A navigation satellite integrated electronic system

Abstract

The present invention relates to an integrated electronic system for a navigation satellite, comprising: an onboard computer, configured to execute all algorithms and autonomous management functions; a data processing terminal, configured to receive instructions issued by the onboard computer and return collected payload equipment data to the onboard computer; the onboard computer and the data processing terminal communicate via a 1553B bus; the onboard computer and the data processing terminal mutually constitute remote storage via the 1553B bus, and after a single machine is powered off and restored, data is restored from the remote end; the 1553B bus uniformly connects an onboard computer unit with a plurality of satellite subsystems, and reserves electrical interfaces for the equipment of the satellite subsystems; and integrated electronic system software, the integrated electronic system software comprising a normal mode of onboard computer software, a minimum mode of onboard computer software, data processing terminal software and FPGA software.

Description

Technical Field

[0001] The present invention generally relates to the field of aerospace electronics technology, and more specifically to an integrated electronic system for a navigation satellite. Background Art

[0002] The navigation satellite integrated electronic system is the core system of the satellite platform and the satellite control center. It is responsible for analyzing remote control data, realizing the control and management of equipment; sending telemetry information on the satellite; collecting data from attitude control sensors, performing calculations based on the current attitude control mode, and realizing attitude control of the satellite; realizing orbit control of the satellite based on satellite orbit data; collecting satellite temperature data, realizing active temperature control, and ensuring that each device works in the best performance state; real-time monitoring of the energy system state to ensure satellite energy security; controlling the direction of the sailboard based on the current orbit and attitude of the satellite to ensure satellite energy supply; and processing inter-satellite data routing. It provides comprehensive management and services for the payload system.

[0003] Traditional satellite electronic systems mostly adopt a distributed management and control mode, where the onboard computer is responsible for remote control, telemetry, thermal control, and time management, and other subsystems are responsible for telemetry collection and remote control of their own systems. The characteristics of distributed electronic systems will lead to large satellite size and mass, high power consumption, and complex interface relationships, which will result in inconsistent interfaces, complex system control, poor reconfigurability, and low functional density. Summary of the invention

[0004] Based on the prior art, the task of the present invention is to provide a navigation satellite integrated electronic system. Through this system, based on the design concept of centralized management and decentralized control and in accordance with the principle of optimal system configuration, each separate single-machine device of the platform and payload can be centrally managed, and decentralized control can be performed using the control modules of each satellite system and equipment, thereby fully and effectively utilizing the resources and information of each subsystem and equipment and improving the degree of reuse of hardware and software resources.

[0005] In order to solve the above technical problems, the present invention provides a navigation satellite integrated electronic system, comprising:

[0006] An onboard computer, configured to execute all algorithms and autonomous management functions;

[0007] a data processing terminal, configured to receive instructions issued by the onboard computer and collect payload equipment data, and return the collected payload equipment data to the onboard computer;

[0008] The onboard computer and the data processing terminal communicate via a 1553B bus;

[0009] The onboard computer and the data processing terminal mutually constitute remote storage via the 1553B bus, and after a single machine loses power and recovers, data is recovered from the remote end;

[0010] The 1553B bus uniformly connects the onboard computer unit and multiple satellite subsystems, and reserves electrical interfaces for the devices of the satellite subsystems; and

[0011] The integrated electronic system software includes a normal mode of the onboard computer software, a minimum mode of the onboard computer software, data processing terminal software and FPGA software.

[0012] In an extended solution of the present invention, it is provided that the onboard computer uses a dual-machine cold backup mode to perform remote control information processing, telemetry processing, attitude control, orbit control, autonomous thermal control, energy monitoring, sailboard control, and collect status data of platform equipment, including data of the energy subsystem, attitude and orbit control subsystem, thermal control subsystem, mechanism subsystem, and satellite service subsystem; and

[0013] The satellite service subsystem is an integrated electronic system for navigation satellites.

[0014] In another extended solution of the present invention, it is stipulated that the data processing terminal uses a dual-machine cold backup mode to receive program control instructions from the onboard computer to realize control of the payload equipment, and at the same time collects status data of the payload equipment, which is sent to the onboard computer after organization, and has no autonomous control function.

[0015] In another embodiment of the present invention, it is provided that the onboard computer and the data processing terminal communicate via a 1553B bus, wherein:

[0016] The onboard computer sends program control instructions to the data processing terminal via the 1553B bus; and

[0017] The data processing terminal sends the telemetry data of the payload equipment to the onboard computer via the 1553B bus.

[0018] In an extended solution of the present invention, it is provided that the 1533B bus is a dual redundant military bus with an automatic switching function, and when one bus fails, it will automatically switch to another bus; and

[0019] The 1553B bus adopts two-stage transformer coupling.

