On-orbit reconstruction method and device for on-orbit aircraft

Abstract

This invention relates to an on-orbit reconfiguration method for on-orbit aircraft. This method utilizes an FPGA-FLASH hardware architecture and integrates the aircraft's injection channel. This method implements on-orbit program storage health monitoring and maintenance through methods such as on-orbit verification, on-orbit repair, and on-orbit injection. This solution eliminates the need for single-event upset (SEP)-resistant components, effectively reducing aircraft costs while ensuring aircraft reliability. The on-orbit injection method also allows for program version upgrades on-orbit, effectively improving mobility.

Description

Technical Field

[0001] The present invention relates to the field of on-orbit reconstruction of an aircraft, and in particular to an on-orbit reconstruction method and device for an on-orbit aircraft. Background Art

[0002] In recent years, SRAM-type FPGAs have been widely used in some low-cost experimental satellites due to their advantages such as large resources and low cost. However, since SRAM-type FPGAs are easily knocked over by high-energy particles in space, resulting in single-event upset effects, how to deal with single-event upsets and improve the reliability of SRAM-type FPGAs has become an issue that cannot be ignored.

[0003] Protection against single-event upsets (SINGs) for SRAM-based FPGAs consists of two main components: protecting the FPGA while the program is being loaded, and protecting the FPGA while the program is already loaded. For the latter, the FPGA-PROM architecture currently used on satellites is common. Because PROMs are antifuse memory chips, programs cannot be modified after being burned, making them immune to SINGs. However, this architecture is costly and has a maximum capacity of only 16Mbit, making it inadequate for the program sizes of FPGAs like the K7 and V7. Furthermore, due to the high cost, immutability, and small capacity of PROM memory, it is not suitable for low-cost, highly flexible experimental satellites. Summary of the Invention

[0004] In order to solve the above technical problems, this application adopts the following means.

[0005] In one aspect, a method for on-orbit reconfiguration of an on-orbit vehicle is provided, the method comprising the following steps:

[0006] S1: After powering on, the device automatically enters the two-out-of-three check state. The FPGA polls and reads the data in the three spaces in the same FLASH by controlling the highest and second highest bits of the FLASH. After reading the data at the same position in the three spaces locally, it compares them bit by bit using the "two-out-of-three" method. If the data is consistent, the data in the three spaces is considered correct. If not, the error count of the inconsistent space is increased by one.

[0007] S2: When the ground detects that the FLASH has been overturned based on telemetry and reconstructs the data in the FLASH, the two-out-of-three check function is disabled and the two-out-of-three repair function is enabled;

[0008] S3: If there are many errors in the on-track FLASH or you want to update the program version, enable the on-track injection operation.

[0009] In a possible implementation, step S1 includes: after traversing the FLASH space, feeding back the program error counts of the three spaces to the ground, and judging whether the onboard stand-alone FLASH program is overturned based on this state quantity.

[0010] In one possible implementation, step S2 includes: controlling the highest bit and the second highest bit of FLASH to poll and read the data in the three spaces in the same FLASH, reading the data at the same position in the three spaces locally, performing bit-by-bit comparison and storing the correct data locally, and clearing the cache if the data in the three spaces are correct; if there is a data error, erasing the space of the erroneous data and rewriting the data in the cache one by one.

[0011] In a possible implementation, the on-track injection step in step S3 includes:

[0012] S31: After exiting the three-out-of-two verification state, the stand-alone device sends an erase command to the selected FLASH. The erase command only erases the data in the first space of the currently selected FLASH and does not operate on the data in other spaces.

[0013] S32: When the telemetry returns the erase completion status, the FLASH is counted through the serial port. After a certain amount of data is written each time, the FLASH status register is read back to confirm the data write reconstruction; if the write is successful, continue writing; if the current data write is unsuccessful, the error status telemetry is returned;

[0014] S33: When the bit program is written, the ground sends back a read checksum instruction to end the on-orbit injection process. After receiving the instruction, the FPGA reads the data stored in the FLASH for sum verification and feeds back the sum verification; the reliability of the single machine is enhanced by comparing it with the sum verification result in the instruction.

[0015] On the other hand, an on-orbit reconfiguration device for an on-orbit vehicle is provided, the device comprising: an injection channel, an SRAM-type FPGA, and a FLASH;

[0016] The FLASH is divided into four spaces as the original FPGA program space. They are not operated during the on-track process, and only the programs in the first three spaces are reconstructed.

