Unmanned system disconnection autonomous control method and system based on physical termination boundary

Abstract

The application discloses an unmanned system chain break autonomous control method and system based on a physical termination boundary, and belongs to the technical field of unmanned system autonomous control. A first unmanned equipment establishes a physical termination time limit in a local monotonic timing coordinate, and according to the time limit and a current physical state, admission judgment is performed on an achievable revocation trajectory, a revocation time and an energy constraint after a candidate task control action is implemented. A second unmanned equipment establishes a takeover no-earlier boundary according to a first legally received termination residual amount, an upper bound of a timing rate error of two ends and a safety margin, and sends a confirmation after a persistent submission. Termination boundary postponement adopts a unique update transaction identifier and a first reception anchor point, and is serialized on a same persistent transaction state as a subsequent generation activation, so as to avoid retransmission, network partition or device restart to cause the takeover boundary to move backward or overlapping control. The application is suitable for chain break autonomy and task takeover of unmanned aerial vehicles, unmanned vehicles and unmanned ships.

Description

Technical Field

[0001] This invention relates to the fields of autonomous control of unmanned systems, runtime safety control, communication fault tolerance, and multi-node task execution permission coordination, specifically to an unmanned system chain-breaking autonomous control method and system based on physical termination boundaries. Background Technology

[0002] Unmanned aerial vehicles (UAVs), unmanned vehicles (UAVs), and unmanned ships (USS) are widely used for tasks such as inspection, surveying, logistics transportation, area search, environmental monitoring, and facility maintenance. During mission execution, factors such as terrain obstruction, electromagnetic interference, link switching, network congestion, control node failure, or network partitioning can cause the currently executing UAV to lose communication with the mission control node or other UAVs. Existing technologies typically employ fixed communication timeout mechanisms, such as stopping, returning to base, or entering a safe mode, or allowing the currently executing UAV to continue its mission for a predetermined time before being taken over by a backup UAV.

[0003] The aforementioned communication timeouts primarily reflect the link status and cannot directly characterize the current speed, position, remaining energy, withdrawal distance, environmental disturbances, and actuator delays of the unmanned equipment. If the fixed timeout is too long, the unmanned equipment may be unable to safely exit before takeover after continuing its mission; if the fixed timeout is too short, it may cause unnecessary mission termination. When safety judgments are made solely based on the current state before the execution of candidate mission control actions, the new state after the candidate action may have already exceeded the safe withdrawal range.

[0004] In multi-unmanned equipment systems, if a backup unmanned equipment gains control solely based on the disappearance of its heartbeat or an independent takeover timeout, it may overlap with the control of the currently executing unmanned equipment under conditions of network partitioning, message delays, duplicate transmissions, or equipment restarts. This risk is further amplified if the current unmanned equipment can unilaterally extend its termination time, or if there is no definite, persistent commit order between termination boundary updates and backup takeover. Therefore, it is necessary to establish a common constraint between the physical safety exit period of the current unmanned equipment and the takeover authority of the backup unmanned equipment. Summary of the Invention

[0005] The purpose of this invention is to establish a current execution and subsequent takeover mechanism constrained by the same physical termination boundary, so that the first unmanned equipment continues to generate mission control output only when it can still be safely withdrawn on time, and the takeover of the second unmanned equipment is not earlier than the safe moment corresponding to the physical termination boundary.

[0006] The fault models considered in this invention include packet loss, delay, out-of-order delivery, duplicate transmissions, and network partitioning, as well as unmanned equipment crashes and restarts; within an effective timing session, the local monotonic timers at both ends do not back off, and their maximum relative timing rate errors relative to the reference time scale are respectively affected by... and Constraints: Persistent commits ensure consistency recovery after power failure; authenticated messages cannot be forged by unauthorized nodes; actual physical disturbances belong to a predetermined bounded set of disturbances. In situations where communication is unrecoverable for an extended period or timing continuity cannot be proven, this invention allows for sacrificing task continuity by keeping task control outputs off or subsequent execution credentials dormant.

