CN114620248A

CN114620248A - Satellite autonomous safety implementation method and system based on logic program control instruction

Info

Publication number: CN114620248A
Application number: CN202210290624.6A
Authority: CN
Inventors: 阳军军; 寇义民; 李红洁; 黄翔; 王浩; 姚俊
Original assignee: Spacety Co ltd Changsha
Current assignee: Spacety Co ltd Changsha
Priority date: 2022-03-23
Filing date: 2022-03-23
Publication date: 2022-06-14

Abstract

The invention relates to a method and a system for realizing autonomous safety of a satellite based on a logic program control instruction. The satellite autonomous safety implementation system at least comprises a housekeeping management module and other modules. The housekeeping module can load, analyze and execute the logic program control instruction sequence. The other module is configured to send the operating state data of the other module to the housekeeping module. The logic program control instruction sequence at least comprises a logic program control instruction and a task instruction, and the housekeeping management module is configured to judge the working state data through the logic program control instruction and execute the task instruction based on a judgment result obtained by the logic program control instruction so as to ensure the safety of the satellite when executing the task instruction.

Description

Satellite autonomous safety implementation method and system based on logic program control instruction

Technical Field

The invention relates to the technical field of on-orbit satellites, in particular to a method and a system for realizing autonomous safety of a satellite based on a logic program control instruction.

Background

The satellite flies outdoors most of the time when in orbit operation, once the whole satellite component fails, the whole satellite can not be intervened and controlled timely by the ground, so that the whole satellite failure is easily caused, the satellite task is further influenced, and even a catastrophic result is caused. The conventional method for executing the logic program control instruction sequence by the satellite is generally executed according to time and point, and the instruction sequence cannot generally judge the working state of the satellite. For example, chinese patent publication No. CN201710583022 discloses a method for maintaining satellite program-controlled instructions based on a loop queue, which adopts a mode of executing at a time point, that is, a loop determines whether an instruction in an instruction sequence reaches an execution time, and executes the instruction if the time reaches the execution time of the instruction. The method only judges the validity, the execution time and the execution interval of the instruction when the instruction sequence is executed, but does not judge system safety factors such as whether the system state is normal or not, whether the condition meets the execution of the instruction and the like; as for the system safety judgment, the system safety judgment needs to be independently carried out outside the instruction sequence, and under some conditions, the execution of the instruction sequence triggers a system safety mechanism, so that the contradiction between the system safety and the task instruction sequence execution occurs. A common satellite autonomous safety mechanism, for example, a satellite in-orbit autonomous fault handling scheme disclosed in chinese patent publication No. CN201810999183, classifies some faults that may occur in satellite in-orbit in advance on the ground, and designs various complex safety modes in software to handle various faults. However, the pre-assumed fault on the ground may not be consistent with the actual on-track condition, or a new fault on the track condition occurs, so that the software needs to be updated by injecting a safety mode for processing, and the modification and maintenance are complex; and each model satellite needs to design a corresponding safety mode according to software coding aiming at the model characteristics, so that the flexibility and the adaptability are poor. Various safety modes are required to be designed in satellite software for ensuring satellite safety, the safety modes are independent of instruction sequences and judge satellite states to perform exception handling, on one hand, the satellite task instruction sequences and the safety mode exception handling may conflict, and on the other hand, the safety modes are complex to implement and lack of flexibility. In addition, the ground has difficulty in on-orbit modification/maintenance of a safety mode designed in software in advance and has no universality; each satellite also needs separate coding software to design a respective safety mode, and meanwhile, the safety mode cannot adapt to various abnormal conditions of the satellite in orbit.

For example, chinese patent publication No. CN111126020A discloses a tabular autonomous security mode design method and system for managing an autonomous security mode of a spacecraft. The invention abstractly designs the autonomous safety mode of the spacecraft into two general forms: the remote measurement criterion form and the execution action sequence form can complete the design of the autonomous safety modes of different models only by designing two forms, and the forms can be annotated and modified. The method has the advantages of strong universality, easy expansion, easy modification and the like. However, the method realized by the invention depends on two global tables, two tables need to be remarked again for single abnormal change, and the maintenance is inconvenient.

For another example, chinese patent publication No. CN107885140B discloses a hierarchical whole satellite autonomous emergency management method and system, which is a method for performing mode-division management on autonomous security, and the method classifies satellite failures in advance, determines the current state according to telemetry data, matches corresponding failure modes, and then executes a response command sequence to perform autonomous security processing. Although the invention has certain flexibility compared with the method of completely using hard coding to realize autonomous safe processing, and the processed instruction sequence can be adjusted, the invention matches the corresponding failure mode according to the telemetry state and is fixed, and the failure mode is usually realized by hard coding, on one hand, the invention can not be flexibly adjusted, and on the other hand, the invention also has no universality among models. Accordingly, there is a need for improvement in view of the above deficiencies of the prior art.

Furthermore, on the one hand, due to the differences in understanding to those skilled in the art; on the other hand, since the applicant has studied a great deal of literature and patents when making the present invention, but the disclosure is not limited thereto and the details and contents thereof are not listed in detail, it is by no means the present invention has these prior art features, but the present invention has all the features of the prior art, and the applicant reserves the right to increase the related prior art in the background.

