Satellite-borne rubidium atomic clock dual-chip hot backup control system and method

Abstract

This invention relates to a dual-chip hot standby control system and method for a spaceborne rubidium atomic clock, belonging to the technical field of spacecraft time and frequency control systems. The system includes a master control ARM chip, a backup control ARM chip, servo circuits, a status monitoring module, and a high-speed synchronization bus. By constructing a dual-chip redundant control architecture, it achieves real-time synchronization of servo parameters and master / backup switching control. The backup control ARM chip has a built-in phase-locked loop pre-synchronization module, possessing frequency tracking and phase error compensation capabilities. When the master control ARM chip malfunctions, it can take over servo control within 10μs, ensuring the continuity and stability of frequency output. Simultaneously, the system introduces multi-dimensional fault criteria, mutually exclusive output paths, and low-pass filtering circuits to enhance anti-interference capabilities. This invention effectively improves the on-orbit reliability of the rubidium atomic clock servo system and is suitable for low-Earth orbit satellite missions with extremely high requirements for continuity and precision.

Description

Technical Field

[0001] This invention relates to the field of spacecraft time and frequency control system technology, specifically to a dual-chip hot standby control system and method for a spaceborne rubidium atomic clock. Background Technology

[0002] In low-Earth orbit satellite systems, rubidium atomic clocks serve as core time and frequency devices, and their frequency output stability directly affects satellite communication synchronization, navigation accuracy, and timing reliability. The rubidium atomic clock servo circuit is typically controlled in a closed-loop manner by an ARM-based control chip, whose main controlled components include a voltage-controlled oscillator (VCXO), temperature compensation circuitry, and modulation system. To achieve precise locking of atomic transition frequencies, the control chip needs to continuously output control parameters to ensure long-term frequency stability.

[0003] However, existing technologies generally employ a single ARM control chip architecture. If this chip fails due to factors such as single-event upsets (SEUs), total dose effects, or logic errors, it will directly cause the servo loop to interrupt, leading to rubidium atomic clock lock-up, resulting in frequency output deviation or even interruption, severely impacting the operational safety of the satellite system. Especially during long-term operation of low-Earth orbit satellites, where manual maintenance is lacking, a clock lock-up could result in irreversible time synchronization failure, causing multi-satellite system coordination errors or missed communication windows. Furthermore, while some existing control systems incorporate reset mechanisms, the interruption of the control chip's output during reset can cause significant frequency jumps in the rubidium atomic clock, failing to meet continuous control requirements.

[0004] Therefore, how to construct a highly reliable servo control architecture with hot standby capability to reduce the risk of single point of failure and achieve rapid, phase-continuous, seamless switching when the main control ARM chip fails has become an important technical problem that needs to be solved in current spaceborne time and frequency systems. Summary of the Invention

[0005] The purpose of this invention is to provide a dual-chip hot standby control system and method for a spaceborne rubidium atomic clock.

[0006] To achieve the above objectives, the present invention proposes the following technical solution: a dual-chip hot standby control system for a spaceborne rubidium atomic clock, comprising:

[0007] Main control ARM chip, backup control ARM chip, servo circuit, status monitoring module and high-speed synchronous bus;

[0008] The main control ARM chip is connected to the servo circuit and is used to generate and output voltage-controlled DA control words, temperature compensation values ​​and modulation control values.

[0009] The backup ARM chip is connected to the main ARM chip through the high-speed synchronous bus, and receives and caches servo parameters in real time.

[0010] The status monitoring module is set in the backup ARM chip and analyzes the operating status, data consistency, register check value, CRC check result and voltage-controlled DA control word change trend of the main ARM chip based on the heartbeat detection mechanism.

[0011] When any of the following faults are detected in the main control ARM chip: heartbeat abnormality, register verification abnormality, CRC verification failure, status flag field abnormality, or abnormal transition of the voltage control DA control word, the backup control ARM chip takes over the servo control within 10μs to achieve frequency-uninterrupted switching.

[0012] Furthermore, the backup ARM chip is equipped with a phase-locked loop pre-synchronization module, which is used to continuously track the voltage-controlled DA control word output by the master ARM chip in standby mode, calculate the phase error Δφ, and generate a frequency output equivalent to that of the master ARM chip, so that there is no frequency change during the master-slave switching process.