[0020] In another extended solution of the present invention, it is provided that the normal mode of the onboard computer software is a software configuration that runs when the onboard computer is in orbit and the hardware functions normally and the software is intact;

[0021] The functions of the onboard computer software in normal mode include satellite-to-ground remote control, inter-satellite remote control, satellite-to-ground telemetry, inter-satellite telemetry, energy management, payload management, orbit calculation and attitude and orbit control calculation; and

[0022] The normal mode of the onboard computer software requires the onboard computer processor, EEPROM, and SRAM to operate normally.

[0023] In another extended solution of the present invention, it is provided that the minimum mode of the onboard computer software is a functional degradation configuration after a software or hardware error occurs during the onboard computer's on-orbit period;

[0024] The minimum mode of the onboard computer software retains telemetry, remote control, attitude control and energy management functions, and requires minimal hardware resources;

[0025] The minimum mode of the onboard computer software is a query and repair method provided when the normal system cannot operate normally. It does not provide channel data and interrupt support and is used for emergency repair.

[0026] The minimum mode of the onboard computer software is a stand-alone program; and

[0027] The minimum mode function of the onboard computer software belongs to an independent unit of the satellite management part and overlaps with the normal system as much as possible;

[0028] The minimum mode of the onboard computer software only supports telemetry, remote control, AD, DA, and frequency for the channel; and

[0029] Use the command to enter the extended mode, initialize the hardware port, and support ground forwarding of channel data in the extended mode.

[0030] In one development of the invention, it is provided that the data processing terminal software is an extension of the onboard computer software; and

[0031] The data processing terminal software executes the remote control instructions forwarded by the onboard computer and provides the onboard computer with telemetry data of the payload equipment, and has no autonomous function.

[0032] In another extended solution of the present invention, it is provided that the onboard computer adopts a dual-machine cold backup mode with manual switching and autonomous switching functions, wherein:

[0033] The autonomous switching is a process in which the two onboard computers autonomously switch between the two onboard computers.

[0034] The basis of the autonomous switching is a hardware watchdog; and

[0035] A combination of software and hardware is used to independently determine the single machine that needs to be turned on.

[0036] In another embodiment of the present invention, it is provided that the autonomous switching comprises the following steps:

[0037] After the satellite is started normally, the A unit of the onboard computer is on duty;

[0038] If machine A is abnormal and the watchdog is enabled, 2 seconds later, when the watchdog bites for the first time, the software interrupts the processing and generates a non-maskable interrupt signal, prompting the processor that the current software is running abnormally. The processor immediately switches to emergency mode, saves the current running status of machine A and backs up data, exits the interrupt, and continues to run;

[0039] If the first watchdog bite is caused by abnormal software operation, a second dog bite will occur 2 seconds later. The machine will be reset by the watchdog, including the processor and I / O system, and the clock unit and memory data will be retained;

[0040] When the watchdog is reset, the hardware circuit powers on the A and B machines of the onboard computer at the same time, so that the A and B machines run synchronously and the I / O system output is disabled;

[0041] After A and B are started synchronously, the startup segment is run first, hardware check and memory check are performed, and the watchdog is cleared in the startup segment;

[0042] The software of machine B issues a command to shut down the power of machine A and enters normal operation. At the same time, the software of machine A does not perform any operation and remains silent for 3 seconds. After 3 seconds, if machine A is not shut down by machine B, the software of machine A enters normal operation and issues a command to shut down the power of machine B.

[0043] In one embodiment of the invention, it is provided that:

[0044] After A and B machines are powered on at the same time, the software of B machine always runs first;

[0045] After the software of the A and B machines are successfully started, try to enter the normal mode of the onboard computer software. If the normal mode cannot be entered, try to enter the minimum mode; and

[0046] The software of machines A and B enter normal mode or minimum mode, confirm that the other machine has been shut down, initialize the hardware devices, enable I / O system output, obtain backup data, and return to normal operation.

[0047] In another extension of the present invention, it is provided that the manual switching of the onboard computer is controlled by direct ground commands, wherein:

[0048] The direct instructions include A turning on B, B turning on A and watchdog disabled; and

[0049] The ground station sends a direct instruction to disable the watchdog, which disables the watchdog on duty, thereby achieving the purpose of prohibiting autonomous switching.

[0050] In another extended solution of the present invention, it is provided that the data processing terminal receives an indirect remote control command from a ground station to switch between the two machines;

[0051] In an extended solution of the present invention, it is provided that the onboard computer software has an on-orbit repair function, wherein:

[0052] The order of using the on-orbit repair function is normal mode master software, normal mode backup software, minimum mode software and ground re-repair;

[0053] When the onboard computer software is in minimum mode, the ground station repairs the normal mode software through software reconstruction, which requires the ground station to segment the injected data and confirm after injection; and

[0054] In the event of a satellite computer failure, the computer memory status can be queried to obtain the current working details of the satellite computer, quickly locate and eliminate the fault, and the ground can provide support for injection and splicing and analysis of downlink data.

