Spacecraft anti-single particle risk system

Abstract

The invention discloses an anti-single particle risk system for a spacecraft, and the system is characterized in that a filtering module is connected to a power module, and is used for filtering noises and peaks with different frequencies in the power module; and the latch-up effect caused by the influence of transient voltage fluctuation on the CMOS in the chip is prevented. The signal limiting module is connected to the signal line and used for limiting the trigger current of the signal. And latch-up caused by CMOS well current abrupt change in the chip due to large current generated by the single event effect is prevented. And the level conversion module is connected to the high-sensitivity device and is used for ensuring the stability and the reliability of the power supply. And the surge protection module is connected to the power loop and is used for absorbing transient voltage, so that overvoltage protection is realized, and false triggering or latching of a subsequent circuit is prevented. And all power supply lines adopt a double-point double-line design, so that single-point failure caused by breakdown of a certain power distribution switch by a single particle is prevented. The control unit adopts a hot and cold dual redundancy measure of a host and a standby, and the management power supply module carries out hot backup, so that the normal work of the management power supply module is ensured.

Description

Technical Field

[0001] This invention belongs to the aerospace field, and in particular relates to a spacecraft anti-single-event risk system. Background Technology

[0002] The single-event effect refers to the instantaneous or permanent circuit failure caused when a high-energy charged particle (such as a cosmic ray) bombards an integrated circuit (IC).

[0003] Single-event effects in space may lead to: 1. Bit Flip: A bit flip occurs in the satellite's storage unit, causing data errors in the satellite's memory.

[0004] 2. Transient pulse: Voltage spikes caused by single-event effects appear in the satellite logic circuit, leading to logic errors in the satellite processor and abnormal instruction execution.

[0005] 3. Latch-up Effect: The latch-up effect refers to the phenomenon where the PN junction structure in a CMOS sensor changes due to external influences, causing a low-resistance path to form between the source (VSS) and drain (VDD), resulting in a large current. In the space environment, due to occasional radiation interference, high-energy particles ionize and generate charge carriers, which can easily cause changes in the PN junction structure of the CMOS in the circuit, resulting in unintended current flow between VDD and VSS, causing a latch-up effect. Latch-up can lead to abnormal or uncontrolled power supply lines for satellite payloads. In severe cases, it can cause the power supply module to burn out.

[0006] 4. Device breakdown: High-energy particles break down the physical structure of the device, causing short circuits or leakage, resulting in permanent device failure. Summary of the Invention

[0007] The technical objective of this invention is to provide a spacecraft anti-single-event risk system to solve the single-event effect problem in existing spacecraft.

[0008] To solve the above problems, the technical solution of the present invention is as follows: A spacecraft single-event risk mitigation system includes: Internal circuit components, including filtering modules, signal limiting modules, level conversion modules, and surge protection modules; The filtering module is connected to the power module of the internal circuit components and is configured to filter noise and spikes of different frequencies that appear in the power module. The signal limiting module is connected to the signal line of the internal circuit components and is configured to limit the trigger current of the signal; The level conversion module is connected to the highly sensitive components of the internal circuitry and is configured to ensure the stability and reliability of the power supply. The surge protection module is connected to the power loop of the internal circuit components and is configured to absorb transient voltages, thus achieving overvoltage protection.

[0009] The filtering module includes three sets of capacitor banks connected in parallel. Each capacitor bank has two capacitors of equal capacitance connected in series. One end of any set of capacitor banks is connected to the power supply circuit, and the other end is grounded.

[0010] Specifically, the filter module includes a pair of capacitors with a capacitance of 47uF, a pair of capacitors with a capacitance of 2.2uF, and a pair of capacitors with a capacitance of 0.22uF.

[0011] The signal limiting module includes several groups of signal limiting units connected in parallel. Each signal limiting unit includes a resistor connected in series with the corresponding input pin and a capacitor connected in parallel with the resistor. The capacitors in each signal limiting unit are connected in parallel with each other.

[0012] The level conversion module includes a level converter and a coupling unit consisting of two capacitors connected in series. One end of the coupling unit is connected to the output pin of the level converter, and the other end is grounded.

[0013] The surge protection module includes a TVS diode and a decoupling capacitor connected in parallel; the negative terminal of the TVS diode and one end of the decoupling capacitor are connected to the power circuit, and the positive terminal of the TVS diode and the other end of the decoupling capacitor are grounded.

[0014] More preferably, it also includes a structural module, the outer surface of which is covered with a multi-layer coating component, the multi-layer coating component being made of polyimide and aluminum.

[0015] Among them, the control unit in the internal circuit components uses radiation-resistant MCU devices, and the power management chip for managing the power module uses a highly integrated chip.

[0016] The internal circuit components employ a dual-point, dual-line design for all power supply lines, and a dual-redundancy design (hot and cold) for the main control module and power supply module.

[0017] The internal circuit components employ a CRC algorithm to transmit signals and achieve data transmission.

