Satellite-borne router exception recovery system and method based on multistage redundancy

Abstract

The invention discloses a satellite-borne router exception recovery system and method based on multistage redundancy, and supports the construction of intra-satellite, inter-satellite and satellite-ground data link communication schemes in a satellite constellation communication scene. The system-level recovery method based on multi-level redundancy is designed for various abnormal scenes faced by a satellite-borne router in a satellite operation environment, and in combination with telemetering state judgment and remote control instruction issuing, in-orbit recovery of data link communication service availability is achieved. Abnormalities related to the guiding system can be recovered through modes of redundant system switching, double-flash configuration synchronization, on-orbit system updating and the like. Abnormalities related to a network operating system can be recovered through self-adaptive network configuration reloading, system switching based on GPIO (General Purpose Input / Output) monitoring, redundant system switching, on-orbit system updating and the like. According to the satellite-borne router abnormity recovery method constructed based on the invention, a single device can be combined to generate 16 system recovery routes, and the availability of a satellite constellation data link communication service is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of satellite constellation communication, and particularly to an on-board router anomaly recovery system and method based on multi-level redundancy. Background Art

[0002] In the field of satellite constellation communication, each on-board service payload and the integrated on-board electronics achieve interconnection and intercommunication based on the Ethernet protocol via an on-board router. The communication processes among various on-board payloads, among different satellites, and between satellites and ground stations all rely on the correct configuration and normal operation of the on-board router. Due to the harsh conditions such as high temperature / low temperature, vacuum, and single particles in the satellite operating environment, the on-board router may face various possible fault scenarios such as flash faults, EMMC faults, and power supply faults, resulting in abnormal forwarding and routing of Ethernet data and being unable to meet the requirements for normal communication of the satellite constellation via the on-board router. Currently, the existing technologies lack a high-availability recovery mechanism at the system level for the above communication anomaly scenarios to ensure the availability of the on-board router communication service. Summary of the Invention

[0003] The purpose of the present invention is to propose an on-board router anomaly recovery system and method based on multi-level redundancy in view of the deficiencies of the above existing technologies, aiming to provide a high-availability communication service recovery solution for the satellite constellation system in an abnormal state.

[0004] To achieve the above purpose, the present invention adopts the following technical solutions: An on-board router anomaly recovery system based on multi-level redundancy includes an integrated on-board electronics and an on-board router; the on-board router internally integrates a main routing and switching unit and a backup routing and switching unit. Both the main routing and switching unit and the backup routing and switching unit include a CPLD, two flashes, and an EMMC, where the two flashes are backup to each other; two operating systems, ONIE and SONIC, are installed in the EMMC; each time it starts, the CPLD controls one of the flashes to power on, and the uboot installed in the flash boots the operating system stored in the EMMC via the boot system control link; the two switching units interact with the integrated on-board electronics via the telemetry and telecontrol link; the on-board router single device selects any one of the four routes of main flash-main SONIC, backup flash-main SONIC, main flash-backup SONIC, and backup flash-backup SONIC to enter the SONIC system. After entering the system through any route, it selects four methods, namely system restart, reloading the SONIC system configuration, reinstalling the SONIC system online based on SONIC, and reinstalling the SONIC system based on ONIE, to restore the system availability.

[0005] Further, during the SONIC system configuration reload process, without restarting the system, only the business containers other than the database are restarted. Through the telemetry status, it can be monitored whether the containers have been restarted successfully. Once the container status returns to normal, it indicates that the reload command has been executed successfully.

[0006] Further, the methods for reinstalling the SONIC system include reinstalling the SONIC system online based on SONIC and reinstalling the SONIC system based on ONIE. If the telemetry and remote control transceiver are normal under the SONIC system, either method can be chosen. Otherwise, only the method of reinstalling the SONIC system based on the ONIE system can be used.

[0007] Further, before reinstalling the SONIC system online based on SONIC, the container status needs to be checked. If the status is normal, the reinstallation operation can be performed. Otherwise, it is necessary to switch to the ONIE system for reinstallation. The online installation of the SONIC system is based on remote control instructions. After the installation is completed, there are two systems in the current SONIC system. Restarting can automatically switch to the new system. It is judged whether the system service has returned to normal according to the system status information returned by the telemetry. If the service has been restored, the remote control instruction is executed to uninstall the old version system. Otherwise, switch to the ONIE system for reinstallation.

[0008] Further, if the SONIC system is in an abnormal state and cannot be reinstalled online, switch to the ONIE system based on the telemetry and remote control instructions and then reinstall the SONIC system. First, judge whether the telemetry status of the ONIE system is normal. If it is normal, execute the remote control instruction to install the system, and try to load the backup installation package from the mounted disk. If the installation package does not exist or the checksum is abnormal, try to obtain an available installation package from the satellite integrated electronics through the remote control instruction and execute the installation instruction again until the installation is completed successfully. After the installation instruction is executed successfully, the system will switch to the SONIC system, and it is judged whether the system service has returned to normal according to the system status information returned by the telemetry.

[0009] Further, if the main flash is abnormal and the backup flash is normal, switch to the backup flash, delete the latest configuration information and the main and backup flash synchronization flags saved in the EMMC through the remote control instruction, update the configuration information of the backup flash to the EMMC, and create a synchronization flag for the backup flash in the EMMC. After switching back to the main flash, the boot system synchronizes the configuration information of the default flash according to the flash synchronization flag saved in the EMMC and creates a synchronization flag for the main flash in the EMMC. If the backup flash is abnormal and the main flash is normal, the recovery method is the same. If both the main and backup flashes are abnormal, the current SONIC system cannot be recovered, and switch to the backup SONIC system to restore the communication link service. The backup SONIC system is the SONIC system in the backup routing and switching unit.