[0007] To achieve the above objectives, the present invention provides an autonomous control method for unmanned systems based on physical termination boundaries, applicable to an unmanned system comprising at least a first unmanned equipment A and a second unmanned equipment B, comprising: configuring a first unmanned equipment A... The first execution certificate is used to configure the dormant first execution certificate in the second unmanned equipment B. The second execution certificate; the termination time limit for the first unmanned equipment A to establish a safe termination state set on the local monotonic timing coordinates. In the first generation Task control output previously read local monotonic timer value And calculate the remaining amount at termination. The second unmanned equipment B sends initial termination boundary information carrying the remaining termination amount to the second unmanned equipment B; when the second unmanned equipment B first legally receives the initial termination boundary information, it reads the local monotonic timing value. ,according to Takeover is initiated no earlier than the boundary, and initial confirmation information is replied to after persistent submission; the first unmanned equipment A opens the mission control output gate only after the initial confirmation information has been verified as valid, and only then... If the candidate task control action is allowed to proceed, the task control output gate is closed and the safety revocation control is initiated; if the second unmanned equipment B fails to verify valid task release information, it will persistently submit the first task control action only after the local monotonic timer reaches the takeover no earlier than the boundary. Activate the status and open the first The task control output gate. Among them, , , This represents the maximum relative timing rate error of the local monotonic timers at both ends. , This is a non-negative safety margin. This is the upper bound of the cancellation time for entering the set of safe termination states, starting from the set of candidate next states after the implementation of candidate task control actions. The latest local monotonic timer at which safe reversal can begin after the candidate task control action is implemented. Further, in one embodiment, the method specifically includes the following steps:

[0008] S1. For the mission unit, configure the first unmanned equipment A with the... The first execution certificate is used to configure the second unmanned equipment B. The second execution credential. The first execution credential must include at least the task unit identifier. intergenerational tasks First execution certificate identifier Designated second unmanned equipment identifier Task allowed status area Revoke the permitted status area Set of safe termination states Timed session identifier and integrity verification information; second execution credential record , and It serves as a preceding execution relation and remains dormant until activated.

[0009] S2. Establish a versioned termination boundary record for the first execution credential:

[0010]

[0011] in, To terminate the boundary version, Given the termination time limit on the local monotonic timing coordinates of the first unmanned equipment A, the set of conditions for A to complete entering the safe termination state is defined. The latest local monotonic time; At least cover , , , , and , Used to authenticate the corresponding record or message.

[0012] The first unmanned equipment A was generated for the first time. Task control output previously read local monotonic timer value Calculate the remaining amount at termination:

[0013]

[0014] The second unmanned equipment B reads the local monotonic timing value when it first legally receives the termination remaining amount. And establish takeover no earlier than the border:

[0015]

[0016] in, As a non-negative safety waiting margin, the maximum relative timing rate error of the local monotonic timers at both ends are respectively and Safety ratio satisfy:

[0017]

[0018] Therefore, even when timer A is at its slowest within the allowed range and timer B is at its fastest within the allowed range, the minimum actual waiting time for side B is still not shorter than that for side A. The corresponding maximum real remaining time; the communication transmission time will only further postpone B's actual takeover.

[0019] Second Unmanned Equipment B General , , , Current version , First legitimate anchor point reception , After persistent commit from dormant state, send initial confirmation information. ; At least binding , , , , , The identity and authentication information of B. The second unmanned equipment B uses the task unit identifier, task generation, first execution credential identifier, termination boundary version, timing session identifier, and message digest as initial transaction identification information. For the same initial termination boundary transaction, it uses the first valid reception anchor point. If it receives initial termination boundary information again that is consistent with the already persistently committed record, it maintains the reception anchor point and takeover not earlier than the boundary formed by the first valid reception, and does not recalculate or move the takeover not earlier than the boundary according to the second reception time of the duplicate message. If any item in the initial transaction identification information is inconsistent, the message is rejected. The first unmanned equipment A only persistently commits the first termination boundary transaction when the confirmation is valid and the current physical state satisfies the following formula. Activate the status and open the task control output portal:

[0020]

[0021] in, This is the upper bound of the cancellation time determined based on the current physical state of A. This is a non-negative safety margin; the initial activation delay needs to be taken into account and incorporated into the above inequality.

[0022] S3, No. While a candidate task is active, the regular task controller generates candidate task control actions. The dynamics of the first unmanned equipment A are expressed as follows:

[0023]

[0024] Before the candidate mission control action reaches the actuator, the first unmanned equipment A estimates the current state, the candidate mission control action, the actuator error, and the set of disturbances. Determine the set of candidate next states and demand Using this set as the initial set, the predetermined safe revocation control strategy is followed. Calculate using interval propagation, reachable set iteration, or equivalent conservative methods:

[0025]

[0026] If there exists a smallest positive integer This ensures that the envelope of the state trajectory during the cancellation process is located within... Inside and Then the upper bound of the cancellation time can be determined as:

[0027]

[0028] in, For discrete time steps, This is a conservative upper bound for the additional delay from the initiation of safety reversal to the actual effective implementation of reversal control, and is not included in the timeframes already factored in before the candidate task control action is implemented. Delayed and repeated calculations; conditions cannot be met within the predetermined prediction range. At that time, it was determined that the control actions of the candidate task did not meet the physical revocable admission conditions.

