Dual-redundancy self-destruction controller suitable for low-altitude unmanned airship

Abstract

The utility model discloses a dual-redundancy self-destruction controller suitable for a low-altitude unmanned airship, which comprises a main control chip A and a main control chip B which are mutually redundant, and data interaction is carried out between the main control chips through an SPI (Serial Peripheral Interface) bus; each main control chip is electrically connected with two paths of electronic blasting cables; one end of the self-destruction circuit is electrically connected with the two main control chips respectively, and the other end of the self-destruction circuit is electrically connected with a storage chip in the flight control computer; the main control chip is electrically connected with the flight control computer through an RS422 bus. The dual-redundancy self-destruction controller serves as the last barrier for safety control of the low-altitude unmanned airship, full-redundancy design is adopted, main control chip redundancy, bag body tearing redundancy, avionics equipment destroying redundancy, communication monitoring redundancy and power supply redundancy are achieved, the reliability is extremely high, the flight safety of the airship is guaranteed, and the safety of the airship is guaranteed. And huge economic loss and severe social influence caused after the airship is out of control are avoided.

Description

TECHNICAL FIELD

[0001] The utility model belongs to airship safety control technical field, concretely relates to a double redundancy self-destruction controller suitable for low altitude unmanned airship. BACKGROUND

[0002] The low altitude unmanned airship provides buoyancy by filling helium in the capsule, lifts the object, and can be used for low altitude freight, emergency communication, intelligent surveying and mapping, etc. after installing the propulsion system, and has broad application prospects.

[0003] The load of the low altitude unmanned airship is positively correlated with the amount of helium filled, the larger the load, the larger the volume of the airship, the larger the volume, the more difficult the airship control, and the more likely to lose control. After the airship loses control, if it hits high-rise buildings, important buildings or falls into a densely populated area, it will cause great economic loss and harm to social safety; if it loses control and flies into the airspace of another country, it will also cause bad international influence and cause a major diplomatic incident.

[0004] At present, after the low altitude unmanned airship loses control, it only relies on the exhaust valve to exhaust, the exhaust valve is small in size and slow in exhaust, and the airship cannot land quickly; in addition, the avionics equipment of the airship does not have a self-destruction function, and if the program and data are read out, it will cause the loss of confidential data and cause a leak. CONTENT OF THE UTILITY MODEL

[0005] Therefore, the utility model provides a double redundancy self-destruction controller suitable for low altitude unmanned airship, adopts full redundancy design, realizes main control chip redundancy, capsule tearing redundancy, avionics equipment destruction redundancy, communication monitoring redundancy and power supply redundancy, has high reliability, ensures the flight safety of the airship, and avoids causing great economic loss and causing bad social influence after the airship loses control.

[0006] To achieve the above purpose, the utility model provides a double redundancy self-destruction controller suitable for low altitude unmanned airship, which comprises:

[0007] The main control chip A and the main control chip B are mutually redundant, and the main control chips communicate and interact data through the SPI bus;

[0008] Each main control chip controls two electronic blasting ropes;

[0009] The self-destruction circuit is electrically connected with the two main control chips at one end and electrically connected with the storage chip in the flight control computer at the other end;

[0010] The main control chips are electrically connected with the flight control computer through the RS422 bus.

[0011] Preferably, the main control chip B resets the main control chip A by sending an SRST signal, and the main control chip A resets the main control chip B by sending an MRST signal.

[0012] Preferably, the detonation circuit is controlled by the main control chip connected thereto, and after receiving the detonation and unlocking signals sent by the main control chip at the same time, the MOS is turned on by the gate driver, the MOS output is connected to the electronic blasting rope, and the electronic blasting rope is detonated when the MOS is turned on. After the on state of the MOS is isolated by the connected optocoupler, it is fed back to the main control chip.

[0013] Among them, the detonation signal is input to the input end of the gate driver, and the unlocking signal is input to the enable end of the gate driver, both of which are high level effective, and there are pull-down resistors on both signals to prevent misoperation during power-on.

