CN111913469B - Method for constructing on-orbit stable operation capability of spacecraft control system - Google Patents
Method for constructing on-orbit stable operation capability of spacecraft control system Download PDFInfo
- Publication number
- CN111913469B CN111913469B CN202010700657.4A CN202010700657A CN111913469B CN 111913469 B CN111913469 B CN 111913469B CN 202010700657 A CN202010700657 A CN 202010700657A CN 111913469 B CN111913469 B CN 111913469B
- Authority
- CN
- China
- Prior art keywords
- data
- capability
- orbit
- attitude
- control system
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B23/00—Testing or monitoring of control systems or parts thereof
- G05B23/02—Electric testing or monitoring
- G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
- G05B23/0218—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults
- G05B23/0243—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults model based detection method, e.g. first-principles knowledge model
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B2219/00—Program-control systems
- G05B2219/20—Pc systems
- G05B2219/24—Pc safety
- G05B2219/24065—Real time diagnostics
Abstract
The invention relates to a method for constructing the on-orbit stable operation capability of a spacecraft control system, which can be used for ground development of the control system and the full life cycle of on-orbit flight, the design method is widely applied to high, medium and low orbit satellites and spacecrafts such as spacecrafts, space stations, deep space probes and the like, the method for constructing the on-orbit stable operation capability of the spacecraft control system is provided with the support of data protection capability, data field rejecting capability, abnormality detection capability, soft fault self-recovery capability, hard fault self-reconstruction capability and under-configuration operation capability which are totally 'six capabilities', and the method can be used for maintaining the attitude and the working mode of the spacecraft in a stable and continuous state in the scheme design and the technical design of the control system.
Description
Technical Field
The invention relates to a method for constructing the on-orbit stable operation capability of a spacecraft control system, which can be used for ground development of the control system and the full life cycle of on-orbit flight, the design method is widely applied to high, medium and low orbit satellites and spacecrafts such as spacecrafts, space stations, deep space probes and the like, the method for constructing the on-orbit stable operation capability of the spacecraft control system is provided with the support of data protection capability, data field rejecting capability, abnormality detection capability, soft fault self-recovery capability, hard fault self-reconstruction capability and under-configuration operation capability which are totally 'six capabilities', and the method can be used for maintaining the attitude and the working mode of the spacecraft in a stable and continuous state in the scheme design and the technical design of the control system.
Background
The control system is a key subsystem of the spacecraft. The final service life of the spacecraft and the continuity of the on-orbit task execution of the spacecraft are determined by the stable operation capacity of the control system, and the control system is an important index for improving the satisfaction degree of users. The complexity and the particularity of the space environment enable the satellite to be difficult to avoid external interference in the in-orbit operation process, the self components of the satellite are difficult to avoid faults in the long-term operation process, and due to the particularity of working conditions, the fault detection, the isolation and the recovery are indirect and difficult compared with a ground system. The construction of the stable operation capability of the control system takes 'a single fault does not affect the service continuity of the spacecraft and a double fault does not affect the safety of the spacecraft' as a starting point, is important embodiment of robustness, margin sufficiency and system fault tolerance, and is important work content of ground development and on-orbit flight full-life cycle design of the control system.
By the beginning of 2020, the in-orbit satellite of China is in 400 orders of magnitude, the actual effective operation satellite is also in 300 orders of magnitude, and in order to ensure the stable and reliable operation of the satellite in orbit, a design method for ensuring the stable operation in orbit needs to be extracted urgently, the autonomous anomaly detection, elimination and fault processing capabilities of the abnormal phenomenon of the satellite in orbit are improved, and the reliability and robustness of the whole life cycle of the model development, launching and in-orbit operation of the spacecraft are improved practically.
Disclosure of Invention
The technical problem solved by the invention is as follows: the method comprehensively ensures robustness design elements and methods required by the on-orbit stable operation of the control system, constructs the on-orbit stable operation capability of the spacecraft control system through data protection capability, data field rejection capability, abnormality detection capability, soft fault self-recovery capability, hard fault self-reconstruction capability and under-configured operation capability which are totally six capabilities, can timely recover various software faults caused by the space environment, can reliably diagnose and isolate various single-machine faults, reduces the influence of the single-machine faults to the minimum, and maximally ensures the continuous and stable operation of the whole on-orbit life cycle of the spacecraft during research. The method for constructing the on-orbit stable operation capacity of the spacecraft control system provides specific definitions, design targets and technical key points of six capacities in total, namely data protection capacity, data field removing capacity, abnormality detection capacity, soft fault self-recovery capacity, hard fault self-reconstruction capacity and under-configured operation capacity, and provides a complete and practical solution for improving the stable operation capacity of the spacecraft control system.
The technical solution of the invention is as follows:
a method for constructing the on-orbit stable operation capability of a spacecraft control system is characterized in that the on-orbit stable operation capability of the spacecraft control system is constructed by data protection capability, data field rejection capability, abnormality detection capability, soft fault self-recovery capability, hard fault self-reconstruction capability and under-configured operation capability which are totally six capabilities, and the method comprises the following steps:
(1) and (3) constructing data protection capability, namely the capability that the system can still independently keep stable operation after the data required by the stable operation of the control system is influenced by abnormal events such as space environment, reset, tripping, abnormal operation, interruption and the like.
(2) And constructing data wild elimination capability, namely, the system autonomously eliminates wild values or illegal data of the measured and obtained data by setting a threshold value, judging data validity, adopting pre-estimation and other means, and the stable operation of the system is not influenced in the wild elimination process.
(3) And (3) constructing an abnormal detection capability, namely the capability of autonomously discovering or detecting the abnormal condition of the single machine or the system by a pre-designed detection method or means under the condition that the single machine or the system has a fault.
(4) And (3) establishing soft fault self-recovery capability, namely after the soft fault occurs, the system or the single machine automatically takes processing measures in time to eliminate the abnormity and ensure that the control system keeps stable operation in the fault processing process. The soft fault refers to a temporary and recoverable fault occurring in a system or a single machine, and the spacecraft soft fault comprises a recoverable fault caused by space single particles, program runaway or other reasons.