[0029] Let the latest local time at which safe reversal can begin after the candidate task control action is implemented be . The candidate task control action is allowed to pass through the task control output gate only if the region constraints are satisfied and the following equation holds:

[0030]

[0031] In implementations that take energy constraints into account, it may also be required that ,in This serves as the lower bound of available energy after the implementation of control actions for the candidate task. To safely remove the upper limit of energy consumption, Energy reserves are reserved for safety. If any access condition is not met, A will shut down the first... The task control output gate is activated and the safety undo control is initiated.

[0032] The first unmanned equipment A is also equipped with an independent monitoring task with a time limit for cancellation. The maximum monitoring period is set as follows: When the following formula is satisfied, the first control action is turned off without waiting for a new candidate task to be generated. Substitute task control output gate and initiate safe reversal:

[0033]

[0034] Candidate task control actions can be achieved through physically revocable access. , , , , , The ActionID and ExpireTime are bound together; before actually sending it to the executor, the task control output gate re-verifies the above context. If any key context changes, the current physical state no longer meets the original admission conditions, or the ExpireTime is reached, the candidate task control action is discarded.

[0035] S4, Same Version In the corresponding versioned termination boundary record It remains unchanged after establishment; the first unmanned equipment A can be established earlier than... Actively close task control output and enter undo at the appropriate time, but do not do so in the same version. Extend backwards. When extension is needed, establish... Update transactions:

[0036]

[0037] Among them, UpdateID uniquely identifies the update transaction within the current task, generation, execution credential, and timing session context; A is generated Time Read And calculate ; At least cover , , , , , , , and UpdateID.

[0038] The second unmanned equipment B was only in the first The second execution certificate remains dormant. The preceding execution relationship is matched with the timing session, the update transaction is verified to be valid, and it is confirmed again at the transaction linearization commit point. The update transaction can be committed at that time.

[0039] For each UpdateID, B establishes a unique receive anchor point using an atomic first write mechanism; for the same transaction, only the first processing branch that passes validity verification and successfully completes put-if-absent, compare-and-swap, or equivalent atomic condition update records the current local monotonic timer value as the first valid receive time. Duplicate messages must not overwrite the anchor point.

[0040] The second unmanned equipment B is established based on the aforementioned first legitimate reception time:

[0041]

[0042] B will release the new version, , UpdateID Or determined by it and As a single, persistent commit, update confirmation messages are then sent. ; At least binding , , , , UpdateID The identity and authentication information of B. The first unmanned equipment A is only in the... The proxy task is still active, and the current valid version is still [version number missing]. The current local time has not yet reached and The valid termination boundary will only be switched to valid if the verification is successful. and ; Press before switching Limit task control output.

[0043] After S5 and B have persistently committed the update transaction corresponding to a certain UpdateID, they will use the UpdateID, new termination boundary version, new termination timeout, new termination remaining quantity, and update transaction summary as the update transaction identification information; upon receiving the UpdateID again, , , and When all transactions are identical to those already committed, retain the record established during the first valid reception. and The takeover boundary must not be recalculated backward based on the time of re-receiving duplicate messages; when B is still in a dormant state, the corresponding acknowledgment can be resent; when B has already persistently committed to a high-generation active state, no further update acknowledgments that can extend the authority of previous generations will be generated. If any other item in the update transaction identification information corresponding to the same UpdateID is inconsistent, the transaction will be rejected.

[0044] S6. The second unmanned equipment B maintains persistent transaction states for the same task unit and its preceding execution relationships:

[0045]

[0046] Terminate boundary update transaction and the first Generational activation transactions operate on the same persistent transaction state and form a deterministic linear order through transaction locks, revision condition updates, or equivalent atomic mechanisms. If an update transaction commits first, higher-generation activations must proceed according to the new... Reassess; when high-generation activation occurs, persist the commit first, then target the preceding sequence. All requests to extend the termination boundary of the generation were rejected.

[0047] The second unmanned equipment B will only make a persistent commit after its local monotonic timer reaches the takeover corresponding to the current highest persistent commit version no earlier than the boundary. The activation status is activated, and the first step is opened after submission. Substitute task control output gate.

[0048] The first unmanned equipment A employs an irreversible state transition for the same mission generation; it cannot be reactivated after cancellation or termination. This only applies once A has entered... , No. The task release information (REL) can only be sent after the task control output gate is closed and the termination status is persistently committed. After verifying a valid REL, it can stop waiting for the current task release information. However, a persistent submission is still required first. Generational activation state. The subsequent generational task control output gate will only be opened after the persistent submission of the aforementioned higher generational activation state is completed.

[0049] After A or B restarts, the original timing session and takeover boundary will continue to be used only if the local monotonic timing coordinates can be proven to be continuous; if continuity cannot be proven, A's old generation task control output will remain closed, and B's successor execution credentials will remain dormant until a valid takeover boundary is re-established or a valid task release message is received.

