feedback for the alternative power path is only considered successful when the output voltage is stable within ±5% of the critical bus's rated voltage (e.g., 24V ± 1.2V) and the current feedback indicates no overload.

[0160] For alternative thermal management paths, the safety control device sends a sequence of instructions to the environmental conditioning unit to reduce the power consumption of non-critical loads, such as reducing the video encoding bitrate from 50 Mbps to 10 Mbps, and reads the current drop feedback of non-critical load branches. The establishment feedback of the alternative thermal management path is only qualified when the current of each non-critical branch drops to a preset target value, such as below 30% of the original current and the temperature rise rate of the critical load drops below a preset value.

[0161] The security control device considers the new path ready only after all alternative paths have received confirmation feedback. If any alternative path fails to provide satisfactory feedback, the entire migration process is halted, and the security control device maintains the original path unchanged.

[0162] Once all alternative path feedback is satisfactory, the security control device performs a switchover operation. The currently active and pending critical command queues are transferred from the original resource path to the alternative resource path, and the path mapping is updated in the routing table. After the switchover, the security control device increments the deployment status version, automatically invalidating all leases based on the old version. Simultaneously, for ongoing command transactions, the security controller generates a new one-time permission lease based on the new version and the confirmed alternative resource path, and sends this lease to the UAV for reconfirmation via the alternative link. Upon receiving the new lease, the UAV checks it against its current flight control status; if the check passes, it replies with "Lease Update Confirmation." Upon receiving confirmation, the ground station continues subsequent command transaction interactions.

[0163] After confirming successful switching to the new path and confirmation of the new lease by the drone, the safety control equipment executes the release operation of the original resource path. It sends instructions to the power management unit to "disconnect the original external power supply branch (if switched to battery)" or "reduce the priority of the original power supply branch"; to the communication routing unit to "reduce the data priority of the original main link to the lowest level, and gradually shut down the transmit power"; and to the environmental control unit to "restore power to non-critical loads, but maintain priority markings." The release of the original path is done gradually. For example, after switching, the original communication link continues to receive but does not send high-priority instructions, continuously monitoring for 30 seconds. If no abnormalities are detected, it is then completely shut down to avoid communication loss due to momentary failure of the new path. If a new path failure is detected during the release process, it immediately rolls back to the original path and enters the emergency command dedicated mode.

[0164] If the alternative path establishment fails or the confirmation timeout occurs after switching (e.g., the drone does not reply with "lease update confirmation" within the preset time), the safety control equipment will roll back the incomplete alternative action, maintain the original path until it becomes unavailable or the safety time limit is reached, and switch to the emergency command dedicated mode, retaining only the minimum control path, such as a single backup radio, critical bus, and emergency command authority, and no longer accepting new non-emergency command requests.

[0165] In the technical solution provided in this embodiment, by establishing and confirming a new path, switching to it, and finally releasing the old path, it is ensured that at least one verified path is available at any given time. Taking power switching as an example, the battery DC / DC module is first put into standby mode and the output voltage is confirmed to be stable before the critical bus is switched to battery power. During this process, the critical bus is continuously powered by an external power source, and the voltage does not drop. After the bus is confirmed to be stable, the external power input is disconnected. Taking rain protection when the protective box is retracted as an example, the backup cellular link and remote operation interface are first established and confirmed to be available before the box cover is retracted. This allows the operator to monitor the UAV in flight via the cellular link during the retraction process. After the box is retracted, the original main communication link and local interface dependency are gradually released, achieving a coordinated unity between the physical environmental protection of the protective box and the continuity of flight control.

[0166] Further, step S610 includes: when rain or dust levels exceed limits and it is necessary to reduce the opening of the protective box lid or adjust the ventilation opening, assessing the negative impact of the action on the communication link quality or heat dissipation capacity, and obtaining an assessment result; based on the assessment result, selecting the backup communication link, remote operation interface, and / or reducing non-critical load power consumption as the alternative resource path that is not affected by the action or is least affected by the action.

