Energy Fault Isolation and Recovery Strategy for Fully Autonomous Intelligent Management Satellites

Abstract

The present invention provides a fully autonomous and intelligent energy fault isolation and recovery system, including: a power controller, including: a sequential switch shunt regulator S3R connected to the solar wing, sequential shunt work on orbit, a short circuit fault mode between the solar wing and the busbar and its hardware protection circuit; a number of independent lithium battery charge and discharge regulation circuits BCRD, hot backup work on orbit; a number of independent lower computer modules and software, compatible with hot backup and cold backup working modes; the system also includes a satellite computer, which communicates with the power controller software, collects telemetry of the energy system, and adopts fault isolation and recovery strategies when a fault occurs in the energy system. The present invention can formulate a fully autonomous and intelligent energy fault isolation and recovery strategy for energy systems equipped with a new generation of domestic high-power power controllers, and improve the satellite's autonomous operation capability and fault survivability.

Description

Technical Field

[0001] The present invention is applied to satellite intelligent autonomous management, especially to fault isolation and recovery strategies related to satellite energy. Background Art

[0002] The mission of the satellite energy system is to provide and distribute electrical energy to the satellite's payload and other subsystems during the satellite's various flight phases, including the active phase, transfer orbit, and synchronous orbit. Once a failure occurs in the energy system, it may cause the payload to fail, and in serious cases, even threaten the safety of the entire satellite.

[0003] In order to further improve the reliability of my country's high-power platform energy system, a fully autonomous and intelligent energy fault isolation and recovery strategy is proposed for the first application of the domestically produced new generation high-power power supply controller to improve the satellite's autonomous operation capability and fault survivability. Summary of the invention

[0004] The technical problem to be solved by the present invention is: for the energy system equipped with a domestically produced new generation high-power power supply controller, a fully autonomous and intelligent energy fault isolation and recovery strategy is formulated to improve the satellite's autonomous operation capability and fault survivability.

[0005] To solve the above problems, the technical solution adopted by the present invention is as follows:

[0006] (1) A fully autonomous and intelligent energy fault isolation and recovery strategy, including: a power controller (including a sequential switch shunt regulator (S3R) connected to the solar wing, working in an on-orbit sequential shunt operation, with a solar wing and bus short-circuit fault mode and its hardware protection circuit; including a number of independent lithium battery charge and discharge regulation circuits (BCDRiA, BCDRiB, i can be flexibly configured according to power requirements), working in an on-orbit hot backup; including a number of independent lower computer modules and software, compatible with hot backup and cold backup working modes) and an onboard computer (communicating with the power controller software through a 1553B bus, collecting telemetry of the energy system, and taking necessary fault isolation and recovery strategies when the energy system fails).

[0007] (2) A fully autonomous and intelligent energy fault isolation and recovery strategy, wherein the fault types include: S3R module protection, battery pack charging voltage setting instruction fault, battery pack charging current setting instruction fault, battery pack charging current abnormality, battery pack unbalanced discharge fault, and BCDR module autonomous protection.

[0008] (3) According to the S3R module protection processing strategy described in (2), the onboard computer software detects all S3R protection status telemetry output by the power controller in real time. If it is detected that three consecutive frames of telemetry show that a certain level of S3R is in a protection state, the corresponding S3R protection reset instruction for this level is sent. After the instruction is sent, it is necessary to detect again in the next software control cycle whether this level of S3R is still in a protection state; if so, the protection reset instruction will not be sent, and the software will no longer detect the protection state of this level of S3R; if not, the software will continue to detect the protection state of this level of S3R in real time.

[0009] (4) As for the battery pack charging voltage setting instruction fault handling strategy described in (2), after the onboard computer software sends the battery pack constant voltage charging voltage setting instruction for one software control cycle, the battery pack constant voltage charging voltage setting code value output by the power controller is collected and read back by telemetry. If it is between the first operation threshold value and the second operation threshold value of the battery pack constant voltage charging voltage setting instruction code value, the constant voltage charging voltage setting instruction is no longer sent; if not, the battery pack constant voltage charging voltage setting instruction corresponding to the inconsistency problem is sent again, and the correctness of the instruction execution is continued to be judged. If the instruction execution is still incorrect after the third instruction is sent, the battery pack constant voltage charging voltage setting instruction error alarm mark telemetry is generated.

