A method for verifying the EDL process of deep space probes

Abstract

The present invention discloses a method for verifying the EDL process of a deep space detector, and proposes a three-step verification strategy of "flight mission profile decomposition", "use case scenario identification" and "test case generation" for the complex EDL process. The method effectively ensures the completeness of the logic verification coverage of the complex system while shortening the test time; it can advance the high-incidence period of failures and quickly converge the failure rate change curve, thereby improving the test reliability; it can reasonably test the typical scenarios and failure scenarios of the complex process, and ensure the credibility of the test results; the method can conduct a more comprehensive verification of the EDL process in advance before the simulated flight test in the system-level test phase, which provides an effective and feasible means for discovering abnormal problems in the EDL process, a key link in the detection mission, as early as possible, and also provides a strong guarantee for the rapid iteration of detector development.

Description

Technical Field

[0001] The present invention belongs to the technical field of spacecraft system-level test design and verification, and specifically relates to an EDL process verification method for a deep space probe. Background Art

[0002] The Mars rover consists of an orbiter and a lander. The orbiter carries the lander to complete the Earth-Mars transfer, Mars capture, orbit lowering maneuver and other flight processes, and then releases the lander. After the lander separates from the orbiter, it will fly for about 3.5 hours and enter the Martian atmosphere in a predetermined entry attitude. After multiple decelerations during the entry, descent and landing process (EDL), it will land on the Martian surface in a soft landing manner, deploy the ramp mechanism, and the Mars rover will leave the landing platform to carry out and complete the patrol exploration mission. The EDL process of the lander is a key link in the Mars mission and is directly related to the success or failure of the Mars exploration mission.

[0003] At present, in the AI&T (Assembly Integration & Test) stage of deep space probes, there is a lack of system support for EDL complex process test verification strategies and methods, resulting in a serious lack of test verification work in this direction. The test means can only be verified through the final simulated flight test, which is very unfavorable for early detection of abnormal problems in the key links of EDL. This status quo can no longer meet the requirements of complex spacecraft test coverage and test reliability for test design, and there is an urgent need to find methods to support EDL complex process verification. Summary of the invention

[0004] In view of this, the purpose of the present invention is to provide a deep space detector EDL process verification method, which realizes the test verification of the complex EDL process of the deep space detector and provides a comprehensive, reliable and effective test method for the verification of the detector EDL process.

[0005] A deep space detector EDL process verification method, comprising:

[0006] Step 1: Decompose the EDL process of the deep space probe based on the "flight mission profile", specifically:

[0007] The EDL flight phase of the detector is set as the flight phase F(T1, T2); in this phase, the detector completes a series of flight tasks according to the predetermined flight program, which is called "flight unit f(t1, t2)", including "initial flight state vector P t1 ”, “Termination flight state vector P t2 ” and “Task Unit G t1t2 "; wherein the flight unit includes a plurality of task units executed in chronological order;

[0008] Step 2: Identify the use case scenario based on the flight profile obtained by decomposing the flight process. The process is as follows:

[0009] Step 21. Use a directed graph to describe the event flow of the use case: the trunk of the directed graph is the basic flow, which describes a typical event flow of the use case, and the branches of the directed graph are alternative flows, which describe the event flow that occurs when an exception or error occurs; let point B be the start point of the use case and point E be the end point of the use case; the basic flow and the event flow constitute all possible paths between the start point B and the end point E in the directed graph;

[0010] Step 22: Search all possible paths of the directed graph and represent them in a tree format.

[0011] Step 23: Search the tree until all paths starting from the starting point B and ending at the ending point E are found, and all use case scenarios are obtained;

[0012] Step 3: Execute all use case scenarios to complete the functional verification of the normal mode and failure mode of the EDL process.

[0013] Preferably, the task unit is a certain subsystem task unit, or a combined task unit of multiple subsystems.

[0014] Preferably, use case scenarios are identified and managed using a matrix or decision table.

[0015] Preferably, review and validate the use case scenarios.

[0016] Preferably, eliminate redundant or equivalent use case scenarios.

[0017] The present invention has the following beneficial effects:

[0018] This invention systematically proposes for the first time a three-step verification strategy for EDL complex processes: "mission profile decomposition", "use case scenario identification", and "test case generation". This changes the current situation where EDL complex process verification is mainly based on test experience. It provides a top-down analysis approach for EDL complex process verification. It enables test designers to complete the test design and verification of spacecraft EDL complex processes based on this method.