[0010] Further, if the ONIE system encounters an anomaly, switch to the SONIC system to check whether the telemetry and remote control functions are available. If the telemetry and remote control of the SONIC system are normal, reinstall based on the SONIC system to restore system availability. First, attempt to load the ONIE system image installation package from the mounted disk via a remote control command. If the target image does not exist on the mounted disk or the checksum is abnormal, obtain the correct installation package from the spacecraft integrated electronics, decompress it, and execute the installation script to link the latest image to the system. Determine whether the system reinstallation is successful based on the system status information returned by the telemetry.

[0011] The present invention also provides a method for recovering from anomalies in an on-board router based on multi-level redundancy, which is implemented based on the above-mentioned on-board router anomaly recovery system based on multi-level redundancy. For abnormal scenarios of in-satellite, inter-satellite, or space-ground data link services during satellite constellation communication, combine the control link communication status among the spacecraft integrated electronics, the CPLD of the on-board router system, the SONIC system of the on-board router, and the ONIE system of the on-board router, and execute the corresponding recovery plan to ensure the availability of data link services. The recovery plan includes the following steps:

[0012] a) Check the status of the SONIC system. If the telemetry status and remote control command transceiver of the SONIC system are abnormal, proceed to step b. Otherwise, check the status of the SONIC system based on the telemetry status and remote control command of the SONIC system. If there is an anomaly, proceed to step b. Otherwise, end this step.

[0013] b) Attempt to restart the SONIC system. After restarting, check whether the status of the SONIC system has been restored. If it has been restored, end this step. Otherwise, proceed to step c.

[0014] c) If the SONIC system can normally receive and transmit telemetry and remote control status information, proceed to step d. Otherwise, check the status of the ONIE system. If the ONIE system can normally receive and transmit telemetry and remote control status information and the MAC configuration status is normal, proceed to step e. Otherwise, proceed to step f.

[0015] d) Attempt to reload the SONIC system configuration. If the system is restored after execution, end this step. Otherwise, check whether the SONIC system MAC is abnormal. If there is an anomaly, proceed to step f. Otherwise, proceed to step g.

[0016] e) Attempt to reinstall the SONIC recovery system based on telemetry and remote control commands under the ONIE system to restore system availability. If the recovery fails, proceed to step h. Otherwise, end this step.

[0017] f) Attempt to switch to the backup flash to enter the SONIC system and restore system availability by synchronizing and backing up the configuration of the boot system. If the recovery fails, proceed to step h. Otherwise, end this step.

[0018] g) Try to reinstall SONIC in the SONIC system to restore system availability. If the recovery fails, go to step h, otherwise end this step;

[0019] h) Try to restore service availability by switching to the standby routing switching unit through remote control commands.

[0020] Furthermore, if the SONIC system status is normal, check other load status and network configuration on the communication link;

[0021] The status of other loads and network configuration on the communication link are analyzed in combination with the corresponding port status and port count returned by the onboard router telemetry; if the count increases normally, it means that the message has been sent. If the satellite-to-ground link is blocked, the satellite-to-ground communication load and the ground station will troubleshoot the problem; if the inter-satellite link is blocked, the inter-satellite communication load will locate the problem.

[0022] Furthermore, a method for restoring system availability based on the configuration of the backup boot system is based on a dual flash redundant architecture design. The SONIC system is controlled by telemetry commands to update the configuration information stored in the backup flash to the EMMC to complete the synchronization. When the onboard router enters the default flash again, it first loads the latest configuration information after synchronization, thereby realizing the recovery of the boot system availability.

[0023] The beneficial effect of the present invention is that a system-level satellite router abnormality recovery method is proposed based on a multi-level redundant design. For the abnormal scenarios of intra-satellite, inter-satellite or satellite-to-ground data link communication services caused by abnormal satellite routers during satellite constellation communication, combined with satellite service integrated electronics, satellite router system CPLD, satellite router SONIC system and satellite router ONIE system, the control link communication status is realized based on high-availability on-orbit recovery means to achieve on-orbit recovery of data link communication service availability. Compared with traditional satellite communication solutions, the constellation router described in the present invention is based on a multi-level redundant design. A single device can select four routes of main flash-main SONIC, backup flash-main SONIC, main flash-backup SONIC, and backup flash-backup SONIC to enter the SONIC system. After entering the system through any route, the system can be restarted, software configuration reloaded, online reinstallation of the SONIC system, and reinstallation of the SONIC system based on ONIE can be selected to restore the system availability. 16 system recovery routes can be generated in combination to ensure the high availability of constellation data link communication services. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] To more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the accompanying drawings required for the description of the embodiments. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other accompanying drawings can be obtained based on these drawings.

[0025] Figure 1 This is the flowchart of the embodiment of the present invention.

[0026] Figure 2 This is a schematic diagram of the on-board router control link. Among them, flash0 corresponds to the main flash, and flash1 corresponds to the backup flash.

[0027] Figure 3 This is a schematic diagram of the satellite constellation communication link.

[0028] Figure 4 This is the timing diagram of the boot system recovery.

[0029] Figure 5 This is the timing diagram of the online recovery of the SONIC system.

[0030] Figure 6 This is the timing diagram of the SONIC system recovery based on ONIE.

