Satellite multi-path heating loop fault self-check system and method

Abstract

The application discloses a satellite multi-path heating loop fault self-checking system, which comprises a main control module, a transceiver, an AD acquisition module, a multiplexer module, a load module, an IO isolation driving module and a power module; the main control module, the transceiver, the AD acquisition module, the multiplexer module and the load module are sequentially connected; the IO isolation driving module is connected between the main control module and the load module; and the power module is connected with the main control module, the transceiver, the AD acquisition module and the multiplexer module to provide a power supply. The application further provides a satellite multi-path heating loop fault self-checking method. The application can realize full coverage, real-time and accurate fault detection and isolation of the multi-path heating loop under the condition of limited hardware resources.

Description

Technical Field

[0001] This invention relates to the field of commercial aerospace, and in particular to a fault self-diagnosis system and method for satellite thermal control multi-channel active thermal control heating circuits. Background Technology

[0003] The satellite thermal control system is one of the key systems for ensuring the stable operation of onboard electronic equipment. Active thermal control heating loops typically use heating elements distributed in different parts of the satellite to regulate the temperature of equipment, structural components, or sensitive devices inside the cabin, ensuring that their operating temperature remains within the allowable range.

[0004] As satellite functionality becomes increasingly complex, the number of onboard heating circuits continues to rise, with engineering practice now demanding configurations of 60 or more heating circuits. Existing multi-circuit heating circuit detection solutions suffer from the following main problems: Limited detection channel resources. Configuring a separate ADC sampling channel for each heating circuit would significantly increase hardware resource consumption, system cost, and circuit complexity; furthermore, selecting high-precision, multi-channel ADC chips presents challenges. Insufficient fault location and diagnosis capabilities. Traditional detection schemes struggle to distinguish between open-circuit and short-circuit faults in real-time during heating, such as fuse 560 breakage, connector poor contact, or fuse 560 short circuit, leading to delayed fault detection and hindering accurate handling. Low system resource utilization efficiency. In an architecture where time-sharing heating reduces peak power consumption, additional independent detection time windows for fault detection could reduce heating efficiency and even waste onboard power resources. Lack of effective isolation between the main control side and the load side. In traditional solutions, the MCU is often directly electrically connected to the acquisition and drive modules on the heating load side. When a fault occurs on the load side (such as a short circuit, surge, or grounding abnormality), the interference or fault energy may be transmitted to the main control side through the signal link, endangering the safety of the entire satellite control system.

[0005] The above content is only used to illustrate the relevant technical background in this field and does not constitute an admission of the prior art, nor does it constitute a limitation on the scope of protection of this invention. Summary of the Invention

[0006] The following description illustrates the contributions made by this invention.

[0007] To address the aforementioned issues, this invention provides a satellite multi-circuit heating circuit fault self-testing system and method, which can achieve full coverage, real-time, and accurate fault detection and isolation of multiple heating circuits under limited hardware resources, while also possessing dual-side electrical isolation capability between the main control unit and the load.

[0008] A satellite multi-channel heating circuit fault self-diagnosis system includes: a main control module, a transceiver, an AD acquisition module, a multiplexer module, a load module, an I / O isolation driver module, and a power supply module. The main control module, transceiver, AD acquisition module, multiplexer module, and load module are connected in sequence. The I / O isolation driver module is connected between the main control module and the load module. The power supply module is connected to the main control module, transceiver, AD acquisition module, and multiplexer module to provide power. The main control module sends a channel switching command to the transceiver via an internal data bus. The command includes the address selection signal and enable control signal of the multiplexer module. After electrical isolation or level conversion, the transceiver transmits the command to the multiplexer module, controlling the multiplexer module to perform channel selection and switching. At the same time, the digital sampling value after analog-to-digital conversion by the AD sampling module is isolated by the transceiver and sent back to the main control module, forming an isolated acquisition closed loop. The main control module outputs a switch control signal, which is electrically isolated and power-enhanced by the IO isolation drive module, and then drives the load drive module to control the on / off state and adjust the power of the heating load circuit.

[0009] Furthermore, the main control module is a dual-core MCU, including core A and core B. Core A serves as the real-time control core, undertaking hard real-time tasks, and is responsible for one or any combination of matrix scanning timing, ADC triggering and sampling window management, multi-channel PWM / switching signal output, rapid shutdown of short-circuit faults, and watchdog feeding. Core B serves as the application processing core, undertaking soft real-time tasks, and is responsible for one or any combination of three-stage detection timing arrangement, three-threshold decision algorithm, fault latching and alarm recording, telemetry packet assembly and reporting, communication with the space station OBC, ground command processing, and fault log persistence.

[0010] Furthermore, the power module includes a main control power supply and a DC-DC module, which are used to provide operating current for the main control module, transceiver, AD acquisition module and multiplexer module.

