Satellite control method, satellite control system and computer readable storage medium

Abstract

The invention provides a satellite control method, a satellite control system and a computer readable storage medium, and the method comprises the steps: carrying out the power-on initialization of a satellite black box when a satellite starts in-orbit operation; in one period, the satellite black box is controlled to start a data acquisition process, and record data is obtained and stored; the satellite-ground data interaction is triggered, and when a satellite fault is detected, the satellite communication module is controlled to download recorded data before the fault to a ground gateway station; otherwise, downloading the recorded data to a ground gateway station according to a time sequence; if the ground gateway station sends the control instruction, controlling the satellite black box to respond and execute according to the control instruction; and enabling the satellite black box to perform self-inspection. According to the invention, when the fault occurs, the recorded data within the first determined length before the fault is downloaded preferentially, so that the interference of other conventional data information in an emergency on the troubleshooting work is reduced, the traceability time is shortened, and the troubleshooting work efficiency after the satellite fault occurs is improved.

Description

A satellite control method, a satellite control system, and a computer-readable storage medium. Technical Field

[0001] This invention relates to the field of spacecraft technology, and in particular to a satellite control method, a satellite control system, and a computer-readable storage medium. Background Technology

[0002] In recent years, with the advancement of aerospace technology and the innovation of business models, satellite systems are exhibiting an unprecedentedly diversified ecosystem, gradually developing into intelligent satellites with various diverse missions such as communication and navigation, and remote sensing monitoring.

[0003] The space environment in which intelligent satellites operate is fraught with various factors detrimental to spacecraft. For example, significant temperature fluctuations, intense electromagnetic radiation, and high-energy particle radiation pose substantial potential risks to the satellite's electronic and life support systems, potentially leading to performance degradation, data loss, or even equipment damage. These factors combined create numerous safety hazards during satellite operation, and failure to address them promptly could result in satellite malfunctions or even failures, hindering mission success. Therefore, satellite behavior recorders are necessary to record data during satellite operation. However, existing satellite control systems often only use onboard computers to record partial log files, failing to fully trace satellite behavior and unable to transmit data to the ground control center in a timely manner. This prolongs the time required for fault tracing, delays in troubleshooting, and increases the difficulty of fault diagnosis.

[0004] Therefore, existing technologies still need to be improved and developed. Summary of the Invention

[0005] In view of the shortcomings of the prior art, the purpose of this invention is to provide a satellite control method, a satellite control system, and a computer-readable storage medium to solve the problems of conventional data transmission occupying the downlink channel when a fault occurs in existing satellite control systems with satellite behavior recording functions, resulting in long tracing times, inaccurate and incomplete tracing information, and difficulties in fault diagnosis.

[0006] The technical solution of the present invention is as follows: The present invention provides a satellite control method, the steps of which include: when the satellite starts to run in orbit, the satellite black box performs power-on initialization; in one cycle, the satellite black box starts the data acquisition process, obtains and stores the recorded data; triggers satellite-to-ground data interaction, and when a satellite fault is detected, the satellite black box controls the satellite communication module to download the recorded data within a first determined length before the fault to the ground gateway station; otherwise, the recorded data is downloaded to the ground gateway station in chronological order; detects whether the ground gateway station sends a control command; if the ground gateway station sends a control command, the satellite black box responds and executes the control command; the satellite black box performs a self-test, and when the self-test result is abnormal, it performs an abnormal alarm processing and enters the next cycle.

[0007] A further provision of the present invention states that the step of powering on and initializing the satellite black box during satellite startup and on-orbit operation includes: powering on and starting the satellite black box when a separation signal output by the satellite-rocket separator and / or a power-on start signal output by the satellite's onboard computer are detected; detecting a heartbeat signal; if the satellite black box and the onboard computer maintain bidirectional heartbeat signal interaction, the satellite black box and the onboard computer operate normally; if the bidirectional heartbeat signal between the satellite black box and the onboard computer is interrupted, the satellite black box automatically restarts and re-detects the bidirectional heartbeat signal; if the bidirectional heartbeat signal between the satellite black box and the onboard computer is interrupted after the automatic restart, the onboard computer is triggered to reset the satellite black box.

[0008] In a further embodiment of the present invention, the step of the satellite black box activating the data acquisition process, obtaining and storing recorded data in one cycle includes: controlling the satellite black box to monitor bus data and non-bus data to obtain working data information; encrypting the working data information to obtain recorded data, wherein the recorded data includes encrypted data and a verification value; and performing dual-chip redundant storage for the encrypted data and the verification value.

[0009] In a further embodiment of the present invention, the step of controlling the satellite black box to monitor bus data and non-bus data to obtain working data information includes: the satellite computer collecting working information from each satellite module and forwarding it to the satellite black box; the satellite black box collecting and storing high-speed bus information from the high-speed transmission bus and low-speed bus information from the low-speed transmission bus to obtain bus data; the satellite black box collecting and storing two-point data information transmitted by each satellite module through the point-to-point interface, as well as working information forwarded by the satellite computer to obtain non-bus data; and the satellite black box integrating these into working data information and storing it.

[0010] A further provision of the present invention states that the step of triggering satellite-to-ground data interaction, in which the satellite black box controls the satellite communication module to download recorded data within a first predetermined length prior to the fault to the ground gateway station when a satellite fault is detected, includes: the satellite communication module and the ground gateway station completing a protocol handshake to trigger satellite-to-ground data interaction; when a satellite fault is detected, the satellite communication module prioritizes downloading recorded data from the hour prior to the fault or the previous orbit to the ground gateway station; when the satellite is detected to be operating normally, the satellite communication module downloads recorded data within a preset periodic time frame to the ground gateway station in chronological order.

[0011] In a further embodiment of the present invention, the step of detecting whether the ground gateway station sends a control command; if the ground gateway station sends a control command, the satellite black box responds to and executes the control command includes: detecting whether the ground gateway station issues a control command; when the ground gateway station outputs a data clearing command, the satellite black box deletes the stored recorded data according to the data clearing command; when the ground gateway station outputs an on-orbit upgrade command, the satellite black box performs a software upgrade according to the on-orbit upgrade command.

[0012] A further provision of the present invention includes the following steps for the satellite black box to perform a self-test, issue an anomaly alarm when the self-test result is abnormal, and proceed to the next cycle: if the ground gateway station does not issue a control command, the system checks whether there is an anomaly in the status of the satellite black box, and proceeds to the next cycle if no anomaly is found; if there is an anomaly in the status of the satellite black box, the satellite black box automatically sends an alarm signal and records an anomaly log, while simultaneously performing self-recovery; the system obtains and stores the recorded data based on the anomaly log, and transmits it to the ground gateway station through a priority channel; if the satellite black box fails to self-recover, an unrecoverable fault occurs, and the satellite's on-orbit operation terminates.

[0013] In a further embodiment of the present invention, the step of encrypting the working data information to obtain recorded data, wherein the recorded data includes encrypted data and a verification value, comprises: reading the address information of the working data information and determining the output module information of the working data information; classifying the working data information according to the output module information and determining the available encryption algorithm for the working data information; encrypting the working data information using the available encryption algorithm to obtain recorded data, wherein the recorded data includes encrypted data and a verification value.

[0014] Based on the same inventive concept, the present invention also provides a satellite control system for implementing the above-described satellite control system operation method, characterized in that it includes a satellite black box and a satellite communication module; wherein, the satellite black box is used to collect and record data from the satellite and encrypt the recorded data; the satellite communication module is used to transmit the recorded data to a ground gateway station and receive control commands sent by the ground gateway station.

[0015] Based on the same inventive concept, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the satellite control method described above.