Disclosure of Invention

The logic program control instruction sequence of the existing satellite is executed according to time and point, and the instruction sequence cannot judge the state of the satellite. The autonomous security of the satellite needs to be realized by additional coding, the execution of the instruction sequence may trigger a security mode, and the autonomous security of the satellite and the timing execution of the instruction sequence are contradictory, so that the security of the execution of the in-orbit task of the satellite cannot be ensured. In addition, the existing logic program control instruction sequence machine has a single function of executing instructions according to time points, and does not have a condition judgment function at all, so that the requirement of a satellite for executing complex tasks in orbit cannot be met. The task execution needs to rely on a pre-designed task software program to be executed normally.

Most of the existing satellite autonomous safety implementation modes adopt a software mode to preset various safety modes so as to presuppose possible faults and countermeasures of the satellite in orbit. The autonomous security mode is solidified in a software form, so that on-track maintenance and modification are difficult and expansion is difficult.

The existing autonomous security of the satellite needs to realize a corresponding security mode according to a specific model software code. The safety mode is complex in design and not universal, and independent safety related software needs to be developed independently for each model, so that the safety mode is not flexible and universally applicable.

Aiming at the defects of the prior art, the invention provides a satellite autonomous safety realization method and a satellite autonomous safety realization system based on a logic program control instruction. The satellite autonomous safety implementation system at least comprises a housekeeping management module and other modules. The housekeeping module can load, analyze and execute the logic program control instruction sequence. The logic program control instruction sequence at least comprises logic program control instructions and task instructions, and other modules are configured to send the working state data of other modules to the housekeeping module. The satellite management module is configured to judge the working state data through the logic program control instruction and execute the task instruction based on a judgment result obtained by the logic program control instruction so as to ensure the safety of the satellite when executing the task instruction.

Preferably, the house keeping module can obtain the working state data sent by other modules.

Preferably, the sequence of logic program control instructions includes at least one of execution time and logic program control instructions corresponding to the execution time and/or task instructions of the satellite.

Preferably, the task instructions are at least capable of controlling other modules to perform specific tasks. Preferably, the task instruction further includes an exception handling instruction for performing corresponding exception handling.

Preferably, the operating status data at least comprises attitude and orbit status data, attitude and orbit stand-alone status data, power supply and distribution status data, load status data, heater and temperature status data. Preferably, the working state data can also be added with new working state data according to the actual scene requirements.

Through the configuration mode, the scheme of the invention adds the logic program control command in the logic program control command sequence, and then automatically judges whether the state of the satellite is safe or not in advance based on the working state data, thereby solving the contradiction between autonomous safety and task command execution and ensuring the safety of satellite on-orbit task execution.

Through the configuration mode, the satellite safety state is judged through the logic program control instruction in the instruction sequence, autonomous safety processing is carried out through the instruction sequence mode, on-orbit maintenance only needs to update the instruction sequence, software codes do not need to be injected, and the satellite safety state on-orbit maintenance method is simple in maintenance, easy to modify and highly extensible.

Through the configuration mode, the logic program control instruction sequence realized by the scheme of the invention has universality, different types can realize number matching adaptation by adjusting the instruction sequence, and software coding is not needed, so that the software development workload is greatly reduced.

According to a preferred embodiment, the logic program control instructions comprise at least conditional judging instructions. The condition judgment instruction can be at least used for judging the working state data and outputting the judgment result.

According to a preferred embodiment, the logic-programmed instructions further comprise one or more of conditional jump instructions, loop execution instructions, call execution instructions. The conditional jump instruction can jump to the program control instructions of the number specified by the conditional jump instruction according to the judgment result of the conditional judgment instruction and then continue to execute, the loop execution instruction is used for executing the subsequent program control instructions of the logic program control instruction sequence in a loop mode, and the call execution instruction is used for calling and executing other instruction sequences to be called.

Particularly preferably, the condition judgment instruction can be flexibly matched with one or more of a conditional jump instruction, a loop execution instruction and a call execution instruction.

Through the configuration mode, the scheme of the invention realizes a command sequence with logic judgment and programmable function, judges the satellite state in the task execution process by adopting logic program control commands such as universal condition judgment, skip, call execution and the like, and calls the command sequence to perform corresponding exception handling based on the judgment result of judging the satellite state so as to realize the unification of task command sequence execution and satellite autonomous safety. The instruction sequence realized by the scheme of the invention can flexibly process various exceptions in the task execution process, has programmable characteristic, can be timely adjusted according to on-orbit conditions, and well avoids the contradiction between the task and autonomous safety conflict in the existing mode. The general logic program control instruction realized by the scheme of the invention has general applicability, can be realized for general satellite systems, does not need to realize software coding of a safety mode aiming at a specific satellite, and greatly reduces the software development amount of the satellite. Meanwhile, the instruction sequence has the programmable capability, so that the functions realized by the instruction sequence are greatly expanded. The logic common task instructions such as the condition judgment instruction, the jump, the call and the like realized by the scheme of the invention enable the logic program control instruction sequence to have the programmable characteristic, namely, the satellite autonomous safety can be realized, the function and the application range of the instruction sequence are expanded, and some complex tasks can be completed by using the instructions.