[0013] Furthermore, it also includes a mutual exclusion access interface module, which is used to isolate and switch the output paths from the main control and backup control ARM chips to the servo circuit. The module adopts a priority preemption logic control circuit and has an embedded state holding unit to ensure output continuity.

[0014] This invention also proposes a dual-chip hot standby control method for a spaceborne rubidium atomic clock, comprising the following steps:

[0015] S1. Main control servo parameter output and synchronous broadcast: The main control ARM chip periodically generates servo control parameter packets, which include voltage-controlled DA control words, temperature compensation values ​​and modulation control values, and sends them to the backup control ARM chip for synchronization every 1ms via high-speed bus;

[0016] S2. Backup control real-time synchronization and status monitoring: The backup control ARM chip caches servo parameters, and at the same time parses the system status flag field, register check value and CRC check code, continuously monitors the health status of the main control ARM chip, and records the heartbeat interval of continuous communication, voltage control DA control word change and abnormal flag bit.

[0017] S3. Fault Detection and Fast Switching: When the main control ARM chip detects two consecutive heartbeat packet losses or abnormal parameter changes exceeding the threshold, the backup control ARM chip cuts off the output of the main control ARM chip through the mutual exclusion access interface module and takes over the control of the servo path. The switching response time does not exceed 10μs.

[0018] Furthermore, in step S2, the status monitoring employs the following multi-indicator joint judgment:

[0019] a) The fault flag bit in the status flag field is activated;

[0020] b) The voltage-controlled DA control word in the parameter package jumps beyond the tolerance threshold;

[0021] c) The register check value is abnormal or the CRC check fails more than twice;

[0022] If any one of these conditions is met, the main control ARM chip is determined to be in a fault state.

[0023] Furthermore, the fast switching action in S3 includes:

[0024] Call the isolation switch in the mutual exclusion access interface module to cut off the output channel of the main control ARM chip and activate the output path of the backup control ARM chip;

[0025] Execute the phase-locked loop phase error compensation command, adjust the local frequency output according to the voltage-controlled DA control word difference value, and complete the smooth frequency transition.

[0026] Furthermore, the method also includes the following steps:

[0027] S4. Phase-locked loop phase synchronization operation: The standby ARM chip continuously reads the voltage-controlled DA control word C1 of the master ARM chip, compares it with the local control word C2, calculates the phase error Δφ=C1-C2 in real time, and adjusts the output of the local voltage-controlled crystal oscillator (VCXO) to achieve closed-loop tracking of the output phase between the master and standby chips; the adjustment period of the phase-locked loop is controlled within 200μs to meet the stability requirements of the frequency output.

[0028] Furthermore, the method also includes the following steps:

[0029] S5. Switchback mechanism after master control recovery: When the backup ARM chip takes over, it continuously monitors the status packet of the master control ARM chip; if the internal beat returns to normal for 3 consecutive cycles, the register check value is consistent with the CRC check result and the phase error satisfies |Δφ|≤2, then the master control priority switchback logic is triggered, and the control is returned to the master control ARM chip.

[0030] Furthermore, during the master / slave switchover, all servo outputs remain connected to the anti-interference low-pass filter circuit to buffer the minor level jumps caused by the switchover and ensure the stability of the rubidium atomic clock output frequency.

[0031] The present invention also proposes an electronic device for low-Earth orbit satellites, characterized in that the electronic device includes: at least one processor, a memory, and a servo interface circuit connected to the processor, wherein the memory stores instructions configured to be executed by the processor to implement a dual-chip hot standby control method for a spaceborne rubidium atomic clock.

[0032] The beneficial effects of this invention are as follows:

[0033] 1. By constructing a dual ARM chip hot standby architecture, high-speed synchronization of servo parameters and interaction of status information are achieved between the master and standby ARM chips. By introducing a heartbeat detection mechanism and health judgment logic, the standby chip can seamlessly take over control within 10μs when an abnormality is detected in the master ARM chip, which significantly improves system reliability and avoids the atomic clock from losing lock due to control interruption.

