CN110196564B - A smooth-switching dual-machine redundant power distribution system resistant to single-particle radiation - Google Patents

Abstract

The invention provides a smooth-switching dual-machine redundant power distribution system resistant to single particle irradiation. The system includes a main machine, a standby machine and a load power supply and distribution module, wherein the main machine and the standby machine are on-duty and off-duty planes for each other, On-the-fly and non-on-duty aircraft send their health status and current working status to each other in real time to ensure that the non-on-duty aircraft and on-duty aircraft know each other's current working status; on-the-fly aircraft receive power distribution instructions from external input according to the preset sequence Output the power distribution control signal to the load power supply and distribution module, control the on-off of the load power supply and distribution module, and retrieve the bus voltage at the output end of the load power supply and distribution module, and judge whether the power distribution command is correctly executed according to the mining result. When the power distribution instruction is sent to the non-on-duty aircraft through the internal serial port, the output control function of the non-on-duty aircraft is temporarily enabled, and the non-on-duty aircraft executes the power distribution instruction once.

Description

A smooth-switching dual-machine redundant power distribution system resistant to single-particle radiation

technical field

The invention relates to a smooth switching dual-machine redundant power distribution system resistant to single particle irradiation. It belongs to the technical field of power distribution.

Background technique

For aerospace measurement and control systems, special attention is paid to the reliability of a single aircraft, especially for a single aircraft of a space vehicle, it is necessary to avoid erroneous output caused by the harsh environment of space, and a design method of triple redundancy or dual redundancy is usually required.

(1) Three-machine redundancy

Three-redundant processors are generally designed according to three-mode redundancy and two-out-of-three voting. There are two modes: tight coupling and loose coupling. The tightly coupled three-mode redundant system has high reliability, but the system design is more complex and the amount of information exchange is large. Software designers need to write a lot of fault-tolerant management software after fully understanding the system design intent. In addition, the system bus is also difficult to handle. If one set of system bus is used, the system has poor real-time performance and a single point; if three sets of bus are used, too many connector points are occupied, so that the template cannot integrate more functions, increasing System volume and weight. The loosely coupled three-machine redundancy is relatively simple in design, and the amount of information exchange between each single machine is small, which reduces the fault-tolerant management link and reduces the burden of software designers. In addition, the single-point problem of the system bus is completely solved. The biggest difficulty of the three-redundancy technical solution lies in the synchronization mechanism between the CPUs. Since the processor has strong real-time performance, it is necessary to periodically complete the tasks of data acquisition, operation, judgment, and control command output, so the synchronization of the three machines is very important. The purpose is to eliminate the cumulative error caused by the slight difference in the main frequency of each processor, and to ensure the simultaneity of data acquisition and processing of each CPU board.

(2) Dual-machine cold standby

The system is equipped with two identical stand-alone machines, only one of which is powered on. Data can be backed up to the standby stand-alone hardware regularly, but the stand-by machine will not automatically take over in the event of a failure, and the hardware and services need to be manually started. Some ground equipment that undertakes non-critical tasks can use this backup method.

(3) Dual parallel output

The system is equipped with two identical single machines, which are in the power-on state at the same time, receive control signals and perform output. As long as the two single machines have one set of output, the output is valid. This type of design is usually used in applications where the connection is guaranteed without interruption, or the two single units are powered separately. When a single unit fails and cannot be shut down, the power-off operation is performed.

(4) Dual-machine hot backup

The device contains two sets of sub-devices with thermal redundancy. Each single machine can independently complete all functions in the controller. The default flight in the information control combination is the main machine. The function and design of the main and standby machines are exactly the same.

Under normal working conditions, both the main engine and the standby engine receive signals, the main engine is on duty, and the standby engine does not output. The main and standby machines monitor the working status of each other through internal communication. When the standby machine detects that the main machine is in abnormal working state, or the main machine itself has continuous dog bites, network failures, etc., it determines the main machine failure. When the flight is switched from the main machine to the standby machine, You can switch back and forth between the main and standby machines many times. To sum up, the currently commonly used redundancy design methods have the following shortcomings:

(1) The three-redundancy technical solution requires the use of three identical CPU boards, which requires high cost, and also limits the miniaturization of the device size, and needs to ensure the synchronization between CPUs;

(2) The dual-machine cold standby needs to manually start the equipment, and it takes a long time to switch;

(3) The dual-machine hot backup redundancy can solve the single point of failure caused by the complete failure of the equipment due to the environment or other factors, but it lacks effective correction ability for the occasional wrong output of a single channel; and increases the power consumption of a single machine.

SUMMARY OF THE INVENTION

The technical problem solved by the present invention is: to overcome the deficiencies of the prior art, a smooth switching dual-machine redundant power distribution system resistant to single particle irradiation is proposed, so as to avoid the loss of information caused by the switching of the main and standby machines. At the same time, the compensation mechanism ensures that the power distribution command can be executed correctly, and the operation will not fail due to single event inversion or other hardware circuit failure reasons.

The technical solution of the present invention is: a smooth-switching dual-machine redundant power distribution system resistant to single particle irradiation, the system includes a main engine, a backup machine and a load power supply and distribution module, wherein the main machine and the backup machine are on-duty and Off-duty planes, on-duty and off-duty planes send their own health status and current working status to each other in real time, to ensure that off-duty planes and on-duty planes know each other's current working status; on-duty planes can receive external input according to the preset sequence or receive external input. The power distribution command outputs the power distribution control signal to the load power supply and distribution module, controls the on-off of the load power supply and distribution module, and retrieves the bus voltage at the output end of the load power supply and distribution module. If the command is not executed correctly, the power distribution command will be sent to the non-on-duty aircraft by the on-board aircraft through the internal serial port, and the output control function of the non-on-duty aircraft will be temporarily activated, and the non-on-duty aircraft will supplement the power distribution command once.

The non-duty flight monitors the health status of the current flight in real time. When the non-duty flight detects the abnormality of the current flight, it will activate its own output control and receive external command functions according to the latest normal working status of the current flight saved before, and follow the preset process or external command. , perform subsequent power distribution operations, and retrieve the operation results. When the retrieval operation results are executed correctly, control the original flight to power on and reset. After the original flight is powered on and reset, it defaults to the non-on-duty state, and the output control and command reception functions are disabled. to complete the cutting operation.

The on-board aircraft monitors the health status of the non-on-duty aircraft in real time, and when the off-duty aircraft has more than N consecutive dog bites and resets, the on-demand aircraft sends a power-on reset signal to the off-duty aircraft; if there are N times of dog bites again after reset, then When the flight control is not on the flight, the power supply is cut off and stops working, and N is greater than or equal to 2.

The health state includes a heartbeat signal, a reset signal, and a supply voltage.

The working state includes the system time, the latest external power distribution command, and the power distribution state after the latest external power distribution command is executed.