According to a preferred embodiment, the logic program control command is composed of command codes and command parameters. The instruction code is used for uniquely identifying one logic program control instruction. The instruction parameters of the condition judgment instruction comprise a judgment mode word, a judgment data source ID, a judgment data number and a threshold type.

The analysis and execution flow of the condition judgment instruction is as follows: acquiring the judgment data source ID from the condition judgment instruction to judge a data source; acquiring data corresponding to the judgment data number from the data source; and acquiring the judgment mode word from the condition judgment instruction, judging whether the logical relationship between the data and the threshold is established or not according to the judgment mode, and temporarily storing the judgment result as the input of the subsequent conditional jump instruction and/or the loop execution instruction.

According to a preferred embodiment, the instruction parameters of the conditional jump instruction comprise the number of instructions to jump. The execution process of the conditional jump instruction is as follows: acquiring the output result of the condition judgment instruction corresponding to the condition jump instruction; if the output result is true, continuing to execute the subsequent program control instruction; if the output result is negative, skipping the program control instructions of the specified instruction number needing skipping in the conditional skipping instruction and then continuing to execute the subsequent program control instructions.

According to a preferred embodiment, the instruction parameters of the loop execution instruction include a loop condition, a maximum number of loops, and a number of program-controlled instructions executed in a loop. The loop condition is a loop according to the execution times or an output result execution loop according to the condition judgment instruction.

The execution process of the loop execution instruction is as follows: acquiring the circulation condition and the maximum circulation times; judging whether the maximum cycle number or cycle condition is reached; if the maximum cycle times or the cycle conditions are not met, circularly executing the logic program control instruction sequence until the maximum cycle times or the cycle conditions are met; and if the maximum cycle times or the cycle conditions are met, stopping circularly executing the logic program control instruction sequence.

According to a preferred embodiment, the instruction parameter of the call execution instruction includes a task instruction name to be called for execution.

The execution process of the calling execution instruction comprises the following steps: searching an instruction sequence file to be called and executed according to the called and executed task instruction name; judging whether a sub-instruction sequence needing to be called exists; if the sub-instruction sequence needing to be called exists, executing the sub-instruction sequence, and continuing to execute the main instruction sequence after the sub-instruction sequence is executed; and if the sub instruction sequence needing to be called does not exist, directly continuing to execute the main instruction sequence.

According to a preferred embodiment, the other modules comprise at least a gesture control module. An attitude and orbit control module is configured to control/monitor the attitude and orbit of the satellite and at least send attitude and orbit state data of the satellite to the housekeeping module.

According to a preferred embodiment, the other modules further comprise a posture and orbit control stand-alone module, a power supply module, a load module and a thermal control module. The attitude and orbit control stand-alone module is configured to send attitude and orbit stand-alone state data of the attitude and orbit control stand-alone to the satellite affair management module, the power supply module is configured to provide power supply and power distribution state data of the satellite to the satellite affair management module, the load module is configured to send load state data of a load stand-alone to the satellite affair management module, and the thermal control module is configured to send the heater and temperature state data to the satellite affair management module.

The invention also provides a satellite autonomous safety implementation method based on the logic program control instruction. The satellite autonomous security implementation method comprises the following steps:

the star affair management module loads, analyzes and executes a logic program control instruction sequence, wherein the logic program control instruction sequence at least comprises a logic program control instruction and a task instruction;

the other modules send the working state data of the other modules to the house keeping management module;

the satellite management module judges the working state data through the logic program control instruction and executes the task instruction based on a judgment result obtained by the logic program control instruction so as to ensure the safety of the satellite when the task instruction is executed. By this configuration, implementing logic programmed instructions in the instruction sequence includes, but is not limited to: and the logic program control instructions such as the condition judgment instruction, the condition jump, the loop execution, the call and the like enable the instruction sequence to have the programmable characteristic.

By the configuration mode, a mode of processing exception in task execution is performed by using a logic program control instruction sequence, and whether the execution condition is met or not can be dynamically judged in the task execution, so that the task execution and the autonomous safety are not in conflict; the logic program control instruction sequence is used for autonomous safety processing, the autonomous safety function of the satellite is not realized by hard coding any more, the flexibility and the adaptability are wide, and the on-orbit reconfiguration can be realized; the autonomous safety management is organized into a plurality of small-cycle instruction sequences, and parallel execution is performed, so that delay waiting caused by sequential processing is avoided; after logic program control instructions are added into the instruction sequence, the on-orbit complex task execution can be adapted through programming combination; the technical scheme adopts a logic program control command sequence to organize a small loop for exception judgment, calls the command sequence for processing, does not need to perform software coding on specific exceptions in advance, and can dynamically adjust the exception processing logic program control command sequence according to the exceptions occurring on track; compared with the mode that the logic program control instruction sequence is executed according to the time sequence, the scheme of the invention realizes the logic program control instruction in the instruction sequence, realizes the programmable instruction sequence, can execute the instruction sequence according to the condition, can jump and execute, can execute circularly, can call other execution sequences for execution, has flexible execution mode, and can flexibly process the possible abnormity in the task execution process. In addition, the scheme of the invention has small workload, is convenient to increase, delete, modify and maintain, and realizes autonomous safe processing by a software hard coding mode, if the on-orbit abnormality is inconsistent with the assumption, the software can be modified and annotated only by the modification and processing workload is large, and the software annotation is also needed when a new abnormality processing function is added; the scheme of the invention only needs to modify the program control command sequence of the exception handling logic, and the instruction sequence modification is much simpler and has less workload; the scheme of the invention has wider adaptability, the autonomous security realized by adopting a software hard coding mode not only needs to be bound with a specific model, but also often cannot adapt to other models, and each model needs to recode autonomous security management respectively.