[0167] It should be noted that the current rainfall intensity, such as light rain, moderate rain, heavy rain, or torrential rain, is obtained through a rainwater detection sensor; the current dust concentration is obtained through a dust detection sensor and compared with the equipment's allowable upper limit for dust concentration, for example, PM2.5 < 500 μg / m³ is considered safe, and > 500 μg / m³ requires protective measures. When the rainwater or dust conditions exceed the limits, the cascading effects of actions such as "reducing the opening of the enclosure" or "adjusting the ventilation vent status" are pre-calculated based on the physical deployment dependency diagram.

[0168] To mitigate the impact of enclosure opening angle on communication link quality, the dependency graph shows propagation paths for "enclosure opening angle, effective antenna deployment, and main link pattern." The safety control equipment pre-stores calibration curves for enclosure opening angle and antenna gain obtained through laboratory pattern testing. For example, the antenna gain is 5 dBi when the enclosure opening angle is 90°, drops to 2 dBi when the opening angle decreases to 45°, and drops to -3 dBi (i.e., signal attenuation exceeds 50%) when the opening angle decreases to 15°. Simultaneously, the dependency graph's path for "enclosure opening angle, local display visibility, and operator visual feedback" indicates that the local display is unreadable when the enclosure opening angle is less than 30°. Based on the current main link operating frequency and azimuth angle, and combined with the aforementioned calibration curves, the safety control equipment calculates an estimated residual signal-to-noise ratio (SNR) for the main link after the enclosure retraction operation.

[0169] The impact of adjusting vent settings on heat dissipation capacity relies on the propagation path in the diagram, which includes vent opening, heat dissipation channel cross-sectional area, thermal resistance, and temperature rise rate. The safety control equipment pre-stores a mapping relationship between vent opening and system thermal resistance. For example, the system thermal resistance is 0.5°C / W when the vent is fully open, rises to 0.8°C / W when the vent is 50% closed, and rises to 1.5°C / W when fully closed. Based on the current critical load heat output (e.g., 150W) and ambient temperature, the system calculates whether the stable temperature of the critical load will exceed the protection threshold (70°C) after the vent is closed, and the remaining time required to reach the protection threshold.

[0170] If the evaluation results show that reducing the cover opening will cause the main link signal-to-noise ratio to drop below the usable threshold, for example, SNR < 10dB, then an alternative communication link unaffected by the cover opening is selected. This could be an antenna installed on the back of the enclosure and not obstructed by the front cover, or a built-in cellular communication module with the antenna located in a fixed position inside the enclosure, independent of the cover opening, as an alternative communication path. If the alternative communication link has already been established and confirmed in step S620, then it is used as the alternative resource path.

[0171] If the assessment results show that reducing the opening of the container lid will obstruct the local display and prevent the operator from obtaining visual feedback, then a remote operating interface, such as a tablet computer or remote command post connected via a cellular link, should be selected as an alternative interface path.

[0172] If the assessment results show that closing the vents will accelerate the rate of temperature rise and reduce thermal headroom, then "reducing non-critical load power consumption" should be selected as the alternative thermal management path. Specific measures include reducing the video encoding bitrate from 50Mbps to 5Mbps and suspending unnecessary data storage write operations to reduce the heat generation power of critical loads from 150W to 80W, so that the rate of temperature rise remains at an acceptable level, for example, not exceeding 0.8°C / min, even after the vents are partially closed.

[0173] In step S620, the safety control device simultaneously establishes the aforementioned alternative communication path, alternative interface path, and alternative thermal management path, and obtains confirmation feedback for each. Only after all selected alternative paths are confirmed to be available is the action of reducing the lid opening or adjusting the vent status permitted. During the execution of the action, the safety control device continuously monitors key indicators (including link SNR, interface response delay, and temperature change rate). If any indicator exceeds the preset safety window, the lid closing action is immediately stopped and the opening is partially restored to the previous safe position.

