A method for autonomous fault management of a satellite power controller

Abstract

The present invention discloses an on-orbit autonomous management system for a satellite energy system, comprising multiple sets of independently operating lower-level computer modules operating in cold backup mode, multiple sets of independently operating discharge regulation circuits and charge regulation circuits connected to batteries, and a control center. The discharge regulation circuit operates in hot backup mode, and the charge regulation circuit operates in cold backup mode. The power controller is in an autonomous operation enable state, the charge and discharge power regulation unit is in an autonomous management state, and the charge and discharge accident protection autonomous startup state is enabled. The control center collects telemetry parameters from the lower-level computer and the battery, compares them with preset values, determines whether a fault has occurred and the type of fault, and then executes corresponding preset instructions for autonomous recovery based on the type of fault.

Description

Technical Field

[0001] The present invention relates to the field of aerospace technology, and in particular to an on-orbit autonomous management system and method for a satellite energy system. Background Art

[0002] A satellite's energy system primarily involves the generation, transformation, adjustment, and distribution of electrical energy, providing a primary power source that meets technical requirements. As a crucial component of a satellite, it is responsible for the entire satellite's power supply and distribution. The safe and reliable operation of the energy system is crucial for satellite normal operation and plays a crucial role in improving satellite performance and extending its on-orbit operational lifespan. Statistics on spacecraft on-orbit failures published domestically and internationally in recent years indicate that the energy system has a higher probability of on-orbit failure than any other subsystem, making it a particularly prone to failure. Failure modes primarily include circuit failures and performance degradation caused by high and low temperature shocks in the operating environment, electrostatic effects, and charged particles in space. Furthermore, due to geographical limitations of ground tracking and control stations, it is often impossible for them to track the satellite in real time throughout its entire lifespan. If an energy system failure occurs within an undetectable arc, failure to promptly address it could result in missed opportunities, ultimately leading to widespread failure, increased losses, and even jeopardizing the safety of the entire satellite. Therefore, improving the autonomous health and operational capabilities of the energy system throughout the satellite's lifespan will help enhance satellite reliability and safety.

[0003] When a satellite's energy supply experiences an anomaly, it must transition from ground-based support to autonomous onboard control, without the support of the ground-based operation and control system. This allows for rapid identification, diagnosis, and resolution of faults occurring on-orbit to eliminate or mitigate their impact, ensure energy balance, and enhance the satellite's autonomous operational capabilities. This is particularly true for medium- and high-orbit satellites, which experience long periods of unobservable arcs and prolonged periods of Earth's shadow. Therefore, designing autonomous energy fault diagnosis and recovery is key to ensuring healthy and reliable on-orbit operation throughout the satellite's lifecycle. Summary of the Invention

[0004] In order to address some or all of the problems in the prior art, the present invention provides an on-orbit autonomous management system for a satellite energy system, comprising:

[0005] Power supply controller, including:

[0006] Multiple sets of independently working lower computer modules work in cold backup mode;

[0007] Multiple sets of independently operating discharge regulating circuits are connected to the battery, and the discharge regulating circuits operate in a hot backup mode; and

[0008] Multiple sets of independently operating charge regulation circuits are connected to the battery, and the charge regulation circuits operate in a cold backup mode; and

[0009] Control Center, including:

[0010] Lower computer software, used to parse telemetry data and distribute indirect instructions;

[0011] Equalizer software, which communicates with the power controller software via an RS422 bus and is used to collect and process telemetry parameters of the battery; and

[0012] The onboard computer communicates with the power controller software via the 1553B bus, is used to collect parameters of the energy system and determine a recovery strategy when the energy system fails.

[0013] Another aspect of the present invention provides an on-orbit autonomous management method for a satellite energy system, comprising:

[0014] Set the power controller autonomous operation enable state, the charge and discharge power regulation unit autonomous management state, and the charge and discharge accident protection autonomous startup state to enable;

[0015] Collect telemetry parameters of the lower computer and battery;

[0016] Determine whether a fault occurs and the type of fault based on the comparison of the telemetry parameters with the preset values;

[0017] According to the fault type, the corresponding preset instructions are executed to perform autonomous recovery.

