Hall electric propulsion controller based on dual redundancy and control method thereof

Abstract

The invention provides a Hall electric propulsion controller based on dual redundancy and a control method thereof. The controller comprises a first main control unit, a second main control unit, a first power processing unit, a second power processing unit, a first flow control unit and a second flow control unit; the first main control unit and the second main control unit are respectively provided with two paths of independent control signals which are respectively connected with and control the first power processing unit and the second power processing unit; the first main control unit and the second main control unit are respectively connected with and control the first flow control unit and the second flow control unit; when one of the first main control unit and the second main control unit breaks down, the other main control unit takes over and controls the first power processing unit, the second power processing unit, the first flow control unit and the second flow control unit.

Description

Technical Field

[0001] This invention relates to the field of spacecraft electric propulsion technology, specifically to a dual-redundant Hall electric propulsion controller and its control method. Background Technology

[0002] In the field of aerospace satellite platforms, electric propulsion systems are increasingly becoming the core power source for orbit maintenance, attitude adjustment, and even deep space exploration missions due to their advantages of high specific impulse and long lifespan. As the "brain" and "central hub" of the electric propulsion system, the Power Processing and Control Unit (PPCU) is responsible for the critical tasks of precisely controlling the thruster ignition timing, propellant flow regulation, and power conversion. Its reliability is directly related to the success of the satellite mission and its overall lifespan.

[0003] However, spacecraft operate in extremely harsh space environments (e.g., single-event upsets, total dose effects, extreme temperature cycling), and are often left unattended for extended periods, posing severe challenges to the fault tolerance of electronic systems. Traditional single-controller designs are prone to single-point-of-failure risks; a failure in such a system could paralyze the entire propulsion system, threatening satellite safety.

[0004] The traditional Hall thruster control unit (PPCU) used in current aerospace satellite platforms has significant shortcomings in its system-level redundancy architecture. The core issues lie in the vulnerability of the control link and insufficient backup of critical resources. Specifically: First, the risk of single-point failure in the core control unit is significant. Most existing Hall effect electric propulsion controllers employ a single master control unit (typically a single microprocessor or simple logic circuit) responsible for instruction parsing, timing scheduling, status monitoring, and driving the power processing unit (PPU) / flow control unit. In this architecture, the master control unit becomes an irreplaceable single point of failure. If this unit fails due to space radiation (such as single-event lockout, rollover, etc.), component aging, or design flaws, the entire Hall effect electric propulsion controller (PPCU) will completely lose its function. Regardless of the downstream power processing or flow control unit's functionality, the system will fall into a state of global uncontrollability, losing thrust regulation capability and posing a direct threat to the satellite mission.

[0005] Secondly, the control link lacks redundancy, and failure in this link leads to system paralysis. Closely related to the single point of failure of the main control unit, the transmission paths of control commands (such as buses and critical control signals) often lack effective physical or logical redundancy. Once the control link from the main control unit to the PPU and flow control unit is interrupted or interfered with, even if each execution unit itself is functioning normally, it will be unable to receive correct commands and operate, and the system function will also be interrupted.

[0006] Furthermore, most Hall effect propulsion controllers (PPCUs) currently employ a partial module backup redundancy design, such as high-power anode power supplies and cathode ignition power supplies. However, this localized and limited hardware backup can only prevent failures in that specific component and cannot cover or resolve system-level faults. The partial module backup redundancy scheme is completely incapable of handling main control unit failures, PPU failures in the cathode power output section, flow control unit failures, or more complex systemic faults. When the main control unit fails, even if the backup anode power module is available, it cannot operate due to the lack of effective control signals.

