RU2693296C1 - Method for protection against failures and failures of spacecraft electronic unit caused by external factors, and device for its implementation - Google Patents

Abstract

FIELD: electronic equipment.SUBSTANCE: invention relates to protection against failures of electronic equipment of spacecrafts. For protection against failures and failures of the spacecraft electronic unit, information is collected on the status of channels of the three-channel redundant electronic unit by the spacecraft diagnostic control system, determining maximum possible current which can be consumed by each channel of three-channel redundant electronic unit, as well as permissible number of repeated inclusions of electronic unit, in which it maintains serviceability, setting threshold current value of one channel of electronic unit, measuring current consumption of each channel of electronic unit, disabling channel, current consumption of which exceeds threshold current value.EFFECT: high resistance to faults and reliability, as well as broader functional capabilities of on-board radioelectronic equipment of a spacecraft.3 cl, 6 dwg

Description

The proposed method of protection against failures and failures of the electronic unit of the spacecraft caused by external influencing factors, and a device for its implementation can be applied in the management of satellites, space stations and other spacecraft (SC).

The composition of the on-board radio-electronic equipment (avionics) of the spacecraft, as a rule, includes the spacecraft control system, which, in turn, includes on-board digital computer systems (BTSVK), as well as electronic components (EB), which are used to control the on-board systems (BS ).

BTSVK performs the formation of control codes in accordance with the flight program, provides control of the spacecraft position, control and management of the onboard systems (BS) in accordance with their state and control logic embedded in the software.

During the operation onboard the spacecraft, two main functional tasks are solved in the BCVC:

- traffic control and navigation,

- control of the onboard systems providing the vital activity of the spacecraft.

The first task is solved with the help of software (software) of the traffic control and navigation system (SUDN), and the second with the help of software of the diagnostic control and management system (SDKU).

DL constructively represent hermetic containers in which modules are installed, made, for example, in the form of printed circuit boards with electronic chips installed on them, resistors, inductive and other elements. Inside the sealed container of electronic components, printed circuit boards are interconnected by means of contact connectors. At the same time, interconnects are made in the form of an onboard cable network containing connectors with mechanical contacts. DLs, as a rule, are implemented on the basis of microprocessors with "hard" implemented logic. Functionally, exchange devices for communication with bcvc, code converters to pulses of various durations, buffer registers, counters, pulse-width, digital-analog and analog-digital converters, electrical isolation elements, amplifying elements, secondary power sources and other elements. The interaction of the EB with the onboard computer and BS is carried out using redundant channels.

SDKU is implemented, as a rule, in the form of an on-board digital computing complex with appropriate software. The power sources, with the help of which the power supply of the corresponding DL channels is carried out, are galvanically isolated and independent.

DL, as a rule, consists of several identical and independent backup channels, for example, three, and is designed so that the failure of at least one of them does not affect the control of the on-board system connected to it. Power is supplied to the first, second and third channels by means of appropriate current switches. Each channel contains a secondary power source, a current sensor, an analog-to-digital converter, and an output current control register. The secondary power source installed in each channel of the EB provides for stabilization and conversion of the levels of the supplied voltage from the channel power sources, that is, from the on-board power supply network. The measured values of consumption currents by each channel of the EB from the output of the current sensor are transmitted to the corresponding analog-digital converters and converted into a code that enters the register and then from its output is transmitted to the SDMS. In addition, each channel contains input and output registers through which information is exchanged with the SDCS. The code received from the SDKU into the output register with the help of the corresponding conversion elements is converted into on-board system control commands. With the help of amplification elements, galvanic isolation and amplification of the indicated commands is carried out, which are fed to the corresponding inputs of the executive devices of the onboard system. The executive devices execute the incoming command from the EB, for example, according to the “OR” scheme, that is, if it is formed at the output, at least one of the EB channels.

The BS status is monitored using discrete and analog sensors, information from which is fed through the corresponding matching elements into analog-to-digital converters, which convert the received signals into codes received through the output channel registers to the SDMS.

The on-board system includes various actuators. For example, in a gas jet propulsion unit, the actuators are electropneumatic valves, with the help of which the metered supply of the fuel components to the corresponding lines and chambers, as well as heating elements, which preheat the gas jet mixture, is carried out. Sensors provide the formation of position signals of electropneumatic valves, and with the help of analog sensors, temperature, pressure in the mains and engine chambers are measured.

During the flight, the onboard equipment of the spacecraft is affected by a number of external influencing factors that can cause failure situations, which must be automatically parried. Failure situations can be divided into two types: irreversible, caused by non-recoverable equipment failures and reversible, resulting from equipment failures. As a result of the failure situations in the electronic equipment of the spacecraft, inaccurate conversion of information received from the on-board systems (BS) connected to it can occur.

The main factors affecting the performance of spacecraft electronic equipment include, for example, various types of radiation, including the effects of high-energy particles, temperature effects, static discharges, shock overloads and vibration. These factors differ in the nature and duration of exposure. For example, the time of static discharge resulting from the accumulation of static electricity on the surface of the device is a few seconds, and the duration of radiation resulting from a solar flare can be several minutes. Consequences of these effects are failures and failures of avionics, including the thyristor effect, causing the effect of overloading of electronic elements over current.

Failures of information and overcurrent in the DL channel may be temporary and not cause irreversible failures, if you immediately disconnect and then re-enable the corresponding DL channel in which they occur. It is not possible to ensure the immediate disconnection of the failed EB channel by means of the ground control complex (CLE), since analysis of the overload requires analysis of telemetry information transmitted to the CLE from the spacecraft, after which it is necessary to form and issue the appropriate commands.

During the time required for decision making in the TCU and subsequent actions in the electronic blocks in which an overload occurs, catastrophic irreversible failures can occur. The problem is solved by automating actions to counter these overloads.

Temporary failures in the electronic unit (DU) may occur due to the breakdown of contact connections due to vibration that periodically occurs onboard the spacecraft as a result of engine operation, or changes in the position of moving parts of the spacecraft structure (solar panels, antennas, telescopes, etc. .).

Uneven heating of the EB under the influence of infrared radiation of the Sun, temperature changes as a result of changes in the operating modes of the elements that make up the EB, as well as penetration of spacecraft structural elements into the shadow zone from other objects, including, for example, the shadow portion of the Earth’s orbit to significant temperature changes in EB. As a result of heating and cooling of boards and detachable joints, temperature gradients appear in the EB, resulting in the occurrence of thermomechanical stresses, as a result of which deforming of detachable joints in the EB can occur. Ultimately, this may lead to a failure of the DL, caused by interrupting or closing contact connections in it.

If the failure occurred due to temperature effects, an attempt to restore the efficiency of the failed EB should be made after ensuring temperature stabilization and its uniform distribution over all elements of the specified EB. Temperature disturbances can persist up to several tens of minutes, are eliminated, for example, after changing the position of a failed EB unit located in a certain place on board the spacecraft relative to the Sun, or temperature changes by the space temperature control system of the spacecraft.

Since, during the operation of the EB, uneven heating of the elements included in its composition may occur, which can lead to failures, for example, due to deformation of the detachable connections. To equalize the temperature of these elements, it is advisable to disable the redundancy channel of the specified EB in which the failure occurred.

As a result of the impact of heavy charged particles and high-energy protons of outer space on the integrated circuits included in the equipment of the DL channels, their consumption may increase dramatically due to the occurrence of the thyristor effect. The thyristor effect (FC) is accompanied, as a rule, by the flow of large currents along the power circuit and is accompanied by heating of the integrated circuits of the EB. As a result, this may lead to an irreversible failure of DL equipment. Full recovery of the equipment in which the fuel cell occurs occurs after a timely power outage, while the thyristor structure is turned off, the temperature and voltage at the outputs of the integrated circuits are reduced to the level of the termination of the specified effect.

Failures occurring in the DL channels as a result of vibration or static discharge may be temporary, and when the DL is disconnected and subsequently re-enabled after the external influence ceases, the failure is usually eliminated. On the other hand, the re-activation of the corresponding DU channel after the disconnection does not eliminate the failure if it is irreversible, therefore, the number of the indicated re-inclusions should be limited.

The duration of the disabled state of the DL channel, after which it is allowed to turn on, depends on the nature of the external influence, because of which the failure occurred. Considering the different nature of external influences, as well as their duration, the disabled state of the DL channel should minimally affect the performance of spacecraft tasks.

The minimum time for which it is necessary to disable the EB before restarting, as a rule, is stipulated in the passport data. At the same time, in the case of the thyristor effect, it is necessary to re-turn on after full discharge of the capacitive-inductive connections on the elements of the EB, as a result of which the thyristor effect completely disappears. The duration of the disabled state of the DL channel in this case increases several times as compared with the passport data on the DL. The time required for complete discharge can be determined by the results of calculations and testing on the stands.

Information failure in the DL channels is usually caused by interference and does not lead to an immediate failure of the elements, since the currents generated on the DL channel elements are limited, so the power can be removed from the DL channel with a small delay. When information fails, the information from the BS is distorted through the DL channels. As a rule, in case of failures, “freezing” or “sticking” of information may occur. The power supply of microcircuits, in which information failure can occur, is carried out by small voltage ratings, while the currents generated on the elements of the EB are usually limited. Thus, the failure of information does not lead to their irreversible failures. This failure is usually resolved when the channel is re-enabled after it is turned off. It takes less time to re-enable the EB channel after the specified information failure than when the channel is turned on again after an overcurrent due to the thyristor effect, since in the second case a deeper discharge to the capacitive-inductive elements of the EB channel and time to reduce temperatures on the elements on which it occurred.

It should be noted that a violation for a long time interval of control systems that provide orientation and stabilization of the spacecraft position can lead to disruption of the task KA as a whole.

External influencing factors, including the thyristor effect, as a rule, do not affect, or have a minimal effect on the disabled channels of the EB. Thus, the resistance to external influences on the EB equipment in the system in which one of the channels is disabled is higher than in the system in which all backup channels are simultaneously turned on.

