A satellite autonomous safety implementation method and system based on logical program control instructions

Abstract

The present invention relates to a method and system for achieving satellite autonomous safety based on logic program-controlled instructions. The satellite autonomous safety implementation system includes at least a satellite management module and other modules. The satellite management module is capable of loading, parsing, and executing a sequence of logic program-controlled instructions. The other modules are configured to send their operating status data to the satellite management module. The sequence of logic program-controlled instructions includes at least logic program-controlled instructions and mission instructions. The satellite management module is configured to judge the operating status data using the logic program-controlled instructions and execute the mission instructions based on the judgment results obtained by the logic program-controlled instructions, thereby ensuring the safety of the satellite when executing the mission instructions.

Description

Technical Field

[0001] The present invention relates to the technical field of on-orbit satellites, and in particular to a method and system for realizing satellite autonomous safety based on logic program control instructions. Background Art

[0002] Satellites spend most of their time in orbit flying outside the country. Once a satellite component fails, it is impossible for the ground to intervene and control it in a timely manner, which can easily cause a failure of the entire satellite, thereby affecting the satellite mission and even leading to catastrophic consequences. Therefore, it is necessary to combine the characteristics of the onboard computer as the information control center of the entire satellite to reasonably set up autonomous judgment methods and autonomous control measures for various types of failures to ensure the judgment and processing of failures when the satellite is flying outside the country and the reliability and safety of the satellite's in-orbit operation. However, the way existing satellites execute logical program-controlled instruction sequences is generally to execute them at a certain point in time, and the instruction sequence is generally unable to judge the working status of the satellite. For example, the Chinese patent document with publication number CN201710583022 discloses a satellite program-controlled instruction maintenance method based on a circular queue. This method adopts a time-point execution method, that is, it cyclically judges whether the instructions in the instruction sequence have reached the execution time. If the time reaches the execution time of a certain instruction, the instruction is executed. During the execution of an instruction sequence, this method only assesses the validity, execution time, and execution interval of the instruction, without assessing system safety factors such as whether the system state is normal or whether the conditions for executing the instruction are met. Since system safety assessments need to be performed independently of the instruction sequence, in some cases, the execution of the instruction sequence may trigger system safety mechanisms, leading to conflicts between system safety and the execution of the mission instruction sequence. Common autonomous satellite safety mechanisms, such as the on-orbit autonomous fault handling scheme for satellites disclosed in Chinese patent publication CN201810999183, pre-classify potential faults on the ground and design complex safety modes in the software to handle these faults. However, these pre-defined faults may not match the actual on-orbit conditions, or new fault conditions may arise on-orbit, requiring software updates to add new safety modes, which is complex to modify and maintain. Furthermore, each satellite model requires software coding with a safety mode tailored to its specific characteristics, resulting in limited flexibility and adaptability. To ensure satellite safety, various safety modes must be designed into satellite software. These modes independently assess satellite status and handle exceptions independently of the command sequence. This creates potential conflicts between the satellite's mission command sequence and the safety mode's exception handling. Furthermore, the implementation of safety modes is complex and lacks flexibility. Furthermore, safety modes pre-designed in ground-based software are difficult to modify and maintain while in orbit and lack universal applicability. Each satellite requires its own coding software to design its own safety mode, which, in turn, cannot adapt to various anomalies that may arise while in orbit.

[0003] For example, the Chinese patent document with publication number CN111126020A discloses a tabular autonomous safety mode design method and system for managing the autonomous safety mode of spacecraft. The present invention abstractly designs the autonomous safety mode of spacecraft into two general tables: a telemetry judgment table and an execution action sequence table. By designing only two tables, the autonomous safety mode design of different models can be completed, and the tables can be modified. It has the advantages of strong versatility, easy expansion, and easy modification. However, the method implemented by this invention relies on two global tables. For a single abnormal change, the two tables need to be re-annotated, and maintenance is inconvenient.

[0004] For another example, the Chinese patent document with publication number CN107885140B discloses a hierarchical whole-satellite autonomous emergency management method and system, which is a method for managing autonomous safety in different modes. The method pre-classifies satellite faults, determines the current state based on telemetry data, matches the corresponding fault mode, and then executes the corresponding instruction sequence for autonomous safety processing. Although this invention has a certain degree of flexibility compared to completely using hard coding to achieve autonomous safety processing, and the processing instruction sequence can be adjusted, the invention is fixed in matching the corresponding fault mode based on the telemetry state, and the fault mode is often implemented by hard coding. On the one hand, it cannot be flexibly adjusted, and on the other hand, it does not have universality between models. Therefore, it is necessary to improve the above shortcomings of the existing technology.

[0005] In addition, on the one hand, there are differences in understanding among those skilled in the art; on the other hand, the applicant studied a large number of documents and patents when making the present invention, but due to space limitations, not all details and contents are listed in detail. However, this does not mean that the present invention does not have the characteristics of these prior arts. On the contrary, the present invention already has all the characteristics of the prior art, and the applicant reserves the right to add relevant prior art to the background technology. Summary of the Invention

[0006] Existing satellites' logically programmed command sequences execute on a timed basis, and the satellite cannot determine its status during the sequence. Satellite autonomous safety also requires separate coding, and the execution of the command sequence may trigger a safety mode. This creates a conflict between the satellite's autonomous safety and the timed execution of the command sequence, making it impossible to guarantee the safety of the satellite's on-orbit missions. Furthermore, existing logically programmed command sequences are limited in their mechanical, timed execution and lack conditional judgment capabilities, making them incapable of adapting to the complex missions required of satellites on-orbit. These missions rely on pre-designed mission software programs for proper execution.