[0018] Because the present invention adopts the above technical solution, it has the following advantages and positive effects compared with the prior art: This invention combats single-event effects (SEE) by incorporating a filtering module, a signal limiting module, a level conversion module, and a surge protection module. The filtering module filters noise and spikes of different frequencies, preventing transient voltage fluctuations from affecting the internal CMOS and causing latch-up. The signal limiting module limits the trigger current of signals, preventing large current surges from SEE that could cause latch-up due to sudden changes in the CMOS well current. The level conversion module ensures power supply stability and reliability while also isolating the primary and secondary power supplies to a certain extent. The surge protection module quickly clamps the voltage, preventing subsequent circuits from being falsely triggered or latching up.

[0019] All power supply lines employ a dual-point, dual-wire design to prevent single-point failure caused by a single-particle breakdown of a distribution switch. For control units, a dual redundancy system (both primary and backup, hot and cold) is implemented, and the management power module is hot-backed up to ensure its normal operation. Attached Figure Description

[0020] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0021] Figure 1 This is a circuit diagram of the filtering module of the present invention; Figure 2 This is a circuit diagram of the signal limiting module of the present invention; Figure 3 This is a circuit diagram of the level conversion module of the present invention; Figure 4 This is a circuit diagram of the surge protection module of the present invention. Detailed Implementation

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the specific implementation methods of the present invention will be described below with reference to the accompanying drawings. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without any creative effort.

[0023] To keep the drawings concise, only the parts relevant to the invention are shown schematically in each figure, and they do not represent the actual structure of the product. Furthermore, for ease of understanding, in some figures, only one of components with the same structure or function is shown schematically, or only one is labeled. In this document, "one" can mean not only "only one" but also "more than one".

[0024] The present invention provides a spacecraft anti-single-event risk system in further detail below with reference to the accompanying drawings and specific embodiments. The advantages and features of the invention will become clearer from the following description and claims.

[0025] Example See Figures 1 to 4 This embodiment provides a spacecraft anti-single-event risk system, which includes internal circuit components inside the spacecraft and structural modules outside the spacecraft.

[0026] This structural module includes the spacecraft's celestial structure. In this implementation, a multi-layered cladding assembly made of polyimide, aluminum, and other materials is used to clad the satellite's outer surface. This multi-layered cladding assembly not only isolates thermal radiation but also blocks most rays and high-energy particles from the outside of the celestial body, effectively isolating it from radiation and high-energy particles in the space environment and protecting the spacecraft's internal circuit components. Furthermore, the specific selection of components in the internal circuit components is as follows: the control unit uses radiation-resistant MCU devices, the power management chip for the power management module uses a highly integrated chip, and other basic components whose processes meet aerospace-grade requirements. All selected key electronic components are guaranteed to meet the first-level derating standard, meaning the rated parameters of the components must be more than twice the actual usage. This ensures that even if a single-event event causes voltage spikes in the circuit, the rated values ​​of the electronic components will not be exceeded, preventing component breakdown or burnout.

[0027] The internal circuit components include a filtering module, a signal limiting module, a level conversion module, and a surge protection module.

[0028] Among them, see Figure 1 The filtering module is connected to the power supply module of the internal circuit components to filter noise and spikes of different frequencies appearing in the power supply module. To suppress fluctuations in the power supply module caused by external high-energy particles, a filtering module is placed near its pins. This filtering module includes three sets of capacitors connected in parallel. Each capacitor set has two capacitors of equal capacitance connected in series: a pair of 47uF capacitors, a pair of 2.2uF capacitors, and a pair of 0.22uF capacitors. One end of any set of capacitors is connected to the power supply circuit, and the other end is grounded. By setting up the filtering module, noise and spikes of different frequencies that may appear on the power supply module can be filtered, preventing transient voltage fluctuations from affecting the CMOS inside the chip and causing latch-up. At the same time, the series connection of capacitors of the same type improves circuit reliability and prevents power supply short circuits caused by high-energy particles breaking down capacitors.

[0029] Among them, see Figure 2The signal limiting module is connected to the signal lines of internal circuit components, especially those susceptible to interference, to limit the trigger current of signals. Specifically, the signal limiting module includes several groups of signal limiting units connected in parallel. Each signal limiting unit includes a resistor (1K ohm) connected in series with the corresponding input pin, and a capacitor connected in parallel with the resistor. The capacitors in each signal limiting unit are connected in parallel with each other. The signal limiting module can limit the trigger current of signals, preventing latch-up caused by large current surges in the CMOS well current due to single-event effects, and can also reduce disturbances on signal lines, avoiding logic errors in the processor caused by signal interference from single-event effects.

[0030] Among them, see Figure 3 The level conversion module is connected to a highly sensitive component within the internal circuitry. The module includes a level converter and a coupling unit consisting of two capacitors connected in series. One end of the coupling unit is connected to the output pin of the level converter, while the other end is grounded. The level conversion module ensures the stability and reliability of the flowing current and also allows for a degree of separation between the primary and secondary power supplies.

