A spaceborne motor driving chip anti-single particle rapid recovery system and method

Abstract

The application relates to a single-particle-resistant quick recovery system and method of a satellite-borne motor drive chip, and belongs to the field of spacecraft device fault recovery technology. The system comprises a directly linked motor drive chip and a controller; the motor drive chip is used for identifying various abnormalities through a sensor built in an internal drive protection unit, feeding back to an internal logic processing unit, controlling internal drive MOS units to be temporarily closed by the logic processing unit, and combining and outputting an abnormal signal to the controller; and the logic processing unit receives a low pulse reset signal output by the controller to perform single-particle-resistant quick recovery, and restarts each drive MOS unit after recovery; the controller is used for receiving an abnormal signal output by the logic processing unit and combining a set software strategy parameter, performing state detection and abnormal processing of the motor drive chip at a software level, and outputting a low pulse reset signal to the logic processing unit. The system can enhance the flexibility and configurability of single-particle protection.

Description

Technical Field

[0001] This application relates to the field of aerospace device fault recovery technology, and in particular to a system and method for rapid single-event recovery of a spaceborne motor drive chip. Background Technology

[0002] With the ever-increasing power demands of aerospace devices, high-power motor drive circuits are widely used in aerospace products. To meet the requirements of miniaturization, high integration, and low cost, the commercial aerospace sector is increasingly using COTS (Commercial Off-The-Shelf) devices to construct motor drive circuits. COTS devices have advantages such as small size, high power density, and simple peripheral circuits. However, COTS devices have poor resistance to space radiation, and are particularly prone to single-event effects such as single-event lock-up (SEL) and single-event functional interruption (SEFI). SEL causes a sharp increase in the device's supply current, which, if not handled promptly, may cause the device to burn out or even affect the overall satellite power supply safety. SEFI causes device malfunction, resulting in no output signal to subsequent circuits and causing system interruption.

[0003] Currently, single-event protection for COTS motor drive circuits typically employs hardware overcurrent detection and rapid power-off recovery: a power switch is connected in series at the driver's power supply return line, and a current sampling circuit and main controller logic work together to achieve rapid SEL recovery. Motor angle information is used to determine if a functional interruption has occurred, and the main control chip controls the chip to power down and then power on again to achieve functional interruption recovery. However, this hardware protection scheme relies on additional complex components such as Hall sensors, high-speed operational amplifiers, and comparators, leading to higher system costs, larger hardware size, increased design complexity, and reduced system reliability. Furthermore, the power switch and analog components in the hardware link also face the risk of failure due to single-event effects, failing to fundamentally eliminate the potential for hardware failure. In addition, this scheme usually lacks flexible software configurability, making it difficult to quickly optimize the protection strategy through firmware updates. Summary of the Invention

[0004] Therefore, it is necessary to provide a simpler, more flexible, and more reliable single-event recovery system and method for spaceborne motor drive chips to address the aforementioned technical problems.

[0005] A single-event fast recovery system for a spaceborne motor drive chip, the system comprising a directly linked motor drive chip and a controller; The motor drive chip contains a drive protection unit, a logic processing unit, and multiple drive MOS units. It is configured to identify overcurrent, overvoltage, and overtemperature anomalies through the built-in sensors of the drive protection unit and feed them back to the logic processing unit. The logic processing unit then controls each drive MOS unit to shut down temporarily and merges various anomaly output signals to the controller. It is also configured to receive a low-pulse reset signal from the controller for single-event fast recovery and restart each drive MOS unit after recovery. The controller is configured to receive the abnormal signal output by the logic processing unit, and in conjunction with the set software strategy parameters, perform state detection and abnormal handling of the motor drive chip at the software level, and output a low pulse reset signal to the logic processing unit. The software strategy parameters include state detection parameters and reset signal configuration parameters. The state detection parameter is the anti-jitter time, and the reset signal configuration parameters include the number of resets, the time interval, and the reset time.

