The present application claims priority under 35 U.S.C. §119 to German Patent Application No. 10 2012 009 513.9, filed May 14, 2012, the entire disclosure of which is herein expressly incorporated by reference.
The invention relates to a multifunctional controller for a satellite.
In satellite technology, key components pertaining to control and safety on board a satellite are generally designed in a redundant manner to prevent a total failure of the satellite should a module or components fail. The internal components in the onboard computer (OBC) and in the power control and distribution unit (PCDU) of a satellite are therefore designed in a particularly redundant manner since a component failure in these units can result in the total malfunction of the satellite.
The OBC controls important functions of the satellite and runs the onboard software (OBSW) to do so. It receives the required commands for this via ground-based radio via an antenna and transceiver and a decoder board that transforms the digital signals of the transceiver back into data packets and forwards them to the OBSW on the CPU of the OBC (cf.
In addition, the PCDU and the OBC are the high-availability components on board of each satellite. The current control and emergency shutdown of equipment must function in every fault incident. The automatic power supply to the OBC and the booting of the OBC must also function reliably after a voltage loss in the satellite as soon as the satellite receives enough power again from the solar panels in the sun-phase of the orbit. In the OBC, it must be possible in all cases, including after a software crash or hardware failure of a component, e.g., CPU, data bus controller, or memory board, to switch over to the corresponding redundant component.
To enable these switchovers, all of the internal OBC constructional components are each wired in a cross-wise manner (also known as cross-coupling) so that, e.g., CPU A can serve both data bus controllers A and B and both memory modules Memory A and B (cf. again
Within the OBC and the PCDU the reconfiguration units and the PCDU controllers are two key elements for emergency operation input commands issued from the ground. The reconfiguration units execute the redundancy switchovers in the OBC. To do so, they must receive the corresponding commands. These can come from the OBSW if it has detected errors (cf. dashed line connections between the CPUs and reconfiguration units in
In this way, the OBC and PCDU have three standardized types of interfaces: data bus connections, power connections from the PCDU to the OBC, and the so-called CPDU emergency command lines from the OBC to the PCDU.
However, the implementation outlay for the required division of functions of the components involved in the reconfiguration is high. In addition, the test outlay increases since each of these high-reliability components must be subjected to time-consuming tests. Therefore, one of the problems addressed by the present invention involves a lower cost arrangement.
The multifunctional controller according to the present invention combines the two highly critical components, namely the reconfiguration unit and the PCDU controller for controlling and distributing power to satellite components, in a single chip, whereby the implementation costs for a satellite control and safety device can be reduced. By combining these two units, the module described as a combined controller in
The multifunctional controller can be implemented as an Application Specific Integrated Circuit (ASIC) or Field-Programmable Gate Array (FPGA). The multifunctional controller generally requires lower design and test costs than a solution consisting of individual components as is used in conventional satellites, since only one ASIC or FPGA module must be developed or only one firmware must be developed for a microcontroller. Accordingly, the component testing expenses also decrease. In addition, complex system tests for the interaction of the two units combined in the multifunctional controller can be simplified.
An embodiment of the invention is directed to a multifunctional controller for a satellite that has the following: a reconfiguration unit or reconfiguration functions for reconfiguring components of the onboard computer and/or turning off electrical loads of the satellite in the event of a fault, and a unit for controlling and distributing power to satellite components or control functions for controlling the distribution of energy to satellite components.
The reconfiguration functions can also allow one to trigger power resets and/or soft reset commands for reconfiguring components of the onboard computer and issue them to the corresponding components. Soft resets are issued to CPUs.
The multifunctional controller can—like a typical reconfiguration unit—have inputs for triggering reconfiguration functions when receiving corresponding commands. For example, via these inputs, trigger signals from the onboard computer can be received by means of which the onboard computer requests certain modules to be reconfigured, for example in the event of a sporadic interruption of a bus controller or the switchover to a redundant module when a module, such as a memory module, is functioning incorrectly.
Furthermore, the controller can have and implement inputs for monitoring signals from the onboard computer to execute a reconfiguration of the corresponding components of the onboard computer when a monitoring signal is missing. The monitoring signals may originate from watchdog circuits that are, for example, integrated in modules and components of the onboard computer and monitor their function.
To do so, the watchdog circuits transmit monitoring signals when modules or components function error-free. If no cyclic monitoring signal from a certain component is received by the controller, the reconfiguration unit can identify the corresponding components and initiate reconfiguration tailored to these components via a corresponding signal that is issued to the affected components.
