7.4 Design Methodology
243
Real-time operating system time slices were used for real-time scheduling of
control computer tasks. The synchronization between tasks of the CCU system software and the application software used time slices of the real-time operating system.
Each task was assigned one or several time slices. If the task did not exit normally
when it was timeout, the task was suspended and the CPU performs other tasks.
7.4.5 Autonomous Failure Diagnosis and Handling Logic
Design
1. Autonomous Failure Diagnosis and Handling Principles
Under normal circumstances, the purpose of autonomous fault diagnosis and
handling of GNC subsystem is to ensure that the critical tasks are completed on
schedule in the event of a single onboard failure and the spacecraft is safe (to ensure
power supply and prevent excessive fuel consumption). In combination with the
characteristics of the lunar lander, the fault handling of the GNC subsystem was
classified into two levels:
(1) Low level: component failure, including gyro failure, IMU circuit failure,
MRVS failure, Star Tracker Sensor failure, accelerometer failure, and LTU
communication failure;
(2) High level: Subsystem level faults, including unfinished subsystem functions
within a specified time, continuous overproof attitude within a specified time
period and continuous thrusters on within the specified time in the work mode.
In critical orbit maneuver phase, the principle of fault handling was to maintain the
status as much as possible. In the powered descent phase, due to the phase was
irreversible, the principle of fault handling was to ensure that the lunar lander could
be landed safely.
The fault diagnosis logic should be as simple and clear as possible to prevent
wrong judgment.
2. Components Autonomous Failure Diagnosis and Handling Methods
Gyro and accelerometer fault diagnosis principle was based on the number of work
gyros and accelerometers that appointed by telecommand to determine whether to
perform autonomous diagnosis.
Gyros and accelerometers that participated in the attitude determination were
selected according to the scores. Gyro and accelerometer scoring included: scoring
according to the consistency check results of six gyroscopes and accelerometers. The
three gyros and accelerometers with the highest scores participated in the attitude
determination and set the corresponding on-board gyro and accelerometer work status
words.
The principle of IMU circuit fault diagnosis was to eliminate gyro and accelerometer outliers output data caused by single event upset. Set the upper limit of the output
243
Real-time operating system time slices were used for real-time scheduling of
control computer tasks. The synchronization between tasks of the CCU system software and the application software used time slices of the real-time operating system.
Each task was assigned one or several time slices. If the task did not exit normally
when it was timeout, the task was suspended and the CPU performs other tasks.
7.4.5 Autonomous Failure Diagnosis and Handling Logic
Design
1. Autonomous Failure Diagnosis and Handling Principles
Under normal circumstances, the purpose of autonomous fault diagnosis and
handling of GNC subsystem is to ensure that the critical tasks are completed on
schedule in the event of a single onboard failure and the spacecraft is safe (to ensure
power supply and prevent excessive fuel consumption). In combination with the
characteristics of the lunar lander, the fault handling of the GNC subsystem was
classified into two levels:
(1) Low level: component failure, including gyro failure, IMU circuit failure,
MRVS failure, Star Tracker Sensor failure, accelerometer failure, and LTU
communication failure;
(2) High level: Subsystem level faults, including unfinished subsystem functions
within a specified time, continuous overproof attitude within a specified time
period and continuous thrusters on within the specified time in the work mode.
In critical orbit maneuver phase, the principle of fault handling was to maintain the
status as much as possible. In the powered descent phase, due to the phase was
irreversible, the principle of fault handling was to ensure that the lunar lander could
be landed safely.
The fault diagnosis logic should be as simple and clear as possible to prevent
wrong judgment.
2. Components Autonomous Failure Diagnosis and Handling Methods
Gyro and accelerometer fault diagnosis principle was based on the number of work
gyros and accelerometers that appointed by telecommand to determine whether to
perform autonomous diagnosis.
Gyros and accelerometers that participated in the attitude determination were
selected according to the scores. Gyro and accelerometer scoring included: scoring
according to the consistency check results of six gyroscopes and accelerometers. The
three gyros and accelerometers with the highest scores participated in the attitude
determination and set the corresponding on-board gyro and accelerometer work status
words.
The principle of IMU circuit fault diagnosis was to eliminate gyro and accelerometer outliers output data caused by single event upset. Set the upper limit of the output