[0018] Furthermore, the fault types include telemetry communication fault, battery discharge regulation fault, battery charge regulation fault, accidental triggering of charge regulation circuit, and accidental triggering of discharge regulation circuit.

[0019] Furthermore, the determination of the fault and the type of fault includes:

[0020] If the engineering parameter count is not updated for 10 consecutive frames, and / or the PCU reference voltage is not within the specified range for 10 consecutive frames, it is a telemetry communication failure;

[0021] If the battery error voltage is greater than or equal to the first preset threshold value for 10 consecutive frames, and the battery charging current is less than or equal to the second preset threshold value, it is a battery charging regulation fault;

[0022] If the voltage of the main error amplifier circuit-shunt regulation circuit and the discharge regulation circuit is less than or equal to the third preset threshold value for 10 consecutive frames, and the output current of the discharge regulation circuit is less than the fourth preset threshold value, it is a battery charging regulation fault;

[0023] If the output current of the discharge regulation circuit is less than or equal to a fifth preset threshold, the discharge regulation circuit is accidentally triggered; and

[0024] If the voltage of the battery pack is less than or equal to the sixth preset threshold, the charging regulation circuit is accidentally triggered.

[0025] Further, the specified range is 2V-7V, and / or the first preset threshold is 5V, and / or the second preset threshold is 0.3A, and / or the third preset threshold is 8.2V, and / or the fourth preset threshold is 3A, and / or the fifth preset threshold is -1A, and / or the sixth preset threshold is 36V.

[0026] Furthermore, the autonomous recovery of the telemetry communication failure includes:

[0027] Send the command "power controller lower computer standby on master off" and "balancer lower computer standby on master off", with the time interval between the two commands being 1 second. After stabilization, confirm through telemetry that the power controller lower computer telemetry is master off standby on, and the balancer lower computer is master off standby on; and

[0028] Determine the entry and exit marks to determine the gear setting:

[0029] If the entry and exit flag is "0", the onboard computer operates the battery pack according to the post-exit working mode: the PCU charging state is set to shelve, the PCU charging state is set to enable, the threshold of the battery pack heater is set to 1°C-5°C; the battery pack voltage is set to level 5; and the battery current level is set to level 3; and

[0030] If the entry and exit flag is "1", the onboard computer operates the battery pack according to the working mode before entering the shadow: the PCU charging condition is set to full charge, the PCU charging condition is set to enable, the threshold of the battery pack heater is set to 16℃-20℃; the battery pack voltage is set to level 4; and the battery current level is set to level 7.

[0031] Furthermore, the autonomous recovery of the battery discharge regulation fault, battery charge regulation fault, accidental triggering of the charge regulation circuit, and accidental triggering of the discharge regulation circuit is achieved by sending instructions to power off and / or re-power on the faulty circuit.

[0032] Furthermore, the on-orbit autonomous management method also includes: when the satellite power supply fails, the onboard computer shuts down the payload unit according to a certain sequence, the satellite enters a safe mode, and sets the battery pack according to the shadow operation: the PCU charging condition is set to full charge, the threshold of the battery pack heater is set to 16°C-20°C; the battery pack voltage is set to level 4; the battery current level is set to level 7; and the battery pack fuel gauge is started.

[0033] The present invention provides an on-orbit autonomous management system and method for a satellite energy system. Aiming at the relatively complex electromagnetic environment in space of medium and high orbit satellites, the present invention proposes an on-orbit autonomous fault diagnosis and recovery design for the energy system, which is verified on Beidou navigation satellites. Through on-orbit data analysis, it is verified that the designed system can dynamically perform real-time online status detection, effectively solve the problems of on-orbit fault identification, diagnosis, processing and recovery of satellites, realize on-orbit autonomous maintenance, and improve the operating life of satellites. It provides a design and application reference for the subsequent stable operation management of other models on orbit, and has important engineering practical significance. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] To further illustrate the above and other advantages and features of various embodiments of the present invention, a more detailed description of various embodiments of the present invention will be presented with reference to the accompanying drawings. It will be understood that these drawings depict only typical embodiments of the present invention and are not to be considered as limiting the scope thereof. In the drawings, for clarity, identical or corresponding components will be represented by the same or similar reference numerals.