[0055] In another extension of the present invention, it is provided that the onboard computer software normal mode and the onboard computer software minimum mode are switched to each other, wherein:

[0056] Four input commands are used to switch between the normal mode of the onboard computer software and the minimum mode of the onboard computer software, including:

[0057] Directly instruct the computer to maintain minimum mode;

[0058] Directly instruct the computer to cancel the minimum hold mode;

[0059] indirectly instructing computer software to reboot into a minimal mode; and

[0060] Indirectly instructs the computer software to restart into normal mode.

[0061] In another extended solution of the present invention, it is provided that the step of switching between the normal mode of the onboard computer software and the minimum mode of the onboard computer software comprises:

[0062] The ground station sends a direct command to the computer to force it to maintain the minimum mode. The onboard computer modifies the telemetry parameters to restart and enter the minimum mode. After an abnormal restart or a direct command to reset the computer, the onboard computer software runs in the minimum mode.

[0063] The ground station sends a direct command to the computer to cancel the minimum hold mode, and the onboard computer modifies the telemetry parameters to restart and enter normal. After an abnormal restart or direct command to reset the computer, the onboard computer software runs in normal mode;

[0064] The onboard computer sends an indirect command to restart the computer software into the minimum mode, and after the restart, the onboard computer software runs in the minimum mode;

[0065] The onboard computer sends an indirect command to restart the computer software into the normal mode. If the onboard computer telemetry parameter is the requested minimum, the onboard computer software runs in the minimum mode after restarting, otherwise the onboard computer software runs in the normal mode.

[0066] The abnormal restart is a restart caused by a program problem, excluding a restart caused by a direct instruction or an indirect instruction;

[0067] One of the onboard computer hardware and software requests to be minimized, and after restarting, the onboard computer software enters the minimum mode.

[0068] In an extension of the present invention, it is provided that the operating mode of the onboard computer software after the direct command and the indirect command are restarted is:

[0069] Determine the telemetry parameters of the onboard computer. If the telemetry parameters of the onboard computer are restarted to enter the minimum, the onboard computer software runs in the minimum mode. If the telemetry parameters of the onboard computer are restarted to enter the normal mode, the onboard computer software runs in the normal mode.

[0070] Determine the request status of the software. If the request status of the software is minimum request, the onboard computer software runs in minimum mode. If the request status of the software is normal request, determine whether the telemetry parameter of the onboard computer is restart to enter minimum. If the telemetry parameter of the onboard computer is restart to enter minimum, the onboard computer software runs in minimum mode. Otherwise, the onboard computer software runs in normal mode.

[0071] Before the onboard computer software runs in normal mode, the code in the EEPROM is checked, first the main code is checked, and then the backup code is checked. If one of the codes is correct, the onboard computer software runs in normal mode, otherwise it runs in minimum mode.

[0072] The present invention has at least the following beneficial effects: The present invention proposes a navigation satellite integrated electronic system, which can centrally manage each separate stand-alone device of the platform and payload, and utilize the control modules of each satellite system and device for decentralized control, thereby fully and effectively utilizing the resources and information of each subsystem and device, improving the reuse of hardware and software resources, and having the characteristics of high functional density, high reliability, and unified interface. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] The present invention will be further described below with reference to specific embodiments in conjunction with the accompanying drawings.

[0074] Figure 1 The working environment of the integrated electronic system is shown;

[0075] Figure 2 The onboard computer dual-machine switching process is shown;

[0076] Figure 3The onboard computer software mode switching process is shown; and

[0077] Figure 4 The operating mode of the onboard computer software after the restart is shown. DETAILED DESCRIPTION

[0078] It should be noted that the components in the figures may be shown exaggeratedly for the sake of illustration and are not necessarily true to scale. In the figures, identical or functionally identical components are provided with the same reference numerals.

[0079] In the present invention, each embodiment is only intended to illustrate the aspects of the present invention and should not be construed as limiting.

[0080] In the present invention, unless otherwise specified, the quantifiers "a", "an" and "an" do not exclude the presence of a plurality of elements.

[0081] It should also be pointed out that in the embodiments of the present invention, for the sake of clarity and simplicity, only a portion of the parts or components may be shown, but a person of ordinary skill in the art will understand that under the teachings of the present invention, required parts or components may be added as needed in specific scenarios.

[0082] It should also be pointed out that within the scope of the present invention, the terms "same", "equal", "equal to" and the like do not mean that the two values ​​are absolutely equal, but allow a certain reasonable error, that is, the terms also cover "substantially the same", "substantially equal", and "substantially equal to".

[0083] In addition, the numbering of the steps of the methods of the present invention does not limit the execution order of the method steps. Unless otherwise specified, the method steps can be executed in different orders.

[0084] Firstly, the principle on which the present invention is based is explained.