[0050] While A is active, it can periodically send normal task status frames. When B receives a valid status frame that matches the current highest persistent commit version and whose timing session and execution credentials are compatible, it reads the local monotonic timer value. ,calculate:

[0051]

[0052] And update the takeover corresponding to the current version according to the following formula, no earlier than the boundary:

[0053]

[0054] Therefore, a normal task status frame can only maintain or tighten the takeover corresponding to the same termination boundary version before the boundary, and cannot extend it backward or create a new termination boundary version.

[0055] This invention also provides an autonomous control system for unmanned systems experiencing chain disconnection, comprising a first unmanned equipment A and a second unmanned equipment B. A includes at least the functions of execution credential management, state acquisition and candidate action generation, safe reversal prediction, termination boundary management, local monotonic timing, task control output gate, safe reversal control, and persistent state storage. B includes at least the functions of subsequent execution credential management, takeover boundary calculation, termination boundary version management, initial and update transaction duplication identification, transaction serialization, high-generation activation, task release verification, and persistent state storage. B maintains the first valid reception anchor point for the same initial and termination boundary transactions, and repeated initial messages must not be re-shifted to a takeover that is already established before the boundary. A generates task release information only after completing physical safe termination, closing the previous generation task control output, and persistently submitting the termination state. After verifying the validity of the task release information, B no longer needs to wait for the current takeover to be no earlier than the boundary, but must still persistently submit the subsequent generation activation state.

[0056] The persistent commit can employ transaction logs, power-loss protected non-volatile storage, or other mechanisms capable of creating a recoverable commit point after a power outage; integrity and authentication verification can employ message authentication codes, digital signatures, or equivalent mechanisms.

[0057] Compared with the prior art, the present invention has the following beneficial effects:

[0058] This invention uses the latest moment when the first unmanned equipment completes its physical safety termination. Simultaneously constrain the control actions of its candidate tasks and the takeover time of the second unmanned equipment, so that physical exit and subsequent takeover form the same time constraint, rather than relying on independent communication timeouts.

[0059] This invention uses the candidate next state after the implementation of the candidate task control action as the starting point for cancellation prediction, and sets an independent cancellation time limit monitoring, thereby reducing the risk that the first unmanned equipment will cross the final safe cancellation boundary due to new task actions or abnormal planning threads.

[0060] This invention utilizes the upper bound of the local monotonic timing rate error to establish a cross-device time mapping, and requires the second unmanned equipment to persistently submit a new takeover boundary before the first unmanned equipment obtains the extension permission when the termination boundary is delayed; retransmission of the same initial termination boundary information or update transaction shall not be allowed to be re-shifted to the established takeover boundary at the time of re-reception.

[0061] This invention enables termination boundary updates and high-generation activation to act on the same persistent state and form a definite linearized sequence, thereby reducing the risk of multiple unmanned equipment causing overlapping control outputs to the same task unit in the case of network partitioning, message retransmission, equipment restart, and concurrent delays and takeovers. Attached Figure Description

[0062] Figure 1 This is a schematic diagram illustrating the overall structure and execution credentials of an unmanned system.

[0063] Figure 2 A sequence diagram for establishing the initial termination boundary and the takeover boundary relationship;

[0064] Figure 3 A flowchart for the physical revocable admission process for task actions;

[0065] Figure 4 A schematic diagram illustrating the termination of boundary extensions, duplicate transaction processing, and serialization of high-generation takeover. Figure 4 (a) is the sequence diagram for the termination boundary extension and repeated update transaction processing. Figure 4 (b) is a schematic diagram of serialization of termination boundary update transactions and high generation activation transactions based on persistent transaction states;

[0066] Figure 5 This is a diagram illustrating the task status and abnormal recovery. Detailed Implementation

[0067] To make the technical solution, working process, and achieved effects of the present invention clearer, further description is provided below in conjunction with the accompanying drawings and embodiments. The following embodiments are used to illustrate the present invention and are not intended to limit the scope of protection of the present invention.

[0068] like Figure 1As shown, in one embodiment of a drone, the unmanned system includes a first unmanned equipment A and a second unmanned equipment B, each including a processor, a local monotonic timer, non-volatile memory, a communication interface, and a control output interface. A is equipped with a normal task control channel and a safety cancellation control channel. The task control output gate only controls whether normal task control actions can be delivered to the actuator. The safety cancellation control channel can still output predetermined safety cancellation controls even after the task control output gate is closed. (This is for a task unit.) A holds the first B holds the first execution certificate. Using the second execution certificate, B remains dormant until the takeover conditions are met.

[0069] In this embodiment, the UAV state can be represented as a combination of position, velocity, attitude, angular velocity, remaining energy, and operating mode; the mission-allowed state area. Allow airspace for normal missions, revoke the allowed status area. Includes mission airspace, return path, and safe hovering area, as well as a set of safe termination states. It can be set to enter a safe hovering state, land in a predetermined landing area, or enter a predetermined safe circling area at least one of the following: disturbance set. Used to cover wind disturbances, state estimation errors, and actuator model errors within a predetermined range.

