KR20220122145A - Uav network topology and synchronization method in the network topology - Google Patents

Abstract

The present invention relates to an unmanned aerial vehicle (UAV) network topology and a synchronization method in the network topology and, more specifically, to a network topology of a distributed flight controller for a rugged drone exposed to harsh conditions and requiring hardware and software fault tolerance, and a synchronization method in the network topology. According to an embodiment of the present invention, the network topology as an UAV network topology comprises: a network bus; a GNSS/IMU sensor triple-multiplexed and connected to the network bus to communicate individually; telemetry equipment triple-multiplexed and connected to the network bus to communicate individually; a flight controller triple-multiplexed and connected to the network bus to communicate individually; a plurality of Voter bridges connected to the network bus; and a motor driven according to a control command selected from the Voter bridges. Therefore, the network topology can be applied to all UAVs requiring tolerance to hardware failures and software faults for harsh environments.

Description

UAV NETWORK TOPOLOGY AND SYNCHRONIZATION METHOD IN THE NETWORK TOPOLOGY

The present invention relates to an unmanned aerial vehicle network structure and a synchronization method in the network structure, and more particularly, a rugged drone exposed to harsh conditions and requiring hardware and software fault tolerance. It relates to a network structure of a distributed flight controller for a (Rugged drone) and a synchronization method within the network structure.

Unmanned aerial vehicles (UAVs) such as drones are increasingly being used in industrial fields. In particular, it is used for monitoring and inspection of large and expensive equipment, such as aircraft, or monitoring and management of dangerous facilities.

Conventional multiplexing techniques used to increase the reliability of the unmanned aerial vehicle network system primarily use at least one extra sensor-controller-communicator. However, in the conventional (drone) system including the redundancy, the 'communication structure' that performs data communication between each part, such as a sensor, a controller, and an actuator, is overlooked.

The problem to be solved by the present invention is to solve all unmanned aerial vehicles (UAVs) that require tolerance to hardware errors and software glitches for harsh environments such as military drones, nuclear field inspection, disaster control, high interference areas or critical applications such as personal vehicles. It provides an unmanned aerial vehicle network structure applicable to UAV).

It also provides a synchronization method that allows the sensors and flight controllers connected to one network and each tripled to operate at the same time.

A network structure according to an embodiment of the present invention includes an unmanned aerial vehicle (UAV) network structure, comprising: a network bus; a GNSS/IMU sensor that is triple multiplexed and connected to the network bus to communicate individually; telemetry that is triple multiplexed and connected to the network bus to communicate individually; a flight controller that is triple multiplexed and connected to the network bus to communicate individually; a plurality of Voter Bridges connected to the network bus; and a motor driven according to a control command selected by the boat bridge.

A network structure according to another embodiment of the present invention includes an unmanned aerial vehicle (UAV) network structure, comprising: a network bus; a flight board that is triple multiplexed and connected to the network bus to communicate individually; a plurality of Voter Bridges connected to the network bus; and a motor driven according to a control command selected from the boat bridge, wherein the flight board includes at least one GNSS/IMU sensor, telemetry and a flight controller, and the flight controller of the flight board is the network bus connected to and communicated individually.

A method according to another embodiment of the present invention, as a synchronization method in the above-described network structure, a broadcasting step, in which each of a plurality of triple multiplexed flight controllers broadcast a decreasing threshold value at a fixed interval; comparing values of synchronization counters shared by one flight controller among the plurality of flight controllers with other flight controllers; and a fault detection and reset step of detecting the presence or absence of a failure of the plurality of flight controllers or resetting the synchronization counters based on the comparison result in the comparison step.

According to embodiments of the present invention, any unmanned aerial vehicle (UAV) requiring tolerance to hardware errors and software glitches for harsh environments such as military drones, nuclear field inspections, disaster control, high interference areas or critical applications such as personal vehicles. ) has an applicable advantage.

In addition, when combined with an appropriate communication protocol such as a redundant CAN bus, equipment can be completely protected from hardware failures as well as software failures in a single subsystem.

In addition, the network can also be safe from errors due to noise as well as cabling errors.