[0017] The device comprises:

[0018] The on-track verification module is used to automatically enter the three-out-of-three verification state after the device is powered on. The FPGA polls and reads the data in the three spaces in the same FLASH by controlling the highest and second highest bits of the FLASH. After reading the data at the same position in the three spaces locally, it compares them bit by bit using the "three-out-of-three" method. If the data is consistent, the data in the three spaces is considered correct; if not, the error count of the inconsistent space is increased by one.

[0019] The on-orbit repair module is used to reconstruct the data in the FLASH when the ground finds that the FLASH has been overturned based on telemetry. The three-out-of-two check function is disabled and the three-out-of-two repair function is enabled.

[0020] The on-track injection module is used to enable the on-track injection operation when many errors occur in the on-track FLASH or when you want to update the program version.

[0021] In one possible implementation, the apparatus further includes:

[0022] The feedback module is used to feed back the program error counts of the three spaces to the ground after traversing the FLASH space, and judge whether the on-board single-machine FLASH program is overturned based on this status quantity.

[0023] In one possible implementation, the apparatus further includes:

[0024] The data comparison module is used to poll and read the highest and second highest bits of the FLASH and the data in the three spaces of the same FLASH. After reading the data at the same position in the three spaces to the local memory, it compares them bit by bit and stores the correct data locally.

[0025] In one possible implementation, the apparatus further includes:

[0026] The command sending module is used to send an erase command to the selected FLASH after the stand-alone machine exits the three-out-two check state. The erase command only erases the data in the first space of the currently selected FLASH and does not operate on the data in other spaces;

[0027] The command readback module is used to count the FLASH through the serial port when the telemetry returns the erase completion status. After each unit writes a certain amount of data, it reads back the FLASH status register to confirm the data write reconstruction; if the write is successful, it continues to write; if the current data write is unsuccessful, it rewrites the current data;

[0028] The feedback verification module is used to send a readback verification and instruction from the ground to end the on-orbit injection process after the bit program is written. The FPGA reads back the data written to the FLASH as a whole and feeds back the verification to the ground in X. The reliability of the single machine is enhanced by comparing and verifying the results.

[0029] Due to the application of the above technical solution, the present invention has the following beneficial effects compared with the prior art:

[0030] The present invention can divide the FLASH into four spaces by controlling the two upper address lines of the FLASH. By writing programs into the four spaces respectively, a multiple backup effect can be achieved. By comparing the data in the FLASH in real time and transmitting the information of the comparison error to the ground, the ground can monitor the satellite's on-orbit program storage status in real time. By sending instructions, the FLASH content with data errors can be overwritten with the correct program through a three-out-two repair method, achieving an on-orbit reconstruction effect. By combining mode switching with an injection channel, the data in the FLASH space can be erased and written on-orbit, realizing an on-orbit program upgrade effect.

[0031] Through functions such as on-orbit verification, on-orbit repair, and on-orbit injection, on-orbit reconstruction of on-orbit spacecraft is achieved, which can effectively improve the reliability and maneuverability of satellites.

[0032] This invention does not require the use of components with single-particle upset resistance, and effectively reduces the cost of the aircraft while ensuring the reliability of the aircraft. Through the method of in-orbit injection, program version upgrades can be performed in-orbit, effectively improving maneuverability. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0034] Figure 1 A block diagram of the principles and components of an exemplary embodiment of the present invention is provided;

[0035] Figure 2 A flowchart of an exemplary embodiment of the present invention is provided. DETAILED DESCRIPTION

[0036] The present invention will be described in detail below with reference to specific embodiments. The following examples will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those skilled in the art, several changes and improvements can be made without departing from the scope of the present invention. These all fall within the scope of protection of the present invention.

[0037] See also Figure 1 , Figure 1 It is a block diagram of the principle of the present invention.

[0038] The hardware design of the present invention mainly includes an injection channel, an SRAM-type FPGA, and FLASH. By controlling the upper two addresses of the FLASH, the FLASH is divided into four spaces. The fourth FLASH space serves as the FPGA original program space and is not operated during the on-orbit process. Only the programs in the first three spaces are reconstructed. The on-orbit reconstruction method designed in this paper includes three-out-of-two verification, three-out-of-two repair, and on-orbit injection. Combined with telemetry monitoring of the single machine status, the reconstruction method is determined according to the actual situation. For example, in the specific implementation process, the specific steps are as follows:

[0039] S1: After the device is powered on, it automatically enters the three-out-of-three check state. The FPGA polls and reads the data in the three spaces of the same FLASH by controlling the highest and second highest bits of the FLASH. After reading the data at the same position in the three spaces locally, it compares them bit by bit using the "three-out-of-two" method. If the data is consistent, the data in the three spaces is considered correct. If not, the error count of the inconsistent space is increased by one.