(5) The method is characterized in that the hard fault self-reconstruction capability is constructed, namely after a hard fault occurs, the system timely cuts off and isolates an unrecoverable fault single machine, and the capability of stable operation of the system can be ensured by means of starting a redundant single machine or switching working modes and the like. Hard faults correspond to soft faults and refer to unrecoverable resident faults on the satellite, including permanent faults, intermittent faults and the like.
(6) Under-configuration operation capability is constructed, namely under-configuration design such as fusion of measurement information and kinematics or fusion of an actuating mechanism and dynamics is adopted to realize under-measurement attitude determination or under-actuated attitude control under the condition that a system loses part of single machine and causes part of measurement information or control capability loss of the system, so that the system has stable operation capability.
The specific construction method of the data protection capability in the step (1) is as follows:
in order to ensure that the control system operates stably in the orbit, the characteristic data needing to be protected must be fully identified when the system is designed. The following data generally needs to be protected:
time of week data;
a control mode word;
a target attitude offset;
system important marks such as a posture fixing mode, a control mode and the like;
the working state of the component comprises the marks of whether the component is in work, normal, introduced, allowed to be diagnosed autonomously and the like;
some important parameters, such as orbit data and integral type data with cumulative effects.
Designing a target: aiming at relevant data influencing the stable operation of a control system, corresponding protective measures are taken to ensure that the data protection is independently, effectively and continuously available under the influence of abnormal conditions such as space environment, reset, cutting, abnormal operation, interruption and the like.
The data protection method comprises the following steps:
protecting the data in the star by taking two out of three; judging the satellite-hour increment during satellite-hour accumulation, and protecting when the satellite-hour increment exceeds a preset deviation range to prevent the satellite-hour error accumulation caused by instant errors of a hardware counter;
performing two-out-of-three protection on the control mode word; ensuring synchronous updating of the two-out-of-three data during mode conversion;
for key data influencing normal attitude determination and control, the onboard control computer periodically stores the data to a third party, such as a lower computer, a satellite affair subsystem or other subsystems of the whole satellite in the control system, and data recovery is performed after the onboard control computer is reset or switched so that the working state is recovered to the reset or pre-switching working state. The frequency of data retention is dependent on the system operating requirements.
The specific construction method of the wild eliminating capability of the data in the step (2) is as follows:
in order to ensure the on-orbit stable operation of the control system, the data needing field rejecting is firstly identified when the system is designed. The following data are generally performed for outliers:
sensor measurement data such as gyros, infrared earth sensors, digital sun sensors, analog sun sensors and star sensors. Invalid field values can be eliminated by a method of fusion judgment of information of a plurality of sensors.
And important state data of the execution part, such as momentum wheel rotating speed, sailboard driving mechanism rotating angle, control moment gyro angle, angular speed and the like.
And the data or instructions of the upper notes, such as data of injection orbit parameters, injection instructions, attitude maneuver angles and the like.
The external system inputs data, such as GNSS orbit data, GNSS second pulse time, external system timing data, and the like.
Designing a target: aiming at the characteristics of different input data, corresponding field rejecting means are independently adopted, so that the fact that unexpected data such as field values, illegal data and the like are not introduced into the system is ensured, or the influence of the unexpected data on the system is weakened through modes such as filtering, weighting and the like, and the stable operation of the whole process system is ensured.
The data field picking method comprises the following steps: the outlier data can be numerically divided into a mutator and a mutator. For the mutation quantity, the input data is directly compared with the set threshold value, or the result of the input data after operation processing is indirectly compared with the set threshold value of the corresponding physical quantity, so that the rapid and effective elimination is realized in the operation period. For the slow variable, the method of filtering and the like is adopted to reduce or eliminate the influence of the field data used in the system.
The specific construction method of the abnormality detection capability in the step (3) is as follows:
and constructing an abnormality detection capability from two aspects of single-machine abnormality detection and system abnormality detection. Firstly, single-machine abnormity detection is carried out on a sensor and an actuating mechanism which are started by a control system and read measurement information or state information, and abnormity detection is carried out on self-diagnosis data of analog quantity, state quantity and the like of the single machine, such as power supply state, motor current, temperature, communication state, validity marks of the single machine and the like; if the analog quantity and the state quantity of the single machine do not exceed the effective range, the digital quantity measurement data of the single machine is continuously subjected to abnormity detection, including measurement data range detection, measurement data field value detection, consistency detection of the measurement data and a theoretical value, consistency detection of the measurement data and the output of the same type of components and the like. In a second aspect, system anomaly detection comprises control performance satisfaction detection, jet safety detection, solar energy safety detection and the like, wherein if any detection value exceeds a set threshold value, system anomaly is determined to occur; the control performance is satisfied by: the attitude angle error does not exceed a set threshold and the attitude angular velocity error does not exceed the set threshold; the safety of air injection means that: the air injection amount in a given time does not exceed a set threshold; the solar energy safety means that: the sun-facing angle error of the solar sailboard does not exceed a set threshold value.
The method for specifically constructing the soft fault self-recovery capability in the step (4) is as follows:
firstly, identifying the soft fault type mainly comprises the following steps:
single event upset;
locking a single particle;
program run-off;
the task runs out of time.
The soft fault self-recovery method comprises the following steps:
aiming at soft faults caused by single event upset, the design measures are as follows: an automatic Error detection and Correction (EDAC) circuit is adopted; adopting a three-copy storage structure, comparing three copies when in orbit, and repairing error data by taking two out according to three bits; after confirming that the lower computer is abnormal in work, the upper computer can automatically reset the lower computer through a serial port or a hardware reset signal, or adopt a measure of powering off and then powering on to restore the lower computer to work normally.
Aiming at soft faults caused by single event locking, the design measures are as follows: the upper computer automatically cuts off the power of the fault lower computer, after the set time is exceeded, the single computer is powered on again, the single event locking phenomenon is eliminated through short-time power cut-off, and the normal work of the single event locking device is recovered.