[0034] 2. The backup ARM chip is in a synchronous standby state when the main ARM chip is running normally. It continuously tracks the control parameters output by the main ARM chip. By constructing a phase-locked loop (PLL) pre-synchronization model, it achieves continuous phase tracking. During the main-backup switching process, it ensures that the output frequency of the rubidium atomic clock does not change abruptly and the phase does not jump, meeting the strict requirements of high-precision time and frequency systems for continuity.

[0035] 3. Introducing multi-dimensional health criteria and parameter jump tolerance mechanism, the system performs real-time analysis of indicators such as registers, output control words, and DA stability of the main control ARM chip, enabling autonomous judgment and fault tolerance, and significantly enhancing the robustness of the control system to typical disturbance factors such as radiation effects, single-event upsets, and temperature drift disturbances in the aerospace environment.

[0036] 4. The system adopts a priority mutual exclusion output mechanism and an anti-disturbance filter circuit structure to ensure that the main and backup output paths have the ability to smoothly transition levels when switching, avoid transient interference from entering the servo circuit, and achieve high stability and high integrity protection for the atomic clock control channel. Attached Figure Description

[0037] Figure 1 This is a block diagram of the overall system structure of the present invention;

[0038] Figure 2 This is a flowchart of the method of the present invention;

[0039] Figure 3 Frequency output curve (simulation) during master / standby switching process;

[0040] Figure 4 The phase error evolution curve under spatial perturbation conditions (simulation);

[0041] Figure 5 A comparison of control signal levels before and after the filter switching between primary and backup (simulation). Detailed Implementation

[0042] To more clearly illustrate the technical solution of the present invention, the present invention will be further described in detail below with reference to specific embodiments. It should be understood that the following embodiments are only used to illustrate the present invention and are not intended to limit the scope of protection of the present invention.

[0043] Example 1:

[0044] This embodiment provides a dual-chip hot standby control system for a spaceborne rubidium atomic clock, including: a main control ARM chip, a backup control ARM chip, a servo circuit, a status monitoring module, a high-speed synchronization bus, a phase-locked loop pre-synchronization module, and a mutual exclusion access interface module. This system is designed so that when the main control ARM chip malfunctions, the backup control ARM chip takes over servo control within no more than 10μs, ensuring the continuous, stable, and disturbance-free output frequency of the rubidium atomic clock. It is suitable for low-Earth orbit satellite navigation and remote sensing missions with extremely high time-frequency stability requirements. The overall structure of this system can be found in [reference needed]. Figure 1 The overall hardware of the system is listed in the table below:

[0045] Table 1 System Hardware Model Table

[0046] Module Name Model / Component Name Function Description Manufacturers Main control ARM chip NXP i.MXRT1062 Cortex-M7 core, 600MHz, as the main servo control unit. NXP Backup ARM chip NXP i.MXRT1062 Consistent with the main controller configuration, used for hot standby and fault takeover. NXP Servo circuit (including DA output module) Analog Devices AD5761R A single-channel 16-bit DAC outputs a 0–2.5V control signal to the rubidium atomic clock VCXO control input. Analog Devices Status monitoring module Software module (embedded backup firmware) Collect and analyze the main control status flag field, register check value, CRC check result, heartbeat frequency and voltage-controlled DA control word change trend to determine whether the main control is faulty. Internal logic module High-speed synchronous bus SN65LVDS047+ Twisted Pair Shielded Cable LVDS differential communication, with a data rate of 100Mb / s, enables high-speed broadcast synchronization between master and backup chips. TexasInstruments Phase-locked loop pre-synchronization module MXO45HS-3C-10M+VC interface Real-time acquisition of main control words, calculation of phase error, and driving of local VCXO to achieve smooth synchronization of output frequency. CTS (Centers for Transit Systems) Mutual Exclusion Interface Module ispMACH4032ZC CPLD Controls the switching of the primary and backup chip servo channel outputs, implementing mutual exclusion logic and state retention functions. Lattice Semiconductor

[0047] The main control ARM chip is the core control unit of the system, embedding a servo control program that generates a set of servo parameters every 1ms, including: a voltage-controlled DA control word (controlling the oscillation frequency of the rubidium atomic clock), a temperature compensation value (adjusting the cavity temperature), and a modulation control value (adjusting the modulation depth of the microwave source). The main controller controls a DAC chip (AD5761R) via SPI to convert the digital control word into an analog voltage signal, which is then output to the rubidium atomic clock servo control interface. Simultaneously, the main control ARM chip packages these servo parameters into a servo parameter broadcast packet, containing the following fields: voltage-controlled DA control word, temperature compensation value, modulation control value, status flag field, register checksum, CRC checksum, and timestamp. The servo parameter broadcast packet is transmitted in real-time to the backup control ARM chip via the LVDS differential high-speed synchronous bus.