[0040] The judgment method of "three out of two" is as follows:

[0041] Space 1 Space 2 Space 3 Verification results 0 0 0 All correct 0 0 1 Space 3 Error 0 1 0 Space 2 Error 0 1 1 Space 1 Error 1 0 0 Space 1 Error 1 0 1 Space 2 Error 1 1 0 Space 3 Error 1 1 1 All correct

[0042] After traversing the FLASH space in this way (or selecting the traversal space size based on the bit file size corresponding to the program), the program error counts of the three spaces are fed back to the ground. Based on this status, the ground determines whether the onboard stand-alone FLASH program has been overturned.

[0043] S2: When the ground detects that the FLASH has been overturned based on telemetry and wants to reconstruct the data in the FLASH, the three-out-of-two check function can be disabled and the three-out-of-two repair function can be enabled.

[0044] In the three-out-of-two repair function, it is still necessary to control the highest and second highest bits of the FLASH to poll and read the data in the three spaces of the same FLASH. After reading the data at the same position in the three spaces locally, perform bit-by-bit comparison. If the three data are correct, perform "three-out-of-two" comparison and store the correct data locally.

[0045] The method of selecting stored data through "three out of two" is as follows:

[0046] Space 1 Space 2 Space 3 Data to be stored 0 0 0 0 0 0 1 0 0 1 0 0 0 1 1 1 1 0 0 0 1 0 1 1 1 1 0 1 1 1 1 1

[0047] The size of the online storage space is determined by the minimum erase granularity of the selected FLASH.

[0048] Taking a FLASH chip with a minimum erase granularity of 1Mb as an example, data in three spaces is read in 1Mb increments, compared with the local storage. If there are no errors, the operation is performed on the next 1Mb of data. If there are errors, the current 1Mb of the erroneous data space is erased, and the correct data stored locally is written back to the erroneous FLASH space. After the write is complete, the operation is performed on the next 1Mb of data. After traversing the FLASH space, the data in the three spaces will be consistent, indicating that the on-orbit repair operation is successful. After a three-out-of-two repair, the stand-alone machine automatically enters the three-out-of-two verification state.

[0049] S3: If there are many errors in the on-track FLASH or you want to update the program version, you can enable the on-track injection function. The on-track injection signal flow is as follows Figure 2 shown.

[0050] The specific operation process is as follows:

[0051] a. After exiting the three-out-of-two verification state, the stand-alone device sends an erase command to the selected FLASH. The erase command only erases the data in the first space of the currently selected FLASH and does not operate on the data in other spaces.

[0052] b. When the telemetry returns the erase completion status, the FLASH is written through the serial port. The maximum amount of data written at a time for this stand-alone device is 1KB. After the write operation is completed, the FLASH status register can be read back to confirm the data write and reconstruction. If the write operation is successful, the write operation can continue; if the current data write is unsuccessful, the current data can be written again.

[0053] c. After the bit program is written, the ground sends a readback verification and command to end the on-orbit injection process. After executing the command, the FPGA reads back the entire written data and provides feedback and verification. By comparing and verifying the results, the reliability of the single machine can be enhanced.

[0054] It should be noted that if a program different from that in other spaces is registered, the on-orbit repair function cannot be enabled on a single machine, and the on-orbit verification results will be meaningless.

[0055] This document uses specific examples to illustrate the inventive concept in detail. The above embodiments are only intended to help understand the core concept of the present invention. It should be noted that any obvious modifications, equivalent substitutions, or other improvements made by a person skilled in the art without departing from the inventive concept should be included within the scope of protection of the present invention.

[0056] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of the present application and include common knowledge or customary techniques in the art not disclosed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the above-mentioned claims.

[0057] It should be understood that the present application is not limited to the exact structures described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

[0058] It should be understood that the term "plurality" used herein refers to two or more. "And / or" describes a relationship between associated objects, indicating that three possible relationships exist. For example, "A and / or B" can mean: A exists alone, A and B exist simultaneously, or B exists alone. The character " / " generally indicates an "or" relationship between the associated objects.

[0059] Those skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, which may be a read-only memory, a disk, or an optical disk, etc.

[0060] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for on-orbit reconstruction of an on-orbit vehicle, characterized in that: The method comprises the following steps: S1: After powering on, the device automatically enters the two-out-of-three check state. The SRAM-type FPGA polls and reads the data in the three spaces of the same FLASH by controlling the highest and second highest bits of the FLASH. After reading the data at the same position in the three spaces locally, it compares them bit by bit using the "two-out-of-three" method. If the data is consistent, the data in the three spaces is considered correct. If not, the error count of the inconsistent space is increased by one. S2: When the ground detects that the FLASH has been overturned based on telemetry and reconstructs the data in the FLASH, the two-out-of-three check function is disabled and the two-out-of-three repair function is enabled. The repair function includes: Using the minimum erase granularity of 1Mb for FLASH, the system polls and reads data from the same 1Mb area in three memory spaces. After bit-by-bit comparison, it uses the "two out of three" principle to determine the correct data and cache it. If an error is found, the 1Mb area containing the incorrect data is erased and the cached correct data is written back to that area, until all FLASH spaces are traversed. S3: If there are many errors in the on-track FLASH or you want to update the program version, enable the on-track injection operation.

