Fault recovery method, terminal and computer readable storage medium of number tube computer

Abstract

The application provides a fault recovery method of a digital tube computer, a terminal and a computer readable storage medium. The digital tube computer comprises a host computer and a backup computer. The method comprises the following steps: in response to the host computer satisfying a preset abnormal working condition, switching the control right from the host computer to the backup computer; the backup computer acquires host computer communication data and satellite task data; if the host computer communication data and the satellite task data satisfy a preset condition at the same time, switching the control right from the backup computer to the host computer. The application can realize autonomous right state recovery in the host computer fault mode of the digital tube computer, effectively avoids the "ping-pong effect" of repeated power struggle between the host computer and the backup computer of the digital tube computer, reduces the negative influence of the host computer fault mode of the digital tube computer, and improves the satellite operation management efficiency and application performance.

Description

Technical Field

[0001] This invention relates to the field of satellite electronic systems technology, and in particular to a fault recovery method, terminal, and computer-readable storage medium for a digital management computer. Background Technology

[0002] As a key hardware component of the satellite's onboard electronic system, the data management computer (DPC) performs core functions such as time calibration, telemetry data acquisition and packetization, remote control command data distribution and decoding, thermal control management, energy management, and payload operation management. To improve the overall reliability, security, and robustness of the satellite, the DPC typically employs a primary / backup redundancy scheme, with either hot or cold backup. In the event of a DPC failure, a reset is usually performed first to troubleshoot recoverable faults. If the reset fails, the primary DPC switches to the backup DPC. After ground intervention and a normal assessment of the primary DPC's status, the control is switched back from the backup DPC to the primary DPC, and relevant information is re-uploaded. This increases the workload of on-orbit operation management, and during the recovery process, the satellite generally does not schedule payload missions, reducing its on-orbit application efficiency. To avoid the "ping-pong effect," the primary DPC is not allowed to autonomously seize control of the backup DPC while in orbit. Summary of the Invention

[0003] In view of this, the present invention provides a fault recovery method, terminal and computer-readable storage medium for a data management computer, which can restore the autonomous state in the host failure mode of the data management computer, effectively avoid the "ping-pong effect" of repeated power struggle between the host and backup of the data management computer, reduce the negative impact of the host failure mode of the data management computer, and improve the efficiency of satellite operation management and application effectiveness.

[0004] This application provides a fault recovery method for a data management computer, the data management computer including a main unit and a backup unit, the method comprising:

[0005] In response to the host meeting preset abnormal operating conditions, control is switched from the host to the standby machine;

[0006] The backup unit acquires communication data from the main unit and satellite mission data.

[0007] If the host communication data and the satellite mission data simultaneously meet preset conditions, control will be switched from the backup machine to the host machine.

[0008] Optionally, the preset abnormal operating conditions include:

[0009] The duration for which no normal host signal and / or main / backup communication signal is detected exceeds the first preset duration.

[0010] Optionally, the host communication data includes the duration of the host's normal signal and the count information of the standby device sending handover instructions to the host; the satellite mission data includes the status parameters of the satellite currently performing a mission and the status parameters of the satellite's planned mission.

[0011] Optionally, the standby device acquires communication data from the main unit and satellite mission data, including:

[0012] Acquire the normal signals continuously transmitted by the host, and record the duration of the normal signals; and,

[0013] If a normal signal is received from the host, continue to send a handover command to the host, and record the number of handover commands within a second preset time period.

[0014] Optionally, the standby device acquiring the main unit's communication data and satellite mission data further includes:

[0015] Based on the instructions to be sent to the satellite, determine whether the satellite is currently performing a mission; and,

[0016] Based on the satellite's planned mission execution time, determine whether there is a planned mission to be executed within the next third preset time period.

[0017] Optionally, the host communication data and the satellite mission data simultaneously meet preset conditions, including:

[0018] The duration of the host's normal signal is greater than the fourth preset duration;

[0019] The counter information for the standby machine sending the handover instruction to the host machine is less than or equal to a preset value;

[0020] Based on the satellite's status parameters indicating that it is not performing a mission;

[0021] Based on the satellite's planned mission status parameters, it is determined that the satellite has no planned missions to perform within the next third preset time period.