It can also be implemented in current drones providing a complete re-implementation of the control electronics and firmware.

In addition, all mechanical aspects of the UAV are not affected by the network system, so the cost associated with system revalidation can be reduced.

1 is a diagram schematically illustrating a triple module redundancy network structure (TMR network topology) according to a first embodiment of the present invention.
2 is a diagram schematically illustrating a triple module redundancy network structure (TMR network topology) according to a second embodiment of the present invention.
FIG. 3 is another embodiment of the present invention, and is a schematic diagram for explaining a synchronization method that is connected to one network and enables the triplexed sensors and flight controllers to operate at the same time.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS [0010] BRIEF DESCRIPTION OF THE DRAWINGS Reference is made to the accompanying drawings, which show by way of illustration specific embodiments in which the present invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the present invention. It should be understood that the various embodiments of the present invention are different but need not be mutually exclusive. For example, certain shapes, structures, and characteristics described herein may be embodied in other embodiments without departing from the spirit and scope of the invention with respect to one embodiment. In addition, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description set forth below is not intended to be taken in a limiting sense, and the scope of the present invention, if properly described, is limited only by the appended claims, along with all scope equivalents to those claimed. Like reference numerals in the drawings refer to the same or similar functions throughout the various aspects.

The present invention is a network structure or network system of a distributed flight controller for a rugged drone that is exposed to harsh conditions and requires hardware and software fault tolerance. is about

Each node of the network architecture of the present invention is fully redundant, at least one path from a sensor node to an output node still exists in the network graph, and one or more subsystems may be lost.

The TMR (Triple Modular Redundancy) technique is one of the techniques to ensure that the system can perform a normal operation even when a fault occurs, and is mainly used in the design of a fault tolerant system. The triple-redundant modular device designed by this technique keeps the processing running even if a part of the system fails without affecting the overall system operation. In addition, the triple redundant modular device has a function of diagnosing and recovering any failure by multiplexing major hardware elements such as a central processing unit, a system busing memory device, an input/output processing device, and an input/output bus.

An application target of the present invention may be an unmanned aerial vehicle network system in which reliability is basically secured through triple multiplexing. However, the present invention is not limited thereto, and the present invention is applicable not only to the unmanned aerial vehicle network system, but also to most sensor-controller-actuator systems.

Conventional multiplexing techniques used to increase the reliability of the unmanned aerial vehicle network system primarily use at least one extra sensor-controller-communicator. However, in the conventional (drone) system including the redundancy, the 'communication structure' that performs data communication between each part, such as a sensor, a controller, and an actuator, is overlooked. Accordingly, the present invention proposes an internal communication structure that connects each other in a system in which two or more sensors, external communication, and flight controller are multiplexed. Here, the internal communication structure is subdivided into two according to the method in which each multiplexed component is connected to the internal communication bus. And, a method for solving the synchronization problem that can cause problems in such a multiplexed system is presented.

Embodiments of the present invention, which will be described in detail below, can solve hardware and EMI-related reliability issues of unmanned aerial vehicles (UAVs) that are conditional on a harsh environment or mission-critical requirements. . By using physically redundant and fault-tolerant network buses, without the other dynamic effects of controlled UAVs, we create a fully redundant network topology in which every single node can be affected by hardware failure or software failure. can solve them

Network structure according to the first embodiment

1 is a diagram schematically illustrating a triple module redundancy network structure (TMR network topology) according to a first embodiment of the present invention.

The triple-module redundant network structure according to the first embodiment of the present invention shown in FIG. 1 is a GNSS/IMU sensor (100a, 100b, 100c), telemetry (300a, 300b, 300c), and a flight controller (500a, 500b and 500c) are each triple multiplexed, and each is individually connected to the network bus 10 .

The triple GNSS/IMU sensor 100a, 100b, 100c includes a first GNSS/IMU sensor 100a, a second GNSS/IMU sensor 100b, and a third GNSS/IMU sensor 100c. Here, GNSS is an abbreviation of Global Navigation Satellite System, and IMU is an abbreviation of Inertial Measurement Unit. The first to third GNSS/IMU sensors 100a , 100b , and 100c may transmit the measured sensing data to the network bus 10 .