[0014] Preferably, the self-destruction circuit is a double-redundancy circuit, and when the main control chip sends a high-level self-destruction signal, it is sent to the relay driving circuit after isolation to control the relay coil action. After the relay coil is actuated, the power supply PVCC is applied to the power supply end of the main control chip or the storage chip to be destroyed, and the chip is burned out under the action of high voltage and large current; wherein,

[0015] The relay is a double-pole single-throw normally open relay, and in the default state, the relay is in the open state;

[0016] The high-voltage power supply PVCC and PGND are physically disconnected from the power supply of the destroyed chip, and the two power supplies are connected when the relay coil is controlled to actuate;

[0017] The signal feedback adopts the form of collecting voltage, and when the relay is not actuated, the power supply voltage of the destroyed chip is collected, and after the relay is actuated, the high voltage PVCC is collected. The signal feedback isolation adopts isolation operational amplifier;

[0018] Preferably, the main control chip adopts a double-redundancy wiring method to communicate with the flight control computer through the RS422 bus, and the two mutually redundant RS422s are connected to the flight controller RS422 bus at the same time.

[0019] The flight control computer sends heartbeat information and key operating state data to the self-destruction controller in real time through the RS422 bus.

[0020] Both main control chips receive data from the flight control computer, and when both main control chips need to send data to the flight control computer, they use the transmission enable signal to time-share the transmission bus to complete data transmission and avoid transmission conflicts.

[0021] Preferably, the dual-redundancy self-destruct controller also adopts a dual-redundancy power supply design, with the airship's avionics bay DC 28V as the main power supply circuit and the self-destruct controller's built-in 6-series 2-parallel lithium battery pack as the backup power supply circuit. The lithium battery pack's full-charge output voltage is 25.2V. If it is lower than 28V, it will be powered by 28V by default. When the DC 28V is abnormal, it will automatically switch to the lithium battery pack for power supply.

[0022] Preferably, the low-altitude unmanned airship sends a self-destruct command to the self-destruct circuit via a control chip located in the flight control computer that is connected to the self-destruct circuit.

[0023] This utility model has achieved at least the following beneficial effects:

[0024] 1. The design adopts full redundancy, which realizes redundancy of main control chip, shell tearing, avionics destruction, communication monitoring, and power supply. It has extremely high reliability, ensures the flight safety of airship, and avoids huge economic losses and adverse social impacts caused by airship loss of control.

[0025] Other advantages, objectives, and features of this invention will be set forth in the following description and will be apparent to those skilled in the art to some extent, or may be learned by practice of this invention. The objectives and other advantages of this invention can be realized and obtained through the following description. Attached Figure Description

[0026] To make the objectives, technical solutions, and beneficial effects of this utility model clearer, the following drawings are provided for illustration:

[0027] Figure 1 This is a simplified circuit diagram of a dual-redundancy self-destruct controller for a low-altitude unmanned airship according to the present invention.

[0028] Figure 2 This is a simplified diagram of the electronic blasting cable control structure and process in this utility model;

[0029] Figure 3 This is a simplified diagram of the self-destruct circuit, i.e., the chip destruction control structure and flowchart in this utility model;

[0030] Figure 4 This is the wiring diagram for the dual-redundant RS422 bus in this utility model. Detailed Implementation

[0031] The preferred embodiments of the present invention will be described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the present invention.

[0032] This patent utility model discloses a dual-redundancy self-destruct controller suitable for low-altitude unmanned airships. To improve safety and reliability, a dual-redundancy design is adopted. The overall circuit diagram is shown below. Figure 1 As shown. The dual redundancy design includes redundancy for the main control chip, redundancy for avionics tearing, redundancy for avionics destruction, redundancy for communication monitoring, and redundancy for power supply.

[0033] The dual-redundancy self-destruct controller uses the domestically produced GigaDevice GD32F103 as the main control chip. Main control chip A and main control chip B are mutually redundant, exchanging data and control commands via the SPI bus and monitoring each other's operating status. They can reset each other; main control chip A resets main control chip B via the MRST signal, and similarly, main control chip B resets main control chip A via the SRST signal.