[0174] Thus, this embodiment of the application pre-quantifies the chain reaction of "box retraction action, antenna obstruction, link attenuation" and "ventilation closure, heat dissipation deterioration, thermal protection" through a dependency graph. It systematically treats the physical protection action of the enclosure as an upstream event in the dependency graph, requiring the establishment of alternative resource paths unaffected by the enclosure protection action before execution, such as backup antennas, remote operation interfaces, and load derating. Taking a rain-affected box retraction scenario as an example, the establishment and confirmation of a backup cellular link are completed before box retraction, allowing the operator to continue monitoring and sending commands to the flying UAV through the cellular link after the enclosure is closed. Simultaneously, by suspending non-critical video transcoding loads, the heat dissipation requirement is reduced to within the heat dissipation capacity after the enclosure is closed. This achieves dual protection: rain protection without link interruption and ventilation closure without overheating, avoiding the dilemma of cutting off flight control paths to protect equipment. It achieves coordinated optimization of physical protection actions and flight control continuity in environmental degradation scenarios.

[0175] Based on the first embodiment of this application, in the fourth embodiment of this application, the same or similar content as the above embodiment can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 The deployment and operation safety control method for the UAV ground station protective box further includes steps S710 to S730:

[0176] Step S710: When illegal opening, impact to the enclosure, tilting of the enclosure, or abnormal power supply is detected, an abnormal event record is generated and the deployment status version is updated.

[0177] It should be noted that when the anti-theft lock on the enclosure changes from locked to unlocked, but no record of an operator unlocking via an authentication interface, such as fingerprint recognition, password input, or remote authorization command, it is considered unauthorized opening. Upon detecting unauthorized opening, the security control device immediately locks all local operating interfaces, disabling joysticks, touchscreens, and keyboard input, displaying only the alarm interface, and triggering the audible and visual alarm inside the enclosure. When the triaxial accelerometer inside the enclosure detects an instantaneous acceleration exceeding a preset impact threshold, such as >50g for <10ms, it is considered a severe impact event, meaning the enclosure has been dropped or subjected to external impact. When the triaxial accelerometer or tilt sensor inside the enclosure detects a roll angle or pitch angle exceeding the normal operating range, such as roll angle >15° or pitch angle >15°, and the duration exceeds a preset value, such as 3s, it is considered a enclosure tipping event. When the power management unit detects a short circuit, overvoltage, undervoltage, or a sudden drop in battery voltage (e.g., a drop of more than 10% within 3 seconds) in the external power supply, it determines it as a power abnormality event.

[0178] Upon identifying any of the above-mentioned anomalous events, immediately perform a recording operation. Generate an anomalous event record, which includes at least the event type code, trigger time, raw data from the triggering sensor (accelerometer triaxial values, angle values, voltage and current values, etc.), current deployment status version, a list of currently ongoing command transactions (including the sequence number, stage status, and lease ID of each transaction), and the current status of the selected resource path (connected / disconnected / quality value). This record is written to non-volatile memory and simultaneously sent as an encrypted alarm message to the remote command platform through all available communication links. Update the deployment status version. Incremental, automatically invalidating all unsubmitted leases based on older versions.

[0179] Step S720: Revoke the unsubmitted one-time permission lease, lock the local operation interface, protect critical data, and isolate non-critical devices.

[0180] In this embodiment, all one-time permission leases in the current lease cache are traversed. If a lease's status is "generated but not yet submitted," it is marked as "revoked" and removed from the cache. For leases with a status of "submitted but no receipt received," they are processed according to step S520, without blindly revoking them due to abnormal events.

[0181] A lock command is sent to the user interface management unit, causing the output signals of all local input devices (joystick, keyboard, touchscreen) to be blocked by software. The display switches to a unified alarm interface, showing the abnormal event type and a "Waiting for remote command" message. Locking the local interface does not affect the connection to the remote user interface. If a confirmed remote user interface exists, such as a tablet connected via a cellular link, the remote interface remains available.

[0182] All telemetry data cache, map data cache, and mission planning data cache of the currently flying UAV are forcibly written to non-volatile memory, and a data integrity check is generated. Before the write is complete, no power-off or reset operations that could cause data corruption are performed.