[0007] In summary, traditional Hall thruster controllers (PPCUs) suffer from problems such as single-point failure of the control unit, lack of redundancy in the control link, and insufficient system-level fault response capabilities. There is an urgent need to develop a Hall thruster controller architecture design with high reliability and redundancy fault tolerance. Summary of the Invention

[0008] The objective of this invention is to provide a Hall-effect electric propulsion controller and its control method based on dual redundancy. Through the controller and / or control method, the problems of insufficient redundancy in the control link and inadequate system-level fault response capability in the prior art are solved, and the reliability and fault tolerance of the system are significantly improved.

[0009] In a first aspect of the invention, the aforementioned task is solved by a dual-redundant Hall electric propulsion controller, the controller comprising: The system comprises a first main control unit, a second main control unit, a first power processing unit, a second power processing unit, a first flow control unit, and a second flow control unit; Both the first main control unit and the second main control unit are equipped with two independent control signals. The control signals include a level signal for start / stop control and a PWM signal for power regulation, which are respectively connected to and control the first power processing unit and the second power processing unit. The first main control unit and the second main control unit are respectively connected to and control the first flow control unit and the second flow control unit; When one of the first and second main control units fails, the other main control unit takes over and controls the first power processing unit, the second power processing unit, the first flow control unit, and the second flow control unit.

[0010] In one embodiment of the present invention, the first main control unit and the second main control unit are identical in hardware, software and function; the primary and backup identities of the first main control unit and the second main control unit are fixedly configured by the spacecraft computer according to the power-on command.

[0011] In one embodiment of the present invention, both the first main control unit and the second main control unit adopt an FPGA+ARM architecture; the FPGA is used to implement hardware parallel timing control for ignition pulse generation, flow valve logic control and sensor signal acquisition; the ARM is used to execute the flow PID algorithm.

[0012] In one embodiment of the present invention, the Hall-effect electric propulsion controller based on dual redundancy supports cold backup mode and hot backup mode; and supports continued operation in a degraded mode with a single main control unit, a single power processing unit, and a single flow control unit.

[0013] In one embodiment of the present invention, both the first master control unit and the second master control unit establish bidirectional communication with the spacecraft computer via a CAN bus; the spacecraft computer is used to monitor the status of the first master control unit and the second master control unit; when the spacecraft computer determines that the currently working master control unit has failed, it performs a switching operation and sends status information to the master control unit that takes over the work, so as to achieve work handover.

[0014] In a second aspect of the invention, the aforementioned task is also solved by a control method based on a dual-redundant Hall electric propulsion controller, the control method using the aforementioned dual-redundant Hall electric propulsion controller, the control method comprising the following steps: When the controller is powered on, it determines the first or second main control unit as the current working main control unit. The current working main control unit controls the first power processing unit and / or the second power processing unit through two independent control signals; The current working master control unit synchronously controls the first flow control unit and / or the second flow control unit; and When the spacecraft computer determines that the current main control unit is faulty, it performs a switching operation, and another main control unit takes over the control of the controller.

[0015] In one embodiment of the present invention, the control method based on a dual-redundant Hall electric propulsion controller further includes a power processing unit switching step: When the current working main control unit detects that the first power processing unit or the second power processing unit has failed, it will feed back the fault status to the space service computer. The spacecraft computer determines the fault code and sends instructions to the current main control unit; and The currently operating main control unit automatically switches to a healthy power processing unit to continue working according to the instruction.

[0016] In one embodiment of the present invention, the control method based on a dual-redundant Hall electric propulsion controller further includes a flow control unit switching step: When the current working master control unit detects that the first flow control unit or the second flow control unit has failed, it automatically switches to the healthy flow control unit to continue working through a fast switching circuit based on FPGA hardware logic.

[0017] In a third aspect, the present invention also provides a spacecraft electric propulsion system, including the aforementioned dual-redundant Hall electric propulsion controller.

[0018] The technical solution provided by this invention has the following advantages: 1) The Hall-effect electric propulsion controller proposed in this invention employs a dual-redundancy architecture with two SOC chips (FPGA+ARM) as the main control unit, constructing a master-backup mode. Even if one SOC chip fails, the other SOC chip can quickly take over the controller, ensuring the electric propulsion controller operates normally. This design greatly enhances the system's reliability and fault tolerance, reducing the risk of satellite failure due to propulsion system malfunctions.