[0022] Optionally, the method further includes:

[0023] If the host communication data and / or the satellite mission data do not meet the preset conditions, the backup machine's control shall be maintained.

[0024] Optionally, after switching control from the standby machine to the master machine, the process includes:

[0025] The host computer reads the backup data from the standby computer from a third-party device to restore the entire satellite system to its original state.

[0026] This application also provides a terminal, including: a memory and a processor, wherein the memory stores a fault recovery program, and when the fault recovery program is executed by the processor, it implements the steps of the fault recovery method of the digital management computer as described above.

[0027] This application also provides a computer storage medium storing computer program instructions; when the computer program instructions are executed by a processor, they implement the fault recovery method of the digital tube computer as described above.

[0028] In summary, the fault recovery method, terminal, and computer-readable storage medium for a data management computer provided by this invention, wherein the data management computer includes a host and a standby unit, and the method includes: in response to the host meeting preset abnormal operating conditions, switching control from the host to the standby unit; the standby unit acquiring communication data and satellite mission data from the host; and if the host communication data and satellite mission data simultaneously meet preset conditions, switching control from the standby unit back to the host. This application can restore the autonomous state of the data management computer in host failure mode, effectively avoiding the "ping-pong effect" of repeated power struggles between the host and standby units, reducing the negative impact of host failure mode, and improving satellite operation management efficiency and application effectiveness.

[0029] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0030] Figure 1 This is a flowchart illustrating a fault recovery method for a digital management computer according to an embodiment of the present invention;

[0031] Figure 2 This is a schematic diagram illustrating the specific process of a fault recovery method for a digital management computer according to an embodiment of the present invention. Detailed Implementation

[0032] To further illustrate the technical means and effects adopted by the present invention in order to achieve the intended purpose, the present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments.

[0033] Figure 1 This is a flowchart illustrating a fault recovery method for a digital management computer according to an embodiment of the present invention. Please refer to... Figure 1 This invention provides a fault recovery method for a digital management computer, comprising:

[0034] Step 201: In response to the host meeting the preset abnormal working conditions, control is switched from the host to the standby host.

[0035] Step 202: The standby device acquires communication data and satellite mission data from the main unit.

[0036] Step 203: If the host communication data and satellite mission data simultaneously meet the preset conditions, then the control will be switched from the backup machine to the host machine.

[0037] To address the shortcomings of existing technologies, this application provides a method for restoring the status of a satellite data management computer host in a fault mode, involving dual-machine redundancy, enabling autonomous handover of the satellite data management computer host. Specifically, when the data management computer host fails and the standby host has the necessary permissions, the standby host performs the following checks: the duration of the host host's normal signal; the timing and counting of the handover command; whether the satellite is currently performing a task; and whether the satellite has any tasks to perform in the future. When all the above checks meet preset conditions, the data management computer grants permissions to the host host, which then reads the backup data from the standby host from a third-party device, restoring the overall satellite status.

[0038] In one embodiment, preset abnormal operating conditions include:

[0039] The duration for which no normal host signal and / or main / backup communication signal is detected exceeds the first preset duration.

[0040] In this embodiment, the satellite data management computer adopts a dual-machine backup design with a main unit and a backup unit. The main unit generates a low-level pulse signal and sends it to the main unit's hardware watchdog. During normal operation, the main unit's hardware watchdog reset signal is an invalid high level. If the main unit malfunctions, it cannot feed the hardware watchdog, and the hardware watchdog outputs a low-level reset signal, resetting the main unit and counting the number of resets. The backup unit monitors the main unit's normal signals and dual-machine communication signals. If it cannot monitor the main unit's normal signals or dual-machine communication signals for 10 consecutive seconds, it issues a takeover command and switches to the backup unit. It should be noted that in digital circuits, voltage levels are represented by logic levels. Logic levels include both high and low levels. Different components in digital circuits correspond to different logic levels. In TTL gate circuits, voltages greater than 3.5 volts are defined as logic high, represented by the number 1; voltages less than 0.3 volts are defined as logic low, represented by the number 0.

[0041] In one embodiment, the host communication data includes the duration of the host's normal signal and the count information of the standby device sending a handover command to the host; the satellite mission data includes the status parameters of the satellite currently performing a mission and the status parameters of the satellite's planned mission.

