Satellite-borne computer based on logic program control instruction and satellite service management method

Abstract

The invention relates to a satellite-borne computer based on a logic program control instruction and a satellite service management method. The satellite-borne computer comprises a satellite service management module and an attitude and orbit control module, the satellite service management module can load, analyze and execute a logic program control instruction sequence, and the satellite service management module is configured to judge working state data through a logic program control instruction. The task instruction is executed based on a judgment result obtained by the logic program control instruction so as to ensure the safety of the satellite when the task instruction is executed, the logic program control instruction comprises a condition judgment instruction, and the condition judgment instruction can be flexibly matched with one or more of a condition jump instruction, a loop execution instruction and a calling execution instruction for use; the logic program control instruction is finally organized in the form of an instruction sequence to form an execution logic relation; the attitude and orbit control module is configured to control / monitor the attitude and orbit of the satellite and at least send the attitude and orbit state data of the satellite to the satellite service management module.

Description

[0001] The original basis of the divisional application is a patent application with the application number 202210290624.6, the application date of March 23, 2022, and the invention name of "Satellite Autonomous Safety Implementation Method and System Based on Logical Programmed Instruction". TECHNICAL FIELD

[0002] The present application relates to the technical field of on-orbit satellites, in particular to a satellite-borne computer and satellite management method based on logical program control instructions. BACKGROUND

[0003] When a satellite is in orbit, it flies outside the country most of the time. Once the whole satellite component fails, it cannot be intervened and controlled by the ground in time, which is easy to cause the whole satellite failure, and further affect the satellite task and even cause disastrous consequences. Therefore, it is necessary to combine the characteristics of the satellite-borne computer as the whole satellite information control center to reasonably set the autonomous judgment mode and autonomous control measures of various faults to ensure that the satellite can effectively complete the fault judgment and processing when flying outside the country, and ensure the reliability and safety of the satellite in orbit. The existing satellite executes the logical program control instruction sequence in a time-to-point manner, and the instruction sequence generally cannot judge the working state of the satellite.

[0004] For example, the satellite program control instruction maintenance method based on the circular queue disclosed in the Chinese patent document with the publication number CN107562443A adopts a time-to-point execution method, that is, it is judged whether the instruction in the instruction sequence reaches the execution time, and if the time reaches the execution time of the instruction, the instruction is executed. This method only judges the validity of the instruction, the execution time and the execution interval when the instruction sequence is executed, and does not judge whether the system state is normal, whether the conditions meet the execution of the instruction, and other system safety factors. As for the system safety judgment, it needs to be independently performed outside the instruction sequence, and in some cases, the execution of the instruction sequence may trigger the system safety mechanism, thereby causing the contradiction between the system safety and the execution of the task instruction sequence.

[0005] However, the ground preconceived faults may not match the actual on-orbit situation, or new fault conditions occur on-orbit, which requires software updates to increase a safety mode processing, modification and maintenance are complex; and each type of satellite needs to be designed with corresponding safety modes according to the characteristics of the type of software coding, which has poor flexibility and adaptability. In order to protect the safety of the satellite, various safety modes need to be designed in the satellite software, and the safety mode is independent of the instruction sequence to determine the satellite state for abnormal processing, which on the one hand may conflict with the satellite mission instruction sequence and safety mode abnormal processing, and on the other hand the implementation of the safety mode is also relatively complex and lacks flexibility. In addition, the safety mode designed in the software by the ground is difficult to modify / maintain on-orbit and lacks universality; each satellite also needs separate coding software to design its own safety mode, and at the same time such safety mode cannot adapt to various abnormal situations on-orbit.

[0006] For example, the Chinese patent document with publication number CN111126020A discloses a tabular autonomous safety mode design method and system for autonomous safety mode management of a spacecraft. The invention abstractly designs autonomous safety modes of a spacecraft into two general tables: a telemetry criterion table and an execution action sequence table. Only two tables need to be designed to complete the autonomous safety mode design of different types, and the tables can be modified by uploading. It has the advantages of strong universality, easy expansion and easy modification. However, the method implemented by the invention relies on two global tables, and a single exception needs to re-upload two tables, which is not convenient to maintain.

[0007] For another example, the Chinese patent document with publication number CN107885140A discloses a hierarchical autonomous emergency management method and system, which is a method of managing autonomous safety in modes. The method pre-classifies satellite faults, judges the current state according to telemetry data, matches the corresponding fault mode, and then executes the corresponding instruction sequence for autonomous safety processing. Although the invention has a certain flexibility compared with the hard-coded autonomous safety processing, the instruction sequence can be adjusted, but the invention is fixed according to the telemetry state to match the corresponding fault mode, and the fault mode is often hard-coded, which on the one hand cannot be adjusted flexibly, and on the other hand lacks universality between types. Therefore, it is necessary to improve the above prior art.

[0008] In addition, on the one hand, there are differences in the understanding of those skilled in the art; on the other hand, a large number of literatures and patents are studied by the applicant when making the present application, but due to the limitation of space, all details and contents are not listed in detail, but this does not mean that the present application does not have these prior art characteristics, on the contrary, the present application has all the characteristics of the prior art, and the applicant reserves the right to add relevant prior art in the background art. SUMMARY

[0009] The logical program control instruction sequence of the existing satellite is executed according to time points, and the instruction sequence cannot determine the state of the satellite. The autonomous safety of the satellite also needs to be coded and implemented separately, and the execution of the instruction sequence may trigger the safety mode. There is a contradiction between the autonomous safety of the satellite and the timing execution of the instruction sequence, which cannot guarantee the safety of the on-orbit task execution of the satellite. In addition, the existing logical program control instruction sequence is mechanically executed according to time points, and the instruction function is single and does not have a condition determination function, so it cannot adapt to the demand of complex tasks of the satellite on-orbit execution. These task executions need to rely on pre-designed task software programs to execute normally.