[0048] The backup ARM chip is in real-time hot standby mode, continuously receiving broadcast data packets from the master controller and running its internally integrated status monitoring module. This module continuously determines the following three types of fault indicators:

[0049] 1) Heartbeat loss detection: If no master control servo parameter broadcast packet is received within two consecutive 1ms cycles, the communication is considered abnormal;

[0050] 2) Voltage-controlled DA control word transition detection: Calculate the difference in control word value between two consecutive cycles. If the number of control words exceeds 12, it is considered a jump anomaly.

[0051] 3) Status flag abnormality, register check abnormality or CRC error: When the abnormal flag in the status flag field is set, the register check value is abnormal, or two consecutive CRC checks fail, it is considered that the master control is abnormal.

[0052] When any of the above fault conditions are met, the backup ARM chip will immediately initiate the fault switching process, controlling the CPLD to perform channel switching operations through the mutual exclusion access interface module. The logic programmed into the CPLD ensures that the backup chip preempts the master control servo channel and forcibly shuts down the master control DAC output path, while simultaneously activating the backup control DAC control path. The entire process is triggered synchronously by internal states, ensuring that the switching response time does not exceed 10μs.

[0053] To ensure continuous frequency output during master / slave switching, the phase-locked loop pre-synchronization module built into the standby ARM chip executes a frequency synchronization mechanism during standby. The specific method is as follows:

[0054] Real-time reading of the voltage-controlled DA control word output by the main controller , with local backup control word Compare and calculate the phase error: ;like Then use the proportionality coefficient Compensation will be provided.

[0055] ;

[0056] The compensation period is 200μs, and the error converges to ±1 control word unit within 5 periods.

[0057] During the switching process, the servo control signal output path is connected in series with an RC low-pass filter circuit (resistor 10kΩ, capacitor 22nF), with a filter cutoff frequency of approximately 724Hz. This filter can effectively suppress level jitter and minor jumps that may occur during DAC switching, ensuring continuous and smooth rubidium atomic clock frequency output.

[0058] Example 2:

[0059] This embodiment provides a dual-chip hot standby control method for a spaceborne rubidium atomic clock, comprising a complete control scheme from master control servo parameter output, high-speed synchronization and status monitoring, to fault detection and rapid switching, phase-locked loop error compensation, and master control ARM chip back-switch mechanism. The method flowchart can be found in [reference needed]. Figure 2 Specifically, it includes:

[0060] S1, Main control servo parameter output and synchronous broadcast;

[0061] The main control ARM chip calls the servo control interrupt every 1 ms to calculate and output the parameter packet for the current control cycle, including the voltage-controlled DA control word, temperature compensation value, and modulation control value. The parameters are transmitted to the DAC output via the SPI interface and simultaneously packaged into broadcast data, which is then transmitted to the backup control ARM chip via the LVDS bus. The broadcast data packet structure is shown in the table below:

[0062] Table 2 Broadcast Data Packet Structure

[0063] Field Name type describe Voltage-controlled DA control word uint16 The frequency of the rubidium atomic clock VCXO is controlled within the range of 0–65535Hz, and the linearly mapped output voltage range is 0–2.5V. Temperature compensation value float32 Control the output current of the heating element Modulation control value float32 Controlling the modulation depth of the microwave source Status flag field uint8 The bit indicates the operating status, such as crystal oscillator lockout, parity error, etc. Register check value uint16 The consistency check value generated after reading back and verifying the critical control registers CRC check code uint16 Calculated based on CRC-16 / CCITT-FALSE standard 64-bit timestamp uint64 1μs-level clock accumulation value based on RTC module

[0064] The main control ARM chip automatically sends data packets via DMA without CPU intervention, ensuring a complete communication cycle is completed within 1ms.