The main machine and the standby machine are exactly the same, including the central processing controller, the remote control command receiving interface module, the dual-machine interaction interface module, the power distribution state acquisition circuit, the power distribution command parsing circuit, and the power conversion control module;

The central processing controller sends its own health status and current working status to the dual-machine interactive interface module in real time, saves the health status and current working status of the standby machine or host received by the dual-machine interactive interface module, and detects the standby machine or Whether the main engine is running normally; if the non-duty flight is abnormal, the non-duty flight will be controlled by the non-duty flight to restart, and the restart will accumulate N consecutive dog bites again, and the non-duty flight will be powered off; if the non-duty flight is abnormal, the non-duty flight will be turned on Output control function, restart the original flight, disable the output control function after restarting, complete the dual-machine switching, if the original flight restarts and accumulates N consecutive dog bites again, the new flight will control its power off;

In flight mode, generate power distribution instructions according to the preset sequence or receive remote control instructions, receive power distribution instructions input from the interface module, and output power distribution gating instructions and corresponding channel power-on or power-off drive instructions to the load power supply and distribution module; According to the power distribution result retrieved by the signal acquisition module, it is judged whether the power distribution command is correctly executed. If the power distribution command is not executed correctly, the power distribution command is sent to the interactive interface module; The signal is in the "inactive" state, so that the off-duty aircraft does not receive the power distribution command input from the outside;

In the off-duty mode, receive the power distribution instruction sent by the interactive interface module, and output the power distribution gating instruction and the power-on or power-off drive instruction of the corresponding channel to the load power supply and distribution module according to the power distribution instruction; When the operation is abnormal, enable the output control function of the non-on-duty aircraft and the external command receiving interface, read the saved latest normal working state of the on-duty aircraft, and continue to generate power distribution commands or receive remote control commands according to the sequence after the normal working state. The power distribution command input by the module outputs the power distribution gating command to the load power supply and distribution module, and judges whether the power distribution command is executed correctly according to the power distribution result retrieved by the signal acquisition module. flight working mode, and send a restart command to the power exchange controller of the original flight;

The remote control command receiving interface module, under the control of the enable signal, when the enable signal is "valid", receives the power distribution command input from the outside, and outputs the power distribution command to the central processing controller, when the enable signal is "invalid" , does not accept externally input power distribution instructions, and does not output power distribution instructions to the central processing controller;

The signal acquisition module collects the bus voltage of each load at the output end of the load power supply and distribution module, and sends it to the central processing controller;

The power distribution command parsing circuit decodes the power distribution gating command issued by the central processing controller, and selects the power-on or power-off drive command output of the corresponding channel; for the power distribution channel that only needs to be ensured to be connected, a pair of Complementary power-on and power-off commands; four pairs of complementary power-on and power-off commands are generated for constant-power power distribution channels that have high requirements on turn-on and turn-off reliability;

The power exchange controller converts the power supply and distribution signal input from the outside, obtains the required secondary power supply voltage, and supplies power to the central processing controller of the other party. restart or power off;

The reset circuit generates a reset signal after power-on to control the reset of the central processing controller; accepts the "feed the dog" operation output by the central processing controller, and does not receive the "feed the dog" output from the central processing controller within the preset time, Then a reset signal is generated to control the reset of the central processing controller.

The load power supply and distribution module includes a drive command fusion module, a power constant power distribution management module, and a power non-constant power distribution management module;

Drive command fusion module, connect the power-on or power-off drive commands of the same channel of the host and the standby machine in parallel to obtain a fusion drive command, and then send the fusion drive command to the constant power distribution management module and/or power distribution corresponding to the channel Non-constant power distribution management module;

Constant power distribution management module, output power supply signal with constant power;

The power non-constant power distribution management module outputs power supply signals with non-constant power.

The constant power distribution management module includes: two command drive modules, respectively denoted as a first command drive module and a second command drive module, and two power distribution output modules, respectively denoted as a first power distribution output module and a second power distribution output module. Power distribution output module;

Command drive module, including resistors R1, R2, R3, R4, transistors V1, V2, one end of the resistor R1 is the input end of the command drive module, the other end is connected to the base of the transistor V1, and the resistor R2 is connected across the base of the transistor V1 Between it and the emitter, the emitter of the transistor V1 is grounded, and the collector of the transistor V1 is the output end of the command drive module; one end of the resistor R3 is the input end of the command drive module, the other end is connected to the base of the transistor V2, and the resistor R4 is across the Connected between the base and the emitter of the triode V2, the emitter of the triode V2 is grounded, and the collector of the triode V2 is the output end of the command drive module;

The power distribution output modules include magnetic latching relay K1, resistors R9, R10, R11, R12, R13, R14, MOS tube MOS1; the magnetic latching relay K1 is a double-ended double-throw switch, with a total of 6 contacts, of which two contacts The ground is used as the fixed end of the switch, the other two contacts are suspended as the first moving end of the switch, and the other two contacts are used as the second moving end of the switch, which are connected in parallel to one end of the resistor R13, and the other end of the resistor R13 is divided into Two circuits, one is connected in series with the resistor R14 to the load distribution power bus, and the other is connected to the gate of the MOS tube;

The input terminals of the first command driving module and the second command driving module are both connected to the power distribution command signal after fusion; the output terminal of the first command driving module is connected to the power-off signal terminal of the constant power channel; the output terminal of the second command driving module is connected to Constant power channel power-on signal terminal;

The drains of the MOS tubes of the first power distribution output module and the second power distribution output module are connected to the constant power channel bus; the first power distribution output module and the second power distribution output module are connected to one end of the first wire package of the magnetic latching relay K1 The power-off signal of the constant power channel, the other end is connected to the positive busbar of the secondary power supply of the device through the parallel resistors R9 and R10. R12 is connected to the positive busbar of the secondary power supply of the equipment;

The power distribution output module also includes a capacitor C1 and a power distribution output. The capacitor C1 and the capacitor power distribution output are connected in series and connected across the load distribution power bus and the grid of the MOS tube.

The power distribution output module further includes diodes V5, V6, V7, and V8, and the diodes V5 and V6 are connected across the two ends of the first wire package of the magnetic latching relay of the first power distribution output module; The tubes V7 and V8 are connected across the two ends of the second wire package of the magnetic latching relay of the second power distribution output module.

The constant power distribution management module includes:

Eight command driving modules, denoted as: the first command driving module, the second command driving module, the third command driving module, the fourth command driving module, the fifth command driving module, the sixth command driving module, the seventh command driving module , the eighth command drive module;

Four command holding modules, a first command holding module, a second command holding module, a third command holding module, and a fourth command holding module;

Eight distribution output modules, the first distribution output module, the second distribution output module, the third distribution output module, the fourth distribution output module, the fifth distribution output module, the sixth distribution output module, the Seven power distribution output modules, eighth power distribution output modules;

The command drive module includes resistors R21, R22, and a transistor V21. One end of the resistor R21 is the input end of the command drive module, and the other end is connected to the base of the transistor V21. The resistor R22 is connected across the base and the emitter of the transistor V21. The emitter of the triode V1 is grounded, and the collector of the triode V21 is the output end of the command drive module;

