Distributed dynamic backup servo control for satcom-on-the-move systems

This paper proposes a distributed control system for the servo control of the Satcom-On-The-Move (SOTM) systems. The servo control system is designed based on a distributed structure, which divides the control system into four sub-systems according to their functions. Each sub-system is equipped with a dedicated controller, and the controllers are connected to sensors and actuators via a bus. The control tasks of each sub-system are carried out by their respective controllers. To mitigate the impact of controller failures on the control system during running, a backup sub-system is implemented, which dynamically adjusts its function and state to ensure the normal running of the control system. An analysis of the impact of the switch to the backup sub-system on the stability of the control system under fault condition is presented. Finally, experimental analysis is conducted, and the results demonstrate the feasibility and effectiveness of the proposed design.


Introduction
Satellite Communication [1][2] [3] is a long-distance, wide coverage wireless communication mode with communication satellites as relays [4] [5] .Satcom-On-The-Move (SOTM) is a satellite communication technology designed for moving carrier application, especially suitable for ground, maritime, and airborne mobile carriers [6][7] [8] .SOTM systems are installed on ground vehicles, ships, aerial vehicles and other moving carriers.To achieve high-quality network communication in areas where the signal of Internet Service Providers (ISPs) is not available, the antenna of the SOTM system need to accurately point to the communication satellite to establish a stable and reliable communication link with the satellite.Most SOTM servo control systems are designed based on a centralized control structure [9] , where the servo control system contains a specific core unit acting as the system controller.This core unit executed all tasks of the control system, including signal conditioning, data processing, and control law calculation.In this control structure, the core controller bears a heavy burden.Additionally, if the core controller experiences a failure or damage, it will greatly impact the entire SOTM servo control system, potentially leading to the inability of the SOTM system to function.This paper proposes a distributed control structure [10][11] [12] for the SOTM systems.This control structure distributes the tasks traditionally executed by the core controller in the centralized control structure to the controllers of different sub-control systems, effectively reducing the burden on individual controllers.Additionally, the control system incorporates a backup sub-system that contains local backups of tasks from all other sub-systems.When a fault occurs in some sub-system of the Figure 1.Overview of the centralized control structure of the SOTM servo control.As shown in Figure 2 is the schematic diagram of the structure of the distributed SOTM servo control system.Different from the centralized control structure, the distributed SOTM servo control system structure does not possess a specific controller which acts as the core system controller.The distributed SOTM servo control structure comprises the management sub-system, azimuth subcontrol-system, pitch sub-control-system, roll sub-control-system, backup sub-system, and related sensors and actuators.The tasks executed by the core controller in the centralized control system structure are distributed among the management sub-system, azimuth control sub-system, elevation control sub-system, and roll control sub-system in the distributed control structure.All sub-systems, sensors, and actuators are connected via a bus for data transmission.In the distributed SOTM servo control system structure, the electronic compass, gyroscope, accelerometer, and GNSS send the carrier's attitude and location information to the management subsystem via the BUS.The tracking receiver sends the received satellite signal characteristics to the azimuth sub-control-system, pitch sub-control-system, and roll sub-control-system to form the azimuth control closed loop, pitch control closed loop, and roll control closed loop.The management sub-system calculates the carrier's location and attitude information based on the received accelerometer, gyroscope, electronic compass, and GNSS sensor data.It then integrates the target communication satellite location and altitude information to calculate the pointing information such as the azimuth angle and pitch angle of the SOTM antenna.In addition, the management sub-system monitors and analyzes the azimuth sub-control-system, pitch sub-control-system, roll sub-controlsystem, and backup sub-system, and performs the migration and scheduling of sub-control tasks.The backup sub-system possesses local backups of all tasks of the management subsystem, azimuth subcontrol-system, pitch sub-control-system, and roll sub-control-system.It changes its role and function according to the system status and the information sent by the management sub-system.An important feature of the distributed backup scheme is that the scheduling of the backup subsystem is dynamic.The detailed dynamic backup scheme is presented in the next section.