[0034] In the event of an unmanned airship going out of control, the dual-redundant self-destruct controller can drive the electronic detonation index to detonate, tearing the airship's capsule. After the capsule is torn apart, the internal helium gas will be rapidly expelled, allowing the airship to land quickly. The airship capsule tearing control adopts a dual-redundant design with a total of four channels. Each channel controls one electronic detonation cable. Electronic detonation cables 1 and 2 are controlled independently by main control chip A, while electronic detonation cables 3 and 4 are controlled independently by main control chip B. A simplified control diagram for each electronic detonation cable is shown below. Figure 2 As shown. The main control chip needs to simultaneously send detonation and unlocking signals to control the gate driver to drive the MOS to conduct. The detonation signal is input to the input terminal of the gate driver, and the unlocking signal is input to the enable terminal of the gate driver. Both are active high, and both signals have pull-down resistors to prevent malfunctions during power-up. The MOS output is connected to the electronic detonating cord. When the MOS is on, the electronic detonating cord detonates. Simultaneously, the MOS conduction status is fed back to the main control chip through optocoupler isolation.

[0035] In the event of potential loss of the unmanned airship's avionics, the dual-redundancy self-destruct controller activates chip destruction logic. This logic applies a continuous high voltage and high current to the power supply terminals of the airship's flight control computer's main control chip core and memory chips, causing the chips to break down and burn out, thus preventing program and flight data leakage. The chip destruction control mechanism is as follows: Figure 3As shown, when it is necessary to destroy the chip in the flight control computer, the self-destruct controller sends a high-level signal, which, after isolation, sends a signal to the relay drive circuit to control the relay coil. Once the relay coil actuates, it applies power PVCC to the power supply terminal of the chip to be destroyed. The chip is then burned out under the influence of high voltage and high current. A double-pole single-throw normally open relay is used. By default, the relay is in the open state, and the high-voltage power supply PVCC and PGND are physically disconnected from the power supply to the chip being destroyed, SGND. When the relay coil is activated, the two power supplies are connected. Signal feedback is achieved by sampling voltage. When the relay is not activated, the voltage supplied to the chip being destroyed is sampled; after the relay activates, the high voltage PVCC is sampled. The signal feedback isolation uses an isolation operational amplifier.

[0036] The dual-redundant self-destruct controller monitors the operational status of the airship's flight control computer. The flight control computer sends heartbeat information and critical operational status data to the self-destruct controller in real time via an RS422 bus. The RS422 wiring is as follows... Figure 4 As shown, the two redundant RS422 channels of the self-destruct controller are simultaneously connected to the RS422 bus of the flight controller. The main control chips 1 and 2 simultaneously receive data from the flight control computer. When the main control chips 1 and 2 need to send data to the flight control computer, they use the transmit enable signal to occupy the transmit bus in a time-sharing manner to complete the data transmission and avoid transmission conflicts.

[0037] The dual-redundant self-destruct controller serves as the last line of defense for the safety control of low-altitude unmanned airships, and its power supply adopts a dual-redundant design. Figure 1 The avionics bay of the airship uses DC 28V as the main power supply circuit, and the self-destruct controller has a built-in 6-series 2-parallel lithium battery pack as the backup power supply circuit. The full-charge output voltage of the lithium battery pack is 25.2V. If it is lower than 28V, it will be powered by 28V by default. When the DC 28V is abnormal, it will automatically switch to the lithium battery pack for power supply. Figure 1 The power conversion circuit isolates and converts the power supplies into independent power supplies M3V3 and S3V3. M3V3 supplies power to main control chip 1, and S3V3 supplies power to main control chip 2.

[0038] The self-destruct control logic of the dual-redundancy self-destruct controller is divided into remote self-destruct and autonomous self-destruct:

[0039] (1) Remote self-destruct

[0040] Remote self-destruct refers to the self-destruct controller executing a tearing of the capsule or destruction of the chip based on a self-destruct command sent by the flight control computer. In this case, the flight control computer is operating normally. The flight computer sends a self-destruct command to the self-destruct controller based on the received ground self-destruct control command or the result of the flight control self-destruct algorithm. After receiving the command, the self-destruct controller first compares the self-destruct commands with the main control chip 1 and the main control chip 2. If the commands match, the self-destruct command is executed; if the commands do not match, the self-destruct command is not executed, and the error is reported back to the flight control computer in sequence.

