CN102521066A - On-board computer space environment event fault tolerance method - Google Patents

Abstract

The space environment event fault tolerance method of the spaceborne computer mainly includes the processing of memory single event flipping, the fault tolerance of the internal register change of the chip caused by space radiation, and the fault tolerance of some circuit failures caused by space radiation. For the single event flip of the memory, the on-board computer periodically reads and writes the memory area for fault tolerance by adding EDAC checks to the memory area. For the change of the chip's internal registers caused by space radiation, the onboard computer protects unused interrupts; for the working mode registers, it adopts periodic inspections, and if it is not the expected value, it is re-initialized; for the registers related to the bus sending messages, each time Reassign the memory before sending the message. For some circuit failures caused by space radiation, the replacement of faulty RAM memory chips, bus interface chip fault detection and switching, and CPU chip fault detection and switching are used for fault tolerance. The method of the invention can effectively improve the reliability of launch and on-orbit operation of the spaceborne computer.

Description

Fault Tolerance Method for Space Environment Events in Spaceborne Computer

technical field

The invention relates to a fault-tolerant method for an on-board computer.

Background technique

During the entire launch process and operation of the spacecraft, various space environmental events will occur due to various reasons such as the space environment and the characteristics of the spacecraft. Failure to deal with them will cause the failure or even collapse of the satellite system functions, so measures should be taken To deal with these abnormal conditions, the satellite can continue to operate correctly and stably, thereby ensuring the stable operation and service of the entire satellite system.

Space environmental events mainly include: memory single event flipping; changes in chip internal registers caused by space radiation; partial circuit failures caused by space radiation, etc. A memory single-event flip will cause errors in the running results of the on-board software or FPGA, or even cause the software to run away and die. Changes in the chip's internal registers caused by space radiation will cause abnormal functions of some chips in the spacecraft, which will affect the realization of functions. The partial circuit failure caused by space radiation mainly refers to the partial circuit failure caused by single event latch-up.

At present, the fault-tolerant methods for space-borne computer space environment abnormal events have not been systematically studied.

Contents of the invention

The technical problem of the present invention is: to overcome the deficiencies of the prior art, to provide a fault-tolerant method for the space environment event of the space-borne computer, to establish a space-environment event fault-tolerant strategy suitable for the design of the space-borne computer, and to improve the Reliability of computer launches and in-orbit operations.

The technical solution of the present invention is: a space-borne computer space environment event fault-tolerant method, the steps are as follows:

(1) After the on-board computer is initially powered on and running, first check whether the on-board computer software can be started normally; Normal operation; if the on-board computer software cannot be started or the on-board computer software fails to feed the software watchdog in a fixed period, the reset circuit will provide a reset signal to the on-board computer, and the on-board computer will restart; if the on-board computer fails three times in a row If it starts normally, switch to the backup onboard computer;

(2) After the software of the on-board computer is running normally, it sends read and write signals to all RAMs; if there is abnormal reading and writing in the RAM area, the on-board computer uses the backup RAM to replace the abnormal RAM through software configuration;

(3) When the on-board computer software is running normally, it periodically sends polling bus messages to each bus terminal. backup machine;

(4) When the on-board computer software is running normally, all interrupt sources actually used are allowed, and other interrupt sources are blocked at the same time; when the on-board computer responds to an interrupt, the interrupt source is first confirmed. For a while, re-initialize the interrupt mask register;

(5) When the on-board computer software is running normally, check regularly whether the value of the register in the bus driver chip in the working state changes. If the value of any register changes, the on-board computer re-initializes the register and related registers; at the same time , for register states that are only valid for part of the time, these registers are reassigned each time the valid time is reached;

(6) When the on-board computer software is running normally, use the Hamming code to calculate the checksum of the data of each memory address, and store the checksum; the on-board computer periodically checks the data of each memory address, and when found When checking a single bit error, perform error correction; when two or more bit errors are found, reset the on-board computer and restart it.

The advantage of the present invention compared with prior art is:

(1) The fault-tolerant method of the space environment event of the space-borne computer of the present invention is mainly aimed at the special event caused by the space environment, and divides different methods to carry out fault-tolerance, which can effectively improve the reliability of the on-orbit operation of the space-borne computer;

(2) adopting the spaceborne computer software to realize the fault tolerance of the space environment event of the spaceborne computer of the present invention can improve the self-management capability of the satellite;

(3) The fault-tolerant method of the space environment event of the space-borne computer of the present invention can mainly adopt software to complete the error detection and fault-tolerance of the space-borne computer under the support of hardware, the principle is simple, the realization is easy, the maintainability is strong, and it is suitable for most satellites , and is highly scalable.