[0010] The existing satellite autonomous safety implementation mostly adopts a software method to preset various safety modes to preconceive possible faults and countermeasures of the satellite on-orbit. Since the autonomous safety mode is fixed in software form, it is difficult to maintain, modify and extend on-orbit.

[0011] The existing satellite autonomous safety implementation needs to code the corresponding safety mode according to the specific software of the model. The above safety mode design is complex and not universal, and each model needs to develop independent autonomous safety related software, so it does not have flexibility and universal applicability.

[0012] In view of the deficiencies of the prior art, the present application proposes a satellite autonomous safety implementation method and system based on logical program control instructions. The system at least includes a star service management module and other modules. The star service management module can load, parse and execute the logical program control instruction sequence. The other modules are configured to send the working state data of the other modules to the star service management module. The star service management module is configured to determine the working state data through the logical program control instruction, and execute the task instruction based on the determination result obtained by the logical program control instruction, to ensure the safety of the satellite when executing the task instruction.

[0013] The satellite autonomous safety implementation system at least comprises a satellite management module and other modules. The satellite management module is capable of loading, parsing and executing a logical program control instruction sequence. The logical program control instruction sequence at least comprises logical program control instructions and task instructions. The other modules are configured to be capable of sending working state data of the other modules to the satellite management module. The satellite management module is configured to be capable of judging the working state data through the logical program control instructions and executing the task instructions based on a judgment result obtained by the logical program control instructions, so as to ensure the safety of the satellite when the task instructions are executed.

[0014] Preferably, the satellite management module is capable of acquiring the working state data sent by the other modules.

[0015] Preferably, the logical program control instruction sequence at least comprises an execution time and logical program control instructions and / or task instructions of the satellite corresponding to the execution time.

[0016] Preferably, the task instructions are at least capable of being used to control the other modules to execute specific tasks. Preferably, the task instructions further comprise exception handling instructions for performing corresponding exception handling.

[0017] Preferably, the working state data at least comprises attitude and orbit state data, attitude and orbit single machine state data, power supply and distribution state data, load state data, heater and temperature state data. Preferably, the working state data can further comprise new working state data according to actual scene requirements.

[0018] Through the configuration mode, the satellite autonomous safety implementation system of the present application adds logical program control instructions in the logical program control instruction sequence, and then automatically judges whether the satellite is safe based on the working state data in advance, so as to solve the contradiction between autonomous safety and execution of the task instructions and ensure the safety of the satellite in the on-orbit task execution.

[0019] Through the configuration mode, the satellite autonomous safety implementation system of the present application judges the safety state of the satellite through the logical program control instructions in the instruction sequence, and performs autonomous safety processing through the instruction sequence mode. On-orbit maintenance only needs to update the instruction sequence, without the need of uploading software codes, so the maintenance is simple, the modification is easy and the system is highly expandable.

[0020] Through the configuration mode, the satellite autonomous safety implementation system of the present application has universality. Different models can be adapted through adjustment of the instruction sequence, and no software coding is needed, so the software development workload is greatly reduced.

[0021] According to one preferred embodiment, the logical program control instructions at least comprise condition judgment instructions. The condition judgment instructions are at least capable of being used to judge the working state data and output a judgment result.

[0022] According to a preferred embodiment, the logic program control instruction further comprises one or more of a conditional jump instruction, a loop execution instruction, and a call execution instruction. The conditional jump instruction is capable of jumping to a specified number of program control instructions for execution according to a result of a conditional judgment instruction. The loop execution instruction is used to loop execution of subsequent program control instructions of the logic program control instruction sequence. The call execution instruction is used to call and execute other instruction sequences to be called.

[0023] Particularly preferably, the conditional judgment instruction can be flexibly used in combination with one or more of the conditional jump instruction, the loop execution instruction, and the call execution instruction.

[0024] With this configuration, the present application achieves a logic-judgment-enabled and programmable instruction sequence. By using general conditional judgment, jump, and call execution logic program control instructions, the satellite state is judged during task execution, and the instruction sequence is called based on the judgment result to perform corresponding exception handling, so as to unify the task instruction sequence execution and the satellite autonomous safety. The instruction sequence achieved by the present application can flexibly handle various exceptions during task execution, has programmable characteristics, and can be adjusted in time according to the on-orbit situation, thereby avoiding the conflict between the task and the autonomous safety in the prior art. The general logic program control instruction achieved by the present application has universal applicability and can be implemented for general satellite systems without the need for safety mode software coding for specific satellites, thereby greatly reducing the satellite software development amount. Meanwhile, since the instruction sequence has programmable capability, the functions that can be achieved by the instruction sequence are greatly expanded. The conditional judgment, jump, and call logic program control instructions achieved by the present application enable the logic program control instruction sequence to have programmable characteristics, that is, not only the satellite autonomous safety can be achieved, but also the functions and application range of the instruction sequence are expanded, and some complex tasks can be completed by using the above instructions.

[0025] According to a preferred embodiment, the logic program control instruction is composed of an instruction code and an instruction parameter. The instruction code is used to uniquely identify a logic program control instruction. The instruction parameter of the conditional judgment instruction comprises a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type.

