A power-on initialization method for a fully autonomous flight spacecraft

Abstract

The application discloses a power-on initialization method of a fully autonomous flight spacecraft, when a central computer fails to communicate with each lower computer after being powered on, system software enters a safe configuration mode to set important state parameters; during autonomous flight of the spacecraft, if the central computer resets and restarts or power-off restarts, and the central computer can read important data from the lower computer, the system software of the central computer enters a reset machine mode to set the important state parameters; when the whole star instantaneously power-off and power-on, the important parameters of the lower computer are all lost, the central computer normally communicates with the lower computer but cannot read important data therefrom, and important data of a FALSH of the central computer is successfully read, the whole star power-off mode is entered to set the important state parameters; if the important data of the FALSH of the central computer fails to be read, the whole star power-off and important data invalid mode is entered to set the important state parameters.

Description

TECHNICAL FIELD

[0001] The application relates to a power-on initialization method of a fully autonomous flight spacecraft, and belongs to the satellite electronic field. BACKGROUND

[0002] With the large application of the all-electric propulsion spacecraft, due to the small thrust of the thruster, the spacecraft is transferred from the perigee of 200 km to the geostationary orbit of 36000 km away from the earth for several months. The process needs to last for more than 180 days. The attitude and running track of the spacecraft need to be continuously corrected until the orbit transfer is completed. During the orbit transfer, the attitude of the spacecraft cannot guarantee the pointing of the earth measurement and control, and the spacecraft cannot be controlled by the ground station for a long time. Therefore, the spacecraft must have the ability of fully autonomous flight and autonomous fault disposal.

[0003] The central computer of the spacecraft is the "brain" of the spacecraft. When the spacecraft system is in the invisible arc segment, once the reset, power-off restart and other faults occur, the computer system of the spacecraft needs to recover the state of the spacecraft to the maximum extent according to the orbit condition of the spacecraft, the orbit transfer stage, important data before power-off and other contents, and ensure the safety of the spacecraft and continue to complete the autonomous flight task as much as possible. At present, the following problems exist in the traditional orbit transfer process of the spacecraft:

[0004] 1) When the system appears reset, power-off fault, the autonomous orbit transfer is stopped, and the next task can be completed only by the ground intervention, which affects the autonomous orbit transfer efficiency of the spacecraft;

[0005] 2) In the autonomous orbit transfer process of the traditional spacecraft, if the system restarts, the system initialization execution process is consistent under general conditions, different system initialization schemes are not adopted, different power-off working conditions cannot be individually disposed, and the system cannot be smoothly connected before and after the fault. SUMMARY

[0006] The technical problem of the application is to overcome the shortcomings of the prior art, provide a power-on initialization method of a fully autonomous flight spacecraft, realize the autonomous orbit transfer operation of the spacecraft system and the smooth connection before and after the system fault, and do not need human intervention.

[0007] The technical solution of the application is a power-on initialization method of a fully autonomous flight spacecraft, which comprises:

[0008] When the spacecraft is tested by the ground, after the first power-on of the spacecraft system, the central computer is powered on and communication with each lower computer is unsuccessful, the system software of the central computer enters a safe configuration mode, and important state parameters are set according to the safe configuration mode;

[0009] When the central computer is reset or restarted, and each lower computer is in the power-on state and normal operation before the central computer is restarted, if the central computer can read important data from the lower computer, the system software of the central computer enters the reset-off mode, and each important state parameter is set according to the reset-off mode;

[0010] When the spacecraft is in autonomous flight, if the central computer and the lower computer are in normal communication but the central computer cannot read important data from the lower computer, and the central computer successfully reads important data from the FALSH, the system software of the central computer enters the whole-star power-off mode, and each important state parameter is set according to the whole-star power-off mode.

[0011] When the spacecraft is in autonomous flight, if the central computer and the lower computer are in normal communication but the central computer cannot read important data from the lower computer, and the central computer successfully reads important data from the FALSH, the system software of the central computer enters the whole-star power-off mode, and each important state parameter is set according to the whole-star power-off mode.

[0012] Preferably, each lower computer comprises a power controller, a battery pack management unit, a control computer and an integrated service unit.