There is a known method for countering current overloads in the electronic unit of a spacecraft, adopted as a prototype, the essence of which is that the current consumption of each channel of the electronic unit is measured. The permissible short time interval is determined, before the channel is turned on again after it is turned off when current is overloaded, and the long waiting time interval, as part of the period of rotation of the spacecraft around the Earth, is set to the allowable number of channel recurrences over a long time interval. At each long time interval during current overloads, the channel of the electronic unit is turned off, then it is turned on after a short time interval. If the number of electronic unit channel on at one long interval does not exceed the threshold value, a short waiting time interval from the moment of shutdown is counted. At the same time, after the first shutdown of the channel, a long waiting time interval is counted. After a short interval is counted, the channel is turned on and the number of channel inclusions is increased by one. They reset the number of channel starts, if it does not exceed the threshold value, at the moment when a long time interval ends. Turn off the current and stop the control of the counter of channel failures, the number of inclusions of which reaches the threshold value [1].

The closest device adopted for the prototype is a device for countering current overloads of the three-channel electronic unit of the spacecraft, caused by external influencing factors, including the thyristor effect, each channel of which contains a current switch, the first input of which is the first input of the device, and the output is connected to the sensor input current, the first output of which is the output of the device, and the second output is connected via an analog-to-digital converter with the first input of the first element the second input of which is the second input of the device, while its output is connected to the first input of the first element “AND”, the second input of which is connected to the first input of the second element “AND” and is the third input of the device, and the output is connected through the driver of short pulses with the first inputs of the third and fourth “I” elements, as well as the first reset input of the storage element, the output of which, in turn, is connected to the second control input of the current switch, while the second installation input of the storage element connected to the output of the OR element, the first input of which is the fourth input of the device, and its second input through the short delay element is connected to the output of the fourth AND element, as well as to the first counting input of the counter, the output of which is connected to the first input of the second comparison element, the second the input of which is the fifth input of the device, and the inverse output is connected to the second input of the fourth element "AND", while the second counter reset input is connected to the output of the long delay element through the second input of the second element The "AND" is connected to the third input of the "OR" element, as well as the first trigger reset input, the inverse output of which is connected to the second input of the third "AND" element, the output of which, in turn, is connected to the second counting trigger input and the input of the long delay element [ one].

The disadvantages of the known method and device are the following:

- refusal situations associated only with current overloads in the DL channels are parried, while failures and failures in the DL information circuits resulting from malfunctions in individual DL elements are not taken into account,

- external influencing factors are simultaneously exposed to all channels of the electronic unit, as they are included.

The technical task of the invention is to increase the resistance to failure and reliability, as well as expanding the functionality of the onboard electronic equipment of the spacecraft.

The technical result is achieved in that the method of protecting against failures and malfunctions of an electronic equipment of a spacecraft caused by external influencing factors, which consists in collecting information on the state of the channels of a three-channel redundant electronic unit by the system of diagnostic control of the spacecraft, determines consume each channel of the three-channel redundant electronic unit, as well as the permissible number of repeated switching on of the electronic unit, while which it maintains, set the threshold value of the current of one channel of the electronic unit, measure the consumption currents of each channel of the electronic unit, turn off the channel, the consumption current of which exceeds the threshold current value, and start the countdown of the turn-on delay when the current is overloaded, determine the period of rotation of the spacecraft around the Earth, break it into fixed time intervals, which are determined by the orientation of the spacecraft relative to the Sun and the planets, as:

1≤N _And ≤100

where: N _And - the number of time intervals, which divide the period of rotation of the spacecraft around the Earth,

set the reset time interval, set the threshold value of the number of electronic unit channel inclusions on one reset time interval, multiple of three, rounded down to a whole number, in the range:

where: N _P - the threshold value of the number of inclusions of all channels in one time interval of the reset,

N _D - the permissible number of repeated switch-ons of the electronic unit, at which it remains operable,

- знак округления в меньшую сторону до целого числа, задают пороговое значение задержки на включение канала при перегрузке по току, задают пороговое значение количества включений каналов электронного блока на одном интервале времени сброса, дополнительно определяют предельные токи, при которых каналы электронного блока сохраняют работоспособность, задают пороговое значение тока перегрузки одного канала электронного блока в диапазоне:

- sign of rounding down to a whole number, set the threshold value for switching the channel on overcurrent, setting the threshold value for the number of switching on the electronic unit channels in one reset time interval, additionally determining the limiting currents at which the electronic unit channels remain operable, set threshold value of the overload current of one channel of the electronic unit in the range:

I _MAX ≤I _P <I _OL

where: I _MAX is the maximum possible current that each channel of an electronic unit can consume during operation as part of a spacecraft,

I _PR - the current limit at which the channels of the electronic unit remain operable,

I _P - the threshold value of the current in the channel of the electronic unit, determine the minimum delay times, at the end of which the channel of the electronic unit is allowed to turn on after it is turned off in the absence and presence of overcurrent, while setting the appropriate values for switching delays in the ranges:

Δt _MINT <Δt _PT <2⋅Δt _MINT ,

Δt _MIN <Δt _IC <Δt _PT ,

where: Δt _MINT is the minimum time at which the channel of the electronic unit is allowed to turn on after it is turned off in the presence of overcurrent,

Δt _PT - the delay on the channel when the current overload,

Δt _MIN ^{_ the} minimum time at which the channel can be switched on

electronic unit after it is turned off in the absence of overloads

current

Δt _IC is the delay for turning on the channel in case of an informational failure; set the reset time interval in the range:

where Δt _With ^- time interval reset

T _KA - the period of rotation of the spacecraft around the Earth, in the channels of the electronic unit carry out the conversion of the codes coming from the system of diagnostic monitoring and control, into the appropriate control commands of the onboard system, set the monitoring period as:

T _K <0, l⋅Δt _IC ,

where: T _K is the period of control,

in addition, in the channels of the electronic unit, the signals generated by the onboard system are simultaneously converted into codes that are polled at each monitoring period, in case there is no failure signal and two channels are included, the polled codes from the first and second, second and third or the third and first channels of the electronic unit, and if they differ, turn off, respectively, the first, second or third channel, starting from the moment the channel is turned off, count down for it the switch-on channel in case of information failure, while at the moment of channel disconnection the counted number of channel inclusions is increased by one, if there is no signal of failure and the number of channels included is no more than one, and if there is a signal of failure no more than two, switch on the current or subsequent monitoring periods the countdown of both delays is absent, at the moment of the reset time interval is reset, the counted number of electronic unit channel inclusions, if it does not reach the threshold value, and in case of threshold values form of system failure signal is stopped by disabling channels absence polled compared codes.

The technical result from the use of protection devices against failures and failures of the electronic unit of the spacecraft caused by external influencing factors is achieved due to the fact that the device contains the first, second and third channels that are identical, each channel contains a current switch, the first input of which is the first input channel, and the output is connected to the current sensor input, the first output of which is the first output of the channel, and the second output is connected through the analog-to-digital converter with the first input of the first the comparison element, the second input of which is the second channel input, characterized in that the first direct output of the first comparison element is connected to the input of the pulse shaper, the output of which is connected through the first delay element to the first reset input of the first storage element, as well as directly to its second setting the input and the first input of the first element "OR", the output of which is connected to the first reset input of the second storage element, the first inverse output and the second input of which are connected, respectively Respectively, with the first input and output of the first element, the second and third inputs of which, in turn, are connected, respectively, with the inverse output of the first storage element and the output of the AND-NO element, the first input of which is the third and the second input is the fourth input channel and connected to the first input of the second element "AND", the output of which is the second output of the channel and connected to the second input of the first OR element, to the first installation input, and through the second delay element to the second reset input of the third memory invert output of which is connected to the fourth input of the first element “AND”, the fifth input of which is the fifth input of the channel and connected to the second input of the second element “AND”, the third input of which is the sixth input of the channel and IS ", The fourth input of the second element" And "is the third output of the channel, and is also connected to the second direct output of the second storage element and connected to the second input of the current switch; the fifth and sixth inputs of the second" And "element are connected, respectively, to the second m inverse output of the first comparison element and with the inverse output of the second comparison element, the first and second inputs of which are, respectively, the seventh and eighth channel inputs, with the first inputs and first outputs of the first, second and third channels, respectively, first, second and the third inputs and the first, second, third outputs of the device, the second inputs of all these channels are interconnected and are the fourth input of the device, and the second outputs of the first, second and third channels are connected, respectively, the first, second and third inputs of the control unit, the fourth input of which is the fifth input of the device, and the output is connected to the fourth, interconnected, inputs of all specified channels and is the fourth output of the device, while the third input of the first channel is connected to the sixth input of the second channel and the third output of the third channel, the third input of which is connected to the sixth input of the first channel, and the third output of the second channel, the third input of which is connected to the sixth input of the third channel and the third output of the first channel, the fifth input cat This is the sixth input of the device, and is connected via the third delay element to the fifth input of the second channel and the input of the fourth delay element, the output of which, in turn, is connected to the fifth input of the third channel, while the seventh input of the first channel is the seventh input of the device and at the same time, with the eighth input of the third channel, the seventh input of which is the ninth input of the device and connected to the eighth input of the second channel, the seventh input of which is connected to the eighth input of the first channel and is the eighth input of the device.

The control unit contains the second element OR, the first, second and third inputs of which are, respectively, the first, second and third inputs of the control unit, and its output is connected to the first inputs of the third and fourth "AND" elements, the output of the last is connected to the first counting input of the counter The output of which, in turn, is connected to the first input of the third comparison element, the second input of which is the fourth input of the control unit, and the inverse output which is the output of the control unit is connected to the second inputs of the third and fourth “I” elements, as well as the first input of the fifth element, the output of which, in turn, is connected to the second reset input of the counter and the first reset input of the fourth storage element, the inverse output of which is connected to the third input of the third “AND” element, and the second input is connected to the output of the third element "And", and through the fifth delay element - with the second input of the fifth element "And".