[0042] In one embodiment, the standby device acquires communication data and satellite mission data from the main unit, including:

[0043] Acquire the normal signals continuously sent by the host and record the duration of the normal signals; and,

[0044] If a normal signal is received from the host, continuously send a handover command to the host and record the number of handover commands within the second preset time period.

[0045] In one embodiment, the standby device acquires communication data and satellite mission data from the main unit, and further includes:

[0046] Based on the instructions to be sent to the satellite, determine whether the satellite is currently performing a mission; and,

[0047] Based on the satellite's planned mission execution time, determine whether there is a planned mission to be executed within the next third preset time period.

[0048] In one embodiment, both host communication data and satellite mission data simultaneously meet preset conditions, including:

[0049] The duration of the host's normal signal is greater than the fourth preset duration;

[0050] The counter information for the standby machine sending the handover command to the master machine is less than or equal to a preset value;

[0051] Based on the satellite's status parameters indicating that it is not performing a mission;

[0052] Based on the satellite's planned mission status parameters, it is determined that the satellite has no planned missions to perform within the next third preset time period.

[0053] Figure 2 This is a schematic flowchart illustrating a fault recovery method for a digital management computer according to an embodiment of the present invention. Please refer to... Figure 2 In this embodiment, when the main computer of the data management computer fails or the standby computer is in a state of authority, the standby computer of the data management computer monitors the following parameters and performs different actions based on the monitoring results.

[0054] Specifically, the duration of the normal signal from the host computer is used as the judgment condition for decision parameter A. The system determines whether the duration of the normal signal from the host computer to the backup computer exceeds 300 seconds. A timer is designed on the backup computer to time the normal signal emitted by the host computer. When the host signal is continuously normal, the timer increments by 1; when the host signal is abnormal, the timer is reset to zero. When the duration of the normal host signal exceeds 300 seconds, decision parameter A is set to 1; when the duration of the normal signal is less than 300 seconds, decision parameter A is set to 0.

[0055] The count of the handover instructions sent from the standby computer to the master computer is used as the judgment condition for decision parameter B. The system determines whether the standby computer's count of handover instructions is not greater than 1. A handover instruction counter and a handover instruction timer are designed on the standby computer. The counter is initially set to 0. Each time the standby computer sends a "grant master control" instruction (i.e., a handover instruction), the handover instruction counter increments by 1 and starts timing. If the handover instruction count remains unchanged for 24 consecutive hours, the counter is reset to zero. When the standby computer's handover instruction count is not greater than 1, decision parameter B takes the value 1; when the handover instruction count is greater than 1, decision parameter B takes the value 0.

[0056] The satellite's current mission status parameter is used as the decision parameter C. The backup data management computer determines whether the satellite is currently performing a mission. The backup data management computer analyzes the satellite's pending transmission commands to determine whether the satellite is currently performing a mission. If the satellite is not performing a mission, the decision parameter C is set to 1; if the satellite is performing a mission, the decision parameter C is set to 0.

[0057] The status parameters of the satellite's planned mission are used as the decision parameter D. The backup computer determines whether there are any pending missions within 30 minutes after the current satellite time. If there are no pending missions within 30 minutes, the decision parameter D is set to 1; if there are pending missions within 30 minutes, the decision parameter D is set to 0.

[0058] A bitwise AND operation is performed on decision parameters A, B, C, and D. A result of 1 indicates that the duration of the master's normal signal is greater than 300 seconds, the standby computer has sent no more than 1 handover command within the past 24 hours, the satellite is not currently performing a task, and there are no pending tasks for the satellite within the next 30 minutes. In this case, control of the master can be restored, and the standby data management computer can send a "grant master control" handover command, completing the switch of control status from standby to master.

[0059] In one embodiment, the fault recovery method for a digital management computer further includes:

[0060] If the host communication data and / or satellite mission data do not meet the preset conditions, the backup machine will retain control.

[0061] In this embodiment, when the result of the AND operation of decision parameters A, B, C, and D is 0, it indicates that the main computer of the data management system cannot regain control at the current moment, and the backup computer of the data management system maintains the current state.