[0026] The analysis and execution flow of the conditional judgment instruction is as follows: the judgment data source ID is obtained from the conditional judgment instruction to judge the data source; the data corresponding to the judgment data number is obtained from the data source; the judgment mode word is obtained from the conditional judgment instruction, and whether the logical relationship between the data and the threshold value is established is judged according to the judgment mode, and the judgment result is temporarily stored as the input of the subsequent conditional jump instruction and / or loop execution instruction.

[0027] According to a preferred embodiment, the instruction parameter of the conditional jump instruction comprises the number of instructions to be jumped.

[0028] According to a preferred embodiment, the instruction parameter of the loop execution instruction comprises a loop condition, a maximum loop number and the number of program control instructions to be executed in a loop.

[0029] The execution process of the loop execution instruction is as follows: obtaining the loop condition and the maximum loop number; judging whether the maximum loop number or the loop condition is met; if the maximum loop number or the loop condition is not met, executing the logical program control instruction sequence in a loop until the maximum loop number or the loop condition is met; if the maximum loop number or the loop condition is met, stopping the execution of the logical program control instruction sequence in a loop.

[0030] According to a preferred embodiment, the instruction parameter of the call execution instruction comprises the task instruction name to be called and executed.

[0031] The execution process of the call execution instruction is as follows: searching for the instruction sequence file to be called and executed according to the task instruction name to be called and executed; judging whether there is a sub-instruction sequence to be called; if there is a sub-instruction sequence to be called, executing the sub-instruction sequence, and then continuing to execute the main instruction sequence after the execution of the sub-instruction sequence; if there is no sub-instruction sequence to be called, directly continuing to execute the main instruction sequence.

[0032] According to a preferred embodiment, the other modules at least comprise an attitude and orbit control module. The attitude and orbit control module is configured to control / monitor the attitude and orbit of the satellite, and at least send the attitude and orbit state data of the satellite to the satellite service management module.

[0033] According to a preferred embodiment, the other modules further comprise an attitude and orbit control unit module, a power supply module, a load module and a thermal control module. The attitude and orbit control unit module is configured to send the attitude and orbit control unit state data of the attitude and orbit control unit to the satellite service management module, the power supply module is configured to provide the power supply and power distribution state data of the satellite to the satellite service management module, the load module is configured to send the load state data of the load unit to the satellite service management module, and the thermal control module is configured to send the heater and temperature state data to the satellite service management module.

[0034] The application also provides a satellite autonomous safety implementation method based on logical program control instructions. The satellite autonomous safety implementation method comprises: The star management module loads, parses and executes the logical program control instruction sequence, and the logical program control instruction sequence at least includes logical program control instructions and task instructions; The other modules send working state data of the other modules to the star management module; The star management module judges the working state data through the logical program control instructions, and executes the task instructions based on the judgment result obtained by the logical program control instructions, so as to ensure the safety of the satellite when the task instructions are executed. Through the configuration mode, the logical program control instructions in the instruction sequence include but are not limited to conditional judgment instructions, conditional jumps, loop execution, calls and other logical program control instructions, so that the instruction sequence has programmable characteristics.

[0035] Through the configuration mode, the use of the logical program control instruction sequence for exception handling in task execution can dynamically judge whether the execution condition is met, ensuring that the task execution does not conflict with autonomous safety. The use of the logical program control instruction sequence for autonomous safety processing makes the satellite autonomous safety function no longer hard-coded, flexible and adaptable, and can be reconfigured and modified on orbit. The autonomous safety management is organized into several small loop instruction sequences and executed in parallel, avoiding delays caused by sequential processing. The addition of logical program control instructions in the instruction sequence can be programmed and combined to adapt to complex task execution on orbit. The present scheme uses the logical program control instruction sequence to organize small loops for exception judgment and call instruction sequences for processing, without the need for pre- software coding for specific exceptions. The exception handling logical program control instruction sequence can be dynamically adjusted according to the exceptions occurring on orbit. Compared with the above-mentioned execution mode of the logical program control instruction sequence in time sequence, the present scheme implements logical program control instructions in the instruction sequence, realizes programmable instruction sequence, conditional execution, jump execution, loop execution and calling other execution sequences for execution, and is flexible in execution mode and can flexibly handle exceptions that may occur during task execution. In addition, the present scheme has small workload, is easy to add, delete and modify, and realizes autonomous safety processing by software hard coding. If the exceptions occurring on orbit are inconsistent with the assumptions and need to be modified and uploaded to the software for modification processing, the workload is large, and new exception handling functions also need to be uploaded to the software. The present scheme only needs to modify the exception handling logical program control instruction sequence, and the modification and uploading of the instruction sequence are much simpler and have small workload. The present scheme has wider adaptability. The autonomous safety realized by software hard coding needs to be bound to a specific model, and the implementation of the model often cannot adapt to other models. Each model needs to be re-coded for autonomous safety management. The present scheme uses the logical program control instruction sequence for autonomous safety processing, and each model only needs to adjust the instruction sequence for exception handling to adapt to the requirements of the present model, so the adaptability is wider. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 is a simplified module connection relationship schematic diagram of a preferred embodiment of the satellite autonomous safety implementation system provided by the present application; Figure 2 is a schematic diagram of a preferred embodiment of the judgment mode word provided by the present application; Figure 3 is a schematic diagram of a preferred embodiment of the judgment data source ID provided by the present application; Figure 4 is a schematic diagram of a preferred embodiment of the judgment data number provided by the present application; Figure 5 is a flowchart schematic diagram of a preferred embodiment of the logic program control instruction sequence provided by the present application; Figure 6 is a flowchart schematic diagram of another preferred embodiment of the logic program control instruction sequence provided by the present application.