FIG. 1 shows a functional diagram of a device for protection against failures and failures of an electronic equipment of a spacecraft; FIG. 2 is a functional block diagram of the control, in FIG. 3-cyclogram of the device operation when it is first turned on, in FIG. 4 is a sequence diagram of the parry of overcurrent in the first channel of the EB, FIG. 5 is a sequence diagram of the countering of the failures of the channels of the electronic unit, in the case of the termination of the comparison of information received at the seventh and eighth inputs of the device; FIG. 6 is a sequence diagram of the operation of the device when the counter exceeds the control unit threshold value.

The proposed method of protection against failures and failures of the electronic unit of the spacecraft caused by external influencing factors is implemented as follows.

Before the flight of the spacecraft, according to the passport data or the results of the experiments, the limiting currents are determined at which the channels of the electronic unit remain operable. In addition, determine the maximum possible current that can consume each channel of the electronic unit during operation as part of the spacecraft, as well as the permissible guaranteed number of re-inclusions of the electronic unit at which it retains its functionality.

After that, the SDKU, implemented as software BSCVK, set the threshold value of the overload current of one channel of the electronic unit in the range:

where: I _MAX is the maximum possible current that each channel of an electronic unit can consume during operation as part of a spacecraft,

- предельный ток, при котором каналы ЭБ сохраняют работоспособность,

- the current limit at which the DL channels maintain their operability,

- пороговое значение тока перегрузки в канале ЭБ.

- the threshold value of the overload current in the DL channel.

Determine the period of rotation of the spacecraft in orbit around the Earth on which it should operate. Next, the nature of possible external influences in different parts of the orbit, including possible radiation, heating of EB elements, depending on the orientation of the spacecraft relative to the Sun, is analyzed. In accordance with the data of the analysis, the period of rotation of the spacecraft around the Earth is divided into fixed time intervals, which are determined by the orientation of the spacecraft relative to the Sun and the planets, as:

where: N _I is the number of time intervals into which the period of rotation of the spacecraft around the Earth is divided.

The time required to reduce the potentials on elements of an EB with capacitive-inductive connections to the level at which the thyristor effect disappears always exceeds several times the time after which it can be re-activated after simply turning off the unit, since a deeper potential discharge is required on the indicated elements of EB. The time after which it is allowed to re-enable the EB after it has been disconnected, is usually indicated in its passport data. At the same time, the delay in switching on the channel in case of overcurrent is always an order of magnitude and less than the reset time, that is:

Further, according to the passport data, or according to the results of the experiments, the minimum permissible times are determined at which the channel of the electronic unit is allowed to turn on after it is turned off in the absence and in the presence of an overcurrent caused by the thyristor effect, while setting the corresponding threshold values for switching on as:

where: Δt _MIN is the minimum time at which the channel of the electronic unit is allowed to turn on after it is turned off when there are no overloads on current, Δt _ПТ is the threshold value for switching the channel on when current is overloaded, Δt is _{IC for the} threshold for switching on the channel for information failure , Δt _MINT is the minimum time at which the channel of the electronic unit is allowed to turn on after it is turned off in the presence of an overcurrent caused by the thyristor effect,

Set a threshold value for the number of DL channel inclusions in one reset time interval, a multiple of three, rounded down to an integer in the range:

where: N _P - the threshold value of the number of inclusions of all channels in one time interval of the reset,

N _G - the guaranteed number of re-inclusions of DL, at which it keeps working,

- знак округления в меньшую сторону до целого числа. Задают интервал времени сброса, в диапазоне:

- sign of rounding down to the integer. Set the reset time interval, in the range:

where Δt _With - time interval reset

T _KA - the period of revolution of the spacecraft around the Earth.

Set the monitoring period as:

where: T _K is the period of control.

Before the start of control, the first and second channels of EB are included. During the operation of the spacecraft, the measured values of the consumption currents by each channel of the EB are converted into the corresponding codes and transmitted to the SKDU. In addition, in the DL channels, the conversion of control codes from the diagnostic monitoring and control system to the onboard system control commands is carried out. At each monitoring period, discrete and analog signals from the DL channels are converted, which are generated by the on-board system into codes that are alternately polled by the diagnostic monitoring and control system.

Emerging failures are countered as follows. Turn off the channel, the current consumption of which exceeds the threshold value, while starting for him count the delay on when the current is overloaded. At each monitoring period, in the absence of a failure signal, if two channels are simultaneously turned on, in the polling order, the codes from the two DL channels are alternately compared. If the indicated codes, of the first and second, or second, and third, or third and first channels of the DL, are different, switch off the first, second, or third channel, respectively. At the moment of the end of the reset time interval Δt _{C, the} counted number of switching-on DB channels is reset, if it does not reach the threshold value N _П , and when the threshold value N _{П is} reached, they generate a system failure signal. In the presence of a failure signal, the disconnection of channels is stopped due to the absence of comparison of the codes of the two included channels. Starting from the moment the channel is turned off, the delay for switching on the channel in case of an information failure is counted for it, while at the time of the channel disconnection, the counted number of channels is increased by one. If, in the absence of a failure signal, the number of enabled channels is no more than one, and if there is a specified signal, no more than two, include in the current or subsequent monitoring periods in the polling order a channel for which there is no counting of the delay times for channel activation during current overload and for informational malfunction.

It should be noted that the functional algorithms implemented in SDKU, providing control of the BS in case of failures and failures received in the same monitoring period, do not react immediately, since the prediction tasks are solved in these algorithms, in addition, for reliability, the functional control can be performed by signals derived from other systems. In this regard, a failure during one or two monitoring periods does not affect the functioning of the BS.

The protection device against failures and failures of the electronic unit of the spacecraft, caused by external influencing factors (Fig. 1), contains the first 1 (1К), second 2 (2К) and third 3 (3К) channels, which are identical, with each channel containing current switch 4 (CT), the first input of which is the first input of the channel (1 input), and the output is connected to the input of current sensor 5 (DT), the first output of which is the first output of the channel (1 output), and the second output is connected through analog-to-digital converter 6 (ADC) with the first input of the first element of comparison 7 (1ES), the second input of which is the second input of the channel (2 in.), while additionally the first, direct output of the first comparison element 7 (1ES) is connected to the input of the pulse shaper 8 (FI), the output of which is connected through the first delay element 9 (1EZ) with the first the reset input of the first storage element 10 (1ZE), as well as directly with its second installation input and with the first input of the first element "OR" 11 (1OR), the output of which is connected to the first reset input of the second storage element 12 (2ЗЭ), the first inverse output and the second input of the installation first connected to the first input and output of the first element "And" 13 (1I), the second and third inputs of which, in turn, are connected, respectively, with the inverse output of the first storage element 10 (1ZE) and the output of the element "And- NOT "14 (IS-NOT), the first input of which is the third (3 in.), And the second input is the fourth input of the channel (4 in.) And is connected to the first input of the second element" And "15 (2I), the output of which is the second channel output (2 out.) and connected to the second input of the first element "OR" 11 (1OR), with the first installation input, and through the second oh delay element 17 (2EZ) -with the second input of the third storage element 16 (3EZ), the inverse output of which is connected to the fourth input of the first element "And" 13 (1I), the fifth input of which is the fifth input of the channel (5 input) and connected to the second input of the second element "AND" 15 (2I), the third input of which is the sixth input of the channel (6 in.) and connected to the third input of the element "AND-NO" 14 (AND-NOT), the fourth input of the second element "AND "15 (2I) is the third output of the channel (3 out.) And is connected to the second direct output of the second storage element 12 (2ЗЭ), also connected to the second input of the current switch 4 (CT), the fifth and sixth inputs of the second element "And" 15 (2I) are connected, respectively, with the second inverse output of the first comparison element 7 (1ES) and with the inverse output of the second comparison element 18 (2ES ), the first and second inputs of which are, respectively, the seventh (7 in.) and eighth (8 in.) channel inputs, with the first inputs (1 input) and the first outputs (1 output) of the first 1 (1K), the second 2 (2K) and third 3 (3K) channels are, respectively, the first (Bx.1), the second (Bx.2) and the third (Bx.3) inputs and the first (Out1), the second ( Out2), third (Out.3) device outputs, the second inputs (2 in.) Of all specified channels are interconnected and are the fourth device input (In.4.), And the second outputs (2 out) of the first 1 ( 1K), second 2 (2K) and third 3 (3K) channels are connected, respectively, with the first, second and third inputs of the control unit 19 (BC), the fourth input of which is the fifth input of the device (Bx. 5), and the output is connected to the fourth (4 in.) Interconnected inputs of all specified channels and is the fourth output of the device (Out 4), while the third input (3 in.) Of the first channel 1 (1K) is connected to the sixth input (6 in.) of the second channel 2 (2K) and the third output (3 out.) of the third channel 3 (3K), the third input of which is connected to the sixth input (6 in.) of the first channel 1 (1K), and the third output (3 out.) The second channel 2 (2K), the third input of which (3 in.) Is connected to the sixth input (6 in.) Of the third channel 3 (3K) and the third output (3 out.) Of the first channel 1 (1K), the fifth entry (5 in.) which is I am the sixth input of the device (Input 6) and is connected via the third delay element 20 (3EZ) to the fifth input (5 in.) of the second channel 2 (2K) and the input of the fourth delay element 21 (4EZ), the output of which, in turn , is connected to the fifth input (5 in.) of the third channel 3 (3K), while the seventh input (7 in.) of the first channel 1 (1K) is the seventh input of the device (In 7) and is connected, with the eighth input (8 in.) Of the third channel 3 (3K), the seventh input (7 in.) Of which is the ninth input of the device (In. 9) and is connected to the eighth input (8 in.) Of the second channel 2 (2K), the seventh input (7 in.) Of which is connected to the eighth input (8 in.) Of the first channel 1 (1K) and is the eighth input of the device (Bx. eight).