Aiming at soft faults caused by program run-off, the design measures are as follows: designing a watchdog circuit for a circuit with a processor of a control computer, and generating a reset signal through the watchdog circuit when a program flies, initializing the processor and rerunning software; the unused interrupts are protected against interrupt traps, and when a computer enters an unused interrupt, it may be returned by the exit provided by the corresponding interrupt.
Aiming at soft faults caused by task operation overtime, the design measures are as follows: for the key tasks of the control system, when the system has transient faults and can not enable the key tasks to normally run (for example, overtime occurs), the tasks are ended in the period, the next control period is restarted, the internal watchdog is not cleared in the period, and under the condition of continuous overtime, the watchdog circuit generates a reset signal, the processor is initialized, and the software is restarted; if the system is continuously reset, the fault is eliminated through the cutter.
The system eliminates the single event locking through short-time power-off, and the power-off time is reasonably selected, so that the single event locking effect is effectively eliminated, and the system cannot be greatly influenced. After the system soft fault is recovered, the important state of the system needs to be reset, so as to ensure the correctness of the system state, such as power-on or power-off operation. When designing soft fault recovery measures, it is necessary to ensure that the system can enter a certain state when the system state recovery is unsuccessful. When designing a recovery scheme, it is necessary to prevent the repeated switching of the main backup, and a logic for terminating the switching should be designed.
The method for specifically constructing the self-reconfiguration capability of the hard fault in the step (5) comprises the following steps:
designing a target: the control system reconfiguration is one of the main means for handling the control system fault, and after the fault occurs, the system configuration or working mode is changed by reconfiguring the system resources to maintain the stable operation of the system. The hard fault self-reconstruction has the characteristics of 'self-reconstruction and continuous service', the system reconstruction is automatically completed on the satellite after the fault occurs, ground intervention is not needed, the working mode is not turned on the satellite as much as possible in the reconstruction process, and the service execution continuity of the spacecraft is ensured as much as possible.
The hard fault self-reconstruction method comprises the following steps:
the hard fault self-reconfiguration is divided into two steps, if the similar component is internally provided with a redundant backup component, the redundant component in the similar component is autonomously switched on the satellite, and if the redundant backup component in the similar component is not provided, the redundant backup component is combined with other types of sensors and actuating mechanisms to replace the redundant backup component, so that the system reconfiguration is realized.
For a system which is provided with a gyroscope and is normally opened in an orbit, the sensor is temporarily not connected into the system in the self-reconstruction process of other sensors such as an infrared earth sensor or a star sensor, and the integral attitude determination of the gyroscope is adopted.
When the reconstruction strategy is designed, the task of the control system is analyzed, functions which need to be ensured under the condition of a fault are distinguished from the use angle of a user, such as the ground-oriented attitude of a communication and remote sensing satellite when the fault occurs, the jet of air is avoided as much as possible when the fault occurs in a navigation satellite, and all the reconstruction strategies are based on the premise of completing the flight task.
The specific construction method of the under-configured operation capability in the step (6) is as follows:
the system-level under-configuration design mainly comprises two categories of under-measurement attitude determination and under-actuated attitude control. The under-measurement system refers to a system in which the number of independent measurement information of the system is less than the number of information required to be determined. The under-measurement attitude determination means that the attitude and the angular speed are determined under the condition that the attitude measurement sensor information is incomplete. The under-actuated system is a system with the number of independent control variables of the system smaller than the number of degrees of freedom of the system. The under-actuated attitude control means that the three-axis attitude control of the spacecraft is realized under the condition that an actuating mechanism cannot provide three-axis control moment.
Designing a target: when a user puts forward a specific requirement or at the end of the service life of the spacecraft, the system-level under-configuration operation capacity design is adopted, when part of single machines in the system have permanent faults, the system has the capacity of switching to an under-measurement attitude determination mode or an under-actuated attitude control mode, and the on-orbit stable operation of the system after the indexes are reduced in a limited manner can be realized.
The technical points are as follows:
the feasibility of an under-configuration scheme is considered in advance aiming at the characteristics of a sensor and an actuating mechanism during the design of the long-life spacecraft, and the feasibility of on-orbit implementation is ensured. The under-configuration scheme is mainly based on under-measurement attitude determination in a normal mode and an under-actuated attitude control scheme in the normal mode, and can consider the under-configuration scheme in an abnormal mode under the condition.
Under-configured attitude control generally only can ensure coarse orientation of a target, prolong the on-orbit service life, and cannot realize higher attitude determination precision and control precision.
The under-measurement attitude determination scheme can be combined with the normal attitude determination scheme, and under the condition that the number of attitude measurement components on the satellite is small, the system can autonomously and timely convert the abnormal sensor into the under-measurement attitude determination after diagnosing the sensor.
Under-actuated attitude control design needs to be combined with fault diagnosis of an actuating mechanism, and generally considered as a fault plan after permanent faults of part of the actuating mechanism or at the end of the service life of a spacecraft.
The under-configuration design needs to utilize the dynamic characteristics of the star body to the maximum extent, and the required under-configuration scheme is designed by fully utilizing the expression of the inertia difference or the inertia product of the star body in the dynamic equation.
Compared with the prior art, the invention has the beneficial effects that:
(1) compared with the fault diagnosis and fault tolerance design research results of various control systems in the prior art, the fault diagnosis and fault tolerance design research result is based on the actual state of ground development and on-orbit flight starting from the previous research and the actual influence of fault expression forms and systems of various single machines and systems of on-orbit types, and the theoretical research and the actual engineering disjunction are avoided. The influence possibly generated by the fault is comprehensively analyzed, the design method is targeted, the characteristics of a single machine and the fusion capability of usable data and information are fully considered, and fault recovery, isolation and processing are carried out on the system level in time. Once the method is provided, the method is applied to a control system with a plurality of key models, and the problems that the spacecraft is easy to be interfered by a single machine fault in orbit, the system attitude is abnormal and the like are well solved.