Drawings

FIG. 1 is a simplified module connection diagram of a preferred embodiment of the satellite autonomous security enforcement system provided by the present invention;

FIG. 2 is a schematic diagram of a preferred embodiment of a decision mode word provided by the present invention;

FIG. 3 is a diagram illustrating a preferred embodiment of determining a data source ID provided by the present invention;

FIG. 4 is a diagram illustrating a preferred embodiment of determining data numbers according to the present invention;

FIG. 5 is a flow diagram of a preferred embodiment of a logic programmed instruction sequence provided by the present invention;

FIG. 6 is a flow chart illustrating another preferred embodiment of a logic programmed instruction sequence provided by the present invention.

List of reference numerals

1: a housekeeping module; 2: a posture and orbit control module; 3: attitude and orbit single-machine control module

4: a power supply module; 5: a load module; 6: and a thermal control module.

Detailed Description

The following detailed description is made with reference to the accompanying drawings.

Fig. 1 shows a satellite autonomous security implementation system based on logic programmed instructions. The satellite autonomous security implementation system at least comprises a housekeeping management module 1 and other modules.

The housekeeping module 1 can load, analyze and execute the logic program control instruction sequence.

The other modules are configured to send the operating status data of the other modules to the house keeping module 1.

The logic program control instruction sequence at least comprises logic program control instructions and task instructions.

The housekeeping management module 1 is configured to judge the working state data through the logic program control instruction, and execute the task instruction based on a judgment result obtained by the logic program control instruction, so as to ensure the safety of the satellite when executing the task instruction.

Preferably, the house keeping module 1 can obtain the working state data sent by other modules.

Preferably, the sequence of logic program control instructions includes execution time and logic program control instructions corresponding to the execution time and/or task instructions of the satellite.

Preferably, the logic program control instruction sequence is loaded, analyzed and executed by the star management module 1 in the OBC (on-board computer).

Preferably, the housekeeping module 1 and the attitude and orbit control module 2 may be respectively disposed on or integrated with the on-board computer.

Through the configuration mode, the matching judgment and the execution of the autonomous safety processing of the fault mode are carried out by using a logic program control instruction; the software coding realizes a general logic program control instruction, the logic program control instruction is not directly connected with the specific fault matching judgment, and the logic program control instruction is a part of an instruction sequence without software coding for matching a specific fault mode. The scheme of the invention adopts the logic program control command to judge, can independently judge and process each fault by using the command sequence, and achieves sufficient detail.

According to a preferred embodiment, the logic-programmed instructions further comprise one or more of conditional jump instructions, loop execution instructions, call execution instructions. The conditional jump instruction can jump to the program control instructions of the number specified by the conditional jump instruction according to the judgment result of the conditional judgment instruction and then continue to execute. The loop execution instruction is used for executing the subsequent program control instructions of the logic program control instruction sequence in a loop mode. The call execution instruction is used for calling and executing other instruction sequences needing to be called.

Preferably, the conditional jump instruction comprises only one parameter, i.e. the number of instructions requiring a jump.

Particularly preferably, the condition judgment logic instruction can be flexibly matched with logic instructions such as a conditional jump instruction, a loop execution instruction, a call execution instruction and the like, so as to realize more complex and flexible abnormal condition judgment and processing.

According to a preferred embodiment, the logic program control command is composed of command codes and command parameters. The instruction code is used for uniquely identifying one logic program control instruction. The instruction parameters of the condition judgment instruction comprise a judgment mode word, a judgment data source ID, a judgment data number and a threshold value type.

The analysis and execution flow of the condition judgment instruction is as follows: acquiring the judgment data source ID from the condition judgment instruction to judge the data source; acquiring data corresponding to the judgment data number from the data source; and acquiring the judgment mode word from the condition judgment instruction, judging whether the logical relationship between the data and the threshold is established or not according to the judgment mode, and temporarily storing the judgment result as the input of the subsequent conditional jump instruction and/or the loop execution instruction.

Preferably, the programmed logic programmed instructions are comprised of instruction codes and instruction parameters.

Preferably, the instruction code is used in a logic program control instruction sequence to uniquely identify a program control instruction. For example, the command code of the logic programmed command may consist of numbers and/or characters. For example, the instruction code identifying the conditional predicate instruction may be "0100C 001"; the instruction code identifying the conditional jump instruction may be "0100C 002"; the instruction code identifying the loop execution instruction may be "0100C 003"; the instruction code identifying the call execution instruction may be "0100C 004". For another example, the instruction code and the instruction parameter of the conditional determination instruction for determining whether the star sense current (e.g., the current of the 0X1D th loop of the power management apparatus) is smaller than the determination threshold (e.g., the determination threshold is 200 mA) are 0100C001 and 0390021D 00C 800, respectively.

