Triple-modular redundancy method based on redundancy backup and FPGA control

Abstract

The invention discloses a triple modular redundancy method based on redundancy backup and FPGA (Field Programmable Gate Array) control. Three groups of data lines are expanded on the FPGA to be connected with the Norflash, and three groups of data are read at the same time to perform triple modular redundancy calculation. The FPGA controls the four Norflash to write data at the same time during writing, and the FPGA chip selects the Norflash to output according to a logic sequence during reading, and determines whether to perform triple modular redundancy operation by judging the state of the Norflash. And sending the wrong sector number and the wrong Norflash number to the SOC chip through a serial port and a corresponding protocol, then sending the wrong sector number and the wrong Norflash number to the ground through the SOC chip, and after an instruction from the ground is received, carrying out error correction on the Norflash according to the instruction. According to the method, the influence of the radiation effect on the low-orbit satellite in the space is overcome, the cost is reduced to a certain extent, the speed and the efficiency are ensured, and meanwhile, the problems that under the condition that only three Norflash pieces exist, one Norflash piece breaks down, so that resources of the other two Norflash pieces are wasted, and data reading based on triple modular redundancy cannot be achieved are solved in a redundant backup mode.

Description

Technical Field

[0001] This invention relates to satellite on-orbit loading and reconfiguration technology, specifically to a triple redundancy method based on redundancy backup and FPGA control. Background Technology

[0002] Low Earth orbit (LEO) satellites face a range of challenges during operation, including cosmic rays, solar radiation, micrometeorites, and orbital debris. These can pose a fatal threat to the satellite's electronic systems. Storage devices hold the firmware required by various chips on the satellite's circuit board; errors in this firmware data can paralyze the entire system. Radiation-hardened storage devices emerged to address these issues, but they also have unavoidable drawbacks, such as high cost, slightly lower performance, lower storage density, and poor adaptability. To further reduce costs, avoid the aforementioned problems of radiation-hardened storage devices, and improve the reliability and fault tolerance of LEO satellite storage systems, triple-mode redundancy technology is widely used.

[0003] The commonly used triple modular redundancy (TMR) method involves reading from, comparing, and then outputting the data obtained through voting on three memory devices. However, the sequential writing and reading from the three memory devices is time-consuming, severely hindering system efficiency. Furthermore, traditional TMR methods lack error correction mechanisms; if a corresponding part of another memory device also malfunctions, the likelihood of system failure increases significantly, reducing overall system reliability. Moreover, in actual spaceflight, entire memory chips may fail. In the event of a failure in one memory device, traditional TMR technology cannot perform TMR calculations, forcing the remaining two chips to perform data reading and writing, which consumes significant resources and reduces system fault tolerance.

[0004] Therefore, how to reduce costs while ensuring the accuracy of data reading from the firmware of low-orbit satellites, thereby guaranteeing the fault tolerance and reliability of the entire on-orbit satellite, is a critical technical problem that urgently needs to be solved. Summary of the Invention

[0005] The purpose of this invention is to provide a triple mode redundancy method based on redundant backup and FPGA control, aiming to improve the reliability and radiation resistance of satellite firmware storage chips. This invention not only reduces costs but also ensures the speed and efficiency of triple mode redundancy, while avoiding the problem of wasting other resources due to the failure of a single Norflash chip.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: The system comprises four Norflash chips, three of which are default Norflash chips and the other is a backup Norflash chip. In addition, the system includes a control FPGA and a System-on-a-Chip (SoC) chip that can interact with both the FPGA and the ground station. The four Norflash chips share a set of address lines, while the remaining data and control signal lines are independent. The FPGA and SoC chip interact via a UART interface and a specified protocol.

[0007] Before satellite launch, the ground system packages the firmware data via RS422 interface according to the relevant protocol and simultaneously writes it to four Norflash chips. After writing is complete, the FPGA shuts down the backup Norflash to reduce the risk of damage and protect the data.

[0008] After the low-Earth orbit satellite is launched, the FPGA checks the status of the three default Norflash chips upon power-up. If the three Norflash chips are in normal condition, the FPGA simultaneously reads firmware data from the three sets of data lines, performs tri-modal redundancy calculations internally, outputs voting data, and loads the firmware.

[0009] If one of the three Norflash chips is detected to be malfunctioning and unable to boot, the FPGA automatically starts the backup Norflash. If the backup Norflash is functioning normally, the FPGA reads data from the two normally functioning default Norflash chips and the backup Norflash, performs tri-modal redundancy calculations, outputs voting data, and loads the firmware.

[0010] If two of the three Norflash chips are detected to be in an abnormal state, the FPGA will directly read data from the backup Norflash chip for output.

[0011] If the backup Norflash is detected to be malfunctioning, the FPGA reads the normal Norflash in ascending order of Norflash number.

