Carrier rocket sequential control full redundancy implementation method

Abstract

The invention provides a carrier rocket time sequence control full redundancy implementation method, and aims to improve the fault adaptability and the working reliability of a time sequence control system. The full-redundancy design method of three-path information source redundancy, three-path transmission line redundancy, two-out-of-three voting control redundancy and five-tube relay instruction driving redundancy is adopted in the sequential control system, the capacity of adapting to all first-degree faults and most second-degree faults is achieved, a single-point failure link does not exist, and the reliability is high. Normal work of the sequential control system can be ensured in the flight process of the carrier rocket. Based on a three-bus communication electrical architecture of a new generation carrier rocket electrical system, a full-redundancy design implementation method of information source redundancy, transmission line redundancy, voting control redundancy and instruction driving redundancy is adopted, high-reliability carrier rocket time sequence control is completed, the fault adaptive capacity of the time sequence control system is improved, and the time sequence control system has a wide application prospect. And the working reliability of the system in the rocket flight process is ensured.

Description

Technical Field

[0001] This invention relates to a method for achieving full redundancy in the timing control of a launch vehicle. Background Technology

[0002] In the field of launch vehicles, there are very high requirements for the reliability of aerospace products, especially for critical systems that affect the success or failure of missions. The timing control system plays a crucial role in the ignition and shutdown of rocket engines, pressurization of propellant tanks, separation of various modules, and separation of satellites.

[0003] The launch vehicle timing control system mainly follows the overall flight program of the rocket. It controls the timing load actions of solenoid valves and pyrotechnics to complete key actions such as engine ignition, shutdown, pressurization, booster separation, interstage separation, fairing separation, and satellite-rocket separation. It directly affects the success or failure of the rocket flight mission. Therefore, the design of a highly reliable timing control system is particularly important.

[0004] Reliability design measures for launch vehicle electrical systems generally include methods such as simplified design, derating design, redundancy design, environmental protection design, and electromagnetic compatibility design. Among these, redundancy design, which enables the adaptation to various failure modes of individual units / systems to ensure normal operation, is the most important in reliability design.

[0005] Current redundancy design methods for timing control systems focus on the timing load output control stage, achieving redundancy through multi-point, multi-line control circuit design and timing load redundancy design. However, current timing control systems are relatively weak in handling problems such as information source failures, transmission line failures, receiving terminal communication failures, voting control module failures, and instruction drive module failures. Therefore, research on full redundancy design implementation methods for timing control systems, encompassing information source redundancy, transmission line redundancy, voting redundancy, and instruction isolation output redundancy, is necessary. Currently, there is limited research in this area. Summary of the Invention

[0006] The purpose of this invention is to provide a method for achieving full redundancy in the timing control of launch vehicles.

[0007] To address the above problems, this invention provides a method for achieving full redundancy in the timing control of a launch vehicle based on a digital pressure sensor, comprising:

[0008] The timing control device receives three first time reference signals from the onboard computer for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown, and three second time reference signals from the ground-based launch control system for ignition and emergency shutdown. Based on the first and second time reference signals, the three voting control modules of the timing control device independently perform a two-out-of-three vote and output timing instructions to the instruction drive module according to the time reference after voting. Finally, the instruction signals are sent to the resistor box to control the timing load action.

[0009] Furthermore, in the above method, the timing control device receives three first time reference signals from the onboard computer for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown, and receives three second time reference signals from the ground-based launch control system for ignition and emergency shutdown, including:

[0010] The onboard computer's three independent control output modules respectively issue first time reference signals for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown; the PLC of the ground-based launch control system outputs three independent time reference no-electric contact signals for ignition and emergency shutdown, serving as second time reference signals.

[0011] Furthermore, in the above method, the three 1553B bus communications between the onboard computer and the timing control device are independent of each other, and the three non-electric contact lines for ignition and emergency shutdown are independent of each other.