[0007] Most existing satellite autonomous safety implementations rely on software to pre-set various safety modes, anticipating potential satellite failures and mitigating them. However, this rigidity in software makes autonomous safety modes difficult to maintain and modify while on-orbit, hindering their scalability.

[0008] Existing satellite autonomous safety implementations require specific software coding to implement corresponding safety modes based on the specific model. These safety modes are complex to design and lack universal applicability. Separate autonomous safety-related software must be developed for each model, making them inflexible and inapplicable.

[0009] To address the shortcomings of existing technologies, the present invention proposes a method and system for achieving satellite autonomous safety based on logic program-controlled instructions. The system comprises at least a satellite control module and other modules. The satellite control module is capable of loading, parsing, and executing sequences of logic program-controlled instructions. Other modules are configured to send their operating status data to the satellite control module. The satellite control module is configured to assess the operating status data using the logic program-controlled instructions and execute mission instructions based on the assessment results of the logic program-controlled instructions, thereby ensuring satellite safety during mission execution.

[0010] This satellite autonomous safety implementation system includes at least a satellite management module and other modules. The satellite management module is capable of loading, parsing, and executing a sequence of logic program-controlled instructions. The sequence of logic program-controlled instructions includes at least logic program-controlled instructions and mission instructions. Other modules are configured to transmit their operating status data to the satellite management module. The satellite management module is configured to determine the operating status data based on the logic program-controlled instructions and execute the mission instructions based on the determination results of the logic program-controlled instructions, thereby ensuring the safety of the satellite during the execution of the mission instructions.

[0011] Preferably, the star affairs management module can obtain the working status data sent by other modules.

[0012] Preferably, the logic program control instruction sequence at least includes the logic program control instructions and / or satellite mission instructions corresponding to the execution time and the execution time.

[0013] Preferably, the task instruction can at least be used to control other modules to perform specific tasks. Preferably, the task instruction also includes an exception handling instruction for performing corresponding exception handling.

[0014] Preferably, the working status data includes at least attitude track status data, attitude track stand-alone status data, power supply and distribution status data, load status data, heater and temperature status data. Preferably, the working status data can also add new working status data according to actual scene requirements.

[0015] Through this configuration, the solution of the present invention adds logical program-controlled instructions to the logical program-controlled instruction sequence, and then automatically determines in advance whether the status of the satellite is safe based on the working status data, thereby resolving the contradiction between autonomous safety and mission instruction execution, and ensuring the safety of the satellite's on-orbit mission execution.

[0016] Through this configuration, the solution of the present invention uses logical program-controlled instructions in the instruction sequence to judge the satellite safety status, and performs autonomous safety processing through the instruction sequence. On-orbit maintenance only requires updating the instruction sequence, without the need to upload software code. It is simple to maintain, easy to modify, and highly scalable.

[0017] Through this configuration, the logic program-controlled instruction sequence implemented by the solution of the present invention has universal applicability, and the differences between various models can be adapted by adjusting the instruction sequence without the need for software coding, thereby greatly reducing the workload of software development.

[0018] According to a preferred embodiment, the logic program control instructions at least include conditional judgment instructions. The conditional judgment instructions can at least be used to judge the working status data and output the judgment result.

[0019] According to a preferred embodiment, the logic program-controlled instructions further include one or more of a conditional jump instruction, a loop execution instruction, and a call execution instruction. The conditional jump instruction can jump to a number of program-controlled instructions specified by the conditional jump instruction and then continue execution based on the judgment result of the conditional judgment instruction; the loop execution instruction is used to loop-execute subsequent program-controlled instructions of the loop-executed logic program-controlled instruction sequence; and the call execution instruction is used to call and execute other instruction sequences that need to be called.

[0020] Particularly preferably, the conditional judgment instruction can be flexibly used in combination with one or more of the conditional jump instruction, the loop execution instruction, and the call execution instruction.

[0021] Through this configuration, the present invention implements a programmable instruction sequence with logic judgment. By employing common logic-based programmable instructions such as conditional judgment, jump, and call execution, the satellite status is determined during mission execution. Based on the satellite status determination results, the instruction sequence is called to perform corresponding exception handling, thereby unifying mission instruction sequence execution with satellite autonomy and safety. The instruction sequence implemented using the present invention can flexibly handle various exceptions during mission execution. Its programmable nature allows for timely adjustment based on on-orbit conditions, effectively avoiding conflicts between mission and autonomous safety under existing approaches. The universal logic-based programmable instructions implemented by the present invention are universally applicable and can be implemented across a wide range of satellite systems, eliminating the need for satellite-specific software coding for safety modes and significantly reducing the amount of satellite software development required. Furthermore, the programmable nature of the instruction sequence significantly expands the functionality that can be implemented using it. The conditional judgment, jump, and call logic-based programmable instructions implemented by the present invention make the logic-based programmable instruction sequence programmable, not only ensuring satellite autonomy and safety but also expanding the functionality and application scope of the instruction sequence, allowing complex tasks to be completed using these instructions.

[0022] According to a preferred embodiment, the logic program control instruction is composed of an instruction code and instruction parameters. The instruction code is used to uniquely identify the logic program control instruction. The instruction parameters of the conditional judgment instruction include a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type.

[0023] The parsing and execution process of the conditional judgment instruction is as follows: obtaining the judgment data source ID from the conditional judgment instruction to determine the data source; obtaining the data corresponding to the judgment data number from the data source; obtaining the judgment method word from the conditional judgment instruction, and judging whether the logical relationship between the data and the threshold is established according to the judgment method, and temporarily storing the judgment result as input for the subsequent conditional jump instruction and / or the loop execution instruction.

