Spacecraft autonomous redundancy control
First Claim
1. A method for providing on-board a spacecraft autonomous redundancy control to perform automatic fault detection and to automatically reconfigure a spacecraft system where that system includes primary sensors and primary controls, redundant sensors and redundant controls, data processor units for handling sensor and control data and input/output circuits between the sensors and the controls and the data processor comprising the steps of:
- automatically testing said primary sensors and primary controls at a primary processor unit,automatically disconnecting said primary sensor or primary control from said input/output circuit and connecting up said redundant sensor or redundant control upon detection at said primary processor unit of errors from said sensor or control exceeding a predetermined threshold,automatic testing of the switched redundant sensor or control at said primary processor unit, andautomatically disconnecting a first input/output circuit and connecting a second redundant input/output circuit between said connected redundant sensor or control and said primary data processor unit if after connecting said redundant sensor or control the errors tested at the processor unit continue to exceed said threshold.
4 Assignments
0 Petitions
Accused Products
Abstract
The spacecraft system has automatic fault detection and autonomous reconfiguration of redundant hardware and software to correct that fault without ground station intervention. The spacecraft has redundant processors, sensors, control systems and buses. When a unit is believed to have failed as detected by the satellite processor unit, it switches to a backup unit. If the symptom persists after the unit is switched, the processor unit switches to a different bus. If the fault still exists, a new processor unit is switched in and the entire checking and switching repeats.
-
Citations
7 Claims
-
1. A method for providing on-board a spacecraft autonomous redundancy control to perform automatic fault detection and to automatically reconfigure a spacecraft system where that system includes primary sensors and primary controls, redundant sensors and redundant controls, data processor units for handling sensor and control data and input/output circuits between the sensors and the controls and the data processor comprising the steps of:
-
automatically testing said primary sensors and primary controls at a primary processor unit, automatically disconnecting said primary sensor or primary control from said input/output circuit and connecting up said redundant sensor or redundant control upon detection at said primary processor unit of errors from said sensor or control exceeding a predetermined threshold, automatic testing of the switched redundant sensor or control at said primary processor unit, and automatically disconnecting a first input/output circuit and connecting a second redundant input/output circuit between said connected redundant sensor or control and said primary data processor unit if after connecting said redundant sensor or control the errors tested at the processor unit continue to exceed said threshold. - View Dependent Claims (2)
-
-
3. A spacecraft autonomous redundancy control system for providing fault detection and automatically reconfiguring a spacecraft system comprising:
-
first input/output bus and second input/output bus; a plurality of spacecraft subsystems, each subsystem comprising a primary unit, a redundant unit, and a unit multiposition switch coupled between said primary unit and redundant unit and said first bus and said second bus such that the output from said primary unit is applied to said first bus in response to a first control signal, the output from said redundant unit is applied to said first bus in response to a second control signal and the output from said redundant unit is applied to said second bus in response to a third control signal; and a processor unit, said processor including means for testing for errors in the received signals from said subsystems for providing said first, second and third control signals in the following order; (1) initially providing said first control signal to all of said subsystem unit switches and testing for error signals received from said subsystems, (2) when the errors from any one of said subsystems exceeds a selected threshold, providing said second control signal to said unit switch to switch in the associated redundant unit and thereafter further testing for the errors from said redundant unit, and (3) if the errors from the redundant unit continue to exceed said selected threshold, providing said third control signal to said unit switch to thereby switch the redundant unit through said second bus to said processor.
-
-
4. A spacecraft autonomous redundancy control system for providing fault detection and automatically reconfiguring a spacecraft system comprising:
-
first input/output bus and second input/output bus; a plurality of spacecraft subsystems, each subsystem comprising a primary unit, a redundant unit, and a unit multiposition switch coupled between said primary unit and redundant unit and said first bus and said second bus such that the output from said primary unit is applied to said first bus in response to a first control signal, the output from said redundant unit is applied to said first bus in response to a second control signal and the output from said redundant unit is applied to said second bus in response to a third control signal; a primary processor and a redundant processor; a system multiposition switch coupled between said primary processor and redundant processor and said first bus and said second bus for coupling said first bus to said primary processor unit in response to a fourth control signal, coupling said second bus to said primary processor in response to a fifth control signal and coupling said second bus to said redundant processor in response to a sixth control signal; said primary and redundant processors each including means for testing for errors in the received signals from said subsystems and means for providing said first, second, third, fourth, fifth and sixth control signals and a seventh control signal in the following order; (1) initially providing said first control signal to all of said subsystem unit switches, providing said fourth control signal to said system switch and testing for error signals received from said subsystems, (2) when the errors from any one of said subsystems exceeds a selected threshold, providing said second control signal to said subsystem unit switch to switch in the associated redundant unit to said first bus and thereafter further testing for errors from the redundant unit, (3) if the errors from the redundant unit continue to exceed said selected threshold, providing said third control signal to said unit subsystem switch and said fifth control signal to said system switch to thereby switch the redundant unit through said second bus to said primary processor, (4) testing the received signals via the second bus and if the errors continue to exceed said selected threshold, providing said sixth control signal to said system switch and said seventh control signal and then deactivating said primary processor; and said redundant processor being responsive to and activated upon receipt of said seventh control signal. - View Dependent Claims (5, 6, 7)
-
Specification