[0037] List of reference signs 1: satellite management module; 2: attitude and orbit control module; 3: attitude and orbit control single machine module; 4: power module; 5: payload module; 6: thermal control module. DETAILED DESCRIPTION

[0038] The following will be described in detail with reference to the accompanying drawings.

[0039] Figure 1 A satellite autonomous safety implementation system based on a logic program control instruction is shown. The satellite autonomous safety implementation system at least includes a satellite management module 1 and other modules.

[0040] The satellite management module 1 is capable of loading, parsing and executing a logic program control instruction sequence.

[0041] The other modules are configured to be capable of sending working state data of the other modules to the satellite management module 1.

[0042] The logic program control instruction sequence at least includes a logic program control instruction and a task instruction.

[0043] The satellite management module 1 is configured to be capable of judging the working state data through the logic program control instruction, and executing the task instruction based on the judgment result obtained by the logic program control instruction, so as to ensure the safety of the satellite when the task instruction is executed.

[0044] Preferably, the satellite management module 1 is capable of acquiring the working state data sent by the other modules.

[0045] Preferably, the logic program control instruction sequence at least includes an execution time and a logic program control instruction and / or a task instruction of the satellite corresponding to the execution time.

[0046] Preferably, the task instruction is at least capable of controlling other modules to perform a specific task. Preferably, the task instruction further comprises an exception handling instruction for performing corresponding exception handling.

[0047] Preferably, the working state data at least comprises attitude and orbit state data, attitude and orbit single machine state data, power supply and distribution state data, payload state data, heater and temperature state data. Preferably, the working state data can further comprise new working state data according to actual scene requirements.

[0048] Preferably, the logic program control instruction sequence comprises a task instruction of the satellite corresponding to the execution time and the logic program control instruction corresponding to the execution time.

[0049] Preferably, the logic program control instruction sequence is loaded, parsed and executed by a satellite management module 1 in an OBC (on-board computer).

[0050] Preferably, the satellite management module 1 and the attitude and orbit control module 2 can be respectively arranged in or integrated in the on-board computer.

[0051] Through the configuration mode, the matching judgment of the fault mode and the execution of the autonomous safety handling are all performed using the logic program control instruction; the software code realizes the general logic program control instruction, the logic program control instruction is not directly related to the specific fault matching judgment, and the logic program control instruction itself is part of the instruction sequence, and no software code needs to be coded for specific fault mode matching. The present application adopts the logic program control instruction for judgment, can use the instruction sequence to independently judge and handle each fault, and is sufficiently detailed.

[0052] According to one preferred embodiment, the logic program control instruction at least comprises a conditional judgment instruction. The conditional judgment instruction is at least capable of judging the working state data and outputting a judgment result.

[0053] According to one preferred embodiment, the logic program control instruction further comprises one or more of a conditional jump instruction, a loop execution instruction, and a call execution instruction. The conditional jump instruction can jump a number of program control instructions specified by the conditional jump instruction according to the judgment result of the conditional judgment instruction and then continue to execute. The loop execution instruction is used to loop the subsequent program control instructions of the logic program control instruction sequence. The call execution instruction is used to call and execute other instruction sequences to be called.

[0054] Preferably, the conditional jump instruction only comprises one parameter, i.e. the number of instructions to be jumped.

[0055] Particularly preferably, the conditional judgment instruction can be flexibly combined with the logic instructions such as the conditional jump instruction, the loop execution instruction, and the call execution instruction, to realize more complex and flexible exception condition judgment and handling.

[0056] According to a preferred embodiment, the logic program control instruction is composed of an instruction code and an instruction parameter. The instruction code is used to uniquely identify a logic program control instruction. The instruction parameter of the conditional judgment instruction includes a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type.

[0057] The analysis and execution flow of the conditional judgment instruction is as follows: the judgment data source ID is obtained from the conditional judgment instruction to determine the data source; the data corresponding to the judgment data number is obtained from the data source; the judgment mode word is obtained from the conditional judgment instruction, and whether the logical relationship between the data and the threshold value is established is determined according to the judgment mode, and the judgment result is temporarily stored as the input of the subsequent conditional jump instruction and / or loop execution instruction.

[0058] Preferably, the logic program control instruction is composed of an instruction code and an instruction parameter.

[0059] Preferably, the instruction code is used in the logic program control instruction sequence to uniquely identify a program control instruction. For example, the instruction code of the logic program control instruction can be composed of numbers and / or characters. For example, the instruction code identifying the conditional judgment instruction can be "0100C001"; the instruction code identifying the conditional jump instruction can be "0100C002"; the instruction code identifying the loop execution instruction can be "0100C003"; and the instruction code identifying the call execution instruction can be "0100C004". For another example, the instruction code and the instruction parameter of the conditional judgment instruction for judging whether the star sensing current (such as the current of the 0x1D loop of the power management device) is less than the judgment threshold value (such as the judgment threshold value is 200 mA) are 0100C001 and 03 90 021D 00C8 00, respectively.