[0183] Send a power-off command to the power management unit to cut off power to non-critical loads. Non-critical loads include extended storage hard drives (excluding system disks), video encoding coprocessors (excluding flight control critical components), additional displays (if a multi-screen configuration exists), and USB peripherals (excluding joysticks and keyboards). The purpose of the isolation operation is to preserve critical bus power supply to the minimum control path as much as possible.

[0184] Step S730: If the UAV is in flight and a verified backup control link exists, maintain the minimum control path and switch to the emergency command dedicated mode.

[0185] After completing local isolation, the safety control equipment checks whether the drone is currently in flight. For example, it determines this by analyzing the flight mode in the most recently received telemetry data; if the flight mode is "airborne" or "mission in progress," it is considered to be in flight. If the drone is in flight, it further checks for the existence of a verified backup control link.

[0186] The verified standard is that the backup link has passed the authentication handshake and bidirectional test messages in the most recent status check, for example, within the past 30 seconds, and the round-trip latency is lower than a preset value, such as 500ms, and the packet loss rate is lower than a preset value, such as 3%. If multiple backup links exist, the one with the best quality is selected.

[0187] If a verified backup control link exists, maintain the minimum control path operation. Maintain power to critical buses and prevent critical loads from being disconnected due to isolation operations; keep the certified backup communication link open; keep the command gateway operational; switch the system's operating mode to Emergency Command Dedicated Mode. In this mode, safety control equipment only allows the following commands to be sent: hovering commands, return-to-base commands, mission pause commands, and control handover commands authenticated by the operator at a high level (e.g., biometrics, dynamic passwords). All other non-emergency commands, including requests for takeoff, route changes, load manipulation, and photography, are rejected. Simultaneously, the local interface being locked and the system entering Emergency Command Dedicated Mode are continuously communicated to the remote command platform via the backup communication link, awaiting remote operator instructions.

[0188] If no verified backup control link exists, no new ground station commands will be sent. Instead, the UAV will rely on its own onboard contingency plan for lost contact, such as a pre-defined return path or mission suspension strategy. During this period, the safety control equipment will continuously attempt to restore the communication link. Once the backup link is reconfirmed, the system will immediately switch to dedicated emergency command mode.

[0189] After an abnormal event is resolved, such as when the operator arrives on-site for re-authentication, the enclosure stabilizes, or the power supply stabilizes, the security control equipment does not automatically reinstate the old lease. The operator must complete a full identity verification, physical status re-collection, and deployment status version regeneration process before regaining critical command permissions according to the normal procedure.

[0190] In the technical solution provided in this embodiment, by distinguishing the protected objects into "critical control paths" and "non-critical equipment," only non-critical equipment is isolated while maintaining the minimum control path (critical bus, certified communication link, command gateway) in the event of an anomaly. This allows ground operators to still issue emergency commands such as hovering, return to home, or mission suspension to the UAV in flight via the verified backup link after a container malfunctions. Taking an unauthorized opening scenario as an example, if the opening event occurs during the UAV's flight path mission, the local interface is locked after detecting unauthorized opening to prevent unauthorized operation, but the remote cellular link and critical bus power supply are maintained. The remote command platform can still send a return to home command to safely recall the UAV, achieving simultaneous protection of ground equipment safety and continuous controllability of the aircraft. At the same time, by not automatically restoring old leases, the risk of misuse of old version permissions after an anomaly is avoided, requiring operators to re-complete the entire deployment verification process. This achieves partition protection and maintenance of the minimum control path under sudden severe events.

[0191] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the deployment and operation safety control method of the UAV ground station protective box of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0192] This application provides a safety control device for a UAV ground station protective box. The safety control device for the UAV ground station protective box includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the deployment and operation safety control method for the UAV ground station protective box in the above embodiment 1.