[0013] Preferably, the important data read from each lower computer comprises each important state parameter of the system, and specifically comprises:

[0014] a thermal control software enabled state, an energy software enabled state, a control software enabled state, a star time, an FDIR enabled state, an autonomous flight enabled state, a communication state table with each lower computer, an orbit mark, a central computer write enabled state for a main backup FLASH, and a whole-star remote control clear state.

[0015] Preferably, the system software of the central computer enters the safe configuration mode, and each important state parameter is set according to the safe configuration mode, and specifically comprises:

[0016] No important data is read from the lower computer; and each state parameter is set as follows:

[0017] the thermal control software enabled state is prohibited, the energy software enabled state is prohibited, the control software enabled state is prohibited, the default star time, the FDIR enabled state is prohibited, the autonomous flight enabled state is prohibited, the communication state table with each lower computer is selected by default, the orbit mark is set to a transfer orbit, the central computer write enabled state for the main backup FLASH is prohibited, and the whole-star remote control is set to the clear state by default.

[0018] Preferably, the system software of the central computer enters the reset switch-off mode, according to which the important state parameters are set, the central computer reads the important data stored in the lower computer, and according to which the system software is overwritten.

[0019] Preferably, the system software of the central computer enters the whole satellite power-off mode, according to which the important state parameters are set, the state setting is based on the premise of safety, and specifically:

[0020] The thermal control software is configured in the minimum energy mode, the energy software is configured in the minimum mode, and the control system software enters the sun orientation mode;

[0021] The autonomous flight enable is prohibited, the communication state table with each lower computer is autonomously established, the central computer writes the main backup FLASH, and the whole satellite remote control setting is clear.

[0022] The important data recorded in the self FLASH are restored, the satellite time, the FDIR enable, and the orbit flag are restored from the FLASH.

[0023] Preferably, the system software of the central computer enters the whole satellite power-off and important data invalid mode, according to which the important state parameters are set, and specifically:

[0024] The thermal control software is configured in the minimum energy mode, the energy software is configured in the minimum mode, and the control system software enters the sun orientation mode;

[0025] The satellite time is set as the default satellite time, the FDIR enable is prohibited, the autonomous flight enable is prohibited, the orbit flag is set as the transfer orbit, the central computer writes the main backup FLASH, and the whole satellite remote control setting is clear.

[0026] The central computer and the lower computer communicate by using the self-established link result.

[0027] Compared with the prior art, the present application has the following advantages:

[0028] (1) In the autonomous flight process of the spacecraft of the present application, if power-off, reset restart and other faults occur, when the system resets and power-off faults occur, no ground intervention is required, and the spacecraft system can autonomously recover to the state before the spacecraft fault according to the orbit environment, orbit transfer stage, spacecraft attitude and other information of the spacecraft system and continue autonomous flight.

[0029] (2) Compared with the traditional spacecraft, the system of the present application divides the initialization program into four types of working conditions, and different initialization programs are designed for different working conditions, so as to achieve smooth connection before and after the system fault.

[0030] (3) The present application can be popularized to various occasions with extremely high reliability requirements, and can greatly improve the system reliability and safety. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 The full autonomous flight spacecraft system architecture of the present application;

[0032] Figure 2 The power-on initialization flowchart of the full autonomous flight spacecraft of the present application. DETAILED DESCRIPTION

[0033] The full autonomous flight spacecraft electronic system adopts a distributed structure, wherein the upper computer is a central computer, and the lower computers are composed of a power controller, a battery pack management unit, a control computer and an integrated service unit, and a distributed network system is constructed through a 1553B bus to provide a standard bus interface and an electrical interface to the outside, and to realize the integrated service functions of spacecraft management and control.

[0034] The full autonomous flight spacecraft mainly experiences the following important stages in the flight process, including the main stage, the satellite-rocket separation stage, the chemical propulsion orbit transfer stage, the electric propulsion orbit transfer stage and the synchronous orbit. The functions performed by the system are different according to the different stages of the spacecraft, and the spacecraft system may appear reset, power failure and other fault conditions at any stage in the autonomous flight process. After the system is initialized again under this condition, it can recover to the software state before power failure and continue autonomous flight.