[0062] In one embodiment, after switching control from the standby machine to the primary machine, the following steps are included:

[0063] The host machine reads backup data from the standby machine from a third-party device to restore the entire satellite's state.

[0064] After control is transferred to the backup computer, the backup computer continuously backs up data via a third-party device. When the primary computer regains control, it needs to read the backup data from the third-party device to synchronize information and restore the entire satellite system to its original state.

[0065] This invention discloses a fault recovery method for a data management computer, comprising a host computer and a standby computer. The method includes: in response to the host computer meeting preset abnormal operating conditions, switching control from the host computer to the standby computer; the standby computer acquiring communication data and satellite mission data from the host computer; and if both the host computer communication data and the satellite mission data simultaneously meet preset conditions, switching control from the standby computer back to the host computer. This application enables the restoration of autonomy in a host computer fault mode, effectively avoiding the "ping-pong effect" of repeated power struggles between the host and standby computers, reducing the negative impact of host computer fault modes, and improving satellite operation management efficiency and application effectiveness.

[0066] For details on the specific process of executing the above method steps in this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0067] This application also provides a terminal, including: a memory and a processor, wherein the memory stores a fault recovery program, and when the fault recovery program is executed by the processor, it implements the steps of the fault recovery method of the digital management computer as described above.

[0068] This invention also provides a computer-readable storage medium storing computer program instructions; when the computer program instructions are executed by a processor, they implement the fault recovery method of the digital management computer as described above.

[0069] For details on the specific process of executing the above method steps in this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0070] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0071] In this document, the terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, which includes not only the elements listed but also other elements not expressly listed.

[0072] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A fault recovery method for a digital management computer, characterized in that, The data management computer includes a main unit and a backup unit, and the method includes: In response to the host meeting preset abnormal operating conditions, control is switched from the host to the standby host; The backup unit acquires communication data from the main unit and satellite mission data. If the host communication data and the satellite mission data simultaneously meet the preset conditions, then control will be switched from the backup machine to the host machine; The host communication data includes the duration of the host's normal signal and the count information of the standby device sending handover commands to the host; the satellite mission data includes the status parameters of the satellite currently performing a mission and the status parameters of the satellite's planned mission. The host communication data and the satellite mission data simultaneously meet preset conditions, including: The duration of the host's normal signal is greater than the fourth preset duration; The counter information for the standby machine sending the handover instruction to the host machine is less than or equal to a preset value; Based on the satellite's status parameters indicating that it is not performing a mission; Based on the satellite's planned mission status parameters, it is determined that the satellite has no planned missions to perform within the next third preset time period.

2. The fault recovery method for a digital management computer according to claim 1, characterized in that, The preset abnormal operating conditions include: The duration for which no normal host signal and / or main / backup communication signal is detected exceeds the first preset duration.

3. The fault recovery method for a digital management computer according to claim 1, characterized in that, The standby device acquires communication data and satellite mission data from the main unit, including: Acquire the normal signals continuously transmitted by the host, and record the duration of the normal signals; and, If a normal signal is received from the host, continue to send a handover command to the host, and record the number of handover commands within a second preset time period.

4. The fault recovery method for a digital management computer according to claim 1, characterized in that, The backup unit's acquisition of communication data and satellite mission data from the main unit also includes: Based on the instructions to be sent to the satellite, determine whether the satellite is currently performing a mission; and, Based on the satellite's planned mission execution time, determine whether there is a planned mission to be executed within the next third preset time period.

5. The fault recovery method for a digital management computer according to claim 1, characterized in that, The method further includes: If the host communication data and / or the satellite mission data do not meet the preset conditions, the backup machine's control shall be maintained.

6. The fault recovery method for a digital management computer according to claim 1, characterized in that, After switching control from the standby machine to the primary machine, the process includes: The host computer reads the backup data from the standby computer from a third-party device to restore the entire satellite system to its original state.

7. A terminal, characterized in that, The terminal includes a memory and a processor, wherein the memory stores a fault recovery program, and when the fault recovery program is executed by the processor, it implements the steps of the fault recovery method of the digital management computer as described in any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions; when executed by a processor, the computer-readable storage medium implements the fault recovery method of the digital management computer as described in any one of claims 1-6.

Images