[0035] Figure 1 A schematic diagram illustrating the structure of an on-orbit autonomous management system for a satellite energy system according to one embodiment of the present invention;

[0036] Figure 2 A schematic diagram illustrating an on-orbit autonomous management process of a lower computer of a satellite energy system according to one embodiment of the present invention is shown;

[0037] Figure 3 A schematic diagram illustrating an on-orbit autonomous management process of a power regulation unit of a satellite energy system according to one embodiment of the present invention is provided;

[0038] Figure 4 A schematic diagram illustrating a process for preventing accidental triggering of a power regulation unit of a satellite energy system according to one embodiment of the present invention;

[0039] Figure 5 A schematic diagram showing an autonomous operation process of a satellite energy system according to an embodiment of the present invention;

[0040] Figure 6 A schematic diagram illustrating an autonomous management process for battery pack entry and exit in a satellite energy system according to an embodiment of the present invention;

[0041] Figure 7a-7b Shows the V of a BeiDou satellite BEA-B Voltage curve and schematic diagram of battery B overcharge protection status;

[0042] Figures 8a-8c A schematic diagram showing the power-on status and input current curve of BCR1B / BCR2B / BCR3B of a BeiDou satellite; and

[0043] Figure 9 The figure shows a schematic diagram of the A / B battery voltage curve of a Beidou satellite. DETAILED DESCRIPTION

[0044] In the following description, the present invention is described with reference to various embodiments. However, those skilled in the art will recognize that the various embodiments can be implemented without one or more of the specific details or with other alternative and / or additional methods, materials, or components. In other cases, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring the inventive aspects of the present invention. Similarly, for the purpose of explanation, specific quantities, materials, and configurations are described to provide a comprehensive understanding of the embodiments of the present invention. However, the present invention is not limited to these specific details. In addition, it should be understood that the various embodiments shown in the drawings are illustrative representations and are not necessarily drawn to scale.

[0045] In this specification, reference to "one embodiment" or "the embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. The appearances of the phrase "in one embodiment" in various places in this specification are not necessarily all referring to the same embodiment.

[0046] It should be noted that the embodiments of the present invention describe the process steps in a specific order. However, this is only for the purpose of illustrating the specific embodiment and does not limit the order of the steps. On the contrary, in different embodiments of the present invention, the order of the steps can be adjusted according to the process.

[0047] The satellite energy system consists of a power controller (PCU), a solar array, a lithium-ion battery pack, a balancer, and a power distribution unit. The PCU, as the control center of the energy system, regulates energy transfer and power balance between the solar array and the lithium-ion battery pack throughout the satellite's lifecycle, providing a fully regulated, high-quality power bus for the platform and payload to meet the satellite's power requirements in various operating modes throughout its lifecycle. The PCU is functionally divided into the main error amplifier (MEA), the shunt regulator (S3R), the charge regulator (BCR), the discharge regulator (BDR), and the telemetry and telecontrol circuits (TM / TC). With the MEA as the central regulator, it employs a three-domain control approach to coordinate the operation of the S3R, BCR, and BDR. MEA signals serve as the basis for fully regulated bus control, allowing the PCU to automatically switch to the appropriate operating mode based on varying load demands. During the sunlit period, the S3R regulates the solar array to power the onboard loads while simultaneously charging the battery pack through the BCR. During the Earth's shadow period, the BDR regulates the battery power supply to the onboard loads.

[0048] To avoid serious power supply and distribution failures of the entire satellite due to abnormal operation of the PCU, the present invention provides an on-orbit autonomous management system and method for the satellite energy system, and performs fault diagnosis and recovery designs on the lower computer module and power regulation module of the power controller respectively.