[0012] Furthermore, in the above method, based on the first time reference signal and the second time reference signal, the three voting control modules of the timing control device independently perform a two-out-of-three vote, and output timing instructions to the instruction driving module according to the time reference after voting, including:

[0013] Each of the three voting control modules in the timing control device receives the first time reference signals for ignition, emergency shutdown, takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown from the corresponding 1553B communication module and contact acquisition module. At the same time, it completes data interaction with the left and right boards through the CAN bus. In addition to exchanging data information, it also exchanges CAN heartbeat signals and 1553B heartbeat signals for redundant voting. Then, based on the time reference signal after voting, it sends timing command control signals to the command drive module.

[0014] Furthermore, in the above method, the three voting control modules of the timing control device independently perform a two-out-of-three vote and output timing instructions to the instruction drive module according to the time base after the vote, including:

[0015] The three voting control modules independently carry out interactive voting. First, they determine the validity of the received message, and then they perform three redundant voting steps before outputting the instruction.

[0016] Furthermore, in the above method, the time reference signal of the 1553B bus is redundantly voted through the interaction of the CAN heartbeat signal and the 1553B heartbeat signal, including:

[0017] A single voting control module judges the 1553B bus heartbeat signal transmitted by the bus communication module of this board and updates the 1553B bus heartbeat flag bit of this board;

[0018] A single voting control module distinguishes the left and right board CAN bus heartbeat signals and left and right board 1553B bus heartbeat signals transmitted by the CAN bus, and updates the left and right board CAN bus heartbeat and left and right board 1553B bus heartbeat flags.

[0019] When a single voting control module receives a correctly verified time base signal from the 1553B bus of this board, and the heartbeat of the 1553B bus of this board is normal, it is determined that a valid time base signal of this board has been received.

[0020] When a single voting control module receives a correctly verified time reference signal from the left and right board CAN bus, and the heartbeats of the left and right board CAN bus and the left and right board 1553B bus are both normal, it is determined that a valid left and right board time reference signal has been received.

[0021] Furthermore, in the above method, a time reference signal is also acquired through the redundant voting contacts of the interactive CAN heartbeat signal, including:

[0022] A single voting control module distinguishes the left and right board CAN bus heartbeat signals transmitted by the CAN bus and updates the left and right board CAN bus heartbeat flags accordingly.

[0023] When a single voting control module receives a time reference signal collected by the contacts on this board, it determines that a valid time reference signal from this board has been received.

[0024] When a single voting control module receives a time reference signal from one contact on the left or right board CAN bus, and the heartbeat of the left or right board CAN bus is normal, it is determined that a valid left or right board time reference signal has been received.

[0025] Furthermore, in the above method, the three voting control modules independently conduct interactive voting. First, they determine the validity of the received message, then perform triple-redundant voting before outputting the instruction, including:

[0026] When a single voting control module receives three valid time base signals, it performs a two-out-of-three voting on the time base signals, and takes the median value as the voting result by sorting the three time bases. Then, it performs timing control operations according to the time base after the voting.

[0027] When a single voting control module receives two valid time reference signals, it votes on the two time references, that is, it adopts the time reference with the smallest absolute value of the time deviation from its own single machine as the voting result, and performs timing control operations according to the time reference after voting.

[0028] When a single voting control module receives a valid time base signal, it determines whether the other two communications are abnormal. If both communications are abnormal, the time base is used as the voting result, and timing control operations are performed according to the time base after the vote; if not both communications are abnormal, the time base is considered an invalid signal.

[0029] Furthermore, in the above method, the instruction driving module adopts a redundant design of five-transistor solid-state relays.

[0030] Furthermore, in the above method, timing instructions are output to the instruction driver module according to the time base after voting, and finally the instruction signal is sent to the resistor box to control the timing load operation, including:

[0031] The instruction drive module receives control information from the voting control module and drives five solid-state relays to complete the output of one instruction. The five solid-state relays are redundantly connected in series and parallel. The instruction signal output by the instruction drive module of the timing control device completes the control work through a resistor box to the timing load.