[0070] When a timing session is established, A generates a timing session identifier CEA, and A and B each read their respective monotonic timers. The monotonic timers do not backtrack within the same timing session. If the maximum relative timing rate error of timers A and B is both 100 ppm, then it can be taken as... , and select ; safety waiting margin The settings can be adjusted based on timing quantization error, verification processing time, and engineering safety margin. In this embodiment, the settings are as follows: .

[0071] like Figure 2 As shown, let A have a local monotonic time value. When to create a version The termination boundary is taken as Then the remaining amount at the time of transmission is The initial termination boundary establishment information sent by A carries at least the following: , , , , CEA and .

[0072] If B has a local monotonic time value If this is the first time the information is legally received, then it shall be handled in accordance with... get B will specify the preceding relationships and versions. , , , , The dormant state is a persistent commit of a recoverable transaction, which is then generated. If the same initial setup information arrives repeatedly due to lost confirmation, B shall act accordingly. , , CEA and Identified as the same initial transaction, retaining the first valid reception. and Instead of shifting the takeover boundary back according to the arrival time of duplicate messages, if any item in the initial transaction identification information is inconsistent, B rejects the message and does not modify the persistently committed receive anchor and takeover boundary accordingly.

[0073] A received and verified Then, calculate the current physical state. For example, if at this time , , Then there is A can persistently commit the first... If the inequality is not satisfied, then A will not activate the task control output and will proceed to safe reversal.

[0074] like Figure 3 As shown, during the task execution phase, A first predicts the set of candidate next states after the actual implementation of each candidate task control action. For example, control cycle. The result is obtained from interval propagation or reachability set calculation. After initiating the safe reversal strategy, it is necessary to The predicted steps have been reached. Remove the upper bound of the additional delay on the control link. ,but The aforementioned Only the additional delay after the safety reversal is initiated is included; delays already reflected before the candidate task control actions are implemented are not counted again. The delay in the process.

[0075] Let the latest time at which safe reversal can begin after a certain candidate task control action is implemented be . ,and ,but ;like And the envelope of the completely canceled state trajectory is located in If the candidate action satisfies the temporal and spatial admission conditions, then, when considering energy constraints, for example... , , At the same time satisfy If so, the candidate action is allowed to pass through the task control output gate.

[0076] For another candidate task control action, if and ,but A prohibits the candidate action before it reaches the executing agency and closes the first... The task control output gate is used by the safety cancellation control channel to perform hovering, return, or landing control.

[0077] Independent revocation timeout monitoring does not depend on whether the normal task scheduling thread generates new actions. For example, if the current... , , , ,but The monitoring task immediately shuts down task control output and initiates a safe reversal, even if the normal task planning thread has already stopped running.

[0078] Candidate actions that pass the admission process can be compared with ActionID and the current... , The CEA and ExpireTime are stored together. Before the control output thread actually sends the action to the executor, the task status and termination boundary are read again. If the task has entered the cancellation or termination state, the timing session has changed, the version has changed, the current physical state no longer meets the original admission conditions, or the ExpireTime has been reached, the candidate action is discarded, thereby avoiding the old action being output even after the context has changed after the admission calculation is completed.

[0079] like Figure 4 As shown in (a), assuming the current version is , The task needs to be extended to A establishes And generate an update transaction identifier UpdateID= If A generates an update transaction ,but Upon receiving valid Previously, A still used and As the only valid termination boundary.

[0080] If B's ​​local monotonic time value The first legal receipt And still satisfying at the linearized submission point , and Then B establishes itself through the first atomic write mechanism. The only receiving anchor point, and calculate B first makes a persistent commit. , , , and Then it was sent. .

[0081] like Arrive at A normally, and A is still in position 1. The activation status and the currently valid version are still [not specified]. Local time has not yet been reached. Then atom A switches to and .like If lost, A will not pre-use a new one simply because a delayed transaction has already been sent. As before Perform candidate actions for admission and revocation of guardianship.

[0082] If A subsequently retransmits the exact same data... And duplicate messages occur at local time B. Upon arrival, B uses UpdateID, version, expiration date, remaining quantity, and Identified as the same committed transaction, continue to maintain the status of the first valid reception. and It is not permissible to The new anchor point is moved back to the takeover boundary; if B is still dormant, the acknowledgment corresponding to the original transaction can be resent.

[0083] If a new, delayed transaction that has not yet been committed arrives at B, the old takeover has not arrived before the boundary, i.e., the linearized commit point satisfies... If B rejects the delayed transaction, it will do so even if the higher generation activation transaction has not yet been finally written to non-volatile memory. Thus, the old takeover boundary that has already been reached will not be postponed again by a belated delay request.