[0019] This method effectively ensures the completeness of complex system logic verification coverage while shortening the test time; it can advance the high-incidence period of faults and quickly converge the failure rate change curve, thereby improving test reliability; it can reasonably test typical scenarios and fault scenarios of complex processes, ensuring the credibility of test results;

[0020] This method can conduct a more comprehensive verification of the EDL process in advance before the simulated flight test in the system-level testing phase, providing an effective and feasible means to discover abnormal problems in the EDL process, a key link in the detection mission, as early as possible, and also providing a strong guarantee for the rapid iteration of detector development. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a flow chart of the verification method of the present invention;

[0022] FIG. 2( a ) is a directed graph of the flight profile from entering the atmosphere to landing in an embodiment of the present invention;

[0023] FIG2( b ) is a search tree diagram of the flight profile from entering the atmosphere to landing in an embodiment of the present invention;

[0024] FIG2(c) is an identification scene of the flight profile from entering the atmosphere to landing in an embodiment of the present invention;

[0025] FIG3( a ) is a directed graph of a flight profile from landing to deployment of a Mars rover in an embodiment of the present invention;

[0026] FIG3( b ) is a search tree diagram of the flight profile from landing to the Mars rover in an embodiment of the present invention;

[0027] FIG3( c ) is an identification scene of the flight profile from landing to the Mars rover in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0029] The verification method of the present invention is a three-step verification strategy of "flight mission profile decomposition", "use case scenario identification", and "test case generation", which changes the current situation where EDL complex process verification is mainly carried out based on test experience, and provides a top-down analysis idea for EDL complex process verification. While effectively ensuring the completeness of complex system logic verification coverage and shortening the test time, this method can conduct a more comprehensive verification of the EDL process in advance before the simulated flight test in the system-level test phase, providing an effective and feasible means for early detection of abnormal problems in the EDL process, a key link in the detection mission. This method can advance the high-incidence period of failures and quickly converge the failure rate change curve, providing a strong guarantee for the rapid iteration of detector development; such as Figure 1 As shown, the specific steps include:

[0030] Step 1: Decompose the EDL process based on the "flight mission profile". The decomposition idea is from top to bottom, from large to small, from the flight process to a specific task completed by a subsystem or multiple subsystems. Specifically:

[0031] Step 11, EDL flight phase, set as flight phase F (T1, T2). In this phase, the detector completes a series of flight tasks according to the predetermined flight program. The present invention refers to each flight task as a "flight unit f (t1, t2)", which can be represented by the "initial flight state vector P t1 ”, “Termination flight state vector P t2 ” and “Task Unit G t1t2 "(the function completed by the aircraft within the time range of the flight unit) is expressed in a ternary form. Mission unit G t1t2 , is the basic unit for flight process testing and analysis, namely the "flight mission profile";

[0032] Step 12: Flight state vector: P t =η(S 0t , S 1t , ...S nt ).t is the relative time in the flight procedure; S nt For subsystem S n The state at time t;

[0033] Step 13, Flight Unit:

[0034] f(t1, t2) = (P t1 , G t1t2 , P t2 ), P t1 =η(S 0t1 , S 1t1 , ...S nt1 ), P t2 =η(S 0t2 , S 1t2 , ...S nt2 ).P t1 is the initial flight state vector, P t2 To terminate the flight state vector, G t1t2 is the mission unit; t1 and t2 are the relative start and end times of the flight program in which the flight unit is located;

[0035] Step 14, Mission Unit (Flight Mission Profile): G t1t2 =S n (t1, t2) or S1S2...S n (t1, t2); S n (t1, t2) is a subsystem task unit, S1S2...S n (t1, t2) is a joint task unit of multiple subsystems.