[0016] This invention provides a satellite control method, a satellite control system, and a computer-readable storage medium. The satellite control method includes the following steps: when the satellite starts operating in orbit, the satellite black box performs power-on initialization; in one cycle, the satellite black box initiates a data acquisition process, obtains and stores recorded data; triggers satellite-to-ground data interaction; when a satellite fault is detected, the satellite black box controls the satellite communication module to download recorded data within a first predetermined length before the fault to the ground gateway station; otherwise, the recorded data is downloaded to the ground gateway station in chronological order; detects whether the ground gateway station sends a control command; if the ground gateway station sends a control command, the satellite black box responds and executes the control command; the satellite black box performs a self-test, and if the self-test result is abnormal, it performs an anomaly alarm and enters the next cycle. This invention reduces the interference of other routine data information on fault investigation in emergency situations by prioritizing the download of recorded data within a first predetermined length before the fault occurs, shortens the tracing time, and improves the efficiency of troubleshooting after a satellite fault occurs. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0018] Figure 1 is a flowchart of the steps of the satellite control method in a preferred embodiment of the present invention.

[0019] Figure 2 is a flowchart of the steps of a satellite control method in another preferred embodiment of the present invention.

[0020] Figure 3 is a schematic diagram of the satellite control system modules in a preferred embodiment of the present invention.

[0021] Figure 4 is a structural block diagram of the satellite control system in a preferred embodiment of the present invention.

[0022] Figure 5 is a schematic diagram of the connection relationship between the satellite black box and the master-slave bus in this invention.

[0023] Figure 6 is a schematic diagram of the connection relationship between the satellite black box and the peer bus in this invention.

[0024] Figure 7 is a schematic diagram of the connection between the satellite black box and the space camera module in this invention.

[0025] The following are the labels in the attached diagram: 1. Satellite components; 11. Power module; 12. Attitude module; 13. Orbit control module; 14. Thermal control module; 15. Satellite-rocket separator; 2. Satellite computer; 3. Satellite black box; 4. Satellite payload; 41. Space camera module; 42. Switch; 5. Satellite communication module. Detailed Implementation

[0026] This invention provides a satellite control method, a satellite control system, and a computer-readable storage medium. To make the objectives, technical solutions, and effects of this invention clearer and more explicit, the invention is further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0027] In the implementation methods and claims, unless otherwise specified in the text, the terms "a," "an," "the," and "the" may also include plural forms. If the embodiments of the present invention involve descriptions of "first," "second," etc., such descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features.

[0028] It should be further understood that the term "comprising" as used in this specification means the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof. It should be understood that when we say an element is "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, or there may be intermediate elements. Furthermore, "connected" or "coupled" as used herein can include wireless connections or wireless coupling. The term "and / or" as used herein includes all or any unit and all combinations of one or more associated listed items.

[0029] It will be understood by those skilled in the art that, unless otherwise defined, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. It should also be understood that terms such as those defined in general dictionaries should be understood to have the same meaning as in the context of the prior art, and should not be interpreted in an idealized or overly formal sense unless specifically defined as herein.

[0030] Furthermore, the technical solutions of the various embodiments can be combined with each other, but only if they are feasible for those skilled in the art. If the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0031] The inventors discovered that as the commercial aerospace industry rapidly develops towards multi-mission integration and modular development, satellites have gradually transformed from traditional single-function systems into integrated "communication-navigation-remote sensing" control systems. Correspondingly, the development model has shifted from "single-entity full-process development" to "multi-unit component integration," and software platforms are gradually becoming more open to support third-party application access. Against this backdrop, the data recording function of traditional satellite systems, due to its high coupling with core control modules, lacks neutrality in its data acquisition process and cannot fully meet the needs of third-party supervision, fault tracing, and insurance verification. Therefore, stand-alone satellite behavior recorders, or satellite black boxes, have become critical equipment in the industry. These recorders need to independently collect and store data such as satellite bus commands, component responses, and payload parameters to support reliable management throughout the entire lifecycle. However, the current satellite architecture and system design are not adapted to this standalone recorder, resulting in functional compatibility issues, mainly in four aspects: First, the satellite hardware architecture lacks a standardized access design. The existing satellite bus interface is customized for satellite operations systems and traditional departmental components, without reserving a standardized channel for the recorder. Bandwidth allocation and interface protocols do not match the recorder's high-frequency acquisition requirements, easily leading to bus congestion or packet loss after integration. Simultaneously, the hardware interface lacks unified mechanical and electrical standards, requiring modifications to satellite operations circuitry during integration, thus extending the debugging cycle and increasing the risk of failure.

[0032] Secondly, the satellite's data link lacks security mechanisms. Data on the intra-satellite bus is mostly transmitted in plaintext without encryption using national cryptographic algorithms, making critical data collected by the recorder susceptible to tampering. Furthermore, satellite-to-ground transmission focuses on basic integrity verification but lacks trusted identity authentication, leading to inconsistent data standards and low reliability, thus failing to ensure its authority and immutability.

[0033] Thirdly, the satellite lacks sufficient resource and environmental adaptability. System resource allocation is centered on core satellite missions, without reserving power consumption and computing power quotas for the recorder. Under extreme conditions, data loss and processing delays can easily occur due to low power supply priority or computing power contention. Furthermore, there is no coordinated design for the recorder's radiation resistance (such as single-event protection) and wide-temperature thermal control requirements, making it difficult to guarantee the recorder's reliability.

[0034] Fourthly, there is a mismatch in the satellite-ground coordination logic when the satellite performs behavior recording. On the satellite side, the satellite-ground transmission does not reserve a priority downlink channel for recorder data; after a failure, it must wait for regular data transmission, delaying the opportunity for tracing the source. At the same time, on the ground gateway side, the ground receiving system lacks a recorder data parsing and signature verification module, making it impossible to directly verify the validity of data credentials, thus increasing the complexity of third-party supervision.

[0035] In summary, due to design flaws in access, security, resources, and collaboration, the existing satellite architecture cannot meet the operational needs of independent recorders, thus hindering the development of commercial aerospace safety supervision. There is an urgent need to optimize the architecture to achieve efficient collaboration between the two.

[0036] To address the technical problems existing in the prior art, as shown in Figure 1, the present invention provides a satellite control method, the steps of which include: S100, when the satellite starts to run in orbit, the satellite black box is powered on and initialized; wherein, in order to enable the satellite black box to record on-board behavior from the start time, it can directly detect the moment when the satellite separates from the rocket and enters the on-orbit operation state, and after starting on-orbit operation, the satellite black box is powered on and initialized, the satellite black box enters the working state and stores the on-board behavior.

[0037] S200. In one cycle, the satellite black box initiates a data acquisition process, obtains and stores recorded data. Further, after power-on initialization, the satellite black box's operation can be divided into multiple operating cycles. In each operating cycle, the satellite black box performs data acquisition and updates the data information in its internal storage unit. Preferably, an independent third-party component can be used to implement the satellite behavior recording function. That is, the satellite black box uses a third-party independent satellite safety recorder. This third-party independent satellite safety recorder is structurally connected to other components and can independently collect and store data such as satellite bus commands, component responses, and payload parameters. This allows for non-intrusive monitoring to obtain and store data generated during onboard operations as recorded data, providing support for reliable management throughout the entire lifecycle.