[0084] like Figure 4 As shown in (b), the boundary update transaction and the first Activation transactions can be serialized using the same persistent object's Revision. Update transactions read the current Revision. Hibernation state and older versions, verification Then, submit the new version and new takeover boundary using a conditional update method and update the Revision to... ;Activate transaction to read the same version, And Revision, in The active state is only allowed to be committed if the Revision has not changed. If two transactions are concurrent, only one can successfully commit on the original Revision, and the other transaction will reread the latest persistent state before making a judgment.

[0085] For example, when a deferred transaction is committed first and At that time, originally based on and old The activation transaction, which was about to be executed, failed due to the revision change and must be reassessed based on the new boundaries; if the activation transaction commits first... At that time, the subsequent postponement was rejected because the second execution certificate was no longer in a dormant state.

[0086] A can also periodically send normal task status frames, which include the current version, timed session, execution credentials, sequence number, and termination remaining quantity. B at local time After receiving a valid status frame that matches the current highest persistent commit version, calculate... and only according to Update the current takeover boundary, so normal state frames cannot move established takeover boundaries backward.

[0087] like Figure 5 As shown, the same generational state of the first unmanned equipment A can be unidirectionally switched between hibernation, activation, deactivation, and termination. A completes safe deactivation and enters... Afterwards, first close the task control output gate and persistently commit the termination status, then send the task release information (REL). After verifying the REL, B can stop waiting for the current task release. However, a persistent submission is still required first. Once the activation status is active, open the task control output portal again.

[0088] If A restarts, and a hardware timer, trusted monotonic clock, or other mechanism can prove that the local timing coordinates after the restart are continuous with the original CEA, then the corresponding undo or wait processing can continue based on the restored persistent state; if continuity cannot be proven, the original CEA becomes invalid, and the old... The task control output remains off; latecomers... or The old generation must not be reactivated.

[0089] If B restarts, B will first recover from non-volatile memory. , UpdateID and If it can be proven that the local monotonic timing coordinates are continuous, B continues to rely on the recovered coordinates. Judgment: If continuity cannot be proven, B keeps the subsequent execution voucher dormant and does not directly determine the old voucher based on the time value after restarting. Arrived, and awaiting the re-establishment of a new takeover boundary that is certified and has completed a persistent commit, or the receipt of a valid REL.

[0090] If the network partition persists, A cannot obtain new delayed confirmations and therefore will not adopt a later physical termination timeout. A can only continue to output task actions that have passed physical revocable access within the original valid termination boundary, and will enter safe revocation if the remaining revocation time is insufficient. B, on the other hand, remains dormant until the current persistent takeover boundary is reached. After reaching the boundary, it decides whether to open the task control output gate based on the persistent commit results of the higher generation active transactions, thereby maintaining mutual exclusion of control permissions under the aforementioned fault model and timing error assumptions.

[0091] In the implementation of autonomous vehicles, state This can include position, longitudinal velocity, lateral velocity, yaw rate, steering status, remaining energy, and vehicle mode. This can be defined as a vehicle entering a predetermined safe parking area, its speed falling below a threshold, and establishing braking; in the implementation of unmanned surface vessels, This can be defined as an unmanned surface vessel entering safe waters and reducing its speed to below a certain threshold. Different equipment may employ different methods. , , The security undo control policy remains unchanged, but the versioned termination boundary, cross-device takeover boundary, and transaction commit relationship remain the same.

[0092] The candidate next state set and the undo trajectory envelope can also be implemented using polyhedral reachability set, interval analysis, terminal feasibility judgment in model predictive control, pre-computed safety set query, or other equivalent methods that can provide a conservative upper bound on the undo time. The serialization of termination boundary update and high generation activation can also be implemented using transaction lock, comparison and exchange, database condition update, or other equivalent mechanisms that can provide a single persistent linearization point.

[0093] The above embodiments are used to illustrate the technical solutions of the present invention and are not intended to limit the scope of protection of the present invention. Equivalent substitutions or modifications made by those skilled in the art without departing from the basic concept of the present invention may fall within the scope of protection of the present invention.