The command hold module includes a magnetic latching relay K3, diodes V31, V32, V33, V34, and resistors R41, R42, R43, R44, and the diodes V31 and V32 are connected across the first wire pack of the magnetic latching relay K3. The diodes V33 and V34 are connected across the two ends of the second wire package of the magnetic latching relay K3. One end of the first wire package of the magnetic latching relay K3 is connected to the first input signal, and the other end is connected to the positive busbar of the secondary power supply of the device through the parallel resistors R41 and R42. One end of the second wire package of the magnetic latching relay K3 is connected to the second input signal, and the other end is connected to the second input signal It is connected to the positive busbar of the secondary power supply of the equipment through the parallel resistors R43 and R44; the magnetic latching relay K3 is a double-ended double-throw switch, with a total of 6 contacts, of which two contacts are grounded as the fixed end of the switch, and the other two contacts The floating point is used as the first moving terminal of the switch, and the two contacts are used as the second moving terminal of the switch, which are connected in parallel to the command holding output terminal;

The power distribution output modules include resistors R49, R50, capacitors C11, C12, and MOS tube MOS11; one end of the resistor R49 is connected to the power distribution command input terminal, and the other end of the resistor R50 is divided into two circuits, one of which is connected in series with the resistor R49 to the MOS11 The source, the other way is connected to the gate of MOS11, and the capacitors C11 and C12 are connected in series across the two ends of R49;

The transistor set of the first command driving module, the second command driving module, the third command driving module, the fourth command driving module, the fifth command driving module, the sixth command driving module, the seventh command driving module and the eighth command driving module The output terminals of the electrodes are the first power-off signal of the non-constant power channel, the second power-off signal of the non-constant power channel, the third power-off signal of the non-constant power channel, the fourth power-off signal of the non-constant power channel, and the first power-off signal of the non-constant power channel. A power-on signal, a second power-on signal for a non-constant power channel, a third power-on signal for a non-constant power channel, and a third power-on signal for a non-constant power channel;

The first input terminal and the second input terminal of the first command holding module are respectively connected to the first power-off signal of the non-constant power channel and the first power-on signal of the non-constant power channel;

The first input end and the second input end of the second instruction holding module are respectively connected to the second power-off signal of the non-constant power channel and the second power-on signal of the non-constant power channel;

The first input terminal and the second input terminal of the third instruction holding module are respectively connected to the third power-off signal of the non-constant power channel and the third power-on signal of the non-constant power channel;

The first input terminal and the second input terminal of the fourth instruction holding module are respectively connected to the fourth power-off signal of the non-constant power channel and the fourth power-on signal of the non-constant power channel;

The command holding output terminal of the first command holding module is connected to the power distribution command input terminals of the first power distribution output module and the second power distribution output module;

The command holding output terminal of the second command holding module is connected to the power distribution command input terminals of the third power distribution output module and the fourth power distribution output module;

The command holding output terminal of the third command holding module is connected to the power distribution command input terminals of the fifth power distribution output module and the sixth power distribution output module;

The command holding output terminal of the fourth command holding module is connected to the power distribution command input terminals of the seventh power distribution output module and the eighth power distribution output module.

The source of the MOS tube in the first power distribution output module is connected to the load distribution power bus, and the drain of the MOS tube is connected to the source of the MOS tube in the third power distribution module;

The source of the MOS tube in the second power distribution output module is connected to the load distribution power bus, and the drain of the MOS tube is connected to the source of the MOS tube in the fourth power distribution module;

The source of the MOS tube in the fifth power distribution output module is connected to the load distribution power bus, and the drain of the MOS tube is connected to the source of the MOS tube in the seventh power distribution module;

The source of the MOS tube in the sixth power distribution output module is connected to the load distribution power bus, and the drain of the MOS tube is connected to the source of the MOS tube in the eighth power distribution module.

Compared with the prior art, the present invention has the following beneficial effects:

(1) When the standby aircraft confirms the status through the retrieval, the current flight switching can be completed, so that the main-standby switching process will not affect the timing process and receiving instructions of the on-orbit aircraft;

(2) Through the redundant design of hardware single channel, the failure of any command drive circuit or MOS tube will not affect the command execution effect, avoiding the failure of command execution due to factors such as single event inversion;

(3) If the command is not executed normally due to an accidental failure on the current flight, after confirming the execution failure according to the recovery status, the non-on-duty flight will reissue the command once to improve reliability;

(4), the switching strategy of the present invention is realized by the software in the CPU, and does not need to increase the extra hardware cost;

(5) The present invention disconnects the power supply if it is confirmed that the host machine fails after the machine is switched off, thereby saving battery power.

(6) The present invention can be applied to electrical equipment, especially the redundant backup design of electronic equipment of on-orbit aircraft.

Description of drawings

Fig. 1 is the workflow of dual-machine redundancy according to an embodiment of the present invention;

2 is a functional block diagram of a system according to an embodiment of the present invention;

3 is an instruction parsing circuit according to an embodiment of the present invention;

FIG. 4 is a redundant circuit of a constant power supply channel according to an embodiment of the present invention;

FIG. 5 is a redundant circuit of a power supply channel with non-constant power according to an embodiment of the present invention;

FIG. 6 is a circuit of a remote control command receiving module according to an embodiment of the present invention.

Detailed ways

The present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

The invention provides a smooth switching dual-machine redundant power distribution system resistant to single particle irradiation, the system includes a main machine, a backup machine and a load power supply and distribution module.

As shown in Figure 1, the system has the following characteristics:

(1) The main engine and the standby machine are each other's on-duty and non-on-duty planes, and the on-duty and non-on-duty planes send their health status and current working status to each other to ensure that the off-duty plane and the on-duty plane know each other's current working status; The health state includes a heartbeat signal, a reset signal, and a power supply voltage; the working state includes system time, the latest external command, and the state after the latest external command is executed.

(2) When the flight is in accordance with the preset sequence or receives the power distribution command input from the outside, it outputs the power distribution control signal to the load power supply and distribution module, controls the on-off of the load power supply and distribution, and retrieves the busbar at the output end of the load power supply and distribution module. voltage, according to the retrieval result, determine whether the power distribution command is executed correctly, when the command is not executed correctly, the power distribution command will be sent to the non-on-duty aircraft through the internal serial port by the on-duty aircraft, and the output control function of the non-on-duty aircraft will be temporarily enabled. The power distribution instruction is supplemented by an off-duty flight.

(3) The non-on-duty flight only receives the health status and working status information of the on-duty flight, and does not receive external instructions;

(4) Real-time monitoring of the health status of the non-duty flight. When the non-duty flight detects N consecutive dog bites or the power supply voltage is lower than 4.4V, it is determined that the current flight is abnormal. When the non-duty flight detects that the current flight is abnormal At this time, according to the latest normal working status of the flight that was saved before, it will open its own output control and receive external command functions, execute subsequent power distribution operations according to the preset process or external commands, and retrieve the operation results. When the retrieval operation results are executed correctly When the power on the original flight is reset, the original flight will default to the non-on-duty state after power-on reset, and the output control and command receiving functions will be disabled to complete the machine switching operation.

(5) When the flight monitors the health status of the non-operating flight in real time, when the non-operating flight has more than N consecutive dog bites and resets, the flight will send a power-on reset signal to the non-operating flight; if there are N dog bites again after the reset, Then when the flight controls the non-duty flight, the power supply is cut off and stops working.

