JP2009012646A - Control device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To solve a problem in which several hours and few days are required until the attitude and track of a space air vehicle are reset in a stable state since control data used in a main system are taken over to a sub-system when switching to the sub-system although it is switched to a control unit of the sub-system when failure or the like is generated in a control unit of the main system in the space air vehicle of stand-by redundancy system. <P>SOLUTION: In the control device, a flash type memory 18 is mounted, for example, on the control unit 11 of the sub-system, and the control data or the like memorized in the memory possessed by the control unit 1 of the main system are output at an arbitrary timing and are stored in the memory of the sub-system. At switching from the main system to the sub-system, after the power source of the control unit of the main system is turned OFF, the attitude and the track are controlled based on the control data written in the memory of the sub-system. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a control device mounted on a space vehicle that performs services such as broadcasting and communication.

  For example, an artificial satellite or the like that is a space flying body needs to always specify its own attitude and orbit and maintain a predetermined attitude in order to control its own attitude (see, for example, Non-Patent Document 1). For this purpose, the latest data acquired from the sensor, for example, its own posture and trajectory are obtained from the position, angle, and angular velocity, and control information for controlling the actuator is calculated based on the obtained posture information and trajectory information, and the actuator is controlled. A control device called a satellite controller is provided.

  The satellite controller is usually configured to have a master / slave redundant system so that even if one failure occurs, the operation of the satellite is not hindered. The redundant system configuration is roughly classified into a standby redundancy type and an operation redundancy type. Of these, the standby redundancy type is a system in which the main system is normally operating, and when the system needs to be switched for some reason, the secondary system is turned on to operate the secondary system.

  In the conventional standby redundancy type satellite controller, when an abnormality occurs in the main system, the follow-up system is started, and thereafter, parameters necessary for control, for example, correction data for correcting data output from the sensor, etc. Uploaded from the ground.

Masamichi Mobara, “Introduction to Space Systems,” Baifukan, October 30, 1995, p. 210

  The standby redundancy type has the advantage that the life of the system as a whole is maintained, but as described above, when switching to the secondary system, the control parameters held by the computer installed in the primary system, etc. This information was not transferred to the subordinate computer after the system switchover. For this reason, it is necessary to upload control parameters from the ground again after switching the system, and it takes several hours to several days for the satellite to return to a stable state. There was a problem that.

  The present invention has been made to solve such a problem. A flash memory such as an EEPROM (Electrically Erasable Programmable Read Only Memory) is mounted on a satellite controller on-board computer, and the main system RAM (Random Access Memory) area is installed. The control parameters stored in part are stored in the slave flash memory, and the slave satellite controller interrupts services such as communication and broadcasting by using the master control parameters when the system is switched. It aims to provide without.

The control device according to the present invention includes:
A control device that controls the attitude and trajectory of a space vehicle and includes a master controller having a master memory and a slave controller having a slave memory;
A main controller that outputs the control data of the space vehicle stored in the main memory at an arbitrary timing;
When the control data received from the master controller is written to the slave memory and the operation is switched from the master controller to the slave controller, the power of the master controller is turned off. Then, the slave controller for controlling the attitude and trajectory based on the control data written in the slave memory,
It is characterized by providing.

  In this way, the secondary system can use data such as control parameters received from the primary system immediately after the startup of the secondary system, and can start the attitude control of the space vehicle, for example, the satellite itself, Artificial satellites can continue to be in a stable state, and commercial satellites can provide services such as communication and broadcasting by switching between the primary satellite controller and the secondary satellite controller with almost no interruption. .

Embodiment 1 FIG.
FIG. 1 shows a hardware configuration diagram of the satellite controller according to the first embodiment of the present invention, and shows a state where the primary satellite controller 1 is on and the secondary satellite controller 11 is off. Yes. In FIG. 1, a main satellite controller 1 includes a main CPU (Central Processing Unit) 2 for processing a program, and a main ROM (Read Only Memory) for storing various control programs. 3, a main RAM (Random Access Memory) 4 for storing control parameters and used as a work area for a program, and a main data input / output interface for data input from a sensor and data output to an actuator 5

  The master satellite controller 1 has a master write interface 6 in order to read data such as control parameters from the main RAM 4 and output the data to the slave.