[0065] S2, Real-time synchronization and status monitoring of backup control;

[0066] Upon receiving the main control data packet, the backup ARM chip immediately buffers it and executes a status monitoring task. The status monitoring module sequentially performs a joint judgment based on the status flag bits, register checksum, CRC checksum, and the trend of changes in the voltage-controlled DA control word in the data packet. The anomaly detection criteria are as follows:

[0067] 1) Heartbeat loss detection: If no master control servo parameter broadcast packet is received within two consecutive 1ms cycles, the communication is considered abnormal;

[0068] 2) Voltage-controlled DA control word transition detection: Calculate the difference in control word value between two consecutive cycles. If the number of control words exceeds 12, it is considered a jump anomaly.

[0069] 3) Status flag anomaly, register check anomaly, or CRC error: When the anomaly flag in the status flag field is set, the register check value is abnormal, or two consecutive CRC checks fail, it is considered a master control anomaly. Once any of these conditions are met, the system enters the fault switching state described in S3.

[0070] S3, fault detection and rapid switching;

[0071] When the status monitoring module triggers a fault determination, the backup ARM chip immediately invokes the interface signal of the mutual exclusion access interface module to send a "backup takeover" command to the CPLD. The CPLD then performs the following switching actions:

[0072] The main control DA control path output is forcibly locked out; the backup control SPI interface drives the local DAC (also AD5761R) output signal; the output signal is connected to the servo circuit path; the switching action delay does not exceed 10μs.

[0073] After the switch, the output of the backup ARM chip will directly affect the voltage control terminal of the rubidium atomic clock VCXO, and the output frequency will be fully controlled by the backup ARM chip.

[0074] S4. Phase-locked loop phase synchronization operation;

[0075] To achieve seamless handover, the backup ARM chip continuously executes the phase-locked loop pre-synchronization task during standby, acquiring the main control DA control word every 200μs. With local control word And calculate the phase error: ;like Then use the proportionality coefficient Compensation will be provided.

[0076] ;

[0077] This compensation is used to adjust the output of the backup DAC so that it is basically synchronized with the frequency before the master controller takes over.

[0078] For example, if , but:

[0079] ;

[0080] ;

[0081] This operation is performed continuously for multiple cycles to ensure that the backup control output frequency is smooth and without abrupt changes at the moment of takeover.

[0082] S5, Switchback mechanism after main control recovery;

[0083] After the backup ARM chip takes over control, it continues to monitor the recovery status of the master ARM chip via the LVDS bus. If the following three conditions are met for three consecutive cycles, the "master priority switchback" mechanism is automatically triggered:

[0084] 1) The main control servo parameter broadcast packets are continuously received, and the heartbeat is normal;

[0085] 2) The register check value and the CRC check result are consistent for three consecutive times;

[0086] 3) The phase error satisfies |Δφ|≤2.

[0087] Once the handover condition is met, the backup ARM chip sends a "control release" signal to the CPLD. The CPLD immediately performs the following actions: shuts down the backup DA control path; restores the master SPI drive DAC output; and returns output control to the master ARM chip. The response delay of the entire handover process is controlled within 300μs, and the system output frequency jitter is less than 0.1Hz, meeting the requirements for continuity of spaceborne frequency switching.

[0088] Filtering protection during master / standby switching: An RC low-pass filter network is connected after the output channel of either the master or standby controller. Specific parameters are as follows: resistor R = 10kΩ; capacitor C = 22nF; cutoff frequency ≈ 724Hz. This filter is used to suppress output level jumps caused by transient voltage differences during master / standby switching, maintaining the continuity of the rubidium atomic clock VCXO input voltage.

[0089] Comparative Example 1 (Single-chip control structure):

[0090] This comparative model adopts a traditional single ARM chip control architecture, simplifying the overall system. It only configures a single master ARM chip as the sole generator and output control unit for servo parameters, lacking redundant control capabilities and hot standby mechanisms. Specifically, the master ARM chip uses the i.MX RT1062 series ARM processor from NXP, which internally runs the servo control program. It periodically calculates key servo parameters such as voltage-controlled DA control words, temperature compensation values, and modulation control values, and drives the AD5761R 16-bit DAC chip through the SPI interface to convert digital control quantities into analog voltages, which are directly output to the VCXO control port of the rubidium atomic clock.