[0032] Compared with existing technologies, this invention proposes a fully redundant implementation method for launch vehicle timing control to improve the fault adaptability and operational reliability of the timing control system. The timing control system employs a fully redundant design method with three-way information source redundancy, three-way transmission line redundancy, three-out-of-two voting control redundancy, and five-tube relay command drive redundancy. This method is capable of adapting to all first-degree faults and most second-degree faults, with no single point of failure, ensuring the normal operation of the timing control system during launch vehicle flight.

[0033] This invention is based on the "three-bus communication" electrical architecture of the new generation of launch vehicle electrical system. It adopts a fully redundant design method with information source redundancy, transmission line redundancy, voting control redundancy and command drive redundancy to achieve highly reliable launch vehicle timing control, improve the fault adaptability of the timing control system, and ensure the system's operational reliability during rocket flight. Attached Figure Description

[0034] Figure 1 This is a schematic diagram of a launch vehicle timing control system according to an embodiment of the present invention;

[0035] Figure 2 This is a schematic diagram of a timing redundancy control implementation method according to an embodiment of the present invention;

[0036] Figure 3This is a schematic diagram of redundant voting in a voting control module, taking voting control module A as an example.

[0037] Figure 4 This is a schematic diagram of a triple-redundant interactive voting method according to an embodiment of the present invention;

[0038] Figure 5 This is a schematic diagram of a solid-state relay with five redundant transistors according to an embodiment of the present invention. Detailed Implementation

[0039] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0040] like Figure 1 As shown, this invention provides a method for achieving full redundancy in the timing control of a launch vehicle, comprising:

[0041] In step S1, the timing control device receives three first time reference signals from the onboard computer for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown, and receives three second time reference signals from the ground-based launch control system for ignition and emergency shutdown. Based on the first and second time reference signals, the three voting control modules of the timing control device independently perform a two-out-of-three vote, and output timing instructions to the instruction drive module according to the time reference after voting. Finally, the instruction signal is sent to the resistor box to control the timing load action.

[0042] Preferably, the instruction driving module adopts a redundant design of a five-transistor solid-state relay.

[0043] Specifically, such as Figure 1 As shown, the launch vehicle timing control system mainly consists of an onboard computer, a timing control device, a resistor box, and a ground-based launch control system. The timing control device receives three time reference signals from the onboard computer for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown, and three time reference signals from the ground-based launch control system for ignition and emergency shutdown. Three voting control modules independently perform a two-out-of-three vote and output timing instructions to the command drive module according to the voted time reference. The command drive adopts a redundant design of five-tube solid-state relays, and finally sends the command signal to the resistor box to control the timing load action.

[0044] Better, such as Figure 2 As shown, the launch vehicle timing control system adopts the implementation methods of information source redundancy, transmission line redundancy, voting control redundancy, and command-driven redundancy.

[0045] In one embodiment of the fully redundant implementation method for launch vehicle timing control of the present invention, the timing control device receives three first time reference signals from the onboard computer for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown, and receives three second time reference signals from the launch control device of the ground-based launch and control system for ignition and emergency shutdown, including:

[0046] The onboard computer's three independent control output modules respectively issue first time reference signals for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown; the PLC of the ground-based launch control system outputs three independent time reference no-electric contact signals for ignition and emergency shutdown, serving as second time reference signals.

[0047] Specifically, information source redundancy: the three independent control output modules of the onboard computer respectively issue the first time reference signals for takeoff, booster separation, first-stage pre-shutdown and second-stage shutdown; the PLC of the launch control device of the ground measurement and control system outputs three independent time reference signals without electrical contacts for ignition, emergency shutdown and other functions.

[0048] In one embodiment of the launch vehicle timing control full redundancy implementation method of the present invention, the three 1553B bus communications between the onboard computer and the timing control device are independent of each other, and the three non-electric contact lines for ignition and emergency shutdown are independent of each other.

[0049] Here, the transmission lines are redundant: the three 1553B bus communications between the onboard computer and the timing control device are independent of each other, and the three non-electric contact lines for ignition and emergency shutdown are independent of each other.