[0049] First, in order to ensure the normal energy supply on the satellite, the power controller is designed to be redundant, so that the power controller includes two sets of independently working lower computer modules and six sets of independently working BDR circuits BDR 1A ~BDR 3A- 、BDR 1B ~BDR 3B- And 6 sets of independent working BCR circuits BCR 1A ~BCR 3A- 、BCR 1B ~BCR 3B- Among them, the lower computer module works in cold backup mode, BDR 1A ~BDR 3A- and BDR 1B ~BDR 3B- They correspond to the discharge functions of battery pack A and battery pack B respectively, which work in hot backup mode, and BCR 1A ~BCR 3A- and BCR 1B ~BCR 3B- Corresponding to the charging functions of battery A and battery group B respectively, they work in cold backup mode; and

[0050] Secondly, if Figure 1 As shown, the on-orbit autonomous management system connects the PCU slave software, the balancing slave software, and the satellite energy management software via a bus, enabling them to work collaboratively. It uses key parameters representing the PCU's key functions as a basis for decision making, setting reasonable decision thresholds, sampling times, and times to perform autonomous fault diagnosis. In one embodiment of the present invention, the on-orbit autonomous management system uniformly collects data and distributes commands via the 1553B bus. The balancing slave software collects and processes battery telemetry parameters and exchanges information with the PCU via the RS422 bus. The PCU slave software communicates with the onboard computer via the 1553B bus to distribute and analyze telemetry data and indirect commands. The onboard computer collects key parameters via the 1553B bus and, when an alarm is triggered, sends pre-set commands via the 1553B bus to execute the corresponding strategy. In other embodiments of the present invention, the ground system can also perform impact domain analysis based on satellite status to facilitate subsequent operations.

[0051] Based on the on-orbit autonomous management system, when the autonomous operation enable status of each module is "enabled", autonomous management of power controller faults, autonomous operation of the power system, auxiliary bus module fault alarms and autonomous management of battery pack entry and exit can be carried out, thereby realizing autonomous fault diagnosis and recovery design of the energy system.

[0052] Autonomous power controller fault management requires the configuration of corresponding power controller autonomous management enable / disable instructions and corresponding enable / disable states. In one embodiment of the present invention, the autonomous operation enable state of the power controller is set to "enabled" via telemetry. Autonomous power controller fault management includes PCU lower-level fault diagnosis and recovery, power regulation unit fault diagnosis and recovery, and preventing accidental triggering of the power regulation unit.

[0053] When the autonomous management of the lower unit is enabled, PCU lower unit fault diagnosis and recovery can be performed, such as Figure 2 As shown, the engineering parameter technology and reference voltage are used to determine whether a telemetry communication failure has occurred. If so, the PCU master / slave switch command is executed to complete the switch operation. In one embodiment of the present invention, when the engineering parameter count is not updated for 10 consecutive frames, that is, the count does not increase, and / or the PCU reference voltage 1 and reference voltage 2 are both outside the range of 2V-7V for 10 consecutive frames, it is determined that a telemetry communication failure has occurred, and the switch operation is executed according to the following steps:

[0054] First, send the command "power controller lower computer standby on master off" and "balancer lower computer standby on master off", with the time interval between the two commands being 1 second. After stabilization, confirm through telemetry that the power controller lower computer telemetry is master off standby on, and the equalizer lower computer is master off standby on; and

[0055] Next, determine the in-and-out marks to determine the gear setting:

[0056] If the entry and exit flag is "0", the onboard computer operates the battery pack according to the post-exit working mode: the PCU charging state is set to shelve, the PCU charging state is set to enable, the threshold of the A / B battery pack heater is set to 1°C-5°C; the A / B battery pack voltage is set to level 5; and the A / B battery current level is set to level 3; and

[0057] If the entry / exit flag is "1", the onboard computer operates the battery pack according to the working mode before the entry / exit flag: the PCU charging condition is set to full charge, the PCU charging condition is set to enable, the threshold of the A / B battery pack heater is set to 16°C-20°C; the A / B battery pack voltage is set to level 4; and the A / B battery current level is set to level 7;

[0058] In one embodiment of the present invention, the charging voltage level, current level and heater threshold are set by annotation.