  The slave satellite controller 11 has the same configuration as that of the master system, and includes a slave CPU 12 for processing programs, a slave ROM 13 for storing various control programs, and a work area for storing control parameters and programs. And a secondary data input / output interface 15 for data input from the sensor and data output to the actuator.

  In addition, a slave reception interface 17 that receives data output from the master write interface 6, a slave flash memory 18 that writes and stores data received from the master, and a slave A slave bus interface 19 is provided for expanding data written in the flash memory 18 to the slave RAM 14.

  For example, the main satellite controller 1 operates as follows. The actual attitude and orbit information is temporarily stored in the main RAM 4 via the main data input / output interface 5 through the latest data acquired from a sensor (not shown) of the artificial satellite. The main CPU 2 reads a program stored in the main ROM 3 and data from the sensors stored in the main RAM 4 and calculates its posture and trajectory using the program. The main CPU 2 calculates correction data related to the attitude and orbit of the artificial satellite itself based on the attitude and orbit.

  The calculation result is stored in the main RAM 4. Thereafter, the correction data stored in the main system RAM 4 is output to an actuator (not shown) via the main system data input / output interface 5, and the attitude and orbit of the artificial satellite itself using the actuator. The position is corrected.

  In the main satellite controller 1 configured as described above, control parameters stored in the main RAM 4 and data such as the current attitude and orbit information as the calculation results are sent to the main CPU 2. Can be written into the subordinate flash memory 18.

  For example, when receiving a command or the like from the ground, the main CPU 2 first supplies power 31 from the main satellite controller 1 to the power supply region 20 of the subordinate flash memory. The power supply area 20 of the slave flash memory may be operated independently of the power supply areas of other components in the slave satellite controller 11.

  The slave flash memory 18 that is supplied with the power 31 is ready to read and write data output from the master. Next, the main CPU 2 transfers data 32 such as control parameters from the main RAM 4 to the main writing interface 6.

  The main writing interface 6 performs a data format capable of outputting the data 32, for example, parallel / serial conversion, and outputs the writing data 33. The secondary reception interface 17 receives the write data 33 output from the primary satellite controller 1. Here, the slave reception interface 17 has, for example, a serial / parallel conversion function, a driver receiver function, a memory read / write function, and the like.

  After the output of the write data 33 from the master write interface 6 is completed, the read data 34 is read from the slave flash memory 18 in order to confirm that the data is correctly written to the slave flash memory 18. Reading, the main CPU 2 executes a check.

  If it can be confirmed that the data is correctly written in the secondary flash memory 18, the supply of power 31 from the primary satellite controller 1 is stopped, the power supply area 20 of the secondary flash memory is turned off, and the process is terminated. To do. If the data is incorrect, write again.

  When detecting any abnormality, the master CPU 2 outputs a slave ON signal 51 for starting the slave from the master satellite controller 1. In addition, the slave satellite controller 11 outputs a master off signal 52 for turning off the master satellite controller 1 after the slave is started.

  Here, as an example of the abnormality detected by the main CPU 2, when a limit is set in the data output from the sensor, and an abnormality is detected by outputting a value greater than the limit from the sensor, There may be a case where an abnormality in the output signal is detected due to a failure of a device in the main satellite controller 1.

  FIG. 2 shows a hardware configuration diagram of the satellite controller according to Embodiment 1 of the present invention, and shows a state in which the primary satellite controller 1 is off and the secondary satellite controller 11 is on. It is. The slave satellite controller 11 reads the data 35 such as control parameters from the slave flash memory 18 after the power supply of the master satellite controller 1 is turned off, and the slave controller 11 via the slave bus interface 19. The data 35 is developed in the system RAM 14 and the attitude control of the satellite is started.

