Low-cost satellite-borne core circuit, operation method and electronic device

Abstract

The invention discloses a low-cost satellite-borne core circuit, an operation method and an electronic device, and belongs to the field of satellite communication circuit design, the low-cost satellite-borne core circuit comprises an embedded MCU, a peripheral circuit and embedded MCU software, the peripheral circuit is connected with the embedded MCU, and the embedded MCU software is loaded and operated by the MCU. According to the invention, based on a new generation of vehicle-gauge-level embedded MCU and peripheral components, the cost of components applied to low-orbit satellite-borne products is greatly reduced; according to the circuit design, multiple redundancy reinforcement technical means such as MCU processor redundancy backup, external interface circuit redundancy backup, software program storage redundancy backup and software triple modular redundancy reinforcement are adopted, and the operation reliability of a core circuit in a low-orbit satellite-borne environment is ensured.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of satellite communication circuit design, more particularly, to a low-cost on-board core circuit, a running method and an electronic device. BACKGROUND

[0002] With the increasing application of low-orbit satellites in recent years, especially the application of commercial components to satellite platforms by Starlink satellites, a new direction for the design concept of low-orbit satellite payloads is indicated. The number of satellites in a low-orbit satellite constellation is large, and the irradiation requirement for components is relatively low compared to medium-orbit and high-orbit satellites. If all traditional aerospace-grade components are used for design, the expensive design cost cannot be borne, which is not conducive to the batch production of the constellation. Moreover, there is still a great risk to the reliability of the product in low-orbit space.

[0003] Using vehicle-grade or commercial aerospace-grade products, and through various redundancies, backups, monitoring and processing means, the product is precisely designed to balance the design requirements of reliability guaranteed on the basis of relatively low cost, which has gradually become the main trend of low-orbit payload design. SUMMARY

[0004] The purpose of the present application is to overcome the shortcomings of the prior art and provide a low-cost on-board core circuit, a running method and an electronic device, which reduce the cost while ensuring reliability.

[0005] The purpose of the present application is achieved by the following scheme: A low-cost on-board core circuit, comprising: an embedded MCU, a peripheral circuit and an embedded MCU software, the peripheral circuit being connected with the embedded MCU, and the embedded MCU software being loaded and run by the MCU; The embedded MCU adopts a dual-redundancy backup design, two MCUs run the same program version and run program threads of the main channel and the redundant channel respectively; the redundant channel listens to the heartbeat signal sent by the main channel and the characteristic information analyzed by the main channel; once the heartbeat of the main channel stops, the redundant channel actively takes over the processing; when the redundant channel finds a serious error in the check information, it continues to observe the state of multiple communication frames, and once a continuous multiple frame error is found, it is considered that the main channel runs an error and also starts the takeover processing; The embedded MCU software adopts a triple-redundancy reinforcement, and when the program is loaded, the 1-main 2-backup program binary files stored for the same function are first subjected to triple-redundancy processing and then loaded to the MCU, and once it is found that a certain binary file has an error, the triple-redundancy processing result is used to cover the error binary, so as to realize the autonomous maintenance of the on-orbit program file; during the program running process, the important information analyzed by the main channel is confirmed to be correct by using the characteristic information delivered by the redundant channel, and then the operation is performed.

[0006] Further, the peripheral circuit comprises a program memory, a data buffer and an interface circuit; the program memory selects a vehicle-grade QSPI FLASH; the data buffer selects an MRAM memory; and the interface chip in the interface circuit selects a vehicle-grade interface chip.

[0007] Further, the feature information is feature information or check information parsed by a communication protocol.

[0008] Further, the program memory is used for storing a running program version of the embedded MCU, and a software program storage redundancy backup design is adopted; the embedded MCU is internally integrated with a FLASH space, which is used as a factory resident version; and an external QSPIFLASH is used for storing a function program of the MCU, and a multiple version storage mode is adopted for the same function program.

[0009] Further, the memory of the data buffer selects an MRAM as a storage medium.

[0010] Further, the interface circuit comprises a CAN and an RS422 interface circuit; the CAN and the RS422 interface circuit adopt a dual-redundancy backup design, utilize the characteristic that the CAN and the RS422 support one-to-multiple reception, connect multiple interface chips at the receiving and transmitting ends respectively, and are connected to two MCUs respectively.

[0011] Further, the multiple version storage mode for the same function program specifically comprises: storing multiple function versions and storing the same function multiple times.