[0091] The system lacks a backup ARM chip, and is not equipped with a status monitoring module, high-speed synchronous communication mechanism, or phase-locked loop synchronization mechanism. The control path is a unidirectional output.

[0092] Comparative Example 2 (Dual-chip phase-locked synchronous control structure):

[0093] This comparative model incorporates a dual-chip configuration in its hardware structure, featuring a basic master-slave control architecture and a high-speed communication mechanism. The system is configured with one master ARM chip and one backup ARM chip, which synchronize servo parameters via an LVDS differential bus. The backup ARM chip can receive and buffer parameter packets output by the master chip in real time. A status monitoring module is integrated into the backup ARM chip, capable of identifying operational anomalies in the master chip and, upon triggering certain conditions, controlling the mutual exclusion access interface module to switch control paths.

[0094] The system lacks a phase-locked loop pre-synchronization module and does not implement real-time voltage-controlled DAC control word tracking and phase compensation logic in the backup ARM chip. When the backup ARM chip takes over due to a fault, it directly uses the local default control parameters or the previous cycle's cached value to take over the DAC output, failing to achieve continuous phase connection with the main control output.

[0095] Comparative Example 3 (Dual-chip synchronous control but without filter structure):

[0096] This comparative example is structurally similar to Example 1, featuring dual ARM chips (master and backup), a high-speed synchronous bus, a status monitoring module, a phase-locked loop pre-synchronization module, and a mutual exclusion access interface module. The master ARM chip periodically generates servo parameters and broadcasts them to the backup ARM chip. The backup ARM chip maintains a hot standby state and adjusts its local control word in real time using a phase-locked loop compensation algorithm, enabling it to seamlessly take over control in the event of master failure. The phase error between the backup control word and the master control word is corrected every 200μs period to ensure continuous output voltage before switching.

[0097] The RC low-pass filter circuit was omitted in the output path design. The DAC analog voltage output port is directly connected to the rubidium atomic clock VCXO control input port, lacking level buffering, glitching, or signal transition processing circuitry. During master / standby switching, even if the phase-locked loop (PLL) synchronization mechanism has matched the control word, short-term glitches or level steps may occur in the output signal due to slight time differences in DAC levels, inconsistent register loading, or conversion response delays. These steps, transmitted directly to the VCXO control port without filtering suppression, can cause transient frequency disturbances or even trigger malfunctions in the frequency PLL module, reducing system output stability and electromagnetic compatibility.

[0098] To verify the stability and response performance of the "dual-chip hot standby control system" described in this invention in rubidium atomic clock servo control, a comprehensive test scheme was designed, covering both ground-based control performance testing and on-orbit simulation analysis. The entire test revolves around key technical issues such as whether the backup control can switch quickly and seamlessly under master control failure, whether the output frequency remains continuous, and whether the system stably maintains phase-locked state. Evaluation parameters cover multiple indicators including switching delay, voltage-controlled DA control word abrupt change amplitude, DAC output level jump amplitude, frequency disturbance magnitude, recovery stabilization time, and phase-locked state retention.

[0099] During the experiment, the system's response performance during the control switch was tested by simulating abnormalities in the main control ARM chip (such as register freezing, heartbeat loss, CRC error, etc.).

[0100] The experiment was conducted on a standard experimental platform, using a 10 MHz rubidium atomic clock module as the controlled time and frequency source, paired with a high-precision DAC chip and a programmable controller to construct an analog servo path. Changes in all key parameters were acquired and analyzed using a frequency counter and a high-speed oscilloscope. For details on frequency output changes during master / slave switching, please refer to [reference needed]. Figure 3 The ground test data are shown in the table below:

[0101] Table 3 Comparison of Control Switching Performance

[0102] Test object Switching response time (μs) Control word mutation (unit) Output level change (V) Frequency jump (Hz) Recovery time (ms) Phase-locked state Example 1 8.3 2 0.003 0.08 0.6 Stablize Comparative Example 1 None (system interruption) ＞100 ＞0.25 ＞5.0 ＞80 Unlocked Comparative Example 2 7.6 52 0.16 12.3 18.2 Unlocked Comparative Example 3 8.1 40 0.18 8.5 6.3 Unlocked

[0103] Note: The “output level change” in Table 3 refers to the transient level change amplitude measured at the VCXO control terminal at the moment of master / standby switching, and is not the steady-state output voltage difference directly calculated from the control word difference according to the DAC static linear mapping relationship.