[0010] (5) As described in (2), the fault handling strategy for the battery pack charging current setting instruction is as follows: after the onboard computer software sends the battery pack constant voltage charging current setting instruction for one software control cycle, the battery pack constant voltage charging current setting code value output by the power controller is collected and read back by telemetry. If it is between the first operation threshold and the second operation threshold of the battery pack constant voltage charging current setting instruction code value, the constant voltage charging current setting instruction is no longer sent; if not, the battery pack constant voltage charging current setting instruction corresponding to the inconsistency problem is sent again, and the correctness of the instruction execution is continued to be judged. If the instruction execution is still incorrect after the third instruction is sent, a battery pack constant voltage charging current setting instruction error alarm mark telemetry is generated.

[0011] In steps (4) and (5), the onboard computer software sends a constant voltage charging current setting instruction to the battery pack when the illumination-Earth (Moon) shadow season switches.

[0012] (6) As for the battery pack charging current abnormal fault handling strategy described in (2), if the onboard computer software determines that the battery voltage telemetry input by the power controller is less than the first preset threshold; and any one of the S3R shunt / power supply status telemetry input by the power controller is equal to 1; and the battery pack charging current telemetry input by the power controller is greater than the second preset threshold or less than the third preset threshold, it is determined that an abnormal battery pack charging current fault has occurred, then the constant current charging current setting instruction and the constant voltage charging voltage setting instruction of the abnormal battery pack are resent, and the correctness judgment of the instructions as described in (4) and (5) is not performed, and the battery pack charging current abnormal fault judgment is directly performed. A single instruction is sent up to 3 times in total. If the instruction execution judgment is still incorrect after the third instruction is sent, the east or west battery pack charging current error alarm mark telemetry is generated.

[0013] (7) In the battery pack unbalanced discharge fault handling strategy as described in (2), the onboard computer collects the current of all the power controller BCDR modules as described in (1), and obtains the battery pack discharge imbalance through the first operation unit; if the onboard computer determines for three consecutive frames that the main error amplifier (Main Error Amplifier, MEA) telemetry output of the power controller is less than the fourth preset threshold and the battery pack discharge imbalance is less than the fifth preset threshold, the software generates a battery pack unbalanced discharge fault alarm flag telemetry.

[0014] (8) The first operation unit described in (7) is

[0015] [(I BCDR1A +I BCDR2A +……+I BCDRiA )-(I BCDR1B +I BCDR2B +……+I BCDRiB )] / [(I BCDR1A +I BCDR2A +……+I BCDRiA )+(I BCDR1B +I BCDR2B +……+I BCDRiB )]

[0016] (9) The BCDR module autonomous protection processing strategy described in (2) is that the onboard computer software detects in real time the protection status of all BCDR battery-side switches and bus-side switches output by the power controller. When the onboard computer continuously displays the battery-side switch protection status or bus-side switch protection status of the same BCDRiA or BCDRiB as "protected" for three frames of telemetry, the APS shutdown command of the BCDRiA or BCDRiB module is sent, and the APS shutdown command of the corresponding BCDRiB or BCDRiA module of another battery group is sent at the same time. After the command is sent, after one software control cycle, the correctness of the command execution is judged, that is, whether the APS on / off status of the BCDRiA and the corresponding BCDRiB module is both in the shutdown state: if yes, the command is no longer sent and the software function continues; if not, the shutdown command is sent again and the correctness of the command execution is continued to be judged; a single command is sent up to three times cumulatively. If the command execution judgment is still incorrect after the third command is sent, the corresponding BCDRiA and BCDRiB shutdown fault alarm flag telemetry is generated.

[0017] Beneficial Effects

[0018] For the first application of the domestically produced new generation of high-power power controller, a fully autonomous and intelligent energy fault isolation and recovery strategy is proposed to improve the satellite's autonomous operation capability and fault survivability. This method has been applied to multiple models and has been verified on orbit. The relevant results can be extended to the power supply system of space high-orbit satellites equipped with the domestically produced new generation of high-power power controller. DETAILED DESCRIPTION

[0019] This chapter describes the specific implementation method.