[0012] A running and monitoring method of a low-cost satellite core circuit, based on the low-cost satellite core circuit according to any one of the above, the MCU main channel and the redundant channel load the same program, and the program is run in two flow branches after being loaded, and the method specifically comprises the following steps: S1: after the MCU is loaded, it is firstly judged whether the current state is a main channel or a redundant channel; S2: the main channel flow enters a loop, once a control instruction interrupt is received, an interrupt service program is entered, the instruction is obtained and parsed to obtain feature information, the feature information is transmitted to the other MCU through the data channels of the two MCUs, the feature information transmitted by the other MCU is parsed and compared, if the feature information is consistent, it is proved that the states of the two MCUs are correct, and the program continues to be executed; if the feature information is inconsistent, an error is reported, and a retransmission request is sent to the upper computer; S3: After the redundant channel enters the cycle, the heartbeat signal sent by the main channel is monitored periodically, once the heartbeat is abnormal, the master-slave switching is started, and the main channel is reset; once the control instruction is received, the interrupt service program is entered, the instruction is obtained and the characteristic information is analyzed, the characteristic information is transmitted to the other MCU through the data channel of the two MCUs, at the same time, the characteristic information transmitted by the other MCU is analyzed and compared, if the characteristic information is continuously wrong for more than a set number of times, the main channel is considered to be untrusted, and the master-slave switching is started.

[0013] Further, in step S1, the main channel running by default power-on runs the main channel flow, and the other piece runs the redundant channel flow.

[0014] A version loading and maintenance method of a low-cost satellite core circuit, based on the low-cost satellite core circuit as described above, comprising the following steps: SS1: When the MCU program is loaded, the bootloader program is loaded first, the bootloader program will obtain the function version number to be loaded, and load the function program from different addresses of the FLASH; SS2: After confirming the version number, enter the main loop; SS3: If the function loading is not completed, read the three binary files in bytes, and perform three-module comparison, after the three-module verification is successful, store the data into the loading area of the MCU, if the three-module verification is wrong, immediately repair the wrong binary file, until the program reading is completed; in this process, the storage data with data flip is restored to the normal state through the three-module redundant processing, so that the autonomous maintenance of the on-orbit program file is realized; SS4: After all the programs are sent into the loading area of the MCU, perform the jump operation, and start the function program running.

[0015] An electronic device comprising the low-cost satellite core circuit as described in any one of the above.

[0016] The beneficial effects of the present application include: (1) The present application abandons the selection of traditional aerospace-grade components, adopts a new generation of automotive-grade embedded MCUs and peripheral circuits, and performs necessary screening and low-cost design ideas, which can realize more than 80% cost saving of components. Moreover, the new generation of automotive-grade embedded MCUs selected by the present application have more abundant external interfaces than traditional satellite microprocessors, support multiple CAN, RS422, hundred-megabit Ethernet interfaces, and simplify the circuit design difficulty.

[0017] (2) In the scheme, the MCU processor is redundantly backed up, the external interface circuit is redundantly backed up, the hardware circuit has a hot backup capability, the main channel and the redundant channel are mutually backed up, the redundant channel monitors the running state of the main channel in real time under normal circumstances, and once the heartbeat signal stops or the characteristic information error appears continuously for multiple times, the running can be taken over.

[0018] (3) In the scheme, the data buffer has natural irradiation immunity, thereby avoiding the problem that the traditional RAM data buffer is prone to single event upset, which brings great risk to program running.

[0019] (4) In the scheme, the program storage adopts a multi-version storage mode, including storage of multiple function versions and storage of multiple two levels for the same function; during program loading, the 1 main 2 backup program binary files stored for the same function are subjected to three-mode redundancy processing and then loaded, the files with error check are covered by using the three-mode processing result, and autonomous maintenance of the in-orbit program file is realized; during program running, the important information analyzed by the main channel is confirmed to be correct by using the characteristic information delivered by the redundant channel, and then operation is performed, thereby improving the system reliability. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only constitute some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained from these drawings without creative labor.

[0021] Figure 1 The figure is a low-cost satellite-borne core circuit composition block diagram of the embodiment of the present application. Figure 2 The figure is an MCU running and monitoring flowchart of the embodiment of the present application. Figure 3 The figure is an MCU multi-version loading and maintenance flowchart of the embodiment of the present application. DETAILED DESCRIPTION

[0022] All features disclosed in the embodiments of the present application, or all steps in the methods or processes impliedly disclosed, can be combined and / or extended, replaced, unless mutually exclusive features and / or steps are mutually exclusive.