[0031] Figure 7 This is the timing diagram of the ONIE system recovery based on SONIC. Specific Embodiments

[0032] In order to make the purpose, technical solutions and advantages of the present invention clearer, the following further details the present invention in combination with the accompanying drawings and embodiments. Of course, the specific embodiments described here are only used to explain the present invention and are not used to limit the present invention.

[0033] Aiming at the problem of abnormal status of the on-board router located based on the telemetry and telecommand data received and transmitted by the ground station during the operation of the satellite constellation, the present invention proposes an on-board router abnormal recovery system and method based on multi-level redundancy design. If a service anomaly occurs in the satellite constellation communication link, first check whether the system status of the on-board router is normal based on the telemetry status and telecommand instructions. If the system status of the on-board router is normal, try to troubleshoot the status of other payloads and network configurations on the communication link. Otherwise, a system recovery plan needs to be executed for the specific abnormal status. The present invention is applicable to the scenarios where the data link services inside the satellite, between satellites or between the satellite and the ground operate abnormally due to the abnormality of the on-board router during the satellite constellation communication process.

[0034] The schematic diagram of the on-board router control link in the embodiment of the present invention is as Figure 2As shown in the figure, based on the multi-level redundancy design, two switching units, a primary unit and a backup unit, are integrated inside each on-board router. Each switching unit contains a CPLD, two flash memories, and an EMMC. The two flash memories are backed up each other. Each time the system starts up, the CPLD controls one of the flash memories to power on. The uboot installed in the flash memory boots the operating system stored in the EMMC via the boot system control link. Two operating systems, ONIE and SONIC, are installed in the EMMC. Among them, ONIE is used as the installation and boot system of the SONIC system and is only used to reinstall SONIC in the scenario where the SONIC system cannot be entered. The two switching units interact with the integrated electronic equipment of satellite services via the telemetry and telecontrol link. The integrated electronic equipment of satellite services can perceive the status of each module in the system by receiving telemetry data and control the orderly operation of each module through telecontrol instructions. Based on the above multi-level redundancy design, the on-board router can select four routes, namely, primary flash - primary SONIC, backup flash - primary SONIC, primary flash - backup SONIC, and backup flash - backup SONIC, to enter the SONIC system. After entering the system through any route, four methods, namely, system restart, software configuration reloading, online reinstallation of the SONIC system, and reinstallation of the SONIC system based on ONIE, can be selected to restore the system availability, with a total of 16 system recovery routes available. Among them, the primary and backup flash memories and the backup SONIC in the two routes of primary flash - backup SONIC and backup flash - backup SONIC refer to the primary and backup flash memories and SONIC in the backup routing and switching unit.

[0035] In the embodiment of the present invention, the schematic diagram of the satellite constellation communication link is as Figure 3 shown in the figure. Inside the satellite, the on-board router connects to each payload and realizes the interconnection and intercommunication of each payload via the intra-satellite communication link, including the integrated electronic equipment of satellite services (referred to as the integrated electronic equipment of satellite services or integrated electronics for short), the inter-satellite communication payload, the satellite-ground communication payload, the intra-satellite computing payload, etc. Each satellite in the constellation establishes a link via the inter-satellite communication link, and the satellite and the ground station establish a link via the satellite-ground communication link. The status of other payloads and the network configuration status on the communication link can be analyzed by combining the corresponding port status and port count returned by the telemetry of the on-board router. If the count increases normally, it indicates that the message has been sent. If the satellite-ground link is not working, the satellite-ground communication payload and the ground station will troubleshoot the fault. If the inter-satellite link is not working, the inter-satellite communication payload will locate the problem.

[0036] The satellite constellation communication link consists of two links: a control link and a data link. For communication anomalies in the data link, troubleshooting can be carried out based on the control link. Based on the space-ground control link, the ground station can send remote control instructions to the integrated satellite electronics, the CPLD of the on-board router system, the SONIC system of the on-board router, and the ONIE system of the on-board router, and receive the returned telemetry status information from the integrated satellite electronics, the CPLD of the on-board router system, the SONIC system of the on-board router, and the ONIE system of the on-board router. The collaborative services among the computing clusters composed of various computing payloads within the constellation are based on the data link.

[0037] The system recovery method for an on-board router system based on multi-level redundancy provided by the embodiments of the present invention for abnormal states has a specific process as Figure 1 shown, including the following steps:

[0038] Step 1: During the communication process of the satellite constellation, if there is an anomaly in the communication link service, first check whether there is an anomaly in the SONIC system of the on-board router. If it is determined that there is an anomaly in the system, execute the corresponding recovery plan; otherwise, check the status of other payloads and network configurations on the communication link.

[0039] Specifically, to check whether there is an anomaly in the SONIC (Software for Open Networking in the Cloud) system of the on-board router, it is necessary to check based on the remote control instructions sent by the ground station and the received telemetry status information.

[0040] 1. First, determine whether the SONIC system of the on-board router can normally send and receive telemetry and remote control status information. If, ten minutes after the ground station sends a remote control instruction to power on the SONIC system, the SONIC system still fails to send and receive telemetry status and remote control instructions, proceed to Step 2 to further locate the cause of the anomaly;

[0041] 2. If the SONIC system of the on-board router can normally send and receive telemetry and remote control status information, it is necessary to check the telemetry and remote control information of the SONIC system. If the system status returned by the SONIC system telemetry is abnormal, proceed to Step 2; otherwise, it means that the SONIC system is operating normally, and this step ends;

[0042] Among them, the specific cause of the anomaly needs to be analyzed and located based on the system status information returned by the telemetry. Different causes of anomalies correspond to different system recovery plans. After executing the corresponding recovery plan according to the located cause of the anomaly, it is necessary to judge whether the service has been restored in combination with the status information returned by the telemetry. If the service has not been restored, further troubleshooting is required.