[0020] (1) A fully autonomous and intelligent energy fault isolation and recovery strategy, characterized by comprising: a power controller (including a sequential switch shunt regulator (S3R) connected to the solar wing, which performs sequential shunt operation on orbit, has a solar wing and bus short circuit fault mode and its hardware protection circuit; contains 16 independent lithium battery charge and discharge regulation circuits (BCDRiA, BCDRiB, i=1-8), performs on-orbit hot backup operation; contains 2 sets of independent lower computer modules and software, which are compatible with hot backup and cold backup working modes) and an onboard computer (which communicates with the power controller software through 1553B summary, collects telemetry of the energy system, and takes necessary fault isolation and recovery strategies when the energy system fails).

[0021] (2) A fully autonomous and intelligent energy fault isolation and recovery strategy, characterized in that the fault types include: battery pack charging voltage setting instruction failure, battery pack charging current setting instruction failure, battery pack charging current abnormality, battery pack unbalanced discharge failure, S3R module protection, BCDR module autonomous protection, and accidental disconnection of the battery pack connection state.

[0022] (3) The S3R module protection processing strategy can prevent protection misoperation due to reasons such as single particles in space, and the protection state can be released through the protection reset instruction.

[0023] The S3R module power supply isolation diode is not designed in series. When the S3R module detects that there is a reverse current from the bus to the solar wing in the power supply isolation diode, the internal hardware protection of the S3R module is triggered, and the ground shunt MOS tube is turned off. At the same time, the power controller lower computer module sends an S3R module protection status signal to the onboard computer.

[0024] The software detects all S3R protection status telemetry of PCU in real time. If it detects that 3 consecutive frames of telemetry show that a certain level of S3R is in a protection state, the corresponding S3R protection reset instruction for this level will be sent. After the instruction is sent, it is necessary to detect again in the next software control cycle whether this level of S3R is still in a protection state; if so, the protection reset instruction will no longer be sent, and the software will no longer detect the protection state of this level of S3R; if not, the software will continue to detect the protection state of this level of S3R in real time.

[0025] (4) The power supply and distribution subsystem is respectively provided with constant voltage charging voltage setting instructions for the east and west battery groups, and constant voltage charging voltage setting instructions for the west and east battery groups. At the same time, constant voltage charging voltage setting code value readback telemetry for the east and west battery groups is respectively provided for the above instructions. After the onboard computer software sends the constant voltage charging voltage setting instruction for the battery group for one software control cycle,

[0026] Step 1: Calculate the battery pack constant voltage charging voltage setting instruction code value C VS The first operation threshold (3.4×C VS / 255+3.926) and the second operation threshold (3.4×C VS / 255+4.074);

[0027] Step 2: Collect the constant voltage charging voltage setting code value of the battery pack output by the power controller and read back the telemetry V CVR , determine V CVR Whether it is between the first operation threshold and the second operation threshold;

[0028] If yes, the constant voltage charging voltage setting instruction is no longer sent;

[0029] If not, the battery pack constant voltage charging voltage setting instruction corresponding to the inconsistency problem is sent again, and the correctness of the instruction execution is further judged;

[0030] If the command execution is still incorrect after the third command is sent, a battery pack constant voltage charging voltage setting command error alarm flag telemetry will be generated.

[0031] (5) The power supply and distribution subsystem is provided with constant current charging current setting instructions for the east and west battery groups respectively, and constant current charging current setting instructions for the west and east battery groups respectively. At the same time, constant current charging current setting code value readback and constant current charging current setting code value readback telemetry are provided for the above instructions respectively. After the onboard computer software sends the constant voltage charging current setting instruction for the battery group for one software control cycle,

[0032] Step 1: Calculate the battery pack constant voltage charging current setting instruction code value C CS The first operation threshold (5×C CS / 255+2.425) and the second operation threshold (5×C CS / 255+2.575);

[0033] Step 2: Collect the battery pack constant voltage charging current setting code value output by the power controller and read back the telemetry V CCR , determine V CCR Is it between the first operation threshold and the second operation threshold?

[0034] If yes, the constant voltage charging current setting instruction will no longer be sent;

[0035] If not, the battery pack constant voltage charging current setting instruction corresponding to the inconsistency problem is sent again, and the correctness of the instruction execution is further judged;

[0036] If the command execution is still incorrect after the third command is sent, a battery pack constant voltage charging current setting command error alarm flag telemetry will be generated.