[0023] The specific implementation process of the present application is as follows: As a first aspect of the present application, refer to Figure 1, provide a low-cost satellite core circuit, comprising: embedded MCU, peripheral circuit and embedded MCU software; embedded MCU adopts dual redundant backup design, two MCU run the same program version, respectively run the main channel and the program thread of redundant channel; redundant channel listens to the heartbeat signal sent by the main channel and the characteristic information analyzed by the main channel, the characteristic information can be the characteristic information or check information parsed by the communication protocol; once the main channel heartbeat stops, the redundant channel initiates the takeover processing; when the redundant channel finds that the check information has serious errors, it continues to observe the state of multiple communication frames, and once there are continuous multiple frame errors, it is considered that the main channel runs an error, and the takeover processing is also started.

[0024] The peripheral circuit includes program memory, data cache and interface circuit (CAN, RS422, 100M Ethernet, etc.). Among them, the program memory selects vehicle-grade QSPI FLASH; the data cache selects MRAM memory; the CAN and RS422 interface chips in the interface circuit select vehicle-grade interface chips, which greatly reduces the cost of components compared with traditional aerospace-grade components. Further, the program memory is used to store the running program version of the embedded MCU, and a software program storage redundant backup design is adopted. The embedded MCU itself is integrated with FLASH space, which can be used as a factory resident version, and the external QSPI FLASH is used to store the function program of the MCU; due to the large capacity of QSPI FLASH, multiple versions of the same function program are stored, including storing multiple function versions and storing the same function multiple times, such as 1 main 2 backup. The memory of the data cache selects MRAM as the storage medium. Since the data cache in the traditional RAM is prone to single event upset, it cannot guarantee that the temporary data will not change during program running, which brings great risk to program running, so a magnetic storage MRAM immune to single event upset is selected to ensure that the temporary data will not flip during use. The CAN and RS422 interface circuit adopts dual redundant backup design, which utilizes the feature of CAN and RS422 that supports one-to-many transmission, and connects multiple interface chips at the receiving and transmitting ends, and connects them to two MCUs respectively. Thus, the circuit reliability is improved.

[0025] The embedded MCU software adopts triple modular redundancy reinforcement, which is reflected in the program loading process and the key running process. During program loading, the 1 main 2 backup program binary files stored for the same function are first subjected to triple modular redundancy processing before being loaded to the MCU. Once it is found that a certain binary file has errors, the triple modular processing result is used to cover the error binary, so as to realize autonomous maintenance of the in-orbit program file. During program running, the characteristic information transmitted by the redundant channel is used to confirm that the important information analyzed by the main channel is correct, and then the operation is performed.

[0026] The new generation of vehicle-grade embedded MCU has certain low-orbit irradiation index, a total dose of which is not less than 15 krad (Si), has peripheral interfaces such as CAN, high-speed RS422, 100-megabit Ethernet and the like, has the characteristics of simple circuit and low power consumption, is suitable for being used as a board-level control management core, meets system control management, remote control and telemetry, and can provide an on-orbit program update data injection interface and a control management interface for a core processor such as FPGA.

[0027] In conclusion, the application greatly reduces the component cost of low-orbit satellite products based on the new generation of vehicle-grade embedded MCU and peripheral components; the circuit design adopts multiple redundancy reinforcement technical means such as MCU processor redundancy backup, external interface circuit redundancy backup, software program storage redundancy backup and software triple modular redundancy reinforcement, thereby ensuring the reliability of the core circuit in the low-orbit satellite environment on the basis of low cost. In the scheme of the preferred embodiment, the technical scheme essentially belongs to the soft and hard cooperative improvement. The MCU hardware of the main channel and the redundant channel is redundantly designed, and the running state is monitored in real time on the software, thereby further improving the system reliability; the program storage adopts the backup mode of the integrated FLASH in the MCU and the external QSPIFLASH; the data register adopts the irradiation-immune MRAM magnetic storage medium; the external interface utilizes the one-to-many transmission characteristics of CAN and RS422, is connected with multiple interface chips at the receiving and transmitting ends respectively, and is connected to two MCUs respectively, thereby further improving the circuit reliability on the basis of low cost.

[0028] As a second aspect of the application, referring to Figure 2 , the MCU main channel and the redundant channel load the same program, and the program is run in two flow branches after being loaded. S1: After the MCU is loaded, it is firstly judged whether the current state is the main channel or the redundant channel, and optionally, the main channel flow is run by default in the main channel powered on, and the other one is run in the redundant channel flow.