[0059] When the BCR power regulation unit autonomous management is enabled, the BCR power regulation unit fault diagnosis and recovery can be performed, such as Figure 3 As shown, the equalizer software collects the error voltage and charging current of batteries A and B to determine whether the BCR power regulation unit has failed. Using battery A as an example, the specific operation is described. If the error voltage of battery A is greater than or equal to 5V and the charging current of battery A is less than or equal to 0.3A for 10 consecutive frames, battery A is determined to be faulty. If the BCRi,A power-on status is "ON" (i = 1 to 3) at this time, the command BCRi,A is sent to power off. After an interval of 1 second, BCRi+1,A is sent to power on. The operation is then determined. If normal, the "BCR power regulation unit switching success status" is set to "Successful." Battery B's failure and recovery are the same as those of battery A.

[0060] When the BDR power regulation unit autonomous management is enabled, the BDR power regulation unit fault diagnosis and recovery can be performed, such as Figure 3 As shown, the MEA (S3R) voltage and MEA (BDR) voltage are used to determine whether the BDR power regulation unit is faulty. When the MEA (S3R) voltage and MEA (BDR) voltage are both less than or equal to 8.2V for 10 consecutive frames, and the power-on status of 6 BDRs is "ON", and only the output current of one BDRix,jy is less than or equal to 3A, a command is sent to BDRix,A and BDRix,B to power off the faulty BDR, where ix refers to the faulty BDR number, which takes the value 1, 2, or 3, and jy takes the value A or B. After determining that the operation is normal, the "BDR power regulation unit switching success status 1" is set to "switching successful"; if all 4 BDR states are "ON" and FLAG BDROFF If the BDRix,jy' fails again and jy' in BDRix,jy' is not equal to jy, a command is sent to power on BDRix,jy and power off BDRix,jy'. After judging that the operation is normal, the "BDR power regulation unit switching success state 2" is set to "successful switching" and FLAG BDROFF Set to TRUE, otherwise the entire satellite enters safe mode; when the BDR power regulation unit switches to state 2 "successful switching", a new BDRix,iy fault occurs again, and the entire satellite switches to safe mode; and if in the above situation, another BDRix,jy' output current ≤ 3A appears, according to the current working status, where i is 2 or 3, jy' is A or B, and all four BDRs are maintained in the ON state, and FLAG BDROFFIf jy'=B, then send a command to make BDRix, B powered off and BDR1x, B powered on. After judging that BDR1x, B powered on and BDRix, B powered off are normal, and set the BDR power regulation unit switching success state 2 to success, FLAG BDROFF Set to TRUE; if jy' = A or FLAG BDROFF If it is TRUE, the entire satellite enters the safe mode. When BDRix,iy fails again, the entire satellite will enter the safe mode.

[0061] When the BDR accident protection autonomous startup state is "enabled", the BDR output current can be used to determine whether the BDR is accidentally triggered. Figure 4 As shown, when the BDR output current I BDRix,iy (ix=1,2,3;jy=A,B) is less than or equal to -1A, and it indicates that BDR is accidentally triggered. If the current BDRix,jy power-on status is "ON", then send a command to power off BDRix,jy. After an interval of 1S, send a command to power on BDRix,jy. If the I BDRix,iy If the current is greater than -0.3A, the corresponding BDRix,jy unlock status is set to "execution successful"; if the fault remains after three consecutive executions, the corresponding BDRix,jy unlock status is set to "execution abnormality" and the corresponding BDRix,jy fault flag is set to "abnormal".

[0062] When the BCR accident protection automatic start state is "enabled", the voltage of battery packs A and B can be used to determine whether the BCR is accidentally triggered. Figure 4 As shown in the figure, when the voltage of battery groups A and B is less than or equal to 36V for 10 consecutive frames, it means that the BCR is accidentally triggered and the battery is overcharged. If the power-on status of BCRix,jy (ix=1,2,3; jy=A,B) is "ON" at this time, a command is sent to power off BCRix,jy. After an interval of 1s, a reset command for battery groups A and B overcharge protection is sent. After an interval of 1s, BCRix,jy is powered on. This command is sent three times in succession. If the overcharge protection status of battery groups A and B is still "protected", a prohibition command for battery groups A and B overcharge protection is sent three times in succession.