The house keeping module 1 can temporarily store the judgment result (for example, true or false) obtained by judging the condition judgment instruction based on the working state data in the condition variable as the input condition of the subsequent other logic program control instructions (for example, the condition bar jump instruction and the loop execution instruction). Other logic program control instructions are relatively independent, and the logic program control instructions are finally organized in a form of instruction sequences to form execution logic relations.

Preferably, the sequence of logic program control commands consists of execution time and logic program control commands corresponding to the execution time and/or task commands of the satellite.

Preferably, a sequence of logic program control commands comprises at least an execution time and a corresponding logic program control command and/or a satellite task command.

Preferably, a sequence of logic program control instructions can include a plurality of execution times and logic program control instructions corresponding to the execution times and/or satellite task instructions. Preferably, the execution time is relative time in units of seconds.

Preferably, the parameter data of the condition judgment instruction includes a judgment mode word, a judgment data source ID, a judgment data number, and a threshold type.

Preferably, the judgment mode word is defined as a mode of judging the judgment data. For example, a preferred embodiment of the decision mode word shown in fig. 2. Preferably, the judgment mode word can adopt other judgment modes according to actual requirements.

Preferably, the judgment data source ID is used to identify the source of the judgment data. Preferably, the data of the judgment data to be identified may originate from an OBC (on-board computer), a stand-alone component (e.g. from a posture and orbit control stand-alone module 3, such as a star sensor, a flywheel, etc.), a load (e.g. from a load module), etc. For example, a preferred embodiment of determining the data source ID is shown in fig. 3. Preferably, the judgment data source ID can be flexibly added/deleted according to actual requirements. Through the configuration mode, the data source of the working state data is abstracted by the condition judgment instruction, so that the data source of the working state data is not hooked with a specific telemetering word, namely the data source of the working state data is abstracted into abstract state conditions such as temperature, power supply, working state and the like; meanwhile, the condition judgment instruction realized by the method can be flexibly matched with logic program control instructions such as a conditional jump instruction, a loop execution instruction, a call execution instruction and the like, and more complex and flexible abnormal condition judgment and processing are realized. In addition, the method of the invention uses a single instruction sequence to process the exception so as to modify the specific exception processing, and only needs to annotate a single instruction sequence file.

Preferably, the judgment data number is used for distinguishing the data type of the data to be identified and judged. Preferably, the data categories include, but are not limited to: voltage, current, temperature, power distribution state, operating state, and the like. For example, a preferred embodiment of the judgment data number as shown in fig. 4.

Preferably, the judgment data number can be defined according to actual requirements.

Preferably, the judgment threshold is a data or a condition filled in the instruction in advance. Preferably, the decision threshold can also be any data type in the threshold type definition. For example a current threshold of 200 mA. Preferably, the threshold type is a type of judgment threshold data. For example, a type code number of "0" may represent that the threshold type is integer data; the type code "1" may represent that the threshold type is floating point data; the type code "2" may represent a threshold type of "BOOL condition: 0X55 is true, 0X00 bit is false; .

Preferably, the sequence of logic programmed instructions may be saved as a binary file. Preferably, the logic program control instruction sequence is executed by OBC (on-board computer) loading analysis. For example, the binary file of the logic programmed instruction sequence in FIG. 5 is as follows:

00 00 00 01 01 00 C0 01 03 90 02 1D 00 C8 00

00 00 00 02 01 00 C0 02 00 01

00 00 00 03 00 00 00 02 0a 00

preferably, the logic programmed instructions may take other different data structures to perform the same or similar functions as described above and perform autonomous security management through instruction sequences.

Based on the scheme, the purpose of the logic program control instruction can be continuously expanded to realize more logic program control instructions, and the logic program control instruction is used for organizing a task instruction sequence to realize a task autonomous safety mode.

According to a preferred embodiment, the instruction parameters of the conditional jump instruction comprise the number of instructions to jump.

The executing process of the conditional jump instruction comprises the following steps: acquiring the output result of the condition judgment instruction corresponding to the condition jump instruction; if the output result is true, continuing to execute the subsequent program control instruction; if the output result is negative, skipping the program control instructions of the specified instruction number needing skipping in the conditional skipping instruction and then continuing to execute the subsequent program control instructions.

Preferably, the conditional jump instruction comprises only one parameter, i.e. the number of instructions requiring a jump. Preferably, the number of the specified pieces in the conditional jump instruction can be flexibly set according to an actual application scenario. Preferably, the conditional branch instruction can be flexibly combined with a conditional jump instruction and/or a loop execution instruction for branching the execution condition of the task logic program control instruction sequence. And if the satellite state/condition corresponding to the working state data does not meet the condition for executing the task instruction, skipping the instruction sequence and not executing the instruction sequence so as to ensure the safety of the satellite. For example, in order to ensure the energy safety of the satellite, the voltage state of the corresponding component of the satellite can be judged through a condition judgment command before the task logic program control command sequence is executed, when the voltage is lower than a safety threshold (namely, a judgment threshold), the command of the task logic program control command sequence is skipped, and when the voltage is higher than the safety threshold, the command is normally executed.