[0038] S300, triggering satellite-to-ground data interaction: When a satellite malfunction is detected, the satellite black box controls the satellite communication module to download recorded data within a first predetermined length before the malfunction to the ground gateway station; otherwise, the recorded data is downloaded to the ground gateway station in chronological order. The satellite black box stores the recorded data generated in this period, and when the satellite triggers satellite-to-ground data interaction, the satellite black box downloads the internally stored recorded data to the ground gateway station. When a satellite malfunction is detected, it is necessary to investigate the data before and after the malfunction to quickly determine the cause of the malfunction and formulate a solution. Therefore, when a satellite malfunction occurs, the recorded data within a first predetermined length before the malfunction is downloaded first through the satellite communication module. After the first predetermined length of recorded data is downloaded, data from other time periods is sent sequentially. Thus, the ground can directly trace the problem based on the prioritized downloaded recorded data before the malfunction, shortening the time required for problem tracing, supporting behavioral reverse engineering and data tracing under abnormal operating conditions, efficiently completing fault location and safety hazard investigation, and providing reliable data support for third-party supervision and insurance verification in commercial aerospace.

[0039] S400. Detect whether the ground gateway station sends a control command; if the ground gateway station sends a control command, the satellite black box responds and executes the control command; specifically, the satellite communication module can be used to transmit data to the ground gateway station, and can also be used to receive control commands uploaded by the ground gateway station. The control command can be any command used to control the satellite black box, and the satellite black box responds and executes various functions according to the control command.

[0040] S500: The satellite black box performs a self-test. If the self-test result is abnormal, an abnormal alarm is triggered, and the next cycle begins.

[0041] If no control commands are sent from the ground, the satellite black box performs a self-check. If the self-check result is abnormal, an anomaly alarm is triggered, and the system enters the next cycle to check for any abnormalities in its own status. This ensures the satellite black box remains operational. If an anomaly is detected, the anomaly type is assessed, and the satellite black box attempts self-recovery, improving its on-orbit performance.

[0042] Please refer to Figures 1 and 2 together. In some preferred embodiments of the present invention, the step of powering on and initializing the satellite black box during satellite startup and on-orbit operation includes: S110, when the separation signal output by the satellite-rocket separator and / or the power-on start signal output by the satellite service computer are detected, the satellite black box is powered on and started; S120, the heartbeat signal is detected. If the satellite black box and the service computer maintain bidirectional heartbeat signal interaction, the satellite black box and the service computer work normally; S130, if the bidirectional heartbeat signal between the satellite black box and the service computer is interrupted, the satellite black box is automatically restarted and the bidirectional heartbeat signal is detected again; S140, if the bidirectional heartbeat signal between the satellite black box and the service computer is interrupted after the automatic restart, the service computer is triggered to reset the satellite black box.

[0043] To ensure complete satellite behavior is captured, the satellite black box is directly connected to the satellite-rocket separator. This separator connects the satellite to the rocket. After the satellite separates from the rocket and begins on-orbit operation, the satellite recording module needs to be activated immediately to record onboard behavior. Preferably, the satellite black box and the satellite-rocket separator are connected via a PPS or I / O interface, used to initiate satellite operation and primarily for powering on and initializing the satellite's onboard computer and black box.

[0044] The satellite black box of this invention is connected to the satellite mission computer via an I / O interface. After initialization, the satellite black box performs bidirectional heartbeat detection with the satellite mission computer. Specifically, the satellite mission computer controls and processes the satellite's main tasks. The satellite black box and the satellite mission computer transmit bidirectional heartbeat signals; that is, both the satellite mission computer and the satellite black box are equipped with a signal output interface for outputting heartbeat signals and a signal detection interface for receiving and detecting heartbeat signals. Thus, while the satellite mission computer outputs heartbeat signals to the satellite black box, it also monitors the heartbeat signals input to the satellite black box, ensuring the normal operation of both the satellite black box and the satellite mission computer. This I / O interface uses specified square wave or other communication signals to mutually sense whether the other is working properly. If an anomaly is detected, a restart and recovery process is initiated.

[0045] Furthermore, the step of the satellite black box starting the data acquisition process, obtaining and storing recorded data in one cycle includes: S210, controlling the satellite black box to monitor bus data and non-bus data to obtain working data information; S220, encrypting the working data information to obtain recorded data, the recorded data including encrypted data and a check value; S230, performing dual-chip redundant storage for the encrypted data and the check value.

[0046] When the satellite black box is operational, it collects operational data generated during any onboard operations. This data can be all information, or only important information or information that primarily reflects the onboard operational status. For example, the operational data may include bus commands and payload parameters. Bus commands have small data volumes and low bandwidth requirements, so they can be transmitted via a low-speed bus. Conversely, payload parameters often have large data volumes and high bandwidth requirements, so they are preferably transmitted via a high-speed bus. The satellite black box obtains all bus data by collecting data from both the high-speed and low-speed buses. Additionally, there is point-to-point data transmission on the satellite. If this transmission passes through the onboard computer, the corresponding information is directly forwarded to the satellite black box by the onboard computer; or the payload parameters or commands are directly transmitted to the satellite black box via a point-to-point transmission module, obtaining non-bus information. To protect the collected critical data from tampering, the satellite black box encrypts the obtained operational data, resulting in recorded data. Preferably, the working data information can be encrypted using a national cryptographic algorithm to obtain encrypted data and a hash value. The hash value is associated with a timestamp and can be accurate to the millisecond level. The hash value is used for data verification. For example, the SM4 algorithm can be used, or other encryption algorithms can be used, and the encrypted record data is redundantly stored.

[0047] A further provision of the present invention includes the following steps for controlling the satellite black box to monitor bus data and non-bus data to obtain working data information: S211, the satellite computer collects working information from each satellite module and forwards it to the satellite black box; S212, the satellite black box collects and stores high-speed bus information from the high-speed transmission bus and low-speed bus information from the low-speed transmission bus to obtain bus data; S213, the satellite black box collects and stores two-point data information transmitted by each satellite module through the point-to-point interface, as well as working information forwarded by the satellite computer to obtain non-bus data; S214, the satellite black box integrates these into working data information and stores it.

[0048] In this invention, the satellite computer can be adapted and connected via a modular structure to payloads for different functions and modules for basic satellite functions. For example, the payloads can be any instrument, device, or system performing a specific task, and the modules for basic satellite functions can be any modules for basic functions such as power supply, attitude control, propulsion, and temperature control. To improve maintainability and scalability, and to ensure that connecting the satellite black box does not alter the existing structure, the satellite black box is connected to the high-speed and low-speed transmission buses, acquiring data from these buses through non-intrusive monitoring.

[0049] The satellite computer and the satellite communication module are connected via a high-speed transmission bus and a low-speed transmission bus. The satellite computer's internal process data for multiple services and applications can also be output to the satellite behavior recorder in a specific log format via these buses for subsequent analysis and tracing. The satellite communication module includes a satellite communicator for communicating with ground control stations or gateway stations to upload control commands or send data and results. This ensures that the generated data does not communicate directly with the satellite computer, maintaining third-party independence. The satellite black box is directly connected to the satellite communication module, transmitting and receiving data with the ground gateway station through a dedicated data channel within the module. This prevents data loss when the satellite computer is not operating or data failure to be sent to the ground gateway station. It also prevents the satellite behavior recorder from failing to detect abnormal operations due to hacking attacks or other abnormal behavior. When communicating with the ground gateway station, the satellite communication module actively sends the recorded data from the previous time period from the satellite black box to the ground gateway station, completing a ground backup of the onboard data.

[0050] Further, the step of encrypting the work data information to obtain recorded data, wherein the recorded data includes encrypted data and a verification value, includes: S221, reading the address information of the work data information and determining the output module information of the work data information; S222, classifying the work data information according to the output module information and determining the available encryption algorithm for the work data information; S223, encrypting the work data information using the available encryption algorithm to obtain recorded data, wherein the recorded data includes encrypted data and a verification value.

