Mechanical arm control method and device capable of resisting single event upset

Abstract

The invention discloses a mechanical arm control method and device capable of resisting single event upset, and the mechanical arm control method adopts a first processing unit with an error detection and correction function and a second processing unit without the error detection and correction function for control. Wherein an algorithm execution module of the second processing unit is embedded in the first processing unit, and the method comprises the following steps: the first processing unit receives a mode switching instruction sent by an external control end, and determines a mode flag bit according to the mode switching instruction; the first processing unit receives a mechanical arm control instruction; when the mode flag bit is in a first state, the first processing unit forwards a received mechanical arm control instruction to the second processing unit for execution; and when the mode flag bit is in the second state, the first processing unit calls the algorithm execution module to directly execute the mechanical arm control instruction. According to the invention, single event upset resistance can be realized with low cost and high reliability.

Description

Technical Field

[0001] The present invention relates to the technical field of robotic arm control, and in particular to a robotic arm control method resistant to single-particle upset. Background Art

[0002] The space environment in which spacecraft operate is host to a vast array of high-energy particles and cosmic rays. These particles and rays can penetrate spacecraft shielding and interact with component materials, producing radiation effects that can cause device performance degradation or malfunction, impacting the on-orbit safety of the spacecraft. The primary sources of space radiation that can cause radiation effects on components include the Earth's radiation belts, galactic cosmic rays, solar cosmic rays, and artificial radiation.

[0003] Among these, the radiation effect that most severely impacts chip operation is the "single event effect." According to statistics, between 1971 and 1986, 39 synchronous satellites launched overseas experienced a total of 1,589 failures, 1,129 of which were related to space radiation, and 621 of which were caused by single event effects. These statistics demonstrate that the primary cause of failures in electronic devices used in aerospace applications is space radiation, with single event effects accounting for a significant proportion.

[0004] Some of these faults are permanent and irreversible, such as a single-event latchup that causes a localized short circuit within the chip, generating high current and damaging the device. These errors can be avoided by applying specific processes or device libraries. However, the majority of errors in space are recoverable due to logic state transitions in semiconductor devices, such as single-event upsets that cause memory errors.

[0005] The disclosure of the above background technology content is only used to assist in understanding the concept and technical solution of the present invention. It does not necessarily belong to the prior art of this patent application. In the absence of clear evidence that the above content has been disclosed on the filing date of this patent application, the above background technology should not be used to evaluate the novelty and creativity of this application. Summary of the Invention

[0006] To solve the above technical problems, the present invention proposes a single event upset (SEEU) resistant robotic arm control method and device, which can achieve SEEU resistance with low cost and high reliability.

[0007] In order to achieve the above object, the present invention adopts the following technical solutions:

[0008] In a first aspect, the present invention discloses a method for controlling a robotic arm resistant to single event upsets, which employs a first processing unit with error detection and correction functions and a second processing unit without error detection and correction functions for control, wherein an algorithm execution module of the second processing unit is embedded in the first processing unit, comprising the following steps:

[0009] The first processing unit receives a mode switching instruction sent by an external control terminal, and determines a mode flag bit according to the mode switching instruction;

[0010] The first processing unit receives a robotic arm control instruction;

[0011] When the mode flag is in the first state, the first processing unit forwards the received robotic arm control instruction to the second processing unit for execution;

[0012] When the mode flag is in the second state, the first processing unit calls the algorithm execution module to directly execute the robotic arm control instruction.

[0013] Preferably, when the first processing unit calls the algorithm execution module to directly execute the robot arm control instruction, the first processing unit calls the algorithm execution module at preset time intervals through the virtual timing module to maintain synchronization with the cycle of executing the algorithm by the second processing module.

[0014] Preferably, the preset time interval ranges from 10ms to 50ms.

[0015] Preferably, the mode switching instruction is obtained based on an analysis by the external control end based on telemetry data of whether the second processing unit is affected by a single-particle flip event; when the external control end analyzes based on telemetry data that the second processing unit is not affected by a single-particle flip event, the mode flag is determined to be in the first state according to the mode switching instruction; when the external control end analyzes based on telemetry data that the second processing unit is affected by a single-particle flip event, the mode flag is determined to be in the second state according to the mode switching instruction.

[0016] Preferably, the operating main frequency of the first processing unit is in a first main frequency range, and the operating main frequency of the second processing unit is in a second main frequency range, and the second main frequency range is higher than the first main frequency range.

[0017] Preferably, the first main frequency range is less than 100 MHz, and the second main frequency range is greater than 100 MHz.