[0024] According to a preferred embodiment, the instruction parameter of the conditional jump instruction includes the number of instructions to be jumped. The execution process of the conditional jump instruction is as follows: obtaining the output result of the conditional judgment instruction corresponding to the conditional jump instruction; if the output result is true, continuing to execute subsequent program-controlled instructions; if the output result is false, jumping to the number of program-controlled instructions specified in the conditional jump instruction before continuing to execute subsequent program-controlled instructions.

[0025] According to a preferred embodiment, the instruction parameters of the loop execution instruction include a loop condition, a maximum number of loops, and the number of program-controlled instructions to be executed in the loop. The loop condition is to loop according to the number of executions or to execute the loop according to the output result of the conditional judgment instruction.

[0026] The execution process of the loop execution instruction is: obtaining the loop condition and the maximum number of loops; judging whether the maximum number of loops or the loop condition is reached; if the maximum number of loops or the loop condition is not met, looping the logic program-controlled instruction sequence until the maximum number of loops or the loop condition is met; if the maximum number of loops or the loop condition is met, stopping the loop execution of the logic program-controlled instruction sequence.

[0027] According to a preferred embodiment, the instruction parameter of the call execution instruction includes the name of the task instruction to be called for execution.

[0028] The execution process of the calling execution instruction is as follows: searching for the instruction sequence file to be called and executed according to the name of the task instruction to be called and executed; judging whether there is a sub-instruction sequence that needs to be called; if there is a sub-instruction sequence that needs to be called, executing the sub-instruction sequence, and continuing to execute the main instruction sequence after the sub-instruction sequence is executed; if there is no sub-instruction sequence that needs to be called, directly continuing to execute the main instruction sequence.

[0029] According to a preferred embodiment, the other modules include at least an attitude and orbit control module, which is configured to control / monitor the attitude and orbit of the satellite and at least send attitude and orbit status data of the satellite to the satellite management module.

[0030] According to a preferred embodiment, the other modules further include an attitude and orbit control module, a power module, a payload module, and a thermal control module. The attitude and orbit control module is configured to send attitude and orbit status data of the attitude and orbit control module to the satellite operations management module; the power module is configured to provide the satellite operations management module with power supply and power distribution status data of the satellite; the payload module is configured to send payload status data of the payload module to the satellite operations management module; and the thermal control module is configured to send heater and temperature status data to the satellite operations management module.

[0031] The present invention also provides a method for achieving satellite autonomous safety based on logic program control instructions. The method comprises:

[0032] The satellite service management module loads, parses and executes the logic program control instruction sequence, wherein the logic program control instruction sequence includes at least logic program control instructions and task instructions;

[0033] Other modules send their working status data to the satellite affairs management module;

[0034] The satellite management module uses the logic program-controlled instructions to determine the operating status data and executes the mission instructions based on the determination results obtained by the logic program-controlled instructions to ensure the safety of the satellite during the execution of the mission instructions. This configuration allows the implementation of logic program-controlled instructions in the instruction sequence, including but not limited to conditional judgment instructions, conditional jumps, loop execution, and calls, making the instruction sequence programmable.

[0035] This configuration uses a logically programmed instruction sequence to handle exceptions during task execution. Task execution can dynamically determine whether execution conditions are met, ensuring that task execution does not conflict with autonomous safety. Using a logically programmed instruction sequence for autonomous safety processing eliminates hard-coded implementation of satellite autonomous safety functions, making it flexible, adaptable, and reconfigurable on-orbit. Autonomous safety management is organized into several small loop instruction sequences, which are executed in parallel to avoid delays caused by sequential processing. By adding logically programmed instructions to the instruction sequence and combining them through programming, it can adapt to complex on-orbit task execution. This solution organizes logically programmed instruction sequences into small loops for exception determination and calls the instruction sequence for processing, eliminating the need for pre-coding specific exceptions in software. The exception handling logically programmed instruction sequence can be dynamically adjusted based on the exceptions that occur on-orbit. Compared to the chronological execution of the aforementioned logically programmed instruction sequence, the solution of the present invention implements logically programmed instructions within the instruction sequence, making the instruction sequence programmable. The instruction sequence can be executed conditionally, with jumps, in a loop, or by calling other execution sequences. This flexible execution method allows for flexible handling of exceptions that may arise during task execution. In addition, the solution of the present invention has a small workload, and is easy to add, delete, modify and maintain, and realizes autonomous safety processing by software hard coding. If the exception occurring on track is inconsistent with the assumption, it needs to be modified and the software needs to be updated before the modification and processing can be carried out, which has a large workload. If a new exception handling function needs to be added, software update is also required. The solution of the present invention only needs to modify the exception handling logic programmable instruction sequence, and the modification and update of the instruction sequence are much simpler and the workload is small. The solution of the present invention has a wider adaptability. The autonomous safety realized by adopting software hard coding not only needs to be bound to a specific model, but often the implementation of the model cannot adapt to other models. Each model needs to re-encode the autonomous safety management separately, while the solution of the present invention adopts a logical programmable instruction sequence for autonomous safety processing. Each model only needs to adjust the instruction sequence of exception handling to adapt to the needs of this model, and has a wider adaptability. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1This is a simplified module connection diagram of a preferred embodiment of the satellite autonomous safety implementation system provided by the present invention;

[0037] Figure 2 It is a schematic diagram of a preferred embodiment of the judgment method provided by the present invention;

[0038] Figure 3 It is a schematic diagram of a preferred implementation method of determining a data source ID provided by the present invention;

[0039] Figure 4 It is a schematic diagram of a preferred implementation method of determining data number provided by the present invention;

[0040] Figure 5 This is a flow chart of a preferred embodiment of the logic program-controlled instruction sequence provided by the present invention;

[0041] Figure 6 It is a flow chart of another preferred embodiment of the logic program-controlled instruction sequence provided by the present invention.