[0011] Furthermore, the load module includes a load power supply, a voltage acquisition module, a current acquisition module, a load drive module, and multiple heating loads. The load drive module is connected to the IO isolation drive module and the multiple heating loads, and is connected to the multiplexer module through the current acquisition module. The load power supply is connected to the multiplexer module through the voltage acquisition module, and is connected to the load drive module and the multiplexer module through the current acquisition module. The main control module outputs a switch control signal, which, after electrical isolation and power enhancement by the IO isolation drive module, drives the load drive module to realize the on / off control and power regulation of the heating circuit, and connects the sampled voltage to the matrix scanning network for sampling by the AD acquisition module.

[0012] Furthermore, each heating circuit in the load module includes a fuse, a MOSFET switch, a voltage acquisition circuit, and a current acquisition circuit connected in series, with the MOSFET switch serving as the load drive module.

[0013] Furthermore, the system includes eight 8-to-1 multiplexers, the load module includes eight load drive modules and eight heating loads, each load drive module includes eight MOSFET switches, and each heating load includes eight heating loads. The main control module outputs 64 MOSFET520 switch control signals, which are electrically isolated and amplified by the IO isolation drive module to drive the MOSFET power switches in the 64 heating circuits respectively. The 64 heating circuits are grouped into eight groups of eight, forming eight detection channels. The current sampling signal of each heating circuit is connected to the input terminal of the corresponding 8-to-1 multiplexer, and the output terminal of the corresponding multiplexer is connected to the corresponding ADC sampling channel. After isolation by the transceiver, the main control module controls the selection state of each multiplexer through three address lines and eight enable control lines.

[0014] Furthermore, after each address switch, the main control module sends a control command via the transceiver and sets a preset stabilization time. After the analog switch on-resistance, parasitic capacitance, and signal conditioning circuit output stabilize, the AD acquisition module is then started to perform ADC sampling.

[0015] Furthermore, the system sets a sampling delay time after address switching and discards the first sampled value and / or performs multiple sampling averaging processes before ADC sampling.

[0016] This invention also provides a fault detection method for the above-mentioned system. The fault detection process includes three stages: pre-heating pulse self-test, real-time monitoring during heating, and post-heating shutdown confirmation. Specifically, it includes: Before formal heating, the system applies a short-duty-cycle detection pulse to the circuit to be started and collects the corresponding current. During this stage, the load switch is not turned on, and the judgment rule is as follows: If the sampled current is less than the first threshold, the status is normal. All other current conditions trigger an alarm; During the operation of the heating circuit, the system continuously collects the current of each circuit according to the matrix scanning cycle and makes judgments based on the current switch drive status. During this stage, the load switch is in the open state, and the judgment rule is as follows: If the sampled current is less than the first threshold: it is determined that the circuit is open, an alarm is triggered immediately, and the switch of the circuit is turned off at the same time; If the first threshold ≤ sampling current ≤ second threshold, the circuit is considered to be working normally, and only continuous temperature monitoring is required thereafter. If the sampled current is greater than the second threshold, it is determined that a short circuit has occurred in that circuit, and the switch for that circuit is immediately turned off and an alarm is triggered. After the heating circuit is turned off, the system collects the corresponding circuit current again. During this stage, the load switch is already closed. The judgment rule is as follows: If the sampled current is less than the first threshold, the status is normal. All other current conditions triggered an alarm.

[0017] Furthermore, when the system detects a short circuit or overcurrent fault in a heating circuit, the main control module immediately cancels the PWM drive signal of that circuit, shuts down the corresponding load drive module, prioritizes fast shutdown, and marks the circuit as a fault latching state. Before receiving a reset command or completing a safety confirmation, the circuit is no longer allowed to be put back into heating. For open-circuit faults, the system records the fault and prohibits the loop from continuing to participate in the thermal control closed-loop control, so as to prevent the control system from continuously increasing the heating duty cycle because the temperature cannot rise.

[0018] Furthermore, in the system recovery strategy, for short-circuit faults, the system defaults to maintaining the latched off state. After ground confirmation or meeting the preset safety conditions, a low duty cycle tentative restart test is performed. If the restart test still triggers the short-circuit criterion, the system continues to maintain the isolated state. For open circuit faults, the system maintains the alarm and waits for ground instructions or a system reset before retesting.

[0019] Furthermore, the main control module performs a rationality check on the sampled data, including current range check, continuity check and abnormal change check, and / or, for sampled values ​​near the threshold boundary, the system adopts a repeated sampling confirmation mechanism.

[0020] This invention achieves electrical isolation of the acquisition and control link through a transceiver and electrical isolation of the power drive link through an IO isolation driver module, forming a comprehensive isolation barrier between the control side and the load side. This effectively prevents load-side faults from being reverse-propagated to the main control side, improving the safety of the entire satellite control system. For precise fault classification and rapid isolation, this invention uses a three-threshold current decision mechanism to accurately distinguish between open-circuit faults, normal operating conditions, and short-circuit faults in the heating circuit. Combined with a three-stage embedded detection timing sequence, it achieves pre-fault warning, in-fault isolation, and post-fault confirmation. This ensures accurate fault location and timely isolation, improving operational reliability under high and low temperature, vacuum, irradiation, and vibration environments.