[0104] Example 1 outperforms the three comparative examples in terms of switching response time, control word stability, level disturbance suppression, frequency stability, and recovery time. Particularly in frequency jump control, the phase-locked loop pre-synchronization mechanism and low-pass filter circuit in Example 1 work together to control the jump amplitude within 0.08Hz; while Comparative Examples 2 and 3, lacking phase-locked loop compensation and output filtering respectively, exhibit frequency disturbances greater than 8Hz, resulting in significant discontinuities. Comparative Example 1, lacking redundancy design, suffers a complete interruption of the control chain after a main controller malfunction, leading to uncontrolled and unlocked frequency output with a recovery time exceeding 80ms.

[0105] Considering that the extreme space environment in which the spaceborne system operates cannot be fully simulated through ground tests, servo control simulation analysis was conducted based on the Simulink platform to further verify the on-orbit adaptability of the present invention.

[0106] The simulation model was used to reproduce key operational processes such as the abnormal failure of the main control ARM chip, the backup control ARM chip taking over control, and the smooth switching of frequency output. Considering the disturbances caused by rapid changes in orbital temperature and space radiation, thermal drift disturbances (setting the temperature change rate to ±0.2°C / s) and random disturbances simulating single-event upset effects (using Poisson distribution to generate disturbance events) were introduced into the model to more closely resemble real on-orbit conditions.

[0107] See Figure 4 Simulation results show that, under conditions of frequency disturbance, the proposed hot standby control system maintains a maximum phase error within ±0.3°, a maximum frequency offset of no more than 0.06Hz, and an output overshoot recovery time of less than 0.4ms during master-slave switching. Overall performance is superior to the comparative structure, which exhibits frequency fluctuations exceeding 2Hz during master-slave switching. (See also...) Figure 5 The filtering circuit introduced in this invention effectively suppressed the high-frequency glitches and level jumps that may occur during the master-slave switching in the simulation, significantly improved the stability of the rubidium atomic clock input signal, reduced the risk of false triggering of the phase-locked loop failure, and verified the superior adaptability and reliability of the structure of this invention under complex spatial disturbance conditions.

[0108] Both ground tests and system-level simulations fully demonstrate that the dual-chip redundant control structure proposed in this invention, through the construction of synchronous communication, phase-locked pre-synchronization mechanism, mutually exclusive output logic and level smoothing mechanism, can achieve rapid, stable and continuous control switching of the main and backup chips under fault conditions; it meets the time-frequency control requirements of high reliability and continuous operation on spacecraft and has engineering advantages over existing single-chip or asynchronous structures.

[0109] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the claimed invention.

Claims

1. A dual-chip hot standby control system for a spaceborne rubidium atomic clock, characterized in that, include: Main control ARM chip, backup control ARM chip, servo circuit, status monitoring module and high-speed synchronous bus; The main control ARM chip is connected to the servo circuit and is used to generate and output voltage-controlled DA control words, temperature compensation values ​​and modulation control values. The backup ARM chip is connected to the main ARM chip through the high-speed synchronous bus, and receives and caches servo parameters in real time. The status monitoring module is set in the backup ARM chip and analyzes the operating status, data consistency, register check value, CRC check result and voltage-controlled DA control word change trend of the main ARM chip based on the heartbeat detection mechanism. When any of the following faults are detected in the main control ARM chip: heartbeat abnormality, register verification abnormality, CRC verification failure, status flag field abnormality, or abnormal transition of the voltage control DA control word, the backup control ARM chip takes over the servo control within 10μs to achieve frequency-uninterrupted switching.

2. The dual-chip hot standby control system for a spaceborne rubidium atomic clock according to claim 1, characterized in that, The backup ARM chip is equipped with a phase-locked loop pre-synchronization module, which is used to continuously track the voltage-controlled DA control word output by the master ARM chip in standby mode, calculate the phase error Δφ, and generate a frequency output equivalent to that of the master ARM chip, so that there is no frequency change during the master-slave switching process.