[0019] 2) The Hall-effect electric propulsion controller based on dual redundancy proposed in this invention allows any single SOC chip, i.e., the main control unit, to control the first power processing unit, the second power processing unit, the first flow control unit, and the second flow control unit, achieving comprehensive and flexible control of the power processing unit and the flow control unit. In actual operation, when a power processing unit or flow control unit malfunctions, the main control unit can quickly adjust the control strategy and switch to the backup unit to continue working, ensuring the stable operation of the propulsion system.

[0020] 3) The Hall-effect electric propulsion controller based on dual redundancy proposed in this invention features two independent control signals for each of the first or second main control units, allowing direct control of the first and second power processing units respectively. This design breaks through the fixed binding relationship between the main control unit and the power processing unit in traditional Hall-effect electric propulsion controllers, enabling parallel control of both power processing units by any main control unit. This provides a dual-redundant control link for the core power supply, significantly reducing the risk of system failure due to control link interruption.

[0021] 4) The Hall-effect electric propulsion controller based on dual redundancy proposed in this invention has a first or second main control unit capable of synchronously controlling the first and second flow control units. Through an integrated drive signal output interface, a single main control unit can simultaneously send control commands to both the first and second flow control units, ensuring real-time synchronization of flow regulation commands. This design allows the controller to maintain a hot redundancy state for both flow control units under normal conditions, significantly improving fault response speed.

[0022] 5) The Hall-effect electric propulsion controller based on dual redundancy proposed in this invention can be configured in both cold backup and hot backup modes. The controller supports continued operation in degraded modes with a single main control unit, a single power processing unit, and a single flow control unit. That is, the main and backup units can complement each other and their functions are not limited, which greatly improves the system's task adaptability. Attached Figure Description

[0023] To further illustrate the above and other advantages and features of the various embodiments of the present invention, a more specific description of the various embodiments of the present invention will be presented with reference to the accompanying drawings. It is to be understood that these drawings depict only typical embodiments of the invention and are therefore not intended to limit its scope. In the drawings, identical or corresponding parts will be indicated by identical or similar reference numerals for clarity.

[0024] Figure 1 A schematic diagram of the architecture of a dual-redundant Hall electric propulsion controller according to an embodiment of the present invention is shown; Figure 2 A schematic diagram of the signal flow of a dual-redundant Hall electric propulsion controller according to an embodiment of the present invention is shown. Figure 3 A schematic diagram of the drive circuit for synchronously controlling the first flow control unit and the second flow control unit according to an embodiment of the present invention is shown; and Figure 4 A flowchart illustrating a control method based on a dual-redundant Hall electric propulsion controller according to an embodiment of the present invention is shown. Detailed Implementation

[0025] In the following description, the invention is described with reference to various embodiments. However, those skilled in the art will recognize that the embodiments may be practiced without one or more specific details or with other alternatives and / or additional methods or components. In other instances, well-known structures or operations are not shown or described in detail so as not to obscure the inventive points of the invention. Similarly, for illustrative purposes, specific numbers and configurations are set forth to provide a comprehensive understanding of the embodiments of the invention. However, the invention is not limited to these specific details.

[0026] In this specification, references to "an embodiment" or "this embodiment" mean that a particular feature, structure, or characteristic described in connection with that embodiment is included in at least one embodiment of the invention. The phrase "in one embodiment" appearing throughout this specification does not necessarily refer to the same embodiment in all instances.

[0027] It should be noted that the embodiments of the present invention describe the method steps in a specific order; however, this is only for illustrating the specific embodiment and not for limiting the order of the steps. On the contrary, in different embodiments of the present invention, the order of the steps can be adjusted according to actual needs.