The triple telemetry 300a, 300b, and 300c includes a first telemetry 300a, a second telemetry 300b, and a third telemetry 300c. The first to third telemetry (Telemetry, 300a, 300b, 300c) may transmit state information data of the unmanned aerial vehicle (UVA) to the network bus 10 .

The triple flight controller (500a, 500b, 500c) is composed of a first flight controller (500a), a second flight controller (500b) and a third flight controller (500c).

The network bus 10 may be a redundant CAN bus having a redundant structure in a physical layer. The network bus 10 may be, for example, TI-00061, a sample design having a redundant structure to secure reliability among CAN communication structures of TI.

The triple module redundant network structure according to the first embodiment of the present invention includes a plurality of Voter Bridges connected to the network bus 10 (Voter Bridges, 700a, 700b, 700c, 700d) and motors 900a, 900b, 900c, 900d).

Each of the boat bridges 700a, 700b, 700c, 700d includes first to third GNSS/IMU sensors 100a, 100b, 100c, first to third telemetry 300a, 300b, 300c, and first to third 3 It is possible to receive data from the flight controllers (500a, 500b, 500c).

Since each boat bridge 700a, 700b, 700c, 700d receives exactly the same input data, its outputs can be guaranteed to match exactly, unless mechanical or software errors occur. Here, each of the boat bridges 700a, 700b, 700c, and 700d may select one data determined to be normal among the received data, and may control the motors 900a, 900b, 900c, and 900d based on the selected data. have.

The triple module overlapping network structure according to the first embodiment of the present invention shown in FIG. 1 is, for example, when a problem occurs in the first GNSS / IMU sensor 100a, the first to third flight controllers 500a, Since both 500b and 500c receive data from the second to third GNSS/IMU sensors 100b and 100c that are operating normally, there is an advantage that normal operation is possible. However, in the triple module redundant network structure according to the first embodiment of the present invention shown in FIG. 1 , since all components communicate with each other through one network bus 10 , the amount of data communication increases compared to a single system The implementation is rather complicated, and the implementation cost is relatively high.

Network structure according to the second embodiment

2 is a diagram schematically illustrating a triple module redundancy network structure (TMR network topology) according to a second embodiment of the present invention.

The triple-module redundant network structure according to the second embodiment of the present invention shown in FIG. 2 is different from the triple-module redundant network structure shown in FIG. 1 , the first to third GNSS/IMU sensors 100a, 100b, 100c ), one of the first to third telemetry (300a, 300b, 300c), and one of the first to third flight controllers (500a, 500b, 500c) is one flight board (G1, G2, G3) ), and each flight board (G1, G2, G3) is individually connected to the network bus (10).

Specifically, the first flight board (G1) is composed of a first GNSS / IMU sensor (100a), a first telemetry (300a) and a first flight controller (500a), the first flight controller (500a) is a network It may be connected to the bus 10 . The second flight board (G2) is composed of a second GNSS / IMU sensor (100b), a second telemetry (300b) and a second flight controller (500b), the second flight controller (500b) is a network bus (10) ) can be associated with And, the third flight board (G3) is composed of a third GNSS / IMU sensor (100c), a third telemetry (300c) and a third flight controller (500c), the third flight controller (500c) is a network bus (10) can be connected.

The network bus 10 may be a redundant CAN bus having a redundant structure in the physical layer. The network bus 10 may be, for example, TI-00061, a sample design having a redundant structure to secure reliability among CAN communication structures of TI.

The triple module overlapping network structure according to the second embodiment of the present invention includes a plurality of Voter Bridges connected to the network bus 10 (Voter Bridges, 700a, 700b, 700c, 700d) and motors 900a, 900b, 900c, 900d).

Each of the boat bridges 700a, 700b, 700c, and 700d may select data determined to be normal among the signals received from the flight controllers 500a, 500b, and 500c, and based on the selected data, the motors 900a, 900b, 900c, 900d) can be controlled.