[0012] When performing triple redundancy calculation, if the FPGA detects data anomalies, it records the sector where the data is located and the corresponding Norflash number. After the firmware writing is completed, it sends the data to the SOC chip via UART and the corresponding protocol. The SOC chip then sends the telemetry signal to the ground station. The specific protocol is shown in Table 2.

[0013] Upon receiving the error correction command from the ground station, the FPGA parses the command from the SOC chip and immediately performs Norflash error correction after completing its current task. The protocol commands are shown in Table 3.

[0014] During error correction, the FPGA simultaneously reads data from the sectors containing the erroneous bits in three Norflashes, performs tri-modular redundancy calculations, and obtains the correct data. If there is only one erroneous Norflash, the correct data is only rewritten to the erroneous sector in that Norflash. If there are more than one erroneous Norflash, the correct data is rewritten to the erroneous sectors in all three Norflashes simultaneously.

[0015] The beneficial effects of this invention are: First, this method effectively overcomes the problem of low-Earth orbit satellites being affected by radiation effects in space by implementing a triple-modal redundancy plus one backup design on the satellite firmware storage chip. Utilizing triple-modal redundancy calculation, the system operates three Norflash chips simultaneously when reading and writing data, thus ensuring data correctness and integrity even if a single chip fails. The backup design ensures that triple-modal redundancy calculation can still be completed even if one Norflash chip fails. Second, the hardware and logic design of this invention makes data reading and writing more efficient. The hardware acceleration design during data reading and the FPGA's simultaneous control of four Norflash chips during data writing improve data processing speed and system response time. Furthermore, the parallel processing of redundant data significantly enhances the system's fault tolerance and stability, ensuring stable operation even in extreme environments. Third, this invention adds error correction logic design and protocols, further enhancing system reliability. The erroneous sector number and Norflash number are transmitted to the SOC chip via a UART serial port, and then the SOC chip sends them to the ground command center for error correction. This design not only improves the efficiency of error detection and correction but also reduces system resource waste caused by single-chip Norflash failures, ensuring the utilization of other storage resources. Finally, it offers significant advantages in cost control. By adding three additional sets of data lines on the board to achieve triple redundancy, rather than using more independent redundant memories, hardware costs are saved. Simultaneously, the optimized redundant computing and data processing logic reduces the need for high-performance processors, further lowering the overall system cost. In conclusion, this invention has significant advantages and promising application prospects in improving system reliability, efficiency, and cost reduction. Attached Figure Description

[0016] Figure 1 This is a system framework diagram of the present invention; Figure 2 This is a block diagram of the three-modulus redundancy logic of the present invention; Figure 3 This is a block diagram of the Norflash status monitoring and chip select logic of the present invention; Detailed Implementation

[0017] The following detailed description, in conjunction with the accompanying drawings and embodiments, illustrates a triple-modular redundancy method based on redundancy backup and FPGA control according to the present invention. The following embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0018] Figure 1 This is a system framework diagram of the present invention. As shown in the figure, the triple redundancy method based on redundancy backup in a low-Earth orbit environment of the present invention includes the following parts: Part 1: Norflash memory The system contains four Norflash memory chips, three of which serve as the default memory (Norflash1, Norflash2, and Norflash3), and the other as the backup memory (Norflash4). These four Norflash chips share a set of address lines, while their respective data and control signal lines are independent. Part 2: FPGA The FPGA is responsible for operating four Norflash chips, including data erasure, writing, tri-mode read, single-mode read, and error correction. Simultaneously, the FPGA connects to a System-on-a-Chip (SoC) chip via a UART interface, enabling communication with the ground station. The FPGA periodically sends status information through the SoC chip and receives commands from the ground station. Part 3: SOC Chip The SOC chip is mainly responsible for communicating with the ground station, receiving status information sent by the FPGA through the UART interface, and transmitting the instructions sent by the ground station to the FPGA. Part 4: RS422 serial port Before the satellite launch, the ground host computer packages the firmware data and writes it into four Norflash chips via RS422 serial port and corresponding protocol; Part 5: UART serial port The FPGA communicates with the SOC chip via UART serial port and corresponding protocols; Part 6: Telemetry Protocol The telemetry protocol is mainly used to send error Norflash numbers and sector numbers to the ground, as specifically shown in Table 2 of the claims. Part 7: Remote Control Protocol The remote control protocol is mainly used for ground control of the FPGA to correct errors in the Norflash, as shown in Table 3 of the claims.