The dynamic backup scheme
For the distributed SOTM servo control system structure proposed in this paper, the azimuth subcontrol-system, pitch sub-control-system, roll sub-control-system, and the backup sub-system periodically send their status information to the management sub-system.Likewise, the management sub-system periodically sends its status information to the backup sub-system.The status information of each sub-system includes the CPU utilization and memory occupancy rate, etc.When the management sub-system judges that the azimuth sub-control-system (pitch sub-controlsystem or roll sub-control-system) does not meet the system requirements according to the received sub-system status information, it gives commands to the sub-control-system that do not meet the system requirements and backup sub-system.The backup sub-system runs the corresponding local task as a process and executes it, so the backup sub-system acts as the new azimuth sub-controlsystem.At the same time, the control sub-system that does not meet the requirements stops executing the relevant control tasks.Then, the management sub-system sends a restart command to the control sub-system that has stopped executing the control task, so that it becomes a backup sub-system after restarting.When the management sub-system cannot receive the status information of the azimuth sub-control-system (pitch sub-control-system or roll sub-control-system), it judges that the subcontrol-system has a hardware or software fault.At this time, the management sub-system sends a command to the backup sub-system, so that it runs as a sub-control-system and executes the corresponding control task.
When the management sub-system judges that the backup subsystem does not meet the system requirements according to the received subsystem status information, it sends a restart command to the backup sub-system.When the management sub-system cannot receive the status information of the backup sub-system, it will judge that the backup sub-system has a hardware or software fault, and send a warning message to the user of the SOTM system to repair or replace the relevant equipment as soon as possible.
When the management sub-system judges that its own state does not meet the system requirements, it sends a command to the backup sub-system, so that the backup subsystem runs as the management sub-system.After the backup sub-system starts running as the management sub-system, it sends a startup successful information to the management sub-system.After the original management subsystem receives the startup success information of the new management sub-system (i.e. the original backup sub-system), it will restart the system and act as the new backup sub-system.When the backup sub-system cannot receive the status information from the management sub-system, it is judged that a software or hardware failure occurs in the management sub-system, and the backup sub-system runs as the new management sub-system automatically.
One characteristic of the dynamic backup scheme is that when one of the sub-systems in the management sub-system, azimuth sub-control-system, pitch sub-control-system, and roll sub-controlsystem switches its task to the backup sub-system due to a recoverable fault such as software deadlock, if the fault of the faulty sub-system is resolved by means of restarting the system, the subsystem will become the new backup sub-system.If the faulty sub-system is the backup sub-system, after the fault is resolved, it will still act as the backup sub-system in the control system.When a nonrecoverable fault such as hardware damage causes the sub-system task to switch to the backup subsystem, the system will issue a warning to the SOTM user to repair or replace the equipment.Due to the characteristics of this dynamic backup scheme, the physical hardware of each subsystem may be in different roles and execute different tasks at different times.The system has a certain reservation and high reliability.
When the azimuth sub-control-system (pitch sub-control-system or roll sub-control-system) fails, and the backup sub-system is running as the new azimuth sub-control-system (pitch sub-control-system or roll sub-control-system), the system running flow is shown as follows and in Figure 3.In Figure 3, we take the azimuth sub-control-system as an example, the pitch sub-control-system or roll sub-controlsystem is similar to the azimuth sub-control-system, and the running flow is no longer repeated.Step 1: Running flow start Step 2: The management sub-system fetches the status of the azimuth sub-control-system Step 3: Judgment of the result that whether the status of the azimuth sub-control-system is fetched, if negative, go to Step 4, otherwise, go to Step 5  Step 4: The backup sub-system running as the new azimuth sub-control-system Step 5: Judgment of the result that whether the local resources occupation of the azimuth -sub-controlsystem meets the system requirements.If positive, running flow end, otherwise, go to Step 6.