[0051] In a further embodiment of the present invention, the satellite black box detects the transmission addresses of the component data signals, component control commands, forwarding work data, payload data signals, and payload control commands, and selects an encryption algorithm to encrypt each component data signal, component control command, forwarding work data, payload data signal, and payload control command according to the transmission address. The encryption algorithm employs at least one of symmetric encryption algorithms, asymmetric encryption algorithms, or hash algorithms. For example, it can be one or more of symmetric algorithms such as DES, 3DES, and AES, asymmetric algorithms such as RSA and DSA, or hash algorithms such as SHA-1 and MD5. Specifically, when the satellite black box is operating, it can determine the corresponding component or load of the output recording data by searching the ID addresses of the component data signals and component control commands on the low-speed transmission bus and the IP addresses of the payload data signals and payload control commands on the high-speed transmission bus. The satellite black box can then pre-determine the encryption algorithm selected for the corresponding ID address or IP address and apply the appropriate encryption algorithm when detecting the corresponding ID address or IP address, thereby setting different encryption methods for different components or loads.

[0052] In some preferred embodiments, the step of performing dual-chip redundant storage for the encrypted data and the verification value includes: S231, transmitting and storing the encrypted data and verification value to the main chip, and simultaneously transmitting and storing the encrypted data and verification value to the slave chip; S232, the main chip is used to complete the independent satellite behavior recording function when it is working, and the slave chip is in a hot backup state when the main chip is working, monitoring and storing the working status of the main chip in real time; S233, when the main chip fails, the slave chip automatically continues to work according to the working status of the main chip.

[0053] To meet the requirements of modern control systems and improve system reliability, encrypted data and verification values ​​are stored using dual-chip redundancy. The satellite black box contains a main chip for independent satellite behavior recording, and also includes a redundant backup chip (slave chip). If the main chip fails, the control system can quickly switch to the slave chip, ensuring normal system operation. The main and slave chips can be the same model or different models. Preferably, the main chip is a chip with higher performance but lower reliability than the slave chip, while the slave chip is a chip with lower performance but higher reliability than the main chip. This is to protect against single-event effects caused by high-energy particle radiation in space, which can lead to device malfunctions or failures.

[0054] Furthermore, the step of triggering satellite-to-ground data interaction, whereby the satellite black box controls the satellite communication module to download recorded data within a first predetermined length prior to the fault to the ground gateway station when a satellite fault is detected, includes: S310, the satellite communication module and the ground gateway station complete a protocol handshake to trigger satellite-to-ground data interaction; S320, when a satellite fault is detected, the satellite communication module prioritizes downloading recorded data from the hour prior to the fault or the previous orbit to the ground gateway station; S330, when the satellite is detected to be operating normally, the satellite communication module downloads recorded data within a preset time period to the ground gateway station in chronological order.

[0055] Specifically, when the satellite detects the uplink carrier signal from the ground gateway station, the satellite and the gateway station synchronize frequency and time and complete a protocol handshake. At this time, a stable transmission link is established between the satellite communication module and the gateway station. After establishing a stable transmission link, the satellite black box selects different transmission modes depending on whether a satellite malfunction has occurred. The malfunction refers to a fault that occurs when the satellite and its internal load modules are in orbit, such as abnormal satellite attitude, bus packet loss, load failure, or decreased power supply. When an accident occurs, the satellite black box enters a priority downlink mode based on alarm signals from other modules and records the timestamp of the accident. In this mode, if a satellite-to-ground data exchange is established with the ground gateway station in one cycle, the satellite black box prioritizes downlinking the recorded data from the hour before the fault or the previous orbit based on the timestamp through the satellite communication module. For low-Earth orbit satellites, the previous orbit refers to the data from the previous orbit, i.e., one revolution around the Earth, so the recording data duration can be set accordingly based on the duration of the previous orbit. Correspondingly, since high-orbit satellites do not orbit, they can extract and transmit recorded data from the previous hour. It should be noted that this "one hour" is a reference value or a typical value, which can be set according to actual conditions. The recorded data includes full information on the operational data of each module on the command and response link in the hour or previous orbit before the fault, thereby shortening the tracing time and enabling rapid location of recorded data before and after the fault occurrence. In another preferred embodiment, the satellite black box can also use fragmented transmission, that is, prioritizing the transmission of key fault segments, such as the specific time code, timestamp, and corresponding load or load-reported abnormal status identifier when the fault occurs, as well as sampling data related to the fault type. This sampling data from that period is transmitted first, enabling direct and rapid location of the fault root cause and determination of the satellite status, further shortening the tracing time. Correspondingly, when the satellite is operating normally, i.e., when the satellite black box is not detected, the recorded data within a preset period is transmitted to the ground gateway station in chronological order via the satellite communication module.

[0056] A further provision of the present invention includes the step of detecting whether the ground gateway station sends a control command; if the ground gateway station sends a control command, the satellite black box responds to and executes the control command, comprising: S410, detecting whether the ground gateway station issues a control command; S420, when the ground gateway station outputs a data clearing command, the satellite black box deletes the stored record data according to the data clearing command; S430, when the ground gateway station outputs an on-orbit upgrade command, the satellite black box performs a software upgrade according to the on-orbit upgrade command.

[0057] Specifically, during satellite-to-ground data interaction, the satellite black box can download recorded data and upload control commands from the gateway station. For example, since the storage capacity of the satellite black box itself is predetermined, there is a limitation on the amount of data it can store. Preferably, the satellite black box can store data from one month prior to a power outage, and overwriting is triggered when the storage space of the satellite black box is less than 10% of its maximum storage capacity. Since the satellite operates for extended periods, its runtime far exceeds the storage limit of the satellite black box. Therefore, it is necessary to detect whether the satellite is interacting with the ground gateway station in each cycle. The ground gateway station can also transmit a clear command to the satellite communication module, which then transmits the clear command to the satellite black box. The satellite black box can also respond to control commands from the ground gateway station, clearing some or all of the data stored inside.

[0058] Furthermore, the steps for the satellite black box to perform a self-test, issue an anomaly alarm when the self-test result is abnormal, and proceed to the next cycle include: S510, if the ground gateway station does not issue a control command, the satellite black box is checked for any abnormality in its status, and if no abnormality is found, the cycle proceeds to the next cycle; S520, if the satellite black box is abnormal, it automatically sends an alarm signal and records an anomaly log, while simultaneously performing self-recovery; the recorded data is obtained from the anomaly log and stored, and then transmitted to the ground gateway station through a priority channel; S530, if the satellite black box fails to self-recover, an unrecoverable fault occurs, and the satellite's on-orbit operation terminates.

[0059] During one cycle, the satellite black box performs a self-test. If the self-test result is abnormal, it issues an alarm and proceeds to the next cycle to check for any abnormalities in its operational status. For example, it can detect and record parameters such as used storage capacity, power supply voltage, latch area size, bad block area capacity, or other items that may affect the satellite black box's operation, thereby increasing operational accuracy. If the self-test result is normal, it proceeds to the next cycle; if the self-test result is abnormal, the satellite black box sends an alarm signal to the satellite computer and records an anomaly log. Simultaneously, the satellite black box enters a priority downlink mode and, during the next data interaction between the satellite communication module and the ground gateway station, prioritizes the downlink of alarm data and anomaly logs based on the alarm. When the satellite black box malfunctions, it detects the fault type and performs self-recovery based on the fault type. If self-recovery fails, the satellite black box experiences an unrecoverable fault, and the satellite's on-orbit operation terminates. If self-recovery is successful, the satellite black box resumes operation and proceeds to the next cycle.

[0060] For ease of understanding, the present invention describes the satellite control system used therein, which can implement the satellite control method described above. It includes a satellite black box and a satellite communication module. The satellite black box is used to collect and record data from the satellite and encrypt the recorded data. The satellite communication module is used to transmit the recorded data to the ground gateway station and receive control commands sent by the ground gateway station.