2. The method according to claim 1, characterized in that The step S1 includes: after traversing the FLASH space, feeding back the program error counts of the three spaces to the ground, and judging whether the on-board stand-alone FLASH program is overturned based on the state quantity.

3. The method according to claim 1, characterized in that The step S2 includes: controlling the highest bit and the second highest bit of the FLASH to poll and read the data in the three spaces in the same FLASH, reading the data at the same position in the three spaces locally, performing bit-by-bit comparison and storing the correct data locally, and clearing the cache if the data in the three spaces are correct; if there is a data error, erasing the space of the erroneous data and rewriting the data in the cache one by one.

4. The method according to claim 1, wherein The on-track injection step in step S3 includes: S31: After exiting the three-out-of-two verification state, the stand-alone device sends an erase command to the selected FLASH. The erase command only erases the data in the first space of the currently selected FLASH and does not operate on the data in other spaces. S32: When the telemetry returns the erase completion status, the FLASH is counted through the serial port. After a certain amount of data is written each time, the FLASH status register is read back to confirm the data write reconstruction; if the write is successful, continue writing; if the current data write is unsuccessful, the error status telemetry is returned; S33: When the bit program is written, the ground sends back a read checksum instruction to end the on-orbit injection process. After receiving the instruction, the FPGA reads the data stored in the FLASH for sum verification and feeds back the sum verification; the reliability of the single machine is enhanced by comparing it with the sum verification result in the instruction.

5. An on-orbit reconstruction device for an on-orbit aircraft, characterized in that: The device comprises: an injection channel, an SRAM type FPGA and a FLASH; The FLASH is divided into four spaces as the original FPGA program space. They are not operated during the on-track process, and only the programs in the first three spaces are reconstructed. The device comprises: The on-track verification module automatically enters the three-out-of-three verification state after the device is powered on. The FPGA polls and reads the data in the three spaces in the same FLASH by controlling the highest and second highest bits of the FLASH. After reading the data at the same position in the three spaces locally, it compares them bit by bit using the "three-out-of-three" method. If the data is consistent, the data in all three spaces is considered correct. If not, the error count of the inconsistent space is increased by one. The on-orbit repair module is used to reconstruct the data in the FLASH when the ground detects that the FLASH has been overturned based on telemetry. It disables the three-out-of-two check function and enables the three-out-of-two repair function. The repair function includes: Using the minimum erase granularity of 1Mb for FLASH, the system polls and reads data from the same 1Mb area in three memory spaces. After bit-by-bit comparison, it uses the "two out of three" principle to determine the correct data and cache it. If an error is found, the 1Mb area containing the incorrect data is erased and the cached correct data is written back to that area, until all FLASH spaces are traversed. The on-track injection module is used to enable the on-track injection operation when many errors occur in the on-track FLASH or when you want to update the program version.

6. The device according to claim 5, characterized in that The device further comprises: The feedback module is used to feed back the program error counts of the three spaces to the ground after traversing the FLASH space, and judge whether the on-board single-machine FLASH program is overturned based on this status quantity.

7. The device according to claim 5, characterized in that The device further comprises: The data comparison module is used to poll and read the highest and second highest bits of the FLASH and the data in the three spaces of the same FLASH. After reading the data at the same position in the three spaces to the local memory, it compares them bit by bit and stores the correct data locally.

8. The device according to claim 7, characterized in that The device further comprises: The command sending module is used to send an erase command to the selected FLASH after the stand-alone machine exits the three-out-two check state. The erase command only erases the data in the first space of the currently selected FLASH and does not operate on the data in other spaces; The command readback module is used to count the FLASH through the serial port when the telemetry returns the erase completion status. After each unit writes a certain amount of data, it reads back the FLASH status register to confirm the data write reconstruction; if the write is successful, it continues to write; if the current data write is unsuccessful, it rewrites the current data; The feedback verification module is used to send a readback verification and instruction from the ground to end the on-orbit injection process after the bit program is written, and to read back the written data as a whole, and to provide feedback and verification; the reliability of the single machine is enhanced by comparing and verifying the results.

Images