[0042] Reference Signs List

[0043] 1: Space administration module; 2: Attitude and orbit control module; 3: Attitude and orbit control module; 4: Power module; 5: Payload module; 6: Thermal control module. DETAILED DESCRIPTION

[0044] The following is a detailed description with reference to the accompanying drawings.

[0045] Figure 1 The present invention shows a satellite autonomous safety realization system based on logic program control instructions. The satellite autonomous safety realization system at least includes a satellite affairs management module 1 and other modules.

[0046] The satellite management module 1 is capable of loading, parsing and executing logical program-controlled instruction sequences.

[0047] The other modules are configured to send the working status data of the other modules to the satellite affairs management module 1 .

[0048] The logic program control instruction sequence at least includes logic program control instructions and task instructions.

[0049] The satellite management module 1 is configured to judge the working status data through the logic program control instructions, and execute the mission instructions based on the judgment results obtained by the logic program control instructions to ensure the safety of the satellite when executing the mission instructions.

[0050] Preferably, the star service management module 1 can obtain the working status data sent by other modules.

[0051] Preferably, the logic program control instruction sequence at least includes the logic program control instructions and / or satellite mission instructions corresponding to the execution time and the execution time.

[0052] Preferably, the task instruction can at least be used to control other modules to perform specific tasks. Preferably, the task instruction also includes an exception handling instruction for performing corresponding exception handling.

[0053] Preferably, the working status data includes at least attitude track status data, attitude track stand-alone status data, power supply and distribution status data, load status data, heater and temperature status data. Preferably, the working status data can also add new working status data according to actual scene requirements.

[0054] Preferably, the logic program control instruction sequence includes the logic program control instructions and / or satellite mission instructions corresponding to the execution time.

[0055] Preferably, the logic program control instruction sequence is loaded, parsed and executed by the onboard management module 1 in the OBC (onboard computer).

[0056] Preferably, the satellite management module 1 and the attitude and orbit control module 2 can be respectively arranged in or integrated into the onboard computer.

[0057] This configuration allows fault pattern matching and autonomous safety processing to be performed using logic programmable instructions. Software coding implements general logic programmable instructions that are not directly related to specific fault matching and are part of an instruction sequence, eliminating the need for software coding for specific fault pattern matching. The present invention utilizes logic programmable instructions for judgment, allowing for independent judgment and processing of each fault using the instruction sequence, achieving sufficient detail.

[0058] According to a preferred embodiment, the logic program control instructions at least include conditional judgment instructions. The conditional judgment instructions can at least be used to judge the working status data and output the judgment result.

[0059] According to a preferred embodiment, the logic program-controlled instructions further include one or more of a conditional jump instruction, a loop execution instruction, and a call execution instruction. The conditional jump instruction can jump to a specified number of program-controlled instructions according to the judgment result of the conditional judgment instruction and then continue execution. The loop execution instruction is used to loop-execute subsequent program-controlled instructions of the loop-executed logic program-controlled instruction sequence. The call execution instruction is used to call and execute other instruction sequences that need to be called.

[0060] Preferably, the conditional jump instruction includes only one parameter, namely the number of instructions to be jumped.

[0061] Particularly preferably, the conditional judgment logic instructions can be flexibly combined with conditional jump instructions, loop execution instructions, call execution and other logic instructions to achieve more complex and flexible abnormal condition judgment and processing.

[0062] According to a preferred embodiment, the logic program control instruction is composed of an instruction code and instruction parameters. The instruction code is used to uniquely identify the logic program control instruction. The instruction parameters of the conditional judgment instruction include a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type.

[0063] The parsing and execution process of the conditional judgment instruction is as follows: obtaining the judgment data source ID from the conditional judgment instruction to determine the data source; obtaining the data corresponding to the judgment data number from the data source; obtaining the judgment method word from the conditional judgment instruction, and judging whether the logical relationship between the data and the threshold is established according to the judgment method, and temporarily storing the judgment result as input for the subsequent conditional jump instruction and / or the loop execution instruction.

[0064] Preferably, the program-controlled logic program-controlled instruction consists of an instruction code and instruction parameters.

[0065] Preferably, the instruction code is used in a logic program-controlled instruction sequence to uniquely identify a program-controlled instruction. For example, the instruction code of a logic program-controlled instruction may be composed of numbers and / or characters. For example, the instruction code identifying a conditional judgment instruction may be "0100C001"; the instruction code identifying a conditional jump instruction may be "0100C002"; the instruction code identifying a loop execution instruction may be "0100C003"; and the instruction code identifying a call execution instruction may be "0100C004". For another example, the instruction code and instruction parameters of the conditional judgment instruction used to determine whether the star-sensitive current (for example, the current of the 0X1D loop of the power management device) is less than the judgment threshold (for example, the judgment threshold is 200mA) are 0100C001 and 03 90 021D 00C8 00, respectively.

[0066] The satellite service management module 1 can temporarily store the judgment result (e.g., true or false) of the conditional judgment instruction based on the working status data in a conditional variable, which serves as the input condition for other subsequent logic program control instructions (such as conditional jump instructions and loop execution instructions). Other logic program control instructions are relatively independent of each other, and the logic program control instructions are ultimately organized into an instruction sequence to form an execution logic relationship.