Description of drawings

Fig. 1 is a block flow diagram of the inventive method;

Fig. 2 is the specific fault-tolerant content composition figure of the inventive method;

Fig. 3 is a hardware configuration diagram of the on-board computer in the embodiment of the present invention.

Detailed ways

The fault tolerance of the space environment abnormal event of the space-borne computer of the present invention utilizes the software and hardware resources of the space-borne computer to perform different processing according to different types of space environment events; at the same time, it can meet the requirements of the weight and power consumption of the space-borne computer. .

As shown in Figure 1, the method of the present invention performs different types of fault tolerance for events such as single event flipping and single event latching caused by the space environment, and is suitable for the application of most spacecraft, which can improve the on-orbit autonomy and reliability of satellite equipment. sex. It mainly includes three aspects: the processing of memory single event flipping, the fault tolerance of chip internal register changes caused by space radiation, and the fault tolerance of some circuit failures caused by space radiation, as shown in Figure 2.

(1) Processing of memory single event upset

For the single event reversal of the memory, the on-board computer checks the storage area by adding EDAC to the storage area, and verifies the storage area by reading and writing regularly. The EDAC check code is characterized by "detect one and correct two", that is, it can correct errors when a single-bit error occurs, but cannot correct errors when a double-bit or multi-bit error occurs, and can only report an error. Therefore, the hardware of the on-board computer is designed with an EDAC verification circuit of the memory. Whenever the EDAC verification fails, the software will generate an interrupt. The software will read the EDAC verification status during the interrupt to determine whether it is a single-bit error or a multi-bit error. , if it is a single-bit error, the single-bit error in the memory is corrected by rewriting the read data, and if it is a double-bit error, the influence of the double-bit error is eliminated by software autonomous reset.

(2) Changes in chip internal registers caused by space radiation

The internal register of the chip is the interface left to the user for the convenience of use at the beginning of the chip design. Different values of the register will cause changes in the working mode and main functions of the chip. Changes in the chip's internal registers caused by space radiation will cause incorrect execution of the normal functions of the on-board computer. The on-board computer mainly adopts the following methods for the change of the internal registers of the chip: protect unused interrupts to prevent uncertain interrupts caused by changes in interrupt-related registers; Initialization; for registers related to sending messages on the bus, re-assign the memory before sending messages each time.

(3) Partial circuit failure caused by space radiation

The partial circuit failure caused by space radiation mainly refers to the partial circuit failure caused by single event latch-up. The on-board computer adopts a fault isolation and system reconfiguration mechanism for some circuits to eliminate the influence of single event latch-up in some circuits. Mainly include replacement of faulty RAM memory chips, fault detection and switching of bus interface chips, fault detection and switching of CPU chips. The on-board computer adopts a backup redundancy strategy. When a RAM chip cannot be read and written normally, it will switch to the backup RAM; when the bus interface chip or CPU chip is abnormal, it will automatically switch to the backup machine.

The main steps of the inventive method are as follows:

(1) Initial power-on operation of the on-board computer;

(2) Check whether the software of the onboard computer can be started normally. If it is started, the software will feed the dog at a fixed period, and the software will run normally; otherwise, the software cannot feed the dog, and the reset circuit will provide a reset signal to the onboard computer, and the onboard computer will restart running; if it fails to start normally for 3 consecutive times, switch to back up the on-board computer.

(3) After the on-board computer software is running, it sends read and write signals to all RAMs. If there is abnormal reading and writing in the RAM area, it means that the RAM is damaged due to unknown reasons. At this time, the onboard computer software is configured to use the backup RAM.

(4) After the on-board computer is running, it periodically sends polling bus messages to each bus terminal. When all bus terminals fail, it proves that the bus driver chip is damaged for some reason. At this time, the software of the on-board computer sends a switch-off signal to the on-board computer, and the on-board computer switches off the backup machine and uses another bus driver chip.

(5) When the on-board computer is running, all interrupt sources actually used are allowed, and other interrupt sources are shielded. When the onboard computer responds to an interrupt, it first confirms the source of the interrupt. If the interrupt is not from one of the actually used interrupts, it means that a single event flip occurs in the interrupt mask register, and the interrupt mask register is re-initialized.