The control unit 19 (BK) (Fig. 2) contains the second element "OR" 22 (2ILI), the first, second and third inputs of which are, respectively, the first (1 inh. Bk), the second (2 inh. Bk) and the third (3 VH.bk) inputs of the control unit 19 (BC), and its output is connected with the first inputs of the third 23 (3I) and fourth 24 (4I) elements "I", the output of the latter is connected with the first counting input of the counter 25 (MF), the output of which, in turn, is connected to the first input of the third comparison element 26 (3ES), the second input of which is the fourth input (4 inlet bk) of the control unit 19 (BC), and the inverse output is the output of the control unit 19 (BC), connected to the second inputs of the third 23 (3I) and fourth 24 (4I) elements "And", as well as the first input of the fifth element "I" 27 (5I), the output of which, in turn connected to the second reset input of the counter 25 (MF) and the first reset input of the fourth storage element 28 (4ЗЭ), the inverse output of which, in turn, is connected to the third input of the third "And" 23 (3I), and the second input is connected to the output of the third element "And" 23 (3I) and through the fifth delay element 29 (5EZ) - with the second input of the fifth element "And" 27 (5I).

A device that implements the proposed method for one channel of an electronic unit, shown in FIG. 1 and FIG. 2 operates as follows.

Before starting operation, the seventh (Bx.7), eighth (Bx.8) and ninth (Bx.9.) Inputs of the device are supplied with power currents, which flow, respectively, to the first inputs of the first 1 (1К), second 2 (2К) and the third 3 (3K) channel device.

The fourth input of the device (Vx.4) is assigned a code corresponding to the threshold value of the overload current of the EB channel defined by the formula (1), which is fed to the second inputs (2 in) of all the specified channels.

The fifth input of the device (I.5) serves the code defined by the formula (5), which arrives at the fourth input of the control unit (4 I & B), which corresponds to the threshold value of the number of activations of all channels in one reset time interval N _П.

In the initial state, the first 10 (1ЗЭ), the second 12 (2ЗЭ) and the third 16 (3ЗЭ) storage elements of the first 1 (1К), second 2 (2К) and third 3 (3К) channels are in the reset state, while the inverse outputs of these elements, as well as from the output (Outlet bk) of the control unit 19 (CU), logical “1” are formed, and on the second, direct outputs of the first storage element 10 (1ЗЭ) in all specified channels, logical “0” are formed.

In each channel, a logical “0” from the direct output of the first storage element 10 (1ZE) is fed to the second, control input of the current switch 4 (CT), which is connected to the current sensor (DT5). At the first output of the current sensor (DT) in each channel, which is its first output, respectively, at the outputs of the first 1 (1K), second 2 (2K) and third 3 (3K) channels, and also, respectively, on the first ( Out1), second (Out.2) and third (Out.3) outputs of the device, a zero current is generated.

The third (3 in.) And sixth (6 in.) Inputs of each channel, respectively, the first and second inputs of the elements "AND-NO" (14) of these channels receive logical "0" from the third outputs (3 output) of the other two channels, which are the outputs of the second storage elements 12 (2ZE) of the specified channels.

FIG. 2 shows a functional block diagram of the control.

Before starting the control in the control unit 19 (BK) (Fig. 2), the fourth storage element 28 (4ЗЭ) is in the reset state, while the logical "1" is formed at its inverse output and the contents of the counter 25 (MF) is zero. At the first input of the third element of comparison 26 (3ES), a code equal to zero is received, corresponding to the contents of counter 25 (MF). The fourth input (4 inlet bk) of the control unit 19 (BC), which is connected with the second input of the specified element, receives a code corresponding to the permissible number of repeated switching on of all channels after their disconnection, defined by formula (5) NP. At the inverse output of the third comparison element 26 (3ES), a logical "1" is formed, which is fed to the second inputs of the third 23 (3I) and fourth 24 (4I) "I" elements and, accordingly, to the output (Outlet bb) of the control unit 19 (BK), from which it goes to the fourth inputs (4 in.) Of the first 1 (1K), second 2 (2K) and third 3 (3K) channels, respectively, to the second inputs of the AND-NO element 14 (AND-NO ) each channel.

During control, the impulse formed at the first (1 in. Bq), second (2 in. Bk) or third (3 in. Bk) inputs of the control unit 19 (BC) is fed to the first, second or third inputs of the second element "OR" 22 (2OR). Next, from the output of the specified element, the pulse arrives at the first inputs of the third 23 (3I) and fourth 24 (4I) “I” elements. Since a logical “1” is fed to the second inputs of these elements from the output of the third comparison element 26 (3ES), a pulse arriving at the input of the fifth delay element 29 (5EZ) is generated at the output of the third element 23 (3I), the duration of which is determined by formula (6), and the second input of the fourth storage element 28 (4ЗЭ), which sets at its inverse output the state of a logical "0", arriving at the third input of the third element "And" 23 (3I) and, thus, blocks the formation of subsequent pulses at the output of this element but. In addition, the impulse received at the first input of the logical element “I” 24 (4I) from its output then goes to the first, counting input of the counter 25 (MF), while the contents of the counter are incremented by one. From the output of the fifth delay element 29 (5EZ) to the second input of the fifth element "And" 27 (5I) the impulse will go through the delay time to the corresponding reset time interval Δt _С ,, determined by the formula (6), if the first input has a logical "1", the specified pulse will come from the fifth element "And" 27 (5I) to the first reset input of the fourth storage element 28 (4ЗЭ) and set the state of logical "1" at its inverse output. At the same time, the specified pulse will go to the second input of the counter 25 (MF) and reset it.

In case the incoming to the first (1 in. Bk), second (2 in. Bk) or third (3 in. Bk) impulses of the control unit 19 (BK) pulse, through the second element "OR" 22 (2IL) and the fourth element “And” 24 (4I) arrives at the first input of counter 25 (MF) and sets its value equal to the code entering the fourth input (4 inlet bk) of the control unit 19 (BC), then the inverse output of the third comparison element 26 ( 3ES), a logical “0” is formed, which goes to the second inputs of the third 23 (3I) and fourth 24 (4I) “I” elements, as well as to the first input of the fifth “I” element 27 (5I), while NTRY pulses at first and second inputs of counter 25 (MF), the input of the fifth delay element 29 (5EZ) and for installation in a logic "1" of the fourth memory element 28 (4ZE) are blocked. The logical “0” formed at the output (Vyhb.bk) of the control unit 19 (BK) then goes to the fourth inputs (4 in.) Of the first 1 (1K), second 2 (2K) and third 3 (3K) channels of the device, while control on the coincidence of information coming in the seventh (7in.) and eighth (8in.) inputs of all channels, respectively, to the first second inputs of the second comparison elements 18 (2ES) is blocked on the second element "And" 15 (2I), since the first input of the specified element in each channel receives a logical "0" from the corresponding fourth input (4 in.) of each channel, formed first output control unit 19 (BK).

At the same time, at the output of the element "AND-NO" 14 (AND-NO) of each channel, a logical "1" is formed, which is fed to the third input of the first element "AND" (1I), while in the case of disconnecting any of the channels, in the absence switching on delay in case of overcurrent Δt _ПТ , defined by the formula (4), it is switched on. That is, all channels are turned on, and disconnection is carried out only in case of current overloads.

The sequence diagram of the device operation at the first power up is presented in FIG. 3. The designations in FIG. 3:

t is the time

T _to - the period of control,

Δt _CI - impulse control,

Δt _3EZ , Δt _4EZ - respectively, the duration of the delays on the third 20 (3EZ) and fourth 21 (4EZ) delay elements),

U _{5BH (K1)} , U _{5BH (K2)} , U _{5BX (K3)} - respectively, the voltage at the fifth inputs (5 in.) _{Of the} first 1 (1K), second 2 (2K) and third 3 (3K) channels of the device,

U _Oh..bk - the voltage at the output of the control unit 19 (BC),

U _{I-NOT (K1)} , U _{I-NOT (K2)} , U _{I-NOT (K3),} respectively, the voltages at the outputs of the AND-NES elements 14 (I-NES) of the first 1 (1K), second 2 (2K ) and the third second 3 (3K) device channels,

U _{2ЗЭ (К1)} , U _{2ЗЭ (К2)} , U _{2ЗЭ (К3)} - respectively, the voltage at the outputs of the second storage elements 12 (2ЗЭ) of the first 1 (1К), second 2 (2К) and third 3 (3К) channels of the device,

I _Out . 1, I _{Out. 2} , I _{Out. 3} - respectively, the currents on the first (Out.1), second (Out.2) and third (Out.3) outputs of the device,

t ₁ , t ₂ , t ₃ - respectively, the moments of receipt of control pulses at the fifth inputs (5 in.) of the first 1 (1K), second 2 (2K) and third 3 (3K) channels of the device.

Operation of the device starts with the receipt of pulses from SDKU at the sixth input (Vh.6) of the device with a period T _to control length on the order of less duration control period, ie:

where Δt _KI is the duration of the control pulse, T _c is the monitoring period,

Before the control starts, before the control pulse arrives at t _{1, the} logical input "1" is received from the first inverse input to the first input of the first element 1 (1K) at the sixth input of the device (Vx. 6). the second storage element 12 (2ZE), which is in a reset state. The second and fourth inputs of the first element "And" 13 (1I) of the first channel 1 (1K) receive a logical "1" from the inverse output, respectively, of the first 10 (1ЗЭ) and the third 16 (3ЗЭ) and storage elements of the specified channel, since they are also in a reset state. To the third input of the first element “AND” 13 (1I), from the output of the element “AND-NO” 14 (AND-NO) of the first channel 1 (1K), the logical “1” also arrives, since the first and third inputs of the specified logical element Logical “00” from the third (3 in.) and sixth (6 in.) inputs of this channel are received, which are formed on the second, direct outputs of the second storage elements 12 (2ЗЭ), coming in from the third outputs (3 out.) of the third 3 (3K) and second 2 (2K) channels, respectively.