[0035] 1 Power failure mode classification

[0036] According to the power-on timing and initialization strategy under different faults, a complete analysis is made. The power-on timing after power-on and reset is analyzed during the operation of the full autonomous spacecraft. The system needs to have the ability to recover autonomously under different conditions, and to perform autonomous fault handling and data recovery. If the system is powered off, after reset, it is ensured that the system can continue the related state before power failure and important data is recovered.

[0037] Therefore, the system sets different initial states under different stages and different conditions. According to the fault mode and system task demand, the initial state setting of the spacecraft system is divided into the following categories: safe configuration mode flow, reset machine flow, whole satellite power failure flow, power failure restart and data recovery flow.

[0038] (1) Safe configuration mode: This flow is mainly designed to support the test mode demand of the spacecraft by the ground. In order to prevent the risk of false operation on the power, thermal control, control and other subsystems of the spacecraft system, the initial state of the system is set to the safe configuration mode in this mode, that is, the control function is prohibited, the thermal control function is prohibited, the energy management function is prohibited, the control propulsion function is prohibited, and the communication with the lower computer 1553B bus is the default master, and other states are set to wait for the ground instruction control execution.

[0039] (2) Reset machine mode: This mode is mainly to identify and solve the problem that the upper computer (central computer) of the spacecraft is reset and restarted or power failure restarts during autonomous flight. In this mode, the central computer can recover important data from each lower computer. Important data records parameters such as the running state of each functional software, the running phase of the spacecraft, and the task being executed. The system can recover the state settings before the reset according to the important data.

[0040] (3) Whole satellite power failure mode: This mode mainly solves the problem of system state setting after the whole satellite power failure and power-on. After the whole satellite power failure and power-on, the important parameters of the lower computer are all lost, so the system recovers important data from the FLASH. Due to the limited storage capacity of the FLASH, the system state setting is based on the premise of safety, and the thermal control and energy are configured in the minimum mode. If it is in the orbit transfer period, the control system will enter the sun orientation mode and wait for ground intervention.

[0041] (4) Whole satellite power failure and important data recovery failure mode: In this mode, the system needs to judge the phase state according to the actual collected data and configure the minimum working mode of the system to wait for timely ground processing in the case of abnormal working conditions after power failure and important data recovery failure. In this mode, the system communicates with each lower computer, so the state table is set to the on-duty lower computer with normal communication, and the communication state with the lower computer is established. According to the satellite-rocket separation state, the energy control mode is set to the minimum power mode. In the visible arc segment, the system is normally configured after ground intervention.

[0042] 2. Each power failure mode identification strategy:

[0043] When the spacecraft system is powered on for the first time, the software judges the state of each hardware of the spacecraft and the important data content (phase marker, satellite-rocket separation signal marker, etc.) stored in the FLASH.

[0044] (1) Safety configuration mode identification strategy: According to the system design, during ground testing, the whole satellite is powered on, the central computer is automatically powered on, and the spacecraft telemetry data is downloaded to the ground. Then, the ground operator sends a command to the central computer to power on each lower computer. According to the characteristics of this task flow, in the safety configuration mode, the first power-on is necessarily unsuccessful in 1553B bus communication with each lower computer (power supply controller, battery pack management unit, control computer, and integrated service unit). This feature is unique. Therefore, if the system software judges that the central computer does not communicate with each lower computer, it is defaulted that the software enters the ground test mode.

[0045] (2) System reset mode recognition strategy: in this mode, the central computer is reset, and other lower computers are in power-on state and normal operation before the upper computer is reset. Therefore, the upper computer and each lower computer can communicate normally and important data can be recovered. Therefore, the criterion of this mode is that if the central computer can successfully recover important data from the lower computer after power-on, it is considered that the software enters the system reset mode.

[0046] (3) Whole star power-off mode recognition strategy

[0047] According to the analysis of the power-on sequence of each computer, the upper computer has the longest startup time, that is, the upper computer is powered on and the other lower computers are in normal operation after the software is normally running. After the central computer is powered on, the upper computer and the lower computer can normally establish communication because the other lower computers are in power-on state. However, since it is a whole star power-off, the lower computer is powered off and then powered on (since the power switch is a magnetic latching relay), and therefore there is no important data saved by the upper computer in the single computer. Therefore, the criterion of this mode is that the upper computer and the lower computer communicate normally, but the important data of the lower computer fails to be read.