[0061] Furthermore, the present invention provides a satellite control system, as shown in FIG2, comprising: a satellite component 1, a satellite service computer 2, a satellite black box 3, and a satellite payload 4; wherein, the satellite component 1 is connected to the satellite service computer 2 to implement basic satellite functions, and outputs component data signals to the satellite service computer 2 and receives component control commands output by the satellite service computer 2; the satellite payload 4 is connected to the satellite service computer 2 to implement satellite payload 4 functions, and outputs payload data signals to the satellite service computer 2 and receives payload control commands output by the satellite service computer 2; the satellite service computer 2 is connected to the satellite black box 3 to output forwarding work data and satellite service work data to the satellite black box 3; the satellite black box 3 is connected to the common terminal of the satellite component 1 and the satellite service computer 2, and the common terminal of the satellite payload 4 and the satellite service computer 2, respectively, for collecting and storing recorded data, the recorded data including component data signals, component control commands, forwarding work data, payload data signals, payload control commands, and satellite service work data.

[0062] The satellite computer 2 is used to control and process the satellite's main tasks. The satellite component 1 performs basic satellite operations and outputs component data signals to the satellite computer 2 for data communication during operation. The satellite computer 2 is connected to both the satellite payload 4 and the satellite component 1, receiving component data signals and payload data signals. It also outputs component control signals to the satellite component 1 to control its operational status and sends payload control signals to the satellite payload 4 to control its operational status. The satellite black box 3 is connected to the communication lines between the satellite computer 2, the satellite payload 4, and the satellite component 1, and collects and stores component data signals or payload data signals emitted by the satellite payload 4 and satellite component 1 during operation. The satellite computer 2's own internal process data for multiple services and applications can also be output to the satellite black box in a specific log data format for subsequent analysis and traceability. For example, this recorded data may also include satellite system time, orbit information, and attitude information. Due to the lack of standardized access design in the existing satellite hardware architecture, the satellite bus interface is customized for the spaceborne computer and traditional components, without reserving a standardized channel for the recorder. Bandwidth allocation and interface protocols cannot match the data acquisition requirements of the satellite black box 3, easily leading to bus congestion or packet loss after connection. Furthermore, the hardware interface lacks unified mechanical and electrical standards, requiring modification of the satellite component 1 circuitry during integration, resulting in extended testing cycles and increased failure risks. Therefore, in this invention, the satellite black box 3 uses a third-party independent satellite safety recorder. This satellite safety recorder is independently configured relative to the satellite component 1, which adopts a common platform design approach. Its modular structure allows for adaptation to different payloads, shortening the development cycle and improving reliability. To improve maintainability and scalability, and to ensure that the connection of the satellite black box 3 does not alter the existing structure, the satellite black box 3 is connected to both the high-speed and low-speed transmission buses. The satellite component 1, the satellite computer 2, the satellite black box 3, and the satellite payload 4 can be connected via a bus, or via point-to-point (i.e., wired two-point two-line) connection, or via intra-satellite short-range wireless communication. For example, the intra-satellite short-range wireless communication can use onboard Wi-Fi 6, LoRa (Long Range Radio), or other wireless communication technologies to meet the lightweight requirements of miniaturized satellites.

[0063] Please refer to Figures 1 and 2 together. The satellite component 1 includes: a power module 11, an attitude module 12, an orbit control module 13, and a thermal control module 14. The power module 11 is connected to the satellite computer 2, the satellite black box 3, the attitude module 12, the orbit control module 13, and the thermal control module 14 via a low-speed transmission bus to provide operating voltage. The attitude module 12 is connected to the satellite computer 2 and the satellite black box 3 via a low-speed transmission bus to detect the satellite's current attitude and output satellite attitude signals to the satellite computer 2 and the satellite black box 3, and to control the attitude according to the attitude commands output by the satellite computer 2. The satellite attitude is adjusted. The orbit control module 13 is connected to the satellite computer 2 and the satellite black box 3 via a low-speed transmission bus. It is used to detect the satellite's current spatial position and orbital altitude, output spatial position information and orbital information to the satellite computer 2 and the satellite black box 3, and adjust the orbit according to the orbit control commands output by the satellite computer 2. The thermal control module 14 is connected to the satellite computer 2 and the satellite black box 3 via a low-speed transmission bus. It is used to detect the satellite temperature, output satellite temperature signals to the satellite computer 2 and the satellite black box 3 respectively, and adjust the satellite temperature according to the thermal control commands output by the satellite computer 2.

[0064] Specifically, in this preferred embodiment, the component data signals include: operating voltage, operating current, satellite attitude signal, spatial position information, orbit information, and satellite temperature signal. Each component data signal is transmitted to the satellite computer 2 via a low-speed transmission bus and managed by the satellite computer 2. Therefore, the satellite black box 3 can collect information generated by the satellite components during satellite operation by monitoring the low-speed transmission bus. The satellite component 1 includes modules for basic functions such as energy supply, attitude control, propulsion, and temperature control. Other low-speed payloads on the satellite are configured in the same way as the satellite components, connecting and communicating with the satellite computer and the satellite black box to perform data processing and control functions. It should also be noted that the modules inside satellite component 1 and the modules inside satellite payload 4 can be connected to the low-speed transmission bus and the high-speed transmission bus, or some modules connected to the low-speed transmission bus can be merged and upgraded and then transmitted through the high-speed transmission bus, or some modules connected to the high-speed transmission bus can be split according to function and then transmitted through the low-speed transmission bus, and stored and backed up by the satellite black box 3. That is, the modules connected to the high-speed transmission bus and the low-speed transmission bus can be adjusted according to actual needs, which will not be elaborated here.

[0065] Satellite payload 4 may include instruments, equipment, or systems on the satellite used to perform specific tasks. It is a core functional part of the satellite and is mainly divided into communication payloads, remote sensing payloads, and navigation payloads. When the satellite is operating, the data information generated by the operation of each satellite payload 4 and each functional module on satellite component 1 communicates with the satellite computer 2. The satellite computer 2 receives the current status of each satellite component and sends commands to control the satellite components. The satellite black box 3 is connected to the common terminal of satellite component 1 and satellite computer 2, and the common terminal of satellite payload 4 and satellite computer 2, respectively, to implement non-intrusive monitoring and store and record the data information generated during operation. Thus, this solution combines the traditional high-speed / low-speed bus architecture of satellites with the modular development trend of commercial aerospace to design an integrated system architecture adapted to the recorder. It adopts a classified acquisition method for different types of onboard components to realize the independent satellite behavior recording function of the third-party satellite black box 3. By independently collecting and storing data such as satellite bus commands, component responses, and payload parameters, it provides support for reliable management throughout the entire life cycle.

[0066] In some preferred embodiments, the satellite computer collects non-bus data output by the satellite payload 4 and / or satellite component 1, and forwards the non-bus data to the satellite black box 3, or directly connects to the satellite black box 3 for direct point-to-point transmission. The satellite black box 3 is connected to each of the satellite payloads 4 via I / O ports, etc., to collect and store the non-bus data, and to collect the non-bus data directly transmitted by each of the satellite payloads 4 via I / O ports, etc. The modules on the satellite payloads 4 and satellite component 1 can also establish a dedicated point-to-point data channel with the satellite computer 2 for transmitting non-bus data. This non-bus data is not transmitted through a high-speed transmission bus or a low-speed transmission bus, but is directly transmitted to the satellite computer 2 through this dedicated data channel, and then forwarded by the satellite computer 2. In this preferred embodiment, the present invention uses the satellite-rocket separator 15 as an example to illustrate the transmission method of non-bus data: Specifically, the satellite component 1 also includes a satellite-rocket separator 15, which communicates with the satellite service computer 2 via a PPS signal and / or with the satellite black box 3 via an I / O signal. The satellite-rocket separator 15 is used to output a separation signal when the satellite separates from the rocket. After detecting the separation signal output by the satellite-rocket separator 15, the satellite black box 3 begins to collect and store the recorded data. And / or, when the satellite service computer detects the separation signal output by the satellite-rocket separator and / or the power-on start signal output by the satellite service computer, it forwards the separation data information to the satellite black box. After detecting the separation data information forwarded by the satellite service computer 2, the satellite black box 3 begins to collect and store the recorded data.