[0085] In order to overcome the shortcomings of distributed satellite electronic systems, the present invention proposes an integrated electronic system with high functional density and high reliability. The design method of centralized management and decentralized control is adopted. According to the principle of optimal system configuration, the integrated electronic system centrally manages the separate stand-alone devices of the platform and the payload, and decentralized control is performed on them by using the control modules of the satellite systems and devices. This design method greatly improves the functional density, reduces the complexity of the whole satellite system, fully and effectively utilizes the resources and information of each subsystem and equipment, and improves the reuse of resources such as hardware and software. The system reliability is improved by means of redundant design of integrated electronic hardware and multiple working modes of software. The integrated electronic system has the characteristics of high functional density, high reliability and unified interface, and has been applied to 2 Beidou test satellites and 10 Beidou networking satellites. In-orbit verification shows that the scheme described in the present invention is reasonable and feasible, and can achieve the functions and performance required by the mission and meet the index requirements.

[0086] The present invention will be further described below with reference to specific embodiments in conjunction with the accompanying drawings.

[0087] Figure 1 The working environment of the integrated electronic system is shown;

[0088] Figure 2 The onboard computer dual-machine switching process is shown;

[0089] Figure 3 The onboard computer software mode switching process is shown; and

[0090] Figure 4 The operating mode of the onboard computer software after the restart is shown.

[0091] Embodiment 1

[0092] like Figure 1 As shown, the thermistor, SADA, and main power distribution are connected to the onboard computer respectively. The power controller and navigation task processor are connected to the onboard computer through the 1553B bus. The telemetry terminal is connected to the onboard computer through the 1553B bus and the synchronous serial port. The attitude control equipment is connected to the onboard computer through the RS422 serial port. The remote control terminal and the fixed release are connected to the telemetry terminal respectively. The spread spectrum transponder and the telemetry terminal are connected through the synchronous serial port. The battery pack, solar panels, thermistor, auxiliary power distribution, payload equipment, and autonomous operation unit are connected to the data processing terminal respectively. The autonomous operation unit is connected to the onboard computer and the high-performance unit respectively through the 1553B bus. The onboard computer is connected to the data processing terminal through the 1553B bus. The high-performance unit connects the onboard computer and the data processing terminal through the 1553B bus.

[0093] The navigation satellite integrated electronic system, namely the satellite service subsystem, includes the onboard computer and the data processing terminal. The onboard computer adopts a dual-machine cold backup mode, which is mainly responsible for remote control information processing, telemetry processing, attitude control, orbit control, autonomous thermal control, energy monitoring, sailboard control, and collecting the status data of multiple platform equipment, including the energy subsystem, attitude and orbit control subsystem, thermal control subsystem, mechanism subsystem, and the satellite service subsystem itself. The data processing terminal adopts a dual-machine cold backup mode, receives the program control instructions of the onboard computer to realize the control of the payload equipment, and collects the status data of the payload equipment, and sends it to the onboard computer after organization. The onboard computer and the data processing terminal communicate through the 1553B bus. The onboard computer sends the program control instructions to the data processing terminal through 1553B, and the data processing terminal sends the telemetry data of the payload equipment to the onboard computer through the 1553B bus. In addition, the onboard computer and the data processing terminal also form remote storage with each other through the 1553B bus. After the single machine is powered off and restored, some key data can be restored from the remote end.

[0094] There are many electrical interfaces between the satellite service subsystem and each subsystem. If all control and telemetry are connected to the chassis, the cables will be too complicated and not conducive to testing. Therefore, the satellite service system adopts the design concept of centralized management and decentralized control, using the 1553B bus to uniformly connect the computer unit and the satellite subsystems, while retaining the necessary electrical interfaces for the satellite subsystem equipment. The 1533B bus is a dual-redundant, high-reliability military bus. The 1533B bus has an automatic switching function. When one bus fails, it will automatically switch to another bus. In addition, since the 1553B bus uses two-stage transformer coupling, any short circuit or failure of the bus interface chip of any device will not affect the operation of the entire network, which is conducive to system fault isolation.

[0095] Embodiment 2

[0096] The onboard computer is the core equipment of the satellite, so the failure of the onboard computer will directly lead to the failure of the satellite mission. In order to improve the long-term on-orbit reliability of the onboard computer, the onboard computer adopts a dual-machine cold backup mode, and the design does not allow both machines to be shut down at the same time. The onboard computer has manual switching and autonomous switching functions.

[0097] Since the functions of onboard computers are concentrated and complex, an autonomous repair function must be designed to ensure business continuity. Autonomous switching is the process of autonomous reconstruction of onboard computers. The basis of this switching mechanism is the hardware watchdog. Autonomous switching uses a combination of software and hardware to autonomously determine whether a single machine needs to be turned on.