As shown in Figure 2, the main machine and the standby machine are exactly the same, including the central processing controller, the remote control command receiving interface module, the dual-machine interaction interface module, the power distribution state acquisition circuit, the power distribution command parsing circuit, and the power conversion control module;

The central processing controller sends its own health status and current working status to the dual-machine interactive interface module in real time, saves the health status and current working status of the standby machine or host received by the dual-machine interactive interface module, and detects the standby machine or Whether the main engine is running normally; if the non-duty flight is abnormal, the non-duty flight will be controlled by the non-duty flight to restart, and the restart will accumulate N consecutive dog bites again, and the non-duty flight will be powered off; if the non-duty flight is abnormal, the non-duty flight will be turned on Output control function, restart the original flight, disable the output control function after restarting, complete the dual-machine switching, if the original flight restarts and accumulates N consecutive dog bites again, the new flight will control its power off;

In flight mode, generate power distribution instructions according to the preset sequence or receive remote control instructions, receive power distribution instructions input from the interface module, and output power distribution gating instructions and corresponding channel power-on or power-off drive instructions to the load power supply and distribution module; According to the power distribution result retrieved by the signal acquisition module, it is judged whether the power distribution command is correctly executed. If the power distribution command is not executed correctly, the power distribution command is sent to the interactive interface module; The signal is in the "inactive" state, so that the off-duty aircraft does not receive the power distribution command input from the outside;

In the off-duty mode, receive the power distribution instruction sent by the interactive interface module, and output the power distribution gating instruction and the power-on or power-off drive instruction of the corresponding channel to the load power supply and distribution module according to the power distribution instruction; When the operation is abnormal, enable the output control function of the non-on-duty aircraft and the external command receiving interface, read the saved latest normal working state of the on-duty aircraft, and continue to generate power distribution commands or receive remote control commands according to the sequence after the normal working state. The power distribution command input by the module outputs the power distribution gating command to the load power supply and distribution module, and judges whether the power distribution command is executed correctly according to the power distribution result retrieved by the signal acquisition module. flight working mode, and send a restart command to the power exchange controller of the original flight;

The remote control command receiving interface module, under the control of the enable signal, when the enable signal is "valid", receives the power distribution command input from the outside, and outputs the power distribution command to the central processing controller, when the enable signal is "invalid" , does not accept externally input power distribution instructions, and does not output power distribution instructions to the central processing controller;

The signal acquisition module collects the bus voltage of each load at the output end of the load power supply and distribution module, and sends it to the central processing controller;

The power distribution command parsing circuit decodes the power distribution gating command issued by the central processing controller, and selects the power-on or power-off drive command output of the corresponding channel; for the power distribution channel that only needs to be ensured to be connected, a pair of Complementary power-on and power-off commands; four pairs of complementary power-on and power-off commands are generated for the constant-power power distribution channel that has high requirements for on and off reliability.

The power exchange controller converts the power supply and distribution signal input from the outside, obtains the required secondary power supply voltage, and supplies power to the central processing controller of the other party. reboot or power off.

The reset circuit generates a reset signal after power-on to control the reset of the central processing controller; accepts the "feed the dog" operation output by the central processing controller, and does not receive the "feed the dog" output from the central processing controller within the preset time, Then a reset signal is generated to control the reset of the central processing controller.

Example:

The present invention will be described in detail below by taking a dual redundant power distribution system of an on-orbit aircraft as an example.

The dual-redundant power distribution system of the on-orbit aircraft can receive commands sent from the ground via space-based measurement and control according to its own sequence or through the 422 serial port, so as to realize the switch-on control of the constant power distribution channel and the control of the power distribution channel with non-constant power. On-off control.

As shown in Figure 2, the dual redundant power distribution system includes a central processing control module (including two sets of main and standby CPU processing circuits and reset circuits), a load power supply and distribution module (including two sets of main and standby power distribution instruction parsing circuits, Power constant power supply and distribution circuit and power non-constant power distribution circuit) and remote control command receiving module (including two sets of main and standby).

1. Central processing control module design:

1.1 CPU circuit

One 80C32 single-chip microcomputer is used for the on-the-fly and non-on-flight flights, with a built-in central processing unit, 128 bytes of internal data storage RAM, 32 bidirectional input/output I/O ports, 2 16-bit timers/counters and 5 two-stage Interrupt structure, a full-duplex serial communication port, on-chip clock oscillator circuit.

Through the internal RS422 serial port, the CPU on the flight and the CPU on the off-duty exchange exchange health status information such as heartbeat signal, reset signal, power supply voltage, and working status information such as system time and the latest external command.

1.2 Reset circuit design

The device reset circuit consists of an initial power-on reset circuit, a "watchdog" reset, and a restart reset circuit.

i. Initial power-on reset circuit

In order to ensure that the CPU has a stable initial state after the device is powered on, and at the same time to ensure that the software starts to run after the oscillator enters a stable state, a power-on reset circuit must be provided. The commonly used RC charging circuit plus a Schmitt inverter is used in the design.

ii. Watchdog reset circuit

The "watchdog" circuit is a timer monitoring circuit, which is composed of a binary counter 54HC4060 configured with an RC circuit. The timing has nothing to do with the software. The time constant is cleared by the software to perform the "feeding the dog" operation. If the program "runs away" or "crash" appears in the software, the "feed the dog" operation cannot be performed, and the dog bite reset occurs. If the number of consecutive dog bites recorded by the on-duty flight has accumulated to 4 times, it will be determined that the other party is faulty, and the off-duty plane will be controlled to restart. ; If the number of consecutive dog bites on the flight that is not recorded by the flight has accumulated to 4 times, it is determined that the other party has a fault, and the dual-machine switching process is entered. After the switching is completed, the original flight will be restarted. If 4 consecutive dog bites are accumulated again after the restart, the original flight will be powered off.

iii. Restart the reset circuit

The restart reset circuit is implemented by MAX706, which generates a 200ms power-on reset signal during the power-on process of the device, so that the 80C32E system can be reset effectively. When the dog bites four times in a row, the restart operation is performed; at the same time, the chip has a voltage monitoring function. If the flight monitor detects that the power supply voltage is lower than about 4.4V, the information will be notified to the non-on-duty flight, as the process of entering the dual-machine switching process. After confirming that the switching is completed, the RESET pin of the MAX706 that was on the flight has been outputting the reset level to realize the power-off. Unless the flight monitor detects that the power supply voltage is lower than about 4.4V, the RESET pin of the MAX706 will directly output the reset level to achieve power-off.

2. Load power supply and distribution module design

2.1 Instruction parsing circuit

The host command parsing circuit generates the input address lines A_A0 to A_A3, the data lines A_D0 to A_D7, the board selection signal A_CS_PD*, and the write signal A_WR* generated by the host CPU. The address line is sent to the 3-8 decoder to generate the strobe signals A_SEL1 to A_SEL5 of the latch, and then the drive command of the power distribution module is generated by the latch.

The standby machine instruction parsing circuit inputs address lines B_A0~B_A3, data lines B_D0~B_D7, board selection signal B_CS_PD*, and write signal B_WR*. The address line is sent to the 3-8 decoder to generate the strobe signals B_SEL1 to B_SEL5 of the latch, and then the drive command of the power distribution module is generated by the latch. Different strobe signals are used to select different latches and generate different drive commands.