According to a preferred embodiment, the instruction parameters of the loop execution instruction include a loop condition, a maximum number of loops, and a number of program control instructions executed in a loop. The loop condition is a loop according to the execution times or an output result execution loop according to the condition judgment instruction.

Preferably, the loop condition is defined as that the loop execution condition is to loop by the number of times of execution or to loop by the conditional judgment instruction. Preferably, looping by the number of execution times means to continue looping execution of the program control instruction as long as the number of times the program control instruction is looped execution has not reached the maximum number of times. Preferably, the loop execution according to the condition judgment instruction means that the loop execution of the program control instruction is continued only when the judgment result output of the condition judgment instruction is true, and the loop is exited when the judgment result output is false. Preferably, the maximum loop number is a value that the number of times the instruction sequence loop is executed cannot exceed, i.e. the loop is stopped when the number of execution loops is greater than the maximum loop number. Preferably, the number of program control instructions to be executed in a loop is the number of program control instructions to be executed in a loop.

The execution process of the call execution instruction comprises the following steps: searching an instruction sequence file to be called and executed according to the called and executed task instruction name; judging whether a sub-instruction sequence needing to be called exists; if the sub-instruction sequence needing to be called exists, executing the sub-instruction sequence, and continuing to execute the main instruction sequence after the sub-instruction sequence is executed; and if the sub instruction sequence needing to be called does not exist, directly continuing to execute the main instruction sequence.

Preferably, the task instruction to be called for execution may include a main instruction sequence and a sub instruction sequence. Preferably, the task instruction to be called for execution may further include an exception handling instruction sequence. For example, exception 1 handles instruction sequences, exception 2 handles instruction sequences through exception n handles instruction sequences. Preferably, the task instruction to be called and executed can be flexibly selected according to the actual scene requirement.

By the configuration mode, the call execution instruction calls and executes another instruction sequence in the instruction sequence process, when in use, the instruction sequence with a certain function can be made into a subsequence, and the subsequence is executed by the call instruction to call and execute the analysis and execution of the instruction.

Preferably, the execution of the instruction is invoked, i.e. the execution of a further sequence of instructions is invoked during the sequence of logically programmed instructions.

According to a preferred embodiment, the further modules comprise at least a pose tracking module 2. Attitude and orbit control module 2 is configured to be able to control/monitor the attitude and orbit of the satellite and at least to be able to send attitude and orbit state data of the satellite to the housekeeping module 1.

Preferably, the attitude and orbit state data mainly includes attitude and orbit state data of the satellite.

According to a preferred embodiment, the other modules further comprise a posture and orbit control stand-alone module 3, a power module 4, a load module 5 and a thermal control module 6. The attitude and orbit control stand-alone module 3 is configured to be capable of sending attitude and orbit stand-alone state data of the attitude and orbit control stand-alone to the star affair management module 1. The power module 4 is configured to be able to provide the satellite management module 1 with power supply and distribution status data of the satellite. The load module is configured to be able to send load status data of the load unit to the house keeping module 1. The thermal control module 6 is configured to be able to send the heater and temperature status data to the housekeeping module 1.

Preferably, the power supply and distribution status data at least comprises the voltage and current of the power management module and the power supply and distribution status data of the power distribution module.

Preferably, the load status data may be the load status of the respective load unit.

Preferably, the operating status data at least comprises attitude and orbit status data, attitude and orbit stand-alone status data, power supply and distribution status data, load status data, heater and temperature status data. Preferably, the working state data can also be added with new data types according to the actual scene requirements.

Preferably, the heater and temperature status data at least comprises the working status of the heater and the temperature data of each temperature collection point.

Preferably, the attitude and orbit control unit module 3 comprises a plurality of attitude and orbit control units.

Preferably, the attitude and orbit control stand-alone module 3 includes but is not limited to: star sensing, flywheel, magnetometer, magnetic torquer, electric thruster, space sensing, gyroscope, GPS, thruster and the like.

Preferably, the power module 4 includes a power management sub-module and a power distribution sub-module.

the housekeeping module 1 loads, analyzes and executes a logic program control instruction sequence, wherein the logic program control instruction sequence at least comprises a logic program control instruction and a task instruction;

the other modules send the working state data of the other modules to the house keeping management module 1;

the housekeeping management module 1 judges the working state data through the logic program control command, and executes the task command based on a judgment result obtained by the logic program control command so as to ensure the safety of the satellite when executing the task command.

By the configuration mode, the task execution condition of the task instruction can be judged in advance through the logic program control instruction in the task instruction sequence execution process: if the housekeeping module 1 judges that the task execution condition of the task instruction is satisfied by loading the analysis condition judgment instruction, the task instruction sequence can be called to execute; and if the housekeeping module 1 judges that the task execution condition of the task instruction is not satisfied by loading the analysis condition judgment instruction, executing the quitting task instruction sequence to realize the safe quitting of the task, thereby realizing the autonomous safety in the execution process of the task instruction sequence through the logic program control instruction.