[0067] Specifically, the satellite-rocket separator 15 is used to connect to the rocket and drive the satellite and rocket to separate when the satellite enters its operational orbit. The satellite-rocket separator 15 can use an electrical connector for separation or a mechanical structure for separation. The satellite-rocket separator 15 is connected to the satellite black box 3 via PPS or IO protocol. After the satellite separates from the rocket, the satellite enters its operational orbit and begins operation. To ensure that the satellite black box 3 can obtain complete satellite behavior, the satellite black box 3 senses the satellite's separation from the rocket, which is the starting point of the satellite's own operation. Therefore, the satellite black box 3 starts operating immediately upon detecting the separation signal emitted during separation and records the on-board behavior. The satellite-rocket separator 15 and the satellite black box 3 are connected point-to-point without any bus, thus enabling non-bus data transmission between them. The satellite-rocket separator 15 can directly output a separation signal. When the satellite black box 3 receives this separation signal, it can know that the satellite and rocket have separated and begin power-on operation. For example, the separation signal is an IO signal. Correspondingly, in another preferred embodiment, the separated data information can also be transmitted using PPS signals. Since some satellite black boxes 3 cannot receive PPS signals, the separated data information needs to be relayed by the satellite service computer 2. Specifically, the satellite-rocket separator 15 is connected to the satellite service computer 2 and transmits the PPS signal to the satellite service computer 2 when satellite-rocket separation occurs. The satellite service computer 2 backs up and stores the signal and generates forwarding work data. The forwarding work data is then sent to the satellite black box 3 via a low-speed transmission bus, so that the satellite black box 3 can directly obtain the corresponding data.

[0068] In some preferred embodiments of the present invention, since the data transmission volume of satellite payload 4 is large, it can use a high-speed transmission bus for data transmission. Satellite payload 4 can be a remote sensing payload, or it can include other payload types such as navigation payloads, communication payloads, and scientific payloads, which will not be elaborated further here. The satellite control system also includes a switch 42, which is connected to the high-speed transmission bus and used to allocate IP addresses to the satellite payload, the satellite service computer 2, and the satellite black box 3 on the high-speed transmission bus. The satellite payload 4 includes at least one high-speed communication payload. If there are few devices, point-to-point cross-connections can be used. Typical high-speed devices on a satellite include satellite communication modules and space camera modules 41. The satellite communication module communicates via a low-speed transmission bus and also connects to the satellite service computer and the satellite black box via a high-speed transmission bus for satellite-to-ground communication, completing functions such as telemetry, tracking, and command (TT&C) and data transmission. The space camera connects to the satellite service computer and the satellite black box via a high-speed transmission bus for satellite-to-ground communication, completing functions such as space photography and video recording.

[0069] This invention uses the implementation of ground, atmospheric, or space observation functions as an example to illustrate the working process of satellite payload 4: Satellite payload 4 includes a space camera module 41, which is connected to the satellite computer 2 and the satellite black box 3 via a high-speed transmission bus. It is used to perform space photography and generate high-speed payload information, which is image data information. The image data information is transmitted via the high-speed transmission bus. The recorded data stored in the satellite black box 3 also includes image data information. The satellite communication module is directly connected to the satellite black box 3 via a high-speed transmission bus and / or a low-speed transmission bus. When connected to a ground gateway station, the satellite black box 3 transmits recorded data to the satellite communication module. The satellite communication module is used to download the recorded data to the ground gateway station. Some high-speed transmission bus devices have independent control lines. For example, the data bus of the space camera module 41 is a high-speed transmission bus, and its control line can use an independent low-speed transmission bus to transmit control information, or it can directly transmit control information via a high-speed transmission bus. Other satellite high-speed payloads have the same connection relationship as the above-mentioned equipment. They can directly connect and communicate with the satellite computer 2 and the satellite black box, or they can connect point-to-point through the switch 42 to perform data processing and control functions.

[0070] The space camera module 41 is connected to the satellite computer 2 and is used to acquire external space images and transmit image data information to the satellite computer 2 via a high-speed transmission bus. The satellite black box 3 then monitors the image data information through the high-speed transmission bus. Specifically, the space camera module 41 can also be connected to the satellite computer 2 via a CameraLink transmission line, or it can use professional interfaces such as CoaXPress for image data information transmission to adapt to the new generation of spaceborne cameras. Specifically, the image data information includes at least remote sensing images. The space camera module 41 is used to acquire and record remote sensing images and directly analyze the recorded remote sensing images. After the remote sensing images and analysis results are stored in its own components, they are directly transmitted to the satellite communication module 5 and sent to the gateway station. The generated data does not communicate with the satellite computer 2. Furthermore, its image data information can include all the image information acquired by the space camera module 41, or it can be a portion of the data information, which can be adjusted according to differences in data sensitivity. For example, if the satellite manufacturer believes that the image data contains sensitive information and is not suitable for being stored entirely in a satellite black box 3 set up by a third party, then the satellite black box 3 can select sampled data from the image data and encrypt the sampled data segments using encryption algorithms such as MD5 before storing them, so as to meet the confidentiality requirements while monitoring and recording the image data.

[0071] Furthermore, when multiple high-speed communication payloads exist, the high-speed communication bus on the satellite can use a switch as the bus controller to complete the connection, routing settings, and data exchange of all high-speed devices. The satellite payload 4 may include a switch 42, and the space camera module 41 is connected to the switch 42, accessing the high-speed transmission bus through the switch 42 and connecting to the satellite black box 3 through the high-speed transmission bus. The switch 42, connected to the high-speed transmission bus, is used to allocate IP addresses to the satellite payload 4, the satellite computer 2, and the satellite black box 3 on the high-speed transmission bus, and is used for data exchange and routing settings of various high-speed devices on the satellite.

[0072] In a preferred embodiment of the present invention, as shown in FIG5, the space camera module is also connected to the satellite black box 3 via a low-speed transmission bus; the space camera module 41 outputs control information to the satellite black box 3 via the low-speed transmission bus; the recorded data stored in the satellite black box 3 also includes control information. The satellite black box 3 is connected to the low-speed transmission bus. When the space camera module 41 needs to acquire remote sensing images, the space station computer 2 sends control information to the space camera module 41 via the low-speed transmission bus. Due to the large amount of image data and high bandwidth requirements, the satellite black box 3 detects the control information output by the space station computer 2 via the low-speed transmission bus. The space camera module 41 then outputs the image data information to the space station computer 2 via a high-speed transmission bus. The space station computer 2 forwards the image data information to the satellite black box 3. The image data information can be the data information of all remote sensing images or the data information of a portion of the remote sensing images. It should be noted that the satellite black box 3 can also collect control information from the space camera module 41 only through a low-speed transmission bus, without monitoring image data information, thereby meeting the data confidentiality requirements.

[0073] In a preferred embodiment of the present invention, the satellite control system further includes a satellite communication module 5, which is connected to the satellite black box 3 via a high-speed transmission bus; when connected to a ground gateway station, the satellite black box 3 transmits recorded data to the satellite communication module 5; the satellite communication module 5 is used to download the recorded data to the ground gateway station.