[0048] (4) Whole star power-off and FLASH data invalid recognition strategy

[0049] This mode is designed to prevent the important data of the upper computer itself from being invalid in the FLASH memory, and to initialize the system. The criterion of this mode is that the upper computer and the lower computer communicate normally, but the important data of the lower computer fails to be read and the important data of the FLASH fails to be read.

[0050] 3 Software execution flow under each flow

[0051] (1) Safe configuration mode execution;

[0052] Software operation: important data is not recovered, thermal control software is enabled, energy software is enabled, control software is enabled, default star time, FDIR (fault identification, isolation and recovery) is enabled, autonomous flight is enabled, the communication state table of each lower computer device is selected as the main part by default, the orbit mark is defaulted as a transfer orbit, the central computer is enabled to write to the main and backup FLASH, the whole star remote control is defaulted as the clear state, and thus the safe configuration mode initialization program is executed.

[0053] (2) Reset computer flow

[0054] The important data stored by the lower computer is recovered, and important state parameters (the important state parameters recovered include: the thermal control software enabling state, the energy software enabling state, the control software enabling state, the star time, the FDIR enabling state, the autonomous flight enabling state, the communication state table with each lower computer, the orbit mark, the center computer writing enabling state to the main backup FLASH, and the whole satellite remote control clear state) managed by the system software are covered.

[0055] (3) The whole satellite power-off flow

[0056] Important data recorded by the FLASH is recovered, and the parameters managed by the FLASH important data covering software (the thermal control software is configured in the minimum energy mode, the energy software is configured in the minimum mode, the control system software enters the sun-oriented mode, the star time is recovered according to the FLASH important data, the FDIR enabling is prohibited according to the FLASH recorded important data, the autonomous flight enabling is prohibited, the communication state table with each lower computer is autonomously established, the orbit mark is recovered from the FLASH, the center computer writes enabling state to the main backup FLASH, and the whole satellite remote control is set to the clear state) are managed, and thus the whole satellite power-off flow is executed.

[0057] The sun-oriented mode refers to the state of the sailboard facing the sun, and the system energy is sufficient.

[0058] (4) The whole satellite power-off and FLASH data invalid flow

[0059] In this mode, no important data can be recovered, and the center computer executes the following strategies: the center computer communicates with the lower computer by using the self-established link result execution, the thermal control software is configured in the minimum energy mode, the energy software is configured in the minimum mode, the control system software enters the sun-oriented mode, the star time is set to the default star time, the FDIR enabling is prohibited, the autonomous flight enabling is prohibited, the orbit mark is set to the transfer orbit, the center computer writes enabling state to the main backup FLASH, and the whole satellite remote control is set to the clear state.

[0060] The technical problem solved by the present application is that, in the autonomous flight process of a spacecraft, if a fault such as power-off or reset restart occurs, the spacecraft system can autonomously recover to the state before the fault of the spacecraft and continue autonomous flight according to the orbit environment, the orbit transfer stage, and the spacecraft attitude of the spacecraft system. After the system is powered on, the software can identify different power-off categories of the spacecraft in real time through characteristic parameters. Different initialization programs are executed according to each power-off category, so as to recover the system state before power-off as much as possible, and the spacecraft system can autonomously perform orbit transfer without human intervention.

[0061] Compared with a traditional spacecraft, when the system has a reset or power-off fault, no ground intervention is needed, and the system can continue to perform the autonomous orbit transfer task after restart.

[0062] Meanwhile, compared with a traditional spacecraft, the system divides initialization procedures into four types of working conditions, and different initialization procedures are designed for different working conditions, so that smooth connection before and after system failure is achieved.

[0063] The contents not described in detail in the specification of the present application belong to the prior art known to those skilled in the art.