[0060] The star management module 1 can temporarily store the judgment result (for example, true or false) of the conditional judgment instruction based on the working state data in the condition variable as the input condition of the subsequent other logic program control instructions (such as the conditional jump instruction and the loop execution instruction). The other logic program control instructions are relatively independent, and the logic program control instructions are finally organized in the form of instruction sequence to form the execution logic relationship.

[0061] Preferably, the logic program control instruction sequence is composed of an execution time and the logic program control instruction and / or the task instruction of the satellite corresponding to the execution time.

[0062] Preferably, a logic program control instruction sequence includes at least one execution time and the logic program control instruction and / or the task instruction of the satellite corresponding to the execution time.

[0063] Preferably, a logic program control instruction sequence can include multiple execution times and the logic program control instruction and / or the task instruction of the satellite corresponding to the execution time. Preferably, the above-mentioned execution time is a relative time, which is in seconds.

[0064] Preferably, the parameter data of the conditional judgment instruction includes a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type.

[0065] Preferably, the judgment mode word defines the mode of the judgment data. For example, one preferred embodiment of the judgment mode word is shown in FIG. 5. Preferably, the judgment mode word can also adopt other judgment modes according to actual needs. Figure 2

[0066] Preferably, the judgment data source ID is used to identify the source of the judgment data. Preferably, the data to be identified can come from an OBC (on-board computer), a single machine component (for example, from an attitude and orbit control single machine module 3, such as a star sensor, a flywheel, etc.), a payload (for example, from a payload module 5), etc. For example, one preferred embodiment of the judgment data source ID is shown in FIG. 6. Preferably, the judgment data source ID can be flexibly added / removed according to actual needs. Through this configuration mode, the conditional judgment instruction of the present application abstracts the data source of the working state data, so as to not be linked with specific telemetry words, i.e., the data source of the working state data is abstracted as temperature, power supply, working state, etc. abstracted state conditions; at the same time, the conditional judgment instruction implemented by the method of the present application can be flexibly matched with conditional jump instructions, loop execution instructions, call execution, etc. logic program control instructions to realize more complex and flexible abnormal condition judgment and processing. In addition, the method of the present application uses a single instruction sequence to process exceptions, so as to modify specific exception processing, and only a single instruction sequence file needs to be uploaded. Figure 3

[0067] Preferably, the judgment data number is used to distinguish the data category to be identified. Preferably, the data category includes but is not limited to voltage, current, temperature, power distribution state, working state, etc. For example, one preferred embodiment of the judgment data number is shown in FIG. 7. Figure 4

[0068] Preferably, the judgment data number can be defined by itself according to actual needs.

[0069] Preferably, the judgment threshold is a data or condition filled in the instruction in advance. Preferably, the judgment threshold can also be any data type in the threshold type definition. For example, the current threshold is 200 mA. Preferably, the threshold type is the type of the judgment threshold data. For example, the type code "0" can represent that the threshold type is an integer data; the type code "1" can represent that the threshold type is a floating point data; and the type code "2" can represent that the threshold type is "BOOL condition: 0x55 is true, 0x00 is false".

[0070] ​​​Preferably, the sequence of logic program instructions can be saved as a binary file. Preferably, the sequence of logic program instructions is loaded and executed by the OBC (on-board computer). For example, Figure 5 The binary file of the sequence of logic program instructions in Figure 5 is as follows: 00 00 00 01 01 00 C0 01 03 90 02 1D 00 C8 00 00 00 00 02 01 00 C0 02 00 01 00 00 00 03 00 00 00 02 0a 00 Preferably, the logic program instructions can adopt other different data structures to achieve the same or similar functions as described above and are self-managed by the sequence of instructions.

[0071] Based on the present solution, the use of the logic program instructions can be further extended to implement more logic program instructions and to organize the sequence of task instructions to achieve autonomous safety of the task.

[0072] According to a preferred embodiment, the instruction parameter of the conditional jump instruction includes the number of instructions to be jumped.

[0073] The execution process of the conditional jump instruction is as follows: obtaining the output result of the conditional judgment instruction corresponding to the conditional jump instruction; if the output result is true, the subsequent program instructions are executed; if the output result is false, the program instructions corresponding to the number of instructions to be jumped specified in the conditional jump instruction are jumped and then the subsequent program instructions are executed.

[0074] Preferably, the conditional jump instruction includes only one parameter, i.e., the number of instructions to be jumped. Preferably, the specified number in the conditional jump instruction can be flexibly set according to the actual application scenario. Preferably, the conditional judgment instruction can be flexibly combined with the conditional jump instruction and / or the loop execution instruction to judge the execution condition of the sequence of task logic program instructions. If the satellite state / condition corresponding to the working state data does not meet the condition for executing the task instructions, the sequence of instructions is skipped and is not executed to ensure the safety of the satellite. For example, to ensure the safety of the satellite energy, the voltage state of the corresponding components of the satellite can be judged by the conditional judgment instruction before the sequence of task logic program instructions is executed. When the voltage is lower than the safety threshold (i.e., the judgment threshold), the instructions of the sequence of task logic program instructions are skipped, and when the voltage is higher than the safety threshold, the sequence of instructions is executed normally.

[0075] According to a preferred embodiment, the instruction parameter of the loop execution instruction includes a loop condition, a maximum number of loops, and a number of program instructions to be executed in a loop. The loop condition is to execute the loop according to the number of executions or to execute the loop according to the output result of the conditional judgment instruction.