[0067] Preferably, the logic program control instruction sequence is composed of an execution time and logic program control instructions and / or satellite mission instructions corresponding to the execution time.

[0068] Preferably, a logic program control instruction sequence includes at least an execution time and a logic program control instruction and / or a satellite mission instruction corresponding to the execution time.

[0069] Preferably, a logic program control instruction sequence can include multiple execution times and logic program control instructions and / or satellite mission instructions corresponding to the execution times. Preferably, the execution time is a relative time in seconds.

[0070] Preferably, the parameter data of the conditional judgment instruction includes a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type.

[0071] Preferably, the judgment method word is defined as the method of judging the judgment data. For example, Figure 2 The judgment method shown is a preferred embodiment of the present invention. Preferably, the judgment method can also adopt other judgment methods according to actual needs.

[0072] Preferably, the judgment data source ID is used to identify the source of the judgment data. Preferably, the data to be identified can come from the OBC (onboard computer), a single component (for example, from the attitude and orbit control single module 3, such as a star sensor, a flywheel, etc.), a payload (for example, from a payload module), etc. For example, Figure 3 A preferred implementation method for determining the data source ID is shown. Preferably, the data source ID can be flexibly added / deleted according to actual needs. Through this configuration method, the conditional judgment instruction abstracts the data source of the working status data, so that it is not linked to a specific telemetry word, that is, the data source of the working status data is abstracted into abstract state conditions such as temperature, power supply, and working status; at the same time, the conditional judgment instruction implemented by the method of the present invention can be flexibly combined with logical program control instructions such as conditional jump instructions, loop execution instructions, and call execution to achieve more complex and flexible abnormal condition judgment and processing. In addition, the method of the present invention uses a single instruction sequence to handle exceptions, and to modify specific exception handling, it only needs to annotate a single instruction sequence file.

[0073] Preferably, the judgment data number is used to distinguish the data category of the data to be identified and judged. Preferably, the data category includes but is not limited to: voltage, current, temperature, power distribution status, working status and other data categories. For example, Figure 4 A preferred implementation method of judging data number is shown.

[0074] Preferably, the judgment data number can be defined according to actual needs.

[0075] Preferably, the judgment threshold is a data or condition pre-filled in the instruction. Preferably, the judgment threshold can also be any data type in the threshold type definition. For example, the current threshold is 200mA. Preferably, the threshold type is the type of the judgment threshold data. For example, the type code "0" can represent that the threshold type is integer data; the type code "1" can represent that the threshold type is floating-point data; the type code "2" can represent that the threshold type is "BOOL condition: 0X55 is true, 0X00 is false".

[0076] Preferably, the logic program control instruction sequence can be saved as a binary file. Preferably, the logic program control instruction sequence is loaded, parsed and executed by the OBC (onboard computer). For example, Figure 5 The binary file of the logical program control instruction sequence in is as follows:

[0077] 00 00 00 01 01 00C0 01 03 90 02 1D 00C8 00

[0078] 00 00 00 02 01 00C0 02 00 01

[0079] 00 00 00 03 00 00 00 02 0a 00

[0080] Preferably, the logic program control instructions can adopt other different data structures to achieve the same functions or similar functions mentioned above, and perform autonomous security management through instruction sequences.

[0081] Based on this solution, the use of logic program control instructions can be further expanded to realize more logic program control instructions, and used to organize task instruction sequences to achieve task autonomy and safety.

[0082] According to a preferred embodiment, the instruction parameter of the conditional jump instruction includes the number of instructions to be jumped.

[0083] The execution process of the conditional jump instruction is: obtaining the output result of the conditional judgment instruction corresponding to the conditional jump instruction; if the output result is true, continuing to execute subsequent program-controlled instructions; if the output result is false, jumping the program-controlled instructions of the number of instructions to be jumped specified in the conditional jump instruction and then continuing to execute subsequent program-controlled instructions.

[0084] Preferably, the conditional jump instruction includes only one parameter, namely the number of instructions to be jumped. Preferably, the specified number in the conditional jump instruction can be flexibly set according to the actual application scenario. Preferably, the conditional judgment instruction can be flexibly combined with the conditional jump instruction and / or the loop execution instruction to judge the execution conditions of the task logic program-controlled instruction sequence. If the satellite status / condition corresponding to the working status data does not meet the conditions for executing the task instruction, the instruction sequence is skipped and not executed to ensure satellite safety. For example, in order to ensure satellite energy safety, the voltage status of the corresponding components of the satellite can be judged by a conditional judgment instruction before the execution of the task logic program-controlled instruction sequence. When the voltage is lower than the safety threshold (i.e., the judgment threshold), the instructions of the task logic program-controlled instruction sequence are skipped. When the voltage is higher than the safety threshold, the instructions are executed normally.

[0085] According to a preferred embodiment, the instruction parameters of the loop execution instruction include a loop condition, a maximum number of loops, and the number of program-controlled instructions to be executed in the loop. The loop condition is to loop according to the number of executions or to execute the loop according to the output result of the conditional judgment instruction.

[0086] The execution process of the loop execution instruction is: obtaining the loop condition and the maximum number of loops; judging whether the maximum number of loops or the loop condition is reached; if the maximum number of loops or the loop condition is not met, looping the logic program-controlled instruction sequence until the maximum number of loops or the loop condition is met; if the maximum number of loops or the loop condition is met, stopping the loop execution of the logic program-controlled instruction sequence.