[0021] Other features and advantages of the invention will become more apparent from the following more detailed description, taken in conjunction with the accompanying drawings, which illustrate the advantages of the invention by way of example. Attached Figure Description

[0022] Figure 1 This is a system architecture diagram of a satellite multi-channel heating circuit fault self-testing system according to one embodiment of the present invention; Figure 2 This is a circuit diagram of a single heating circuit in a satellite multi-channel heating circuit fault self-testing system according to one embodiment of the present invention; Figure 3 This is a schematic diagram of the matrix scanning detection architecture of a satellite multi-channel heating circuit fault self-testing system according to one embodiment of the present invention; and Figure 4 This is a flowchart illustrating a satellite multi-channel heating circuit fault self-testing method according to one embodiment of the present invention. Detailed Implementation

[0023] The accompanying drawings illustrate the invention. Various embodiments are disclosed herein. Numerous specific details are set forth in the following description to provide a more thorough understanding of the invention. However, those skilled in the art will recognize that the technical content described herein can be practiced without one or more specific details, or other methods, components, materials, etc. In other examples, well-known structures, materials, or operations are not shown or described in detail to avoid obscuring specific content.

[0024] Please refer to Figure 1This invention discloses a satellite multi-channel heating circuit fault self-diagnosis system, comprising a main control module 100, a transceiver 200, an AD acquisition module 300, a multiplexer module 400, a load module 500, an I / O isolation driver module 600, and a power supply module 700. The main control module 100, transceiver 200, AD acquisition module 300, multiplexer module 400, and load module 500 are sequentially connected. The I / O isolation driver module 600 is connected between the main control module 100 and the load module 500. The power supply module 700 is connected to the main control module 100, transceiver 200, AD acquisition module 300, and multiplexer module 400 to provide power. The power supply module 700 includes a main control power supply 710 and a DC-DC (Direct Current) module 720, used to provide operating current to the main control module, transceiver, AD acquisition module, and multiplexer module.

[0025] The main control module 100 sends a channel switching command to the transceiver 200 via its internal data bus. The command includes the address selection signal and enable control signal of the multiplexer module 400. After electrical isolation or level conversion, the transceiver 200 transmits the command to the multiplexer module 400, controlling the multiplexer module 400 to perform channel selection and switching. Simultaneously, the digital sampling value after analog-to-digital conversion by the AD acquisition module 300 is isolated by the transceiver 200 and sent back to the main control module 100, forming an isolated acquisition closed loop. In addition, the main control module 100 outputs a switch control signal, which is electrically isolated and power-enhanced by the IO isolation driver module 600, driving the load driver module 520 to control the on / off state and adjust the power of the heating load 510 circuit.

[0026] In one embodiment, the load module 500 includes a load power supply 530, a voltage acquisition module 550, a current acquisition module 540, a load drive module 520, and multiple heating loads 510. The load drive module 520 is connected to the IO isolation drive module 600 and the multiple heating loads 510, and is connected to the multiplexer module 400 through the current acquisition module 540. The load power supply 530 is connected to the multiplexer module 400 through the voltage acquisition module 550, and is connected to the load drive module 520 and the multiplexer module 400 through the current acquisition module 540. The main control module 100 outputs a switch control signal, which, after electrical isolation and power enhancement by the IO isolation drive module 600, drives the load drive module 520 to realize the on / off control and power adjustment of the heating circuit, and connects the sampled voltage to the matrix scanning network for sampling by the AD acquisition module 300.

[0027] In one embodiment, the main control module 100 is a dual-core MCU, employing an asymmetric dual-core architecture. The two cores operate independently in hardware, with clearly defined software roles, and interact with hardware semaphores through on-chip shared memory for strong consistency. The shared memory (Shared RAM) is used for large-scale, loosely coupled data exchange, including multiple (e.g., 64-channel) sampling current frames, multiple (e.g., 64-channel) fault status words, and multiple (e.g., 64-channel) PWM duty cycle settings. The A core (Control Core) handles hard real-time tasks, including matrix scan timing, ADC triggering and sampling window management, multiple (e.g., 64-channel) PWM / switching signal outputs, μs-level fast shutdown for short-circuit faults, and watchdog timer feeding. The B core (Application Core) handles soft real-time tasks, including three-stage detection timing orchestration, three-threshold decision algorithms, fault latching and alarm logging, telemetry packet assembly and reporting, communication with the spaceborne OBC, ground command processing (including short-circuit recovery confirmation), and fault log persistence. Both cores physically share the same MCU's memory and peripherals, but software tasks do not preempt each other, and task scheduling is core-isolated. The two cores use hardware semaphores to achieve mutual exclusion access, avoiding read / write conflicts.

[0028] The signal transmission of the control link in this invention is as follows: from the dual-core MCU main control module 100 to the transceiver 200 (for isolation) to the multiplexer module 400 (for channel switching control); and from the dual-core MCU main control module 100 to the IO isolation driver module 600 (for isolation) to the load driver module 520 (for power switch control).