[0063] like Figure 5As shown in the figure, when the power controller autonomous operation enable state is "enabled", the satellite enters the autonomous operation mode, and the control center sends the command "reset the fuel gauge of battery group A" and "reset the fuel gauge of battery group B". In this working mode, the fuel gauge does not participate in any operation. At the same time, the PCU charging condition is set to full charge, the charging current of battery groups A and B is set to level 07, the charging voltage of battery groups A and B is set to level 04, and the heater thresholds of battery groups A and B are set.

[0064] When the satellite power supply fails, the entire satellite enters safe mode. The control center completes the power subsystem settings according to the steps in the video, shuts down the relevant loads in real time, and reduces the load power of the entire satellite to the minimum. There are two conditions for entering safe mode:

[0065] First, the autonomous entry into safety mode is enabled, and the primary and backup bus voltages in the processing energy pack and the bus voltage collected by the computer are all below 38V for one minute; and

[0066] Second, the autonomous entry into safety mode is enabled, and three of the telemetry measurements of the main and backup PCU output currents, load current 1, and load current 2 in the energy pack are consistently greater than 70A within one minute.

[0067] like Figure 6 As shown in the figure, when the telemetry status of the battery pack's autonomous operation in and out of shadow is "enabled", the control center can determine the on-orbit maintenance mode of the battery pack based on the satellite's in and out of shadow flag. The autonomous management operation of the battery pack in and out of shadow requires setting the corresponding autonomous in and out of shadow enable / disable instructions and having the corresponding enable / disable status, where:

[0068] When the in-shadow flag changes from "0→1", the satellite will enter the shadow within 3 days. The onboard computer operates the battery pack according to the working mode before entering the shadow. The operations include:

[0069] The PCU charging condition is set to full charge;

[0070] The threshold of the A / B battery pack heater is set to 16°C-20°C;

[0071] The voltage of the A / B battery pack is set to level 4;

[0072] The A / B battery current range is set to 7; and

[0073] A / B battery pack fuel gauge activation; and

[0074] When the satellite is out of the shadow, the energy software will operate the battery pack according to the working mode after the satellite is out of the shadow. The operation includes:

[0075] The PCU charging status is set to shelved;

[0076] The PCU charging condition is set to enabled;

[0077] The threshold of the A / B battery pack heater is set to 1°C-5°C;

[0078] The voltage of the A / B battery pack is set to level 5;

[0079] The A / B battery current level is set to level 3;

[0080] A / B battery pack fuel gauge reset;

[0081] In an embodiment of the present invention, the charging voltage level, current level and heater threshold are realized by annotation.

[0082] In one embodiment of the present invention, an auxiliary bus module is also provided. The auxiliary bus module has a total of three modules A, B, and C that work independently. Under normal conditions, modules A and B are powered on at the same time and are in backup mode, while module C is shut down and in cold standby mode. When the "auxiliary bus module A" exceeds the normal range or the "auxiliary bus module B" exceeds the normal range, the auxiliary bus operates abnormally, and an auxiliary bus module fault alarm is displayed. At the same time, the control center sends an instruction to shut down the alarm auxiliary bus, and after an interval of 1s, sends an instruction to power on the auxiliary bus C. In one embodiment of the present invention, the normal range refers to 4.30±0.2V.

[0083] To verify the effectiveness of the on-orbit autonomous management system and method, an on-orbit application verification was conducted using a BeiDou navigation satellite:

[0084] The ground software displayed a battery overcharge protection "alarm" fault. At this point, telemetry indicated that the battery overcharge protection status of satellite B changed from "0 / Normal" to "1 / Protection." Simultaneously, the power-on status of power regulation unit BCR1B changed from "0 / Powered" to "1 / Powered Off." The power-on status of BCR3B changed from "1 / Powered Off" to "0 / Powered." The power regulation unit switchover status was displayed as "Switchover Normal" for BCR-B. All parameters related to BCR-A were normal. Table 1 shows the changes in relevant parameters before and after the satellite failure.