On the other hand, in the triple module redundant network structure according to the second embodiment of the present invention, the problem occurred in any one of the flight boards (G1, G2, G3) is a boat bridge mounted in front of each motor (900a, 900b, 900c, 900d) ( 700a, 700b, 700c, and 700d) may be filtered through a majority voting method, and the corresponding motors 900a, 900b, 900c, and 900d may be driven normally.

Data of the first to third GNSS/IMU sensors 100a, 100b, 100c on the network bus 10 in the triple module redundant network structure according to the first embodiment of the present invention shown in FIG. 1, first to Data of the third telemetry (300a, 300b, 300c) and data generated by the first to third flight controllers (500a, 500b, 500c) exist, but the triple module overlap according to the second embodiment of the present invention Only control data generated by the flight controllers 500a, 500b, and 500c of each flight board G1, G2, and G3 exists on the network bus 10 in the network structure. Therefore, the triple-module redundant network structure according to the second embodiment of the present invention can reduce data communication amount, is simple to implement, and has the advantage of relatively low implementation cost. However, in the triple module redundant network structure according to the second embodiment of the present invention, only one of the telemetry, GNSS / IMU sensors and flight controllers, which are components in each flight board (G1, G2, G3), occurs, Since a problem occurs in the entire flight board, the reliability of the system is relatively lower than the triple module redundant network structure according to the first embodiment of the present invention shown in FIG. 1 .

Clock Inter-Synchronization of TMR Network Systems

The control topologies of the network structures shown in FIGS. 1 and 2 present different communication sequences. Communication of the flight controller and telemetry system may or may not be tripled as the user may want the error to be propagated to the ground station for further monitoring. Communication between the telemetry receiver and the flight controller must match exactly and must be voted on by the flight controller. Each sensor is different, it must implement appropriate sensor fusion to reject outliers, and the resulting measurements must be exactly the same on each flight controller. Finally, the flight controllers operate on the same measurements, so the outputs must match exactly. Their motor commands can be boated through the main boat in the boat bridge.

Additionally, to ensure shared timestep and synchronized operations, an appropriate sensor and flight controller synchronization scheme should be implemented. Many synchronization schemes can be implemented. Hereinafter, a synchronization method suitable for maintaining hardware failure and software fault tolerance of the system is proposed below.

Specifically, as another embodiment of the present invention, a synchronization method is proposed so that sensors and flight controllers connected to a single network, each tripled, can operate at the same time. That is, it corresponds to an additional verification technique that can detect a time delay that may occur in a sensor or flight controller, or a system clock delay or error occurring in the CPU of the flight controller.

The synchronization method according to another embodiment of the present invention is a method that can be used because each flight controller is connected to one network, and has the advantage of being simple to configure.

A synchronization method according to another embodiment of the present invention, each flight controller broadcasts a decreasing threshold value at a fixed interval; and when the two flight controllers broadcast a value below the threshold, reload the timer of the synchronization counter to synchronize the system, reset the synchronization counter to an initial value, and synchronize the sensor to start the next iterative calculation and transmit a new command. Here, when the value of the synchronization counter reaches 0, it may be determined that the corresponding flight board is alone in the network or that the internal clock is too unstable.

The synchronization scheme can ensure proper synchronization of the system at a median clock among the flight controllers. The reset value of the synchronization counter is preferably adjusted to provide sufficient margin for the system to reach zero only when the flight controller is disconnected.

In more detail, a synchronization method according to another embodiment of the present invention will be described with reference to FIG. 3 .

FIG. 3 is another embodiment of the present invention, and is a schematic diagram for explaining a synchronization method that is connected to one network and enables the triplexed sensors and flight controllers to operate at the same time.

Referring to Figure 3, each flight controller (500a, 500b, 500c) includes a synchronization counter (N1, N2, N3), each of the synchronization counters (N1, N2, N3) are shared with each other.

Each flight controller (500a, 500b, 500c) receives all the values of the synchronization counters (N1, N2, N3) and compares. Here, the size of the synchronization counters N1, N2, and N3, decreasing intervals, etc. may be different depending on the system of each flight controller 500a, 500b, and 500c.