Preferably, the logic program control instruction sequence can include a plurality of logic program control instructions to judge and/or execute a plurality of task execution conditions in a sequential execution mode. For example, a logic program control instruction realizes that a task instruction performs logic judgment on a task execution condition 1, a task execution condition 2 to a task execution condition n in sequence in a sequential execution manner through the same or different condition judgment instructions so as to judge whether the task execution condition is met. And if and only if the judgment result of the same or different condition judgment instruction on the previous task execution condition is 'true', the same or different condition judgment instruction moves to the next task execution condition to perform logic judgment on the next task execution condition. When the judgment results of all the task execution conditions are 'true', the star management module 1 calls an instruction sequence for executing the task; otherwise, once the judgment result of the logic judgment of any one of the task execution conditions by the same or different condition judgment instructions is false or no, the housekeeping module 1 directly jumps out of the judgment of the task execution conditions to call and execute the exit task instruction sequence.

Preferably, the logic program control instruction sequence can include a plurality of logic program control instructions to judge a plurality of task execution conditions or exception triggering conditions and/or execute exception handling in a parallel loop execution mode. Preferably, the logic program control instruction executed by each parallel loop can be flexibly configured according to actual requirements. By the configuration, the logic program control instruction sequence can include a plurality of logic program control instructions to judge a plurality of task execution conditions or exception triggering conditions and/or execute exception handling in a parallel loop execution manner, so that the exception is handled by using the logic program control instruction to judge the satellite exception triggering conditions in a loop manner, namely calling the execution exception handling instruction sequence when the exception triggering conditions are met.

By the configuration mode, the autonomous security management can be organized into a plurality of small-loop instruction sequences to be executed in parallel, so that delay waiting caused by sequential processing can be avoided. In addition, the logic program control instructions executed by each parallel loop can be flexibly configured according to actual requirements, and are not realized in a fixed program or instruction sequence. For example, the logic program control instruction sequence implements a satellite autonomous security maintenance process, and the logic program control instruction sequence may include a plurality of logic program control instructions, and the logic program control instruction sequence circularly determines whether an exception 1, an exception 2, and an exception n are generated through a condition determination instruction 1, a condition determination instruction 2, and a condition determination instruction n in a parallel circular execution manner: in the process of executing each condition judgment instruction (for example, condition judgment instruction 1/condition judgment instruction 2/condition judgment instruction n) circularly, if and only if the judgment result of the condition judgment instruction is "true", the housekeeping module 1 calls an exception handling instruction sequence corresponding to the exception (for example, exception 1 handling instruction sequence corresponding to exception 1); if the judgment result of the condition judgment instruction is 'no', the loop execution process of the condition judgment instruction corresponding to the abnormity is executed from the beginning again. After the housekeeping module 1 calls and executes the exception handling instruction sequence corresponding to the exception, the housekeeping module 1 needs to determine whether the exception handling instruction sequence corresponding to the exception needs to be prohibited, if it needs to be prohibited (i.e. the determination result is yes), the exception handling instruction sequence corresponding to the exception is respectively ended, otherwise, the cyclic execution process of the condition determining instruction corresponding to the exception is continuously executed again from the beginning.

As another example, FIG. 5 shows a preferred embodiment of a logic programmed sequence of instructions to perform the functions of determining whether the star sense current is over-limit and, if so, turning off the star sense power supply.

Preferably, the exception handling is organized in a small loop by the housekeeping module 1 of the OBC using a sequence of logic programmed instructions. For example, a satellite exception triggering condition is judged by using a logic program control instruction loop, an exception handling instruction sequence is called and executed to handle an exception when the exception triggering condition is met, multiple exception judgments can be carried out in parallel, exception handling is carried out in one small instruction sequence loop, and further fixed program implementation is not needed.

For another example, fig. 6 is a schematic flow chart of another preferred embodiment of the logic program control command sequence provided by the present invention, and the logic program control command sequence takes the processing of the star sensor 1 as an example to process the abnormality such as current overrun and communication fault of the star sensor 1. As shown in fig. 6, the function realized by the logic program control instruction sequence is to circularly determine whether the current of the star sensor 1 exceeds the limit, if so, execute the instruction for powering off the star sensor, and otherwise, skip (execute the instruction for powering off the star sensor); continuously judging whether the continuous communication error count of the star sensor 1 working state exceeds 5, if so, calling a command sequence of' star. This organizes a star sensitive exception handling into a single instruction sequence for loop execution. Because the logic program control instruction is designed and realized in advance and has universality, independent coding is not needed for autonomous safety processing, only the instruction sequence similar to the instruction sequence is organized, and the on-board computer executes according to the instruction data of the instruction code; the instruction sequence can be dynamically adjusted, namely the content of the instruction sequence can be adjusted according to the actual on-track condition, and the on-track updating can be realized by adding the instruction sequence file after the adjustment without modifying software codes; for example, in the instruction sequence for processing the star sensor 1 abnormity, the normal working current of the star sensor 1 is actually found to be more than 200mA on the orbit, the star sensor current overrun value is judged to be adjusted to 300mA, and at the moment, only the parameter of the instruction 2 of the instruction sequence needs to be adjusted.