[0087] Preferably, the loop condition is defined as the condition for loop execution, which is looping by the number of executions or looping by conditional judgment instructions. Preferably, looping by the number of executions means that the loop execution of the program-controlled instruction will continue as long as the number of times the program-controlled instruction is looped does not reach the maximum number of loops. Preferably, looping by conditional judgment instructions means that the program-controlled instruction will continue to be looped only when the judgment result output of the conditional judgment instruction is true, and the loop will be exited when it is false. Preferably, the maximum number of loops is the value that the number of times the instruction sequence is looped cannot exceed, that is, the loop stops when the number of execution loops is greater than the maximum number of loops. Preferably, the number of program-controlled instructions to be looped refers to the number of program-controlled instructions that need to be looped.

[0088] According to a preferred embodiment, the instruction parameter of the call execution instruction includes the name of the task instruction to be called for execution.

[0089] The execution process of the calling execution instruction is as follows: searching for the instruction sequence file to be called and executed according to the name of the task instruction to be called and executed; judging whether there is a sub-instruction sequence that needs to be called; if there is a sub-instruction sequence that needs to be called, executing the sub-instruction sequence, and continuing to execute the main instruction sequence after the sub-instruction sequence is executed; if there is no sub-instruction sequence that needs to be called, directly continuing to execute the main instruction sequence.

[0090] Preferably, the task instructions to be called for execution may include a main instruction sequence and a sub-instruction sequence. Preferably, the task instructions to be called for execution may also include an exception handling instruction sequence. For example, an exception 1 handling instruction sequence, an exception 2 handling instruction sequence, and an exception n handling instruction sequence. Preferably, the task instructions to be called for execution may be flexibly selected based on actual scenario requirements.

[0091] Through this configuration, the calling execution instruction calls and executes another instruction sequence during the instruction sequence process. When used, the instruction sequence of a certain function can be made into a subsequence, and the sub-instruction sequence is executed by calling the instruction to call the execution instruction for parsing and execution.

[0092] Preferably, calling the execution instruction means calling and executing another instruction sequence during the process of the logic program-controlled instruction sequence.

[0093] According to a preferred embodiment, the other modules include at least an attitude and orbit control module 2. The attitude and orbit control module 2 is configured to control / monitor the attitude and orbit of the satellite and at least send the attitude and orbit status data of the satellite to the satellite management module 1.

[0094] Preferably, the attitude and orbit status data mainly include the attitude and orbit status data of the satellite.

[0095] According to a preferred embodiment, the other modules also include an attitude and orbit control unit module 3, a power module 4, a payload module 5, and a thermal control module 6. The attitude and orbit control unit module 3 is configured to send attitude and orbit status data of the attitude and orbit control unit to the satellite management module 1. The power module 4 is configured to provide the satellite management module 1 with power supply and power distribution status data of the satellite. The payload module is configured to send payload status data of the payload unit to the satellite management module 1. The thermal control module 6 is configured to send heater and temperature status data to the satellite management module 1.

[0096] Preferably, the power supply and power distribution status data at least includes the voltage and current of the power management module and the power supply and distribution status data of the power distribution module.

[0097] Preferably, the load status data may be the load status of the corresponding load unit.

[0098] Preferably, the working status data includes at least attitude track status data, attitude track standalone status data, power supply and distribution status data, load status data, heater and temperature status data. Preferably, the working status data can also add new data types according to actual scenario requirements.

[0099] Preferably, the heater and temperature status data at least include the operating status of the heater and temperature data of each temperature collection point.

[0100] Preferably, the attitude and orbit control unit module 3 includes multiple attitude and orbit control units.

[0101] Preferably, the attitude and orbit control stand-alone module 3 includes but is not limited to: star sensor, flywheel, magnetometer, magnetic torquer, electric propulsion, time sensor, gyroscope, GPS, thruster, etc.

[0102] Preferably, the power module 4 includes a power management submodule and a power distribution submodule.

[0103] The present invention also provides a method for achieving satellite autonomous safety based on logic program control instructions. The method comprises:

[0104] The satellite operation management module 1 loads, parses and executes the logic program control instruction sequence, wherein the logic program control instruction sequence includes at least logic program control instructions and task instructions;

[0105] Other modules send their working status data to the star affairs management module 1;

[0106] The satellite management module 1 judges the working status data through the logic program control instructions, and executes the mission instructions based on the judgment results obtained by the logic program control instructions to ensure the safety of the satellite when executing the mission instructions.

[0107] Through this configuration, the task execution conditions of the task instructions can be pre-judged during the execution of the task instruction sequence through logical program-controlled instructions: the task instruction sequence can be called for execution only if the satellite management module 1 determines that the task execution conditions of the task instruction are met by loading the analytical condition judgment instruction; if the satellite management module 1 determines that the task execution conditions of the task instruction are not met by loading the analytical condition judgment instruction, the task instruction sequence is exited to achieve safe exit of the task, thereby achieving autonomous safety during the execution of the task instruction sequence through logical program-controlled instructions.

[0108] Preferably, a logical programmable instruction sequence may include multiple logical programmable instructions that sequentially execute to determine and / or execute multiple task execution conditions. For example, a logical programmable instruction implements a task instruction, using the same or different conditional judgment instructions, to sequentially perform logical judgments on task execution conditions 1, 2, through n to determine whether the aforementioned task execution conditions are satisfied. Specifically, if and only if the same or different conditional judgment instruction evaluates the previous task execution condition as "true," the same or different conditional judgment instruction moves to the next task execution condition to perform a logical judgment on the next task execution condition. Only when all task execution conditions are evaluated as "true" does the satellite operation management module 1 invoke the execution task instruction sequence. Otherwise, if the same or different conditional judgment instruction evaluates any of the task execution conditions as "false" or "no," the satellite operation management module 1 directly exits the task execution condition evaluation and invokes the execution exit task instruction sequence.