[0037] (6) The strategy for handling abnormal battery charging current fault is as follows:

[0038] Step 1: The onboard computer software determines the abnormal charging current fault of the battery pack. The strategy is as follows:

[0039] If the battery voltage telemetry input by the power controller is less than the first preset threshold; and any one of the S3R shunt / power supply status telemetry input by the power controller is equal to 1; and the battery pack charging current telemetry input by the power controller is greater than the second preset threshold or less than the third preset threshold, it is judged that an abnormal battery pack charging current fault has occurred.

[0040] The first preset threshold is 84, the second preset threshold and the third preset threshold are 7.9 and 7.0 or 1.9 and 1.1

[0041] Step 2: If it is determined that the battery pack charging current is abnormal, the constant current charging current setting instruction and the constant voltage charging voltage setting instruction of the abnormal battery pack are resent, and the correctness judgment of the instructions as described in (4) and (5) is not performed, and the abnormal battery pack charging current fault is directly judged;

[0042] Step 3: If the command execution is still incorrect after the third command is sent, an error alarm flag telemetry for charging current of the east or west battery pack is generated.

[0043] (7) A typical embodiment is configured as follows:

[0044] BCDRiA (i = 1 ~ 8max) corresponds to the connection of the western battery pack (battery pack 2)

[0045] BCDRiB (i = 1 ~ 8max) corresponds to the connection of the battery pack (battery pack 1)

[0046] The method for judging the unbalanced discharge fault of the battery pack is as follows:

[0047] Step 1: The onboard computer collects the current of all power controller BCDR modules as described in (1) and calculates the battery pack discharge imbalance.

[0048] [(I BCDR1A +I BCDR2A +……+I BCDR8A )-(I BCDR1B +I BCDR2B +……+I BCDR8B )] / [(I BCDR1A +I BCDR2A +……+I BCDR8A )+(I BCDR1B +I BCDR2B +……+I BCDR8B )]

[0049] Step 2: For three consecutive frames, it is determined that the MEA telemetry output by the power controller is less than the fourth preset threshold, and the battery pack discharge imbalance is less than the fifth preset threshold. The software generates a battery pack unbalanced discharge fault alarm mark telemetry.

[0050] Among them, the fourth preset threshold is 10.5

[0051] The 5th preset threshold is 0.2.

[0052] (8) The BCDR module autonomous protection processing strategy as described in (2),

[0053] The power management software monitors the battery-side switch protection status and bus-side switch protection status of all 16 BCDR modules (BCDRiA and BCDRiB) in real time;

[0054] When the SMU shows that the battery side switch protection status or bus side switch protection status of the same BCDRiA or BCDRiB is "protected" for three consecutive frames of telemetry, the APS shutdown command of the BCDRiA or BCDRiB module is sent, and the APS shutdown command of the BCDRiB or BCDRiA module of the corresponding other battery group is sent at the same time.

[0055] After the instruction is sent, after a software control cycle, the correctness of the instruction execution is judged, that is, checking whether the APS power on / off status of the BCDRiA and corresponding BCDRiB modules are both in the power off state:

[0056] If yes, no more instructions will be sent and the software function will continue;

[0057] If not, send the shutdown command again and continue to judge the correctness of the command execution;

[0058] A single instruction can be sent up to 3 times in total. If the instruction execution judgment is still incorrect after the third instruction is sent, the corresponding BCDRiA and BCDRiB shutdown fault alarm flag telemetry will be generated and this function will no longer run.