[0050] In one embodiment of the fully redundant implementation method for launch vehicle timing control of the present invention, based on the first time reference signal and the second time reference signal, the three voting control modules of the timing control device independently perform a two-out-of-three vote, and output timing instructions to the instruction driving module according to the time reference after voting, including:

[0051] Each of the three voting control modules in the timing control device receives the first time reference signals for ignition, emergency shutdown, takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown from the corresponding 1553B communication module and contact acquisition module. At the same time, it completes data interaction with the left and right boards through the CAN bus. In addition to exchanging data information, it also exchanges CAN heartbeat signals and 1553B heartbeat signals for redundant voting. Then, based on the time reference signal after voting, it sends timing command control signals to the command drive module.

[0052] Preferably, voting control module A controls the actions of drive modules A1 and A2, voting control module B controls the actions of drive modules B1 and B2, and voting control module C controls the actions of drive module C.

[0053] Here, as Figure 3 As shown, the voting control is redundant: each of the three voting control modules in the timing control device receives time reference signals for ignition, emergency shutdown, takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown from the corresponding 1553B communication module and contact acquisition module. Simultaneously, it interacts with the left and right boards via the CAN bus, exchanging CAN heartbeat and 1553B heartbeat information for redundant voting. Then, based on the time reference signal after voting, it sends timing command control signals to the command drive module. Voting control module A controls the actions of drive modules A1 and A2, voting control module B controls the actions of drive modules B1 and B2, and voting control module C controls the actions of drive module C.

[0054] In one embodiment of the fully redundant implementation method for launch vehicle timing control of the present invention, three voting control modules of the timing control device independently perform a two-out-of-three vote and output timing instructions to the instruction driving module according to the time base after the vote, including:

[0055] The three voting control modules independently carry out interactive voting. First, they determine the validity of the received message, and then they perform three redundant voting steps before outputting the instruction.

[0056] Here, the voting determination method fully considers the system's fault adaptability. The three voting control modules independently carry out interactive voting. First, the validity of the received message is judged, and then the instruction is output after three redundant voting steps. The voting determination method is as follows: Figure 4 As shown.

[0057] In one embodiment of the launch vehicle timing control full redundancy implementation method of the present invention, the interactive CAN heartbeat signal and 1553B heartbeat signal are used for redundancy voting of the 1553B bus time reference signal, including:

[0058] A single voting control module judges the 1553B bus heartbeat signal transmitted by the bus communication module of this board and updates the 1553B bus heartbeat flag bit of this board;

[0059] A single voting control module distinguishes the left and right board CAN bus heartbeat signals and left and right board 1553B bus heartbeat signals transmitted by the CAN bus, and updates the left and right board CAN bus heartbeat and left and right board 1553B bus heartbeat flags.

[0060] When a single voting control module receives a correctly verified time base signal from the 1553B bus of this board, and the heartbeat of the 1553B bus of this board is normal, it is determined that a valid time base signal of this board has been received.

[0061] When a single voting control module receives a correctly verified time reference signal from the left and right board CAN bus, and the heartbeats of the left and right board CAN bus and the left and right board 1553B bus are both normal, it is determined that a valid left and right board time reference signal has been received.

[0062] Here, the validity of the 1553B bus message is determined:

[0063] (1) A single voting control module (3 in total) judges the 1553B bus heartbeat signal transmitted by the bus communication module of this board and updates the 1553B bus heartbeat flag bit of this board;

[0064] (2) A single voting control module (3 in total) judges the left and right board CAN bus heartbeat signals and left and right board 1553B bus heartbeat signals transmitted by the CAN bus, and updates the left and right board CAN bus heartbeat and left and right board 1553B bus heartbeat flag bits.

[0065] (3) When a single voting control module (3 in total) receives a correctly verified time base signal from the 1553B bus of this board and the heartbeat of the 1553B bus of this board is normal, it is determined that a valid time base signal of this board has been received.

[0066] (4) When a single voting control module (3 in total) receives a correctly verified time reference signal from the left and right board CAN bus, and the heartbeats of the left and right board CAN bus and the left and right board 1553B bus are normal, it is determined that a valid left and right board time reference signal has been received.