[0006] In one embodiment, the controller internally includes a status acquisition module, a status detection and exception handling strategy module, and a driver interface module; The status acquisition module is used to receive abnormal signals output by the logic processing unit and forward them to the status detection and abnormal handling strategy module; The status detection and anomaly handling strategy module is used to perform status detection and anomaly handling of the motor driver chip at the software level based on anomaly signals and set software strategy parameters. Specifically, when an anomaly signal occurs and the signal pull-down exceeds the set debouncing time, the status detection and anomaly handling strategy module determines that the motor driver chip has a drive anomaly caused by single-event effect. Under the set reset count, time interval, and reset time configuration, it generates a low-pulse reset signal and sends it to the drive interface module. The reset count controls the number of drive resets triggered by the low-pulse reset signal, the time interval controls the time length between two adjacent drive resets, and the reset time controls the execution duration of a single drive reset. The drive interface module is used to output a low-pulse reset signal to the logic processing unit of the motor drive chip.

[0007] In one embodiment, the controller also includes an external command interface. Software policy parameters are input to the external command interface by an external communication device in the form of external commands, and are then forwarded by the external command interface to the status detection and exception handling policy module.

[0008] In one embodiment, the state detection and anomaly handling strategy module is also used to detect the number of times a single axis drive anomaly occurs and the number of times a drive reset occurs, and outputs the number of times a drive anomaly occurs and the number of times a drive reset occurs to an external communication device through an external command interface, so as to provide data support for the on-orbit health management and fault analysis of the motor drive chip.

[0009] In one embodiment, the software strategy parameters are designed differently based on the characteristics of different motor drive chips, different load conditions, and different levels of single-event events.

[0010] In one embodiment, the low-pulse reset signal includes a RESET signal and multiple PWM signals; the RESET signal is used to drive the logic processing unit to perform anti-single-event fast recovery, and each PWM signal is used to drive the logic processing unit to perform a restart of each driving MOS unit.

[0011] In one embodiment, the controller is an FPGA.

[0012] In one embodiment, the motor drive chip also includes a VREG that is directly linked to the drive protection unit and the logic processing unit. The VREG is used to regulate the voltage of the drive protection unit and the logic processing unit.

[0013] A method for single-event recovery of a spaceborne motor drive chip, the method being implemented based on the aforementioned single-event recovery system for a spaceborne motor drive chip, includes the following steps: Inside the motor drive chip, the sensors built into the drive protection unit identify overcurrent, overvoltage, and overtemperature anomalies and feed them back to the logic processing unit. The logic processing unit then controls each drive MOS unit to shut down temporarily and merges various anomaly output signals to the controller. In the controller, the abnormal signal output by the logic processing unit is received, and in combination with the set software strategy parameters, the status detection and abnormal handling of the motor drive chip are performed at the software level, and a low pulse reset signal is output to the logic processing unit. Finally, the logic processing unit receives the low-pulse reset signal output by the controller to perform anti-single-event fast recovery, and restarts each driving MOS unit after recovery.

[0014] The aforementioned system and method for rapid single-event recovery of a spaceborne motor drive chip eliminates the need for external components for status detection. It achieves this simply by directly linking the controller to the motor drive chip. Compared to traditional hardware protection solutions, this significantly reduces the number of components, PCB area, and weight, meeting the miniaturization, lightweight, and high reliability requirements of aerospace products. Furthermore, by combining abnormal signals with pre-defined software strategy parameters, the system performs status detection and anomaly handling of the motor drive chip at the software level, enabling rapid recovery from single-event effects. This eliminates potential hardware failures, improves system reliability, and allows for adaptive optimization of the recovery strategy based on adjustments to the software strategy parameters, increasing on-orbit flexibility. Attached Figure Description