In addition, the controller can have inputs for commands from decoder modules for the hardware reconfiguration of the onboard computer and/or the emergency shutdown of electrical loads of the satellite and/or electrical switchovers. These inputs can be designed in such a manner that, for example, they forward these commands directly to the controller, which then, for example, triggers a hardware reconfiguration of the onboard computer and/or actuates the unit for controlling and distributing energy in such a way that it executes an emergency shutdown for corresponding electrical loads to conserve the electrical power supply pertaining to satellites.
Lastly, the typical function of a PCDU controller to monitor components regarding the electrical power supply of the satellite can be implemented in the combined controller to turn off electrical satellite components receiving a shortage of electrical energy as detected by the monitoring system and/or after such a shutdown, to successively supply satellite components with electrical energy when the monitoring system determines there is sufficient power. To this end, the combined controller may have inputs for monitoring the components for supplying electrical power to the satellite and be designed in such a way to turn off electric satellite components when monitoring determines there is an insufficient supply of electrical energy and/or after such a shutdown, to successively supply satellite components with electrical energy when the monitoring system determines there is sufficient power.
For example, electrical voltages may be monitored by electrical energy sources such as a solar panel and/or a battery of the satellite. If monitoring determines that the supply of electrical energy is no longer sufficient for the satellite components, some or all satellite components may be turned off. After a failure of the power supply in the satellite, for example when it is in the shadow of the Earth and the battery energy is no longer sufficient for the power supply, successive satellite components can be placed back into operation upon exceeding a certain voltage threshold when, for example, the satellite re-emerges out of the shadow of the Earth—preferably the controller first, then the onboard computer, satellite position control devices and so on.
Also belonging to the functionality of a conventional PCDU controller according to
The combined controller can be optionally integrated in the OBC, in the PCDU, or even in a separate housing. The outlay for the wiring between the OBC and PCDU is practically minimal if the integration takes place in the PCDU, which is why this is also depicted in such a manner in
In a conventional OBC/PCDU architecture according to
Another embodiment of the invention relates to a constructional component pair consisting of the OBC and PCDU for issuing commands to a satellite and the control of its energy supply with
Lastly, an embodiment of the invention relates to an OBC/PCDU combination with such a combined controller, in particular for miniature satellites, for controlling the functions of the satellite, for supplying electrical energy to the electrical loads of the satellite, for controlling the supply of electrical energy in a satellite, and for monitoring the satellite onboard computer according to the invention and as described above.
Another embodiment of the invention relates to a satellite, in particular a miniature satellite, with a transceiver for receiving signals via radio, an onboard computer for controlling functions of the satellite, a solar panel for supplying electrical energy to electrical loads of the satellite, a battery for supplying electrical energy to the electrical loads of the satellite, and a device for commanding the satellite and controlling its energy supply according to the invention and as described above.
Additional advantages and application possibilities of the present invention emerge from the following description in connection with the embodiments depicted in the drawings.
The terms and assigned reference signs provided in the list of reference signs cited at the end are used in the description, the claims, the abstract, and the drawings:
In the following description, identical, functionally identical, and functionally related elements may be furnished with the same reference sign. Absolute values hereafter are provided only for example purposes and shall not be understood as limiting the invention.
The OBC and PCDU are key components for the control and safety on board of a satellite. Therefore, all components in conventional satellites are each designed in a redundant manner and cross-coupled within the OBC and PCDU.
For example within the OBC, process module CPU A can be operated with memory module Memory A or B. In the standard configuration, the A modules are generally used. Of the submodules in the OBC, the most important types are listed in
In the following description, it is now assumed that only A modules will be used. For example, to start up a payload, such as spacecraft equipment 1 (SC Equipm. 1), the satellite receives commands on a transceiver via radio that are decoded in the decoder/encoder board A, with normal commands being forwarded to the OBSW, which is executed by CPU A, on the processor board of the OBC.
The OBSW initially actuates the active PCDU controller PCDU Ctrl A of the PCDU by means of data bus controller Bus Ctrl A and the data bus controlled by the data bus controller to supply the aforementioned payload spacecraft equipment 1 with electricity from the solar array or the battery.
According to the actuation, PCDU controller PCDU Ctrl A closes the LCL/FCL switch on each active power bus Pwr Bus A so that SC Equipm. 1 is supplied with electrical energy from the solar array or the battery via the power electronics module. Only then can the payload SC Equipm. 1 payload itself be commanded by the OBC via bus controller A. The OBSW delivers telemetry of the payload back to the active encoder decoder/encoder board A to transmit it with the transceiver via radio signals back to earth.