  In this way, the secondary system can use the control parameters received from the primary system immediately after the startup of the secondary system to start controlling the attitude of the satellite itself, so that the artificial satellite is in a stable state. Can continue. Therefore, for example, in a commercial satellite, it is possible to provide services such as communication and broadcasting by switching between the primary satellite controller and the slave satellite controller with almost no interruption.

  A flash memory is installed on the main system side, and control parameters and other data are written in advance. When the main system fails, the sub system is started up. The sub system reads the data in the main flash memory and starts up the main system. A method of lowering is also possible. However, in the above technique, data in the main flash memory cannot be read in the event of a failure in which the main system falls before the slave, such as when the main power supply fails.

  On the other hand, in the present invention, since the flash memory is mounted in the slave system, even if the above failure occurs, data is written in the slave flash memory 18 in advance, so that the master system is ahead of the slave system. Even if a failure such as falling down occurs, data such as control parameters can be read out.

  In the above description, in switching from the primary satellite controller 1 to the secondary satellite controller 11, the secondary on signal 51 is sent from the primary satellite controller 1, and the primary system off from the secondary satellite controller 11. The signal 52 is output, but the on / off state of the main satellite controller 1 and the subordinate satellite controller 11 may be controlled by a command from the ground.

  In the above description, when the main CPU 2 receives a command or the like from the ground, the power 31 is supplied to the power supply region 20 of the secondary flash memory. The power 31 may be supplied to the power supply region 20 of the slave flash memory at regular intervals, and data such as control parameters may be written.

  In the above description, the flash memory is used to store the control parameters of the main system in the sub system, but a RAM may be used.

  In the case of a flash memory, the power 31 is supplied from the main system as described above, and on / off control is performed on the power supply region 20 of the secondary flash memory. However, when a RAM is used instead of the flash memory, it is necessary to always turn on the power supply area in which the RAM is mounted. For example, power may be supplied from a slave system.

Embodiment 2. FIG.
FIG. 3 shows a hardware configuration diagram of the satellite controller according to the second embodiment of the present invention, and shows a state in which the main satellite controller 1 is off and the subordinate satellite controller 11 is on. Yes. The description of the same configuration and operation as in the first embodiment is omitted.

  In addition to the configuration of the first embodiment, the slave satellite controller 11 according to the second embodiment reads a data such as a control parameter from the slave RAM 14 and outputs the data to the master system. 16

  In addition to the configuration of the first embodiment, the main satellite controller 1 according to the second embodiment includes a main reception interface 7 that receives data output from the secondary write interface 16, and a slave reception controller 7. A main flash memory 8 for writing and storing data received from the main system and a main bus interface 9 for developing the data written in the main flash memory 8 in the main RAM 4 are provided.

  Next, the operation of the second embodiment will be described. Consider a case where the main system is not faulty and the main system is switched to the subordinate system, for example, when an incorrect command is received. In this case, according to the operation described in the first embodiment, the slave satellite controller 11 develops control parameters and the like from the slave flash memory 18 to the slave RAM 14. In the operation of artificial satellites, switching from the primary system to the secondary system due to human error is not considered a failure. Therefore, normally, the processing is quickly returned to the main system, and the processing is performed again in the main system.

  Therefore, in order to return the control parameters and the like stored in the secondary RAM 14 to the primary satellite controller 1, an instruction is given to the secondary CPU 12 so as to be written into the primary flash memory 8. For example, when the secondary CPU 12 receives a command from the ground, it turns on the power of the primary satellite controller 1. In this case, the main system on signal 53 may be output from the subordinate satellite controller 11, or the main satellite controller 1 may be turned on by a command from the ground.

  When the master satellite controller 1 is turned on, the master flash memory 8 is ready to read and write data output from the slave. Next, the slave CPU 12 transfers data 41 such as control parameters from the slave RAM 14 to the slave write interface 16.

  The secondary write interface 16 performs a data format capable of outputting the data 41, for example, parallel / serial conversion, and outputs the write data 42. The master reception interface 7 receives the write data 42 output from the slave satellite controller 11. Here, the main reception interface 7 has, for example, a serial / parallel conversion function, a driver receiver function, a memory read / write function, and the like.