Claims

1. A method for autonomous control of unmanned systems based on physical termination boundaries, characterized in that, include: The first unmanned equipment A is configured with the first The first execution certificate is used to configure the hibernation process in the second unmanned equipment B. The second execution certificate; the first unmanned equipment A establishes a termination time limit for entering the safe termination state set on the local monotonic timing coordinates. In the first generation The task control output previously read the local monotonic timer value. And calculate the remaining amount at termination. The system sends initial termination boundary information carrying the remaining termination amount to the second unmanned equipment B; when the second unmanned equipment B first legally receives the initial termination boundary information, it reads the local monotonic timing value. ,according to Takeover is established no earlier than the boundary, and initial confirmation information is replied after persistent submission; the first unmanned equipment A opens the mission control output gate only after the initial confirmation information has been verified as valid, and only when... If the candidate task control action is allowed to proceed, the task control output gate is closed and safety revocation control is initiated; if the second unmanned equipment B fails to verify a valid task release information REL, it will persistently submit the first task control action only after the local monotonic timer reaches the takeover no earlier than the boundary. Activate the status and open the first The task control output gate; among which... , , This represents the maximum relative timing rate error between the two timers. , This is a non-negative safety margin. The upper bound of the revocation time for entering the set of safe termination states, starting from the set of candidate next states after the implementation of the candidate task control action. This refers to the latest time after the candidate task control action is implemented to begin safe reversal.

2. The unmanned system chain-break autonomous control method according to claim 1, characterized in that, The initial termination boundary information is at least bound to the task unit identifier. intergenerational tasks First execution certificate identifier Termination Boundary Version The termination time limit Timed session identifier The remaining amount after termination The message digest, along with integrity verification information, is included; the second unmanned equipment B uses the task unit identifier, the task generation, the first execution credential identifier, the termination boundary version, the timing session identifier, and the message digest as initial transaction identification information, and uses the local monotonic timing value at the time of the first legitimate reception. As a receiving anchor point, it is persistently committed together with the takeover not earlier than the boundary; when the initial transaction identification information is received again and is consistent with the persistently committed initial termination boundary information, the receiving anchor point and the takeover not earlier than the boundary remain unchanged, and the takeover not earlier than the boundary is not recalculated or moved backward according to the time of re-receiving the duplicate message; if any item in the initial transaction identification information is inconsistent, the initial termination boundary information is rejected; the initial confirmation information is at least bound to the initial transaction identification information, the identity of the second unmanned equipment B, and the confirmation authentication information; the integrity verification information and the confirmation authentication information adopt message authentication code or digital signature.

3. The unmanned system chain-break autonomous control method according to claim 1, characterized in that, The conditions for the candidate task control action to pass through the task control output gate also include: the candidate next state set. Located in the task allowed status area Within this region, the state trajectory envelope of the cancellation process lies within the cancellation-allowed state area. Within this range, the lower bound of available energy after the implementation of the candidate task control action is not less than the sum of the upper bound of energy consumption for safe cancellation and the energy reserved for safety; the upper bound of cancellation time... according to , Iterative calculation, To implement the pre-defined safe reversal control strategy, For a predetermined set of bounded disturbances, This represents the computation of a one-step reachable set; it exists when there is a smallest positive integer. Make the first When the step state set is located in the safe termination state set, according to Determine the upper bound of the cancellation time, wherein For discrete time steps, This is a conservative upper bound for the delay between initiating a safe reversal and the actual effective date of the reversal control.

4. The unmanned system chain-break autonomous control method according to claim 2, characterized in that, The first unmanned equipment A only has its current local monotonic time value satisfy The task control output gate is opened at that time. The upper bound of the revocation time for entering the set of safe termination states, starting from the current physical state; the first unmanned equipment A is also set with an independent revocation time limit monitoring task, when the condition is met. At that time, without waiting for new candidate task control actions to be generated, the task control output gate is closed and the safety reversal control is initiated. The maximum monitoring period is defined as follows: the candidate task control action is bound to the task unit identifier, the task generation, the first execution credential identifier, the termination boundary version, the termination time limit, the timing session identifier, the action identifier ActionID, and the expiration time ExpireTime, and is verified again before being actually sent to the execution agency.

5. The unmanned system chain-break autonomous control method according to claim 2, characterized in that, When it is necessary to extend the termination time limit, the first unmanned equipment A establishes a new termination boundary version with a unique update transaction identifier (UpdateID) and sends an update transaction to the second unmanned equipment B. When the update transaction is generated, the local monotonic time value is read. And in accordance with Calculate the new termination remainder. The new termination time limit applies; the second unmanned equipment B will only terminate the update transaction if the second execution credential is still in a dormant state, the old version carried by the update transaction is equal to the current highest persistent commit version, the timing session identifier matches, the update transaction is verified as valid, and its local monotonic timer has not yet reached the current takeover no earlier than the boundary at the transaction linearization commit point, using the local monotonic timer value at the time of the first legitimate receipt of the update transaction. As the sole receiving anchor point, according to Establishing a new takeover no earlier than the boundary and updating the takeover no earlier than the boundary, after persistent commit, sending an update confirmation message to the first unmanned equipment A; the first unmanned equipment A only sends an update confirmation message to the first unmanned equipment A after the first takeover no earlier than the boundary. The task is still active, the current valid version is still the old version, and the local monotonic timer has not yet reached the termination time limit. Furthermore, when the update confirmation information is verified to be valid, the new termination boundary version and the new termination time limit are adopted.