[0018] In a second aspect, the present invention discloses a single-event upset resistant robotic arm control device, comprising a first processing unit and a second processing unit, wherein the first processing unit has an error detection and correction function, and the second processing unit does not have an error detection and correction function, and an algorithm execution module of the second processing unit is embedded in the first processing unit, wherein:

[0019] The first processing unit is configured to receive a mode switching instruction sent by an external control terminal and determine a mode flag according to the mode switching instruction; receive a robotic arm control instruction and, when the mode flag is in a first state, send the robotic arm control instruction to the second processing unit; and, when the mode flag is in a second state, call the algorithm execution module to directly execute the robotic arm control instruction;

[0020] The second processing unit is configured to call the algorithm execution module to directly execute the robotic arm control instruction when receiving the robotic arm control instruction from the first processing unit.

[0021] Preferably, the first processing unit is provided with an error detection and correction function module, and the error detection and correction function module includes a check code generation unit and a check code comparison unit. The check code generation unit is used to generate a check code when data is written, and the check code comparison unit is used to perform check code comparison when data is read.

[0022] Preferably, when the first processing unit calls the algorithm execution module to directly execute the robot arm control instruction, the first processing unit calls the algorithm execution module at preset time intervals through the virtual timing module to maintain synchronization with the cycle of executing the algorithm by the second processing module.

[0023] Preferably, the mode switching instruction is obtained based on an analysis by the external control end based on telemetry data of whether the second processing unit is affected by a single-particle flip event; when the external control end analyzes based on telemetry data that the second processing unit is not affected by a single-particle flip event, the mode flag is determined to be in the first state according to the mode switching instruction; when the external control end analyzes based on telemetry data that the second processing unit is affected by a single-particle flip event, the mode flag is determined to be in the second state according to the mode switching instruction.

[0024] Compared with the prior art, the beneficial effects of the present invention are as follows: the single-particle upset resistant robotic arm control method disclosed in the present invention combines a first processing unit with an EDAC function and a second processing unit without an EDAC function, so that when a single-particle upset occurs in the second processing unit without an EDAC function, the first processing unit with an EDAC function is used to perform most of the functions of the second processing unit, which can effectively resist the impact of the single-particle upset on the aircraft mission and avoid the failure of the entire space test mission; and through this design, the thickness of the outer shell of the payload controller or the thickness of the aircraft protective layer do not need to be increased. In summary, the present invention achieves reliability and cost optimization of the spacecraft robotic arm through collaborative control of dual processing units under a single-particle upset environment.

[0025] Other beneficial effects of the embodiments of the present invention will be further described below. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 This is a flow chart of a single event upset resistant robotic arm control method according to a preferred embodiment of the present invention;

[0027] Figure 2 It is a software implementation flow chart of a specific embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following is a detailed description of the embodiments of the present invention. It should be emphasized that the following description is only exemplary and is not intended to limit the scope of the present invention and its application.

[0029] It should be noted that when an element is referred to as being "fixed to" or "disposed on" another element, it can be directly on the other element or indirectly on the other element. When an element is referred to as being "connected to" another element, it can be directly connected to the other element or indirectly connected to the other element. In addition, connection can be used for both fixing and circuit / signal communication.

[0030] It should be understood that the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the embodiments of the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation, and therefore cannot be understood as limiting the present invention.

[0031] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of such features. In the description of the embodiments of the present invention, "plurality" means two or more, unless otherwise specifically defined.

[0032] The following is an explanation of the meaning of the terms in this case.

[0033] Single-Event Upsets (SEU) refers to the change in the potential state of a component caused by radiation, where "0" becomes "1" or "1" becomes "0", but generally does not cause physical damage to the device.

[0034] EDAC (Error Detection and Correction) is a hardware-implemented error detection and correction mechanism used to protect memory and other integrated circuits from electromagnetic interference and other environmental factors, particularly in harsh electromagnetic environments. EDAC generates a checksum when writing data and stores it with the data. It also reads and compares the checksum when reading data.

[0035] like Figure 1 As shown, the first embodiment of the present invention discloses a single event upset resistant robotic arm control method, which uses a first processing unit with error detection and correction functions and a second processing unit without error detection and correction functions for control, wherein the algorithm execution module of the second processing unit is embedded in the first processing unit, including the following steps:

[0036] Receive a mode switching instruction sent by an external control terminal through a preset communication protocol, and determine a mode flag bit according to the mode switching instruction;

[0037] The first processing unit receives a robotic arm control instruction;

[0038] When the mode flag is in the first state, the first processing unit forwards the received robotic arm control instruction to the second processing unit for execution;

[0039] When the mode flag is in the second state, the first processing unit calls the algorithm execution module to directly execute the robotic arm control instruction.