[0019] Figure 2This is a block diagram of the triple modular redundancy logic of the present invention. As shown in the figure, the triple modular redundancy logic of the present invention includes the following steps: Step 1: Firmware Writing Before satellite launch, firmware data is packaged and sent to the FPGA via the RS422 interface. After the FPGA decodes and verifies the data, it simultaneously writes the data to four Norflash chips. After writing is complete, the FPGA shuts down the backup Norflash. Step 2: Power-on self-test After satellite launch and power-on, the FPGA first checks the status of the three default Norflash chips. If the three default Norflash chips are in normal condition, the FPGA simultaneously reads data from the three Norflash chips, performs tri-modal redundancy calculation, and outputs the majority consistent data for firmware loading. Step 3: Troubleshooting If one of the three Norflash chips is in an abnormal state, the FPGA automatically activates the backup Norflash and performs tri-mode redundancy calculation with the remaining two default Norflash chips; if two Norflash chips fail, the FPGA directly reads the data from the backup Norflash; if the backup Norflash also fails, the FPGA reads the normal Norflash chips in ascending order of their serial numbers. Step 4: Data Correction During the triple modulo redundancy calculation process, if the FPGA detects a data anomaly, it records the faulty sector and Norflash number, and sends it to the SOC chip via UART. The SOC chip then transmits the data to the ground station. After the ground station sends an error correction command, the FPGA performs the error correction operation according to the command. At the same time, it reads the data in the sector where the faulty bit is located in the three Norflash chips and performs triple modulo redundancy calculation to obtain the correct data, and then rewrites it into the faulty Norflash.

[0020] Figure 3 This is a block diagram of the Norflash status monitoring and chip selection logic of the present invention. As shown in the figure, the Norflash status monitoring and chip selection process of the present invention includes the following steps: Step 1: Status Monitoring The FPGA monitors the RY / BY signal of each Norflash chip in real time. A high RY / BY signal indicates that the Norflash is in an idle state and can work normally; a low signal indicates that the Norflash may be faulty. Step 2: Chip Selection Logic If all three default Norflash chips are detected to be in normal condition, the FPGA simultaneously reads data from all three Norflash chips and performs tri-mode redundancy calculation. If one Norflash chip is abnormal, the FPGA automatically activates the backup Norflash chip for data reading and tri-mode redundancy calculation. If two Norflash chips are abnormal, the FPGA directly reads data from the backup Norflash chip. If the backup Norflash chip is also unusable, the FPGA reads the normal Norflash chips in ascending order of their serial numbers. Step 3: Error Correction Process If the FPGA detects an anomaly in the triple modulo redundancy calculation result, it records the erroneous sector and its Norflash number, and sends this information to the SOC chip via the UART interface. Upon receiving the error message, the ground station sends an error correction command to the SOC chip, which then forwards the command to the FPGA. The FPGA performs the error correction operation according to the command, simultaneously reading the data from the sector containing the erroneous bit in each of the three Norflash chips and performing triple modulo redundancy calculation to obtain the correct data, which is then rewritten into the erroneous Norflash.

[0021] This invention employs a triple-modal redundancy method based on redundancy backup and FPGA control in a low-Earth orbit environment, significantly improving the reliability and radiation resistance of satellite firmware storage. The FPGA performs triple-modal redundancy calculations by synchronously reading and comparing data from three default Norflash chips to ensure data consistency and correctness. When one or more Norflash chips fail, the system automatically activates the backup memory, ensuring uninterrupted data reading. The FPGA records errors and hands them over to the ground station, which then corrects them using error correction commands, ensuring data integrity. In summary, this invention, through its innovative triple-modal redundancy method and efficient hardware design, significantly improves the reliability and radiation resistance of low-Earth orbit satellite firmware storage while reducing costs and simplifying maintenance, demonstrating significant application value and broad market prospects.

Claims

1. A triple modular redundancy method based on redundancy backup and FPGA control, characterized in that, The triple redundancy method with redundant backups includes: S1: The system comprises four Norflash chips, three of which are default Norflash chips, one is a backup Norflash chip, and one chip controls the FPGA and a SOC chip that can interact with the FPGA and the ground. The four Norflash chips share a set of address lines, while the remaining data and control signal lines are independent. The FPGA and SOC chip interact via a serial port and a specified protocol. S2: When the satellite is writing firmware on the ground, it packages the data used to start other modules and writes it to four Norflash chips simultaneously via serial port according to the corresponding protocol. After writing is complete, the FPGA shuts down the backup Norflash. S3: Each time the system powers on, the FPGA on the satellite board checks the default status of the three Norflash chips. If the default status of the three Norflash chips is normal, the FPGA simultaneously reads the corresponding firmware from the three Norflash chips from the three sets of data lines, performs three-mode redundancy calculations internally, outputs the voting data of the three chips, and loads the firmware. S4: If one of the three Norflash chips is in an abnormal state and cannot start, the FPGA will automatically start the backup Norflash. It will then perform tri-modal redundancy calculations on the remaining Norflash chips, output the voting data from all three chips, and load the firmware. S5: If two of the three Norflash chips fail, the FPGA will read data from the backup Norflash. S6: If the backup Norflash is detected to be malfunctioning, read the normal Norflash in ascending order of Norflash number; S7: If the FPGA detects data anomalies during triple redundancy calculation, it records the sector where the data is located and the corresponding Norflash number, and sends it to the ground station via telemetry signal after the firmware writing is completed. S8: If an error correction instruction is received from the ground station, Norflash error correction will be performed immediately after the current task is completed; S9: During error correction, the error correction instruction is first parsed. Then, data from the sectors containing the error bits in the three Norflash memory are read simultaneously and triple modulo redundancy calculation is performed to obtain the correct data. S10: If there is only one faulty Norflash, then only the correct data is rewritten to the faulty sector in that Norflash. If there is more than one faulty Norflash, then the correct data is rewritten to the faulty sectors in all three Norflashes at the same time.