[0028] In this invention, the modules or units of the system according to the invention can be implemented using software, hardware, firmware, or a combination thereof. When a unit is implemented using software, its function can be implemented through computer program flow. For example, the unit can be implemented using code segments (such as code segments in languages ​​like C and C++) stored in a storage device (such as a hard disk, memory, etc.), wherein the corresponding function of the unit can be implemented when the code segment is executed by a processor. When a unit is implemented using hardware, its function can be implemented by setting a corresponding hardware structure. For example, the function of the unit can be implemented by hardware programming a programmable device such as a field-programmable gate array (FPGA), or by designing an application-specific integrated circuit (ASIC) that includes multiple transistors, resistors, capacitors, and other electronic devices. When a unit is implemented using firmware, the function of the unit can be written into a read-only memory such as an EPROM or EEPROM in the form of program code, and the corresponding function of the unit can be implemented when the program code is executed by a processor. In addition, some functions of the unit may need to be implemented by separate hardware or by cooperation with said hardware. For example, the detection function is implemented by corresponding sensors (such as proximity sensors, accelerometers, gyroscopes, etc.), the signal transmission function is implemented by corresponding communication devices (such as Bluetooth devices, infrared communication devices, baseband communication devices, Wi-Fi communication devices, etc.), the output function is implemented by corresponding output devices (such as displays, speakers, etc.), and so on.

[0029] This invention first provides a Hall electric propulsion controller based on dual redundancy. It adopts a main-backup cross-redundancy design concept and uses a high-performance dual SOC chip (integrating FPGA logic processing capabilities and ARM processor control advantages) as the main control unit. It combines dual power processing units and dual flow control units to build the system, and realizes that any SOC main control unit can seamlessly take over and control the main and backup power processing units and the main and backup flow control units. This is a key technical approach to improve the reliability of aerospace Hall electric propulsion systems.

[0030] Figure 1 A schematic diagram of a dual-redundant Hall electric propulsion controller according to an embodiment of the present invention is shown. Figure 2 A schematic diagram of the signal flow of a dual-redundant Hall electric propulsion controller according to an embodiment of the present invention is shown. Figure 1 and Figure 2As shown, the Hall electric propulsion controller based on dual redundancy includes the following components: a first main control unit 101, a second main control unit 102, a first power processing unit 103, a second power processing unit 104, a first flow control unit 105, and a second flow control unit 106.

[0031] The first main control unit 101 is the first SOC (System on Chip) main control unit. The second main control unit 102 is the second SOC main control unit. In one embodiment of the present invention, the first main control unit 101 and the second main control unit 102 are completely identical in hardware, software, and function; the primary and backup identities of the first main control unit 101 and the second main control unit 102 are fixedly configured by the spacecraft computer according to the power-on command. In one embodiment of the present invention, both the first main control unit 101 and the second main control unit 102 adopt a high-performance SOC chip integrating an FPGA and an ARM core. The FPGA part is responsible for handling all logic requiring high-speed, parallel processing, such as precise ignition timing pulse generation, high-frequency flow valve switching logic control, and parallel acquisition of pressure signals, temperature signals, etc. from multiple sensors. The ARM core is responsible for running system-level task scheduling, communication protocol stack processing with the spacecraft computer, and executing complex closed-loop control algorithms, such as the flow PID (Proportional-Integral-Derivative) control algorithm.

[0032] The first power processing unit 103 is the primary power processing unit, and the second power processing unit 104 is the backup power processing unit. The first power processing unit 103 and the second power processing unit 104 are two identical sets of independent hardware, each containing an anode power supply module, a cathode ignition power supply module, and an excitation power supply module. They receive primary power from the satellite bus and, according to the control signals from the main control unit, convert this electrical energy into various high-precision, high-stability secondary power supplies required for the normal operation of the Hall thruster, providing basic guarantees for the normal operation of all components of the thruster. For example, the electrical energy from the satellite bus is converted into different types and parameters of power supplies such as anode power, cathode ignition power, and excitation power to meet the power requirements of various parts of the Hall electric propulsion system.