Step 6: The backup sub-system running as the new azimuth sub-control-system Step 7: Send a restart command to the original azimuth sub-control-system Step 8: Running flow end.When the management sub-system starts the backup sub-system as the new management sub-system according to its own status information, the system running flow is shown as follows and in Figure 4.
Step 1: Running flow start Step 2: The management sub-system reads its own status Step 3: Judgment of whether the local resource status of the management sub-system meets the requirements.If positive, the running flow end, otherwise, go to Step 4.
Step 4: Send the start as the new management sub-system command to the backup sub-system Step 5: Let a variable i=0 Step 6: Wait for the information that the backup sub-system running as the new management subsystem successfully Step 7: Judgment of whether the information that the backup sub-system running as the new management sub-system has been received successfully by the original management sub-system.If positive, go to Step 8, otherwise, go to Step 9  Step 8: The original management sub-system restarts, and the running flow ends  The backup sub-system runs as the new management sub-system when it cannot receive the status information of the management sub-system, the system running flow is as follows and in Figure 5: Step 1: Running flow start Step 2: Fetching the status information of the management sub-system Step 3: Judgment of whether the status information of the management sub-system is fetched successfully.If positive, flow ends, otherwise, go to Step 4  Step 4: Determine that the management subsystem has failed Step 5: The backup sub-system running as the new management sub-system automatically Step 6: Running flow ends.Next, we will analyze the impact of the backup sub-system task switch on the stability of the SOTM servo control system.In most cases, the SOTM antenna control system is in a steady-state tracking of the target communication satellite.In this state, the SOTM antenna is controlled by the closed-loops control loops composed of azimuth sub-control-system, pitch sub-control-system, roll sub-controlsystem, and the tracking receiver.Here, we will describe and analyze the task switching action.During the sub-system switching process, the control output of the switched sub-system is equals to 0, which can be considered as introducing an equivalent square wave disturbance  into the normally running system.The amplitude of the square wave disturbance  is equals to the output of the switched sub-system at the time of the switching action, and in the opposite direction.The width of the equivalent square wave  is equal to the duration of the switching action.Therefore, the equivalent square wave disturbance of the system is: where, () is the step function,  1 is the start time of the switching action,  2 is the end time of the switching action, then  1 <  2 .
The equivalent disturbance  is regarded as external disturbance, the disturbance transfer function of the system is: where, () is transfer function of the controller of the azimuth (or pitch/roll) sub-control-system, () is the transfer function of the actuator system of the azimuth (or pitch/roll), () is transfer function of the feedback of the system, () is the transfer function of the output of the azimuth (or pitch/roll) sub-control-system, () is the transfer function of the equivalent disturbance.
According the Laplace Final Value Theorem, the steady-state output of the system under step input  1 () and  2 () are as follows: ) Then, the steady-state output of the system under the equivalent square wave disturbance  is as follows: 5), it can be derived that the steady-state output of the system under the equivalent disturbance  is 0, indicating that the backup controller switching action does not affect the stability of the control system.Similar methods can be utilized to analyze the management sub-system, leading to similar conclusions.Further analysis on this is unnecessary at this point.