[0015] Figure 1 This is a schematic diagram of the structure of a single-event fast recovery system for a spaceborne motor driver chip in one embodiment; Figure 2 This is a schematic diagram of software strategy parameter input in one embodiment; Figure 3 This is a schematic diagram of telemetry information output in one embodiment; Figure 4 This is a schematic diagram of the RESET signal in one embodiment; Figure 5 This is a schematic diagram of the internal structure of the motor driver chip in one embodiment; Figure 6 This is a schematic diagram of unreinforced test data in one embodiment; Figure 7 This is a schematic diagram of the test data after reinforcement in one embodiment. Detailed Implementation

[0016] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0017] In one embodiment, such as Figure 1 As shown, a single-event fast recovery system for a spaceborne motor drive chip is provided, including a directly linked motor drive chip and a controller. The motor drive chip internally includes a drive protection unit, a logic processing unit, and multiple drive MOS units. It is configured to identify anomalies such as overcurrent, overvoltage, and overtemperature through sensors built into the drive protection unit and feed them back to the logic processing unit. The logic processing unit then controls each drive MOS unit to briefly shut down and simultaneously merges various anomalies to output an anomaly signal (FAULT) to the controller. It is also configured to receive a low-pulse reset signal from the controller for single-event fast recovery and restart each drive MOS unit after recovery. The controller is configured to receive the anomaly signal output from the logic processing unit and, in conjunction with set software strategy parameters, execute state detection and anomaly handling of the motor drive chip at the software level, and output a low-pulse reset signal to the logic processing unit. The software strategy parameters include state detection parameters and reset signal configuration parameters. The state detection parameters include parameters such as anti-jitter time, and the reset signal configuration parameters include parameters such as the number of resets, time interval, and reset time. Furthermore, combined with… Figure 1 It is known that the motor driver chip is also connected to an external motor, and drives the motor to rotate by outputting PWM (pulse width modulation) signals.

[0018] It should be understood that the above-mentioned single-event recovery system for the onboard motor drive chip can be implemented simply by directly linking the controller to the motor drive chip. Compared with traditional hardware protection schemes, this significantly reduces the number of components, PCB area, and weight, meeting the development requirements of miniaturization, lightweighting, and high reliability for aerospace products. At the same time, by combining abnormal signals and set software strategy parameters, the status detection and anomaly handling of the motor drive chip are executed at the software level, enabling rapid recovery from single-event effects of the motor drive chip. This eliminates the risk of hardware failure, improves system reliability, and allows for adaptive optimization of the recovery strategy based on adjustments to the software strategy parameters, increasing on-orbit flexibility.

[0019] In one embodiment, such as Figure 1 As shown, the controller internally includes a status acquisition module, a status detection and exception handling strategy module, and a drive interface module. The status acquisition module receives exception signals output by the logic processing unit and forwards them to the status detection and exception handling strategy module. The status detection and exception handling strategy module performs status detection and exception handling of the motor drive chip at the software level based on the exception signal and the set software strategy parameters. Specifically, when an exception signal occurs and the exception signal pull-down exceeds the set anti-bounce time, the status detection and exception handling strategy module determines that the motor drive chip has a drive exception caused by a single event event. Under the set reset count, time interval, and reset time configuration, it generates a low-pulse reset signal and sends it to the drive interface module. The reset count controls the number of drive resets triggered by the low-pulse reset signal, the time interval controls the time length between two adjacent drive resets, and the reset time controls the execution duration of a single drive reset. The drive interface module outputs the low-pulse reset signal to the logic processing unit of the motor drive chip.