[0043] Check the status of other payloads and network configurations on the communication link, including: The status of other payloads and network configurations on the communication link can be analyzed in combination with the corresponding port status and port count returned by the on-board router telemetry. If the count increases normally, it indicates that the message has been sent. If the space-ground link is not working, the space-ground communication payload and the ground station will troubleshoot the fault. If the inter-satellite link is not working, the inter-satellite communication payload will locate the problem.

[0044] Step 2: First, try to restart the SONIC system. If the abnormal status is restored after the restart, this step ends; if the abnormal status still exists after the restart, check whether the SONIC system can normally send and receive telemetry and telecommand status information. If it is normal, go to Step 3; otherwise, power off the current SONIC system based on the telecommand, switch to the ONIE system and power it on, and check the telemetry and telecommand status under the ONIE (Open Network Install Environment) system to further locate the cause of the system abnormality.

[0045] Specifically, the location of the cause of the system abnormality under the ONIE system includes the following steps:

[0046] 1. If the ONIE system can normally send and receive telecommand control instructions and telemetry status information and the MAC configuration status is normal, go to Step 3;

[0047] 2. If the ONIE system cannot normally send and receive telemetry and telecommand status information, or can normally send and receive telecommand control instructions and telemetry status information but the MAC configuration status is abnormal, go to Step 4;

[0048] In one embodiment, if it is determined in Step 2 that the on-board router system is currently in an abnormal state of the flash boot system, the solution of reinstalling the SONIC system cannot be directly adopted because the system lacks the basic MAC configuration, which will lead to the failure of reinstallation. Based on the dual-flash design, the current system boot can be restored through on-orbit system configuration synchronization.

[0049] It should be noted that the on-board router SONIC system and the on-board router ONIE system are two independent systems, and both need to be booted into the system through the on-board router flash. The SONIC system can be reinstalled via the ONIE system, and the ONIE system can also be reinstalled via the SONIC system. The on-board router can only select to start from one flash at the same time and enter one of the ONIE system or the SONIC system. The on-board router CPLD system controls the power-on and power-off of the flash and the GPIO signal switching, and then specifies the selection of the on-board router SONIC system and the on-board router ONIE system. A low level selects the ONIE system, and a high level selects the SONIC system.

[0050] After the on-board router CPLD system receives the telecommand from the integrated avionics electronics, it selects the ONIE system or the SONIC system. The switching process includes the following steps:

[0051] 1. The integrated avionics electronics sends a telecommand to the on-board router CPLD system to control the power-down of the on-board router flash;

[0052] 2. The integrated avionics electronics sends a telemetry request command to the on-board router CPLD system to confirm the system status;

[0053] 3. The integrated avionics electronics sends a telecommand to the on-board router CPLD system to control the switching of the on-board router GPIO signal;

[0054] 4. The integrated avionics electronics sends a telecommand to the on-board router CPLD system to control the power-on of the on-board router flash. The on-board router uboot system selects to start from the corresponding system by reading the specified GPIO signal. A low level selects the ONIE system, and a high level selects the SONIC system. The default is a high level;

[0055] 5. The integrated avionics electronics sends a telemetry request command to the currently running system (ONIE / SONIC) of the on-board router, and the currently running system of the on-board router returns the current status information.

[0056] Step 3: If the telecommand control instruction and the telemetry status information of the SONIC system have abnormal transceiver, go to Step 5; otherwise, try to execute Step 6. After successful execution, wait for the container to restart successfully and then check the system status. If the system is restored, end this step; if it is still not restored, check whether there is an abnormal MAC (Media Access Control) configuration in the current SONIC system. If there is an abnormality, go to Step 4; otherwise, go to Step 5;

[0057] Step 4: For the abnormal operation of the boot system, it can be restored by synchronizing and backing up the configuration of the boot system. First, switch to the backup flash and power it on through a telecommand. If the SONIC system can be normally entered after switching to the backup flash, execute the following instructions. Based on the dual-flash configuration synchronization design, update the configuration information stored in the backup flash to the EMMC (Embedded MultiMedia Card). After synchronization, enter the default flash (the default is the main flash) to load the synchronized and latest configuration information to achieve the restoration of the boot system; if both flashes are abnormal or the restoration of the boot system fails, switch to the backup board communication through a telecommand;

[0058] The restoration process of the boot system specifically includes the following steps:

[0059] 1. Select to power on from the backup flash through a telecommand;

[0060] 2. After power-on, the backup flash automatically reads the flash synchronization flag saved in the EMMC, and based on the flag, decides whether to synchronize the configuration information of the default flash. If the backup flash synchronization flag already exists at this time, the backup flash does not need to perform configuration synchronization again and proceeds to the next step; otherwise, this step ends.

[0061] 3. Enter the SONIC system from the backup flash, call the configuration information synchronization script through the remote control command, delete the latest configuration information and the main-backup flash synchronization flag saved in the EMMC, and update the configuration information of the backup flash to the EMMC.

[0062] 4. Since the configuration information of the backup flash and the EMMC has been synchronized, create a synchronization flag for the backup flash in the EMMC.

[0063] 5. Power off the backup flash through the remote control command and choose to power on from the default flash.

[0064] 6. After power-on, the default flash automatically reads the flash synchronization flag saved in the EMMC. At this time, the backup flash synchronization flag already exists, and the default flash synchronization flag has not been created yet. The default flash automatically performs a synchronization operation to update the configuration information stored in the EMMC to the current flash.

