JP2009220767A - Satellite-mounted control system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a satellite-mounted control system forming a double redundant system, which maintains the quality of service when switching from a main system satellite-mounted unit to a slave system satellite-mounted unit. <P>SOLUTION: Commands relating to the setting of a configuration or the like of an unit are transmitted in a command format by erecting identifiable flags in the commands. A ground device or satellite-mounted data processing device executes these commands with respect to the main-system unit of the units forming a redundant constitution and, at the same time, temporarily stores these commands in a memory in the data processing device with respect to a slave system in an OFF state. Furthermore, a memory area is available to each unit mounted on a satellite. A data processing part monitors a switching state of each unit. When the occurrence of switching is determined, a command stored in the memory in the data processing device is read and transmitted to a unit newly becoming a main system, and the setting is performed. <P>COPYRIGHT: (C)2010,JPO&INPIT

Description

  The present invention relates to a satellite-mounted control system configured with a redundant system for controlling a satellite. More specifically, the present invention relates to a satellite-mounted control system that switches redundant systems of devices mounted on the satellite.

Various settings are made for each device mounted on the satellite by a command signal transmitted from the ground station to the satellite. On the other hand, the collected information and various setting information collected by the satellite-equipped device are transmitted from the satellite to the ground station by a telemetry signal.
As shown in FIG. 6, a command transmitted from the ground station to the satellite, that is, CLTU (Command Link Transfer Unit) reaches the satellite as a radio wave modulated by the modulator of the ground station, and is transmitted by the satellite demodulator. Demodulated to signal level CLTU. The data processor mounted on the satellite confirms the validity of the CLTU, reconverts it into packet data, and sends it to each device in the satellite. Telemetry generated by each device in the satellite is collected by a data processor installed on the satellite, converted into a PCA PDU (Physical Channel Access Data Unit), and passed through the data processor of the ground station through the modulator / demodulator. It is sent to each device (each user) of the ground station.

  In general, since an artificial satellite is required to have high reliability, it has a redundant configuration configured by combining two or more of the same devices. One system is mainly used (hereinafter referred to as the main system), the other systems are positioned as backups, and the function is disabled when the main system is used. Used when an abnormality occurs and it becomes unusable (hereinafter referred to as a subordinate).

The redundancy configuration is roughly classified into two types: standby redundancy and operation redundancy.
In the operation redundant configuration, processing is performed simultaneously in both the primary system and the secondary system. However, in satellite broadcasting and satellite communication artificial satellites that require a lifetime of 15 years or more, there is a high possibility of operation redundancy that is likely to cause deterioration of parts due to constant energization and deterioration of reliability due to deterioration of parts. The configuration is difficult to adopt.

On the other hand, in the standby redundancy configuration, all functions are valid in the main system, but all functions or specific functions are invalid in the slave system by turning off the power of the device. For this reason, the setting by the command transmitted from the ground station to the satellite is executed in the main system, but the setting is not executed because the function is disabled in the sub system.
For this reason, when a failure occurs in the main device, it is necessary to transfer the setting information set in the main system from the main system to the subordinate system (see, for example, Non-Patent Document 1).

Masamichi Mobara “Introduction to Space Systems” Baifukan (1995)

However, in system switching, in order to prevent erroneous control, it is common to adopt a configuration in which the sub system cuts off the main system power supply during system switching. For example, regarding imaging conditions of imaging equipment mounted on satellites, information on these conditions will be lost if the main system is powered off during system switching.
Therefore, after starting up (after startup) for the slave device, a command is sent from the ground station by manual operation, and the setting conditions etc. are reset for the slave device via the satellite-mounted data processing device. There was a need to do.

  For this reason, there has been a problem that it takes a considerable time to switch the system from the main system to the slave system, and the system must be switched manually. In addition, during the system switching, there is a problem that the quality of service depending on the mission function of the satellite such as broadcasting and communication on the satellite is deteriorated, and in the worst case, the service is interrupted.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to maintain the quality of service without interrupting the service at the time of switching from a primary satellite-equipped device to a slave satellite-equipped device. .