When the driving commands of the flight and the non-on-duty aircraft are connected in parallel, the final driving command (ie, cmd1 to cmd6 in Figure 3) is obtained. Under normal conditions, since the non-on-duty aircraft's CPU is disabled, the non-on-duty aircraft's instruction parsing circuit Not working, the drive order is determined by the flight. When the host detects that the command issued is not executed, the non-on-duty aircraft temporarily turns on its own output control function, and the non-on-duty aircraft's command parsing circuit generates the driving command to realize the command reissue.

2.2 Constant power supply and distribution management module

The constant power supply and distribution management module provides a constant low-power power supply output for the load, and needs to ensure its reliability. The main and standby machines share the same set of power supply and distribution circuits, which are controlled by two MOS tubes in parallel. The above drive command is amplified and driven by the triode as the control level of the power supply and distribution circuit, and the control level is latched by the magnetic latching relay. Even if the secondary power supply or CPU fails, the previous state can be maintained.

As shown in FIG. 4 , the constant power distribution management module includes: two command drive modules, respectively denoted as a first command drive module and a second command drive module, and two power distribution output modules, respectively denoted as the first command drive module An electrical output module and a second power distribution output module.

Command drive module, including resistors R1, R2, R3, R4, transistors V1, V2, one end of the resistor R1 is the input end of the command drive module, the other end is connected to the base of the transistor V1, and the resistor R2 is connected across the base of the transistor V1 Between it and the emitter, the emitter of the transistor V1 is grounded, and the collector of the transistor V1 is the output end of the command drive module; one end of the resistor R3 is the input end of the command drive module, the other end is connected to the base of the transistor V2, and the resistor R4 is across the Connected between the base and the emitter of the triode V2, the emitter of the triode V2 is grounded, and the collector of the triode V2 is the output end of the command drive module;

The power distribution output module includes magnetic latching relay K1, resistors R9, R10, R11, R12, R13, R14, MOS tube MOS1; the magnetic latching relay K1 is a double-ended double-throw switch, with a total of 6 contacts, two of which ( 4 and 9) grounding is used as the stationary end of the switch, the other two contacts are floating (2 and 8) as the first movable end of the switch, and the other two contacts (3 and 7) are used as the second movable end of the switch, It is connected in parallel at one end of the resistor R13. When the first wire package is powered on, the switch is connected to the stationary terminal, and when the second wire package is powered on, the switch is connected to the moving terminal. The other end of the resistor R13 is divided into two paths, one is connected in series with the resistor R14 to the load distribution power bus (28v), and the other is connected to the gate of the MOS tube.

The input terminals of the first command driving module and the second command driving module are both connected to the power distribution command signal after fusion; the output terminal of the first command driving module is connected to the power-off signal terminal of the constant power channel; the output terminal of the second command driving module is connected to Constant power channel power-on signal terminal.

The drains of the MOS tubes of the first power distribution output module and the second power distribution output module are connected to the constant power channel bus; the first power distribution output module and the second power distribution output module are connected to one end of the first wire package of the magnetic latching relay K1 The power-off signal of the constant power channel, the other end is connected to the positive busbar (+12V) of the secondary power supply of the device through the parallel resistors R9 and R10, the second wire package of the magnetic latching relay K1 is connected to the power-on signal of the constant power channel at one end, and the other end is connected in parallel The resistors R11 and R12 are connected to the device's secondary power positive bus (+12V).

The power distribution output module also includes a capacitor C1 and a power distribution output. The capacitor C1 and the capacitor power distribution output are connected in series and connected across the load distribution power bus (28v) and the gate of the MOS tube.

The power distribution output module further includes diodes V5, V6, V7, and V8, and the diodes V5 and V6 are connected across the two ends of the first wire package of the magnetic latching relay of the first power distribution output module; The tubes V7 and V8 are connected across the two ends of the second wire package of the magnetic latching relay of the second power distribution output module;

In this module, the output terminals of the command-driven module are cmd1 and cmd2. When the cmd1 drive command is high, the three-stage transistors V1 and V2 are turned on, and the constant power A channel power-off command is pulled to a low level. In the off state, the gate voltage V _G of MOS1 and MOS2 in the power supply and distribution circuit is 28V, the MOS tube is in the off state, and the power constant A channel bus is not powered; when the cmd2 drive command is high, the three The stage tubes V3 and V4 are turned on, and the power-on command of the constant power channel A is pulled to a low level. At this time, the magnetic latching relays K1 and K2 are powered on both ends of the neutral wire package 2, and the switches are all on. The gate voltage V _G of MOS1 and MOS2 in the electrical circuit is the divided voltage of 28V on R13/R14 and R19/R20, the MOS tube is in the conduction state, and the power is constant and the A channel bus is powered on.

In the power supply and distribution circuit, the transistors and magnetic latching relays used for driving command isolation and amplification, and the voltage divider resistors, filter capacitors, and MOS tubes used for bus power supply are all redundant designs, eliminating single-point risks.

2.3 Power non-constant power supply and distribution management module

The power non-constant power supply and distribution management module provides power supply with variable power to the load according to the demand. It has experienced multiple switches during the whole flight process, and the reliability of switching on and off needs to be considered at the same time. Based on the constant power supply and distribution management module, the channel reliability is improved through the following approaches.

For power-on or power-off commands, the command parsing circuit outputs four commands each, as shown in Figure 5. After the optocoupler isolation, amplification triode and magnetic latching relay, the final output of four pairs of series-parallel MOS tubes (eight in total) is driven.

As shown in Figure 5, the power non-constant power distribution management module includes:

Eight command driving modules, denoted as: the first command driving module, the second command driving module, the third command driving module, the fourth command driving module, the fifth command driving module, the sixth command driving module, the seventh command driving module , the eighth command drive module;

Four command holding modules, a first command holding module, a second command holding module, a third command holding module, and a fourth command holding module;

Eight distribution output modules, the first distribution output module, the second distribution output module, the third distribution output module, the fourth distribution output module, the fifth distribution output module, the sixth distribution output module, the Seven power distribution output modules, eighth power distribution output modules;

The command drive module includes resistors R21, R22, and a transistor V21. One end of the resistor R21 is the input end of the command drive module, and the other end is connected to the base of the transistor V21. The resistor R22 is connected across the base and the emitter of the transistor V21. The emitter of the triode V1 is grounded, and the collector of the triode V21 is the output end of the command drive module;

The command hold module includes a magnetic latching relay K3, diodes V31, V32, V33, V34, and resistors R41, R42, R43, R44, and the diodes V31 and V32 are connected across the first wire pack of the magnetic latching relay K3. The diodes V33 and V34 are connected across the two ends of the second wire package of the magnetic latching relay K3. One end of the first wire package of the magnetic latching relay K3 is connected to the first input signal, and the other end is connected to the positive busbar of the secondary power supply of the device through the parallel resistors R41 and R42. One end of the second wire package of the magnetic latching relay K3 is connected to the second input signal, and the other end is connected to the second input signal Connect to the positive busbar (+12V) of the secondary power supply of the device through the parallel resistors R43 and R44; the switch of the magnetic latching relay K3 is a double-ended double-throw switch, with a total of 6 contacts, two of which are grounded and two contacts As the fixed terminal contact is floating, the two contacts are connected in parallel to the command holding output terminal as the moving terminal.

