JP2002024049A - Computer for controlling space machine - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a computer for controlling space machine capable of continuing functions by restart of an operating system for a temporary functional disorder of the operating system in a state that a standby system is operated at a permanent failed state. SOLUTION: Two watchdog timers A12 and 22 and watchdog timers B13 and 23 having mutually different timeout are provided in a main system computer 1 and a redundant system computer 2. A switching request pulse of systems is generated by the first watchdog timers A12 and 22 a fact that no system is switched is detected by the second watchdog timers B13 and 23 and computers 11 and 12 of the present operating system are simultaneously restarted.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a spacecraft control computer, and more particularly to a switching control circuit for a spacecraft control computer having a cold standby standby redundant system when a single system error occurs.

[0002]

2. Description of the Related Art Conventionally, this kind of spacecraft control computer is mounted on a spacecraft and has a standby redundancy system of cold standby. In this spacecraft control computer, either the main system or the redundant system must be operating. Therefore, if a problem occurs in the active computer, the standby computer is automatically stopped before the standby computer is stopped. It has a function to start the computer on the system side.

[0003] However, if a permanent failure occurs in one of the systems, it is required to operate only in a normal system, because it is dangerous to operate in the system in which the failure has occurred.
For this reason, it is required to be controlled so that automatic switching does not occur.

To meet this demand, for example, Japanese Patent Laid-Open
In the technique disclosed in Japanese Patent Application Laid-Open No. 2-123842, it is proposed to prevent switching to a system in failure. In the technology described in this publication, information on a system in which a failure has occurred is stored in a memory, and when a switching request is received from an operating system, the standby redundant system refers to the contents of the memory at startup and then starts up. The system where a permanent failure has occurred is not started.

[0005]

In the above-described conventional switching control of the spacecraft control computer to the standby redundant system, when the standby system is permanently out of order, the operating system temporarily loses its function and switches. Even if a request is issued, switching to the standby system is not performed, so that the function of the entire system is lost. However, when the loss of function of the entire system is not allowed as in a spacecraft, there is a problem that such a state is not allowed.

In a space environment, the contents of software and the contents of temporary data such as registers are rewritten by bit inversion due to high-energy particles existing in orbit, causing a computer to run out of control and cause a system failure. However, the possibility of temporary loss of function cannot be ruled out.

[0007] In this case, it is possible to recover by restarting the entire operation system computer. However, in the above system, the system is stagnated in a state where a switching request signal from the operation system to the standby system is generated. There is also a problem that it cannot be restarted automatically without an external operation.

Accordingly, an object of the present invention is to solve the above-mentioned problems, and to provide a function by restarting the active system in response to a temporary functional failure of the active system when the standby system is operated in a permanent failure state. To provide a spacecraft control computer capable of continuing the above.

[0009]

SUMMARY OF THE INVENTION A spacecraft control computer according to the present invention is a spacecraft control computer comprising an active system and a cold standby standby redundant system. A dog timer is provided to switch the system by the timeout of the first timeout period, and to detect that the switching of the system is not performed by the timeout of the second timeout period.

That is, the spacecraft control computer of the present invention is characterized in that two watchdog timers operating with different timeout periods are provided in each of the computers on the main system side and the redundant system side.

The software operating on the active computer resets the two watchdog timers at the same time only when it is possible to periodically self-check the operating state of the own computer and determine that there is no problem in the operation. When a timeout occurs, the first watchdog timer outputs a switching request signal to the redundant system, and the second watchdog timer has a longer timeout period than the first watchdog timer. When a timeout occurs, a signal for restarting the computer of the own system is generated.

In the computer for controlling a spacecraft according to the present invention, the second request that the switching request signal generated by the time out of the first watchdog timer is not accepted due to a permanent failure of the standby redundant system or the like is accepted. Detected by the watchdog timer, it is possible to restart its own computer.

Therefore, even if the computer in the active system temporarily loses its function when the computer in the standby redundant system is permanently activated and its startup is suppressed, the function is restarted by the computer in the active system. And operation can be continued.