[0040] In a further embodiment, when the first processing unit calls the algorithm execution module to directly execute the robot arm control instructions, the first processing unit calls the algorithm execution module at a preset time interval through the virtual timing module to maintain synchronization with the cycle of algorithm execution of the second processing module. Specifically, the preset time interval ranges from 10ms to 50ms, for example, 20ms.

[0041] In a further embodiment, the first processing unit is provided with an error detection and correction function module, while the second processing unit does not have an error detection and correction function module. The error detection and correction function module includes a check code generation unit and a check code comparison unit. The check code generation unit is used to generate a check code when data is written, and the check code comparison unit is used to perform check code comparison when data is read.

[0042] The mode switching instruction is obtained based on the external control end analyzing, based on the telemetry data, whether the second processing unit has been subjected to a single-event upset event. Furthermore, when the external control end analyzes, based on the telemetry data, that the second processing unit has not been subjected to a single-event upset event, the mode flag is set to a first state based on the mode switching instruction; and when the external control end analyzes, based on the telemetry data, that the second processing unit has been subjected to a single-event upset event, the mode flag is set to a second state based on the mode switching instruction.

[0043] The first processing unit operates at a main frequency within a first main frequency range, and the second processing unit operates at a main frequency within a second main frequency range, where the second main frequency range is higher than the first main frequency range. Furthermore, the first main frequency range is less than 100 MHz, and the second main frequency range is greater than 100 MHz. Specifically, for example, the first main frequency range is 50 MHz to 100 MHz, and the second main frequency range is 100 MHz to 200 MHz.

[0044] Among them, the above-mentioned robotic arm control method can be applied to a spacecraft robotic arm control system.

[0045] A second embodiment of the present invention discloses a single-event upset resistant robotic arm control device, comprising a first processing unit and a second processing unit, wherein the first processing unit has an error detection and correction function, and the second processing unit does not have an error detection and correction function, and an algorithm execution module of the second processing unit is embedded in the first processing unit, wherein:

[0046] The first processing unit is configured to receive a mode switching instruction sent by an external control terminal and determine a mode flag according to the mode switching instruction; receive a robotic arm control instruction and, when the mode flag is in a first state, send the robotic arm control instruction to the second processing unit; and, when the mode flag is in a second state, call the algorithm execution module to directly execute the robotic arm control instruction;

[0047] The second processing unit is configured to call the algorithm execution module to directly execute the robotic arm control instruction when receiving the robotic arm control instruction from the first processing unit.

[0048] Furthermore, the first processing unit is provided with an error detection and correction function module, which includes a check code generation unit and a check code comparison unit. The check code generation unit is used to generate a check code when data is written, and the check code comparison unit is used to perform check code comparison when data is read.

[0049] When the first processing unit calls the algorithm execution module to directly execute the robotic arm control instruction, the first processing unit calls the algorithm execution module at a preset time interval through the virtual timing module to maintain synchronization with the cycle of executing the algorithm of the second processing module; wherein the value range of the preset time interval is 10ms to 50ms.

[0050] The mode switching instruction is obtained by the external control end analyzing whether the second processing unit is affected by a single-particle upset event based on the telemetry data; when the external control end analyzes based on the telemetry data that the second processing unit is not affected by the single-particle upset event, the mode flag is determined to be in the first state according to the mode switching instruction; when the external control end analyzes based on the telemetry data that the second processing unit is affected by the single-particle upset event, the mode flag is determined to be in the second state according to the mode switching instruction.

[0051] The first processing unit operates at a main frequency within a first main frequency range, and the second processing unit operates at a main frequency within a second main frequency range, where the second main frequency range is higher than the first main frequency range. Furthermore, the first main frequency range is less than 100 MHz, and the second main frequency range is greater than 100 MHz. Specifically, for example, the first main frequency range is 50 MHz to 100 MHz, and the second main frequency range is 100 MHz to 200 MHz.

[0052] The following further describes in detail the single event upset resistant robotic arm control method of the preferred embodiment of the present invention in conjunction with a specific embodiment.