(6) When the on-board computer is running, regularly check whether the value of the register in the bus driver chip in the working state changes. When there is a change, it means that the register is affected by a single event. At this point, the onboard computer reinitializes this register and related registers.

(7) When the on-board computer is running, the status of some registers is only valid for part of the time, and these registers are reassigned every time these registers are needed to eliminate the possible single event impact on these registers before that.

(8) When the on-board computer is running, the Hamming code is used to calculate the checksum of the data of each memory address and store the checksum. The on-board computer periodically checks the data of each memory address, and when a single-bit error is found (that is, a single event flip), error correction is performed; when multiple-bit errors are found, the computer is reset and the program is reloaded.

(9) Repeat steps (4) to (8) to perform fault-tolerant processing on space environment events.

Example

Taking a certain satellite as an example, the space environment event fault-tolerant strategy of the space-borne computer is introduced below:

As shown in Figure 3, the onboard computer of a certain satellite uses TSC695f as the cpu, comes with EDAC circuit, and has a redundant RAM replacement circuit; the onboard computer uses 61580 as the interface chip of the bus; the onboard computer has 128K PROM and 8M RAM, RAM chip is composed of 4 pieces of 9Q512K32 with a capacity of 2M, and the system is backed up with a piece of 2M RAM at the same time; it also has a telemetry interface and a remote control interface. Application software completes the functions of various application layers on top of the operating system. The on-board computer has a dual-machine cold backup, and the composition of each single machine is exactly the same.

During the start-up process of the on-board computer, the operating system first performs a self-test on the 4 pieces of RAM. If the reading and writing of a certain piece of RAM is not normal, the backup RAM is used to replace it. If it is still not normal after replacement, it is reset.

TSC695f has its own EDAC circuit. When the EDAC in the storage area fails to check, it will generate a corresponding interrupt, and record whether it is a single-bit error or a double-bit error at this time, and record the value read at this time. During the initialization process of the application software, hook up this interrupt; when this interrupt occurs, the software first judges whether it is a single-bit error, and if it is a single-bit error, it will write back the value after EDAC error correction to the RAM area to eliminate the single-bit error. Influence; if it is a double bit error, it will be reset immediately.

The application software of the on-board computer checks the working mode of the 61580 chip and the working mode of the 695f chip every 0.5 seconds, and re-assigns the value if it is not the set value; The register for message sending is reassigned; the operating system software protects unused interrupts, and when an unused interrupt exception occurs, clears the corresponding bit of the interrupt status register and exits the interrupt response program.

The on-board computer has the function of self-shutdown. When the application software detects that all bus terminals are disconnected, it considers that the 61580 chip is faulty and immediately shuts down the machine. When the CPU chip is abnormal, reset it through the watchdog. If it is reset for 3 times, it still cannot be recovered. , then shut down the machine immediately, thereby isolating the parts that cause the failure due to space environmental events.

The content that is not described in detail in the description of the present invention belongs to the well-known technology of those skilled in the art.

Claims (1)

1. The space-borne computer space environment event fault-tolerant method is characterized in that the steps are as follows: (1) After the on-board computer is initially powered on and running, first check whether the on-board computer software can be started normally; Normal operation; if the on-board computer software cannot be started or the on-board computer software fails to feed the software watchdog in a fixed period, the reset circuit will provide a reset signal to the on-board computer, and the on-board computer will restart; if the on-board computer fails three times in a row If it starts normally, switch to the backup onboard computer; (2) After the software of the on-board computer is running normally, it sends read and write signals to all RAMs; if there is abnormal reading and writing in the RAM area, the on-board computer uses the backup RAM to replace the abnormal RAM through software configuration; (3) When the on-board computer software is running normally, it periodically sends polling bus messages to each bus terminal. backup machine; (4) When the on-board computer software is running normally, all interrupt sources actually used are allowed, and other interrupt sources are blocked at the same time; when the on-board computer responds to an interrupt, the interrupt source is first confirmed. For a while, re-initialize the interrupt mask register; (5) When the on-board computer software is running normally, check regularly whether the value of the register in the bus driver chip in the working state changes. If the value of any register changes, the on-board computer re-initializes the register and related registers; at the same time , for register states that are only valid for part of the time, these registers are reassigned each time the valid time is reached; (6) When the on-board computer software is running normally, use the Hamming code to calculate the checksum of the data of each memory address, and store the checksum; the on-board computer periodically checks the data of each memory address, and when found When checking a single bit error, perform error correction; when two or more bit errors are found, reset the on-board computer and restart it.

Images