(2) The method aims to improve the robustness of the whole life cycle of the spacecraft, and comprehensively guarantees six capabilities, namely data protection capability, data field rejection capability, abnormality detection capability, soft fault self-recovery capability, hard fault self-reconstruction capability and under-configured operation capability. The method is complete in system and wide in application range, patching emergency treatment of the control system for specific faults is effectively avoided by enhancing the top-level planning and systematic design capability, the mature technology and the existing advanced method are integrated to the maximum extent, the development direction of a satellite public platform is met, the system engineering concept is complete and guiding is strong, and the improvement of the overall reliability and maturity of the control system is finally ensured.
(3) The method emphasizes the autonomous anomaly detection capability and the autonomous anomaly recovery capability, adopts simple and reliable autonomous processing measures, provides a comprehensive, simple and safe fault handling strategy for a control system through the modes of fault self-recovery, fault isolation, system degradation use and the like, improves the on-orbit autonomous stable operation capability of the spacecraft, reduces the workload of ground operation and maintenance, and is suitable for large-scale, long-service-life and industrialized spacecraft development and high-density launching requirements. The method for constructing the on-orbit stable operation capability of the spacecraft control system based on six capabilities is applied to various types of spacecraft, and on-orbit operation results of years show that the method can effectively improve the on-orbit operation stability of the spacecraft, can timely and autonomously recover various software faults caused by the space environment, can reliably and autonomously diagnose and isolate various single-machine or system faults, and can reduce the fault influence to the minimum.
Drawings
Fig. 1 is a flow chart of a method for constructing the on-orbit stable operation capability of a spacecraft control system according to the invention.
Detailed Description
The specific implementation of the process of the invention is shown in FIG. 1.
The main components of a spacecraft (satellite) control system comprise a master control computer, a backup control computer, 1 set of 3+1S gyros, 2 double-shaft digital sun sensors, 2 star sensors, 4 momentum wheels arranged in a pyramid configuration and a chemical thruster. When the satellite is in a normal ground working mode, a combined filtering attitude determination mode of a star sensor and a gyroscope is adopted on the satellite, and the gyroscope provides three-axis attitude angular velocity. The spacecraft control system is constructed with on-orbit stable operation capability according to the invention, and the main steps are as follows:
(1) and (3) constructing data protection capability, namely the capability that the system can still independently keep stable operation after the data required by the stable operation of the control system is influenced by abnormal events such as space environment, reset, tripping, abnormal operation, interruption and the like.
In order to ensure that the control system operates stably in the orbit, the characteristic data needing to be protected must be fully identified when the system is designed. This embodiment requires protection of the following data:
time of week data;
a control mode word;
a target attitude offset;
a posture-fixing mode mark;
the working state of the components comprises a gyro on-duty selection mark (3 gyros plus 1S adopt 3 entry control calculation marks, a star sensitivity selection mark (double star sensitivity or single star sensitivity) and an autonomous diagnosis permission mark;
the orbit data.
Designing a target: aiming at relevant data influencing the stable operation of a control system, corresponding protective measures are taken to ensure that the data protection is independently, effectively and continuously available under the influence of abnormal conditions such as space environment, reset, cutting, abnormal operation, interruption and the like.
The data protection method comprises the following steps:
protecting the data in the star by taking two out of three; and during the satellite-hour accumulation, judging the satellite-hour increment, and protecting when the satellite-hour increment exceeds a preset deviation range to prevent the satellite-hour error accumulation caused by instant errors of a hardware counter.
Performing two-out-of-three protection on the control mode word; and synchronous updating of the two-out-of-three data is ensured during mode conversion.
And key data influencing normal attitude determination and control are stored into a third party periodically by the onboard control computer, in the embodiment, the data are stored into a lower computer inside the control system, and the data are recovered after the onboard control computer is reset or switched, so that the working state is recovered to the reset or pre-switching working state.
(2) And constructing data wild elimination capability, namely, the system autonomously eliminates wild values or illegal data of the measured and obtained data by setting a threshold value, judging data validity, adopting pre-estimation and other means, and the stable operation of the system is not influenced in the wild elimination process.
In order to ensure the on-orbit stable operation of the control system, the data needing field rejecting is firstly identified when the system is designed. In this example, the following data need to be eliminated:
sensor measurement data, in this example, gyroscope, digital sun sensor, star sensor, and other sensor measurement data. Invalid field values can be eliminated by a method of fusion judgment of information of a plurality of sensors.
The important state data of the executing component comprise the data of the rotating speed of the momentum wheel, the rotating angle of the windsurfing board driving mechanism and the like.
And (4) data or instructions of upper notes, such as data of injection track parameters, injection instructions and the like.
The external system inputs data, which are mainly external system timing data and the like.
Designing a target: aiming at the characteristics of different input data, corresponding field rejecting means are independently adopted, so that the fact that unexpected data such as field values, illegal data and the like are not introduced into the system is ensured, or the influence of the unexpected data on the system is weakened through modes such as filtering, weighting and the like, and the stable operation of the whole process system is ensured.
The data field picking method comprises the following steps: the outlier data can be numerically divided into a mutator and a mutator. And for the mutation quantity, the mutation quantity is directly compared with a set threshold value, or the result after the operation is indirectly compared with the set threshold value, so that the rapid and effective elimination is realized in the operation period. For the slow variable, the method of filtering and the like is adopted to reduce or eliminate the influence of the field data used in the system.
The construction of the data outlier capability in this example includes:
removing the field from gyro measurement data: in the mode of small angular velocity motion of the spacecraft, if the difference between the current measurement value of the gyroscope and the last effective measurement value exceeds a certain threshold value, the gyroscope data is not used; and judging and selecting effective data according to the gyro equilibrium equation, and if the output value of the gyro does not meet the equilibrium equation threshold value, not introducing the gyro output data for use.
Removing the field from the measurement data of the digital sun sensor: judging according to the sun-seeing mark of the monitoring code, if the monitoring code does not see the sun, not introducing the data for use; if the difference between the current measured value and the last effective measured value of the digital sun sensor exceeds a threshold value, the data is not used.