It should be noted that the above-mentioned embodiments are exemplary, and that those skilled in the art, having benefit of the present disclosure, may devise various arrangements that are within the scope of the present disclosure and that fall within the scope of the invention. It should be understood by those skilled in the art that the present specification and figures are illustrative only and are not limiting upon the claims. The scope of the invention is defined by the claims and their equivalents. The present description contains a plurality of inventive concepts such as "preferably", "according to a preferred embodiment" or "optionally" each indicating that the respective paragraph discloses a separate concept, the applicant reserves the right to apply for divisional applications according to each inventive concept. Throughout this document, the features referred to as "preferably" are only an optional feature and should not be understood as necessarily requiring that such applicant reserves the right to disclaim or delete the associated preferred feature at any time.

Claims

1. A satellite autonomous safety implementation system based on logic program control instructions is characterized by at least comprising:

the housekeeping management module (1) can load, analyze and execute the logic program control instruction sequence;

-a further module configured to send to said housekeeping module (1) the operating status data of said further module;

wherein the logic program control command sequence at least comprises logic program control commands and task commands,

the housekeeping management module (1) is configured to judge the working state data through the logic program control instruction and execute the task instruction based on a judgment result obtained by the logic program control instruction so as to ensure the safety of the satellite when executing the task instruction.

2. The satellite autonomous safety realization system of claim 1, wherein the logic programmed instructions comprise at least conditional judgment instructions, wherein the conditional judgment instructions are at least operable to judge the working state data and output the judgment result.

3. The satellite autonomous security implementation system of claim 2 wherein the logic-programmed instructions further comprise one or more of conditional jump instructions, loop execution instructions, call execution instructions,

the conditional jump instruction can jump to the program control instructions of the number specified by the conditional jump instruction according to the judgment result of the conditional judgment instruction and then continue to execute, the loop execution instruction is used for executing the subsequent program control instructions of the logic program control instruction sequence in a loop mode, and the call execution instruction is used for calling and executing other instruction sequences to be called.

4. The satellite autonomous safety realization system of claim 3, wherein the logic program control command is composed of a command code and a command parameter, the command code is used for uniquely identifying one logic program control command, the command parameter of the condition judgment command comprises a judgment mode word, a judgment data source ID, a judgment data number and a threshold value type,

wherein the content of the first and second substances,

5. The satellite autonomous security implementation system of claim 3, wherein the instruction parameters of the conditional jump instruction include the number of instructions to jump,

wherein, the executing process of the conditional jump instruction is as follows: acquiring the output result of the condition judgment instruction corresponding to the condition jump instruction; if the output result is true, continuing to execute the subsequent program control instruction; if the output result is negative, skipping the program control instructions of the specified instruction number needing skipping in the conditional skipping instruction and then continuing to execute the subsequent program control instructions.

6. The satellite autonomous safety realization system of claim 3, wherein the instruction parameters of the loop execution instruction include a loop condition, a maximum number of loops, and a number of program-controlled instructions executed in a loop, the loop condition being a loop executed according to the number of execution times or a loop executed according to an output result of the condition determination instruction,

wherein, the execution process of the loop execution instruction is as follows: acquiring the circulation condition and the maximum circulation times; judging whether the maximum cycle number or the cycle condition is reached; if the maximum cycle times or the cycle conditions are not met, circularly executing the logic program control instruction sequence until the maximum cycle times or the cycle conditions are met; and if the maximum cycle times or the cycle conditions are met, stopping circularly executing the logic program control instruction sequence.

7. The satellite autonomous security implementation system of claim 3, wherein the instruction parameter of the call execution instruction includes a task instruction name to be called for execution,

wherein, the first and the second end of the pipe are connected with each other,

the execution process of the calling execution instruction comprises the following steps: searching an instruction sequence file to be called and executed according to the called and executed task instruction name; judging whether a sub instruction sequence needing to be called exists or not; if the sub-instruction sequence needing to be called exists, executing the sub-instruction sequence, and continuing to execute the main instruction sequence after the sub-instruction sequence is executed; and if the sub instruction sequence needing to be called does not exist, directly continuing to execute the main instruction sequence.

8. The satellite autonomous safety enforcement system of claim 3, characterized in that the other modules comprise at least an attitude and orbit control module (2),

wherein the attitude and orbit control module (2) is configured to be capable of controlling/monitoring the attitude and orbit of the satellite and at least capable of sending attitude and orbit state data of the satellite to the housekeeping module (1).

9. The satellite autonomous safety realization system according to claim 8, characterized in that the other modules further comprise an attitude and orbit control stand-alone module (3), a power module (4), a load module (5) and a thermal control module (6),

the attitude and orbit single machine control module (3) is configured to send attitude and orbit single machine state data of the attitude and orbit single machine to the satellite affair management module (1), the power supply module (4) is configured to provide power supply and power distribution state data of the satellite to the satellite affair management module (1), the load module (5) is configured to send load state data of the load single machine to the satellite affair management module (1), and the thermal control module (6) is configured to send the heater and temperature state data to the satellite affair management module (1).

10. A satellite autonomous safety implementation method based on logic program control instructions is characterized by comprising the following steps:

the housekeeping module (1) loads, analyzes and executes a logic program control instruction sequence, wherein the logic program control instruction sequence at least comprises a logic program control instruction and a task instruction;

the other modules send the working state data of the other modules to the house keeping management module (1);

the housekeeping management module (1) judges the working state data through the logic program control command and executes the task command based on a judgment result obtained by the logic program control command so as to ensure the safety of the satellite when executing the task command.