  After the output of the write data 42 from the secondary write interface 16 is completed, the read data 43 is read from the primary flash memory 8 in order to confirm that the data is correctly written to the primary flash memory 8. Reading and the slave CPU 12 execute the check.

  If it can be confirmed that data is correctly written in the main flash memory 8, the processing is terminated. If the data is incorrect, write again.

  Thereafter, when the slave satellite controller 11 receives a command to turn off the slave from the ground, it turns off the slave. Alternatively, the main satellite controller 1 may output the sub system off signal 54 to the sub system to turn the sub system off.

  FIG. 4 shows a hardware configuration diagram of the satellite controller according to Embodiment 2 of the present invention, and shows a state in which the primary satellite controller 1 is on and the secondary satellite controller 11 is off. It is. After the power of the slave satellite controller 11 is turned off, the master satellite controller 1 reads out data 44 such as control parameters from the master flash memory 8, and transmits the master parameter via the master bus interface 9. The system is expanded in the system RAM 4 and the attitude control of the satellite is started.

  In this way, when the main system is not faulty and the main system is switched to the subordinate system, for example, when an incorrect command is received, the process is switched back to the main system to switch from the subordinate system to the main system. Can also take over the data.

1 is a hardware configuration diagram of a satellite controller according to Embodiment 1 of the present invention, and shows a state in which a main satellite controller 1 is on and a subordinate satellite controller 11 is off. FIG. 1 is a hardware configuration diagram of a satellite controller according to Embodiment 1 of the present invention, and is a diagram showing a state in which a primary satellite controller 1 is off and a secondary satellite controller 11 is on. FIG. FIG. 5 is a hardware configuration diagram of a satellite controller according to Embodiment 2 of the present invention, and shows a state in which a primary satellite controller 1 is off and a secondary satellite controller 11 is on. FIG. 5 is a hardware configuration diagram of a satellite controller according to Embodiment 2 of the present invention, and is a diagram showing a state in which a main satellite controller 1 is on and a subordinate satellite controller 11 is off.

Explanation of symbols

1. 1. Main system satellite controller Main CPU
3. Main ROM
4). Main system RAM
5). 5. Data input / output interface for main system 6. Main writing interface 7. Receiving interface for main system 8. Main flash memory Main bus interface 11. Slave satellite controller 12. Subordinate CPU
13. Subordinate ROM
14 Subordinate RAM
15. 15. Secondary data input / output interface 18. Secondary writing interface Subordinate reception interface 18. Secondary flash memory 19. Subordinate bus interface 20. Power supply area of slave flash memory 31. Electric power 32. Data 33. Write data 34. Read data 35. Data 41. Data 42. Write data 43. Read data 44. Data 51. Subordinate on signal 52. Main system off signal 53. Main system on signal 54. Subordinate off signal

Claims (4)

In a control device that controls the attitude and trajectory of a space vehicle, and includes a master controller having a master memory and a slave controller having a slave memory,
A main controller that outputs the control data of the space vehicle stored in the main memory at an arbitrary timing;
When the control data received from the master controller is written to the slave memory and the operation is switched from the master controller to the slave controller, the power of the master controller is turned off. Then, the slave controller for controlling the attitude and trajectory based on the control data written in the slave memory,
A control device comprising:   The slave controller turns on the slave memory only when the control data output from the master controller is written to the slave memory, and the control data is 2. The control device according to claim 1, wherein the control device turns off the power of the slave memory after confirming that the data has been correctly written to the slave memory.   3. The control apparatus according to claim 1, wherein the main controller has a counter and outputs control data stored in the main memory at regular intervals. The main controller has a main memory different from the main memory,
When switching the operation from the slave controller to the master controller, turn on the power of the master controller, the slave controller outputs the control data for the space vehicle, Write the control data to the different master memory, turn off the slave controller, and control the master controller based on the control data written to the different master memory 4. The control device according to claim 1, wherein the control device controls a posture and a trajectory.

Images