[0074] The satellite communication module 5 includes a satellite communication unit, which is used to communicate with ground telemetry and control stations or gateway stations, upload control commands, and send data and results. The satellite communication module 5 is directly connected to the satellite black box 3, ensuring that the data stored and transmitted by the satellite black box 3 does not directly communicate with the satellite service computer 2, maintaining third-party independence. The satellite black box 3 is connected to the satellite communication module 5. When the satellite black box 3 is working, it collects and stores recorded data on the high-speed and low-speed transmission buses, and outputs the recorded data to the satellite communication module 5 after establishing satellite-to-ground data interaction. The recorded data includes component data signals, component control commands, forwarding work data, payload data signals, payload control commands, and satellite service work data on the high-speed and low-speed transmission buses, and may also include other information not transmitted via the buses. The satellite communication module 5 is used to transmit recorded data to the ground for backup. Specifically, when connected to a ground gateway station, the satellite communication module 5 is used to download recorded data from the previous time period to the ground gateway station and upload control commands provided by the ground gateway station. When communicating with the ground gateway station, the satellite communication module 5 actively downloads the recorded data from the previous time period of the satellite black box 3 to the ground gateway station, completing ground backup of the on-board data. To maintain the independence of the satellite black box 3 from third parties, the satellite black box 3 is directly connected to the satellite communication module 5, and data is uploaded and downloaded between the satellite black box 3 and the ground gateway station through a dedicated data channel in the satellite communication module 5. When the satellite mission computer malfunctions, the satellite black box 3 can still operate independently and perform data upload and download normally, unaffected by the malfunction of the mission computer, preventing data loss or failure to download data to the ground gateway station, and also preventing abnormal operations such as hacker attacks from causing the satellite black box to be unable to detect abnormal operations. The ground gateway station can also transmit a clear command to the satellite communication module 5, and the satellite communication module 5 transmits the clear command to the satellite black box 3; the satellite black box 3 can also respond to control commands from the ground gateway station to clear part or all of the data stored inside the satellite black box 3.

[0075] In a further embodiment of the present invention, please refer to Figures 1 to 4 together. As shown in Figure 3, the low-speed transmission bus includes at least one master-slave bus, which includes a master receiver bus and a slave receiver bus. The transmitter TX11 of the satellite black box is connected to the master receiver bus, and the receiver of the satellite black box is connected to both the slave receiver bus and the master receiver bus. The satellite black box is used to receive low-speed bus information transmitted on the master-slave bus. The satellite computer 2, as the master device, has its transmitter connected to the slave receiver bus and its receiver connected to the master receiver bus. Other satellite payloads 4 and satellite components 1, as slave devices, have their receivers connected to the slave receiver bus and their transmitters connected to the master receiver bus. The master-slave bus can be an RS series bus, preferably an RS422 bus. The master receiver RX12 and slave receiver RX11 of the satellite black box 3 are connected to the master receiver bus and slave receiver bus, respectively. The satellite black box 3 can act as a slave device to record signal data emitted by the satellite computer 2 (acting as the master), and as a master device to collect signals and data emitted by the satellite payload 4 and satellite components 1 (acting as slaves). It can receive control commands from the master to all slave devices and monitor feedback commands sent from other slave devices to the master. When low-speed bus information is detected from the master-slave bus, the satellite computer, acting as the master, connects to the master-slave bus and controls the slave devices or modules connected to it. Thus, the satellite black box 3 can receive control commands from the master to all slave devices on the master-slave bus and monitor feedback commands sent from other slave devices to the master.

[0076] Furthermore, the low-speed transmission bus includes at least one peer-to-peer bus; wherein, the peer-to-peer bus includes a peer-to-peer transmit bus and a peer-to-peer receive bus; as shown in Figure 4, the peer-to-peer transmit terminal TX01 of the satellite black box 3 is connected to the peer-to-peer transmit bus, and the peer-to-peer receive terminal RX01 of the satellite black box 3 is connected to the peer-to-peer receive bus of the peer-to-peer bus. The satellite black box 3 is a full-address device used to receive low-speed bus information transmitted on the peer-to-peer bus; for example, the peer-to-peer bus can be a CAN bus. The peer-to-peer bus adopts a peer-to-peer network, that is, in the peer-to-peer bus, the satellite black box 3 can directly communicate with multiple satellite payloads 4 and multiple modules on satellite components 1 without the need for host or central processing unit management. Therefore, the satellite black box 3 only needs to receive all data information on the peer-to-peer bus through the peer-to-peer receive terminal. Preferably, the peer-to-peer bus can use twisted-pair cable, and the bus level is represented by the voltage difference between the transmitted differential signals to transmit information through differential signals, which has the characteristics of strong anti-interference ability and effective suppression of external electromagnetic interference. When the satellite black box senses bus data, it is always in a listening state in a peer-to-peer network environment. For example, in the CAN bus, the device address of the satellite black box 3 is a full address, so it can receive and store all data packets on the bus.

[0077] In a preferred embodiment of the present invention, the satellite computer 2 and the satellite black box 3 are connected via an I / O port protocol. When the satellite black box 3 is working, it generates a working heartbeat signal. The satellite computer 2 is used to detect the working heartbeat signal and confirm the working status of the satellite black box 3. The satellite black box 3 is connected to the satellite service computer 2 via a set of I / O interfaces to enable bidirectional communication between the two. When the satellite black box 3 is working normally, it outputs a predetermined square wave communication signal as a working heartbeat signal to the satellite service computer 2 through the I / O interface. Correspondingly, when the satellite service computer 2 is working normally, it outputs another predetermined square wave communication signal as a working heartbeat signal to the satellite black box 3. Thus, the satellite service computer 2 and the satellite black box 3 can sense whether they are working normally. The satellite black box 3 is used to record the working status of the satellite service computer 2 based on the working heartbeat signal transmitted by the satellite service computer. The satellite service computer is used to detect the working status of the satellite black box 3 based on the working heartbeat signal transmitted by the satellite black box 3. If the working status of the satellite black box 3 is abnormal, it controls it to restart and recover. Correspondingly, when the working state of the satellite computer 2 is abnormal, the satellite black box 3 can work independently and record the abnormal working state of the satellite computer 2 for use in downlinking to the ground gateway station and subsequent abnormal obstacle handling.

[0078] Furthermore, the satellite component 1 also includes an attitude module 12, an orbit control module 13, and a thermal control module 14. The attitude module 12 is connected to the satellite computer 2 and the satellite black box 3 via a low-speed transmission bus. It detects the satellite's current attitude, outputs satellite attitude signals to the satellite computer 2 and the satellite black box 3, and adjusts the satellite attitude according to attitude control commands output by the satellite computer 2. The orbit control module 13 is connected to the satellite computer 2 and the satellite black box 3 via a low-speed transmission bus. It detects the satellite's current spatial position and orbital altitude, outputs spatial position information and orbital information to the satellite computer 2 and the satellite black box 3, and adjusts the orbit according to orbit control commands output by the satellite computer 2. The thermal control module 14 is connected to the satellite computer 2 and the satellite black box 3 via a low-speed transmission bus. It detects the satellite temperature, outputs satellite temperature signals to the satellite computer 2 and the satellite black box 3 respectively, and adjusts the satellite temperature according to thermal control commands output by the satellite computer 2. The attitude control system, including sensors and actuators, senses the current attitude of the satellite through gyroscopes, sun sensors, star sensors, etc., and adjusts the attitude through actuators such as magnetic torquers and momentum wheels. The satellite senses its current spatial position and orbital altitude through GNSS and other means, and adjusts its orbit through thrusters; the satellite also has a thermal control sensing and adjustment system. The satellite component 1 also includes a power module 11, which is connected to the satellite computer 2, satellite communication module 5, satellite black box 3, and satellite payload 4, respectively, and is used to provide operating voltage. The power module 11 provides energy to all components on the entire satellite platform and performs charging and discharging control.