The power distribution output modules include resistors R49, R50, capacitors C11, C12, and MOS tube MOS11; one end of the resistor R49 is connected to the power distribution command input terminal, and the other end of the resistor R50 is divided into two circuits, one of which is connected in series with the resistor R49 to the MOS11 The source, the other way is connected to the gate of MOS11, and the capacitors C11 and C12 are connected in series across the two ends of R49;

The transistor set of the first command driving module, the second command driving module, the third command driving module, the fourth command driving module, the fifth command driving module, the sixth command driving module, the seventh command driving module and the eighth command driving module The output terminals of the electrodes are the first power-off signal of the non-constant power channel, the second power-off signal of the non-constant power channel, the third power-off signal of the non-constant power channel, the fourth power-off signal of the non-constant power channel, and the first power-off signal of the non-constant power channel. A power-on signal, a second power-on signal for a non-constant power channel, a third power-on signal for a non-constant power channel, and a third power-on signal for a non-constant power channel;

The first input terminal and the second input terminal of the first command holding module are respectively connected to the first power-off signal of the non-constant power channel and the first power-on signal of the non-constant power channel;

The first input end and the second input end of the second instruction holding module are respectively connected to the second power-off signal of the non-constant power channel and the second power-on signal of the non-constant power channel;

The first input terminal and the second input terminal of the third instruction holding module are respectively connected to the third power-off signal of the non-constant power channel and the third power-on signal of the non-constant power channel;

The first input terminal and the second input terminal of the fourth instruction holding module are respectively connected to the fourth power-off signal of the non-constant power channel and the fourth power-on signal of the non-constant power channel;

The command holding output terminal of the first command holding module is connected to the power distribution command input terminals of the first power distribution output module and the second power distribution output module;

The command holding output terminal of the second command holding module is connected to the power distribution command input terminals of the third power distribution output module and the fourth power distribution output module;

The command holding output terminal of the third command holding module is connected to the power distribution command input terminals of the fifth power distribution output module and the sixth power distribution output module;

The command holding output terminal of the fourth command holding module is connected to the power distribution command input terminals of the seventh power distribution output module and the eighth power distribution output module.

The source of the MOS tube in the first power distribution output module is connected to the load distribution power bus (28v), and the drain of the MOS tube is connected to the source of the MOS tube in the third power distribution module;

The source of the MOS tube in the second power distribution output module is connected to the load distribution power bus (28v), and the drain of the MOS tube is connected to the source of the MOS tube in the fourth power distribution module;

The source of the MOS tube in the fifth power distribution output module is connected to the load distribution power bus (28v), and the drain of the MOS tube is connected to the source of the MOS tube in the seventh power distribution module;

The source of the MOS tube in the sixth power distribution output module is connected to the load distribution power bus (28v), and the drain of the MOS tube is connected to the source of the MOS tube in the eighth power distribution module.

In this module, the output terminals of the command-driven module are cmd3, cmd5, cmd7, cmd9, cmd4, cmd6, cmd8, and cmd10. When the cmd3, cmd5, cmd7, and cmd9 drive commands are high, the three-stage transistors V21, V23, V25, and V27 are turned on, and the power is not constant. The B channel is powered off _1/2/3/4 is low, and the magnetic latching relay K3, K4, K5, K6 are powered on both ends of the wire package 1. At this time, the gate voltage V _G of MOS11 to MOS18 in the power supply and distribution circuit is 28V, the MOS tube is in the off state, and the power non-constant B channel bus is not connected. Electricity; when the cmd4, cmd6, cmd8, and cmd10 drive commands are high, the three-stage transistors V22, V24, V26, and V28 are turned on, and the power is not constant when the B channel is powered on _1/2/3/4 is low, and the magnetic hold The relays K3, K4, K5, K6 are powered on both ends of the wire package 2, and the switches are all on. At this time, the gate voltage V _G of MOS11 to MOS18 in the power supply and distribution circuit is the divided voltage of 28V on the resistor, MOS The tube is on and the power non-constant B channel bus is energized.

In this circuit, cmd5/cmd6 are used to drive MOS tubes V11 and V12, cmd7/cmd8 are used to drive MOS tubes V13 and V14, cmd9/cmd10 are used to drive MOS tubes V15 and V16, cmd11/cmd12 are used to drive MOS tubes V17 and V18. It can be verified that any command fails, and the failure of any three MOS tubes will not cause the load to fail to be powered on or powered off.

3. Design of remote control command receiving module

The remote control command receiving interface chip AM26C32 of the main and standby aircraft of the on-orbit aircraft is always powered on. When the host is working, the enable signal B_RX that controls the receiving interface of the standby aircraft is low, and the standby aircraft does not receive commands; when the standby aircraft is working, the control The enable signal A_RX of the host receiving interface is low level, the host does not receive commands and does not affect each other. As shown in Figure 6.

4. Dual-machine redundancy design optimization:

In addition to the redundant design of the power distribution circuit, the dual-machine redundant power distribution system in this method is optimized in two aspects: command reissue and switching strategy:

4.1 Switching strategy

When a dog bite reset occurs on the CPU board of the host computer (the on-flight plane in the initial state), the number of dog bites recorded by the standby computer (non-duty plane in the room state) is incremented by 1. If the standby computer determines that the host computer has suffered four consecutive dog bites , enter the active/standby switchover process. In order to avoid the power-off of the channel that has been powered on before, during the cutting process, the main and standby machines output at the same time. According to the latest normal working state of the host that was previously saved, enable the function of receiving external commands of the standby machine, perform subsequent operations according to the preset process, and retrieve the operation results. At the same time, the control panel is powered on and reset again. After the panel is powered on, it defaults to a non-on-duty flight.

In addition, if the MAX706 monitoring voltage terminal of the host computer is lower than 4.4V, it will notify the standby computer and enter the main-standby switching process. After the switching is completed, the power supply of the original flight will be cut off to save power consumption.

When the flight regularly sends the system time, the latest external command, and the status backup after the execution of the latest external command to the non-on-duty flight, and saves it in the EEPROM at the same time. During normal flight, backup is performed every 10 minutes; during mission development, due to intensive operations, backup is performed every 10 seconds. The backup interval can be easily modified by the software.

4.2 Command compensation

In order to avoid command failure due to single event inversion or circuit hardware failure, when the flight CPU board outputs a power-on command for any channel (assuming it is channel A), the command is sent to the non-on-duty flight through the internal serial port, and the next Periodically detect the recovery status of channel A. If the recovery status of channel A is low, it is considered that the power-on is unsuccessful, and the on-flight aircraft will set the CPU output of the non-on-flight aircraft to be valid, and then reissue the power-on command of channel A. Similarly, when the flight CPU board outputs a power-off command for any channel (assuming it is channel B), the flight CPU needs to judge the recovery status of channel B. If the recovery status of channel B is high, The CPU output is set to be valid, and the B channel power-off command is reissued again.

Under the condition of keeping the state of the hardware circuit unchanged, by changing the software settings of the CPU to control the CLK signal of the output chip of the standby machine in the single-chip microcomputer, it is possible to flexibly change the redundancy strategy, such as only host control, parallel output of the main and standby machines, or Backup mechanism, etc.

The parts that are not described in detail in this specification belong to the common knowledge of those skilled in the art.