Removing the field from the measurement data of the star sensor: when the two star sensors work, if the difference between the included angle between the optical axis and the transverse axis of the two star sensors and the included angle between the theoretical optical axis and the transverse axis is smaller than a selected threshold (such as 5 degrees), the data of the two star sensors are introduced into a system for use, otherwise, the two star sensors enter a single star sensor for field rejecting treatment; for a single star sensor, if the included angle between the measured optical axis and horizontal axis vector and the optical axis and horizontal axis vector which are measured last time effectively exceeds a threshold value (such as 2 degrees), the data of the star sensor is not introduced for use.
Removing the field of the momentum wheel measurement data: if the difference between the actually-measured angular momentum data of the period and the latest effectively-measured angular momentum data exceeds the threshold value, the measured data of the period is not used.
Top note orbit data field picking: and protecting the position, the speed or the semimajor axis a, the inclination angle i, the mean-near point angle lambda, the rising-crossing-point right ascension omega and the like of the orbit injection parameters, wherein if the difference between a certain parameter and the data before updating exceeds a threshold value, the injection orbit parameters are not introduced for use (except for orbit injection after orbit control).
Field rejecting is carried out on timing data of an external system: and when the difference value between the external system timing data and the star time of the control computer exceeds a threshold value, the external system timing data is not introduced for use.
In addition, in the normal mode attitude determination mode, a combined filtering attitude determination mode of the star sensor and the gyroscope is adopted, and when slowly varying deviation occurs in measurement data of the star sensor, the influence on the attitude can be reduced to a certain degree.
(3) And (3) constructing an abnormal detection capability, namely the capability of autonomously discovering or detecting the abnormal condition of the single machine or the system by a pre-designed detection method or means under the condition that the single machine or the system has a fault.
Designing a target: and aiming at different fault modes of the single machine, corresponding diagnosis strategies are adopted to finish the autonomous and rapid diagnosis of the faults, so that a basis is provided for the self-recovery of the single machine faults and the self-reconfiguration of the system.
The abnormality detection method comprises the following steps:
and constructing an abnormality detection capability from two aspects of single-machine abnormality detection and system abnormality detection. Firstly, single-machine abnormity detection is carried out on a sensor and an actuating mechanism which are started by a control system and read measurement information or state information, and abnormity detection is carried out on self-diagnosis data of analog quantity, state quantity and the like of the single machine, such as power supply state, motor current, temperature, communication state, validity marks of the single machine and the like; if the analog quantity and the state quantity of the single machine do not exceed the effective range, the digital quantity measurement data of the single machine is continuously subjected to abnormity detection, including measurement data range detection, measurement data field value detection, consistency detection of the measurement data and a theoretical value, consistency detection of the measurement data and the output of the same type of components and the like. In a second aspect, system anomaly detection comprises control performance satisfaction detection, jet safety detection, solar energy safety detection and the like, wherein if any detection value exceeds a set threshold value, system anomaly is determined to occur; the control performance is satisfied by: the attitude angle error does not exceed a set threshold and the attitude angular velocity error does not exceed the set threshold; the safety of air injection means that: the air injection amount in a given time does not exceed a set threshold; the solar energy safety means that: the sun-facing angle error of the solar sailboard does not exceed a set threshold value.
According to this method, the abnormality detection capability construction in this example includes:
detecting the gyro abnormality: when the 4 gyros work, whether the gyros are invalid or failed is detected according to a balance equation among the gyros, if the 4 gyros are detected to have invalid or failed gyros through the balance equation, the failed gyros are positioned by using information of other sensors (such as star sensors or infrared sensors) and measurement data of the gyros.
And (3) anomaly detection of the digital sun sensor: if the monitoring code of the digital sun sensor is invalid in the area where the sun is seen for a certain time, the digital sun sensor diagnoses a fault.
And (3) anomaly detection of the star sensor: if the star sensor has no output or invalid data output for a certain time in the usable area (such as no sunlight stray light or earth-atmosphere light interference) of the star sensor or the output data is not updated, the star sensor is diagnosed as a fault.
Detecting the abnormality of the momentum wheel: and calculating the friction torque of the momentum wheel through a friction torque estimation algorithm, and if the friction torque exceeds a threshold value, determining that the momentum wheel is in fault.
System level anomaly detection: when the spacecraft autonomously judges that the attitude angle error or the angular speed error continuously exceeds a threshold value, the system level is considered to be abnormal, and the design is switched into a sun-facing orientation mode to ensure the energy safety of the spacecraft. (when the satellite is in a safety mode of the sun, the-Z axis of the satellite body points to the sun, and the sailboard is set at a fixed angle of the sun, so that the optimal energy condition is provided for the whole satellite.)
(4) And (3) establishing soft fault self-recovery capability, namely after the soft fault occurs, the system or the single machine automatically takes processing measures in time to eliminate the abnormity and ensure that the control system keeps stable operation in the fault processing process. The soft fault refers to a temporary and recoverable fault occurring in a system or a single machine, and the spacecraft soft fault comprises a recoverable fault caused by space single particles, program runaway or other reasons.
Firstly, identifying the soft fault type mainly comprises the following steps:
single event upset;
locking a single particle;
program run-off;
the task runs out of time.
The soft fault self-recovery method comprises the following steps:
aiming at the soft fault caused by single event upset, the design measures in the example are as follows: an automatic Error detection and Correction (EDAC) circuit is adopted, automatic Error Correction is carried out when 1 bit Error occurs, and measures of resetting a CPU or repairing data written in an original address are taken according to Error contents when 2 bit Error occurs. After the upper computer confirms that the lower computer works abnormally, measures of power failure and power on are taken to enable the upper computer to recover to work normally.
For soft faults caused by single event locking, the design measures in the example are as follows: the upper computer automatically cuts off the power of the fault lower computer, after a period of time, the upper computer powers on the single computer again, eliminates the single event locking phenomenon through short-time power cut-off, and restores the normal work of the single event locking phenomenon.
For soft faults caused by program run-off, the design measures in the example are as follows: designing a watchdog circuit for a circuit with a processor of a control computer, and generating a reset signal through the watchdog circuit when a program flies, initializing the processor and rerunning software; the unused interrupts are protected against interrupt traps, and when a computer enters an unused interrupt, it may be returned by the exit provided by the corresponding interrupt.