The functions of the decoder/encoder boards A and B, the reconfiguration units A and B, and the PCDU controllers A and B are described below in the event of a malfunction on board the satellite for various types of malfunctions:
Malfunction Type 1: Malfunctions that the Operating OBSW of the Satellite can Identify:
Malfunction Type 2: Crash of the OBSW—Auto-Reconfiguration:
Malfunction Type 3: Crash of the OBSW—Reconfiguration from the Ground:
Malfunction Type 4: Power Shortage in the Satellite:
From the preceding description, it becomes clear that the two component types, the reconfiguration units of the OBC and the PCDU controllers, are extremely critical structural elements in relation to the correct functioning and reconfiguration of the satellite in the event of a malfunction. In the event of a malfunction, the mission of the satellite depends on the 100-percent functioning of these two components. Both component-types are therefore usually implemented in satellites without their own software as FPGA or directly as ASIC modules. However as a result, a large outlay for testing independent modules and also for system tests for their smooth interaction in all situations is required.
To decrease the implementation- and test-related outlay, these two components can be combined into a single component, a multifunctional controller that combines implementation of an OBC reconfiguration unit and a PCDU controller. The thusly created multifunctional controller can be installed in the PCDU housing or OBC housing, in a separate housing, or both units (PBC and PCDU) are combined with the multifunctional controller into a common unit in one housing.
Inputs 20 are provided for triggering reconfiguration functions when receiving corresponding commands such as the high-priority command (cf. malfunction-type 1 above) and ensure that reconfiguration functions 12 initiate a reset of one or more OBC components via reset output 30 and if applicable also a hardware switchover to redundant OBC components via the current switching functions.
Inputs 22 are provided for monitoring signals from the OBC such as watchdog signals (see malfunction-type 2 above) and, when a monitoring signal is absent, they serve to execute a reconfiguration of the corresponding components of the OBC by issuing corresponding signals to outputs 30 and 32.
Inputs 24 are provided for commands from decoder modules for the hardware reconfiguration of the OCB and/or emergency shutdown of electrical loads of the satellite and/or electrical switchovers, as well as the special high-priority commands from the ground (see malfunction type 3 above) and serve to trigger a hardware reconfiguration of OBC components or initiate a reboot of the OBSW by issuing corresponding signals to outputs 30 and 32. Furthermore, by means of data coming in through inputs 24 via current switching functions 14, an emergency shutdown of loads and, if necessary other electrical switchovers, can be executed by issuing corresponding control signals at output 32. In doing so, the commands at inputs 24 no longer have to be implemented as analog pulse commands, as is normally required in a design with the reconfiguration unit and the PCDU controller as independent modules. The signal-types on inputs 24 can be forwarded directly in a digital form from the decoder board to the multifunctional controller.
The current regulation and switching functions also take over the typical PCDU function of monitoring the electric power supply of the satellite (see malfunction type 4 above) and serve to turn off satellite components in the event of insufficient electrical energy and/or supply satellite components with electrical energy by issuing corresponding control signals at output 32, as soon as a sufficient supply of electric energy prevails in the satellite (for example, when, after a complete blackout of the electrical energy supply in the earth's shadow, the solar panel supplies sufficient electrical energy once again).
In regard to the architecture of
The OBC reconfiguration takes place as normal by means of power resets or soft reset commands sent to the corresponding OBC submodules—now by the multifunctional combined controllers.
For example, each OBC decoder board A or B can be separately supplied with power from the combined controllers, every OBC core board A or B with CPU, PROM, RAM, clock module, data bus and/or every I/O module A or B, and so on. The seemingly additionally created electrical switching outlay in the PCDU was hidden in the architecture of the OBC from
The function of the multifunctional controllers in the various malfunction instances explained above is now as follows:
A few advantages offered by the concept of combining the OBC reconfiguration unit and the PCDU controller, are listed briefly below:
The foregoing disclosure has been set forth merely to illustrate the invention and is not intended to be limiting. Since modifications of the disclosed embodiments incorporating the spirit and substance of the invention may occur to persons skilled in the art, the invention should be construed to include everything within the scope of the appended claims and equivalents thereof.
Number | Date | Country | Kind |
---|---|---|---|
10 2012 009 513 | May 2012 | DE | national |
Number | Name | Date | Kind |
---|---|---|---|
4654846 | Goodwin | Mar 1987 | A |
5502812 | Leyre et al. | Mar 1996 | A |
6137171 | Joshi | Oct 2000 | A |
20080297120 | Potter et al. | Dec 2008 | A1 |
20130185460 | Bobak | Jul 2013 | A1 |
Number | Date | Country |
---|---|---|
698 33 273 | Sep 2006 | DE |
Number | Date | Country | |
---|---|---|---|
20130299642 A1 | Nov 2013 | US |