[0076] The execution process of the loop execution instruction is as follows: obtaining a loop condition and a maximum loop number; judging whether the maximum loop number or the loop condition is reached; if the maximum loop number or the loop condition is not reached, the sequence of the logic program control instruction is executed in a loop until the maximum loop number or the loop condition is reached; and if the maximum loop number or the loop condition is reached, the sequence of the logic program control instruction is stopped from being executed in a loop.

[0077] Preferably, the loop condition is defined as a condition for loop execution, which is looped by execution times or looped by a condition judgment instruction. Preferably, the looped by execution times means that the sequence of the logic program control instruction is continuously executed in a loop as long as the number of times of the loop execution of the sequence of the logic program control instruction does not reach the maximum loop number. Preferably, the looped by the condition judgment instruction means that the sequence of the logic program control instruction is continuously executed in a loop only when the judgment result of the condition judgment instruction is true, and the loop is exited when the judgment result is false. Preferably, the maximum loop number is a value that the number of times of the loop execution of the sequence of the instructions cannot exceed, that is, the loop is stopped when the number of times of the loop execution exceeds the maximum loop number. Preferably, the number of the sequence of the logic program control instruction that is executed in a loop is the number of the sequence of the logic program control instruction that needs to be executed in a loop.

[0078] According to a preferred embodiment, the instruction parameter of the calling execution instruction includes a task instruction name that needs to be called and executed.

[0079] The execution process of the calling execution instruction is as follows: searching for an instruction sequence file that needs to be called and executed according to the task instruction name that needs to be called and executed; judging whether there is a sub-instruction sequence that needs to be called; if there is a sub-instruction sequence that needs to be called, executing the sub-instruction sequence, and then continuing to execute the main instruction sequence after the sub-instruction sequence is executed; and if there is no sub-instruction sequence that needs to be called, directly continuing to execute the main instruction sequence.

[0080] Preferably, the task instruction that needs to be called and executed can include the main instruction sequence and the sub-instruction sequence. Preferably, the task instruction that needs to be called and executed can also include an exception handling instruction sequence. For example, an exception 1 handling instruction sequence, an exception 2 handling instruction sequence, and an exception n handling instruction sequence. Preferably, the task instruction that needs to be called and executed can be flexibly selected according to actual scene requirements.

[0081] Through the configuration mode, the calling execution instruction is used to call and execute another instruction sequence in the process of the instruction sequence. When used, an instruction sequence with certain functions can be made into a sub-sequence, and the calling execution instruction is used to call and execute the sub-instruction sequence.

[0082] Preferably, the calling execution instruction is used to call and execute another instruction sequence in the process of the sequence of the logic program control instruction.

[0083] According to a preferred embodiment, the other modules at least include an attitude and orbit control module 2. The attitude and orbit control module 2 is configured to be able to control / monitor the attitude and orbit of the satellite, and at least send the attitude and orbit state data of the satellite to the satellite management module 1.

[0084] Preferably, the attitude and orbit state data mainly includes the attitude and orbit state data of the satellite.

[0085] According to a preferred embodiment, the other modules further include an attitude and orbit control unit module 3, a power supply module 4, a payload module 5 and a thermal control module 6. The attitude and orbit control unit module 3 is configured to be able to send the attitude and orbit control unit state data of the attitude and orbit control unit to the satellite management module 1. The power supply module 4 is configured to be able to provide the power supply and distribution state data of the satellite to the satellite management module 1. The payload module 5 is configured to be able to send the payload state data of the payload unit to the satellite management module 1. The thermal control module 6 is configured to be able to send the heater and temperature state data to the satellite management module 1.

[0086] Preferably, the power supply and distribution state data at least includes the voltage and current of the power supply management module, and the power supply and distribution state data of the power distribution module.

[0087] Preferably, the payload state data can be the payload state of the corresponding payload unit.

[0088] Preferably, the working state data at least includes the attitude and orbit state data, the attitude and orbit control unit state data, the power supply and distribution state data, the payload state data, and the heater and temperature state data. Preferably, the working state data can also increase new data types according to actual scene requirements.

[0089] Preferably, the heater and temperature state data at least includes the working state of the heater and the temperature data of each temperature collection point.

[0090] Preferably, the attitude and orbit control unit module 3 includes a plurality of attitude and orbit control units.

[0091] Preferably, the attitude and orbit control unit module 3 includes but is not limited to star sensors, flywheels, magnetometers, magnetic torque devices, electric thrusters, too sensitive, gyroscopes, GPS, thrusters, etc.

[0092] Preferably, the power supply module 4 includes a power supply management sub-module and a power distribution sub-module.

[0093] The application also provides a satellite autonomous safety implementation method based on a logic program control instruction. The satellite autonomous safety implementation method comprises: The satellite management module 1 loads, analyzes and executes the logic program control instruction sequence, and the logic program control instruction sequence at least includes a logic program control instruction and a task instruction; The other modules send the working state data of the other modules to the satellite management module 1; The star management module 1 judges the working state data through the logical program control instruction, and executes the task instruction based on the judgment result obtained by the logical program control instruction, to ensure the safety of the satellite when the task instruction is executed.

[0094] Through this configuration mode, the task execution condition of the task instruction can be judged in advance through the logical program control instruction during the execution of the task instruction sequence: if the star management module 1 judges that the task execution condition of the task instruction meets through loading and analyzing the condition judgment instruction, the task instruction sequence is called for execution; if the star management module 1 judges that the task execution condition of the task instruction does not meet, the exit task instruction sequence is executed to realize the safe exit of the task, so that the autonomous safety during the execution of the task instruction sequence is realized through the logical program control instruction.