3. The dual-chip hot standby control system for a spaceborne rubidium atomic clock according to claim 2, characterized in that, It also includes a mutual exclusion access interface module, which is used to isolate and switch the output paths from the main control and backup control ARM chips to the servo circuit. The module adopts a priority preemption logic control circuit and has an embedded state holding unit to ensure output continuity.

4. A dual-chip hot standby control method for a spaceborne rubidium atomic clock, using the dual-chip hot standby control system for a spaceborne rubidium atomic clock as described in any one of claims 1-3, characterized in that, Includes the following steps: S1. Main control servo parameter output and synchronous broadcast: The main control ARM chip periodically generates servo control parameter packets, which include voltage-controlled DA control words, temperature compensation values ​​and modulation control values, and sends them to the backup control ARM chip for synchronization every 1ms via high-speed bus; S2. Backup control real-time synchronization and status monitoring: The backup control ARM chip caches servo parameters, and at the same time parses the system status flag field, register check value and CRC check code, continuously monitors the health status of the main control ARM chip, and records the heartbeat interval of continuous communication, voltage control DA control word change and abnormal flag bit. S3. Fault Detection and Fast Switching: When the main control ARM chip detects two consecutive heartbeat packet losses or abnormal parameter changes exceeding the threshold, the backup control ARM chip cuts off the output of the main control ARM chip through the mutual exclusion access interface module and takes over the control of the servo path. The switching response time does not exceed 10μs.

5. The dual-chip hot standby control method for a spaceborne rubidium atomic clock according to claim 4, characterized in that, In step S2, the status monitoring uses the following multi-indicator joint judgment: a) The fault flag bit in the status flag field is activated; b) The voltage-controlled DA control word in the parameter package jumps beyond the tolerance threshold; c) The register check value is abnormal or the CRC check fails more than twice; If any one of these conditions is met, the main control ARM chip is determined to be in a fault state.

6. The dual-chip hot standby control method for a spaceborne rubidium atomic clock according to claim 5, characterized in that, The fast switching action in S3 includes: Call the isolation switch in the mutual exclusion access interface module to cut off the output channel of the main control ARM chip and activate the output path of the backup control ARM chip; Execute the phase-locked loop phase error compensation command, adjust the local frequency output according to the voltage-controlled DA control word difference value, and complete the smooth frequency transition.

7. The dual-chip hot standby control method for a spaceborne rubidium atomic clock according to claim 6, characterized in that, Also includes: S4. Phase-locked loop phase synchronization operation: The standby ARM chip continuously reads the voltage-controlled DA control word C1 of the master ARM chip, compares it with the local control word C2, calculates the phase error Δφ=C1-C2 in real time, and adjusts the output of the local voltage-controlled crystal oscillator (VCXO) to achieve closed-loop tracking of the output phase between the master and standby chips; the adjustment period of the phase-locked loop is controlled within 200μs to meet the stability requirements of the frequency output.

8. The dual-chip hot standby control method for a spaceborne rubidium atomic clock according to claim 7, characterized in that, Also includes: S5. Switchback mechanism after main control recovery: After the backup ARM chip takes over, the status packet of the main control ARM chip is continuously monitored. If the internal heartbeat returns to normal for three consecutive cycles, the register check value is consistent with the CRC check result, and the phase error satisfies |Δφ|≤2, then the master control priority switchback logic is triggered, and control is returned to the master control ARM chip.

9. A dual-chip hot standby control method for a spaceborne rubidium atomic clock according to claim 8, characterized in that, During the master / slave switchover, all servo outputs remain connected to the anti-interference low-pass filter circuit to buffer the minor level jumps caused by the switchover and ensure the stability of the rubidium atomic clock output frequency.

10. An electronic device for low-Earth orbit satellites, characterized in that, The electronic device includes: at least one processor, a memory, and a servo interface circuit connected to the processor, wherein the memory stores instructions configured to be executed by the processor to implement the dual-chip hot standby control method for a spaceborne rubidium atomic clock as described in any one of claims 4-9.

Images