[0031] Among them, see Figure 4 The surge protection module is connected to the power loop of the internal circuit components. The module includes a TVS diode and a decoupling capacitor connected in parallel. The negative terminal of the TVS diode and one end of the decoupling capacitor are connected to the power loop, while the positive terminal of the TVS diode and the other end of the decoupling capacitor are grounded. The TVS diode is used for voltage clamping; its rapid response quickly clamps the voltage, preventing subsequent circuits from being falsely triggered or latched up. Furthermore, through measures such as the TVS diode, level shifter, decoupling capacitor, and series resistor, a complete anti-single-event effect link is constructed within the internal circuit components: the TVS diode absorbs transient high voltage, the capacitor filters, the level shifter maintains voltage stability, and the resistor limits current.

[0032] Furthermore, this embodiment employs redundant design in several aspects, including: a dual-point, dual-wire design for all power supply lines in the internal circuit components to prevent single-point failure caused by a single-event event damaging a power distribution switch; dual redundancy (hot and cold) for the main control module in the internal circuit components, with hot backup for the power module, meaning two independently operating power management systems exist within the spacecraft. During normal spacecraft operation, both systems operate simultaneously, receiving and sending commands respectively. Even if one system malfunctions due to a single-event event, the other system can still function normally. Additionally, a cold backup is implemented for the satellite management system, with two non-simultaneous operating systems designed within the spacecraft. The backup system is only switched on when the primary system malfunctions. Because the backup system is a cold backup, data or functional failures in the primary system due to a single-event event, or bit flips in the storage area, will not affect the backup system's data, ensuring that the impact of single-event events on the system is minimized during the entire satellite's on-orbit operation. Furthermore, the internal circuit components employ an ECC error correction mechanism during signal transmission, which uses CRC for data transmission. Each instruction is verified during transmission. If the satellite computer detects an erroneous instruction, it will refuse to execute the instruction and return an error count and error message to the ground control center, allowing ground personnel to promptly identify the problem. This minimizes the impact of bit flips caused by single-event effects on the satellite system.

[0033] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings, but the present invention is not limited to the above embodiments. Even if various changes are made to the present invention, if these changes fall within the scope of the claims of the present invention and their equivalents, they shall still fall within the protection scope of the present invention.

Claims

1. A spacecraft anti-single-event risk system, characterized in that, include: Internal circuit components, including a filtering module, a signal limiting module, a level conversion module, and a surge protection module; The filtering module is connected to the power module of the internal circuit assembly and is configured to filter noise and spikes of different frequencies that appear in the power module. The signal limiting module is connected to the signal line of the internal circuit component and is configured to limit the trigger current of the signal; The level conversion module is connected to the highly sensitive device of the internal circuit assembly and is configured to ensure the stability and reliability of the power supply. The surge protection module is connected to the power loop of the internal circuit assembly and is configured to absorb transient voltages, thus achieving overvoltage protection.

2. The spacecraft anti-single-event risk system according to claim 1, characterized in that, The filtering module includes three sets of capacitor banks arranged in parallel, and each set of capacitor banks has two capacitors of equal capacitance connected in series; one end of any set of capacitor banks is connected to the power supply circuit, and the other end is grounded.

3. The spacecraft anti-single-event risk system according to claim 2, characterized in that, The capacitor bank consists of a pair of capacitors with a capacitance of 47uF, a pair of capacitors with a capacitance of 2.2uF, and a pair of capacitors with a capacitance of 0.22uF.

4. The spacecraft anti-single-event risk system according to claim 1, characterized in that, The signal limiting module includes several groups of signal limiting units connected in parallel. Each signal limiting unit includes a resistor connected in series with the corresponding input pin and a capacitor connected in parallel with the resistor. The capacitors in each signal limiting unit are connected in parallel with each other.

5. The spacecraft anti-single-event risk system according to claim 1, characterized in that, The level conversion module includes a level converter and a coupling unit consisting of two capacitors connected in series; one end of the coupling unit is connected to the output pin of the level converter, and the other end is grounded.

6. The spacecraft anti-single-event risk system according to claim 1, characterized in that, The surge protection module includes a TVS diode and a decoupling capacitor connected in parallel; the negative terminal of the TVS diode and one end of the decoupling capacitor are connected to the power circuit, and the positive terminal of the TVS diode and the other end of the decoupling capacitor are grounded.

7. The spacecraft anti-single-event risk system according to claim 1, characterized in that, It also includes a structural module, the outer surface of which is covered with a multi-layer coating component, the multi-layer coating component being made of polyimide and aluminum.

8. The spacecraft anti-single-event risk system according to claim 1, characterized in that, The control unit in the internal circuit assembly is a radiation-resistant MCU device, and the power management chip that manages the power module is a highly integrated chip.

9. The spacecraft anti-single-event risk system according to claim 1, characterized in that, All power supply lines in the internal circuit components adopt a dual-point, dual-line design, and the main control module and the power supply module in the internal circuit components adopt a dual redundancy design of main and backup cold and hot.

10. The spacecraft anti-single-event risk system according to claim 1, characterized in that, The internal circuit components employ a CRC algorithm to transmit signals and achieve data transmission.

Images