Claims

1. A method for energy fault isolation and recovery, characterized in that: A fully autonomous and intelligent energy fault isolation and recovery system, the system comprising: a power controller and an onboard computer; The power supply controller includes: a sequential switch shunt regulator S3R connected to the solar wing, which works in an on-orbit sequential shunt operation and includes a hardware protection circuit for short circuit between the solar wing and the busbar; Several independent lithium battery charge and discharge regulation circuits BCDR, working as hot backup on orbit; Several independent lower computer modules and software, compatible with hot backup and cold backup working modes; The onboard computer includes: communicating with software in the power controller, collecting telemetry of the power controller, determining the fault type based on the telemetry and taking corresponding fault isolation and recovery strategies; The types of faults include: S3R module protection, battery pack charging voltage setting instruction fault, battery pack charging current setting instruction fault, battery pack charging current abnormality, battery pack unbalanced discharge fault, and BCDR module autonomous protection; The method comprises the following steps: S1: The onboard computer monitors the telemetry of the energy system in real time; S2: Determine the fault according to the telemetry and take corresponding fault isolation and / or recovery measures; In step S2, when the fault is S3R module protection, the processing method is specifically as follows: the onboard computer software detects all S3R protection status telemetry output by the power controller in real time. If it is detected that 3 consecutive frames of telemetry show that a certain level of S3R is in a protection state, the corresponding S3R protection reset instruction of this level is sent. After the instruction is sent, it is necessary to detect again whether this level of S3R is still in a protection state in the next software control cycle; if yes, the protection reset instruction is no longer sent, and the software no longer detects the protection state of this level of S3R; if no, the software continues to detect the protection state of this level of S3R in real time; In step S2, when the fault is a battery pack charging voltage setting instruction fault, the processing method is specifically as follows: after the onboard computer software sends the battery pack constant voltage charging voltage setting instruction for one software control cycle, the battery pack constant voltage charging voltage setting code value output by the power controller is collected and read back by telemetry. If it is between the first operation threshold value and the second operation threshold value of the battery pack constant voltage charging voltage setting instruction code value, the constant voltage charging voltage setting instruction is no longer sent; if not, the battery pack constant voltage charging voltage setting instruction corresponding to the inconsistency problem is sent again, and the correctness of the instruction execution is continued to be judged. If the instruction execution is still incorrect after the third instruction is sent, a battery pack constant voltage charging voltage setting instruction error alarm mark telemetry is generated; In step S2, when the fault is a battery pack charging current setting instruction fault, the processing method is specifically as follows: after the onboard computer software sends the battery pack constant voltage charging current setting instruction for one software control cycle, the battery pack constant voltage charging current setting code value output by the power controller is collected and read back by telemetry. If it is between the first operation threshold and the second operation threshold of the battery pack constant voltage charging current setting instruction code value, the constant voltage charging current setting instruction is no longer sent; if not, the battery pack constant voltage charging current setting instruction corresponding to the inconsistency problem is sent again, and the correctness of the instruction execution is continued to be judged. If the instruction execution is still incorrect after the third instruction is sent, a battery pack constant voltage charging current setting instruction error alarm mark telemetry is generated; In step S2, when the fault is an abnormal charging current of the battery pack, the processing method is specifically as follows: if the onboard computer software determines that the battery voltage telemetry input by the power controller is less than the first preset threshold; and any one of the S3R shunt and power supply status telemetry input by the power controller is equal to 1; and the battery pack charging current telemetry input by the power controller is greater than the second preset threshold or less than the third preset threshold, it is determined that an abnormal charging current fault of the battery pack occurs, then the constant current charging current setting instruction and the constant voltage charging voltage setting instruction of the abnormal battery pack are resent, and the abnormal charging current fault of the battery pack is directly judged. A single instruction is sent up to 3 times cumulatively. If the instruction execution judgment is still incorrect after the third instruction is sent, the east or west battery pack charging current error alarm mark telemetry is generated; In step S2, when the fault is a battery pack unbalanced discharge fault, the processing method is specifically as follows: the onboard computer collects the current of the BCDR in all the power controllers, and calculates the battery pack discharge imbalance through the first operation unit; if the onboard computer determines for three consecutive frames that the main error amplifier telemetry output by the power controller is less than the fourth preset threshold and the battery pack discharge imbalance is less than the fifth preset threshold, the software generates a battery pack unbalanced discharge fault alarm mark telemetry; In step S2, when the fault is the autonomous protection of the BCDR module, the processing method is specifically as follows: the onboard computer software detects in real time the protection status of all BCDR battery-side switches and the bus-side switch protection status output by the power controller; when the onboard computer continuously displays the battery-side switch protection status or the bus-side switch protection status of the same BCDR as "protection" for three frames of telemetry, the BCDR module APS shutdown instruction is sent, and the corresponding BCDR module APS shutdown instruction of another battery group is sent at the same time; after the instruction is sent, after a software control cycle, the correctness of the instruction execution is judged, that is, whether the corresponding BCDRAPS on / off status of the BCDR and the other battery group is in the shutdown state: if yes, the instruction is no longer sent, and the software function continues; if not, the shutdown instruction is sent again, and the correctness of the instruction execution continues to be judged; a single instruction is sent up to three times in total. If the instruction execution judgment is still incorrect after the third instruction is sent, the corresponding BCDR shutdown fault alarm mark telemetry is generated.