For soft faults caused by task operation timeout, the design measures in the example are as follows: for the key tasks of the control system, when the system has transient faults and can not enable the key tasks to normally run (for example, overtime occurs), the tasks are ended in the period, the next control period is restarted, the internal watchdog is not cleared in the period, and under the condition of continuous overtime, the watchdog circuit generates a reset signal, the processor is initialized, and the software is restarted; if the system is continuously reset, the fault is eliminated through the cutter.
(5) The method is characterized in that the hard fault self-reconstruction capability is constructed, namely after a hard fault occurs, the system timely cuts off and isolates an unrecoverable fault single machine, and the capability of stable operation of the system can be ensured by means of starting a redundant single machine or switching working modes and the like. Hard faults correspond to soft faults and refer to unrecoverable resident faults on the satellite, including permanent faults, intermittent faults and the like.
Designing a target: the control system reconfiguration is one of the main means for handling the control system fault, and after the fault occurs, the system configuration or working mode is changed by reconfiguring the system resources to maintain the stable operation of the system. The hard fault self-reconstruction has the characteristics of 'self-reconstruction and continuous service', the system reconstruction is automatically completed on the satellite after the fault occurs, ground intervention is not needed, the working mode is not turned on the satellite as much as possible in the reconstruction process, and the service execution continuity of the spacecraft is ensured as much as possible.
The hard fault self-reconstruction method comprises the following steps:
the hard fault self-reconstruction is divided into two layers, the first layer is redundant switching inside the same type of components, and the satellite has the autonomous switching capacity of all the redundant components; the second layer is to realize system reconstruction by combining with other types of sensors and actuators.
Hard faults are combined with an anomaly detection design from a reconstruction design.
In the embodiment, the gyroscope is configured and normally opened on the orbit, the star sensor is temporarily not connected to the system in the self-reconstruction process, and the integral attitude determination of the gyroscope is adopted.
In this way, the hard fault self-reconfigurable capability construction in this example includes:
self-reconstruction of hard faults of the gyroscope: the 3+1S gyroscope has redundant backup capability, and can be reconfigured in an autonomous configuration switching mode when a single gyroscope fails. When the number of the gyros is less than 3, a non-gyro long-term working mode based on dynamics estimation is designed.
Self-reconstruction of hard faults of the digital sun sensor: in the embodiment, a backup digital sun sensor is available, and the reconstruction is realized by using the backup through autonomous switching.
Self-reconstruction of hard faults of the star sensor: and when the double star sensors fix the postures, reconstructing by cutting off the failed star sensors.
Self-reconstruction of hard faults of the momentum wheel: the momentum wheels installed in 4 pyramid configurations are used at the same time, and belong to a hot backup mode, and reconstruction is achieved by automatically changing the configuration of the flywheel after the momentum wheels break down.
Self-reconstruction of hard faults of the control computer: in this example, a backup control computer is available and reconstruction is achieved by autonomously switching backups.
(6) Under-configuration operation capability is constructed, namely under-configuration design such as fusion of measurement information and kinematics or fusion of an actuating mechanism and dynamics is adopted to realize under-measurement attitude determination or under-actuated attitude control under the condition that a system loses part of single machine and causes part of measurement information or control capability loss of the system, so that the system has stable operation capability.
The system-level under-configuration design mainly comprises two categories of under-measurement attitude determination and under-actuated attitude control. The under-measurement system refers to a system in which the number of independent measurement information of the system is less than the number of information required to be determined. The under-measurement attitude determination means that the attitude and the angular speed are determined under the condition that the attitude measurement sensor information is incomplete. The under-actuated system is a system with the number of independent control variables of the system smaller than the number of degrees of freedom of the system. The under-actuated attitude control means that the three-axis attitude control of the spacecraft is realized under the condition that an actuating mechanism cannot provide three-axis control moment.
Designing a target: when a user puts forward a specific requirement or at the end of the service life of the spacecraft, the system-level under-configuration operation capacity design is adopted, when part of single machines in the system have permanent faults, the system has the capacity of switching to an under-measurement attitude determination mode or an under-actuated attitude control mode, and the on-orbit stable operation of the system after the indexes are reduced in a limited manner can be realized.
The technical points are as follows:
the feasibility of an under-configuration scheme is considered in advance aiming at the characteristics of a sensor and an actuating mechanism during the design of the long-life spacecraft, and the feasibility of on-orbit implementation is ensured. The under-configuration scheme is mainly based on under-measurement attitude determination in a normal mode and an under-actuated attitude control scheme in the normal mode, and can consider the under-configuration scheme in an abnormal mode under the condition.
Under-configured attitude control generally only can ensure coarse orientation of a target, prolong the on-orbit service life, and cannot realize higher attitude determination precision and control precision.
The under-measurement attitude determination scheme can be combined with the normal attitude determination scheme, and under the condition that the number of attitude measurement components on the satellite is small, the system can autonomously and timely convert the abnormal sensor into the under-measurement attitude determination after diagnosing the sensor.
Under-actuated attitude control design needs to be combined with fault diagnosis of an actuating mechanism, and generally considered as a fault plan after permanent faults of part of the actuating mechanism or at the end of the service life of a spacecraft.
The under-configuration design needs to utilize the dynamic characteristics of the star body to the maximum extent, and the required under-configuration scheme is designed by fully utilizing the expression of the inertia difference or the inertia product of the star body in the dynamic equation.
According to the method, the under-configuration operation capability construction in the example comprises the following steps:
under-measurement attitude determination design: when the gyroscope is unavailable, a star sensor attitude determination scheme based on dynamics estimation is designed, the angular velocity of the spacecraft is estimated by using a star body executing mechanism and dynamics characteristics, and the attitude angle and the angular velocity are corrected by using the measurement of the star sensor, so that the attitude determination based on the star sensor is realized; and designing an attitude estimation scheme based on kinetic information when the star sensor is unavailable in a short period, estimating by utilizing the dynamics when the star sensor is unavailable, and correcting the attitude and the angular speed when the star sensor is available.
When the under-actuated attitude control is designed, an under-actuated control scheme is adopted when only two momentum wheels are normally left, the compass effect of the track gyro is utilized, the air injection unloading of a thruster is combined, an under-actuated control law is designed, and the three-axis stable attitude control based on the two momentum wheels is realized.