[0053] A specific embodiment of the present invention proposes a method for switching the control mode of a robotic arm controller running in a space environment. For a controller with two control chips, one is responsible for scheduling and communication with the host computer (A chip, main control chip), and the other is responsible for planning and controlling the robotic arm (B chip, sub-control chip). The main frequency of chip A is relatively slow (the main frequency is below 100MHz) but has an EDAC function, and the main frequency of chip B is relatively fast (the main frequency is above 100MHz) but does not have an EDAC function. Under normal circumstances, chip A will forward the robotic arm control instructions received to chip B, and chip B is responsible for planning and controlling the robotic arm. During the software development process, the robotic arm planning and control code of chip B is embedded in the code of chip A, and a mode switching instruction is set in the code of chip A according to the existing communication protocol. The algorithm cycle period of chip B is virtualized in chip A through a timer (that is, the period for calling the algorithm, for example, 20ms). When chip B experiences a single-event upset, chip A receives mode switch instruction 1 and sets a flag. When the host computer sends planning instructions to chip B, chip A no longer forwards them to chip B but instead executes them itself. Chip A uses a virtual timer with the same period as chip B, allowing the robot's motion planning and control algorithms to achieve the same results as when chip B is running. This ensures that the entire robot can execute its tasks even when chip B experiences a single-event upset. When chip B does not experience a single-event upset, chip A receives mode switch instruction 2 and clears the flag. When the host computer sends robot control instructions, chip A forwards them normally to chip B, which then executes the robot's planning and control.

[0054] Among them, the software implementation process is as follows Figure 2 As shown in the figure, ground personnel determine whether chip B has been affected by a single-event upset based on telemetry data. If chip B is affected, chip A receives mode switch instruction 1 and sets a flag. The ground sends a robotic arm control instruction to chip A, which executes the instruction to control the robot's motion. If chip B is not affected by a single-event upset, chip A receives mode switch instruction 2 and clears the flag. The ground sends a robotic arm control instruction to chip A, which forwards the instruction to chip B, which executes the instruction to control the robot's motion.

[0055] A specific embodiment of the present invention discloses a method for designing software for a robotic arm controller that operates in a space environment. This method has the characteristics of low cost and high reliability. The robotic arm controller has a main control chip (A chip) with an EDAC function that is responsible for the task scheduling of the entire controller and communication with the aircraft. The auxiliary control chip (B chip) that does not have an EDAC function is responsible for the execution of the robotic arm motion planning and control algorithms. Due to the presence of various high-energy particles and rays in the space environment, single-particle flips will be caused in the B chip, causing abnormal movement of the robotic arm, and ultimately resulting in the inability to complete the target task. When a single-particle flip failure occurs in the B chip, the ground control personnel send an instruction to chip A to continue to instruct the planning task of the robotic arm, and the robotic arm continues to perform the task. Therefore, without the need to increase the protective layer of the spacecraft, the dependence on high-frequency chips is reduced through dynamic switching, thereby improving the fault tolerance of long-term missions.

[0056] If only CPU chips without EDAC (Error Detection and Correction) functionality are used to control the spacecraft's robotic arm, the spacecraft's protective layer or outer shell will need to be thickened, increasing the weight of the spacecraft and requiring a heavier rocket for launch, increasing costs. Furthermore, this approach can only be used on spacecraft with shorter lifespans. Extensive simulation and testing are required to determine the specific amount of outer shell expansion required. To fully assess the feasibility of the solution, even non-EDAC-enabled control chips must undergo radiation resistance screening, consuming significant manpower and financial resources. Furthermore, if only control chips with EDAC functionality are used, their slower clock speeds prevent the use of high-performance, computationally intensive algorithms. Consequently, the program design logic must be simplified, preventing the aerospace industry from utilizing advanced software algorithms used in commercial applications on the ground. This further slows down the upgrade of aerospace products. In an embodiment of the present invention, a main control chip with EDAC functionality is combined with a secondary control chip without EDAC functionality. This allows the main control chip with EDAC functionality to perform most of the secondary control chip's functions if a single-event upset (SEEU) occurs in the secondary control chip without EDAC functionality. This effectively mitigates the impact of SEEUs on the spacecraft mission and prevents the failure of the entire space test mission. Furthermore, this design eliminates the need to increase the thickness of the payload controller's casing or the thickness of the spacecraft's protective layer.

[0057] The background section of the present invention may contain background information about the problem or environment of the present invention rather than describing prior art by others. Therefore, the inclusion of content in the background section is not an admission by the applicant that the prior art is available.