[0109] Preferably, the logic program-controlled instruction sequence may include multiple logic program-controlled instructions that are executed in parallel and cyclical fashion to determine multiple task execution conditions or exception triggering conditions and / or perform exception handling. Preferably, each logic program-controlled instruction that is executed in parallel and cyclical fashion can be flexibly configured according to actual needs. With this configuration, the logic program-controlled instruction sequence may include multiple logic program-controlled instructions that are executed in parallel and cyclical fashion to determine multiple task execution conditions or exception triggering conditions and / or perform exception handling. This allows the logic program-controlled instruction sequence to determine satellite exception triggering conditions in a cyclical fashion, i.e., when the exception triggering conditions are met, the exception handling instruction sequence is invoked to handle the exception.

[0110] This configuration allows autonomous safety management to be organized into multiple small loop instruction sequences that are executed in parallel, thereby avoiding delays and waits caused by sequential processing. Furthermore, each parallel loop-executed logic program-controlled instruction can be flexibly configured based on actual needs, rather than being implemented as a fixed program or instruction sequence. For example, a logic program-controlled instruction sequence implements the process of autonomous satellite safety maintenance. This logic program-controlled instruction sequence can include multiple logic program-controlled instructions, which are executed in parallel loops through conditional judgment instructions 1, conditional judgment instructions 2, through conditional judgment instructions n to loop through and determine whether exceptions 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 9 After the satellite service management module 1 calls and executes the exception handling instruction sequence corresponding to the exception, the satellite service management module 1 needs to determine whether the exception handling instruction sequence corresponding to the exception needs to be prohibited. If it needs to be prohibited (that is, the above judgment result is "yes"), the exception handling instruction sequence corresponding to the exception is terminated respectively; otherwise, the loop execution process of the condition judgment instruction corresponding to the exception is restarted from the beginning.

[0111] For example, Figure 5 A preferred implementation of a logic program-controlled instruction sequence is shown to realize the function of judging whether the star-sensing current exceeds the limit and turning off the star-sensing power supply if it exceeds the limit.

[0112] Preferably, the OBC's satellite management module 1 uses a logical program-controlled instruction sequence to organize exception handling into small loops. For example, a logical program-controlled instruction loop is used to determine satellite anomaly trigger conditions. When the anomaly trigger condition is met, the exception handling instruction sequence is called to handle the anomaly. Multiple anomaly determinations can be performed in parallel, and exception handling is performed in small instruction sequence loops, eliminating the need for a fixed program implementation.

[0113] For example, Figure 6 This is a flow chart of another preferred embodiment of the logic program control instruction sequence provided by the present invention. The above logic program control instruction sequence takes the processing of Xingmin 1 as an example to process the abnormalities such as current over-limit and communication failure of Xingmin 1. Figure 6As shown, the function implemented by the logic program control instruction sequence is to cyclically determine whether the current of Star Sensitivity 1 exceeds the limit. If so, execute the instruction to power off the Star Sensitivity, otherwise skip (execute the instruction to power off the Star Sensitivity); continue to determine whether the continuous communication error count of Star Sensitivity 1 working status exceeds 5. If it exceeds, call the instruction sequence of 'star.bin' for processing. After executing the 7th instruction, the cyclic execution count is reduced by 1, and continue to return to the first instruction execution; in this way, an exception handling for Star Sensitivity is organized into a cyclic execution instruction sequence. Since the logic program control instructions are designed and implemented in advance and are universal, there is no need for separate coding for autonomous safety processing. It is only necessary to organize an instruction sequence similar to the above, and the on-board computer executes it according to the instruction code and instruction data; the above instruction sequence can be dynamically adjusted, which means that the instruction sequence content can be adjusted according to the actual on-orbit situation. After the adjustment, the instruction sequence file can be annotated to achieve on-orbit update without modifying the software code; for example, the above instruction sequence for the abnormal processing of Star Sensitivity 1, it is actually found on orbit that the normal working current of Star Sensitivity 1 is greater than 200mA, and the star-sensitivity current is judged to be over-limit value and adjusted to 300mA. At this time, only the parameters of Instruction 2 of the instruction sequence need to be adjusted.

[0114] It should be noted that the above-mentioned specific embodiments are exemplary, and those skilled in the art can come up with various solutions inspired by the disclosure of the present invention, and these solutions also belong to the disclosure scope of the present invention and fall within the protection scope of the present invention. Those skilled in the art should understand that the present invention specification and its drawings are illustrative and do not constitute a limitation of the claims. The scope of protection of the present invention is defined by the claims and their equivalents. The present invention specification contains multiple inventive concepts, such as "preferably", "according to a preferred embodiment" or "optionally", all of which indicate that the corresponding paragraph discloses an independent concept, and the applicant reserves the right to file a divisional application based on each inventive concept. Throughout the text, the features guided by "preferably" are only an optional method and should not be understood as having to be set, so the applicant reserves the right to abandon or delete the relevant preferred features at any time.

Claims

1. A satellite autonomous safety implementation system based on logic program control instructions, characterized in that: At least: A satellite management module (1) capable of loading, parsing and executing a sequence of logic program-controlled instructions; Other modules are configured to be able to send working status data of the other modules to the satellite affairs management module (1); The logic program control instruction sequence includes at least logic program control instructions and task instructions. The satellite management module (1) is configured to be able to judge the working status data through the logic program control instruction, and execute the mission instruction based on the judgment result obtained by the logic program control instruction to ensure the safety of the satellite when executing the mission instruction, wherein the logic program control instruction at least includes a condition judgment instruction, wherein the condition judgment instruction is at least capable of judging the working status data and outputting the judgment result, The satellite service management module (1) can temporarily store the judgment result obtained by the condition judgment instruction based on the working status data in a condition variable to serve as an input condition for subsequent other logic program control instructions. The instruction parameters of the condition judgment instruction include a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type. Other logic program control instructions are relatively independent. The condition judgment instruction can be flexibly used in combination with one or more of a conditional jump instruction, a loop execution instruction, and a call execution instruction. The logic program control instruction is finally organized in the form of an instruction sequence to form an execution logic relationship.