[0033] The first flow control unit 105 is the primary flow control unit, and the second flow control unit 106 is the backup flow control unit. The first flow control unit 105 and the second flow control unit 106 are also two sets of independent hardware with the same structure, used to precisely control the flow rate of propellant (such as xenon) delivered to the thruster.

[0034] The first main control unit 101 and the second main control unit 102 are each equipped with two independent control signals, which are respectively connected to and control the first power processing unit 103 and the second power processing unit 104. Specifically, each main control unit outputs two independent control signals: the first control signal is connected to the first power processing unit 103, and the second control signal is connected to the second power processing unit 104. The first main control unit 101 or the second main control unit 102 uses a 16-bit ADC chip to collect the voltage and current feedback values ​​of each power supply in the first power processing unit 103 and the second power processing unit 104 in real time, completing power supply status monitoring. Figure 2 As shown, these control signals are independent control signals, including: a 5V level signal output by the main control unit via a level conversion chip to control the start and stop of the power unit, namely the anode / cathode / excitation power enable signal EN_A or EN_B, which directly regulates the on / off state of the first power processing unit 103 and the second power processing unit 104; signals controlled by the ADC; and PWM (Pulse Width Modulation) signals PWM_A or PWM_B for precisely adjusting the power output of the anode power supply, cathode power supply, and excitation power supply of the first power processing unit 103 and the second power processing unit 104. Figure 2 As shown, the signal acquired by the ADC is connected to the first power processing unit 103 or the second power processing unit 104 via an analog switch and / or amplifier circuit.

[0035] Both the first flow control unit 105 and the second flow control unit 106 include a flow control unit drive circuit 107 and a pressure sensor 108. The first main control unit 101 and the second main control unit 102 synchronously acquire real-time flow data from the pressure sensor 108 via a serial peripheral interface (SPI), and drive the flow control unit drive circuit 107 through a flow control PWM adjustment signal to dynamically adjust the on / off states of the flow valve and solenoid valve, ensuring precise and controllable flow. The core closed-loop control is completed internally by the main control unit: the FPGA is responsible for high-speed acquisition of pressure sensor data and transmission to the ARM core, where the ARM executes a flow PID algorithm. The calculation results are directly used to adjust the opening duration of the flow valve and solenoid valve, forming a dynamic flow closed-loop regulation system to ensure the stability and response speed of the propellant flow.

[0036] Figure 3 A schematic diagram of the drive circuit for synchronously controlling the first flow control unit and the second flow control unit according to an embodiment of the present invention is shown. Figure 3As shown, the first main control unit 101 or the second main control unit 102 is simultaneously connected to the first flow control unit 105 and the second flow control unit 106. The control signals from the same main control unit to the flow control unit occupy different pins. For example, the first main control unit 101 to the first flow control unit 105 occupies the PWM1_VA pin, the first main control unit 101 to the second flow control unit 106 occupies the PWM1_VB pin, the second main control unit 102 to the first flow control unit 105 occupies the PWM2_VA pin, and the second main control unit 102 to the second flow control unit 106 occupies the PWM2_VB pin.

[0037] like Figure 2 As shown, both the first main control unit 101 and the second main control unit 102 establish bidirectional communication with the spacecraft computer 100 through the CAN bus to realize telemetry data transmission and remote control command reception. The CAN bus includes the CANA bus and the CANB bus. The CANA bus includes the CANA-TX signal line and the CANA-RX signal line, and the CANB bus includes the CANB-TX signal line and the CANB-RX signal line.