Claims

1. A method of power-on initialization of a fully autonomous flying spacecraft, characterized by The application relates to a spacecraft system, which comprises the following parts: When the spacecraft system is tested on the ground, the central computer cannot communicate with the lower computers after the whole spacecraft is powered on for the first time, the system software of the central computer enters a safe configuration mode, and important state parameters are set according to the safe configuration mode; When the central computer is reset and restarted or power-off restarted during autonomous flight of the spacecraft, and the lower computers are in the power-on state and normally operate before the central computer is restarted, if the central computer can read important data from the lower computers, the system software of the central computer enters a reset and shutdown mode, and important state parameters are set according to the reset and shutdown mode; When the whole spacecraft is instantaneously powered off and then powered on during autonomous flight of the spacecraft, important parameters of the lower computers are all lost, the central computer can communicate with the lower computers but cannot read important data from the lower computers, and important data of the central computer are successfully read from a FLASH, the system software of the central computer enters a whole spacecraft power-off mode, and important state parameters are set according to the whole spacecraft power-off mode; When the whole spacecraft is instantaneously powered off and then powered on during autonomous flight of the spacecraft, important parameters of the lower computers are all lost, the central computer can communicate with the lower computers but cannot read important data from the lower computers, and important data of the central computer are unsuccessfully read from a FLASH, the system software of the central computer enters a whole spacecraft power-off and invalid important data mode, and important state parameters are set according to the whole spacecraft power-off and invalid important data mode.

2. The power-on initialization method of a fully autonomous flight spacecraft according to claim 1, characterized in that: The lower computers comprise a power controller, a battery pack management unit, a control computer and a comprehensive service unit.

3. The power-on initialization method of a fully autonomous flight spacecraft according to claim 1, characterized in that: The important data read from the lower computers comprises important state parameters of the system, and the important state parameters are as follows: a thermal control software enabling state, an energy software enabling state, a control software enabling state, a star time, an FDIR enabling state, an autonomous flight enabling state, a communication state table of the central computer with the lower computers, an orbit mark, a central computer main and backup FLASH writing enabling state and a whole spacecraft remote control clear and secret state.

4. The power-on initialization method of a fully autonomous flight spacecraft according to claim 1, characterized in that: The system software of the central computer enters the safe configuration mode, and important state parameters are set according to the safe configuration mode, and the important state parameters are as follows: No important data is read from the lower computers, and the state parameters are as follows: the thermal control software enabling is prohibited, the energy software enabling is prohibited, the control software enabling is prohibited, the default star time, the FDIR enabling is prohibited, the autonomous flight enabling is prohibited, the communication state table of the central computer with the lower computers is selected by default, the orbit mark is a transfer orbit by default, the central computer main and backup FLASH writing is prohibited, and the whole spacecraft remote control is in a clear state by default.

5. The power-on initialization method of a fully autonomous flight spacecraft according to claim 3, characterized in that: When the system software of the central computer enters the reset and shutdown mode, important data stored in the lower computers is read by the central computer, and the state parameters of the system software are covered according to the important data.

6. The power-on initialization method of a fully autonomous flight spacecraft according to claim 1, characterized in that: When the system software of the central computer enters the whole spacecraft power-off mode, the state parameters are set on the premise of safety, and the state parameters are as follows: the thermal control software is configured in a minimum energy mode, the energy software is configured in a minimum mode, and the control system software enters a sun orientation mode; the autonomous flight enabling is prohibited, the communication state table of the central computer with the lower computers is autonomously established, the central computer main and backup FLASH writing is enabled, and the whole spacecraft remote control is set in a clear state. Restore the important data of self FLASH record, star time, FDIR enable, and orbit mark from FLASH.

7. The power-on initialization method of a fully autonomous flight spacecraft according to claim 1, wherein: The system software of central computer enters the whole satellite power-off and important data invalid mode, according to which the important state parameters are set, specifically: The thermal control software is configured in the minimum energy mode, the energy software is configured in the minimum mode, and the control system software enters the sun orientation mode; The star time is set as the default star time, the FDIR enable is disabled, the autonomous flight enable is disabled, the orbit mark is set as the transfer orbit, the central computer writes enable to the main backup FLASH, and the whole satellite remote control is set as the clear state; The central computer and the lower computer communicate by using the autonomous link establishment result execution.

Images