[0098] like Figure 2As shown in the figure, after the satellite starts normally, the onboard computer A is on duty. If the onboard computer A is abnormal and the watchdog is enabled, after 2 seconds, when the watchdog has the first dog bite, it will not reset the processor, but generate a non-maskable interrupt (NMI) signal, and the software interrupt processing will prompt the processor that there is an abnormality in the current software operation. The processor immediately switches to emergency mode, saves the current operating status of the onboard computer A and backs up key data, then exits the interrupt and continues to run. If the first watchdog dog bite is due to abnormal software operation, the second dog bite will inevitably occur after 2 seconds. At this time, the on-duty machine is reset by the watchdog, including the processor and I / O system, but the clock unit and memory data are retained. At the same time as the watchdog is reset, the hardware circuit powers on machines A and B at the same time. At this time, machines A and B are in a synchronous operation state, and machines A and B both prohibit I / O system output. After machines A and B are started synchronously, the startup segment is first run to perform hardware checks and memory checks, and the watchdog is cleared in the startup segment. After that, A and B adopt different processing strategies: B software issues a power off command for A and returns to normal operation. At the same time, A software does not do anything and remains silent for 3 seconds. After 3 seconds, if A is not turned off by B, A software returns to normal operation and issues a power off command for B.

[0099] In the dual-machine autonomous switching, in order to prevent the dual machines from switching back and forth constantly, after powering on at the same time, the B machine software always runs first. After the A and B machine software are successfully started, try to enter the normal mode of the satellite computer software. If it cannot enter the normal mode, try to enter the minimum mode. Once the A and B machine software enter the normal mode or minimum mode, first confirm that the other machine has been turned off, then initialize the hardware device, enable the I / O system output, obtain the backup data, and switch to normal operation.

[0100] Manual switching of onboard computers is controlled by direct commands from the ground station: machine A turns on machine B, machine B turns on machine A, and watchdog is disabled. In order to prevent repeated switching of onboard computers, the ground station should send a direct command to disable the watchdog, disable the watchdog of the on-duty machine, and achieve the purpose of prohibiting autonomous switching.

[0101] Embodiment 3

[0102] The satellite service software, i.e. the satellite computer software, is divided into two configuration items: normal mode and minimum mode. Each configuration item can be run independently. Figure 3 As shown, there are four input actions that affect the transition between normal mode and minimum mode: (1) direct instruction “the computer is forced to remain in minimum mode”; (2) direct instruction “the computer cancels the minimum mode”; (3) indirect instruction “the computer software restarts to enter minimum mode”; (4) indirect instruction “the computer software restarts to enter normal mode”.

[0103] The initial status of the onboard computer hardware is "direct command hardware request normal". The ground station sends a direct command "Computer forced to maintain minimum mode". The onboard computer modifies the telemetry parameter "Computer normal / minimum request-direct" to "restart to enter minimum", and the hardware status is converted to "direct command hardware request minimum". After the next abnormal restart or direct command "computer reset", the onboard computer software runs in minimum mode.

[0104] The ground station sends a direct command "Computer cancels minimum mode", the onboard computer modifies the telemetry parameter "Computer normal / minimum request-direct" to "restart to normal", and the hardware status is converted to "direct command hardware request normal". After the next abnormal restart or direct command "computer reset", the onboard computer software runs in normal mode.

[0105] The initial state of the onboard computer software is "indirect instruction software request normal". The onboard computer sends an indirect instruction "computer software restarts to enter minimum mode". The software state is converted to "indirect instruction software requests minimum". After restarting, the onboard computer software runs in minimum mode.

[0106] The onboard computer sends an indirect command "computer software restarts to normal mode". If the onboard computer telemetry parameter "computer normal / minimum request-direct" is "restart to minimum", the onboard computer software runs in minimum mode after restart, otherwise the onboard computer software runs in normal mode.

[0107] Abnormal restart refers to a restart caused by a program problem, excluding direct and indirect instruction restarts.

[0108] One of the onboard computer hardware and software requires minimum operation. After restart, the onboard computer software enters minimum mode:

[0109] The hardware request is normal, the software request is normal, and the onboard computer software enters normal mode after restart;

[0110] The hardware request is normal, the software request is minimum, and the onboard computer software enters the minimum mode after restart;

[0111] The hardware request is minimum, the software request is normal, and the onboard computer software enters the minimum mode after restart;

[0112] The hardware request is minimum, the software request is minimum, and the onboard computer software enters minimum mode after restart.

[0113] Embodiment 4

[0114] The operating mode of the onboard computer software after restart, such as Figure 4As shown, the telemetry parameters of the onboard computer are judged. If the telemetry parameters of the onboard computer are "restart to enter minimum", the onboard computer software runs in minimum mode; if the telemetry parameters of the onboard computer are "restart to enter normal", the onboard computer software runs in normal mode.