2. The satellite autonomous safety implementation system according to claim 1, characterized in that: The logic program control instructions also include one or more of a conditional jump instruction, a loop execution instruction, and a call execution instruction. Among them, the conditional jump instruction can jump to the number of program-controlled instructions specified by the conditional jump instruction and continue execution according to the judgment result of the conditional judgment instruction. The loop execution instruction is used to loop execute the subsequent program-controlled instructions of the logical program-controlled instruction sequence, and the call execution instruction is used to call and execute other instruction sequences that need to be called.

3. The satellite autonomous safety implementation system according to claim 2, characterized in that: The logic program control instruction is composed of an instruction code and instruction parameters, and the instruction code is used to uniquely identify a logic program control instruction. in, The parsing and execution process of the conditional judgment instruction is as follows: obtaining the judgment data source ID from the conditional judgment instruction to determine the data source; obtaining the data corresponding to the judgment data number from the data source; obtaining the judgment method word from the conditional judgment instruction, and judging whether the logical relationship between the data and the threshold is established according to the judgment method, and temporarily storing the judgment result as input for the subsequent conditional jump instruction and / or the loop execution instruction.

4. The satellite autonomous safety implementation system according to claim 2, characterized in that: The instruction parameters of the conditional jump instruction include the number of instructions to be jumped, Among them, the execution process of the conditional jump instruction is: obtaining the output result of the conditional judgment instruction corresponding to the conditional jump instruction; if the output result is true, continuing to execute subsequent program-controlled instructions; if the output result is false, jumping the program-controlled instructions of the number of instructions to be jumped specified in the conditional jump instruction and then continuing to execute subsequent program-controlled instructions.

5. The satellite autonomous safety implementation system according to claim 2, characterized in that: The instruction parameters of the loop execution instruction include a loop condition, a maximum number of loops, and the number of program-controlled instructions for loop execution. The loop condition is to execute the loop according to the number of loops or to execute the loop according to the output result of the conditional judgment instruction. Among them, the execution process of the loop execution instruction is: obtaining the loop condition and the maximum number of loops; judging whether the maximum number of loops or the loop condition is reached; if the maximum number of loops or the loop condition is not met, looping the logic program-controlled instruction sequence until the maximum number of loops or the loop condition is met; if the maximum number of loops or the loop condition is met, stopping the loop execution of the logic program-controlled instruction sequence.

6. The satellite autonomous safety implementation system according to claim 2, characterized in that: The instruction parameter of the call execution instruction includes the name of the task instruction to be called for execution. in, The execution process of the calling execution instruction is as follows: searching for the instruction sequence file to be called and executed according to the name of the task instruction to be called and executed; judging whether there is a sub-instruction sequence that needs to be called; if there is a sub-instruction sequence that needs to be called, executing the sub-instruction sequence, and continuing to execute the main instruction sequence after the sub-instruction sequence is executed; if there is no sub-instruction sequence that needs to be called, directly continuing to execute the main instruction sequence.

7. The satellite autonomous safety implementation system according to claim 2, characterized in that: The other modules at least include an attitude and orbit control module (2), The attitude and orbit control module (2) is configured to be able to control / monitor the attitude and orbit of the satellite, and at least be able to send attitude and orbit status data of the satellite to the satellite management module (1).

8. The satellite autonomous safety implementation system according to claim 7, characterized in that: The other modules also include an attitude and orbit control module (3), a power module (4), a payload module (5) and a thermal control module (6). The attitude and orbit control unit module (3) is configured to be able to send attitude and orbit unit status data of the attitude and orbit control unit module (3) to the satellite affairs management module (1), the power supply module (4) is configured to be able to provide the satellite affairs management module (1) with power supply and power distribution status data of the satellite, the payload module (5) is configured to be able to send payload status data of the payload unit to the satellite affairs management module (1), and the thermal control module (6) is configured to be able to send heater and temperature status data to the satellite affairs management module (1).

9. A method for realizing satellite autonomous safety based on logic program control instructions, characterized in that: The satellite autonomous safety implementation method comprises: The satellite service management module (1) loads, parses and executes a logic program control instruction sequence, wherein the logic program control instruction sequence at least includes logic program control instructions and task instructions; The other modules send the working status data of the other modules to the satellite affairs management module (1); The satellite management module (1) judges the working status data through the logic program control instruction, and executes the mission instruction based on the judgment result obtained by the logic program control instruction to ensure the safety of the satellite when executing the mission instruction, wherein the logic program control instruction at least includes a condition judgment instruction, wherein the condition judgment instruction is at least capable of judging the working status data and outputting the judgment result, The satellite service management module (1) can temporarily store the judgment result obtained by the condition judgment instruction based on the working status data in a condition variable to serve as an input condition for subsequent other logic program control instructions. The instruction parameters of the condition judgment instruction include a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type. Other logic program control instructions are relatively independent. The condition judgment instruction can be flexibly used in combination with one or more of a conditional jump instruction, a loop execution instruction, and a call execution instruction. The logic program control instruction is finally organized in the form of an instruction sequence to form an execution logic relationship.

Images