[0041] (2) Self-destruction

[0042] Autonomous self-destruction refers to the self-destruct controller autonomously executing the self-destruct command. In this case, the self-destruct controller cannot receive data and commands from the flight control computer, and monitors that the power supply of the destroyed chip of the flight control computer and the DC 28V power supply of the avionics bay are in an abnormal state. Therefore, the self-destruct controller judges that the flight control computer has been damaged and the airship is out of control, and executes the self-destruct command.

[0043] Finally, it should be noted that the above preferred embodiments are only used to illustrate the technical solution of this utility model and are not intended to limit it. Although the utility model has been described in detail through the above preferred embodiments, those skilled in the art should understand that various changes can be made to it in form and detail without departing from the scope defined by the claims of this utility model.

Claims

1. A dual-redundancy self-destruct controller suitable for use in low-altitude unmanned airships, characterized in that, Comprise: The mutually redundant master control chip A and master control chip B, the master control chip communicates through SPI bus interaction data between each other; Each master control chip controls 2 electronic detonation cable respectively; Self-destruction circuit, one end is electrically connected with two master control chips respectively, the other end is electrically connected with the storage chip in the flight control computer; Master control chip is electrically connected with flight control computer through RS422 bus respectively.

2. The dual-redundancy self-destruction controller for low-altitude unmanned airships according to claim 1, characterized in that, Master control chip B resets master control chip A by sending SRST signal, and master control chip A resets master control chip B by sending MRST signal.

3. The dual-redundancy self-destruction controller for low-altitude unmanned airships according to claim 1, wherein, The detonation circuit is controlled by the master control chip connected with it. After receiving the detonation and unlock signals sent by the master control chip at the same time, the gate driver drives the MOS to turn on, and the MOS output is connected with the electronic detonation cable. When the MOS tube is turned on, the electronic detonation cable is detonated. After the MOS tube is turned on, the feedback is given to the master control chip through the connected photocoupler isolation. Among them, the detonation signal is input to the input end of the gate driver, and the unlock signal is input to the enable end of the gate driver, both of which are high level effective. There are pull-down resistors on both signals to prevent misoperation during power-on.

4. The dual-redundancy self-destruction controller for low-altitude unmanned airships of claim 1, wherein, The self-destruction circuit is a double redundant circuit. When the master control chip sends a high level self-destruction signal, it is sent to the relay driving circuit after isolation to control the relay coil action. After the relay coil action, the power PVCC is applied to the power supply end of the master control chip or the storage chip to be destroyed. The chip is burned out under the action of high voltage and large current. The relay is a double pole single throw normally open relay. The default state of the relay is off. The high voltage power supply PVCC, PGND and the power supply of the destroyed chip are physically disconnected. When the relay coil is controlled to act, the two power supplies are connected. The signal feedback adopts the form of collecting voltage. When the relay is not in action, the collected voltage is the power supply voltage of the destroyed chip. After the relay is in action, the collected voltage is high voltage PVCC. The signal feedback isolation adopts isolation operational amplifier.

5. The dual-redundancy self-destruction controller for low-altitude unmanned airships of claim 1, wherein, The master control chip adopts double redundant wiring method to communicate with the flight control computer through RS422 bus. The two-way RS422 is connected to the RS422 bus of the flight controller at the same time. The flight control computer sends heartbeat information and key running state data to the self-destruction controller in real time through RS422 bus. The two master control chips receive the data of the flight control computer at the same time. When the two master control chips need to send data to the flight control computer, they use the transmission enable signal to occupy the transmission bus in time to complete the data transmission and avoid transmission conflict.

6. The dual-redundancy self-destruction controller for low-altitude unmanned airships of claim 1, wherein, The double redundant self-destruction controller also adopts double redundant power supply mode. The DC 28V in the airship navigation cabin is used as the main power supply circuit, and the 6 string 2 parallel lithium battery pack built-in the self-destruction controller is used as the backup power supply circuit. The output voltage of the lithium battery pack is 25.2V when it is fully charged, which is lower than 28V. The default power supply is 28V. When the DC 28V is abnormal, it automatically switches to lithium battery pack power supply.

7. The dual-redundancy self-destruction controller for low-altitude unmanned airships of claim 1, wherein, The low-altitude unmanned airship sends self-destruction instruction to the self-destruction circuit through the control chip in the flight control computer which is connected with the self-destruction circuit.

Images