  The satellite-mounted control system according to the present invention is mounted on a satellite and switches the system from the master device to the slave device when an abnormality is detected in the master and slave devices and the master device. A satellite-borne control system comprising two redundant systems, wherein the processing computer receives a command transmitted from the ground to the satellite and processes the command And a memory for storing the command and a detection unit for receiving information on abnormality detection from the main device, wherein the command processing unit determines whether or not the command is a command to be stored in the memory. If the command is not a command to be saved in the memory as a result of discrimination, the command is distributed to the main device, and if the command is to be saved in the memory as a result of the discrimination, the command is determined. The command is stored in the memory and the command is distributed to the master device, and the command processing unit retrieves the command from the memory upon receiving the abnormality detection information from the master device. To other devices.

  According to the present invention, it becomes easy to acquire the setting information of the device in the slave system when shifting from the master system to the slave system, and even if the system must be shifted due to a failure of the master system, satellite communication or It can prevent interruption of service such as satellite broadcasting and deterioration of quality.

Embodiment 1 FIG.
Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram showing a configuration of a data processing device DHU (Data Handling Unit) of the control system in the present embodiment.
In FIG. 1, the data processing device DHU 100 includes a saved command determining unit 101, a command saving processing unit 102, a command saving memory 103, each device switching presence / absence detecting unit 104, and a command output control unit 105. When receiving a command from the ground, the saved command determining unit 101 determines whether to save the command in the memory. The saved command determination unit and the command save processing unit are examples of the command processing unit.

  FIG. 2 is an example of a command format 300 of a command transmitted from the ground station. In the command format 300, a user command message 320 is a source command required by a device on the satellite. In addition to the user command message 320, an overhead of a primary header (PH) 310 is added, and a BCH check bit (not shown) is added to the satellite from the ground station.

  The user command message 320 includes a device designation command 321, a storage necessity bit 322, and a device command 323. The device designation command 321 is used to designate a partner to which a command is transmitted from among a plurality of devices mounted on the satellite, and is designated by a bit string. The storage necessity bit 322 is information for identifying whether or not the subsequent device command 323 is to be stored in the command storage memory 103. For example, when the save necessity bit 322 is “1”, it indicates that the device command 323 following the save necessity bit is to be saved. On the other hand, when the storage necessity bit 322 is “0”, the subsequent device command 323 indicates that it is not necessary to store in the memory. The device command 323 indicates the instruction content for the designated device.

The storage necessity bit 322 is given by the command creator of the ground station. As described above, when the primary device is switched from the primary device to the secondary device due to a failure, etc., the setting information that was set on the primary device because the main system power is generally turned off. Will be lost. For this reason, the command creator of the ground station distinguishes in advance the command to be saved in the memory and the command that does not need to be saved at the time of command creation, and the command to be saved in the command format save necessity bit 322 for the command to be saved. An identification code (“1” in this embodiment) is assigned.
For example, if the target device is an imaging device, the command to be stored is the posture angle, the correction parameter for correcting the error of the posture angle, the imaging timing, and the data output from the imaging device. Examples include correction data and imaging conditions.
Note that the identification code may be assigned to the storage necessity bit 322 by the command creator based on his / her own judgment, or automatically determined by the apparatus according to the type of the device command. You may make it give.

Next, the operation of the satellite mounting control system of the present embodiment will be described with reference to the drawings. FIG. 3 is a flowchart of data processing executed by the data processing apparatus 100.
When the storage command determination unit 101 of the data processing apparatus 100 receives a command from the ground station (step S01 in FIG. 3), the storage command determination unit 101 extracts a storage necessity bit of the user command message 320 (S02).
When the identification flag is set in the storage necessity bit (when the storage necessity bit is “1”, S03), the storage command determination unit 101 extracts the device designation command from the user command message 320 and specifies it. The device is determined (S04). The save command determination unit 101 outputs the device designation command 321 and the device command 323 to the command save processing unit 102. Upon receiving the device designation command 321 and the device command 323 from the saved command determination unit 101, the command storage processing unit 102 accesses the memory area that is classified for the device in the command storage memory 103 and is designated by the device designation command 321. The device command 323 is saved in the device memory area (S05). Next, the save command determination unit 101 outputs the device command 323 by directing the device command 323 to the device designated by the device designation command 321.
On the other hand, when the identification flag is not set in the saving necessity bit (when the saving necessity bit is not “1”, S03), the saving command determination unit 101 uses the device command 323 extracted from the user command message as the device command. A device command 323 is output to the device specified by the specified command 321.