[0058] The above description further details the present invention in conjunction with specific / preferred embodiments, and the specific implementation of the present invention should not be construed as being limited to these descriptions. Persons skilled in the art will appreciate that, without departing from the spirit of the present invention, they may make various substitutions or modifications to the described embodiments, and these substitutions or modifications should be considered to fall within the scope of protection of the present invention. Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "preferred embodiments," "examples," "specific examples," or "some examples" indicates that the specific features, structures, materials, or characteristics described in conjunction with such embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of these terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples. Furthermore, those skilled in the art may combine and assemble the different embodiments or examples described in this specification, as well as features from different embodiments or examples, without conflicting opinions. Although the embodiments of the present invention and their advantages have been described in detail, it should be understood that various changes, substitutions, and modifications may be made herein without departing from the scope of the appended claims.

Claims

1. A single event upset resistant robotic arm control method, characterized in that: A first processing unit with error detection and correction functions and a second processing unit without error detection and correction functions are used for control, wherein the algorithm execution module of the second processing unit is embedded in the first processing unit, including the following steps: The first processing unit receives a mode switching instruction sent by an external control terminal, and determines a mode flag bit according to the mode switching instruction; The first processing unit receives a robotic arm control instruction; When the mode flag is in the first state, the first processing unit forwards the received robotic arm control instruction to the second processing unit for execution; When the mode flag is in the second state, the first processing unit calls the algorithm execution module to directly execute the robotic arm control instruction.

2. The single event upset resistant robotic arm control method according to claim 1, characterized in that: When the first processing unit calls the algorithm execution module to directly execute the robot arm control instruction, the first processing unit calls the algorithm execution module at preset time intervals through the virtual timing module to maintain synchronization with the cycle of executing the algorithm of the second processing module.

3. The single event upset resistant robotic arm control method according to claim 2, characterized in that: The preset time interval ranges from 10ms to 50ms.

4. The single event upset resistant robotic arm control method according to claim 1, characterized in that: The mode switching instruction is obtained by analyzing whether the second processing unit is affected by a single event upset event based on telemetry data by the external control end; when the external control end analyzes based on the telemetry data that the second processing unit is not affected by the single event upset event, the mode flag is determined to be in the first state according to the mode switching instruction; When the external control end analyzes based on the telemetry data that the second processing unit is subjected to a single event upset event, the mode flag is determined to be in the second state according to the mode switching instruction.

5. The single event upset resistant robotic arm control method according to claim 1, characterized in that: The operating main frequency of the first processing unit is within a first main frequency range, and the operating main frequency of the second processing unit is within a second main frequency range, which is higher than the first main frequency range.

6. The single event upset resistant robotic arm control method according to claim 5, characterized in that: The first main frequency range is less than 100 MHz, and the second main frequency range is greater than 100 MHz.

7. A single event upset resistant robotic arm control device, characterized in that: The system comprises a first processing unit and a second processing unit, wherein the first processing unit has an error detection and correction function, and the second processing unit does not have an error detection and correction function, and an algorithm execution module of the second processing unit is embedded in the first processing unit, wherein: The first processing unit is configured to receive a mode switching instruction sent by an external control terminal and determine a mode flag according to the mode switching instruction; receive a robotic arm control instruction and, when the mode flag is in a first state, send the robotic arm control instruction to the second processing unit; and, when the mode flag is in a second state, call the algorithm execution module to directly execute the robotic arm control instruction; The second processing unit is configured to call the algorithm execution module to directly execute the robotic arm control instruction when receiving the robotic arm control instruction from the first processing unit.

8. The single event upset resistant robotic arm control device according to claim 7, characterized in that: The first processing unit is provided with an error detection and correction function module, which includes a check code generation unit and a check code comparison unit. The check code generation unit is used to generate a check code when data is written, and the check code comparison unit is used to perform check code comparison when data is read.

9. The single event upset resistant robotic arm control device according to claim 7, characterized in that: When the first processing unit calls the algorithm execution module to directly execute the robot arm control instruction, the first processing unit calls the algorithm execution module at preset time intervals through the virtual timing module to maintain synchronization with the cycle of executing the algorithm of the second processing module.

10. The single event upset resistant robotic arm control device according to claim 7, characterized in that: The mode switching instruction is obtained by analyzing whether the second processing unit is affected by a single event upset event based on telemetry data by the external control end; when the external control end analyzes based on the telemetry data that the second processing unit is not affected by the single event upset event, the mode flag is determined to be in the first state according to the mode switching instruction; When the external control end analyzes based on the telemetry data that the second processing unit is subjected to a single event upset event, the mode flag is determined to be in the second state according to the mode switching instruction.

Images