At each control cycle T pulse is given by _K SDKU from the sixth input device (Vh.6) is supplied to the fifth input (5 Bx.) Of the first channel 1 (1 K), further, via a third delay element 20 (3EZ) is supplied to the fifth input ( 5 in.) The second channel 2 (2K), then, through the fourth delay element 21 (4EZ) to the fifth input (5 input) of the third channel 3 (3K), while the sum of the durations of the third 20 (3EZ) and the fourth 21 (4EZ a) delay elements is less than the duration of the monitoring period, that is:

(Δt _3EE + Δt _4EE ) <T _K (9)

where (Δt _3EZ , (Δt _3EZ - respectively, the duration of the delay pulses on the third 20 (3EZ) and fourth 21 (4EZ) delay elements.

Received at time t ₁ from SDKU to the sixth input (6 in.) Device control pulse duration Δt _KI comes to the fifth input (5 in.) Of the first channel 1 (1K) and then goes to the fifth input of the second element "And" 15 (2I ) this channel. Since logical “1” arrives at the inputs of the second element “And” 15 (2I) from the first to the fourth, a pulse is generated at its output, which arrives at the second input of the second storage element 12 (2ЗЭ) installation, which is set to the logical leading edge of the pulse "one".

From the second, direct output of the second storage element 12 (2ZE) of the first channel 1 (1K) logical "1" is fed to the second, control input of the current switch 4 (CT) of the first channel 1 (1K), while the current entering the first input of the specified switch, then, through the current sensor 5 (DT) is fed to its output and, accordingly, to the first output (1 output) of the first channel of the device 1 (1K), which is the first output of the device (Vych.1). In this case, power is supplied to the first channel of the EB. In addition, a logical "1" from the second, direct output of the second storage element 12 (2ZE) of the first channel 1 (1K) is fed through the third output (3 out.) Of the first channel 1 (1K) to the third input (3 in.) Of the second channel 2 (2K) and the sixth input (6 in.) Of the third channel 3 (3K) device.

Up to the moment t _2, the first input of the first element “AND” 13 (1I) of the second channel 2 (2K) receives a logical “1” from the first inverse of the second storage element 12 (2ЗЭ) of this channel, which is in the reset state. The second and fourth inputs of the first element "And" 13 (1I) of the second channel 2 (2K) logical "1" comes from the inverse output, respectively, of the first 10 (1ЗЭ) and the third 16 (3ЗЭ) and storage elements of the specified channel, since they are also in a reset state. To the third input of the first element “AND” 13 (1I) of the second channel 2 (2K) logical “1” comes from the output of the element “AND-NO” 14 (AND-NO) of this channel, since the third inputs of the specified logical element receive a logical "0" from the sixth input (6 in.) Of this channel, which are formed on the third output (3 out.) Of the third 3 (3K) channel from the second, direct output in the state of logical "0" second storage element 12 (2ЗЭ). At time t _{2 a} pulse of duration Δt _KI , from the output of the third delay element 20 (3EZ), is fed to the fifth input (5 in.) Of the second channel 2 (2K) and, accordingly, to the fifth input of the second element "I" 15 (2I) specified channel. Since at the inputs from the first to the fourth element "And" 15 (2I) of the second channel 2 (2K) channel logical "1" are formed, the pulse received at its fifth input is further, from its output it goes to the second input of the second storage element 12 (2ЗЭ ) this channel ,. At the same time, on the leading edge of the pulse, the second storage element 12 (2ZE) is set to the logical "1" state. From the second, direct output of the second storage element 12 (2ZE) of the second channel 2 (2K), the generated logical "1" is fed to the second, control input of the current switch 4 (CT) of the second channel 2 (2K), as a result of which the current coming to the first the input of the specified switch, through the current sensor 5 (DT) is fed to its output and then to the first output (1 output) of the second channel of device 2 (2K), respectively, to the second output of the device (Output 2). In this case, power is supplied to the second channel of the EB. In addition, a logical "1" from the second, direct output of the second storage element 12 (2ZE) of this channel goes through its third output (3 outputs) to the third input (3 in.) Of the third channel 3 (3K) and the sixth input of the first channel 1 (1K) device.

At time t ₃ , from the output of the fourth delay element 21 (4EZ), the pulse arrives at the fifth input (5 in.) Of the third channel 3 (3K), respectively, to the fourth input of the second element "And" 15 (2I) of the third channel 3 (3K). At the moment t ₃ , logical "1" is formed at the direct outputs of the second storage elements 12 (2ZE) of the first 1 (1K) and second 2 (2K) channels and at the output (Out. BC) of the control unit 19 (BK). These logical "1" are received, respectively, on the sixth (6 in.), The third (3 in.), The fourth (4 in.) And the inputs of the third channel 3 (3K). At the same time at the output of the element "AND-NO" 14 (AND-NO) of the third channel 3 (3K) a logical "0" is formed.

Formed logical "0" from the output of the element "AND-NO" 14 (AND-NO) of the third channel 3 (3K) is fed to the second input of the first element "AND" 13 (1I) of this channel and blocks the pulse coming at time t ₃ to the installation the second storage element 12 (2ZE) of the third channel 3 (3K), which remains in the state of logical "0", while the current to the first output (1 output) of the third channel 3 (3K), respectively, to the third output of the device (Ex. 3) does not arrive.

FIG. 4 shows a cyclogram of the parry of overcurrent in the first channel of the EB. The indications in FIG. four:

1 _THEN - the threshold value of the current supplied to the first input of the first channel,

U _{1ES (K1)} is the voltage at the direct output of the first element of comparison 7 (1ES) of the first channel 1 (1K),

U _{FI (K1)} is the voltage at the output of the pulse shaper 8 of the first comparison element 7 (1ES) of the first channel 1 (1K),

U _{1ZE (K1)} voltage at the output of the first storage element 10 (1ZE) of the first channel 1 (1K),

t ₄ - the time of the beginning of the current exceeding the threshold value I _POR in the first channel 1 (1K),

t ₅ - the moment of disconnection of the first channel in case of current overload,

t ₆ - the time off the first channel,

t ₇ - the moment of switching on the third channel,

t ₈ - the end of the first time interval.

In the first channel 1 (1K), the current I _Out.1 generated by the second output of current sensor 5 (DT) is _converted using a analog-to-digital converter 6 (ADC) into a code that goes to the first input of the first comparison element 7 (1ES). The second input of the specified element receives a code corresponding to the threshold current value from the second input (2 in.) Of the first 1 (1K) channel, respectively, from the fourth input of the device (Vx.4). Until t _{4, the} first 1 (1K) and second 2 (2K) channels of the device are in the on state, while the currents from the first (Bx1) and second (Bx2) input devices come through switches 4 (CT) and current sensors 5 (DT) of the indicated channels, respectively, to the first (Out. 1) and second (Out. 2) outputs of the device. At time t ₄ , the current I _Out.1 arriving at the second output of current sensor 5 (DT) of the first channel 1 (1K). i reaches the threshold value I _THEN , that is, there is an overload on the current of the first channel 1 (1K). The specified current is converted by the analog-to-digital converter 6 (ADC) of the first channel 1 (1K) into a code that goes to the first input of the first comparison element 7 (1ES) of the first channel 1 (1K). Starting from the time t ₄ to the time t ₅ , at the output of the analog-to-digital converter 6 (ADC), a code is generated corresponding to a higher threshold value corresponding to the current measured by sensor 5 (DT). Since the code received from the output of analog-to-digital converter 6 (ADC) of the first channel 1 (1K) to the first input of the first comparison element 7 (1 ES) of this channel exceeds the threshold value of the code received at its second input, on the first direct output of the specified the comparison element forms a logical “1”, respectively, at the second inverse output - a logical “0”. The logical “0” formed at the second inverse output of the first comparison element 7 (1 ES) is fed to the fifth input of the second element “I” 15 (2I) of the first channel 1 (1K). In this case, the control pulse Δt _KI arriving at the second input of the second element “AND” 15 (2I) from the fifth input (5 in.) Of the first channel 1 (1K), respectively, from the sixth input of the device (Bx.6) does not flow to its output starting from the moment of overload t ₄ to the moment t ₅ . This delay is due to delays on the analog-to-digital converter 6 (ADC) and switch 4 (CT) of the first channel 1 (1K). At the same time, at the time t _{4 the} logical “1” formed at the first, direct output of the first comparison element 7 (1ES) of the first channel 1 (1K) is input to the pulse shaper 8 (FI) of the first channel 1 (1K), at the output which is formed by a short pulse not exceeding Δt _CI, which is input to the first delay element 9 (1EZ), the duration of which _PT Δt is defined by the formula (4), the second input of the installation of the first memory element 10 (1ZE) and to a first input the first element "OR" 11 (1OR). At the inverse output of the first storage element 10 (1ZE) of the first channel 1 (1K) a logical "0" is formed, which is fed to the second input of the first element "I" 13 (1I) of the first channel 1 (1K), starting from the moment t ₄ resetting the specified the first storage element 10 (1ZE) until t ₈ .

Until t ₈ at the second input of the first element "And" 13 (1I) of the first channel 1 (1K), a logical "0" is formed, which blocks the control pulses received at the fifth input of the specified element, the output of which is connected to the second input of the second storage element 12 (2E). Thus, during the time delay Δt _PT , defined by the formula (4), due to overcurrent _; the inclusion of the first channel 1 (1K) is blocked, since the control pulse, with a duration Δt _KI, arrived at t ₆ at the sixth input of the device (Bx.6), respectively, at the fifth input (5 in) of the first channel 1 (1K) and the fifth the input of the first element "And" 13 (1I) does not arrive at the second input of the installation of the second storage element 12 (2ЗЭ) of the first channel 1 (1K). After a time Δt _3EZ after arriving at the moment t ₆ to the input of the control pulse device, from the output of the third delay element 20 (3EZ) the pulse goes to the fifth input (5 in.) Of the second channel 2 (2K), respectively, to the fifth input of the first element And »13 (1И) of the second channel 2 (2К). The formation of a pulse at the output of the second element "And" 15 (2I) of the second channel is blocked by a logical "0" arriving at its first input from the first, inverse output of the second storage element 12 (2ЗЭ) of the second channel 2 (2K), since the specified channel is on.

The first input of the second element "And" 15 (2I) of the third channel 3 (3K) from the first, inverse output of the second storage element 12 (2ZE) of the third channel 3 (3K) receives a logical "1", since the channel is turned off, with the specified storage element is in reset state.