[0193] The following is for reference. Figure 5This document illustrates a structural schematic diagram of a safety control device suitable for implementing the UAV ground station protective box embodiments of this application. The safety control device for the UAV ground station protective box in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), vehicle-mounted terminals (e.g., vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The safety control device shown in the drone ground station protective box is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0194] like Figure 5 As shown, the safety control device of the UAV ground station protective enclosure may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the safety control device of the UAV ground station protective enclosure. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the safety control equipment of the UAV ground station protective case to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows safety control equipment for a UAV ground station protective case with various systems, it should be understood that it is not required to implement or possess all the systems shown. More or fewer systems may be implemented alternatively.

[0195] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0196] The safety control device for the UAV ground station protective box provided in this application adopts the deployment and operation safety control method for the UAV ground station protective box in the above embodiments. It can solve the technical problem of ensuring sufficient continuity of key flight control commands throughout the entire execution cycle when the physical deployment state of the protective box changes dynamically. Compared with the prior art, the beneficial effects of the safety control device for the UAV ground station protective box provided in this application are the same as the beneficial effects of the deployment and operation safety control method for the UAV ground station protective box provided in the above embodiments. Moreover, other technical features in the safety control device for the UAV ground station protective box are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0197] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0198] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0199] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the deployment and operation safety control method for the UAV ground station protection box in the above embodiments.

[0200] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0201] The aforementioned computer-readable storage medium may be included in the safety control equipment of the UAV ground station protective box; or it may exist independently and not be assembled into the safety control equipment of the UAV ground station protective box.

[0202] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by the security control device of the UAV ground station protection box, the security control device of the UAV ground station protection box: establishes a physical deployment dependency graph and generates a deployment state version based on the physical deployment state, environmental state, power state, communication state, and operation interface state of the protection box; responds to the critical flight control command to be sent, determines the instruction continuity required by the critical flight control command according to the instruction type, and determines the resource path bundle of the critical flight control command according to the physical deployment dependency graph; issues resource reservation requests to each resource path in the resource path bundle, and generates a one-time permission lease binding the deployment state version and the resource path bundle after receiving a qualified response; sends the critical flight control command based on the one-time permission lease and instruction transaction; and when a new event that changes the physical deployment dependency graph is detected, updates the deployment state version, and performs invalidation handling, state reconciliation, or security rollback on the one-time permission lease according to the instruction transaction at the current stage.

[0203] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0204] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0205] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0206] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-described deployment and operation safety control method for the UAV ground station protection box. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the deployment and operation safety control method for the UAV ground station protection box provided in the above embodiments, and will not be elaborated here.

[0207] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the deployment and operation safety control method for the UAV ground station protection box as described above.

[0208] Compared with the prior art, the computer program product provided in this application has the same beneficial effects as the deployment and operation safety control method of the UAV ground station protection box provided in the above embodiments, and will not be repeated here.

[0209] The above description is only a part of the embodiments of this application and does not limit the patent scope of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for safe deployment and operation control of a UAV ground station protective box, characterized in that, The deployment and operation safety control method of the UAV ground station protective box includes: Based on the physical deployment status, environmental status, power status, communication status, and operation interface status of the protective box, a physical deployment dependency graph is established, and a deployment status version is generated. In response to a critical flight control command to be sent, the required command continuity of the critical flight control command is determined according to the command type, and the resource path bundle of the critical flight control command is determined according to the physical deployment dependency graph; Send resource reservation requests to each resource path in the resource path bundle, and after receiving a satisfactory response, generate a one-time permission lease that binds the deployment status version and the resource path bundle; Based on the one-time permission lease and instruction transaction, the key flight control instructions are sent; When a new event that changes the physical deployment dependency graph is detected, the deployment state version is updated, and the one-time permission lease is invalidated, reconciled, or rolled back according to the instruction transaction of the current stage.

2. The deployment and operation safety control method for the UAV ground station protective box as described in claim 1, characterized in that, The step of determining the resource path bundle for the critical flight control commands based on the physical deployment dependency graph includes: Based on the physical deployment dependency graph, determine the candidate resource path bundle for the key flight control commands; Calculate the power supply availability continuity, thermal availability continuity, communication link availability continuity, physical deployment availability continuity, and user interface availability continuity for each candidate resource path bundle to obtain the total availability continuity value for each candidate resource path bundle. Based on the total available continuity value, the instruction continuity, and the safety margin, the resource path bundle is obtained by filtering from each of the candidate resource path bundles.