[0029] The data acquisition feedback link is as follows: from multiplexer module 400 to AD acquisition module 300 to transceiver 200 (for isolation) to dual-core MCU main control module 100.

[0030] The power supply link is: load power supply 530 to load drive module 520 to multi-channel (64-channel) heating circuit array.

[0031] In one embodiment, the multiplexer module 400 consists of eight 8-to-1 analog multiplexers. A multiplexer is a device that controllably selects one signal from multiple input signals for output. Each analog multiplexer corresponds to a set of heating circuits, and each set contains eight sampled signals. Through this matrix scanning structure, up to 64 analog sampled signals can be converged to eight ADC sampling channels, thereby significantly reducing ADC resource usage, as will be further explained in the following embodiments.

[0032] The present invention adopts a dual-layer isolated signal link design, including acquisition and control link isolation (transceiver 200) and power drive link isolation (IO isolation drive module 600).

[0033] The data acquisition and control link isolation includes: the dual-core MCU main control module 100 sends channel switching commands to the transceiver 200 via its internal data bus. These commands include address selection signals and enable control signals for the analog multiplexers. The transceiver 200 electrically isolates (or levels-converts) these digital control signals and transmits them to the multiplexer module 400 via the isolated signal line, controlling each analog multiplexer to complete channel selection and switching. Simultaneously, the digital sampled values ​​from the analog-to-digital conversion by the AD acquisition module 300 are isolated by the transceiver 200 and transmitted back to the dual-core MCU main control module 100, forming a complete isolated acquisition closed loop. The introduction of the transceiver 200 achieves electrical isolation between the main control side and the acquisition side. When an abnormality occurs in the load-side acquisition circuit or heating circuit (such as a ground fault or surge impact), the abnormal energy is blocked by the isolation barrier of the transceiver 200 and cannot be transmitted back to the main control MCU via the acquisition signal link, thus protecting the safety of the core control unit.

[0034] The power drive link isolation includes: the 64 MOSFET520 switching control signals (PWM signals) output by the dual-core MCU main control module 100 are electrically isolated and amplified by the IO isolation drive module 600, and then used to drive the MOSFET520 power switches in multiple (64) heating circuits respectively. The IO isolation drive module 600 typically uses optocoupler isolation or magnetic isolation to achieve electrical isolation between the low-voltage control circuit on the main control side and the high-voltage power circuit on the load side.

[0035] Therefore, transceiver 200 and IO isolation driver module 600 act on different signal links, forming complementary isolation barriers: transceiver 200 isolates the control transmission and acquisition feedback signal links, preventing interference and fault propagation on the acquisition side; IO isolation driver module 600 isolates the power drive signal link, preventing power side faults and surge propagation; the two work together to achieve comprehensive isolation between all MCU IO signals and the load side. Through the above dual-layer isolation architecture, all MCU IO signals are isolated by transceiver 200 or IO isolation module before entering the load side, effectively preventing load side faults (short circuits, surges, grounding anomalies, etc.) from being propagated back to the main control side through the signal link, significantly improving the system reliability in complex electromagnetic environments and fault conditions, and enhancing the safety and reliability of the entire satellite control system.

[0036] Please refer to Figure 2In one embodiment, each heating circuit of the single-circuit heating circuit includes a heating load 510, a MOSFET switch 520, a load power supply 530, a current sampling circuit 540, a voltage sampling circuit 550, and a fuse 560. The main control module 100 outputs a switch control signal, which, after electrical isolation and power enhancement by the IO isolation drive module 600, drives the gate of the MOSFET 520 to realize the on / off control and power regulation of the heating circuit. The fuse 560, MOSFET 520, and current sampling circuit 540 are connected in series, and the sampled voltage is connected to the matrix scanning network for sampling by the AD acquisition module 300. The fuse 560 is connected in series in the power supply path of the heating circuit as the last stage of overcurrent protection; the MOSFET 520 switch, as a power control actuator, is controlled by the isolated drive PWM signal to turn on and off; the current sampling circuit 540 is connected in series in the power circuit for real-time acquisition of the circuit operating current.

[0037] Please refer to Figure 3 In one embodiment, the matrix scanning detection architecture is shown in the figure. In this embodiment, the 64 heating circuits are grouped into 8 groups of 8, forming a total of 8 detection channels. Unused spare input terminals can be reserved for expansion or redundant detection. The current sampling signal of each heating circuit group is connected to the input terminal of the corresponding 8-to-1 analog multiplexer, and the output terminal of the analog multiplexer is connected to the corresponding ADC sampling channel. After isolation by the transceiver 200, the main control module 100 controls the selection state of each analog multiplexer 400 through 3 address lines and 8 enable control lines. Under the same address state, the 8 analog multiplexers 400 output the sampling signal of the same numbered channel within their respective groups, and the 8 ADCs complete sampling synchronously. Subsequently, the main control module 100 switches the address line states via the transceiver 200 to sequentially complete the traversal of the 8 channels within the group. Thus, current sampling of up to 64 heating circuits can be completed through 8 address switches.