Experiment analysis
To verify the actual performance of the distributed dynamic backup servo control scheme designed in this paper, experiments are conducted in this section for validation.Figure 6 shows the experimental site.Set the swing platform azimuth, pitch and roll three-axis motion period to 7s.During the running of the SOTM system, the azimuth sub-control-system is manually turned off.At this time, the azimuth sub-control-system task is switched to the backup sub-system for execution.

Figure 7.
Real-time Azimuth Angle of the SOTM Antenna.As shown in Figure 7, it is a schematic diagram of the real-time azimuth angle change of the SOTM antenna tracking target communication satellite during system running.It can be seen from the figure that the SOTM antenna stably tracks the satellite during system running.Among them, at around 32.7s, the azimuth sub-control-system task switching action begins, and at around 33s, the switching action is completed.During the task switching of the azimuth control subsystem, the azimuth subcontrol-system temporarily stops working, the azimuth axis actuator cannot receive the control command, and the azimuth axis remains almost unchanged.However, since there is an error in the antenna azimuth angle measurement system, as shown in the enlarged part of Figure 7, the azimuth angle of the SOTM antenna fluctuates within a small range.As shown in Figure 8, it is a schematic diagram of the real-time pitch angle change of the SOTM antenna tracking the target communication satellite during system running.It can be observed from the figure that the SOTM antenna stably tracks the satellite during system running, and the fluctuation range of the SOTM antenna's pitch angle is relatively small.The task switching action of the azimuth sub-control-system does not affect the normal execution of the pitch control subsystem tasks, thus the pitch sub-control-system is in a normal running state.As shown in Figure 9, it is a schematic diagram of the real-time Automatic Gain Control (AGC) levels of the SOTM antenna during system running.From Figure 9, it can be observed that during the task switching process of the azimuth sub-control-system, the AGC level of the SOTM antenna decreases, indicating a decrease in the communication quality of the SOTM system as a result of the task switching action of the azimuth sub-control-system, but satellite communication has not been interrupted.

Figure 9.
Real-time AGC of the SOTM Antenna.As shown in Figure 10, it is a schematic diagram of the real-time signal-to-noise ratio (SNR) change of the SOTM antenna during system running.From Figure 10, it can be observed that during the task switching process of the azimuth sub-control-system, the real-time SNR of the SOTM antenna decreases, indicating a decrease in the communication quality of the SOTM system due to the task switching action of the azimuth sub-control-system, but satellite communication has not been interrupted.This is consistent with the real-time Automatic Gain Control (AGC) level of the SOTM antenna shown in Figure 9.As shown in Figure 11, it is a schematic diagram of the real-time signal quality change of the SOTM antenna during system running, where the signal quality refers to the ratio of the current signal level received by the SOTM antenna to the maximum signal level.From Figure 11, it can be observed that during the task switching process of the azimuth sub-control-system, the real-time signal quality of the SOTM antenna decreases, indicating a decrease in the communication quality of the SOTM system due to the task switching action of the azimuth sub-control-system, but satellite communication has not been interrupted.This is consistent with the real-time AGC level of the SOTM antenna shown in Figure 9 and the real-time SNR shown in Figure 10.Based on the aforementioned experimental results, it can be concluded that when employing the distributed SOTM servo control system structure proposed in this paper, the control system can meet the requirements of the SOTM system and exhibit good control performance during normal running.Furthermore, when a sub-control-system experiences a fault and control tasks are switched to the backup sub-system, the fault within the sub-system does not impact the normal running of other subsystems within the system.It only impacts the switched sub-system.Additionally, the sub-system switching action only causes a temporary decrease in communication quality or interruption in the SOTM system, without stopping the running of the control system.The advantages of the design proposed in this paper are as follows: the control system design is more modular, requiring lower manpower, time, and financial costs for system development, maintenance, and upgrades.For SOTM systems, in the event of a sub-system failure during running, the entire servo control system will not cease functioning, thereby preventing continuous communication interruptions in the SOTM system until the system is restored.Instead, it only leads to a temporary degradation or brief interruption in communication quality.These observed results are acceptable.Although SOTM necessitates stable satellite communication links, it is understood that continuous connectivity is not always achievable during normal running due to satellite switches caused by changes in the carrier's location.Furthermore, SOTM systems are influenced by weather conditions and the high dynamic nature of the carrier, leading to instances of communication quality degradation or interruptions.As long as communication can be promptly restored following situations, it can meet the needs of the majority of SOTM system application scenarios.In contrast, for conventional centralized control structures, if the core controller malfunctions, the SOTM servo control system can only be restored to normal working after maintenance, which is generally performed offline and requires professional engineers.On the other hand, the proposed design in this paper endows the control system with robust fault-tolerance capabilities, enhancing the SOTM system's ability to withstand faults and significantly improving the reliability of the SOTM control system.