Parts of the invention not described in detail are well known in the art.
Claims (7)
1. A method for constructing the on-orbit stable operation capability of a spacecraft control system is characterized by comprising the following steps: the method constructs the on-orbit stable operation capability of the spacecraft control system through data protection capability, data field rejection capability, abnormality detection capability, soft fault self-recovery capability, hard fault self-reconstruction capability and under-configuration operation capability;
the data protection capability protects the satellite-hour data, the control mode words, the target attitude offset, the attitude determination mode, the control mode, the component working state, the orbit data and the integral data with the accumulation effect;
the data protection method in the data protection capability comprises the following steps:
protecting the time of the satellite data by taking two out of three, judging the time of the satellite increment when the time of the satellite is accumulated, and protecting when the time of the satellite exceeds a preset deviation range;
performing two-out-of-three protection on control mode words, and synchronously updating two-out-of-three data during mode conversion;
for the orbit data, the on-board control computer periodically stores the orbit data to a third party, and data recovery is carried out after the on-board control computer is reset or is switched off, so that the working state is recovered to the reset or pre-switching-off working state;
the under-configuration operation capability comprises under-measurement attitude determination and under-actuated attitude control;
the construction method comprises the following steps:
when the gyroscope is unavailable, establishing a star sensor attitude determination scheme based on dynamics estimation, estimating the angular velocity of the spacecraft by using a star body actuating mechanism and dynamics characteristics, and correcting the attitude angle and the angular velocity by using the star sensor measurement to realize the attitude determination of only the star sensor;
establishing an attitude estimation scheme based on kinetic information when the star sensor is unavailable;
when the under-actuated attitude control is designed, an under-actuated control scheme is adopted when the two momentum wheels are normal, the compass effect of the track gyro is utilized, the air injection unloading of the thruster is combined, and an under-actuated control law is designed to realize the three-axis stable attitude control based on the two momentum wheels.
2. The method for constructing the on-orbit stable operation capacity of the spacecraft control system according to claim 1, wherein the method comprises the following steps: the data field removing capability removes fields of the gyroscope, the infrared earth sensor measurement data, the digital sun sensor measurement data, the analog sun sensor measurement data, the star sensor measurement data, the momentum wheel rotating speed, the rotating angle of the sailboard driving mechanism, the control moment gyroscope angle, the angular speed, the injection orbit parameter, the injection instruction, the attitude maneuver angle, the GNSS orbit data, the GNSS second pulse time and the external system timing data.
3. The method for constructing the on-orbit stable operation capacity of the spacecraft control system according to claim 2, wherein the method comprises the following steps: the data de-cropping method in the data de-cropping capability comprises the following steps: firstly, dividing data to be subjected to field rejection into a mutation quantity and a slow variable, for the mutation quantity, directly comparing input data with a set threshold value, or indirectly comparing a result obtained after the operation processing of the input data with a corresponding physical quantity set threshold value, so as to realize the rejection, and for the slow variable, adopting a filtering method to reject.
4. The method for constructing the on-orbit stable operation capacity of the spacecraft control system according to claim 1, wherein the method comprises the following steps: the abnormality detection method in the abnormality detection capability is as follows:
establishing an anomaly detection capability from two aspects of single-machine anomaly detection and system anomaly detection, wherein on the first aspect, the single-machine anomaly detection is carried out on a sensor and an execution mechanism which are started by a control system and read measurement information or state information, firstly, the anomaly detection is carried out on the self-diagnosis data of the analog quantity and the state quantity of the single machine, and if the analog quantity and the state quantity of the single machine do not exceed an effective range, the anomaly detection is continuously carried out on the digital quantity measurement data of the single machine, and the anomaly detection comprises the measurement data range detection, the measurement data outlier detection, the consistency detection of the measurement data and a theoretical value, and the output consistency detection of the measurement data and similar components; in the second aspect, the system abnormity detection comprises control performance satisfaction detection, air injection safety detection and solar energy safety detection, wherein if any detection value exceeds a set threshold value, the system abnormity is determined to occur; the control performance is satisfied by: the attitude angle error does not exceed a set threshold and the attitude angular velocity error does not exceed the set threshold; the safety of air injection means that: the air injection amount in a given time does not exceed a set threshold; the solar energy safety means that: the sun-facing angle error of the solar sailboard does not exceed a set threshold value.
5. The method for constructing the on-orbit stable operation capacity of the spacecraft control system according to claim 1, wherein the method comprises the following steps: the soft fault type in the soft fault self-recovery capability comprises the following steps: single event upset, single event lockout, program runaway, and task run timeout.
6. The method for constructing the on-orbit stable operation capacity of the spacecraft control system according to claim 1, wherein the method comprises the following steps: the soft fault self-recovery method in the soft fault self-recovery capability comprises the following steps:
aiming at soft faults caused by single event upset, a three-part storage structure is adopted, error data is repaired by comparing three parts with each other in an on-track mode and taking two out according to three bits, and after the upper computer confirms that the lower computer works abnormally, the upper computer automatically resets through a serial port or a hardware reset signal or takes measures of power failure and power on to restore normal work;
aiming at soft faults caused by single event locking, the upper computer is adopted to automatically power off the fault lower computer, after the set time is exceeded, the single computer is powered on again, the single event locking phenomenon is eliminated through short-time power off, and normal work is recovered;
aiming at soft faults caused by program run-off, a watchdog circuit is designed for a circuit with a processor, when the program runs-off, a reset signal is generated through the watchdog circuit, the processor is initialized, and software is operated again;
aiming at soft faults caused by task operation overtime, when transient faults occur and key tasks cannot normally operate, the tasks are ended in the period, the next control period is restarted, an internal watchdog is not cleared in the period, and under the condition of continuous overtime, a reset signal is generated through a watchdog circuit, a processor is initialized, and software operates again; if the system is continuously reset, the fault is eliminated through the cutter.