[0038] To ensure sampling stability after switching of the analog multiplexer 400, after each address switch, the main control module 100 sends a control command via transceiver 200 and sets a preset stabilization time (tens of microseconds to milliseconds). ADC sampling is only initiated after the analog switch on-resistance, parasitic capacitance, and signal conditioning circuit output have stabilized. Preferably, each channel can be sampled multiple times, and the average or median value is taken to reduce the impact of transient interference and ADC quantization noise on fault detection.

[0039] Unlike traditional solutions where each heating circuit has its own independent ADC sampling channel, this invention groups multiple heating circuits into sets of eight, with each set connected to an ADC sampling channel via an 8-to-1 analog multiplexer. The system uses only eight ADCs to detect the current of up to 64 heating circuits. Compared to multi-channel independent ADC detection schemes, this invention significantly reduces the number of ADC channels, chips, wiring complexity, and power consumption, thus reducing onboard hardware resource usage and improving system integration. It significantly reduces hardware resource consumption while maintaining detection coverage. Since the eight ADCs can acquire eight groups of signals in parallel, this invention offers a shorter detection cycle and better real-time performance compared to a single ADC polling scheme.

[0040] The innovation of the matrix scanning current detection architecture lies in the fact that, without increasing a large amount of ADC hardware resources, it achieves periodic and rapid inspection of multiple heating circuits by simulating the time-division multiplexing of the multiplexer and the ADC; at the same time, combined with the heating control timing, the fault detection process is embedded in the pre-heating, heating and post-heating stages to avoid occupying an additional independent detection window, thereby balancing detection real-time performance and heating efficiency.

[0041] Please refer to Figure 4 The process of this invention for fault detection and status determination of the above-mentioned multi-channel heating circuit is shown in the figure, which includes three stages: pulse self-test before heating, real-time monitoring during heating, and shutdown confirmation after heating.

[0042] The pre-heating pulse self-test phase involves applying a short-duration, low-duty-cycle detection pulse to the circuit to be started before formal heating and sampling the corresponding current. This phase is used to detect potential issues such as fuse 560 blown, connector detachment, sampling circuit abnormalities, or short-circuit risks in advance, preventing faulty circuits from entering a continuous heating state. During this phase, the load switch is not turned on. The specific judgment rule is: if the sampled current I < 0.1A, the status is normal; all other current conditions trigger an alarm.

[0043] The real-time monitoring phase during heating involves the system continuously collecting the current of each circuit according to the matrix scanning cycle during the operation of the heating circuit, and making judgments based on the current switch drive status. When a circuit is in the conduction control state, its sampled current should be within the normal range; if the current is significantly lower than the normal lower limit, it is judged as an open circuit or ineffective conduction; if the current exceeds the short circuit threshold, it is judged as a short circuit or overcurrent fault. During this phase, the load switch is in the open state, and the specific judgment rules are as follows: if I < 0.1A: it is judged as an open circuit, an alarm is immediately triggered, and the switch of that circuit is turned off; if 0.1A ≤ I ≤ 1.0A: it is judged as normal operation, and only temperature monitoring is needed subsequently; if I > 1.0A: it is judged as a short circuit, the switch of that circuit is immediately turned off, and an alarm is triggered. The real-time monitoring phase during heating involves the system continuously collecting the current of each circuit according to the matrix scanning cycle during the operation of the heating circuit, and making judgments based on the current switch drive status. When a circuit is in the conduction control state, its sampled current should be within the normal range.

[0044] The heating-after-shutdown confirmation phase involves the system re-collecting the corresponding circuit current after the heating circuit is shut down. If abnormal current is still detected after shutdown, it is determined that there may be a MOSFET520 breakdown, drive malfunction, or circuit short circuit problem, and a continuous alarm is triggered. During this phase, the load switch is already off, and the judgment rule is: if I < 0.1A, the status is normal; other current conditions will trigger an alarm.

[0045] This invention's three-stage embedded fault detection timing deeply integrates the fault detection process with the heating control timing, dividing it into three stages. This three-stage detection timing embeds fault diagnosis into the entire lifecycle of heating control, eliminating the need for an additional independent detection window and balancing real-time detection with heating efficiency. This invention determines the operating status of the corresponding heating circuit by comparing the sampled current with preset thresholds. These thresholds include an open-circuit determination threshold, a normal operating lower limit threshold, and a short-circuit determination threshold. When the sampled current is less than 0.1A, the circuit is determined to have an open-circuit fault or not forming a valid conductive loop; when the sampled current is within the range of 0.1A to 1.0A, the circuit is determined to be operating normally; when the sampled current is greater than 1.0A, the circuit is determined to have a short-circuit or overcurrent fault.

[0046] In this invention, the threshold design of the first threshold of 0.1A and the second threshold of 1.0A is based on the following: Under normal heating circuit conditions of rated bus voltage and nominal fuse 560 resistance, its operating current is typically within the range of 0.1A to 1.0A. 0.1A serves as the open-circuit determination threshold, avoiding the influence of ADC zero drift, sampling resistor error, op-amp offset voltage, and noise interference; 0.1A serves as the normal operating lower limit, used to distinguish between the actual effective heating current and abnormal weak conduction state; 1.0A serves as the short-circuit determination threshold, used to identify overcurrent risks such as fuse 560 short circuit, MOSFET 520 abnormal conduction, or significant reduction in load resistance. In other methods, the specific thresholds can be calibrated or configured according to the satellite platform bus voltage, fuse 560 power rating, sampling resistor value, and thermal control strategy.

[0047] To avoid misjudgments caused by transient interference, the system can employ a decision mechanism based on whether multiple consecutive samples are consistent or by averaging multiple samples. Under normal circumstances, the multiple sampling and averaging method is used to ensure data stability; the system only confirms a fault when multiple consecutive samples meet the open-circuit or short-circuit judgment conditions; for short-circuit faults, a shorter confirmation time can be used to prioritize loop safety.

[0048] In this invention, the fault isolation and protection mechanism for short-circuit faults is as follows: when the system detects a short circuit or overcurrent fault in a heating circuit, the main control module 100 immediately cancels the PWM drive signal for that circuit, turning off the corresponding MOSFET 520. Simultaneously, the system marks the circuit as fault-latched, and the circuit will not be allowed to be re-energized for heating until a reset command is received or a safety confirmation is completed. The specific short-circuit protection action sequence is as follows: the ADC acquires an abnormal overcurrent signal; the main control module 100 completes the short-circuit condition judgment; the main control module 100 shuts down the corresponding PWM output; the IO isolation drive module 600 cancels the gate drive of the MOSFET 520; the system resamples to confirm whether the circuit current has dropped to a safe range; the fault information is recorded and an alarm is reported.

[0049] For open-circuit faults, the fault isolation and protection mechanism involves recording the fault and prohibiting the circuit from continuing to participate in the thermal control closed-loop control, thus preventing the control system from continuously increasing the heating duty cycle due to insufficient temperature rise. For short-circuit faults, the system prioritizes rapid shutdown to prevent overcurrent from causing bus disturbances, localized overheating, or device damage.

[0050] In this invention, the system recovery strategy can be configured differently based on the fault type. For open-circuit faults, the system maintains the alarm and waits for ground commands or a system reset before re-detecting. For short-circuit faults, the system defaults to a latched-off state and only performs a low-duty-cycle tentative restart detection after ground confirmation or when preset safety conditions are met. If the restart detection still triggers the short-circuit criterion, the system continues to remain in isolation.

[0051] This invention employs a branched MOSFET520 independent control method, where each heating circuit has an independent drive and sampling path. The matrix scanning module is only used for sampling signal multiplexing and does not change the power drive independence of each heating circuit. Therefore, a single circuit failure will not cause the entire heating circuit to fail. For a detected faulty heating circuit, the system immediately shuts off the corresponding MOSFET520 drive signal, locks the circuit's fault state, and records alarm information including the circuit number, fault type, sampled current value, and timestamp. After the faulty circuit is isolated, other normal heating circuits can continue to operate according to the original thermal control strategy, avoiding the impact of a single point of failure on the entire group or satellite's thermal control function.

[0052] To adapt to the satellite's on-orbit operating environment, this invention incorporates anti-interference and reliability designs at both the hardware and software levels.

[0053] In terms of hardware, low-temperature drift and high-stability components are selected in the sampling circuit. The sampled signal enters the AD acquisition module 300 and is filtered and conditioned to obtain a stable value. The analog signal trace adopts a short-path and reference ground integrity design, and an RC filter circuit is set at the sampling signal input to the AD module to reduce the impact of switching noise, bus ripple, and electromagnetic interference on the sampling results. The transceiver 200 is selected as a model with isolation function (such as an isolated CAN transceiver 200, an isolated RS-485 transceiver 200, or a digital isolator) to ensure that the electrical isolation strength between the main control side and the acquisition side meets the requirements of aerospace applications. To address the issues of conduction resistance error, charge injection, and inter-channel crosstalk during the analog multiplexer switching process: the system sets a sampling delay time (tens of microseconds to milliseconds) after address switching, and discards the first sampled value or performs multiple sampling averaging before ADC sampling, thereby improving sampling stability.

[0054] On the software side, the main control module 100 performs a reasonableness check on the sampled data, including current range checks, continuity checks, and abnormal change checks. For sampled values ​​near the threshold boundary, the system employs a repeated sampling confirmation mechanism to avoid false alarms caused by a single interference. For high-risk faults such as short circuits, the system adopts a rapid decision-making strategy to prioritize equipment safety.

[0055] In terms of aerospace environment adaptability, the system can select analog multiplexers, ADCs, MOSFET520s, isolation drivers, transceivers 200s and sampling circuits that meet the requirements of aerospace applications, and combine them with watchdog, fault latching, telemetry reporting and local log recording mechanisms to improve the operational reliability in high and low temperature, vacuum, irradiation and vibration environments.