[0065] 7. Since the configuration information of the default flash and the EMMC has been synchronized, create a synchronization flag for the default flash in the EMMC.

[0066] 8. Complete the configuration synchronization of the boot system and enter the SONIC system from the default flash.

[0067] It should be noted that if the main and backup flashes have been synchronized before the default flash of the satellite router system fails, the backup flash synchronization flag already exists and is not affected by the abnormal flash configuration; otherwise, the backup flash will automatically synchronize the abnormal configuration of the default flash, resulting in both flashes entering an abnormal state.

[0068] Step Five: For abnormal operation of the SONIC system, it can be restored by reinstalling SONIC. According to the different availability of the SONIC system, two corresponding installation schemes can be adopted (reinstalling the SONIC system based on SONIC online and reinstalling the SONIC system based on the ONIE system). If the telemetry and remote control transceiver under the SONIC system is normal, both schemes can be executed; otherwise, only the scheme of reinstalling the SONIC system based on the ONIE system can be adopted. If the reinstallation of the SONIC system fails, the communication service operation can be guaranteed by switching to the backup board through the remote control command.

[0069] Specifically, the solution for online reinstalling the SONIC system based on SONIC includes the following steps:

[0070] 1. Execute the remote control instruction. First, try to load the backup installation package from the mounted disk to install the system online. If the installation package does not exist or the checksum is abnormal, the status information of the installation failure can be obtained through telemetry, and then try to obtain the available installation package from the integrated power supply or the intelligent computer through the remote control instruction, and execute the installation instruction again until the normal installation is completed;

[0071] 2. Judge whether the installation instruction has been executed completely according to the telemetry. If the execution is successful, two versions of the sonic system have been installed in the current system. Restart the system through the remote control instruction, and it will automatically switch to the new system; otherwise, it is necessary to further locate the reason why the system installation instruction fails to execute successfully. If the instruction sending or receiving fails, try to resend the instruction to solve it. Otherwise, end this step and switch to the ONIE system for reinstallation;

[0072] 3. After switching to the new system, judge whether the system service has returned to normal according to the system status information returned by the telemetry. If the service has been restored, execute the remote control instruction to uninstall the old version of the system; otherwise, end this step and switch to the ONIE system for reinstallation.

[0073] The system switching design of the spaceborne router based on GPIO monitoring can switch to the ONIE system to reinstall the SONIC system in the case of an exception in the current SONIC operating system, thereby restoring the system availability. Specifically, the solution for reinstalling the SONIC system based on the ONIE system includes the following steps:

[0074] 1. Execute the system switching instruction based on the CPLD remote control instruction of the spaceborne router, power off the current SONIC system and then switch to start up from the ONIE system and power on again;

[0075] 2. Judge whether the system status information returned by the ONIE system telemetry is normal. If the system status is normal, enter step 3 to execute the remote control instruction to install the system; otherwise, it means that the ONIE system is abnormal, and end this step;

[0076] 3. Execute the remote control instruction. First, try to load the backup installation package from the mounted disk to install the system. If the installation package does not exist or the checksum is abnormal, the status information of the installation failure can be obtained through telemetry, and then try to obtain the available installation package from the integrated power supply through the remote control instruction and execute the installation instruction again until the normal installation is completed;

[0077] After the system installation is successful, it will automatically enter the sonic system, and judge whether the system service has returned to normal according to the system status information returned by the telemetry.

[0078] If it is determined that the ONIE system of the spaceborne router is abnormal, perform the following steps to reinstall the ONIE system:

[0079] 1. After power-on, first enter the SONIC system and check whether the telemetry and telecontrol functions are available. If the telemetry and telecontrol are abnormal and cannot be used, end this step; otherwise, enter step 2 to execute the telecontrol command to reinstall the ONIE system;

[0080] 2. First, try to load the ONIE system image installation package from the mounted disk through the telecontrol command. If the target image does not exist on the mounted disk or the checksum is abnormal, the correct installation package can be obtained from the comprehensive power supply to get the uploaded file;

[0081] 3. Based on the telecontrol command, decompress the image installation package and execute the installation script to link the latest image to the system. If the execution is successful, enter step 4; otherwise, it means that the current installation package is abnormal, and enter step 2 to obtain the installation package again;

[0082] Execute the system switching instruction through the CPLD, power off the current board and then switch to start from the ONIE system and power on again, and judge whether the system reinstallation is successful according to the system status information returned by the telemetry.

[0083] Step 6: Based on the default network configuration, execute the reloading instruction, and restart the service container without restarting the system to restore the default network configuration. Based on the triple-mode redundancy implemented at the software level, it can ensure that the service availability is restored by automatically synchronizing data in the case where the currently running service configuration is inconsistent with the backup data.

[0084] Example 1:

[0085] In the embodiment of the present invention, if it is located that there is a problem with the boot system based on the telemetry status, the availability of the current boot system can be restored by synchronizing the configuration of the backup boot system. The timing diagram corresponding to the location and restoration process is as Figure 4 shown, including the following steps:

[0086] 1. The space mission comprehensive power supply sends a telecontrol command to the CPLD of the spaceborne router to select to start the SONIC system and power on from the main flash;

[0087] 2. The CPLD of the spaceborne router controls the main flash to power on and updates the specified GPIO to high level; the main flash selects to enter the SONIC system based on the GPIO signal;

[0088] 3. The integrated power supply requests the telemetry status from the SONIC system. After the system starts successfully, it will return the corresponding status information. Based on the system startup time, container status, and port status information included in the telemetry status, determine whether the SONIC system is in an abnormal state. If the status is normal, end this step; otherwise, send a remote control command to the on-board router CPLD to power down the main flash.