[0079] In a further embodiment of the present invention, the satellite black box detects the transmission addresses of the component data signals, component control commands, forwarding work data, payload data signals, payload control commands, and satellite service work data, and selects an encryption algorithm to encrypt the component data signals, component control commands, forwarding work data, payload data signals, payload control commands, and satellite service work data according to the transmission addresses. The encryption algorithm employs at least one of symmetric encryption algorithms, asymmetric encryption algorithms, or hash algorithms, and the satellite black box selects an encryption algorithm with the same key or a different key based on the transmission address. For example, it can be one or more of symmetric algorithms such as DES, 3DES, and AES, asymmetric algorithms such as RSA and DSA, or hash algorithms such as SHA-1 and MD5. Specifically, when the satellite black box is working, it can find the corresponding component or load of the output recording data by looking up the ID address of the component data signal and component control command on the low-speed transmission bus, and the IP address of the load data signal and load control command on the high-speed transmission bus. Then the satellite black box can predetermine the encryption algorithm selected for the corresponding ID address or IP address, and use the corresponding encryption algorithm when detecting the corresponding ID address or IP address, thereby setting different encryption methods for different components or loads.

[0080] Similarly, based on the same inventive concept, the present invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the satellite control method described above. Specific details are as described in a particular embodiment of a satellite control method, and will not be repeated here.

[0081] This invention provides a satellite control method, a satellite control system, and a computer-readable storage medium. The satellite control method includes the following steps: when the satellite starts operating in orbit, the satellite black box performs power-on initialization; in one cycle, the satellite black box initiates a data acquisition process, obtains and stores recorded data; triggers satellite-to-ground data interaction, and when a satellite fault is detected, the satellite black box controls the satellite communication module to download recorded data within a first predetermined length before the fault to the ground gateway station; otherwise, the recorded data is downloaded to the ground gateway station in chronological order; detects whether the ground gateway station sends a control command; if the ground gateway station sends a control command, the satellite black box responds and executes the control command; the satellite black box performs a self-test, and if the self-test result is abnormal, it performs an anomaly alarm and enters the next cycle. This invention reduces the interference of other routine data information on fault investigation in emergency situations by prioritizing the download of recorded data within a first predetermined length before the fault occurs, shortens the tracing time, and improves the efficiency of troubleshooting after a satellite fault occurs.

[0082] It should be understood that the application of the present invention is not limited to the examples above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A satellite control method, characterized in that, The steps include: When the satellite starts operating in orbit, the satellite black box performs power-on initialization; During one cycle, the satellite black box initiates a data acquisition process to obtain and store recorded data. Triggering satellite-to-ground data interaction, when a satellite malfunction is detected, the satellite black box controls the satellite communication module to download the recorded data within a first defined length before the malfunction to the ground gateway station; Otherwise, the recorded data is transmitted to the ground gateway station in chronological order; the system checks whether the ground gateway station sends control commands. If the ground gateway station sends a control command, the satellite black box responds to and executes the control command; the satellite black box performs a self-test, and if the self-test result is abnormal, it performs an abnormal alarm and enters the next cycle.

2. The satellite control method according to claim 1, characterized in that, The steps for powering on and initializing the satellite black box during satellite startup and on-orbit operation include: powering on and starting the satellite black box when a separation signal output by the satellite-rocket separator and / or a power-on start signal output by the satellite's onboard computer are detected; detecting the heartbeat signal; if the satellite black box and the onboard computer maintain bidirectional heartbeat signal interaction, the satellite black box and the onboard computer operate normally; if the bidirectional heartbeat signal between the satellite black box and the onboard computer is interrupted, the satellite black box automatically restarts and re-detects the bidirectional heartbeat signal; if the bidirectional heartbeat signal between the satellite black box and the onboard computer is interrupted after the automatic restart, the onboard computer is triggered to reset the satellite black box.

3. The satellite control method according to claim 1, characterized in that, In one cycle, the steps of the satellite black box initiating a data acquisition process to obtain and store recorded data include: controlling the satellite black box to monitor bus data and non-bus data to obtain working data information; encrypting the working data information to obtain recorded data, the recorded data including encrypted data and a check value; and performing dual-chip redundant storage for the encrypted data and the check value.

4. The satellite control method according to claim 3, characterized in that, The steps for controlling the satellite black box to monitor bus data and non-bus data to obtain working data information include: the satellite computer collecting working information from each satellite module and forwarding it to the satellite black box; the satellite black box collecting and storing high-speed bus information from the high-speed transmission bus and low-speed bus information from the low-speed transmission bus to obtain bus data; the satellite black box collecting and storing two-point data information transmitted by each satellite module through the point-to-point interface, as well as working information forwarded by the satellite computer to obtain non-bus data; and the satellite black box integrating these into working data information and storing it.

5. The satellite control method according to claim 1, characterized in that, The step of triggering satellite-to-ground data interaction, in which the satellite black box controls the satellite communication module to download recorded data within a first predetermined length prior to the fault to the ground gateway station when a satellite fault is detected, includes: the satellite communication module and the ground gateway station completing a protocol handshake to trigger satellite-to-ground data interaction; when a satellite fault is detected, the satellite communication module prioritizes downloading recorded data from the hour prior to the fault or the previous orbit to the ground gateway station; when the satellite is detected to be operating normally, the satellite communication module downloads recorded data within a preset periodic time frame to the ground gateway station in chronological order.

6. The satellite control method according to claim 1, characterized in that, The detection system checks whether the ground gateway station sends control commands. If a ground gateway station sends a control command, the steps for the satellite black box to respond to and execute the control command include: detecting whether the ground gateway station has issued a control command; When the ground gateway station outputs a data clearing command, the satellite black box deletes the stored record data according to the data clearing command; when the ground gateway station outputs an on-orbit upgrade command, the satellite black box performs a software upgrade according to the on-orbit upgrade command.

7. The satellite control method according to claim 1, characterized in that, The satellite black box performs a self-test, and when the self-test result is abnormal, it issues an alarm and proceeds to the next cycle. The steps include: if the ground gateway station does not issue a control command, it checks whether the satellite black box is abnormal, and if no abnormality is found, it proceeds to the next cycle; if the satellite black box is abnormal, it automatically sends an alarm signal and records an anomaly log, while simultaneously performing self-recovery; it obtains and stores the recorded data based on the anomaly log, and transmits it to the ground gateway station via a priority channel; if the satellite black box fails to self-recover, an unrecoverable fault occurs, and the satellite's on-orbit operation terminates.

8. The satellite control method according to claim 3, characterized in that, The step of encrypting work data information to obtain recorded data, wherein the recorded data includes encrypted data and a verification value, includes: reading the address information of the work data information and determining the output module information of the work data information; classifying the work data information according to the output module information and determining the available encryption algorithm for the work data information; encrypting the work data information using the available encryption algorithm to obtain recorded data, wherein the recorded data includes encrypted data and a verification value.

9. A satellite control system for implementing the satellite control system operation method as described in any one of claims 1 to 8, characterized in that, It includes a satellite black box and a satellite communication module; wherein, the satellite black box is used to collect and record data from the satellite and encrypt the recorded data; the satellite communication module is used to transmit the recorded data to the ground gateway station and receive control commands sent by the ground gateway station.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the satellite control method as described in any one of claims 1 to 8.

Images