[0029] S2: The main channel flow enters a loop, and once a control instruction interrupt is received, an interrupt service program is entered, the instruction is obtained and the characteristic information is obtained, the characteristic information is transmitted to the other MCU through the data channel of the two MCUs, the characteristic information transmitted by the other MCU is analyzed and compared, if the characteristic information is consistent, it is proved that the state of the two MCUs is correct, and the program continues to execute; if the characteristic information is inconsistent, an error is reported, and the host computer is requested to retransmit.

[0030] S3: After the redundant channel enters the cycle, the heartbeat signal sent by the main channel is periodically monitored, and once the heartbeat is abnormal, the master-slave switching is started, and the main channel is reset; once the control instruction is received, the interrupt service program is entered, the instruction is obtained and the characteristic information is analyzed, the characteristic information is transmitted to the other party through the data channel of the two MCUs, and the characteristic information transmitted by the other party is analyzed and compared, if the characteristic information is continuously wrong for more than 5 times (for example, 5 times), it is considered that the main channel is not reliable, and the master-slave switching is started.

[0031] As a third aspect of the present application, referring to Figure 3 , a MCU multi-version loading and maintenance process is provided. The MCU program storage adopts a software program storage redundancy backup design. The embedded MCU itself is internally integrated with FLASH, which is used as a factory resident version; an external QSPI FLASH is used to store the function program of the MCU; due to the large capacity of the QSPI FLASH, a multi-version storage method is adopted for the same function program, including storing multiple function versions and storing multiple times for the same function, such as 1 main and 2 backup, and the specific process is as follows: SS1: When the MCU program is loaded, the bootloader is loaded first, and the bootloader program will obtain the function version number to be loaded and load the function program from different addresses of the FLASH; SS2: After confirming the version number, the main loop is entered; SS3: If the function loading is not completed, three copies of the binary file are read according to the byte, and three-mode comparison is performed, and after the three-mode verification is successful, the data is stored in the loading area of the MCU, if the three-mode verification is wrong, the wrong binary file is repaired immediately, and the program reading is completed. In this process, the data with data flip-flop is restored to the normal state through three-mode redundancy processing, so that the autonomous maintenance of the on-orbit program file is realized.

[0032] SS4: After all the programs are sent to the MCU loading area, the jump operation is executed, and the function program starts running.

[0033] It should be noted that within the scope of protection defined in the claims of the present application, the following embodiments can be combined and / or extended, replaced, in any logical manner from the above specific embodiments, such as disclosed technical principles, disclosed technical features or implied disclosed technical features.

[0034] Example 1 A low-cost satellite core circuit, comprising: an embedded MCU, a peripheral circuit and an embedded MCU software, the peripheral circuit is connected with the embedded MCU, and the embedded MCU software is loaded and run by the MCU; The embedded MCU adopts a dual-redundancy backup design, two MCUs run the same program version, and respectively run the program threads of the main channel and the redundant channel; the redundant channel listens to the heartbeat signal sent by the main channel and the characteristic information analyzed by the main channel; once the heartbeat of the main channel stops, the redundant channel actively takes over the processing; when the redundant channel finds serious errors in the check information, it continues to observe the state of multiple communication frames, and once there are continuous multiple frame errors, it is considered that the main channel is running an error, and the takeover processing is also started; The embedded MCU software adopts a triple-redundancy reinforcement, and when the program is loaded, the 1 main 2 backup program binary files stored for the same function are first subjected to triple-redundancy processing and then loaded to the MCU, and once it is found that a certain binary file has an error, the triple-processing result is used to cover the error binary, so as to realize autonomous maintenance of the program file in orbit; during the program running process, the important information analyzed by the main channel is confirmed to be correct by using the characteristic information delivered by the redundant channel, and then operation is performed.

[0035] Embodiment 2 On the basis of embodiment 1, the peripheral circuit includes a program memory, a data buffer, and an interface circuit; the program memory selects a vehicle-grade QSPI FLASH; the data buffer selects an MRAM memory; and the interface chip in the interface circuit selects a vehicle-grade interface chip.

[0036] Embodiment 3 On the basis of embodiment 1, the characteristic information is characteristic information or check information parsed by a communication protocol.

[0037] Embodiment 4 On the basis of embodiment 2, the program memory is used to store the running program version of the embedded MCU, and adopts a software program storage redundancy backup design; the embedded MCU internally integrates a FLASH space, which is used as a factory resident version, and an external QSPI FLASH is used to store the function program of the MCU; and for the same function program, a multi-version storage mode is adopted.