[0089] 4. The on-board router CPLD controls the main flash to power down.

[0090] 5. The integrated power supply sends a remote control command to the on-board router CPLD to select and start the ONIE system and power on from the main flash.

[0091] 6. The on-board router CPLD controls the main flash to power on and updates the specified GPIO to low level; the main flash selects to enter the ONIE system based on the GPIO signal.

[0092] 7. The integrated power supply requests the telemetry status from the ONIE system. After the system starts successfully, it will return the corresponding status information. Based on the system startup time and network status information included in the telemetry status, determine whether the ONIE system is in an abnormal state. If the status is normal, end this step; otherwise, send a remote control command to the on-board router CPLD to power down the main flash.

[0093] 8. The on-board router CPLD controls the main flash to power down.

[0094] 9. The integrated power supply sends a remote control command to the on-board router CPLD to select and start the SONIC system and power on from the backup flash.

[0095] 10. The on-board router CPLD controls the backup flash to power on and updates the specified GPIO to high level; the backup flash selects to enter the SONIC system based on the GPIO signal.

[0096] 11. The integrated power supply requests the telemetry status from the SONIC system. After the system starts successfully, it will return the corresponding status information. Based on the telemetry status, determine whether the system MAC configuration is normal. If it is normal, the integrated power supply sends a remote control command to the on-board router CPLD to synchronize the flash configuration.

[0097] 12. The SONIC system executes the synchronization command, deletes the latest configuration information and the main-backup flash synchronization flag saved in the EMMC, updates the configuration information of the backup flash to the EMMC, and creates a synchronization flag for the backup flash in the EMMC at the same time.

[0098] 13. The integrated power supply requests the telemetry status from the SONIC system, and the system returns the current status information of the integrated power supply. Based on the telemetry, it is judged whether the synchronization is completed. After waiting for the synchronization to be completed, a remote control command is sent to the on-board router CPLD to power off the backup flash.

[0099] 14. The on-board router CPLD controls the main flash to power off.

[0100] 15. The integrated power supply sends a remote control command to the on-board router CPLD to select to start the SONIC system and power on from the main flash.

[0101] 16. The on-board router CPLD controls the main flash to power on and updates the specified GPIO to high level; the main flash selects to enter the SONIC system based on the GPIO signal.

[0102] 17. The integrated power supply requests the telemetry status from the SONIC system. After the system starts successfully, it will return the corresponding status information. Based on the telemetry status, it is judged whether the SONIC system is successfully restored.

[0103] Embodiment 2:

[0104] In the embodiment of the present invention, if a problem with the SONIC system is located based on the telemetry status, the availability of the current system can be restored by reinstalling the SONIC system online. The timing diagram corresponding to the specific restoration process is as Figure 5 shown, and it includes the following steps:

[0105] 1. The satellite bus integrated power supply sends a remote control command to the on-board router CPLD to select to start the SONIC system and power on.

[0106] 2. The on-board router CPLD controls the SONIC system to power on.

[0107] 3. The integrated power supply requests the telemetry status from the SONIC system. After the system starts successfully, it will return the corresponding status information. After judging that each container of the system is in a stable state based on the telemetry status, the integrated power supply sends a remote control command to the on-board router SONIC to install a new version of SONIC.

[0108] 4. The on-board router SONIC system executes the remote control command. First, it tries to load the backup installation package from the mounted disk to install the system online. If the installation package does not exist or the checksum is abnormal, it then tries to obtain an available installation package from the integrated power supply and executes the installation command again until the normal installation is completed. After the installation is completed, the current EMMC contains two versions of the SONIC system, the old and the new.

[0109] 5. The integrated power supply requests the telemetry status from the SONIC system. After judging that the system installation is completed based on the telemetry status, the integrated power supply sends a remote control command to the on-board router SONIC to restart the current SONIC system.

[0110] 6. After the SONIC system executes the remote control instruction to restart the system, it automatically enters the new version of the SONIC system;

[0111] 7. The integrated power system requests the telemetry status from the SONIC system. After judging that the system restart is completed and all containers of the system are in a stable state according to the telemetry status, the integrated power system issues a remote control instruction to the on-board router SONIC to uninstall the old version of the SONIC system;

[0112] 8. The integrated power system requests the telemetry status from the SONIC system and judges whether the SONIC system has been successfully restored according to the telemetry status.

[0113] Embodiment 3:

[0114] In the embodiment of the present invention, if a problem occurs in the SONIC system based on the telemetry status, but the current state of the SONIC system does not support online installation, the availability of the current system can be restored by reinstalling the SONIC system based on the ONIE system. The timing diagram corresponding to the specific location and recovery process is as Figure 6 shown and includes the following steps:

[0115] 1. The integrated power system of the satellite mission issues a remote control instruction to the on-board router CPLD to select to start the SONIC system and power it on;

[0116] 2. The on-board router CPLD updates the specified GPIO to a high level, and the flash selects to enter the SONIC system based on the GPIO signal;

[0117] 3. The integrated power system requests the telemetry status from the SONIC system. After the system starts successfully, it will return the corresponding status information. According to the system start time, container status, and port status information included in the telemetry status, judge whether the SONIC system is in an abnormal state. If the state is normal, end this step; otherwise, issue a remote control instruction to the on-board router CPLD to power off the SONIC system;

[0118] 4. The on-board router CPLD controls the SONIC system to power off;

[0119] 5. The integrated power system issues a remote control instruction to the on-board router CPLD to select to start the ONIE system and power it on;

[0120] 6. The on-board router CPLD updates the specified GPIO to a low level, and the flash selects to enter the ONIE system based on the GPIO signal;

[0121] 7. The integrated power requests the telemetry status from the ONIE system. After the system starts successfully, it will return the corresponding status information. Based on the system startup time and network status information included in the telemetry status, determine whether the ONIE system is in an abnormal state. If the status is abnormal, end this step; otherwise, send a remote control command to the ONIE system of the on-board router to reinstall the SONIC system.