3. The deployment and operation safety control method for the UAV ground station protective box as described in claim 1, characterized in that, The step of sending the key flight control commands based on the one-time permission lease and command transaction includes: Send an intent message to the drone, the intent message including the instruction intent, transaction identifier and necessary parameters; Perform drone recitation and readiness verification, receive the recitation content and current flight status returned by the drone, and verify the recitation content based on the operator's intention and the one-time permission lease; Once the recitation content has been verified and the deployment status version has not changed, the key flight control command is sent to the drone. Execution receipt reception: Receive the execution result and current flight control status returned by the UAV; During the instruction transaction, the critical flight control instructions are subjected to anti-replay verification based on the transaction sequence number, and the instruction execution results are subjected to integrity verification and status reconciliation based on the transaction sequence number and deployment status version.

4. The deployment and operation safety control method for the UAV ground station protective box as described in claim 3, characterized in that, The steps of updating the deployment state version when a new event that changes the physical deployment dependency graph is detected, and performing invalidation, state reconciliation, or security rollback on the one-time permission lease according to the instruction transaction at the current stage, include: If the new event occurs before the step of sending the critical flight control command to the drone, the one-time permission lease is invalidated, and the sending of the critical flight control command is terminated. If the new event occurs when sending an intent message to the drone, or when performing drone repetition and readiness verification, maintain critical bus power supply and certified communication links, suspend non-critical traffic, and query the current flight status based on the transaction sequence number; If the new event occurs during the receipt of the execution receipt, and the UAV has already executed the key flight control command, a safe rollback strategy is selected based on the current flight control status and current physical conditions.

5. The deployment and operation safety control method for the UAV ground station protective box as described in claim 1, characterized in that, Before the steps of updating the deployment state version and performing invalidation, state reconciliation, or security rollback on the one-time permission lease according to the instruction transaction at the current stage when a new event that changes the physical deployment dependency graph is detected, the method further includes: When environmental degradation, power degradation, or communication link quality degradation is detected, alternative resource paths are determined based on the physical deployment dependency graph. Establish the alternative resource path and obtain confirmation feedback; After receiving the confirmation feedback, switch the critical instruction queue to the alternative resource path, update the deployment status version, and generate a new one-time permission lease; Release the original resource path.

6. The deployment and operation safety control method for the UAV ground station protective box as described in claim 5, characterized in that, The step of determining alternative resource paths based on the physical deployment dependency graph when environmental degradation, power degradation, or communication link quality degradation is detected includes: When rain or dust levels exceed limits and actions such as reducing the opening of the protective enclosure lid or adjusting the ventilation openings are required, assess the negative impact of these actions on communication link quality or heat dissipation capacity, and obtain the assessment results. Based on the evaluation results, the backup communication link, remote operation interface, and / or reduced non-critical load power consumption that are not affected by the action or are minimally affected by the action are selected as the alternative resource path.

7. The deployment and operation safety control method for the UAV ground station protective box as described in claim 1, characterized in that, The deployment and operation safety control method for the UAV ground station protective box also includes: When unauthorized opening, impact to the enclosure, tilting of the enclosure, or abnormal power supply is detected, an abnormal event record is generated, and the deployment status version is updated. Revoke unsubmitted one-time permission leases, lock the local operating interface, protect critical data, and isolate non-critical devices; If the drone is in flight and a verified backup control link exists, maintain the minimum control path and switch to the emergency command dedicated mode.

8. A safety control device for a UAV ground station protective box, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the security control method for the UAV ground station protective box as described in any one of claims 1 to 7.

9. A readable storage medium, characterized in that, The readable storage medium is a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps of the safety control method for the UAV ground station protective box as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the safety control method for the UAV ground station protective box as described in any one of claims 1 to 7.

Images