Starting from the moment of switching on the first channel 1 (IK) t _{4, the} logical input "0" and the third channel 3 (1K) are sent to the third input of the element "AND-NO" 14 (AND-NO) of this channel from the sixth input (6 in). formed at the third output (3 out.) of the first channel 1 (1K), which is the direct output of the second storage element (2ZE) of the first channel 1 (1K). At the same time at the output of the element "AND-NO" 14 (AND-NOT), respectively, a logical "1" is formed at the third input of the second element "AND" 15 (2I) of the third channel 3 (3K). The second and fourth inputs of the second element "And" 15 (2I) of the third channel 3 (3K) logical "1" are received from the inverse outputs of the first 10 (1ЗЭ) and the third 16 (3ЗЭ) storage elements of the third channel 3 (3К) as indicated items are in reset state. At time t _{7, the} pulse, from the output of the fourth delay element 21 (4EZ), goes to the fifth input (5 in.) Of the third channel 3 (3K), respectively, to the fifth input of the first element "And" 13 (1I) of the third channel 3 (3K ). Since logical “1” elements are formed at the inputs from the first to the fourth of the second element “AND” 15 (2I), a control pulse with a duration Δt _KI passes to the output of the first element “AND” 13 (1I) of the third channel 3 (3K) and then to the second input installation of the second storage element 12 (2ZE) of the third channel 3 (3K), with the result that the specified storage element is set to the logical state "1". The specified logical "1" is fed to the second, control, input of switch 4 (CT), while the current arriving at its first input from the eighth input of the device (Bx.8), respectively, from the first input (1 in.) Of the third channel 3 ( 3K) then goes through the current sensor 5 (DT) to its output, respectively, to the first output (1 out.) Of the third channel 3 (3K) which is the third output of the device (3 out.).

Starting from the moment t ₄ to the moment t ₈ from the inverse output of the first storage element 10 (1ZE) of the first channel 1 (1K), during the delay time caused by current overloads Δt _ПТ , the logical "0" goes to the second input of the first element 13 "And "(1I) of the first channel 1 (1K). At the same time, pulses are blocked for setting the second storage element 12 (2ЗЭ) of the first channel 1 (1K) to the logical “1” state, that is, turning on the switch 4 (CT) of the first channel 1 (1K). At time t _8, the delay due to congestion poi current Δt _Fr at the output of the first delay element 9 (1EZ) of the first channel 1 (1 K) is generated pulse which is supplied to the first reset input of the first memory element 10 (1ZE) of the first channel 1 (1 K), while at its inverse output a logical “1” is formed, which allows the formation of a pulse at the output of the first element “AND” 13 (1I) of the first channel 1 (1K), that is, it allows the inclusion of the first channel 1 (1K) if the third input will be formed logical "1" in the case, for example , The second tripping 2 (2K), or a third 3 (3K) channel.

FIG. 5 shows a cyclogram of the countering of failures of the channels of the electronic unit, in case of the termination of the comparison of the information received at the seventh (Bx.7) and eighth (Bx.8) inputs of the device. Legend in figure 5:

Δt _IP - the duration of the delay due to the failure of information

U I _{6 (K1)} , the voltage at the sixth input of the first channel (6 I),

U _{3ЗЭ (К1)} , - voltage at the inverse output of the third storage element 3ЗЭ of the first channel 1 (1К),

U _Vyh..bk - output voltage (Vyh bk) of the control unit (VC),

_{UIn.6 (K1)} , _{UIn.3 (K1} U _{In.4 (K1)} ,) - respectively, the voltage at the sixth (6 in.), The third (3 in.) And fourth (4 in.) Inputs of the first channel 1 (1K),

t ₉ - the time of the beginning of the failure of information coming from

the first and second channels to the inputs of the second comparison element

18 (2ES) in the first channel 1 (1K) of the device,

t ₁₀ - the moment of disconnection of the first channel 1 (1K) of the device,

t ₁₁ - the moment of switching on the third channel,

t ₁₂ - the end of the delay due to the failure of information.

Up to the moment t ₉ , the first 1 (1К) and second 2 (2К) channels of the device are turned on, while the monitoring is carried out using codes from the seventh (Bx.7) and eighth (Bx.8) inputs of the device, information from which is received, respectively , to the seventh inputs (7 in.), respectively, of the first 1 (1K) and second 2 (2K) channels. Further, information from these inputs goes, respectively, to the first and second inputs, the second comparison element 18 (2ES) of the first channel 1 (1K), on the inverse output of which, in the case of its comparison, a logical "0" is formed. The fourth input of the second element "And" 15 (2I) of the first channel 1 (1K), the logical "1" comes from the second, direct output of the second storage element 12 (23E) since the first channel 1 (1K) is on. To the third input of the second element “And” 15 (2I) of the first channel 1 (1K) logical “1” comes from the sixth input (6 in.) Of the first channel 1 (1K), since information from the third output (3 O.) the second channel 2 (2K), which is the second direct output of the second storage element 12 (2ЗЭ) of the second channel 2 (2K), since the specified channel is included. Starting from the moment t ₉ , the information received at the seventh (Bx.7) and eighth (Bx.8) information inputs of the device differ, and the logical “1” is formed at the inverse output of the second comparison element 18 (2ES) of the first channel 1 (1K) which arrives at the sixth input of the second element “And” 15 (2I) of the first channel 1 (1K), and at its fifth input receives a logical “1” from the output of the first comparison element 7 (1ES) of the first channel 1 (K 1), so as overcurrent in the first channel 1 (1 K) is missing.

At the first input of the second element "And" 15 (2I) of the first channel 1 (1K) logical "1" comes from the fourth input (4 in.) Of the first channel 1 (1K), which is formed at the output (Output bk) of the control unit 19 (BC), since the contents of the counter 25 (MF) of the specified block does not exceed the threshold value supplied to its fourth input (4 inlet bk), respectively, to the fifth input of the device (I.5).

At the third input of the second element "And" 15 (2I) of the second channel 2 (2K), a logical "0" comes from the sixth input (6 in.) Of the second channel 2 (2K), since information from the third output (3 OUT.) of the third channel 3 (3K), which is the second, direct output of the second storage element 12 (2pЭ) of the third channel 3 (3K), since the specified channel is disabled.

Starting from the moment t _{9, the} codes arriving at the seventh (Bx.7) and eighth (Bx.8) inputs of the device, respectively, to the first and second inputs of the second comparison element 18 (2ES) of the first channel 1 (1K) are different. At the inverse output of the second comparison element 18 (2ES) of the first channel 1 (1K) a logical “1” is formed, which is fed to the sixth input of the second element “I” 15 (2I) of the first channel 1 (1K).

At time t ₁₀ , to the sixth input of the device (Bx.6), respectively to the fifth input (5 in.) Of the first channel 1 (1K) and then to the second input of the second “I” 15 (2I) of the first channel 1 (1K) receives control pulse Δt _CI Given that the remaining inputs of said element formed logical "1" pulse from the output of the second element "I" 15 (2I) of the first channel 1 (1 K) is input to the second delay element 17 (2EZ), duration wherein Δt _IP defined by the formulas (4) and fed to a first input of a third memory element Fitting 16 (3ZE) of the first kana 1 and (1K), the second input of the first element "OR" 11 (1or) and the second output (O 2.) of the first channel 1 (1 K). At the same time, on the inverse output of the third storage element 16 (3EZ) of the first channel 1 (1K) a logical "0" is formed, which is fed to the fourth input of the second element "I" 15 (2I) of the first channel 1 (1K) and, thus, blocks the formation of a logical "1" at its output from the time t ₁₀ during the delay time Δt of the _IC due to the failure of information, that is, to the time t ₁₂

From the output of the first element "OR" 11 (1IL) of the first channel 1 (1K) at time t _{10 a} pulse arrives at the first reset input of the second storage element 12 (2ЗЭ) of the first channel 1 (1K) and resets it on the leading edge, while the switch current 4 (CT) opens the current coming from the first input (Vx.1) to the first output (Vych.1) of the device.

After a time Δt _3EZ after time t ₁₀ , from the output of the third delay element 20 (3EZ), the pulse arrives at the fifth input (5 in.) Of the second channel 2 (2K) and, accordingly, to the second input of the first element "And" 13 (1I) second channel 2 (2K).

The formation of a pulse at the output of the second element "And" 15 (2I) of the second channel 2 (2K) is blocked by a logical "0" arriving at its first input from the first, inverse output of the second storage element 12 (23E) of the second channel 2 (2K), since The specified channel is enabled.

Up to the moment t _{11 the} logical input "1" is fed from the inverse output of the second storage element 12 (23E) of the third channel 3 (3K) to the first input of the second element "And" 15 (2I) of the third channel 3 (3K), as it is in the reset condition, that is, the channel is disabled. The third input element "AND-NOT" 14 (AND-NOT) of the third channel 3 (3K), which is the fifth input (5 in.) Of the third channel 3 (1 K), starting from the moment t ₁₀ receives a logical signal "0" from the third output (3 out.) of the first channel 1 (1K), which is the direct output of the second storage element (2ЗЭ) of the first channel 1 (1 К), therefore at the output of the AND-NO element 14 (AND-NOT), respectively , at the third input of the first element "And" 13 (1I) of the third channel 3 (3K) a logical "1" is formed. On the second and fourth inputs of the second element "And" 15 (2I) of the third channel 3 (3K) logical "1" comes from the corresponding inverse outputs of the first 10 (1ЗЭ) and third 20 (3ЗЭ) storage elements of the third channel 3 (3К) as These items are in the reset state.

At time t _{11 a} pulse, from the output of the fourth delay element 21 (4EZ) goes to the fifth input (5 in.) Of the third channel 3 (3K), respectively, to the fifth input of the first element "And" 13 (1I) of the third channel 3 (3K ). Since at the inputs from the first to the fourth of the first element "And" 13 of the third channel 3 (3K), logical "1" pulses are generated at its output and then it goes to the second input of the installation of the second storage element 12 (2ЗЭ) of the third channel 3 (3K), which is set to the logical state "1". When switch 4 (CT) of the third channel 1 (1K) supplies current from the third input (Bx.3), to the third output of the device (Output 3), that is, the third channel is turned on.