[0056] Compared with existing technologies, this invention has at least the following beneficial effects: Significantly reduced ADC resource consumption: Traditional 64-channel heating circuit detection schemes typically require 64 ADC sampling channels, while this invention can complete the detection of up to 64 heating circuits using 8 multiplexers and 8 ADC channels, reducing ADC channel resource consumption by approximately 87.5%, while also reducing the number of chips and wiring complexity; Improved real-time performance of multi-channel detection: This invention uses a matrix scanning method for periodic inspection, and can complete the sampling of all 64 heating circuits within a detection cycle of approximately 1ms, meeting the real-time requirements of spaceborne thermal control. The parallel acquisition of 8 ADCs significantly shortens the detection cycle compared to polling one ADC channel by channel; Achieved dual-layer electrical isolation between the main control and load: This invention achieves electrical isolation of the acquisition and control link through a transceiver and electrical isolation of the power drive link through an IO isolation driver module, forming a comprehensive isolation barrier between the control side and the load side, effectively preventing load-side faults from being reverse-propagated to the load side. On the main control side, this invention enhances the safety of the entire satellite control system. It features precise fault classification and diagnosis, and rapid isolation. Through a three-threshold current decision mechanism, it accurately distinguishes between open-circuit faults, normal operating conditions, and short-circuit faults in the heating circuit. Combined with a three-stage embedded detection timing sequence, it achieves pre-fault warning, in-fault isolation, and post-fault confirmation, ensuring accurate fault location and timely isolation. A single-path fault does not affect the overall operation. This invention employs a branched MOSFET520 independent control method, isolating only the heating circuit experiencing a single-path fault while other normal circuits continue operating according to the original thermal control strategy, improving system reliability and mission continuity. A robust combination of hardware and software design is employed. This invention features systematic design in areas such as component selection (low temperature drift, aerospace grade), signal integrity (short path, reference ground, RC filtering), sampling stability (delay waiting, multiple averaging), data rationality checks, and rapid fault decision-making, improving operational reliability under high and low temperature, vacuum, irradiation, and vibration environments.

[0057] Throughout this specification, references to "an embodiment," "an example," or "an example" mean that a particular feature, structure, or characteristic described in connection with that embodiment or example is included in at least one embodiment. Or, an example of the invention. Therefore, phrases such as "in one embodiment" or "in one example" appearing throughout this specification do not necessarily refer to the same embodiment or example. Furthermore, specific features, structures, or characteristics may be combined in any suitable manner in one or more embodiments or examples. Additionally, unless otherwise specifically stated, the terms "having," "comprising," "containing," and similar terms are defined as meaning "including." Furthermore, it should be understood that the accompanying drawings provided herein are for illustrative purposes only and are not necessarily drawn to scale.

[0058] The above description of the illustrated examples of the invention (including those described in the abstract) is not intended to be exhaustive or limited to the precise forms disclosed. While specific embodiments and examples of the invention have been described herein for illustrative purposes, various equivalent modifications may be made without departing from the broader spirit and scope of the invention. Indeed, it should be understood that specific example structures and steps are provided for illustrative purposes, and other structures and steps may be used in other embodiments and examples based on the teachings of the invention. These modifications can be made to embodiments of the invention based on the above detailed description. The terminology used in the following claims should not be construed as limiting the invention to the specific embodiments disclosed in the specification and claims. Rather, the scope is determined entirely by the following claims, which should be interpreted according to the established principles of their interpretation.

Claims

1. A satellite multi-channel heating circuit fault self-testing system, characterized in that, The system includes a main control module, a transceiver, an AD acquisition module, a multiplexer module, a load module, an I / O isolation driver module, and a power supply module. The main control module, transceiver, AD acquisition module, multiplexer module, and load module are connected in sequence. The I / O isolation driver module is connected between the main control module and the load module. The power supply module is connected to the main control module, transceiver, AD acquisition module, and multiplexer module to provide power. The main control module sends a channel switching command to the transceiver via an internal data bus. The command includes the address selection signal and enable control signal of the multiplexer module. After electrical isolation or level conversion, the transceiver transmits the command to the multiplexer module, controlling the multiplexer module to perform channel selection and switching. At the same time, the digital sampling value after analog-to-digital conversion by the AD sampling module is isolated by the transceiver and sent back to the main control module, forming an isolated acquisition closed loop. The main control module outputs a switch control signal, which is electrically isolated and power-enhanced by the IO isolation drive module, and then drives the load drive module to control the on / off state and adjust the power of the heating load circuit.

2. A system as described in claim 1, characterized in that, The main control module is a dual-core MCU, including core A and core B. Core A serves as the real-time control core, undertaking hard real-time tasks, and is responsible for one or any combination of matrix scanning timing, ADC triggering and sampling window management, multi-channel PWM / switching signal output, fast shutdown for short-circuit faults, and watchdog feeding. Core B serves as the application processing core, undertaking soft real-time tasks, and is responsible for one or any combination of three-stage detection timing arrangement, three-threshold decision algorithm, fault latching and alarm recording, telemetry packet assembly and reporting, communication with the OBC, ground command processing, and fault log persistence.