[0122] 8. The ONIE system executes the remote control command. First, it tries to load the backup installation package from the mounted disk and install it. If the installation package does not exist or the checksum is abnormal, it then tries to obtain an available installation package from the integrated power and executes the installation command again until the SONIC system installation is completed normally.

[0123] 9. The integrated power requests the telemetry status from the ONIE system and waits for the system installation to complete.

[0124] 10. After the ONIE system installation is completed, it automatically restarts and enters the SONIC system.

[0125] 11. The integrated power requests the telemetry status from the SONIC system. After the system starts successfully, it will return the corresponding status information. Based on the telemetry status, determine whether the SONIC system has been successfully restored.

[0126] Example 4:

[0127] In the embodiment of the present invention, if a problem with the ONIE system is located based on the telemetry status and the current state of the SONIC system is normal, the availability of the current system can be restored by reinstalling the ONIE system based on the SONIC system. The timing diagram corresponding to the specific location and recovery process is as Figure 7 shown and includes the following steps:

[0128] 1. The integrated power of the satellite bus sends a remote control command to the CPLD of the on-board router to select to start the SONIC system and power it on.

[0129] 2. The CPLD of the on-board router updates the specified GPIO to high level, and the flash selects to enter the SONIC system based on the GPIO signal.

[0130] 3. The integrated power requests the telemetry status from the SONIC system. After the system starts successfully, it will return the corresponding status information. Based on the system startup time, container status, and port status information included in the telemetry status, determine whether the SONIC system is in an abnormal state. If the status is abnormal, end this step; otherwise, send a remote control command to the SONIC system to reinstall the ONIE system.

[0131] 4. The SONIC system executes the remote control instruction. First, it attempts to load the ONIE system installation package from the mounted disk to install the system online. If the installation package does not exist or the checksum is abnormal, it then attempts to obtain an available installation package from the integrated power supply and executes the installation instruction again until the ONIE system is successfully installed.

[0132] 5. The integrated power supply requests the telemetry status from the SONIC system. After the system starts successfully, it will return the corresponding status information. According to the telemetry status, it is judged whether the ONIE system is reinstalled successfully. If the status is abnormal, this step is ended. Otherwise, a remote control instruction is sent to the CPLD of the on-board router to power off the SONIC system.

[0133] 6. The CPLD of the on-board router controls the SONIC system to power off.

[0134] 7. The integrated power supply sends a remote control instruction to the CPLD of the on-board router to select to start the ONIE system and power it on.

[0135] 8. The CPLD of the on-board router updates the specified GPIO to low level, and the flash selects to enter the ONIE system based on the GPIO signal.

[0136] 9. The integrated power supply requests the telemetry status from the ONIE system. After the system starts successfully, it will return the corresponding status information. According to the telemetry status, it is judged whether the ONIE system is successfully restored.

[0137] The above embodiments are only used to illustrate the design idea and features of the present invention, and its purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made according to the principles and design ideas disclosed by the present invention are within the protection scope of the present invention.

Claims

1. A spaceborne router anomaly recovery system based on multi-level redundancy, characterized in that, It includes the satellite bus integrated electronics and the on-board router; the on-board router integrates a main routing and switching unit and a standby routing and switching unit inside. Both the main routing and switching unit and the standby routing and switching unit contain a CPLD, two flashes, and an EMMC, where the two flashes are backup to each other; two operating systems, ONIE and SONIC, are installed in the EMMC; each time it starts up, the CPLD controls one of the flashes to power on, and the uboot installed in the flash boots the operating system stored in the EMMC via the boot system control link; the two switching units interact with the satellite bus integrated electronics via the telemetry and telecommand control link; the on-board router single device selects any one of the four routes, namely main flash - main SONIC, standby flash - main SONIC, main flash - standby SONIC, and standby flash - standby SONIC, to enter the SONIC system, and after entering the system through any route, it selects four methods, namely system restart, SONIC system configuration reloading, online reinstalling the SONIC system based on SONIC, and reinstalling the SONIC system based on ONIE, to restore system availability.

2. The on-board router anomaly recovery system based on multi-level redundancy according to claim 1, wherein, During the SONIC system configuration reloading process, on the premise of ensuring that the system does not restart, only the service containers other than the database are restarted. The container restart completion can be monitored through the telemetry status, and the normal restoration of the container status indicates that the reloading command has been executed.

3. The on-board router anomaly recovery system based on multi-level redundancy according to claim 1, characterized in that The methods for reinstalling the SONIC system include online reinstalling the SONIC system based on SONIC and reinstalling the SONIC system based on ONIE; if the telemetry and telecommand transceiver is normal under the SONIC system, either method can be selected; otherwise, only the method of reinstalling the SONIC system based on the ONIE system can be used.