[0115] Determine the software request status. If the software request status is "request minimum", the onboard computer software runs in minimum mode. If the software request status is "request normal", determine whether the onboard computer telemetry parameter is "restart to enter minimum". If the onboard computer telemetry parameter is "restart to enter minimum", the onboard computer software runs in minimum mode, otherwise the onboard computer software runs in normal mode.

[0116] Before the onboard computer software runs in normal mode, the integrity of the code in the EEPROM is checked. First, the main code is checked to see if it is correct, and then the backup code is checked to see if it is correct. If any of the codes are correct, the onboard computer software runs in normal mode, otherwise the onboard computer software runs in minimum mode.

[0117] The onboard computer software adopts a three-layer structure: board support driver layer (BSP), system layer and application layer.

[0118] Board Support Driver (BSP): Provides the underlying program for interfacing with computer hardware, including various drivers, interrupt controllers, timers, serial ports, hardware initialization, etc.

[0119] System layer: includes VxWorks function library, I / O system, file system, and VxWorks kernel (Wind), which mainly provides system-level services for upper-layer application software. VxWorks is a highly real-time embedded operating system that can provide real-time management, switching and other scheduling for multiple tasks, as well as the ability to handle asynchronous concurrent events.

[0120] Application layer: Satellite service application software, which performs tasks such as management and control of computers, attitude control, timing, orbit, energy, thermal control, and payload systems, as well as whole-satellite telemetry.

[0121] The operating system VxWorks assigns each task a priority and an independent task control block TCB (memory, stack, timer, etc.), which can reduce the delay of interrupts. The task scheduling strategy of VxWorks is based on preemptive scheduling, supplemented by a time slice round-robin scheduling algorithm, which enables VxWorks to respond to high-priority tasks in a timely manner, while the time slice round-robin method can be selected between tasks to allow multiple tasks of the same priority to be executed concurrently.

[0122] The functional modules of the normal mode of the onboard computer software include satellite service module, acquisition module, telemetry module, remote control module, orbit module, attitude control module, energy module and thermal control module.

[0123] The minimum mode of the onboard computer software is a query and repair method provided when the normal system cannot operate normally. It does not provide channel data and all interrupt support. It is used for emergency repair and is an independent program. The minimum mode function of the onboard computer software belongs to an independent unit of the satellite management part. It is required to overlap with the normal system as much as possible to facilitate modification.

[0124] In order to minimize the hardware support, under normal circumstances, the minimum mode of the onboard computer software only supports telemetry, remote control, AD, DA, and frequency for the channel. When more data is needed, use the command to enter the extended mode to initialize other hardware ports, such as the 1553B bus, to get more data. In the extended mode, the ground forwarding of channel data (sent from the ground station to the channel) is supported.

[0125] Embodiment 5

[0126] Since software always relies on hardware to run, hardware failures will also be transmitted to software, so software is required to have strong fault tolerance, fault detection and self-repair capabilities. The CPU software reliability design method in the present invention includes: redundant backup design, data integrity verification, timed refresh, software on-track reconstruction, static memory allocation, variable and other coding code distance greater than 2, and hot start retention and cold start recovery technology.

[0127] Redundant backup design

[0128] Independent chips are used for dual backup storage of program code and key data. The primary data is used first when in use. When the primary data is incorrect, the backup data is tried.

[0129] Data integrity check

[0130] For "long-term" fixed data, it is verified before each use, and it is also verified when the CPU is idle. The verification results are reflected in the telemetry parameters in a timely manner.

[0131] Timed refresh

[0132] The SRAM or SDRAM used for software operation and data storage are susceptible to single-particle effects and data errors. In order to prevent the spread of errors and reduce the probability of forming multiple bit errors, the memory is refreshed regularly when the CPU is idle, and single-bit errors are repaired through hardware EDAC technology.

[0133] Software On-Track Refactoring

[0134] The onboard computer uses PROM to store the boot code and minimum mode code, and EEPROM to store the normal mode code. The EEPROM chip used in the onboard computer can be erased in the system, providing a basis for the normal mode software reconstruction. The existing onboard computer software architecture provides flexible options for software reconstruction, from small to large scale, including parameter changes, mode changes, process reconstruction, and operating system reconstruction. Software reconstruction provides a means to repair satellite on-orbit faults, reconstruct and upgrade satellite functions, and isolate faults, which is conducive to extending the service life of satellites.

[0135] Static memory allocation measures prevent the process from accidentally hanging due to lack of memory.

[0136] Hot start retention and cold start recovery technologies ensure work continuity after CPU restart and active / standby switchover.

[0137] The present invention has at least the following beneficial effects: The present invention proposes a navigation satellite integrated electronic system, which can centrally manage each separate stand-alone device of the platform and payload, and utilize the control modules of each satellite system and device for decentralized control, thereby fully and effectively utilizing the resources and information of each subsystem and device, improving the reuse of hardware and software resources, and having the characteristics of high functional density, high reliability, and unified interface.