  In this way, in each device memory of the command storage memory 103, a command to be stored with a command created by the command creator corresponding to each device is stored. When there are commands of the same type when viewed in time series, the previous command is overwritten by the command saved later so that the latest command is saved.

Next, a switching operation for switching from the primary device to the secondary device will be described. FIG. 4 is a flowchart of data processing executed by the data processing apparatus 100 at the time of switching.
In FIG. 4, when the switching presence / absence detecting unit 104 in the data processing apparatus receives an abnormal signal (OFF information) from the main system device (step S11 in FIG. 4), the switching information for switching the system is sent to the command output control unit. To 105. The command output control unit 105 turns on the power of the slave device corresponding to the master device that has received the OFF signal, and puts it into an operating state.
Next, the command output control unit 105 extracts a stored command from the memory area corresponding to the device in which an abnormality has occurred in the command storage memory 103 (S13).
The command output control unit 105 outputs the command extracted from the memory area to the slave device (S14).

  The slave device performs various settings based on the command extracted from the memory area. In this way, the system is switched from the master device to the slave device.

  As described above, in the present embodiment, a data field indicating whether or not it is necessary to save a command is provided in the command format received by the satellite from the ground station. The satellite data processing apparatus 100 stores the command in the corresponding memory area of the command storage memory 103 when an identification flag indicating the necessity of storage is set in the data column of the received command. When the device used is switched from the master device to the slave device due to the occurrence of an abnormality in the master device, the data processing device retrieves the command stored in the memory area and transfers the command to the slave device. Delivered.

  As a result, at the time of switching the system from the master system to the slave system, information on the master device such as the imaging conditions is lost if it is an imaging device. Since there is no choice but to reset, the problem that the quality of service during that time is reduced is eliminated, and the quality of service can be maintained even during system switching.

Embodiment 2. FIG.
In the first embodiment, the embodiment for the satellite-mounted device such as the imaging device used by each user of the ground station has been described. However, in the second embodiment, the satellite attitude control device is the target, and the system An embodiment in which continuous attitude control is possible even during switching is described.

  The artificial satellite includes a control device called AOCE (Attitude and Orbit Control Electronics) for controlling the attitude and orbit of the satellite. AOCE obtains its posture information and trajectory information from the latest data (for example, the latest data of its own position, angle, angular velocity, etc.) acquired from the sensor, calculates control information based on these information, and calculates actuators, etc. By controlling, the attitude and orbit of the satellite are controlled.

This AOCE normally has a redundant system of two systems, that is, an operating system (primary system) and a backup system (secondary system) so that even if one failure occurs, the operation of the artificial satellite is not hindered. When a failure is detected in the primary device, switching from the primary device to the secondary device is performed.
In this AOCE system switching, in order to prevent erroneous control, it is common to adopt a configuration in which the slave system cuts off the main system power supply during system switching. The attitude control information of the artificial satellite obtained by processing the information acquired from the sensor is held in a memory area using a volatile memory. For this reason, if the main system is turned off at the time of system switching, these pieces of information are lost. In order to restore the attitude of the satellite, information on the current position of the satellite transmitted from the ground is required, but information on the current position of the satellite is not always transmitted from the ground. For this reason, there is a problem that it takes a considerable time to recover the posture.

The second embodiment will be described below with reference to the drawings. FIG. 5 is a configuration example of the control system in the present embodiment.
In FIG. 4, the control device AOCE includes a main AOCE 100 and a subordinate ACOE 200 having the same configuration. In addition, a data processing unit DHU (Data Handling Unit) 100 is provided which is connected to the AOCE 400 and the ACOE 400b and inputs a command from the ground and performs data processing. In addition, the same number is attached | subjected to the structure equivalent to Embodiment 1, and the description is abbreviate | omitted.

The AOC 400 calculates a trajectory and obtains information related to its own position on the trajectory (referred to as trajectory information), a program memory 402 that holds various programs, and a CPU 401 that executes various programs held in the program memory 402. With. The AOCE 400 is used to exchange data between the I / O 403 that is an interface for exchanging information with the external sensor 111 and the external actuator 410 mounted on the satellite, and the data processing apparatus 100. An I / O 404 that is an interface, and a memory area A405 that includes a volatile memory that is a work area for reading and writing processing information of the CPU 101 and input / output information between the I / Os.
Since the AOC 400b has the same configuration as the AOC 400, detailed description and illustration are omitted as described above.