[0067] In one embodiment of the launch vehicle timing control full redundancy implementation method of the present invention, CAN heartbeat signals and 1553B heartbeat signals are also exchanged for redundancy voting, including:

[0068] A single voting control module distinguishes the left and right board CAN bus heartbeat signals transmitted by the CAN bus and updates the left and right board CAN bus heartbeat flags accordingly.

[0069] When a single voting control module receives a time reference signal collected by the contacts on this board, it determines that a valid time reference signal from this board has been received.

[0070] When a single voting control module receives a time reference signal from one contact on the left or right board CAN bus, and the heartbeat of the left or right board CAN bus is normal, it is determined that a valid left or right board time reference signal has been received.

[0071] Here, the validity of the touchpoint message is determined:

[0072] 1) Each voting control module (3 in total) judges the CAN bus heartbeat signals transmitted by the CAN bus between the left and right boards and updates the CAN bus heartbeat flags of the left and right boards;

[0073] 2) When a single voting control module (3 in total) receives the time reference signal collected by the contact of this board, it determines that a valid time reference signal of this board has been received;

[0074] 3) When a single voting control module (3 in total) receives a time reference signal from one contact of the left and right board CAN bus, and the heartbeat of the left and right board CAN bus is normal, it is determined that a valid left and right board time reference signal has been received.

[0075] In one embodiment of the fully redundant implementation method for launch vehicle timing control of the present invention, three voting control modules independently conduct interactive voting. First, they determine the validity of the received message, and then, after three-redundancy voting, they output the instruction, including:

[0076] When a single voting control module (3 in total) receives three valid time base signals, it performs a two-out-of-three voting on the time base signals, and takes the median value as the voting result by sorting the three time bases. Then, it performs timing control operations according to the time base after voting.

[0077] When a single voting control module (3 in total) receives two valid time reference signals, it votes on the two time references, that is, it adopts the time reference with the smallest absolute value of the time deviation from its own single machine as the voting result, and performs timing control operations according to the time reference after voting.

[0078] When a single voting control module receives a valid time base signal, it determines whether the other two communications are abnormal. If both communications are abnormal, the time base is used as the voting result, and timing control operations are performed according to the time base after the vote; if not both communications are abnormal, the time base is considered an invalid signal.

[0079] Here, the voting control module outputs the following instructions after triple-redundant voting:

[0080] (1) When a single voting control module (3 in total) receives three valid time base signals, it performs a two-out-of-three voting on the time base signals, and takes the middle value as the voting result by sorting the three time bases. Then, it performs timing control operations according to the time base after voting.

[0081] (2) When a single voting control module (3 in total) receives two valid time reference signals, it votes on the two time references, that is, it adopts the time reference with the smallest absolute value of the time deviation from its own single machine as the voting result, and performs timing control operation according to the time reference after voting.

[0082] (3) When a single voting control module (out of 3) receives one valid time reference signal, it determines whether the other two communications are abnormal. If both communications are abnormal, the time reference is used as the voting result, and timing control operations are performed according to the time reference after voting; if not both communications are abnormal, the time reference is considered an invalid signal.

[0083] In one embodiment of the launch vehicle timing control full redundancy implementation method of the present invention, timing instructions are output to the instruction driving module according to the time base after voting, and finally the instruction signal is sent to the resistor box to control the timing load action, including:

[0084] The instruction drive module receives control information from the voting control module and drives five solid-state relays to complete the output of one instruction. The five solid-state relays are redundantly connected in series and parallel. The instruction signal output by the instruction drive module of the timing control device completes the control work through a resistor box to the timing load.

[0085] Here, as Figure 5 As shown, the instruction-driven redundancy is as follows: the instruction-driven module receives control information from the voting control module and drives five solid-state relays to complete the output of one instruction. The five solid-state relays are redundantly connected in series and parallel. The instruction signal output by the instruction-driven module of the timing control device completes the control work through the resistor box to the timing load.

[0086] In detail, the fully redundant implementation method for launch vehicle timing control proposed in this invention has strong fault adaptability.

[0087] Generally, launch vehicles require that each system be adaptable to all first-degree failure modes and most second-degree failure modes, ensuring that there are no single-point failure modes.