[0020] It should be understood that by customizing the number of resets, the time interval, and the reset time, a low-pulse reset signal can be output, flexibly adapting to the reset electrical characteristics and fault recovery requirements of different motor driver chips. By precisely limiting the total execution frequency of drive reset operations through the number of resets, the frequent impact on devices and system malfunctions caused by unlimited repeated resets can be effectively avoided. Relying on the adjustable adjacent reset time interval, sufficient state recovery and signal stabilization buffer period can be reserved to avoid signal interference and chip overload failure caused by the superposition of continuous reset actions. The configurable single reset duration can match the effective low-level holding area required by various motor driver chips. In between, each reset pulse has sufficient level maintenance time to complete the complete reset action. The coordinated configuration of the three parameters enables fine-grained and controllable adjustment of the drive reset process. It can orderly carry out multiple reset retries to try to restore the normal operation of the equipment in the event of fault scenarios such as abnormal pull-down timeout. At the same time, the parameter constraints can reduce the wear and tear on the hardware circuit by repeated resets, taking into account the fault self-recovery capability and the long-term stability of the drive hardware. Meanwhile, the parameter configuration mode also improves the system's adaptability and universality to different motor drive chips. The reset logic can be adapted by adjusting the configuration parameters without modifying the hardware circuit, which greatly reduces the cost of equipment debugging and compatibility modification.

[0021] In one embodiment, such as Figure 2 As shown, the controller also includes an external command interface. Software policy parameters are input to the external command interface by external communication devices in the form of external commands, and then forwarded by the external command interface to the status detection and exception handling policy module.

[0022] In one embodiment, such as Figure 3 As shown, the status detection and anomaly handling strategy module is also used to detect the number of drive anomalies and drive resets of a single axis, and output telemetry information including the number of drive anomalies and drive resets to external communication devices (such as spaceborne computers) through an external command interface, providing data support for on-orbit health management and fault analysis of the motor drive chip.

[0023] In one embodiment, the software strategy parameters are designed differently based on the characteristics of different motor drive chips, different load conditions, and different levels of single-event events.

[0024] It should be understood that the software strategy parameters are configured by inputting external commands through external communication devices. Telemetry information, including the number of drive anomalies and drive resets, is output to the external communication devices via the external command interface. This allows the ground control terminal to have a real-time and complete understanding of the operating conditions and fault handling process of on-orbit drive devices, providing detailed quantitative evidence for ground-based condition analysis, fault tracing, and operational evaluation. Simultaneously, the on-orbit hardened software strategy parameters can be dynamically modified online using the controller's internal software reconfiguration mechanism. Fault handling and reset control logic can be flexibly adjusted without modifying the device hardware, significantly improving the adaptability and flexibility of on-orbit operation strategy adjustments. The anomaly handling logic can be adaptively optimized based on different operating conditions such as environmental disturbances and device aging at different on-orbit stages. Simultaneously, the control strategy is iteratively adapted using real on-orbit operating data, specifically avoiding potential risks such as prolonged abnormal operation and frequent reset impacts. This effectively reduces the failure probability of on-orbit devices under long-term operation, improving the operational reliability of the spaceborne motor drive chip and the continuous and stable execution capability of the mission.

[0025] In one embodiment, such as Figure 1 As shown, the low-pulse reset signal includes a RESET signal and multiple PWM signals; the RESET signal is used to drive the logic processing unit to perform anti-single-event fast recovery, and each PWM signal is used to drive the logic processing unit to perform the restart of each drive MOS unit.

[0026] like Figure 4 As shown, when an abnormal signal occurs and the abnormal signal pulls down for more than the set debounce time, the RESET signal is generated under the configuration of the set number of resets N, the time interval, and the reset time.

[0027] In one embodiment, such as Figure 1 As shown, the controller is an FPGA (Field Programmable Gate Array).