Conclusion
This paper proposes a distributed Satcom-On-The-Move (SOTM) servo control system structure and designs a dynamic backup scheme.The designed control system consists of five subsystems: the management sub-system, azimuth sub-control-system, pitch sub-control-system, roll sub-controlsystem, and backup sub-system.The status and function of the backup sub-system are dynamically changing, adapting according to the system's running.The running flow of the dynamic backup scheme is described, and the impact of the sub-system task switching on the control system is analyzed.To validate the effectiveness of the proposed design, experimental verification is conducted.The experimental results demonstrate that when utilizing a distributed servo control structure, the SOTM system runs effectively.In the event of sub-system faults, the faults within a sub-system do not impact the running of other sub-systems; the faults within the sub-systems are not coupled, and the switching of sub-system tasks to the backup sub-system only causes temporary degradation or interruption in communication within the SOTM system, which can be rapidly restored to normal communication.This illustrates the effectiveness of the designed distributed control structure and the high reliability of the dynamic backup scheme.

Figure 2 .
Figure 2. Overview of the distributed control structure of the SOTM Servo control.

Figure 3 .
Figure 3. Running flow of azimuth sub-control-system tasks switch to backup sub-system.

Figure 4 .
Figure 4.The backup sub-system running as the management subsystem under the control of the management sub-system.

Figure 5 .
Figure 5. Self-restart of the backup sub-system.

Figure 6 .
Figure 6.Experiment site.Figure6shows the experimental site.Set the swing platform azimuth, pitch and roll three-axis motion period to 7s.During the running of the SOTM system, the azimuth sub-control-system is manually turned off.At this time, the azimuth sub-control-system task is switched to the backup sub-system for execution.

Figure 8 .
Figure 8. Real-time Pitch Angle of the SOTM Antenna.As shown in Figure9, it is a schematic diagram of the real-time Automatic Gain Control (AGC) levels of the SOTM antenna during system running.From Figure9, it can be observed that during the task switching process of the azimuth sub-control-system, the AGC level of the SOTM antenna decreases, indicating a decrease in the communication quality of the SOTM system as a result of the task switching action of the azimuth sub-control-system, but satellite communication has not been interrupted.

Figure 10 .
Figure 10.Real-time SNR of the SOTM Antenna.As shown in Figure11, it is a schematic diagram of the real-time signal quality change of the SOTM antenna during system running, where the signal quality refers to the ratio of the current signal level received by the SOTM antenna to the maximum signal level.From Figure11, it can be observed that during the task switching process of the azimuth sub-control-system, the real-time signal quality of the SOTM antenna decreases, indicating a decrease in the communication quality of the SOTM system due to the task switching action of the azimuth sub-control-system, but satellite communication has not been interrupted.This is consistent with the real-time AGC level of the SOTM antenna shown in Figure9and the real-time SNR shown in Figure10.

Figure 11 .
Figure 11.Real-time Signal Quality of the SOTM Antenna.Based on the aforementioned experimental results, it can be concluded that when employing the distributed SOTM servo control system structure proposed in this paper, the control system can meet the requirements of the SOTM system and exhibit good control performance during normal running.Furthermore, when a sub-control-system experiences a fault and control tasks are switched to the backup sub-system, the fault within the sub-system does not impact the normal running of other subsystems within the system.It only impacts the switched sub-system.Additionally, the sub-system switching action only causes a temporary decrease in communication quality or interruption in the SOTM system, without stopping the running of the control system.The advantages of the design proposed in this paper are as follows: the control system design is more modular, requiring lower manpower, time, and financial costs for system development, maintenance,