[0038] Embodiment 5 On the basis of embodiment 2, the memory of the data buffer selects an MRAM as a storage medium.

[0039] Embodiment 6 On the basis of embodiment 2, the interface circuit includes a CAN and an RS422 interface circuit; the CAN and the RS422 interface circuit adopt a dual-redundancy backup design, and by using the characteristic that the CAN and the RS422 themselves support one-to-multiple reception, multiple interface chips are respectively connected at the receiving and transmitting ends and are respectively connected to two MCUs.

[0040] Embodiment 7 On the basis of embodiment 4, the multiple version storage mode is adopted for the same function program, specifically including: storing multiple function versions and storing multiple times for the same function.

[0041] Embodiment 8 A low-cost satellite core circuit operation and monitoring method, based on the low-cost satellite core circuit in any one of embodiments 1-7, the MCU main channel and the redundant channel load the same program, and the program is run in two flow branches after being loaded, specifically including the following steps: S1: After the MCU is loaded, firstly, it is judged whether the current state is the main channel or the redundant channel; S2: The main channel flow enters a loop, once the control instruction interrupt is received, the interrupt service program is entered, the instruction is obtained and the characteristic information is parsed, the characteristic information is transmitted to the other MCU through the data channel of the two MCUs, the characteristic information transmitted by the other MCU is parsed and compared, if they are consistent, it is proved that the state of the two MCUs is correct, and the program continues to execute; if they are not consistent, the error is reported, and the upper computer is requested to retransmit; S3: After the redundant channel enters a loop, the heartbeat signal sent by the main channel is periodically monitored, once the heartbeat is abnormal, the master-slave switching is started, and the main channel is reset; once the control instruction interrupt is received, the interrupt service program is entered, the instruction is obtained and the characteristic information is parsed, the characteristic information is transmitted to the other MCU through the data channel of the two MCUs, the characteristic information transmitted by the other MCU is parsed and compared, if the characteristic information is continuously wrong for more than a set number of times, the main channel is considered to be untrusted, and the master-slave switching is started.

[0042] Embodiment 9 On the basis of embodiment 8, in step S1, the main channel running the main channel flow is powered on by default, and the other piece runs the redundant channel flow.

[0043] Embodiment 10 A low-cost satellite core circuit version loading and maintenance method, based on the low-cost satellite core circuit in embodiment 4, including the following steps: SS1: When the MCU program is loaded, firstly, the bootloader program is loaded, the bootloader program will obtain the function version number to be loaded, and load the function program from different addresses of the FLASH; SS2: After confirming the version number, the main loop is entered; SS3: If the function loading is not completed, read the three copies of the binary file by bytes, and perform three-mode comparison. After the three-mode check is successful, the data is stored in the loading area of the MCU. If the three-mode check is incorrect, repair the incorrect binary file immediately until the program reading is completed. In this process, the storage data that appears data flip is restored to the normal state through the three-mode redundancy processing, thereby realizing the autonomous maintenance of the on-orbit program file. SS4: After all the programs are sent to the MCU loading area, perform a jump operation to start the function program running.

[0044] Embodiment 11 An electronic device includes the low-cost on-board core circuit of any one of Embodiments 1-7.

[0045] The units described in the embodiments of the present application can be implemented by software, or by hardware, or by a combination of software and hardware. The units described can also be located in a single processor. In some cases, the names of the units do not limit the units themselves.

[0046] According to an aspect of the embodiments of the present application, a computer program product or computer program is provided, which includes computer instructions stored in a computer readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device performs the method provided in the various optional implementation manners.

[0047] As another aspect, the embodiments of the present application also provide a computer readable medium, which can be included in the electronic device described in the above embodiments, or can exist separately without being assembled into the electronic device. The computer readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to implement the method described in the above embodiments.