2. The triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S1 includes: The system comprises four Norflash chips and corresponding data lines, control signals, and address lines. An FPGA is used to operate these four chips, including erasing, writing, tri-mode read, single-mode read, and error correction. The FPGA is connected to a SoC chip via a serial port, enabling communication with the ground. The FPGA periodically sends status information to the ground through the SoC chip, and the SoC chip receives commands from the ground and sends them back to the FPGA.

3. The triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S2 includes: Before launch, the satellite first writes the required firmware into the Norflash. The host computer sends the packaged firmware to the FPGA via an agreed protocol and serial port. After successful decoding and verification, the FPGA writes the data simultaneously into all four Norflash chips. Once the writing is complete, the FPGA pulls down the relay switch of the backup chip, powering off the backup Norflash.

4. The triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S3 includes: After the low-Earth orbit satellite is launched into space, before operation, the RY / BY signals of the three default Norflash chips are checked. If the RY / BY pins are pulled high, it indicates that the Norflash is now in an idle state and can operate normally. At this time, the firmware in the three default Norflash chips is read simultaneously. To prevent metastability and delay from interfering with the tri-mode redundancy calculation, after the Norflash data is output, it is first synchronously scanned before the tri-mode redundancy calculation is performed. The specific calculation logic expression is as follows, where data1, data2, and data3 represent the data read from the same address in the three Norflash chips at the same time. See the table below: Table 1. Three-mode redundancy logic expressions 5. The triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S4 includes: If the RY / BY signal of one Norflash chip fails to go high within a certain time period, it is considered that the Norflash chip is malfunctioning. The FPGA then pulls the relay switch pin high to power on the backup Norflash chip, while simultaneously detecting its RY / BY signal. Once the signal goes high, data is output according to the three-mode redundancy calculation logic.

6. The triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S5 includes: If the RY / BY signals of two or three Norflash chips fail to go high within a certain timeframe, it is assumed that the Norflash chips with non-high pins are not functioning properly. The FPGA then pulls the relay switch pin high to power on the backup Norflash, simultaneously detecting its RY / BY signal. Once pulled high, the FPGA directly reads the data from the backup Norflash and outputs it.

7. The triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S6 includes: If the backup Norflash fails to pull the RY / BY signal high within a certain period after power-on, it is considered a fault in the backup Norflash. In this case, data is read from the Norflash where the RY / BY signal is high in ascending order.

8. The triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S7 includes: When performing triple-modulus redundancy calculation on the output data, if the ERROR signal is not 0, it indicates that there is incorrect data in the Norflash. The FPGA stores the sector containing the data and the corresponding Norflash number in a register. After the firmware writing process is complete, the FPGA packages the erroneous sector number and Norflash number according to the protocol and sends them to the SOC chip via UART. The SOC chip then sends them to the ground station. The corresponding protocol is shown in the table below: Table 2 Some Telemetry Protocols 9. The triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S8 includes: After receiving the erroneous sector number and Norflash number, the ground system sends a remote control command to the SOC chip. The SOC chip forwards the command to the FPGA according to the protocol. Upon receiving the data, the FPGA parses it, as shown in the table below. After completing its current task, the FPGA begins executing the error correction function, as shown in the table below: Table 3 Error Correction Command Protocol 10. A triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S9 includes: During error correction, the sector number requiring correction is first obtained from the parsed data. Then, data from the sectors containing the error bits in the three Norflash memory are read simultaneously and triple modulo redundancy calculation is performed to obtain the correct data.

11. The triple modular redundancy method based on redundancy backup and FPGA control according to claim 1, characterized in that, Step S10 includes: After obtaining the correct data, the FPGA retrieves the Norflash number that needs error correction from the parsed data. If it is 0x0000, it indicates that more than one Norflash in the corresponding sector has an error. In this case, the FPGA will simultaneously rewrite the data in the corresponding sectors of the three Norflashes. If it receives 0x0001-0x0004, it indicates that the Norflash with the corresponding number needs error correction, and the FPGA immediately begins to execute the sector erase and write operations for the corresponding Norflash.

Images