[0028] In one embodiment, such as Figure 5 As shown, the motor driver chip also includes a VREG (voltage regulator) directly connected to the drive protection unit and the logic processing unit. The VREG is used to regulate the voltage of the drive protection unit and the logic processing unit. Specifically, Figure 5The external input main power supply (VDD) shown is connected to the VREG inside the motor driver chip to complete the overall power supply of the chip. The other end of VDD is connected in series with the external VREG, analog signal ground (AGND), and digital system ground (GND) to form a grounding loop. The drive protection unit also has an external output voltage regulation feedback pin (ADJ). When the sensor built into the drive protection unit detects abnormalities such as overcurrent, overvoltage, or overtemperature, the logic processing unit controls each drive MOS unit to temporarily shut down. At this time, the four drive MOS units stop external output (OUT), and the logic processing unit merges various abnormal output abnormal signals (FAULT) to the controller. After receiving the RESET_AB and RESET_CD signals from the controller and performing single-event fast recovery, the logic processing unit receives four PWM signals from the controller corresponding to the number of drive MOS units and executes a restart of each drive MOS unit. Furthermore, the logic processing unit also receives an external input mode signal (MODE) for parameter configuration.

[0029] In one embodiment, a method for single-event recovery of a spaceborne motor driver chip is provided. This method is based on the aforementioned single-event recovery system for a spaceborne motor driver chip and includes the following steps: Inside the motor drive chip, the sensors built into the drive protection unit identify overcurrent, overvoltage, and overtemperature anomalies and feed them back to the logic processing unit. The logic processing unit then controls each drive MOS unit to shut down temporarily and merges various anomaly output signals to the controller. In the controller, the abnormal signal output by the logic processing unit is received, and in combination with the set software strategy parameters, the status detection and abnormal handling of the motor drive chip are performed at the software level, and a low pulse reset signal is output to the logic processing unit. Finally, the logic processing unit receives the low-pulse reset signal output by the controller to perform anti-single-event fast recovery, and restarts each driving MOS unit after recovery.

[0030] Furthermore, to verify the beneficial effects of the system proposed in this application, heavy ion single-event experiments were conducted. Experiments were performed sequentially on the circuit without a hardened spaceborne motor driver chip (i.e., without the software strategy proposed in this application) and the circuit with a hardened spaceborne motor driver chip (i.e., with the software strategy proposed in this application). During the tests, the FPGA periodically issued control commands to drive the motor to rotate periodically. The heavy ion experiment results for the unhardened spaceborne motor driver chip are as follows: Figure 6As shown, when the FPGA sends a -20-degree turn command, the motor rotates to -20 degrees, and the rotation is normal. When the FPGA sends a 20-degree turn command, the motor rotates to 20 degrees. At this moment, the heavy ion beam is turned on, and the motor stops rotating after reaching a certain angle. Based on the chip current, it can be determined that the driver chip has entered standby mode. After a power outage and restart, the motor remains stationary. Only after sending the -20-degree turn command again does the motor start rotating again. This experiment demonstrates that while a power outage and restart can restore the chip to normal operation, the motor cannot continue rotating according to the previous command and requires a new command to be sent.

[0031] Figure 7 The heavy ion test results were used to reinforce the circuitry of the spaceborne motor drive chip. Figure 7 It can be seen that the FPGA periodically issues control commands to turn at -20 degrees and 20 degrees, the heavy ion beam is turned on at the beginning of the experiment, and the motor continues to rotate towards the target angle without any issues. Figure 6 The observed phenomenon of stopped rotation demonstrates this. Therefore, the experimental data proves that the software strategy employed in the system proposed in this application can quickly recover from the single-event effect of the onboard motor drive chip without affecting the normal operation of the controller.

[0032] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0033] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application.

Claims

1. A single-event fast recovery system for a spaceborne motor drive chip, characterized in that, The system includes a directly linked motor drive chip and a controller; The motor drive chip internally includes a drive protection unit, a logic processing unit, and multiple drive MOS units. It is configured to identify overcurrent, overvoltage, and overtemperature anomalies through sensors built into the drive protection unit and feed them back to the logic processing unit. The logic processing unit then controls each drive MOS unit to shut down temporarily and merges various anomaly output signals to the controller. It is also configured to receive a low-pulse reset signal output by the controller for single-event fast recovery and restart each drive MOS unit after recovery. The controller is configured to receive the abnormal signal output by the logic processing unit, and in conjunction with the set software strategy parameters, perform state detection and abnormal handling of the motor drive chip at the software level, and output a low-pulse reset signal to the logic processing unit; wherein, the software strategy parameters include state detection parameters and reset signal configuration parameters, the state detection parameters being the anti-jitter time, and the reset signal configuration parameters including the number of resets, the time interval, and the reset time.