4. The on-board router anomaly recovery system based on multi-level redundancy according to claim 1, characterized in that, Before performing the online reinstallation of the SONIC system based on SONIC, the container status needs to be checked. If the status is normal, the reinstallation operation is performed; otherwise, it is necessary to switch to the ONIE system for reinstallation; the online installation of the SONIC system is based on the telecommand. After the installation is completed, the current SONIC system contains two systems, and restarting will automatically switch to the new system; according to the system status information returned by the telemetry, it is judged whether the system service has been restored to normal. If the service has been restored, the telecommand is executed to uninstall the old version system; otherwise, it is switched to the ONIE system for reinstallation.

5. The on-board router anomaly recovery system based on multi-level redundancy according to claim 1, characterized in that If the SONIC system is in an abnormal state and cannot be reinstalled online, it is switched to the ONIE system based on the telemetry and telecommand instruction and then the SONIC system is reinstalled; first, it is judged whether the telemetry status of the ONIE system is normal. If it is normal, the telecommand is executed to install the system, and an attempt is made to load the backup installation package from the mounted disk. If the installation package does not exist or the checksum is abnormal, an attempt is made to obtain an available installation package from the satellite bus integrated electronics through the telecommand and execute the installation instruction again until the normal installation is completed; after the installation instruction is successfully executed, the system will switch to the SONIC system, and according to the system status information returned by the telemetry, it is judged whether the system service has been restored to normal.

6. The on-board router anomaly recovery system based on multi-level redundancy according to claim 1, wherein, If the primary flash is abnormal and the secondary flash is normal, switch to the secondary flash, delete the latest configuration information and the primary-secondary flash synchronization flag saved in the EMMC through the remote control command, update the configuration information of the secondary flash to the EMMC, and create a synchronization flag for the secondary flash in the EMMC; after switching back to the primary flash, the boot system synchronizes the configuration information of the default flash according to the flash synchronization flag saved in the EMMC, and creates a synchronization flag for the primary flash in the EMMC; If the secondary flash is abnormal and the primary flash is normal, the recovery method is the same; if both the primary and secondary flashes are abnormal, the current SONIC system cannot be recovered, and switch to the secondary SONIC system to restore the communication link service; the secondary SONIC system is the SONIC system in the secondary routing and switching unit.

7. The on-board router anomaly recovery system based on multi-level redundancy according to claim 1, characterized in that, If the ONIE system is abnormal, switch to the SONIC system to check whether the telemetry and remote control functions are available. If the SONIC system telemetry and remote control are normal, reinstall based on the SONIC system to restore system availability; first, try to load the ONIE system image installation package from the mounted disk through the remote control command. If the target image does not exist on the mounted disk or the checksum is abnormal, obtain the correct installation package from the space service integrated electronics, decompress and execute the installation script to link the latest image to the system, and determine whether the system reinstallation is successful according to the system status information returned by the telemetry.

8. A method for abnormal recovery of a spaceborne router based on multi-level redundancy, characterized in that Implementation of an on-board router anomaly recovery system based on multi-level redundancy according to claim 1; for the anomaly scenarios of in-satellite, inter-satellite or space-ground data link services during the satellite constellation communication process, combined with the control link communication status among the space service integrated electronics, the CPLD of the on-board router system, the SONIC system of the on-board router and the ONIE system of the on-board router, execute the corresponding recovery plan to ensure the availability of the data link service; the recovery plan includes the following steps: a) Check the status of the SONIC system. If the telemetry status of the SONIC system is abnormal and the remote control command sending and receiving are abnormal, go to step b; otherwise, check the status of the SONIC system based on the telemetry status and remote control command of the SONIC system. If there is an abnormality, go to step b; otherwise, end this step; b) Try to restart the SONIC system. After restarting, check whether the status of the SONIC system has been restored. If it has been restored, end this step; otherwise, go to step c; c) If the SONIC system can normally send and receive telemetry and remote control status information, go to step d; otherwise, check the status of the ONIE system. If the ONIE system can normally send and receive telemetry and remote control status information and the MAC configuration status is normal, go to step e; otherwise, go to step f; d) Try to reload the SONIC system configuration. If the system is restored after execution, end this step; otherwise, check whether the SONIC system MAC is abnormal. If there is an abnormality, go to step f; otherwise, go to step g; e) Try to reinstall the SONIC to restore system availability based on the telemetry and remote control commands under the ONIE system. If the recovery fails, go to step h; otherwise, end this step; f) Try to switch the standby flash to enter the SONIC system, and restore the system availability by synchronously backing up the configuration of the boot system. If the restoration fails, go to step h; otherwise, end this step. g) Try to reinstall the SONIC system under the SONIC system to restore the system availability. If the restoration fails, go to step h; otherwise, end this step. h) Try to switch to the standby routing and switching unit through remote control instructions to restore service availability.

9. The method for abnormal recovery of a spaceborne router based on multi-level redundancy according to claim 8, wherein, If the SONIC system is in a normal state, check the status of other payloads and network configurations on the communication link. Analyze the status of other payloads and network configurations on the communication link in combination with the corresponding port status and port count returned by the telemetry of the on-board router. If the count increases normally, it means that the message has been sent. If the space-ground link is not working, the space-ground communication payload and the ground station will troubleshoot the problem. If the inter-satellite link is not working, the inter-satellite communication payload will locate the problem.

10. A method for abnormal recovery of a spaceborne router based on multi-level redundancy according to claim 8, characterized in that, The method for restoring the system availability based on the configuration of the backup boot system is designed based on the dual-flash redundancy architecture. The SONIC system is controlled by telemetry instructions to update the configuration information stored in the standby flash to the EMMC to complete synchronization. When the on-board router enters the default flash again, it first loads the latest synchronized configuration information, thereby realizing the restoration of the availability of the boot system.

Images