[0038] The primary and backup identities of the first master control unit 101 and the second master control unit 102 are fixedly configured by the spaceborne computer according to the power-on command. If the primary master control unit needs to be powered on, a power-on command is sent to it; if the backup master control unit needs to be powered on, a power-on command is sent to it. The primary master control unit is the currently operating master control unit. The spaceborne computer 100 monitors the status of the first master control unit 101 and the second master control unit 102. When the spaceborne computer 100 determines that the currently operating master control unit has failed, it performs a switching operation and sends status information to the master control unit taking over the operation to achieve seamless operation. Specifically, when one of the master control units, the first master control unit 101 and the second master control unit 102, fails, the other master control unit takes over and controls the first power processing unit 103, the second power processing unit 104, the first flow control unit 105, and the second flow control unit 106. The faults here could be signal faults, GPIO (General Purpose Input / Output) / PWM faults of the SOC output, etc. After the main control unit switches, the spacecraft computer sends the operating parameters of the main control unit that was operating before the fault (e.g., thruster operating mode, power processing unit output parameters, flow valve parameters, PID calculation parameters, etc.) to the main control unit that is operating after the fault, thus realizing the switching and operation of the main control unit. It should be noted that the algorithms in the first main control unit 101 and the second main control unit 102 are independent. When the main control unit switches, the spacecraft computer sends the parameters to the currently operating main control unit in the form of instructions. The main control unit after the switch restarts operation and calculates the PID parameters.

[0039] In one embodiment of the present invention, the dual-redundant Hall electric propulsion controller supports cold backup mode and hot backup mode; and supports continued operation in a degraded mode with a single main control unit, a single power processing unit, and a single flow control unit, that is, the primary main control unit and the backup main control unit complement each other and their functions are not limited.

[0040] In one embodiment of the present invention, when the spacecraft computer 100 detects that the first main control unit 101 and the second main control unit 102 fail simultaneously, the first main control unit 101 and the second main control unit 102 are operating abnormally. The spacecraft computer 100 will perform shutdown or restart operations on the first main control unit 101 and / or the second main control unit 102 according to the fault status in order to restore the operation of the electric propulsion controller.

[0041] Figure 4 A schematic flowchart illustrating a control method based on a dual-redundant Hall electric propulsion controller according to an embodiment of the present invention is shown. Figure 4 As shown, the control method based on a dual-redundant Hall electric propulsion controller provided by the present invention uses the aforementioned dual-redundant Hall electric propulsion controller, and the method includes the following steps: Step 401: Power on the controller and determine the first or second main control unit as the current working main control unit.

[0042] Step 402: The current working main control unit controls the first power processing unit and / or the second power processing unit through two independent control signals.

[0043] Step 403: The current working master control unit synchronously controls the first flow control unit and / or the second flow control unit.

[0044] Step 404: When the spacecraft computer determines that the current working main control unit is faulty, it performs a switching operation, and another main control unit takes over the control of the controller.

[0045] In one embodiment of the present invention, the control method based on the dual-redundant Hall electric propulsion controller further includes a power processing unit switching step: when the current working master control unit detects that the first power processing unit or the second power processing unit has failed, it feeds back the fault status to the space station computer; the space station computer makes a judgment based on the fault code and sends an instruction to the current working master control unit; and the current working master control unit automatically switches to the healthy power processing unit to continue working according to the instruction.

[0046] In one embodiment of the present invention, the control method based on the dual-redundant Hall electric propulsion controller further includes a flow control unit switching step: when the current working master control unit detects that the first flow control unit or the second flow control unit has failed, it automatically switches to the healthy flow control unit to continue working through a fast switching circuit based on FPGA hardware logic.

[0047] In a third aspect, the present invention also provides a spacecraft electric propulsion system, including the aforementioned dual-redundant Hall electric propulsion controller.

[0048] The proposed invention presents a dual-redundant Hall-effect electric propulsion controller, employing a dual-SoC (FPGA+ARM) architecture as the main control unit to construct a master-backup mode. Even if one SoC fails, the other can quickly take over the controller, ensuring normal operation of the electric propulsion controller. This design significantly enhances the system's reliability and fault tolerance, reducing the risk of satellite failure due to propulsion system malfunctions.