[0138] Although some embodiments of the present invention have been described in this application document, it will be appreciated by those skilled in the art that these embodiments are merely shown as examples. Those skilled in the art may conceive of numerous variations, alternatives, and improvements under the teachings of the present invention without departing from the scope of the present invention. The appended claims are intended to define the scope of the present invention and thereby cover methods and structures within the scope of these claims themselves and their equivalents.

Claims

1. A navigation satellite integrated electronic system, characterized in that: include: The onboard computer is configured to execute all algorithms and autonomous management functions; the onboard computer uses a dual-machine cold backup mode to execute remote control information processing, telemetry processing, attitude control, orbit control, autonomous thermal control, energy monitoring, sailboard control, and collect status data of platform equipment, including data of the energy subsystem, attitude and orbit control subsystem, thermal control subsystem, mechanism subsystem, and satellite service subsystem; the satellite service subsystem is a navigation satellite integrated electronic system; The data processing terminal is configured to receive instructions issued by the onboard computer and collect payload equipment data, and return the collected payload equipment data to the onboard computer; the data processing terminal uses a dual-machine cold backup mode to receive program-controlled instructions from the onboard computer to control the payload equipment, and collects status data of the payload equipment, which is organized and sent to the onboard computer, and has no autonomous control function; The onboard computer and the data processing terminal communicate via a 1553B bus; The onboard computer and the data processing terminal mutually constitute remote storage via the 1553B bus, and after a single machine loses power and recovers, data is recovered from the remote end; The 1553B bus uniformly connects the onboard computer unit and multiple satellite subsystems, and reserves electrical interfaces for the equipment of the satellite subsystems; as well as Integrated electronic system software, including a normal mode of onboard computer software, a minimum mode of onboard computer software, data processing terminal software and FPGA software; the normal mode of onboard computer software is a software configuration that runs when the onboard computer is in orbit and the hardware functions normally and the software is intact; The functions of the onboard computer software in normal mode include satellite-to-ground remote control, inter-satellite remote control, satellite-to-ground telemetry, inter-satellite telemetry, energy management, payload management, orbit calculation and attitude and orbit control calculation; The normal mode of the onboard computer software requires the onboard computer processor, EEPROM, and SRAM to work normally; The minimum software mode of the onboard computer is a functional degradation configuration after the software and hardware errors occur during the onboard computer's on-orbit period; The minimum mode of the onboard computer software retains telemetry, remote control, attitude control and energy management functions, and requires minimal hardware resources; The minimum mode of the onboard computer software is a query and repair method provided when the normal system cannot operate normally. It does not provide channel data and interrupt support and is used for emergency repair. The minimum mode of the onboard computer software is an independent program; The minimum mode function of the onboard computer software belongs to an independent unit of the onboard management part; The minimum mode of the onboard computer software only supports telemetry, remote control, AD, DA, and frequency for the channel; and Use the command to enter the extended mode, initialize the hardware port, and support ground forwarding of channel data in the extended mode.

2. The navigation satellite integrated electronic system according to claim 1, characterized in that: The onboard computer and the data processing terminal communicate via a 1553B bus, wherein: The onboard computer sends program control instructions to the data processing terminal via the 1553B bus; and The data processing terminal sends the telemetry data of the payload equipment to the onboard computer via the 1553B bus.

3. The navigation satellite integrated electronic system according to claim 1, characterized in that: The 1553B bus is a dual-redundant military bus with an automatic switching function. When one bus fails, it automatically switches to another bus; and The 1553B bus adopts two-stage transformer coupling.

4. The navigation satellite integrated electronic system according to claim 1, characterized in that: The data processing terminal software is an extension of the onboard computer software; and The data processing terminal software executes the remote control instructions forwarded by the onboard computer and provides the onboard computer with telemetry data of the payload equipment, and has no autonomous function.

5. The navigation satellite integrated electronic system according to claim 1, characterized in that: The onboard computer adopts a dual-machine cold backup mode, with manual switching and autonomous switching functions, wherein: The autonomous switching is a process in which the two onboard computers autonomously switch between the two onboard computers. The basis of the autonomous switching is a hardware watchdog; and A combination of software and hardware is used to independently determine the single machine that needs to be turned on.

6. The navigation satellite integrated electronic system according to claim 5, characterized in that: The autonomous switching comprises the following steps: After the satellite is started normally, the A unit of the onboard computer is on duty; If machine A is abnormal and the watchdog is enabled, 2 seconds later, when the watchdog bites for the first time, the software interrupts the processing and generates a non-maskable interrupt signal, prompting the processor that the current software is running abnormally. The processor immediately switches to emergency mode, saves the current running status of machine A and backs up data, exits the interrupt, and continues to run; If the first watchdog bite is caused by abnormal software operation, a second dog bite will occur 2 seconds later. The machine will be reset by the watchdog, including the processor and I / O system, and the clock unit and memory data will be retained; When the watchdog is reset, the hardware circuit powers on the A and B machines of the onboard computer at the same time, so that the A and B machines run synchronously and the I / O system output is disabled; After A and B are started synchronously, the startup segment is run first, hardware check and memory check are performed, and the watchdog is cleared in the startup segment; The software of machine B issues a command to shut down the power of machine A and enters normal operation. At the same time, the software of machine A does not perform any operation and remains silent for 3 seconds. After 3 seconds, if machine A is not shut down by machine B, the software of machine A enters normal operation and issues a command to shut down the power of machine B.