6. The unmanned system chain-break autonomous control method according to claim 5, characterized in that, The second unmanned equipment B establishes the unique receiving anchor point for each UpdateID by performing an atomic first write, comparison and exchange, or equivalent atomic conditional update, and uses the UpdateID, the new termination boundary version, the new termination time limit, the new termination remaining amount, and the update transaction summary as update transaction identification information; when the update transaction identification information is received again and all update transactions are the same as the committed records, the new takeover remains unchanged as not earlier than the boundary. If the UpdateID is the same but any other item in the update transaction identification information is inconsistent, the update transaction is rejected; the update transaction and the... The activation transaction operates on the same persistent transaction state and forms a single persistent linearization point through transaction locks, condition updates, or comparison and exchange: when the update transaction is committed first, the first... The transaction to be activated will be reassessed no earlier than the boundary, according to the new takeover; When a transaction is activated by proxy and then permanently committed, subsequent transactions targeting the first one are rejected. The request to extend the termination boundary of the generation shall not be sent again, and no further update confirmation information that can extend the execution authority of the previous generation shall be sent; the update confirmation information received by the first unmanned equipment A after the mission control output gate has been closed shall not cause the mission control output gate to be reopened.

7. The unmanned system chain-break autonomous control method according to claim 1, characterized in that, The first unmanned equipment A employs irreversible state transitions for the same mission generation, and cannot be reactivated after entering a canceled or terminated state; after the mission control output gate has been closed or the termination state has been persistently committed, a delayed initial confirmation message must not reopen the mission control output gate; the first unmanned equipment A sends the mission release information (REL) only after entering the safe termination state set, the mission control output gate being closed, and the termination state being persistently committed; the second unmanned equipment B, upon verifying the validity of the mission release information REL, no longer waits for the takeover to be no earlier than the boundary, but still opens the first generation... The task control output gate was previously persistently committed. Activated status.

8. The unmanned system chain-break autonomous control method according to claim 2, characterized in that, The local monotonic timers of the first unmanned equipment A and the second unmanned equipment B do not roll back within the same timing session; after the first unmanned equipment A or the second unmanned equipment B restarts, the timing session corresponding to the timing session identifier will continue to be used only if it can be proven that the local monotonic timing coordinates are continuous, and the takeover is not earlier than the boundary; if continuity cannot be proven, the first unmanned equipment A's... The mission control output remains off, and the second execution credentials of the second unmanned equipment B remain dormant until a valid takeover is re-established no earlier than the boundary or a valid mission release message is received.

9. The unmanned system chain-break autonomous control method according to claim 2, characterized in that, The first unmanned equipment A periodically sends a task status frame containing the current termination boundary version, the timing session identifier, the sequence number, and the current termination remaining amount; the second unmanned equipment B reads the local monotonic timing value when it receives a valid task status frame. Calculate candidate takeovers no earlier than the boundary. The equal The task status frame carries the current remaining amount of data to be terminated. Double The sum of the three, and according to Update takeover should not occur earlier than the boundary. Takeover prior to the update shall not occur before the boundary.

10. An autonomous control system for unmanned systems with disconnected chains based on physical termination boundaries, characterized in that, It includes a first unmanned equipment A and a second unmanned equipment B; the first unmanned equipment A is equipped with the first The first execution credential is provided, and includes a termination boundary management module, a security revocation prediction module, and a mission control output gate; the second unmanned equipment B is configured to hibernate. It serves as the second execution credential and includes a takeover boundary calculation module and a high-generation activation module; The termination boundary management module is configured to establish a termination time limit for entering a set of safe termination states on a local monotonic timing coordinate. In the first generation The task control output previously read the local monotonic timer value. Calculate the remaining amount at termination And send it to the second unmanned equipment B; the takeover boundary calculation module is configured to read the local monotonic timing value when the termination residual amount is first legally received. ,according to Establish takeover no earlier than the boundary, and reply with the initial confirmation message after a persistent commit; The task control output gate is configured to open only after the initial confirmation information has been verified as valid, and only when... The candidate task control action is allowed to proceed when the time is right, otherwise it is closed, and the first unmanned equipment A initiates the safety revocation control; the high-generation activation module is configured to persistently submit the first task only after the local monotonic timer reaches the takeover no earlier than the boundary, in the absence of verified valid task release information. Activate the status and open the first Task control output; among which... , , This represents the maximum relative timing rate error between the two timers. , This is a non-negative safety margin. The upper bound of the revocation time for entering the set of safe termination states is calculated by the safety revocation prediction module, starting from the set of candidate next states after the implementation of the candidate task control action. This refers to the latest time after the candidate task control action is implemented to begin safe reversal.

Images