[0049] Although various embodiments of the present invention have been described above, it should be understood that they are presented by way of example only and not as limitations. It will be apparent to those skilled in the art that various combinations, modifications, and alterations can be made without departing from the spirit and scope of the invention. Therefore, the breadth and scope of the invention disclosed herein should not be limited by the exemplary embodiments disclosed above, but should be defined according to the technical solutions of the invention and their equivalents.

Claims

1. A Hall-effect electric propulsion controller based on dual redundancy, characterized in that, include: The system comprises a first main control unit, a second main control unit, a first power processing unit, a second power processing unit, a first flow control unit, and a second flow control unit; Both the first main control unit and the second main control unit are equipped with two independent control signals. The control signals include a level signal for start / stop control and a PWM signal for power regulation, which are respectively connected to and control the first power processing unit and the second power processing unit. The first main control unit and the second main control unit are respectively connected to and control the first flow control unit and the second flow control unit; When one of the first and second main control units fails, the other main control unit takes over and controls the first power processing unit, the second power processing unit, the first flow control unit, and the second flow control unit.

2. The Hall-effect electric propulsion controller based on dual redundancy according to claim 1, characterized in that, The first main control unit and the second main control unit are identical in hardware, software and functions; the primary and backup identities of the first main control unit and the second main control unit are fixedly configured by the spacecraft computer according to the power-on command.

3. The Hall-effect electric propulsion controller based on dual redundancy according to claim 1, characterized in that, Both the first main control unit and the second main control unit adopt an FPGA+ARM architecture; the FPGA is used to implement hardware parallel timing control for ignition pulse generation, flow valve logic control and sensor signal acquisition; the ARM is used to execute the flow PID algorithm.

4. The Hall-effect electric propulsion controller based on dual redundancy according to claim 1, characterized in that, The Hall-effect electric propulsion controller based on dual redundancy supports both cold backup and hot backup modes; and it also supports continued operation in degraded modes with a single main control unit, a single power processing unit, and a single flow control unit.

5. The Hall-effect electric propulsion controller based on dual redundancy according to claim 1, characterized in that, Both the first master control unit and the second master control unit establish bidirectional communication with the spacecraft computer via the CAN bus; the spacecraft computer is used to monitor the status of the first master control unit and the second master control unit; when the spacecraft computer determines that the currently working master control unit has failed, it performs a switching operation and sends status information to the master control unit that takes over the work to achieve work handover.

6. A control method based on a dual-redundant Hall electric propulsion controller, applied to the dual-redundant Hall electric propulsion controller as described in any one of claims 1 to 5, characterized in that, Includes the following steps: When the controller is powered on, it determines the first or second main control unit as the current working main control unit. The current working main control unit controls the first power processing unit and / or the second power processing unit through two independent control signals; The current working master control unit synchronously controls the first flow control unit and / or the second flow control unit; as well as When the spacecraft computer determines that the current main control unit is faulty, it performs a switching operation, and another main control unit takes over the control of the controller.

7. The control method according to claim 6, characterized in that, It also includes a power processing unit switching step: When the current working main control unit detects that the first power processing unit or the second power processing unit has failed, it will feed back the fault status to the space service computer. The spacecraft computer determines the fault based on the fault code and sends instructions to the current working main control unit; as well as The currently operating main control unit automatically switches to a healthy power processing unit to continue working according to the instruction.

8. The control method according to claim 6, characterized in that, It also includes the flow control unit switching procedure: When the current working master control unit detects that the first flow control unit or the second flow control unit has failed, it automatically switches to the healthy flow control unit to continue working through a fast switching circuit based on FPGA hardware logic.

9. A spacecraft electric propulsion system, characterized in that, Includes a Hall-effect electric propulsion controller based on dual redundancy as described in any one of claims 1 to 5.

Images