Since the values of the synchronization counters N1, N2, and N3 are starting from the same value and decreasing in the same way, they must reach an arbitrarily selected threshold equally. However, if only one of the synchronization counters (N1, N2, N3) has a value below the threshold value within the set time, it is considered that a problem has occurred in the corresponding flight controller that emitted this value and faults can be detected. In addition, when two or more reach the threshold value or less within a set time, synchronization may be performed by resetting the synchronization counters N1 , N2 , and N3 .

Fault tolerance analysis

The network structure according to various embodiments of the present invention described above may fail at various points, and the following is an analysis of possible failures and their effect on the system.

When programmed correctly, errors in sensor boards or telemetry will cause each flight controller to ignore inconsistent data.

All flight controllers use data from all sensors and all telemetry subsystems, so each flight controller has the same information and has the same internal state. Errors in one flight controller can be detected and corrected by the TMR voter.

If either the TMR voter or the motor controller fails, both are lost and mechanical redundancy must be ensured to recover from these events.

If the network bus implements a fault-tolerant mechanism such as CRC, faults on communication buses can be recovered.

When implementing a redundant physical layer such as TIDA-00061, which is an internal communication network, a hardware error of the communication bus does not interfere with communication between subsystems.

Features, structures, effects, etc. described in the above embodiments are included in one embodiment of the present invention, and are not necessarily limited to one embodiment. Furthermore, the features, structures, effects, etc. illustrated in each embodiment can be combined or modified for other embodiments by those of ordinary skill in the art to which the embodiments belong. Accordingly, the contents related to such combinations and modifications should be interpreted as being included in the scope of the present invention.

In addition, although the embodiment has been mainly described in the above, this is only an example and does not limit the present invention, and those of ordinary skill in the art to which the present invention pertains in the range that does not deviate from the essential characteristics of the present embodiment. It will be appreciated that various modifications and applications not illustrated are possible. For example, each component specifically shown in the embodiment can be implemented by deformation|transformation. And the differences related to these modifications and applications should be construed as being included in the scope of the present invention defined in the appended claims.

Claims (6)

In the unmanned aerial vehicle (UAV) network structure,
network bus;
a GNSS/IMU sensor that is triple multiplexed and connected to the network bus to communicate individually;
telemetry that is triple multiplexed and connected to the network bus to communicate individually;
a flight controller that is triple multiplexed and connected to the network bus to communicate individually;
a plurality of Voter Bridges connected to the network bus; and
A network structure including; a motor driven according to a control command selected by the boat bridge.
In the unmanned aerial vehicle (UAV) network structure,
network bus;
a flight board that is triple multiplexed and connected to the network bus to communicate individually;
a plurality of Voter Bridges connected to the network bus; and
Including; a motor driven according to the control command selected by the boat bridge;
The flight board includes at least one GNSS/IMU sensor, telemetry and flight controller,
A network structure, wherein the flight controller of the flight board is connected to the network bus to communicate individually.
3. The method according to claim 1 or 2,
wherein the network bus is a redundant CAN bus having a redundant structure in a physical layer.
The method for synchronization in the network structure of claim 1 or 2,
A broadcasting step, in which each of a plurality of triple multiplexed flight controllers broadcasts a decreasing threshold value at a fixed interval;
comparing values of synchronization counters shared by one flight controller among the plurality of flight controllers with other flight controllers; and
a fault detection and reset step of detecting the presence or absence of a failure of the plurality of flight controllers or resetting the synchronization counters based on the comparison result in the comparison step;
A method for synchronization in a network structure, comprising:
5. The method of claim 4, wherein the fault detection and reset step comprises:
If one of the values of the synchronization counters is a value less than or equal to a threshold value within a set time, it is determined that the flight controller that has emitted the value is faulty, a synchronization method in a network structure.
5. The method of claim 4, wherein the fault detection and reset step comprises:
and resetting the synchronization counters if two or more values of the synchronization counters are less than or equal to a threshold value within a set time.

Images