[0085]

[0086] Table 1

[0087] A fault tree analysis was conducted on the above phenomenon, and it was finally determined that the cause of the fault was the abnormal flipping of the overcharge protection latch circuit of battery B (single event effect), which triggered the protection of battery B. Figure 3 and Figure 4 It can be seen that in the PCU power regulation unit fault autonomous management "enabled" state, when VBEA-B ≥5V, BCRi,B (i=1 to 3) power-on state is "ON" and BCRi,B input current ≤0.3A, when the conditions are met for 10 consecutive frames, BCRi,B power-off and BCRi+1,B power-on are sent. After judging that the operation is normal, the BCR power regulation unit switching success state is set to "successful switching". The relevant telemetry data before and after the fault are analyzed and compared, see Figure 7a-7b 、 Figures 8a-8c and Figure 9 shown.

[0088] B battery overcharge protection status and BCR switching process are shown in Figure 7a-7b 、 Figures 8a-8c As shown in Figure 1. At some point after the failure, the satellite enters the Earth's shadow and the battery begins to discharge. Figures 8a-8c and Figure 9 It can be seen that when battery B is discharged to a voltage of 35.99V, the BCR3B battery overcharge protection is reset. At this time, the overcharge protection state of battery B switches from "protection / 1" to "normal / 0". When the satellite leaves the Earth's shadow and enters the sunlit area, the battery discharge ends and charging begins. At this time, the BCR3B charging current is normal, and battery B is finally fully charged. The battery charge and discharge curve after the fault is shown in Figure 2. Figures 8a-8c and Figure 9 As shown in the figure, it can be seen that when the satellite's on-orbit operation is disturbed by the space environment and overcharging protection occurs, the on-orbit autonomous management system works normally on-orbit, verifying the correctness and effectiveness of the on-orbit autonomous management system.

[0089] Although various embodiments of the present invention have been described above, it should be understood that they are presented by way of example only and not limitation. It will be apparent to those skilled in the relevant art that various combinations, modifications, and variations may be made thereto without departing from the spirit and scope of the present invention. Therefore, the breadth and scope of the present invention disclosed herein should not be limited by the exemplary embodiments disclosed above, but should be defined solely in accordance with the appended claims and their equivalents.

Claims

1. A method for autonomous fault management of a satellite power controller, characterized in that: The power controller adopts a redundant design, including: Two sets of independently working slave modules, which work in cold backup mode; 6 sets of independent discharge regulation circuits BDR 1A 、BDR 2A 、BDR 3A 、BDR 1B 、BDR 2B 、BDR 3B , among which, BDR 1A 、BDR 2A 、BDR 3A Corresponding to the discharge function of battery pack A, BDR 1B 、BDR 2B 、BDR 3B corresponding to the discharge function of battery group B; and 6 sets of independent charging regulation circuits BCR 1A 、BCR 2A 、BCR 3A 、BCR 1B 、BCR 2B 、BCR 3B , among which, BCR 1A 、BCR 2A 、BCR 3A Corresponding to the charging function of battery pack A, BCR 1B 、BCR 2B 、BCR 3B Corresponding to the charging function of battery group B; The autonomous fault management method includes fault diagnosis and recovery of the lower computer, fault diagnosis and recovery of the power regulation unit, and prevention of accidental triggering of the power regulation unit. The fault diagnosis and recovery of the power regulation unit includes fault diagnosis and recovery of the charging power regulation unit and fault diagnosis and recovery of the discharging power regulation unit. The fault diagnosis and recovery of the discharging power regulation unit includes: Enabling the autonomous management function of the discharge power regulation unit; and Monitor the voltages of the main error amplifier circuit-shunt regulation circuit and the main error amplifier circuit-discharge regulation circuit in real time. If the voltages of the main error amplifier circuit-shunt regulation circuit and the main error amplifier circuit-discharge regulation circuit are all less than or equal to 8.2V for 10 consecutive frames, and the power-on status of the six independently working discharge regulation circuits are all ON, perform fault recovery based on the output current: If the discharge regulation circuit BDR ix，jy If the output current is less than or equal to 3A, the discharge regulation circuit BDR ix，A 、BDR ix，B Power off, where jy is the code of the battery pack corresponding to the discharge regulation circuit with an output current less than or equal to 3A, and the value is A or B, and ix is ​​the number of the discharge regulation circuit; The discharge regulation circuit BDR ix，A 、BDR ix，B After power failure, if the discharge regulation circuit BDR ix’，jy’ If a fault occurs, the BDR ix，jy’ Re-power on and BDR ix’，jy’ Power outage, where jy' is not equal to jy and ix' is not equal to ix; and The discharge regulation circuit BDR ix’，jy’ After a power outage, if the BDR ix’’，jy If a fault occurs, the entire satellite enters safe mode, where ix'' is not equal to ix; if BDR ix’’，jy’ If a fault occurs, the entire satellite enters safe mode, where ix'' is not equal to ix'.