[0036] Step 15: According to the above method, the EDL flight process is decomposed and an EDL flight process analysis table or diagram is formed;

[0037] Step 2: Identify the use case scenario based on the flight profile obtained by decomposing the flight process. The identification process is as follows:

[0038] Step 21: Use a directed graph to describe the specific steps of the use case event flow. The backbone of the directed graph is the basic flow (the basic flow of the backbone is a path, where point B is the start point of the use case and the state is the starting flight state vector P of the flight profile. t1 , point E is the end point of the use case, and the state is the terminal flight state vector P of the flight profile t2 ), describes a typical event flow of a use case, that is, the event flow of task units executed in a predetermined order. The branches of the directed graph are alternative flows, which describe the event flow that will occur when an exception or error occurs. That is, when an exception or error occurs in a task unit of the trunk, jump from the current task unit to the exception or error state, and after processing, return to the next task unit of the trunk. The process of continuing to execute the basic flow of the trunk constitutes a possible path; in this way, when an exception or error occurs in other task units, another possible path is constituted;

[0039] Step 22, search for all possible paths of the directed graph (paths from vertex B to vertex E), and represent them in the form of a tree (only consider the case where the loop in the directed graph is executed once);

[0040] Step 23: Search the tree until all paths starting from the root node B and ending at the leaf node E are found, and all use case scenarios are obtained.

[0041] Step 3. Test cases need to be determined for each scenario. Test cases can be determined and managed using matrices or decision tables. Once all test cases are determined, they should be reviewed and verified to ensure accuracy and appropriateness, and redundant or equivalent test cases should be eliminated. For each test case, the test case ID, conditions (or instructions), all data elements involved in the test case, and expected results are generally included. By executing all paths from the root node to the leaf node in the tree, the functional verification of the normal mode and failure mode of the EDL process can be completed.

[0042] Example:

[0043] Taking the Mars rover EDL process verification as an example, the specific steps are as follows:

[0044] Step 1: Decompose the EDL process based on the “flight mission profile”: Decompose from top to bottom to obtain the flight unit f(t1, t2), the initial flight state vector Pt1 , Termination flight state vector P t2 , Task Unit G t1t2 And the subsystem G required to execute the task unit t1t2 =S n (t1, t2) or S1S2...S n (t1, t2). The specific results are shown in Table 1;

[0045] Among them, the flight unit is divided into "atmospheric entry to landing phase" and "landing to Mars rover deployment";

[0046] Table 1

[0047]

[0048]

[0049] Step 2: Identify the use case scenarios for the above two flight profiles. The identification process is as follows:

[0050] A. Flight profile from entering the atmosphere to landing:

[0051] 1) As shown in Figure 2(a), draw a directed graph: Step 1 is to unfold the trimmed wings; but if the digital tube computer autonomously cuts the machine or the descent control unit autonomously cuts the machine, go to step 10, wait for 10 seconds, the system autonomously returns to the trunk, and prepares to proceed to step 2 parachute. The subsequent steps are step 3 for large base separation, step 4 for back cover separation, step 5 for rough obstacle avoidance, step 6 for hovering imaging, step 7 for obstacle avoidance maneuvering, step 8 for slow descent, and step 9 for landing on the surface of Mars. As above, after steps 2 to 9, if the S digital tube computer autonomously cuts the machine or the descent control unit autonomously cuts the machine, go to steps 11 to 18 respectively, wait for 10 seconds, the system autonomously returns to the trunk, and continues to enter the subsequent steps;

[0052] 2) As shown in Figure 2(b), search for all possible paths in the directed graph (the path from vertex B to vertex E) and represent them in a tree format (only consider the case where the loop in the directed graph is executed once);

[0053] 3) As shown in Figure 2(c), the tree is searched until all paths starting from the root node B and ending at the leaf node E are found, and all use case scenarios and corresponding test cases are obtained. Considering the test coverage, when the test case is executed, the fault can be constructed by the computer cutting machine and the EDCU cutting machine in turn to observe whether the detector system can correctly perform subsequent actions.

[0054] B. Landing to the Mars rover to launch the flight profile:

[0055] 1) As shown in Figure 3(a), draw a directed graph: Step 1 is to deploy the mast to 0 degrees using a closed loop method. If the computer detects a fault code, it enters step 13 (the mechanism board switches to backup) and then enters step 14 (the mast is deployed again using a closed loop method); step 2 is to switch to working mode 6; step 3 is to turn on the UHF transceiver of the Mars rover; step 4 is to stop the propellant passivation; step 5 is to judge the mast deployment angle. If it is not within the expected value range, it enters step 15 (the mechanism board switches to backup) and then enters step 16 (the mast is deployed again using a switch method); step 6 is the forward deployment of the ramp mechanism. If the deployment fails, it enters step 17 (the ramp mechanism is deployed in the reverse direction); step 7 is the deployment of the directional antenna. If the computer detects a fault code, it enters step 18 (the mechanism board switches to backup) and then enters step 19 (the directional antenna is deployed again); step 8 is the static attitude determination of the Mars rover GNCC; step 9 is X-band ground communication; step 10 is to disconnect and fall off; step 11 is to switch to working mode 7; step 12 is to start the measurement and control cycle task template;