Claims (7)

1. The smooth switching dual-machine redundant power distribution system is characterized by comprising a host machine, a standby machine and a load power supply and distribution module, wherein the host machine and the standby machine are an active machine and a non-active machine, and the active machine and the non-active machine transmit the health state and the current working state of the active machine and the current working state to each other in real time to ensure that the non-active machine and the active machine know the current working state of the other party; when the on-duty aircraft outputs a power distribution control signal to the load power supply and distribution module according to a preset time sequence or receives a power distribution instruction input from the outside, the on-off of the load power supply and distribution is controlled, the bus voltage at the output end of the load power supply and distribution module is acquired, whether the power distribution instruction is executed correctly is judged according to the acquisition result, when the instruction is not executed correctly, the on-duty aircraft transmits the power distribution instruction to the off-duty aircraft through an internal serial port, the output control function of the off-duty aircraft is started temporarily, and the off-duty aircraft executes the power distribution instruction once in a supplementing manner;

the health state comprises a heartbeat signal, a reset signal and a power supply voltage; the working state comprises system time, a latest external power distribution instruction and a power distribution state after the latest external power distribution instruction is executed;

the host machine and the standby machine are completely the same and comprise a central processing controller, a remote control instruction receiving interface module, a dual-machine interaction interface module, a power distribution state acquisition circuit, a power distribution instruction analysis circuit and a power supply conversion control module;

the central processing controller sends the self health state and the current working state to the dual-computer interactive interface module in real time, stores the health state and the current working state of the standby computer or the host computer received by the dual-computer interactive interface module, and detects whether the standby computer or the host computer runs normally; if the non-current airliner is abnormal, the current airliner controls the non-current airliner to restart, the current airliner is restarted, N times of continuous dog bites are accumulated again, and the non-current airliner is powered off; if the current airliner is abnormal, starting an output control function of a non-current airliner, restarting the original current airliner, forbidding the output control function after restarting, completing dual-machine switching, and if the original current airliner is restarted and continuous N times of dog bites are accumulated again, controlling the new current airliner to cut off the power;

in the flight mode, generating a power distribution instruction according to a preset time sequence or receiving a power distribution instruction input by a remote control instruction receiving interface module, and outputting a power distribution gating instruction and a power-on or power-off driving instruction of a corresponding channel to a load power supply and distribution module; judging whether the power distribution instruction is executed correctly according to the power distribution result acquired by the signal acquisition module, and if the power distribution instruction is not executed correctly, sending the power distribution instruction to the interactive interface module; controlling the enabling signal of the remote control instruction receiving interface module of the non-current airliner to be in an invalid state, so that the non-current airliner does not receive an externally input power distribution instruction;

receiving a power distribution instruction sent by an interactive interface module in a non-current airliner mode, and outputting a power distribution gating instruction and a power-on or power-off driving instruction of a corresponding channel to a load power supply and distribution module according to the power distribution instruction; when the abnormal operation of the current airliner is detected, starting an output control function and an external instruction receiving interface of the non-current airliner, reading the latest normal working state of the stored current airliner, continuously generating a power distribution instruction or receiving the power distribution instruction input by a remote control instruction receiving interface module according to the time sequence after the normal working state, outputting a power distribution gating instruction to a load power supply and distribution module, judging whether the power distribution instruction is correctly executed or not according to the power distribution result acquired by a signal acquisition module, if the power distribution instruction is correctly executed, switching to the current airliner working mode, and sending a restarting instruction to a power supply exchange controller of the original current airliner;

the remote control instruction receiving interface module receives an externally input power distribution instruction and outputs the power distribution instruction to the central processing controller when the enable signal is effective under the control of the enable signal, and does not receive the externally input power distribution instruction and does not output the power distribution instruction to the central processing controller when the enable signal is ineffective;

the signal acquisition module is used for acquiring the bus voltage of each load at the output end of the load power supply and distribution module and transmitting the bus voltage to the central processing controller;

the power distribution instruction analysis circuit decodes the power distribution gating instruction sent by the central processing controller, and selects the power-on or power-off driving instruction of the corresponding access to output; generating a pair of complementary power-up and power-down commands for a power-constant distribution channel that only needs to be guaranteed to be switched on; generating four pairs of complementary power-on and power-off instructions for a power constant distribution channel with higher requirements on the connection and disconnection reliability;

the power supply exchange controller is used for carrying out power supply conversion on the externally input power supply and distribution signal to obtain required secondary power supply voltage to supply power to the central processing controller of the opposite side, and meanwhile, receiving a control signal of the central processing controller of the opposite side and restarting or powering off the computer;

the reset circuit generates a reset signal after being electrified and controls the central processing controller to reset; and receiving the 'dog feeding' operation output by the central processing controller, and generating a reset signal to control the central processing controller to reset if the 'dog feeding' operation output by the central processing controller is not received within the preset time.

2. The smooth switching dual-machine redundant power distribution system resistant to single particle irradiation of claim 1 is characterized in that a non-current machine monitors the health state of the current machine in real time, when the non-current machine detects that the current machine is abnormal, the output control and external instruction receiving function of the non-current machine is started according to the latest normal working state of the current machine stored before, the subsequent power distribution operation is executed according to the preset flow or the external instruction, the operation result is collected, when the collection operation result is executed correctly, the original current machine is controlled to be powered on and reset again, the power on and reset state of the original current machine is defaulted to be the non-current machine state after the power on and reset of the original current machine, the output control and instruction receiving function is disabled, and the power cutting operation is completed.

3. The smooth switching dual-machine redundant power distribution system resisting single particle irradiation according to claim 1, wherein the on-board machine monitors the health status of the off-board machine in real time, and when the off-board machine continuously has more than N times of dog bite reset, the on-board machine sends a power-on reset signal to the off-board machine; if N times of dog bites occur again after resetting, the current airliner controls the power supply of the non-current airliner to be powered off, the current airliner stops working, and N is more than or equal to 2.

4. The smooth switching dual-machine redundant power distribution system resisting single event irradiation according to claim 1, wherein the load power supply and distribution module comprises a driving instruction fusion module, a power constant power distribution management module and a power non-constant power distribution management module;

the driving instruction fusion module is used for connecting the power-on or power-off driving instructions of the same channel of the host machine and the standby machine in parallel to obtain a fusion driving instruction, and then sending the fusion driving instruction to the power constant distribution management module and/or the power non-constant distribution management module corresponding to the channel;

the power constant distribution management module outputs a power supply signal with constant power;

and the power non-constant distribution management module outputs a power supply signal with non-constant power.