Starting from the time t ₁₀ to the time t ₁₂ at the inverse output of the first storage element 10 (1ZE) of the first channel 1 (1K), a logical "0" is formed during the delay time due to the failure of information Δt _IC , which is fed to the fourth input of the first element 13 " And ”(1I) of the first channel 1 (1K). At the same time, up to the moment t _{12, the} installation of the second storage element 12 (2ЗЭ) in the state of logical "1", i.e. the switching on of the switch 4 (CT) of the first channel, in the event of one of the other channels disconnecting, is blocked. At time t _{12 the} end of the delay due to the failure of information Δt _IC at the output of the second delay element 17 (2EZ) of the first channel 1 (1K) a pulse is generated, which is fed to the second reset input of the third storage element 16 (3ЗЭ) of the first channel 1 (1K), this logical “1” is formed at the inverse output of the specified storage element, which allows the formation of a pulse at the output of the first element “AND” 13 (1I) of the first channel 1 (1K), that is, it enables the inclusion of the first channel 1 (1K).

The cyclogram of the device operation when the counter exceeds the threshold control unit is shown in FIG. 6. The indications in FIG. 6:

t ₁₃ - the time of occurrence of the absence of comparison of information coming from the first and second channels to the inputs of the second comparison element 18 (2ES) in the first channel 1 (1K) of the device,

t ₁₄ - time off the first channel 1 (1K) device

t ₁₅ , t ₁₇ - respectively, the moments of the inclusion of the third 3 (3K) and the first 1 (1K) channels,

t ₁₆ - the end of the delay due to the failure of information.

Up to the moment t ₁₃ , the first 1 (1К) and second 2 (2К) channels of the device are turned on, while the control is carried out using codes received at the seventh (Bx.7) and eighth (Bx.8) information inputs of the device, information from which, the turn enters, respectively, the seventh inputs (7 in.) of the first 1 (1K) and second 2 (2K) channels, as well as the first and second inputs of the second comparison element 18 (2ES) of the first channel 1 (1K). At the same time on the inverse output of the specified element of comparison until the moment of the CS the logical "0" is formed. The fourth input of the second element "And" 15 (2I) of the first channel 1 (1K), the logical "1" comes from the second, direct output of the second storage element 12 (2ЗЭ) since this channel is on. At the third input of the second element “And” 15 (2I) of the first channel 1 (1K), a logical “1” is received from the sixth input (6 in.) Of the first channel 1 (1K), since information from the third output (3 O.) the second channel 2 (2K), which is the second, direct output of the second storage element 12 (2ЗЭ) of the second channel 2 (2K), which is included. At the first input of the second element "And" 15 (2I) of the first channel 1 (1K) logical "1" comes from the fourth input (4 in.) Of the first channel 1 (1K), which is formed at the output (Output bk) of the control unit 19 (BC), since the contents of the counter 25 (MF) of the specified block does not exceed the threshold value supplied to its fourth input (4 inlet bk), respectively, to the fifth input of the device (I.5).

Starting from the moment t ₁₃ , the information inputs of the seventh (Bx.7) and eighth (Bx.8) information inputs of the device begin to differ, and the logical “1” is formed at the inverse output of the second comparison element 18 (2ES) of the first channel 1 (1K). "Which goes to the sixth input of the second element" And "15 (2I) of the first channel 1 (1K), the fifth input of which receives a logical" 1 "from the output of the first comparison element 7 (1ES) of the first channel 1 (1K), since Overcurrent in the first channel 1 (1K) is not observed.

To the second input of the second element "And" 15 (2I) of the second channel 2 (2K) logical "0" comes from the sixth input (6 in.) Of this channel, since the specified input receives information from the third output (3 output) of the third channel 3 (3K), which is the second, direct output of the second storage element 12 (23E) of the third channel 3 (3K), since the specified channel is disabled.

Up to the moment t _14, from the output of the counter 25 (MF) of the control unit 19 (BC), the first input of the third comparison element 26 (3ES) receives a code that is less than the threshold value for the number of all channel inclusions in one reset time interval arriving at its second input. In this case, at the output (Out. Bq) of the control unit 19 (BK), which is the inverse output of the third comparison element, a logical “1” is formed, which arrives at the fourth inputs (4 in) of the first 1 (1K), second 2 (2K) and third 3 (3K) channels of the device, respectively, to the second inputs of the elements "AND-NO" 14 and to the first inputs of the second elements "AND" 15 (2I) of the indicated channels.

Starting from the moment t _{14, the} codes arriving at the seventh (Bx.7) and eighth (Bx.8) inputs of the device, respectively, to the first and second inputs of the second comparison element 18 (2ES) of the first channel 1 (1K) are different. At the same time on the inverse output of the specified element is formed a logical "1", which is fed to the sixth input of the second element "And" 15 (2I) of the first channel 1 (1K).

At time t ₁₄ , to the sixth input of the device (Bx.6), respectively, to the fifth input (5 in.) Of the first channel 1 (1K) which is the second input of the second element "And" 15 (2I) of the first channel 1 (1K) comes the control pulse Δt _KI . Due to the fact that logical “1” is formed at the remaining inputs of the specified element, the pulse from the output of the second element “AND” 15 (2I) of the first channel 1 (1K) is fed to the input of the second delay element 17 (2EZ), the second input of the installation of the third storage element 16 (3ЗЭ) of the first channel 1 (1К), the second input of the first element "OR" 11 (SHLI), and also the second output (2 outputs) of the first channel 1 (1К). At the same time, on the inverse output of the third storage element 16 (3EZ) of the first channel 1 (1K) a logical “0” is formed, which is fed to the fourth input of the first element “I” 13 (1I) of the first channel 1 (1K) and, thus, blocks the formation of a logical "1" at its output for the time delay due to the information failure Δt _IC to the moment t ₁₆ .

From the output of the first element "OR" 11 (1IL) of the first channel 1 (1K), a pulse arrives at the first reset input of the second storage element 12 (2ЗЭ) of the first channel 1 (1K) and resets it, while the current switch 4 (CT) opens the current coming from the first input (L.1) to the first output (V.1) of the device.

In addition, at time t _{14, the} impulse received at the second output of the first channel (2 outputs) 1 (1K) is fed to the first input of the control unit 19 (BK) and, respectively, to the first input of the second element "OR" 22 (2IL) said block, from the output of which the impulse goes further to the first inputs of the third 23 (3I) and fourth 24 (4I) “I” elements. Up to the moment t ₁₄ , a logical “1” is formed at the second inputs of these elements, which comes from the inverse output of the third comparison element 26 (3ES) of the control unit 19 (BC), since the code corresponding to the number of channel switchings arriving at its first input is less than the admissible number code repeated switching on of all channels after their disconnection, which comes to its second input, which is the fourth input (4 in. bk) of the control unit 19 (BC) and, accordingly, the fourth input (Vx.4) of the device. At the third input of the third element "And" 23 (3I) logical "0" comes from the inverse output of the fourth storage element 28 (4ZE), while at time t _{14 a} pulse from the output of the fourth element "And" 24 (4I) goes to the first , the counting input of the counter 25 (MF) and increases its contents by "1". Further, information from the output of the counter 25 (MF) arrives at the first input of the third comparison element 26 (3ES), as a result of which the contents of the counter 25 (MF) reaches a value equal to the number of channel switchings received at its first input, while the inverse output of the third Comparative element 26 (3ES) is set to a logical "0", which enters the output (Output bk) of the control unit 19 (BK) and then to the fourth inputs (4 in.) first 1 (1K), second 2 (2K) and third 3 (3K) channel device.

After a time Δt _3EZ after time t ₁₄ , from the output of the third delay element 20 (3EZ), the pulse arrives at the sixth input (6 in.) Of the second channel 2 (2K) and, accordingly, to the fifth input of the first element "And" 13 (1I) specified channel. The impulse at the output of the second element "And" 15 (2I) to the installation in a state of logical "1" of the second storage element 12 (2ЗЭ) of the second channel 2 (2K) is not generated, since it is blocked by a logical "0" coming to its first input from the first , the inverse output of the second storage element 12 (2ZE) of the second channel 2 (2K), since the specified channel is on.

Until ti _{5, the} logical input "1" is received from the inverse output of the second storage element 12 (2ЗЭ) of the third channel 3 (3K) to the first input of the second element "And" 15 (2I) of the third channel 3 (3K), since in the reset state, that is, the channel is disabled. To the third input of the element "AND-NO" 14 (AND-NO) of the third channel 3 (3K), which is the fifth input (5 in.) Of the third channel 3 (3K), starting from the moment t _{14 of} turning off the first channel 1 (1K) a logical signal “0” is received from the third output (3 out.) of the first channel 1 (1K), which is the second, direct output of the second storage element 12 (2ЗЭ) of the first channel 1 (1K). As a consequence, the output element "AND-NOT" 14 (AND-NOT) of the third channel 3 (3K), respectively, at the third input of the second element "AND" 15 (2I) of this channel is formed a logical "1". On the second and fourth inputs of the second element "And" 15 (2I) of the third channel 3 (3K) logical "1" are formed, which are received from the inverse outputs of the first 10 (1ЗЭ) and the third 16 (3ЗЭ) storage elements of the third channel 3 (3К) as the specified elements are in the reset state.