[0095] Preferably, the logical program control instruction sequence can include multiple logical program control instructions to judge and / or execute multiple task execution conditions in a sequential execution manner. For example, a logical program control instruction realizes that the task instruction sequentially judges task execution condition 1, task execution condition 2 to task execution condition n through the same or different condition judgment instructions in a sequential execution manner, to judge whether the above task execution conditions meet. Only when the same or different condition judgment instruction moves to the next task execution condition to logically judge the next task execution condition, the same or different condition judgment instruction moves to the next task execution condition to logically judge the next task execution condition. Only when the judgment results of all task execution conditions are "true", the star management module 1 calls for execution of the task instruction sequence; otherwise, as soon as the logical judgment result of the same or different condition judgment instruction for any one of the task execution conditions is "false" or "no", the star management module 1 directly exits the judgment of the task execution condition and calls for execution of the exit task instruction sequence.

[0096] Preferably, the logical program control instruction sequence can include multiple logical program control instructions to judge and / or execute multiple task execution conditions or abnormal trigger conditions in a parallel loop execution manner. Preferably, each parallel loop execution logical program control instruction can be flexibly configured according to actual needs. Through this configuration mode, the logical program control instruction sequence can include multiple logical program control instructions to judge and / or execute multiple task execution conditions or abnormal trigger conditions in a parallel loop execution manner, to judge the satellite abnormal trigger condition through the use of the logical program control instruction loop, that is, the abnormal trigger condition is established to call for execution of the abnormal processing instruction sequence to process the abnormality.

[0097] Through the configuration mode, the autonomous safety management can also be organized into multiple small cycle instruction sequences for parallel execution, so that the delay caused by sequential processing can be avoided. In addition, the logical program control instruction executed by each parallel cycle can be flexibly configured according to actual needs, instead of being implemented in a fixed program or instruction sequence. For example, the logical program control instruction sequence implements the process of satellite autonomous safety maintenance, which can include multiple logical program control instructions to respectively loop through condition judgment instruction 1, condition judgment instruction 2 to condition judgment instruction n to loop to judge whether abnormality 1, abnormality 2 to abnormality n is generated: during the loop execution of each condition judgment instruction (for example, condition judgment instruction 1 / condition judgment instruction 2 / condition judgment instruction n), only when the judgment result of the condition judgment instruction is "true", the satellite management module 1 respectively calls the abnormality processing instruction sequence corresponding to the abnormality (for example, the abnormality 1 processing instruction sequence corresponding to abnormality 1); if the judgment result of the condition judgment instruction is "false", the loop execution process of the condition judgment instruction corresponding to the abnormality is started from the beginning. After the satellite management module 1 calls and executes the abnormality processing instruction sequence corresponding to the abnormality, the satellite management module 1 needs to judge whether the abnormality processing instruction sequence corresponding to the abnormality needs to be prohibited, if it needs to be prohibited (i.e. the above judgment result is "yes"), the abnormality processing instruction sequence corresponding to the abnormality is ended, otherwise, the loop execution process of the condition judgment instruction corresponding to the abnormality is started from the beginning.

[0098] For another example, Figure 5 A preferred embodiment of a logical program control instruction sequence is shown to implement the function of judging whether the star sensor current is out of limit, and turning off the star sensor power supply if it is out of limit.

[0099] Preferably, the satellite management module 1 of the OBC uses a logical program control instruction sequence to organize the abnormality processing into small cycles. For example, the logical program control instruction is used to loop to judge the satellite abnormality trigger condition, and the abnormality processing instruction sequence is called to execute the abnormality processing when the abnormality trigger condition is established. Multiple abnormality judgments can be performed in parallel, and the abnormality processing is performed in a small instruction sequence cycle, so that the fixed program implementation is no longer needed.

[0100] For another example, Figure 6 is a flowchart of another preferred embodiment of the logical program control instruction sequence provided by the present application, which takes the processing of star sensor 1 as an example to process the abnormality such as the current out of limit of star sensor 1 and communication failure. As shown in Figure 6As shown, the function implemented by the logic program control instruction sequence is to determine whether the current of star sensor 1 is over limit, if yes, execute the instruction of powering off star sensor, otherwise, skip (do not execute the instruction of powering off star sensor); continue to determine whether the continuous communication error count of star sensor 1 working state is more than 5, if yes, call the instruction sequence of'star.bin' for processing, after executing the 7th instruction, execute the count minus 1 and continue to return to the first instruction for execution; thus, an abnormal processing for star sensor is organized into a cyclically executed instruction sequence. Since the logic program control instruction is designed and implemented in advance and has universality, thus, for autonomous and safe processing, it is not necessary to code separately, only to organize the instruction sequence similar to the above, the on-board computer executes according to the instruction code and data; the above instruction sequence can be dynamically adjusted, which means that the instruction sequence content can be adjusted according to the actual on-orbit situation, after adjustment, the on-orbit instruction sequence file can be updated, without modifying the software code; for example, the instruction sequence of the above star sensor 1 abnormal processing, it is found that the normal working current of star sensor 1 is greater than 200mA in actual on-orbit situation, it is determined that the star sensor current over limit value is adjusted to 300mA, at this time, only the parameter of instruction 2 of the instruction sequence needs to be adjusted.