That is, in an operation mode in which the standby system is in a permanent failure state and cannot respond to the switching request, even if the operation system falls into a temporary loss of function peculiar to the spacecraft, the standby system is automatically set. It is possible to return the function by detecting that is not activated and restarting the active system.

[0015]

Next, an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing a configuration of a spacecraft control computer according to one embodiment of the present invention.
In FIG. 1, a spacecraft control computer according to an embodiment of the present invention includes a main computer 1 and a redundant computer 2.

The main computer 1 includes a computer 11, a watchdog timer A12, a watchdog timer B13,
Flip-flops (hereinafter referred to as F / F) 14, 16
, An OR gate 15, an AND gate 17, and a fall detection one-shot pulse generation circuit (OSG) 18. Here, the timeout time of the watchdog timer B13 is set longer than the timeout time of the watchdog timer A12.

Similarly, the redundant computer 2 is
, A watchdog timer A22, a watchdog timer B23, F / Fs 24 and 26, and an OR gate 25
, An AND gate 27, and a falling detection one-shot pulse generation circuit 28.

The pulse signals output when the watchdog timers A 12 and 22 of the main computer 1 and the redundant computer 2 time out are switched request signals 102 and 202, and the activation permission signals 204 and 204 of the redundant computer 2 and the main computer 1 are transmitted.
After the AND operation is performed by the AND gates 27 and 17, the signals are connected to the reset signals of the F / Fs 26 and 16.

The output signals of the F / Fs 26 and 16 are the stop signals 205 and 105 of the redundant computer 2 and the main computer 1, respectively.
The OR operation is performed by OR gates 25 and 15 with restart pulses 203 and 103, which are timeout signals of watchdog timers B23 and B13, and connected as reset signals 206 and 106 of computers 21 and 11, respectively.

Further, a falling detection one-shot circuit 2
Numerals 8 and 18 are connected as set inputs of the F / Fs 16 and 26 of the main computer 1 and the redundant computer 2 as stop release pulses 207 and 107, respectively, as a result of detecting the fall of the stop signals 205 and 105.

On the other hand, the switching request signals 102 and 202 are connected to reset inputs of the F / Fs 15 and 25 of the main computer 1 and the redundant computer 2. The initial value of F / F15, 25 is H
It is set to the (high level) side and does not affect the start permission signals 104 and 204 in the initial state, but once a failure occurs, the start permission signals 104 and 204 of the main computer 1 and the redundant computer 2 are changed. Reset.

Therefore, when a failure occurs in the main computer 1 and the redundant computer 2, the stop release pulses 207 and 107 from other systems are ignored by the AND gates 17 and 27 due to the effect of this signal. And can be controlled not to restart.

FIG. 2 is a timing chart showing the operation when the redundant computer 2 of FIG. 1 is normal. The operation in a state where both the main computer 1 and the redundant computer 2 of FIG. 1 can operate normally will be described with reference to FIGS.

In the normal state, the main computer 1 is operated, and in this state, control of the spacecraft (not shown) is performed. In this state, the stop signal 205 of the redundant computer 2 is set, and the computer 21 stops operating because the reset signal 206 is continuously input.

The main computer 1 periodically monitors the internal operation state, and if there is no problem, generates a clear signal 101 to clear the watchdog timer A12 and the watchdog timer B13. Therefore, the watchdog timer A12 and the watchdog timer B13
Does not occur for the switching request pulse 102 and the restart pulse 103 which are the time-out signals.

If a failure occurs in the computer 11 in this state, the clearing operation of the timer, which is the result of the periodic operation monitoring, stops. In that case, first, watchdog timer A
Twelve timeouts occur, and the switch request pulse 102 is input to the redundant computer 2. At the same time, F / F14
Is reset, and the activation permission signal 104 is set to the L (low level) side (inhibited).

Since the initial value of the activation permission signal 204 of the redundant computer 2 is on the H side (permission side), the switching request pulse 10
2 is directly input to the reset input of the F / F 26.
As a result, the F / F 26 of the redundant computer 2 is reset, the stop signal 205 is released, and the reset signal 206 input to the computer 21 is also released at the same time.