At time t _{15 a} pulse from the output of the fourth delay element 21 (4EZ) goes to the fifth input of the third channel 3 (K) and, accordingly, to the fifth input of the first element "I" 13 (1I) of the third channel 3 (K). Since at the inputs from the first to the fourth of the second element "And" 15 (2I) logical "1" are formed, the pulse arriving at t ₁₅ then goes to the output of the first element "And" 13 (1I) of the third channel 3 (3К) and, accordingly , to the second input of the installation of the second storage element 12 (2ZE) of the third channel 3 (3K). As a result, a logical “1” is formed at the second, direct output of the storage element 12 (2ZE) of the third channel 3 (3K), and a logical “0” at the inverse. At the same time, the current from the third input of the device (Dx.8), through the first input (1 in.) Of the third channel 3 (3K), respectively, from the first input of the switch 4 (CT) of the third channel 3 (3K), flows through the current sensor 4 (DT) of the specified channel, to the first output (1 out.) Of the third channel 3 (3K), respectively, to the third output of the device (Out. 3). In this case, power is supplied to the first channel of the EB.

Until ti6, the installation of the second storage element 12 (2ЗЭ) of the first channel 1 (1K) to the logical state "1", since switching on the switch 4 (CT) of the first channel 1 (1K) is blocked, since from the time t ₁₄ until the moment t ₁₆ at the inverse output of the first storage element 10 (1ZE) of the first channel 1 (1K), during the delay time due to the failure information Δt of the _IC , a logical "0" is formed, which is fed to the fourth input of the first element 13 "And" (1I) of the first channel 1 ( 1 TO).

At time t ₁₆ , the end of the delay due to the failure of information Δt _IC , at the output of the second delay element 17 (2EZ) of the first channel 1 (1K) a pulse is generated, which is fed to the first reset input of the third storage element 16 (3ЗЭ) of the first channel 1 (1K) , at the same time on the inverse output of the specified storage element is formed a logical "1", which is fed to the fourth input of the first element "And" 13 (1I) of the first channel 1 (1K). Thus, the second, first and fourth inputs of the first element "And" 13 (1I) of the first channel 1 (1K), receive logical "1" from the inverse outputs of the first 10 (1ЗЭ), the second 12 (2ЗЭ) and the third 16 (3ЗЭ ) storage elements, respectively. To the third input of the first element “AND” 13 (1I) the logical “1” comes from the output of the element “AND-NO” 14 (AND-NO) of the first channel 1 (1K), since at its second input a logical “0” is formed from the fourth input (4 in.) of the specified channel from the output of the control unit 17 (BC). At time t ₁₇ , the pulse formed at the sixth input of the device (Vx.6) goes to the fifth input (5 in.) Of the first channel 1 (1K) and then to the fifth input of the first element "And" 13 (1I) of the first channel. Then, the output of the first element "And" 13 (1I) of the first channel 1 (1K), a pulse arrives at the second input of the installation of the second storage element 12 (2ZE) of the first channel 1 (1K), and sets it to the logical state "1", with this switch current 4 (CT) supplies the current from the first input (Bx1) of the device to its first output (Vl.1), that is, the first channel 1 (K1) is switched on.

This method is advisable to use in systems in which the interruption of control is not allowed, for example, when controlling engines for stabilization and orientation of the spacecraft. The use of this method of parrying failures in the channels of the redundant electronic unit of the spacecraft arising due to the influence of various external influencing factors can improve the fault tolerance and reliability of the onboard electronic equipment of the spacecraft as a whole.

Information sources:

1. The patent of the Russian Federation 2 599 089, 07/08/2015, NC 03/17 (2006/01).

Claims (29)

1. The method of protection against failures and failures of the electronic unit of the spacecraft caused by external influencing factors, which consists in collecting information on the status of the channels of the three-channel backup electronic unit by the diagnostic system of the spacecraft, determine the maximum possible current that each channel of the three-channel can consume redundant electronic unit, as well as the allowable number of repeated inclusions of the electronic unit, at which it saves the work ability, set the threshold value of the current of one channel of the electronic unit, measure the consumption currents of each channel of the electronic unit, turn off the channel, the current consumption of which exceeds the threshold current value, and start the countdown of the switch-on delay when the current is overloaded, determine the period of rotation of the spacecraft around the Earth, break it into fixed time intervals, which are determined by the orientation of the spacecraft relative to the Sun and the planets, as 1≤N _And ≤100, where N _I is the number of time intervals into which the period of rotation of the spacecraft around the Earth is divided, set the reset time interval, set the threshold value of the number of electronic unit channel inclusions in one reset time interval, multiple of three, rounded down to an integer in the range

, where N _P - the threshold value of the number of inclusions of all channels on the same time interval reset, N _D - the permissible number of repeated switch-ons of the electronic unit, at which it remains operable,

- sign of rounding down to the integer, set the threshold value of the delay for switching on the channel in case of current overload, set the threshold value for the number of switching on the electronic unit channels in one reset time interval, characterized in that they determine the limiting currents at which the electronic unit channels remain operable, set the threshold value of the single channel electronic current block range I _MAX ≤I _P <I _OL, where I _MAX is the maximum possible current that each channel of the electronic unit can consume during operation as part of the spacecraft, I _PR - the current limit at which the channels of the electronic unit remain operable, I _P - the threshold value of the current in the channel of the electronic unit, determine the minimum delay times at the end of which it is possible to turn on the channel of the electronic unit after it is turned off in the absence of overcurrent, while setting the appropriate values of switching delays in the ranges Δt _MINT <Δt _PT <2⋅Δt _MINT , Δt _MIN <Δt _IC <Δt _PT , where Δt _MINT is the minimum time at which the channel of the electronic unit is allowed to turn on after it is turned off in the presence of overcurrent, Δt _ПТ - delays for switching on the channel in case of overcurrent, Δt _MIN - the minimum time at which the inclusion of the channel of the electronic unit is allowed after it is turned off in the absence of current overloads, Δt _IC is the delay for turning on the channel in case of an information failure; set the reset time interval in the range

where Δt _C is the time interval of the reset, T _KA - the period of revolution of the spacecraft around the Earth, in the electronic unit channels, the codes from the diagnostic control and control system are converted into the corresponding onboard system control commands, the monitoring period is set as T _K <0.1⋅Δt _IC , where T _K - the period of control, in addition, in the channels of the electronic unit, the signals generated by the onboard system are simultaneously converted into codes that are polled at each monitoring period, in case there is no failure signal and two channels are included, the polled codes from the first and second, second and third or the third and first channels of the electronic unit, if the specified codes differ, turn off, respectively, the first, second or third channel, starting from the moment the channel is turned off, count down for it the switch-on time channel channel in case of information failure, while at the moment of channel disconnection, the calculated number of channel inclusions is increased by one, if there is no failure signal and the number of included channels is no more than one, and if there is a failure signal - no more than two, turn on the current or subsequent monitoring periods for which there is no counting of both delays, at the moment when the reset time interval ends, the counted number of electronic unit channel inclusions is reset, if it does not reach the threshold value, and if ostizheniya threshold form of system failure signal is stopped by disabling channels absence polled compared codes. 2. Protection device against failures and failures of the electronic unit of the spacecraft, caused by external influencing factors, containing the first, second and third channels that are identical, each channel contains a current switch, the first input of which is the first input of the channel, and the output is connected to the input current sensor, the first output of which is the first output of the channel, and the second output is connected via an analog-digital converter with the first input of the first comparison element, the second input of which is the second input of the channel , characterized in that the first direct output of the first comparison element is connected to the input of the pulse shaper, the output of which is connected via the first delay element to the first reset input of the first storage element, as well as directly to its second setting input and to the first input of the first OR element, the output of which is connected to the first reset input of the second storage element, the first inverse output and the second installation input of which are connected, respectively, with the first input and output of the first element "I", the second and third the turns of which, in turn, are connected, respectively, with the inverse output of the first storage element and the output of the AND-NOT element, the first input of which is the third and the second input is the fourth input of the channel and is connected to the first input of the second And element, output which is the second output of the channel and connected to the second input of the first OR element, to the first installation input, and through the second delay element to the second reset input of the third storage element, the inverse output of which is connected to the fourth input of the first The “AND” element, the fifth input of which is the fifth input of the channel and connected to the second input of the second element “AND”, the third input of which is the sixth input of the channel and connected to the third input of the element “AND-NOT”, the fourth input of the second element “AND” is the third output of the channel, and also connected to the second direct output of the second storage element and connected to the second input of the current switch, the fifth and sixth inputs of the second element "And" are connected, respectively, to the second inverse output of the first comparison element and to the inverse output the second comparison element, the first and second inputs of which are, respectively, the seventh and eighth channel inputs, while the first inputs and the first outputs of the first, second and third channels are, respectively, the first, second and third inputs and the first, second, third outputs of the device , the second inputs of all specified channels are interconnected and are the fourth input of the device, and the second outputs of the first, second and third channels are connected, respectively, with the first, second and third inputs of the control unit, the fourth input It is the fifth input of the device, and the output is connected to the fourth, interconnected, inputs of all specified channels and is the fourth output of the device, while the third input of the first channel is connected to the sixth input of the second channel and the third output of the third channel, the third input of which is connected to the sixth the input of the first channel and the third output of the second channel, the third input of which is connected to the sixth input of the third channel and the third output of the first channel, the fifth input of which is the sixth input of the device and connected through the third element Support with the fifth input of the second channel and the input of the fourth delay element, the output of which, in turn, is connected to the fifth input of the third channel, while the seventh input of the first channel is the seventh input of the device and is connected, with the eighth input of the third channel, the seventh input which is the ninth input of the device and is connected with the eighth input of the second channel, the seventh input of which is connected with the eighth input of the first channel and is the eighth input of the device. 3. The device according to p. 2, characterized in that the control unit contains the second element OR, the first, second and third inputs of which are, respectively, the first, second and third inputs of the control unit, and its output is connected with the first inputs of the third and fourth elements "And", the output of the latter is connected with the first counting input of the counter, the output of which, in turn, is connected to the first input of the third comparison element, the second input of which is the fourth input of the control unit, and the inverse output, which is the output of the control unit, En with the second inputs of the third and fourth elements "And", as well as the first input of the fifth element "And", the output of which, in turn, is connected to the second reset input of the counter and the first reset input of the fourth storage element, the inverse output of which is connected to the third input the third element "And", and the second input is connected to the output of the third element "And", and through the fifth delay element - to the second input of the fifth element "And".

Images