[0101] It should be noted that the above specific embodiments are exemplary, and those skilled in the art can think of various solutions under the inspiration of the disclosure of the present application, and these solutions also belong to the disclosed range of the present application and fall within the protection scope of the present application. Those skilled in the art should understand that the present application specification and its drawings are illustrative and not constitute a limitation on the claims. The protection scope of the present application is defined by the claims and its equivalents. The present application specification contains multiple inventive concepts, such as "preferably", "according to a preferred embodiment" or "optionally", which all indicate that the corresponding paragraph discloses an independent concept, and the applicant reserves the right to file a divisional application according to each inventive concept. Throughout the text, the features introduced by "preferably" are only optional ways, and should not be understood as necessarily set, therefore, the applicant reserves the right to abandon or delete the relevant preferred features at any time.

Claims

1. A satellite-borne computer based on logic program instructions, comprising a satellite management module (1) and an attitude and orbit control module (2), characterized in that, the satellite management module (1) is capable of loading, parsing and executing a sequence of logic program instructions, the satellite management module (1) is configured to be capable of judging working state data through the logic program instructions, and executing task instructions based on the judgment result obtained by the logic program instructions to ensure the safety of the satellite when executing the task instructions, the logic program instructions include conditional judgment instructions, which can be flexibly used with one or more of conditional jump instructions, loop execution instructions, and call execution instructions; the logic program instructions are finally organized in the form of an instruction sequence to form an execution logic relationship; the attitude and orbit control module (2) is configured to control / monitor the attitude and orbit of the satellite, and at least send the attitude and orbit state data of the satellite to the satellite management module (1).

2. The space-borne computer of claim 1, wherein, The instruction parameters of the conditional judgment instructions include a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type.

3. The spaceborne computer of claim 1 or 2, wherein, The conditional jump instruction can jump a specified number of program instructions according to the judgment result of the conditional judgment instruction and then continue to execute; the loop execution instruction is used to loop execute subsequent program instructions of the logic program instruction sequence, the call execution instruction is used to call and execute other instruction sequences to be called.

4. The spaceborne computer of any one of claims 1 to 3, wherein, The logic program instruction is composed of an instruction code and an instruction parameter, and the instruction code is used to uniquely identify a logic program instruction.

5. The spaceborne computer of any one of claims 1 to 4, wherein, The parsing and execution process of the conditional judgment instruction is as follows: obtain the judgment data source ID from the conditional judgment instruction to judge the data source; obtain the data corresponding to the judgment data number from the data source; obtain the judgment mode word from the conditional judgment instruction, and judge whether the logical relationship between the data and the threshold is established according to the judgment mode, and temporarily store the judgment result as the input of the subsequent conditional jump instruction and / or loop execution instruction. 6.The satellite-borne computer according to any one of claims 1 to 5, characterized in that, the instruction parameters of the conditional jump instruction include the number of instructions to be jumped, wherein the execution process of the conditional jump instruction is as follows: obtain the output result of the conditional judgment instruction corresponding to the conditional jump instruction; if the output result is true, continue to execute the subsequent program instructions; if the output result is false, jump the specified number of program instructions in the conditional jump instruction and then continue to execute the subsequent program instructions.

7. The spaceborne computer of any one of claims 1 to 6, wherein, wherein, the execution process of the loop execution instruction is as follows: obtain the loop condition and the maximum number of loops; judge whether the maximum number of loops or the loop condition is met; if the maximum number of loops or the loop condition is not met, loop execute the logic program instruction sequence until the maximum number of loops or the loop condition is met; if the maximum number of loops or the loop condition is met, stop looping the logic program instruction sequence.

8. The spaceborne computer of any one of claims 1 to 7, wherein, The execution process of the calling execution instruction is: According to the task instruction name to be called for execution, the instruction sequence file to be called for execution is found; It is judged whether there is a sub-instruction sequence to be called; If there is a sub-instruction sequence to be called, the sub-instruction sequence is executed, and after the sub-instruction sequence is executed, the main instruction sequence is continued to be executed; If there is no sub-instruction sequence to be called, the main instruction sequence is directly continued to be executed.

9. The spaceborne computer of any one of claims 1 to 8, wherein, The on-board computer further comprises an attitude and orbit control single-machine module (3), a power supply module (4), a load module (5) and a thermal control module (6), The attitude and orbit control single-machine module (3) is configured to be capable of sending attitude and orbit single-machine state data of the attitude and orbit control single-machine module (3) to the satellite management module (1), The power supply module (4) is configured to be capable of providing power supply and power distribution state data of the satellite to the satellite management module (1), The load module (5) is configured to be capable of sending load state data of a load single-machine to the satellite management module (1), The thermal control module (6) is configured to be capable of sending heater and temperature state data to the satellite management module (1).

10. A method for satellite management of a satellite-borne computer based on logic program control instructions, characterized by The method comprises: The satellite management module (1) is capable of loading, analyzing and executing a logical program control instruction sequence, the satellite management module (1) is configured to be capable of judging working state data through the logical program control instruction, and executing the task instruction based on the judgment result obtained by the logical program control instruction, so as to ensure the safety of the satellite when the task instruction is executed, The logical program control instruction comprises a condition judgment instruction, the condition judgment instruction can be flexibly used with one or more of a condition jump instruction, a loop execution instruction and a calling execution instruction; the logical program control instruction is finally organized in the form of an instruction sequence to form an execution logic relationship; The attitude and orbit control module (2) is configured to be capable of controlling / monitoring the attitude and orbit of the satellite, and at least capable of sending attitude and orbit state data of the satellite to the satellite management module (1).

Images