[0088] The fault adaptability of the command-driven redundancy design was analyzed (as shown in Table 1). During rocket flight, the control signals of the default relays A1, A2, B1, B2, and C were all normal.

[0089] When one of the five relays is open-circuited or short-circuited, the commands can still be output normally, demonstrating that the command-driven redundancy scheme can adapt to all first-degree fault modes.

[0090] When two out of five relays are open-circuited or short-circuited, the command can be output normally in most cases, but some commands may be missed or sent incorrectly. This shows that the command-driven redundancy scheme can adapt to most second-degree fault modes.

[0091] Table 1. Fault Adaptability Analysis of Instruction-Driven Redundancy Design

[0092]

[0093] An analysis of the adaptability of the information source, transmission line, and voting module under failure conditions (as shown in Table 2) reveals that the current redundancy design of the information source, transmission line, and voting module can adapt to all first-degree failure modes and most second-degree failure modes.

[0094] Table 2 Fault Adaptability Analysis of Redundancy Design for Information Source, Transmission Line, and Voting Module

[0095]

[0096]

[0097] The published patent (publication number: CN106557022A) proposes a redundant timing control system for launch vehicles. The patent content mainly focuses on the system architecture. The system redundancy design is mainly reflected in the use of two parallel and two series solid-state relays in the actuator stage, which is different from the five-tube redundancy solid-state relay scheme of this invention. At the same time, it does not adopt design methods such as input signal redundancy, transmission line redundancy, and voting redundancy, and the redundancy measures are relatively simple.

[0098] In summary, to improve the fault adaptability and operational reliability of the timing control system, this invention proposes a fully redundant implementation method for the timing control of a launch vehicle. The timing control system employs a fully redundant design method, including redundancy of three information sources, three transmission lines, two-out-of-three voting control, and five-tube relay command drive. This method is capable of adapting to all first-degree faults and most second-degree faults, with no single point of failure, ensuring the normal operation of the timing control system during launch vehicle flight.

[0099] This invention is based on the "three-bus communication" electrical architecture of the new generation of launch vehicle electrical system. It adopts a fully redundant design method with information source redundancy, transmission line redundancy, voting control redundancy and command drive redundancy to achieve highly reliable launch vehicle timing control, improve the fault adaptability of the timing control system, and ensure the system's operational reliability during rocket flight.

[0100] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0101] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0102] Obviously, those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Therefore, if these modifications and variations fall within the scope of the claims of the invention and their equivalents, the invention is also intended to include these modifications and variations.

Claims

1. A method for achieving full redundancy in the timing control of a launch vehicle, characterized in that, include: The timing control device receives three first time reference signals from the onboard computer for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown, and three second time reference signals from the ground-based launch control system for ignition and emergency shutdown. Based on the first and second time reference signals, the three voting control modules of the timing control device independently perform a two-out-of-three vote and output timing instructions to the instruction drive module according to the time reference after voting. Finally, the instruction signals are sent to the resistor box to control the timing load action.

2. The method for achieving full redundancy in the timing control of a launch vehicle as described in claim 1, characterized in that, The timing control unit receives three first time reference signals from the onboard computer for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown, and also receives three second time reference signals from the ground-based launch control system for ignition and emergency shutdown, including: The onboard computer's three independent control output modules respectively issue first time reference signals for takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown; the PLC of the ground-based launch control system outputs three independent time reference no-electric contact signals for ignition and emergency shutdown, serving as second time reference signals.

3. The method for achieving full redundancy in the timing control of a launch vehicle as described in claim 1, characterized in that, The three 1553B bus communications between the onboard computer and the timing control device are independent of each other, and the three non-electric contact lines for ignition and emergency shutdown are also independent of each other.