Claims

1. A low-cost on-board core circuit, characterized by, The application relates to a low-cost satellite core circuit. The embedded MCU adopts a dual-redundancy backup design, two MCUs run the same program version, and respectively run program threads of a main channel and a redundant channel; the redundant channel listens to a heartbeat signal sent by the main channel and characteristic information analyzed by the main channel; Once the heartbeat of the main channel stops, the redundant channel initiatively takes over the processing; When the redundant channel finds serious errors in the check information, the redundant channel continues to observe the states of multiple communication frames, and once continuous multiple frame errors are found, it is considered that the main channel runs an error, and the redundant channel initiatively takes over the processing; The embedded MCU software adopts a triple-redundancy reinforcement, during program loading, 1-main and 2-backup program binary files of the same function are subjected to triple-redundancy processing before being loaded to the MCU, once it is found that one of the binary files has an error, the triple-redundancy processing result is used to cover the error binary file, so that the in-orbit program file is autonomously maintained; During program running, important information analyzed by the main channel is confirmed to be correct by using the characteristic information transmitted by the redundant channel, and then operation is performed. The peripheral circuit comprises a program memory, a data buffer and an interface circuit; the program memory selects a vehicle-grade QSPI FLASH; the data buffer selects an MRAM memory; and the interface chip in the interface circuit selects a vehicle-grade interface chip.

2. The low-cost spaceborne core circuit of claim 1, wherein, The characteristic information is characteristic information or check information analyzed by a communication protocol.

3. The low cost space core circuit of claim 1, wherein, The program memory is used for storing a running program version of the embedded MCU, adopts a software program storage redundancy backup design, the embedded MCU is internally integrated with a FLASH space which is used as a factory resident version, and an external QSPI FLASH is used for storing a function program of the MCU; and a multiple-version storage mode is adopted for the same function program.

4. The low cost space core circuit of claim 2, wherein, The memory of the data buffer selects an MRAM as a storage medium.

5. The low cost space core circuit of claim 2, wherein, The interface circuit comprises CAN and RS422 interface circuits; the CAN and RS422 interface circuits adopt a dual-redundancy backup design, utilize the characteristic that the CAN and RS422 can support one-to-multiple transmission, are respectively connected with multiple interface chips at receiving and transmitting ends, and are respectively connected to two MCUs.

6. The low cost space core circuit of claim 2, wherein, The multiple-version storage mode for the same function program specifically comprises the following steps: multiple function versions are stored, and the same function is stored multiple times.

7. The low cost space core circuit of claim 4, wherein, The low-cost satellite core circuit comprises a MCU main channel and a redundant channel which load the same program, the program is loaded and respectively runs in two flow branches, and the steps specifically comprise the following steps:

8. A method of operation and monitoring of a low-cost on-board core circuit, characterized by S1: after the MCU is loaded, it is firstly judged whether the current state is a main channel or a redundant channel; S2: the main channel flow enters a loop, once a control instruction is received, the main channel flow enters an interrupt service program, obtains the instruction, analyzes the instruction to obtain characteristic information, transmits the characteristic information to the other MCU through a data channel of the two MCUs, simultaneously analyzes the characteristic information transmitted by the other MCU and compares the characteristic information, if the characteristic information is consistent, it is proved that the states of the two MCUs are correct, and the program continues to be executed; if the characteristic information is inconsistent, an error is reported, and a retransmission request is sent to an upper computer. ​ S3: After the redundant channel enters the cycle, the heartbeat signal sent by the main channel is monitored periodically. Once the heartbeat is abnormal, the main-backup switching is started, and the main channel is reset. Once the control command is received, the interrupt service program is entered, the instruction is obtained and the characteristic information is analyzed, the characteristic information is transmitted to the other MCU through the data channel of the two MCUs, the characteristic information transmitted by the other MCU is analyzed and compared, if the characteristic information is continuously wrong for more than a certain number of times, the main channel is considered to be untrusted, and the main-backup switching is started.

9. The method of operating and monitoring a low cost core circuit on a satellite as recited in claim 8, wherein, In step S1, the main channel running the main channel flow by default is powered on, and the other one runs the redundant channel flow.

10. A method for version loading and maintenance of low-cost on-board core circuitry, characterized by The low-cost on-board core circuit based on the low-cost on-board core circuit in claim 4 comprises the following steps: SS1: When the MCU program is loaded, the bootloader program is loaded first, the bootloader program obtains the function version number to be loaded, and loads the function program from different addresses of the FLASH; SS2: After confirming the loading version number, the main loop is entered; SS3: If the function loading is not completed, the three-byte binary files are read and compared, and the data is stored in the loading area of the MCU after the three-module verification is successful. If the three-module verification is wrong, the wrong binary file is repaired immediately, and the program reading is completed; In this process, the storage data with data flip is restored to the normal state through the three-module redundant processing, thereby realizing the autonomous maintenance of the on-orbit program file; SS4: After all the programs are sent to the MCU loading area, the jump operation is executed, and the function program starts to run.

11. An electronic device, comprising: The low-cost on-board core circuit comprises the low-cost on-board core circuit in any one of claims 1-7.

Images