2. The anti-single-event fast recovery system for a spaceborne motor drive chip according to claim 1, characterized in that, The controller internally includes a status acquisition module, a status detection and exception handling strategy module, and a driver interface module; The status acquisition module is used to receive the abnormal signal output by the logic processing unit and forward it to the status detection and abnormal handling strategy module; The state detection and anomaly handling strategy module is used to perform state detection and anomaly handling of the motor drive chip at the software level based on the anomaly signal and in conjunction with the set software strategy parameters. Specifically, when an anomaly signal occurs and its pull-down exceeds the set anti-jitter time, the state detection and anomaly handling strategy module determines that the motor drive chip has a drive anomaly caused by a single-event effect. Under the set reset count, time interval, and reset time configuration, it generates a low-pulse reset signal and sends it to the drive interface module. The reset count controls the number of drive resets triggered by the low-pulse reset signal, the time interval controls the time length between two adjacent drive resets, and the reset time controls the execution duration of a single drive reset. The drive interface module is used to output the low-pulse reset signal to the logic processing unit of the motor drive chip.

3. The anti-single-event fast recovery system for a spaceborne motor drive chip according to claim 2, characterized in that, The controller also includes an external command interface. The software policy parameters are input to the external command interface by an external communication device in the form of external commands, and are then forwarded by the external command interface to the status detection and exception handling policy module.

4. The anti-single-event fast recovery system for a spaceborne motor drive chip according to claim 3, characterized in that, The state detection and anomaly handling strategy module is also used to detect the number of drive anomalies and drive resets of a single axis, and output the number of drive anomalies and drive resets to an external communication device through the external command interface, providing data support for the on-orbit health management and fault analysis of the motor drive chip.

5. The anti-single-event fast recovery system for a spaceborne motor drive chip according to claim 3, characterized in that, The software strategy parameters are designed differently based on the characteristics of different motor drive chips, different load conditions, and different levels of single-event events.

6. The anti-single-event fast recovery system for a spaceborne motor drive chip according to claim 1, characterized in that, The low-pulse reset signal includes a RESET signal and multiple PWM signals; the RESET signal is used to drive the logic processing unit to perform anti-single-event fast recovery, and each PWM signal is used to drive the logic processing unit to perform a restart of each driving MOS unit.

7. The anti-single-event fast recovery system for a spaceborne motor drive chip according to claim 1, characterized in that, The controller is an FPGA.

8. The anti-single-event fast recovery system for a spaceborne motor drive chip according to claim 1, characterized in that, The motor drive chip also includes a VREG that is directly linked to the drive protection unit and the logic processing unit. The VREG is used to regulate the voltage of the drive protection unit and the logic processing unit.

9. A method for single-event fast recovery of a spaceborne motor drive chip, characterized in that, The method is implemented based on the anti-single-event fast recovery system of a spaceborne motor drive chip according to any one of claims 1 to 8, and includes the following steps: Inside the motor drive chip, the sensors built into the drive protection unit identify overcurrent, overvoltage, and overtemperature anomalies and feed them back to the logic processing unit. The logic processing unit then controls each drive MOS unit to shut down briefly and merges various anomaly output signals to the controller. In the controller, the abnormal signal output by the logic processing unit is received, and in combination with the set software strategy parameters, the status detection and abnormal handling of the motor drive chip are performed at the software level, and a low pulse reset signal is output to the logic processing unit. Finally, the logic processing unit receives the low-pulse reset signal output by the controller to perform anti-single-event fast recovery, and restarts each driving MOS unit after recovery.

Images