2. The autonomous fault management method according to claim 1, wherein: The fault diagnosis and recovery of the lower computer includes: Enable the autonomous management function of the lower computer; and Real-time monitoring of engineering parameter counts and reference voltages. If the engineering parameter counts do not increase for 10 consecutive frames, and / or the reference voltages are not within the 2V-7V range for 10 consecutive frames, the main and standby machines will be switched. Wherein, the main standby cutting machine includes: Send the command "power controller lower computer standby on master off" and "balancer lower computer standby on master off" with a time interval of 1 second. After stabilization, confirm through telemetry that the power controller lower computer is master off and standby on, and the balancer lower computer is master off and standby on; and Determine the entry and exit marks, and set the battery pack voltage level, current level, and battery pack heater threshold by annotation: If the shadow entry and exit flag is "0", the power controller charging state is set to shelve, the power controller charging state is set to enable, the battery pack heater threshold is set to 1°C-5°C, the battery pack voltage is set to level 5, and the battery current level is set to level 3; and If the entry and exit flag is "1", the power controller charging condition is set to full charge, the power controller charging condition is set to enable, the battery pack heater threshold is set to 16℃-20℃, the battery pack voltage is set to level 4, and the battery current level is set to level 7.

3. The autonomous fault management method according to claim 1, wherein: The charging power regulation unit fault diagnosis and recovery includes: Enabling autonomous management of the charging power regulation unit; and Monitor the error voltage and charging current of the battery group A and the battery group B in real time. If the error voltage of any battery is greater than or equal to 5V and the charging current is less than or equal to 0.3A for 10 consecutive frames, the charging regulation circuit corresponding to the battery with the power-on state turned on will be powered off and powered on again after an interval of 1 second.

4. The autonomous fault management method according to claim 1, wherein: The preventing the power regulating unit from being accidentally triggered includes preventing the charging regulating circuit from being accidentally triggered and preventing the discharging regulating circuit from being accidentally triggered.

5. The autonomous fault management method according to claim 4, characterized in that: Preventing the charging regulation circuit from being accidentally triggered includes: Enable the automatic power-on function for accidental protection of the charge regulation circuit; Monitor the voltage of battery group A and battery group B in real time. If the voltage of battery group A and battery group B is less than or equal to 36V for 10 consecutive frames, the charging regulation circuit in the power-on state will be powered off, and an overcharge protection reset instruction will be sent after an interval of 1 second. Then, the charging regulation circuit will be powered on again after an interval of 1 second. This will be repeated three times. If the overcharge protection state is still protection at this time, the overcharge protection prohibition instruction will be sent three times in succession.

6. The autonomous fault management method according to claim 4, characterized in that: The method of preventing the discharge regulating circuit from being accidentally triggered comprises: Enable the discharge regulation circuit accidental protection and autonomous power-on function; Monitor the output current of the discharge regulation circuit in real time. If the output current of any discharge regulation circuit is less than or equal to -1A for 10 consecutive frames and its power-on state is ON, the discharge regulation circuit is powered off and then powered on again after an interval of 1 second to detect the output current of the discharge regulation circuit: If it is greater than -0.3A, the operation ends; otherwise Repeat the power-off and power-on operations twice. If the output current of the discharge regulation circuit is still less than -0.3A, the unlock state of the discharge regulation circuit is set to execution abnormality, and the fault flag of the discharge regulation circuit is set to abnormality.

Images