7. The navigation satellite integrated electronic system according to claim 6, characterized in that: After A and B machines are powered on at the same time, the software of B machine always runs first; After the software of the A and B machines are successfully started, try to enter the normal mode of the onboard computer software. If you cannot enter the normal mode, try to enter the minimum mode; as well as The software of machines A and B enter normal mode or minimum mode, confirm that the other machine has been shut down, initialize the hardware devices, enable I / O system output, obtain backup data, and return to normal operation.

8. The navigation satellite integrated electronic system according to claim 7, characterized in that: The manual switching of the onboard computer is controlled by direct ground commands, where: The direct instructions include machine A turning on machine B, machine B turning on machine A, and watchdog prohibition; and The ground station sends a direct instruction to disable the watchdog, which disables the watchdog on duty, thereby achieving the purpose of prohibiting autonomous switching.

9. The navigation satellite integrated electronic system according to claim 1, characterized in that: The data processing terminal receives indirect remote control instructions from the ground station to switch between the two machines.

10. The navigation satellite integrated electronic system according to claim 1, characterized in that: The onboard computer software has an on-orbit repair function, wherein: The order of using the on-orbit repair function is normal mode master software, normal mode backup software, minimum mode software and ground re-repair; When the onboard computer software is in minimum mode, the ground station repairs the normal mode software through software reconstruction, which requires the ground station to segment the injected data and confirm after injection; and In the event of a satellite computer failure, the computer memory status can be queried to obtain the current working details of the satellite computer, quickly locate and eliminate the fault, and the ground can provide support for injection and splicing and analysis of downlink data.

11. The navigation satellite integrated electronic system according to claim 1, characterized in that: The onboard computer software normal mode and the onboard computer software minimum mode are switched between each other, wherein: Four input commands are used to switch between the normal mode of the onboard computer software and the minimum mode of the onboard computer software, including: Directly instruct the computer to maintain minimum mode; Directly instruct the computer to cancel the minimum hold mode; indirectly instructing computer software to reboot into a minimal mode; and Indirectly instructs the computer software to restart into normal mode.

12. The navigation satellite integrated electronic system according to claim 11, characterized in that: The step of switching between the normal mode of the onboard computer software and the minimum mode of the onboard computer software comprises: The ground station sends a direct command to the computer to force it to maintain the minimum mode. The onboard computer modifies the telemetry parameters to restart and enter the minimum mode. After an abnormal restart or a direct command to reset the computer, the onboard computer software runs in the minimum mode. The ground station sends a direct command to the computer to cancel the minimum mode, and the onboard computer modifies the telemetry parameters to restart and enter the minimum mode. After an abnormal restart or direct command to reset the computer, the onboard computer software runs in normal mode; The onboard computer sends an indirect command to restart the computer software into the minimum mode, and after the restart, the onboard computer software runs in the minimum mode; The onboard computer sends an indirect command to restart the computer software into the normal mode. If the onboard computer telemetry parameter is the requested minimum, the onboard computer software runs in the minimum mode after restarting, otherwise the onboard computer software runs in the normal mode. The abnormal restart is a restart caused by a program problem, excluding a restart caused by a direct instruction or an indirect instruction; and One of the onboard computer hardware and software requests to be minimized, and after restarting, the onboard computer software enters the minimum mode.

13. The navigation satellite integrated electronic system according to claim 12, characterized in that: The operating modes of the onboard computer software after direct and indirect command restart include: Determine the telemetry parameters of the onboard computer. If the telemetry parameters of the onboard computer are restarted to enter the minimum, the onboard computer software runs in the minimum mode. If the telemetry parameters of the onboard computer are restarted to enter the normal mode, the onboard computer software runs in the normal mode. Determine the request status of the software. If the request status of the software is minimum request, the onboard computer software runs in minimum mode. If the request status of the software is normal request, determine whether the telemetry parameter of the onboard computer is restart to enter minimum. If the telemetry parameter of the onboard computer is restart to enter minimum, the onboard computer software runs in minimum mode. Otherwise, the onboard computer software runs in normal mode. Before the onboard computer software runs in normal mode, the code in the EEPROM is checked, first the main code is checked, and then the backup code is checked. If one of the codes is correct, the onboard computer software runs in normal mode, otherwise it runs in minimum mode.

Images