5. The system according to claim 4, wherein the power constant distribution management module comprises: the two instruction driving modules are respectively marked as a first instruction driving module and a second instruction driving module, and the two power distribution output modules are respectively marked as a first power distribution output module and a second power distribution output module;

the instruction driving module comprises resistors R1, R2, R3 and R4, triodes V1 and V2, wherein one end of the resistor R1 is an input end of the instruction driving module, the other end of the resistor R1 is connected with a base electrode of the triode V1, the resistor R2 is bridged between the base electrode and an emitter electrode of the triode V1, the emitter electrode of the triode V1 is grounded, and a collector electrode of the triode V1 is an output end of the instruction driving module; one end of the resistor R3 is the input end of the command driving module, the other end is connected with the base electrode of the triode V2, the resistor R4 is bridged between the base electrode and the emitting electrode of the triode V2, the emitting electrode of the triode V2 is grounded, and the collector electrode of the triode V2 is the output end of the command driving module;

the power distribution output modules comprise magnetic latching relays K1, resistors R9, R10, R11, R12, R13, R14 and MOS tubes MOS 1; the magnetic latching relay K1 is a double-end double-throw switch, and has 6 contacts, wherein two contacts are grounded and used as the immobile end of the switch, the other two contacts are suspended and used as the first mobile end of the switch, the two contacts are used as the second mobile end of the switch and are connected in parallel to one end of a resistor R13, the other end of the resistor R13 is divided into two paths, one path is connected in series with the resistor R14 to a load distribution power supply bus, and the other path is connected to the grid of an MOS (metal oxide semiconductor) tube;

the input ends of the first instruction driving module and the second instruction driving module are connected with the fused power distribution instruction signal; the output end of the first instruction driving module is connected with a power constant channel power-off signal end; the output end of the second instruction driving module is connected with a power-on signal end of the constant-power channel;

the drain electrodes of the MOS tubes of the first distribution output module and the second distribution output module are connected with a power constant channel bus; one end of a first coil of a magnetic latching relay K1 of the first distribution output module and the second distribution output module is connected with a power-off signal of a power constant channel, the other end of the first coil is connected to a positive bus of the secondary power supply of the equipment through resistors R9 and R10 which are connected in parallel, one end of a second coil of the magnetic latching relay K1 is connected with a power-on signal of the power constant channel, and the other end of the second coil is connected to the positive bus of the secondary power supply of the equipment through resistors R11 and R12 which are;

the distribution output module further comprises a capacitor C1 and a distribution output, wherein the capacitor C1 is connected with the capacitor distribution output in series and bridged between the load distribution power supply bus and the grid of the MOS tube.

6. The smooth switching dual-machine redundant power distribution system resistant to single event irradiation according to claim 5, wherein the power distribution output module further comprises diodes V5, V6, V7 and V8, wherein the diodes V5 and V6 are connected across the first wire packet of the magnetic latching relay of the first power distribution output module in a bridging manner; and the diodes V7 and V8 are connected across the second wire packet of the magnetic latching relay of the second distribution output module in a bridging mode.

7. The system according to claim 4, wherein the power non-constant distribution management module comprises:

eight command driver modules, noted as: the system comprises a first instruction driving module, a second instruction driving module, a third instruction driving module, a fourth instruction driving module, a fifth instruction driving module, a sixth instruction driving module, a seventh instruction driving module and an eighth instruction driving module;

the system comprises four instruction holding modules, a first instruction holding module, a second instruction holding module, a third instruction holding module and a fourth instruction holding module;

the power distribution system comprises eight power distribution output modules, a first power distribution output module, a second power distribution output module, a third power distribution output module, a fourth power distribution output module, a fifth power distribution output module, a sixth power distribution output module, a seventh power distribution output module and an eighth power distribution output module;

the instruction driving module comprises resistors R21 and R22 and a triode V21, one end of the resistor R21 is the input end of the instruction driving module, the other end of the resistor R21 is connected with the base electrode of the triode V21, the resistor R22 is bridged between the base electrode and the emitter electrode of the triode V21, the emitter electrode of the triode V1 is grounded, and the collector electrode of the triode V21 is the output end of the instruction driving module;

the command holding module comprises a magnetic holding relay K3, diodes V31, V32, V33 and V34, resistors R41, R42, R43 and R44, wherein the diodes V31 and V32 are bridged at two ends of a first line packet of the magnetic holding relay K3; the diodes V33, V34 are connected across the second wire packet of the magnetic latching relay K3. One end of a first coil of the magnetic latching relay K3 is connected with a first input signal, the other end of the first coil is connected to a positive bus of the secondary power supply of the equipment through resistors R41 and R42 which are connected in parallel, one end of a second coil of the magnetic latching relay K3 is connected with a second input signal, and the other end of the second coil is connected to the positive bus of the secondary power supply of the equipment through resistors R43 and R44 which are connected in parallel; the magnetic latching relay K3 is a double-end double-throw switch, and has 6 contacts in total, wherein two contacts are grounded and used as the immobile end of the switch, the other two contacts are suspended and used as the first mobile end of the switch, and the other two contacts are used as the second mobile end of the switch and are connected in parallel to the instruction holding output end;

the power distribution output modules comprise resistors R49 and R50, capacitors C11 and C12 and an MOS transistor MOS 11; one end of the resistor R49 is connected to the input end of a power distribution command, the other end of the resistor R50 is divided into two paths, one path is connected with the resistor R49 in series to the source of the MOS11, the other path is connected to the grid of the MOS11, and the capacitors C11 and C12 are connected in series and then bridged at two ends of the R49;

the output ends of the triode collectors of the first instruction driving module, the second instruction driving module, the third instruction driving module, the fourth instruction driving module, the fifth instruction driving module, the sixth instruction driving module, the seventh instruction driving module and the eighth instruction driving module are respectively a power non-constant channel first power-off signal, a power non-constant channel second power-off signal, a power non-constant channel third power-off signal, a power non-constant channel fourth power-off signal, a power non-constant channel first power-up signal, a power non-constant channel second power-up signal, a power non-constant channel third power-up signal and a power non-constant channel third power-up signal;

a first input end and a second input end of the first instruction holding module are respectively connected with a first power-off signal of a power non-constant channel and a first power-on signal of the power non-constant channel;

the first input end and the second input end of the second instruction holding module are respectively connected with a second power-off signal of a power non-constant channel and a second power-on signal of the power non-constant channel;

the first input end and the second input end of the third instruction holding module are respectively connected with a third power-off signal of a power non-constant channel and a third power-on signal of the power non-constant channel;

a first input end and a second input end of the fourth instruction holding module are respectively connected with a fourth power-off signal of the power non-constant channel and a fourth power-on signal of the power non-constant channel;

the instruction holding output end of the first instruction holding module is connected with the power distribution instruction input ends of the first power distribution output module and the second power distribution output module;

the instruction holding output end of the second instruction holding module is connected with the power distribution instruction input ends of the third power distribution output module and the fourth power distribution output module;

the instruction holding output end of the third instruction holding module is connected with the power distribution instruction input ends of the fifth power distribution output module and the sixth power distribution output module;

the instruction holding output end of the fourth instruction holding module is connected with the power distribution instruction input ends of the seventh power distribution output module and the eighth power distribution output module;

the source electrode of an MOS tube in the first power distribution output module is connected with a load power distribution bus, and the drain electrode of the MOS tube is connected with the source electrode of an MOS tube in the third power distribution module;

the source electrode of an MOS tube in the second power distribution output module is connected with a load power distribution bus, and the drain electrode of the MOS tube is connected with the source electrode of an MOS tube in the fourth power distribution module;

the source electrode of an MOS tube in the fifth power distribution output module is connected with a load power distribution bus, and the drain electrode of the MOS tube is connected with the source electrode of the MOS tube in the seventh power distribution module;

and the source electrode of the MOS tube in the sixth power distribution output module is connected with a load power distribution bus, and the drain electrode of the MOS tube is connected with the source electrode of the MOS tube in the eighth power distribution module.

Images