4. The method for achieving full redundancy in the timing control of a launch vehicle as described in claim 1, characterized in that, Based on the first and second time reference signals, the three voting control modules of the timing control device independently perform a two-out-of-three vote, and output timing instructions to the instruction drive module according to the time reference after the vote, including: Each of the three voting control modules in the timing control device receives the first time reference signals for ignition, emergency shutdown, takeoff, booster separation, first-stage pre-shutdown, and second-stage shutdown from the corresponding 1553B communication module and contact acquisition module. At the same time, it completes data interaction with the left and right boards through the CAN bus. In addition to exchanging data information, it also exchanges CAN heartbeat signals and 1553B heartbeat signals for redundant voting. Then, based on the time reference signal after voting, it sends timing command control signals to the command drive module.

5. The method for achieving full redundancy in the timing control of a launch vehicle as described in claim 4, characterized in that, The three voting control modules of the timing control device independently perform a two-out-of-three vote and output timing instructions to the instruction drive module according to the time base after the vote, including: The three voting control modules independently carry out interactive voting. First, they determine the validity of the received message, and then they perform three redundant voting steps before outputting the instruction.

6. The method for achieving full redundancy in the timing control of a launch vehicle as described in claim 5, characterized in that, It also uses redundant voting of the 1553B bus time base signal through the interaction of CAN heartbeat signals and 1553B heartbeat signals, including: A single voting control module judges the 1553B bus heartbeat signal transmitted by the bus communication module of this board and updates the 1553B bus heartbeat flag bit of this board; A single voting control module distinguishes the left and right board CAN bus heartbeat signals and left and right board 1553B bus heartbeat signals transmitted by the CAN bus, and updates the left and right board CAN bus heartbeat and left and right board 1553B bus heartbeat flags. When a single voting control module receives a correctly verified time base signal from the 1553B bus of this board, and the heartbeat of the 1553B bus of this board is normal, it is determined that a valid time base signal of this board has been received. When a single voting control module receives a correctly verified time reference signal from the left and right board CAN bus, and the heartbeats of the left and right board CAN bus and the left and right board 1553B bus are both normal, it is determined that a valid left and right board time reference signal has been received.

7. The method for achieving full redundancy in the timing control of a launch vehicle as described in claim 6, characterized in that, It also acquires time reference signals through redundant voting contacts of the interactive CAN heartbeat signal, including: A single voting control module distinguishes the left and right board CAN bus heartbeat signals transmitted by the CAN bus and updates the left and right board CAN bus heartbeat flags accordingly. When a single voting control module receives a time reference signal collected by the contacts on this board, it determines that a valid time reference signal from this board has been received. When a single voting control module receives a time reference signal from one contact on the left or right board CAN bus, and the heartbeat of the left or right board CAN bus is normal, it is determined that a valid left or right board time reference signal has been received.

8. The method for achieving full redundancy in the timing control of a launch vehicle as described in claim 7, characterized in that, The three voting control modules independently perform interactive voting. First, they determine the validity of the received message, then perform triple-redundant voting before outputting instructions, including: When a single voting control module receives three valid time base signals, it performs a two-out-of-three voting on the time base signals, and takes the median value as the voting result by sorting the three time bases. Then, it performs timing control operations according to the time base after the voting. When a single voting control module receives two valid time reference signals, it votes on the two time references, that is, it adopts the time reference with the smallest absolute value of the time deviation from its own single machine as the voting result, and performs timing control operations according to the time reference after voting. When a single voting control module receives a valid time reference signal, it determines whether the other two communications are abnormal. If both communications are abnormal, the time reference is used as the voting result, and timing control operations are performed according to the time reference after the vote. If not both communications are abnormal, the time reference is considered an invalid signal.

9. The method for achieving full redundancy in the timing control of a launch vehicle as described in claim 8, characterized in that, The instruction-driven module adopts a redundant design using five-transistor solid-state relays.

10. The method for achieving full redundancy in the timing control of a launch vehicle as described in claim 9, characterized in that, Based on the time base after voting, timing instructions are output to the instruction driver module, and finally, the instruction signal is sent to the resistor box to control the timing load operation, including: The instruction drive module receives control information from the voting control module and drives five solid-state relays to complete the output of one instruction. The five solid-state relays are redundantly connected in series and parallel. The instruction signal output by the instruction drive module of the timing control device completes the control work through a resistor box to the timing load.

Images