Accordingly, the computer 21 is started, and the redundant computer 2 starts operating. The release of the stop signal 205 is detected by the falling detection one-shot pulse generation circuit 28, and the stop release pulse 207 is input to the main computer 1.

The stop release pulse 207 is transmitted to F
/ F16, the stop signal 105 of the main computer 1 is set. Therefore, Calculator 1
Since the reset signal 106 input to 1 is set,
The operation of the computer 11 stops, and the switching between the main computer 1 and the redundant computer 2 is performed.

After that, the watchdog timer B13
Occurs, and the restart pulse 103 is generated. However, this effect does not appear because the stop signal 105, which is the OR operation performed by the OR gate 15, is set.

FIG. 3 is a timing chart showing the operation when the redundant computer 1 of FIG. 1 has a permanent failure. The operation in the case where the redundant computer 1 has a permanent failure will be described with reference to FIGS.

After a failure occurs in the main computer 1,
Since the activation permission signal 204 of the F / F 14 is set to the L side (prohibited), the switching request pulse 202 is ignored. The operation in the case where a temporary loss of function occurs in the operating computer 21 in this state will be described below.

In this state, since the clear signal 201 is interrupted as a result of monitoring the operation state of the computer 21, the watchdog timer A22 first times out. For this reason, the switching request pulse 202 is generated and input to the redundant computer 2, but the F / F 16 does not operate because the activation permission signal 104 of the redundant computer 1 is set to the L side (prohibited). , The stop signal 105 is not released. Therefore, the redundant computer 1 does not operate, and the stop release pulse 107 is not generated.

Thereafter, the watchdog timer B23 times out with a delay. Thereby, the restart pulse 2
03 occurs. In this case, since the stop signal 205 is not set, the reset signal 206
Will be entered as Therefore, the computer 21
Can restart and recover from a temporary loss of function.

In the embodiment of the present invention, the same effect as described above can be obtained even when a single watchdog timer having two types of timeouts is used instead of having two watchdog timers in one computer. Is possible.

As described above, in the spacecraft control computer having the main computer 1 and the cold standby redundant computer 2, the two watchdog timers A12 and 22 and the watchdog timer B1 having different timeout periods are used.
With the provision of 3 and 23, even when the redundant computer 2 is operated in a permanent failure state, the function is continued by restarting the main computer 1 in response to a temporary functional failure of the main computer 1. be able to.

The present invention is not limited to the above embodiment,
It is clear that the above embodiments can be modified as appropriate within the scope of the technical idea of the present invention.

[0038]

As described above, according to the present invention, there is provided a spacecraft control computer including an active system and a cold standby standby redundant system, wherein a watchdog timer in which two types of timeout times are set. By switching the system by the timeout of the first timeout period, and detecting that the system was not switched by the timeout of the second timeout period,
In a state where the standby system is operated in a permanent failure state, there is an effect that the function can be continued by restarting the active system for a temporary functional failure of the active system.

[Brief description of the drawings]

FIG. 1 is a block diagram showing a configuration of a spacecraft control computer according to an embodiment of the present invention.

FIG. 2 is a timing chart showing an operation when the redundant computer in FIG. 1 is normal.

FIG. 3 is a timing chart showing an operation when the redundant computer of FIG. 1 has a permanent failure;

[Explanation of symbols]

 1 Primary computer 2 Redundant computer 11,21 Computer 12,22 Watchdog timer A 13,23 Watchdog timer B 14,16,24,26 Flip-flop 15,25 OR gate 17,27 AND gate 18,28 Falling Detection one-shot pulse generation circuit

Claims (3)

[Claims] 1. A spacecraft control computer comprising an active system and a standby redundant system for cold standby, comprising: a watchdog timer in which two types of timeout times are set; A computer for spacecraft control, characterized in that the system switching is performed by the system and that the system switching is not performed is detected by the timeout of the second timeout period. 2. The spacecraft control computer according to claim 1, wherein in response to the timeout of the second timeout period, the function of the computer on which the function loss has occurred is restored by restarting. . 3. The spacecraft control computer according to claim 1, wherein the two types of timeout periods are set to different watchdog timers.