[0056] 2) As shown in Figure 3(b), search for all possible paths in the directed graph (the path from vertex B to vertex E) and represent them in a tree format (only consider the case where the loop in the directed graph is executed once);

[0057] 3) As shown in Figure 3(c), search the tree until all paths starting from the root node B and ending at the leaf node E are found, and all use case scenarios and the corresponding test cases can be obtained. Step 3: Execute the test cases formed by the above steps to complete the functional verification of the normal mode and failure mode of the EDL process.

[0058] In summary, the above are only preferred embodiments of the present invention and are not intended to limit the protection scope of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A deep space detector EDL process verification method, characterized in that: include: Step 1: Decompose the EDL process of the deep space probe based on the "flight mission profile" to form an EDL flight process analysis table or diagram; the decomposition idea is from top to bottom, from large to small, from the flight process to a specific task completed by a subsystem or multiple subsystems, specifically: The EDL flight phase of the detector is set as the flight phase F(T1, T2); in this phase, the detector completes a series of flight tasks according to the flight program, which is called "flight unit f(t1, t2)", including "initial flight state vector P t1 ", "Termination flight state vector P t2 " and "Task Unit G t1t2 "The flight unit includes multiple task units executed in time sequence; flight unit f(t1, t2) = (P t1 ,G t1t2 ,P t2 ),P t1 =η(S 0t1 ,S 1t1 ,…S nt1 ),P t2 =η(S 0t2 ,S 1t2 ,…S nt2 ), where P t1 is the initial flight state vector, P t2 is the flight termination state vector, G t1t2 is the mission unit; t1 and t2 are the relative start and end times of the flight program in which the flight unit is located; flight state vector: P t =η(S 0t ,S 1t ,…S nt ), where t is the relative time in the flight procedure; S nt For subsystem S n The state at time t; task unit G t1t2 =S n (t1,t2) or S1S2…S n (t1, t2), where S n (t1, t2) is a subsystem task unit; S1S2…S n (t1, t2) is a joint task unit of multiple subsystems; Step 2: Identify the use case scenario based on the flight profile obtained by decomposing the flight process. The process is as follows: Step 21: Use a directed graph to describe the use case event flow: the main body of the directed graph is the basic flow, and the basic flow of the main body is a path, where point B is the start point of the use case and the state is the starting flight state vector P of the flight profile. t1 , point E is the end point of the use case, and the state is the terminal flight state vector P of the flight profile t2 The typical event flow of a use case is the event flow of task units executed in a predetermined order. The branches of the directed graph are alternative flows. The event flow that occurs when an exception or error occurs is when an exception or error occurs in a task unit of the trunk, the current task unit jumps to the exception or error state, and after the processing is completed, it returns to the next task unit of the trunk. The process of continuing to execute the basic flow of the trunk constitutes a possible path; in this way, when an exception or error occurs in other task units, another possible path is formed; the basic flow and event flow constitute all possible paths between the starting point B and the end point E in the directed graph; Step 22: Search all possible paths of the directed graph, i.e., the paths from vertex B to vertex E, and represent them in the form of a tree. Step 23: Search the tree until all paths starting from the starting point B and ending at the ending point E are found, that is, all use case scenarios are obtained; Step 3: Execute all use case scenarios, where test cases are determined and managed using matrices or decision tables. Once all test cases are determined, they are reviewed and verified, and redundant or equivalent test cases are cancelled. For each test case, including the test case ID, conditions, all data elements involved in the test case and expected results; all paths from the root node to the leaf node in the execution tree are completed, that is, the functional verification of the normal mode and failure mode of the EDL process is completed.

2. A deep space detector EDL process verification method as claimed in claim 1, characterized in that: The task unit is a task unit of a certain subsystem, or a joint task unit of multiple subsystems.

3. A deep space detector EDL process verification method as claimed in claim 1, characterized in that: Use case scenarios are identified and managed using matrices or decision tables.

4. A deep space detector EDL process verification method as claimed in claim 1, characterized in that: Review and validate use case scenarios.

5. A deep space detector EDL process verification method as claimed in claim 4, characterized in that: Eliminate redundant or equivalent use case scenarios.

Images