  The data processing device DHU 100 includes a saved command determination unit 101, a command save processing unit 102, a command save memory 103, each device switching presence / absence detection unit 104, and a command output control unit 105. Data processor DHU100 delivers a command to AOCE400 based on a command from the ground. The AOC 400 performs the attitude control by operating the actuator 410 based on the distributed commands such as the target rotation angle of the actuator and the target angular velocity of the actuator.

  A command format of a command transmitted from the ground station is shown in FIG. 2 (the same as in the first embodiment). The command format 300 includes a primary head (PH) 310 and a user command message 320 as in the first embodiment, and the user command message 320 includes a device designation command 321, a storage necessity bit 322, and an AOC command 323. The device designation command 321 designates AOCE.

  When creating a command for attitude control, the ground station command creator distinguishes in advance between commands that should be held in the memory and commands that do not need to be held. An identification code (“1” in the present embodiment) is assigned to the rejection bit 322. That is, an identification code is assigned to a command that is required when switching the system from the main system AOCE 400 to the subordinate system AOCE 400b.

The storage command determination unit 101 of the data processing apparatus sends a command to the corresponding memory area of the command storage memory 103 when an identification code indicating storage necessity is set in the field of the storage necessity / non-necessity bit 322 of the received command. save.
When the system is switched from the main system 400 to the sub system 400b due to a failure of the main system AOCE 400, the command stored in the command storage memory 103 is taken out and distributed to the sub system AOCE 400b.

  As described above, in this embodiment, a data column indicating whether or not a command needs to be saved is provided in the command format of the attitude control command received by the satellite from the ground station. The satellite data processing apparatus 100 stores the command in the corresponding memory area of the command storage memory 103 when an identification flag indicating that storage is required is set in the data column of the received satellite attitude control command. When switching from the main AOCE to the subordinate AOCE due to the occurrence of an abnormality in the main AOC, the data processing device takes out the command stored in the memory area and distributes the command to the subordinate AOCE. .

  This eliminates the problem that satellite attitude information is lost at the time of system switching and a considerable amount of time is required for attitude control to reset the attitude after waiting for a command from the ground station. Even at the time of switching, the attitude control of the satellite can be maintained.

1 is a diagram illustrating a configuration of a data processing device according to Embodiment 1. FIG. 3 is an example of a format of a command received by the data processing apparatus according to the first embodiment. 6 is a diagram for explaining an execution flow of the data processing apparatus according to Embodiment 1. FIG. 6 is a diagram for explaining an execution flow at the time of system switching of the data processing apparatus according to Embodiment 1. FIG. It is a figure which shows the structure of the attitude | position control system in Embodiment 2. FIG. It is the figure which showed the structural example of the data transmission / reception between the conventional ground station and a satellite.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Data processing apparatus, 101 Save command discrimination | determination part, 102 Command save process part, 103 Command save memory, 104 Switching presence detection part, 105 Command output control part, 300 Command format, 310 Primary header (PH), 320 User command message, 321 Device designation command, 322 Save necessity bit, 323 Device command, 400 Master AOCE, 400b Slave AOCE, 401 CPU, 402 Program memory, 403, 404 I / O, 405 Memory area, 410 Actuator, 411 Sensor

Claims (2)

2 comprising a main system and a subordinate apparatus mounted on a satellite, and a processing computer for switching the system from the main apparatus to the subordinate apparatus when an abnormality is detected in the main apparatus. A satellite-mounted control system that forms a redundant system,
The processing computer includes a command processing unit that receives a command transmitted from the ground to the satellite and processes the command, a memory that stores the command, and a detection unit that receives abnormality detection information from the main device. With
The command processing unit includes determination means for determining whether or not the command is a command to be stored in the memory, and if the command is not a command to be stored in the memory as a result of the determination, the command is distributed to the main device. If the command is stored in the memory as a result of the determination, the command is stored in the memory and the command is distributed to the main device.
When the command processing unit receives the abnormality detection information from the primary device, the command processing unit extracts the command from the memory and distributes the command to the secondary device. The command includes a primary header area and a user command message area, and the user command message area further includes a device command area that is an instruction to the device and whether or not the device command is to be stored. Consisting of areas,
The satellite mounting control system according to claim 1, wherein the command processing unit determines whether the received command needs to be stored based on information on the storage necessity region.

Images