3. A system as described in claim 1, characterized in that, The power module includes a main control power supply and a DC-DC module, which are used to provide operating current for the main control module, transceiver, AD acquisition module and multiplexer module.

4. A system as described in claim 1, characterized in that, The load module includes a load power supply, a voltage acquisition module, a current acquisition module, a load drive module, and multiple heating loads. The load drive module is connected to the IO isolation drive module and the multiple heating loads, and is connected to the multiplexer module through the current acquisition module. The load power supply is connected to the multiplexer module through the voltage acquisition module, and is connected to the load drive module and the multiplexer module through the current acquisition module. The main control module outputs a switch control signal, which, after electrical isolation and power enhancement by the IO isolation drive module, drives the load drive module to realize the on / off control and power regulation of the heating circuit, and connects the sampled voltage to the matrix scanning network for sampling by the AD acquisition module.

5. A system as described in claim 4, characterized in that, Each heating circuit in the load module includes a fuse, a MOSFET switch, a voltage acquisition circuit, and a current acquisition circuit connected in series, with the MOSFET switch serving as the load drive module.

6. A system as described in claim 5, characterized in that, The system includes eight 8-to-1 multiplexers. The load module includes eight load drive modules and eight heating loads. Each load drive module includes eight MOSFET switches, and each heating load includes eight heating loads. The main control module outputs 64 MOSFET520 switch control signals. After electrical isolation and power amplification by the IO isolation drive module, these signals drive the MOSFET power switches in the 64 heating circuits. The 64 heating circuits are grouped into eight groups of eight, forming eight detection channels. The current sampling signal of each heating circuit is connected to the input of the corresponding 8-to-1 multiplexer. The output of the corresponding multiplexer is connected to the corresponding ADC sampling channel. After isolation by the transceiver, the main control module controls the selection state of each multiplexer through three address lines and eight enable control lines.

7. A system as described in claim 1, characterized in that, After each address switch, the main control module sends control commands via the transceiver and sets a preset stabilization time. After the analog switch on-resistance, parasitic capacitance, and signal conditioning circuit output stabilize, the AD acquisition module is then started to perform ADC sampling.

8. A system as described in claim 1, characterized in that, The system sets a sampling delay time after address switching and discards the first sampled value and / or performs multiple sampling averaging processes before ADC sampling.

9. A fault detection method applied to the system as described in claim 1, characterized in that, include: Before formal heating, the system applies a short-duty-cycle detection pulse to the circuit to be started and collects the corresponding current. During this stage, the load switch is not turned on, and the judgment rule is as follows: If the sampled current is less than the first threshold, the status is normal. All other current conditions trigger an alarm; During the operation of the heating circuit, the system continuously collects the current of each circuit according to the matrix scanning cycle and makes judgments based on the current switch drive status. During this stage, the load switch is in the open state, and the judgment rule is as follows: If the sampled current is less than the first threshold: it is determined that the circuit is open, an alarm is triggered immediately, and the switch of the circuit is turned off at the same time; If the first threshold ≤ sampling current ≤ second threshold, the circuit is considered to be working normally, and only continuous temperature monitoring is required thereafter. If the sampled current is greater than the second threshold, it is determined that a short circuit has occurred in that circuit, and the switch for that circuit is immediately turned off and an alarm is triggered. After the heating circuit is turned off, the system collects the corresponding circuit current again. During this stage, the load switch is already closed. The judgment rule is as follows: If the sampled current is less than the first threshold, the status is normal. All other current conditions triggered an alarm.

10. The method as described in claim 9, characterized in that, Also includes: When the system detects a short circuit or overcurrent fault in a heating circuit, the main control module immediately cancels the PWM drive signal for that circuit, shuts down the corresponding load drive module, prioritizes fast shutdown, and marks the circuit as fault-latched. The circuit will not be allowed to be re-energized for heating until a reset command is received or a safety confirmation is completed; and / or For open-circuit faults, the system records the fault and prohibits the loop from continuing to participate in the thermal control closed-loop control, so as to prevent the control system from continuously increasing the heating duty cycle because the temperature cannot rise.

11. The method as described in claim 9, characterized in that, Also includes: In the system recovery strategy, for short-circuit faults, the system defaults to a latched-off state. After ground confirmation or fulfillment of preset safety conditions, a low-duty-cycle tentative restart test is performed. If the restart test still triggers the short-circuit criterion, the system continues to remain in isolation; and / or For open circuit faults, the system maintains the alarm and waits for ground instructions or a system reset before retesting.

12. The method as described in claim 9, characterized in that, Also includes: The main control module performs a reasonableness check on the sampled data, including current range check, continuity check and abnormal change check, and / or, for sampled values ​​near the threshold boundary, the system adopts a repeated sampling confirmation mechanism.

Images