7. The method for constructing the on-orbit stable operation capacity of the spacecraft control system according to claim 1, wherein the method comprises the following steps: the hard fault self-reconstruction method of the hard fault self-reconstruction capability comprises the following steps:
if the similar component is internally provided with a redundant backup component, the redundant component in the similar component is automatically switched on the satellite, and if the redundant backup component in the similar component is not provided, the component is replaced by combining with other sensors or actuating mechanisms, so that the system reconstruction is realized.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010700657.4A CN111913469B (en) | 2020-07-20 | 2020-07-20 | Method for constructing on-orbit stable operation capability of spacecraft control system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010700657.4A CN111913469B (en) | 2020-07-20 | 2020-07-20 | Method for constructing on-orbit stable operation capability of spacecraft control system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111913469A CN111913469A (en) | 2020-11-10 |
| CN111913469B true CN111913469B (en) | 2021-07-13 |
Family
ID=73280048
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010700657.4A Active CN111913469B (en) | 2020-07-20 | 2020-07-20 | Method for constructing on-orbit stable operation capability of spacecraft control system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111913469B (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112363410B (en) * | 2020-11-13 | 2022-09-30 | 浙江大学 | Intelligent autonomous control research and verification system for spacecraft |
| CN113359668B (en) * | 2021-06-08 | 2022-11-11 | 北京控制工程研究所 | Autonomous diagnosis and processing method for satellite power failure fault |
| CN113759946A (en) * | 2021-08-30 | 2021-12-07 | 上海卫星工程研究所 | Deep space exploration energy safety hierarchical management method and system |
| CN113778060B (en) * | 2021-09-15 | 2023-07-25 | 上海卫星工程研究所 | Satellite remote control receiving terminal on-orbit abnormity monitoring and fault recovery method and system |
| CN114114998A (en) * | 2021-11-05 | 2022-03-01 | 河北汉光重工有限责任公司 | Redundancy control system and method |
| CN114476135B (en) * | 2022-02-22 | 2024-02-09 | 中国空间技术研究院 | Satellite bias momentum flywheel hot standby method |
| CN115273566B (en) * | 2022-07-29 | 2024-01-09 | 西北工业大学 | High-orbit satellite group area protection system and method |
| CN116502516B (en) * | 2023-01-15 | 2023-12-01 | 北京控制工程研究所 | Identification method and device for degradation stage of spacecraft component |
Family Cites Families (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101131862B (en) * | 2007-09-29 | 2011-03-30 | 航天东方红卫星有限公司 | Space nonvolatile memory |
| CN100491916C (en) * | 2007-12-26 | 2009-05-27 | 北京控制工程研究所 | Method for detecting, recovering and controlling for independence trouble during orbital transfer course |
| CN102927987B (en) * | 2012-10-24 | 2015-07-08 | 北京控制工程研究所 | Processing method for probes of earth sensor under in-orbit fault condition |
| CN103029851B (en) * | 2012-11-30 | 2015-04-22 | 北京控制工程研究所 | Parameter self-tuning pseudo-rate modulator |
| CN104678989B (en) * | 2014-12-26 | 2017-07-07 | 北京控制工程研究所 | The state aware optimization method of fault diagnosability is improved under a kind of noise circumstance |
| CN104809338B (en) * | 2015-04-16 | 2017-11-17 | 北京空间飞行器总体设计部 | A kind of method for early warning influenceed based on the satellite in orbit of incidence relation by space environment |
| CN109934130A (en) * | 2019-02-28 | 2019-06-25 | 中国空间技术研究院 | The in-orbit real-time fault diagnosis method of satellite failure and system based on deep learning |
| CN111338840B (en) * | 2020-03-07 | 2021-09-28 | 西安电子科技大学 | Space data protection method, storage medium, computer program, system and terminal |
-
2020
- 2020-07-20 CN CN202010700657.4A patent/CN111913469B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN111913469A (en) | 2020-11-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111913469B (en) | Method for constructing on-orbit stable operation capability of spacecraft control system | |
| Dugan et al. | Fault trees and Markov models for reliability analysis of fault-tolerant digital systems | |
| CN111966517B (en) | On-orbit autonomous anomaly detection method for hierarchical spacecraft control system | |
| Olive | FDI (R) for satellites: How to deal with high availability and robustness in the space domain? | |
| AU2002245678B2 (en) | Method of recovering a flight critical computer after a radiation event | |
| WO1998044416A1 (en) | Fault tolerant computer system | |
| CN111913470B (en) | Spacecraft control system data validity identification method | |
| CN113918386A (en) | Autonomous fault tolerance and fault recovery method for on-orbit processing system | |
| CN112905155B (en) | Design method of autonomous attitude control software of navigation satellite | |
| CN110567485B (en) | On-orbit autonomous fault diagnosis and repair method for multi-probe star sensor | |
| CN111473799A (en) | Method and device for testing fault diagnosis and recovery functions of satellite celestial body sensor | |
| JP2002287997A (en) | Multiple system processing method | |
| Liu | A study of flight-critical computer system recovery from space radiation-induced error | |
| Neilson | Mars exploration rovers surface fault protection | |
| CN112860467A (en) | On-orbit fault smooth repairing device and method for satellite-borne computer | |
| CN111290885A (en) | Multi-computer two-stage data backup and hierarchical recovery method for Mars detection | |
| Vladimirova et al. | Fault-Tolerant Distributed Attitude and Orbit Control System for Space Applications | |
| CN113760605B (en) | Implementation method for recovering communication between deep space detector and ground after power failure and power on of detector | |
| Duarte et al. | A fault-tolerant attitude determination system based on COTS devices | |
| CN114035422B (en) | Heterogeneous gyroscope fault positioning and processing method based on multi-source information | |
| Yan et al. | Ground test verification method for fault diagnosis and disposal of satellite attitude and orbit control subsystem | |
| Siewiorek et al. | Fault tolerant architectures for space and avionics | |
| CN112083645A (en) | Thruster redundancy mode management and fault shielding and autonomous recovery method | |
| Dubos et al. | Single Event Functional Interrupts during the Cruise and EDL Phases of the Mars 2020 Mission | |
| Slonski | System fault protection design for the Cassini spacecraft |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |