A light-occupancy single-point-free reliability reinforcement method considering health management

Abstract

The present application relates to aerospace technology field, specifically to a kind of light occupation single-point reliability reinforcing method with health management. First, the task to be executed in processor is encapsulated, and is sent to three CPU cores respectively, and the task is bound to the CPU core in the form of process, and three cores execute the task simultaneously, and also exchange task execution information in real time. During the trial of task, each CPU core receives information sent by other two CPU cores in addition to the information generated by itself executing task, and each CPU core makes a decision according to the three pieces of information and corresponding strategy. If the decision result considers that there is an abnormal CPU core, the abnormal CPU core will be closed after this information exchange, and then it will be restarted to wait for the execution of the next task. One of the three CPU cores is selected as the main CPU core, which is responsible for saving the information during the execution of the task. The result after the task is completed is also sent by the main CPU core.

Description

Technical Field

[0001] This invention relates to the field of aerospace technology, and specifically to a lightweight, single-point-free reliability hardening method that takes into account health management. Background Technology

[0002] 1) Irradiation factors in the space environment

[0003] Space, where satellites reside, is filled with various rays and particles. The harsh environment can cause onboard processors and other hardware to malfunction. Software needs to run on the hardware platform, and radiation can affect its normal operation, potentially causing it to fail completely in severe cases.

[0004] Not only in outer space, but also in near-ground space, low-flux space rays can affect electronic devices operating in these areas, and reliability issues need to be considered.

[0005] 2) Architectural flaws of traditional reliability hardening methods

[0006] Traditional processor hardening methods typically require a comparator to produce the final result. In the overall system architecture, the comparator is located on a serial information link, making it a single point of failure. This necessitates additional hardening measures to ensure the comparator's reliability, incurring additional costs and complicating the entire system. Conversely, without hardening the comparator, its single-point-of-failure nature means that any failure can severely impact the entire reliability architecture.

[0007] 3) Issues with the continuous operation of reliability-hardened systems

[0008] Health management is one of the essential functions of a reliability-hardened system. During system operation, CPU core failures are inevitable. How to handle these failures, and whether they can be recovered and reintegrated into the reliability system, are critical issues. The traditional method is to simply and permanently remove the failure, which inevitably impacts the system's continued operation.

[0009] 4) Information exchange issues in reinforcement measures

[0010] During the operation of a reliability-hardened system, frequent information exchange and processing are required. The traditional method involves putting information onto the disk each time and then transferring it from the disk to memory for processing, which consumes a lot of processor resources, may reduce processor performance, and may even affect the normal operation of the processor.

[0011] 5) High cost of hardware reinforcement

[0012] As small satellite development has become characterized by low cost, short cycle time, and high performance, manufacturers have also raised cost requirements for improving the reliability of onboard equipment. If the equipment is entirely hardened using traditional methods, it would incur high costs, a problem that urgently needs to be addressed.

[0013] 6) Existing hardening methods are not well-suited for multi-core processors and are increasingly unable to meet the growing demand for high-performance multi-core processors from spaceborne computers.

[0014] The above describes the problems faced by existing reliability hardening methods. Summary of the Invention

[0015] This invention provides a lightweight, single-point-of-failure reliability hardening method that takes into account health management. Its purpose is to reduce the impact of the space environment on onboard computers and other equipment, and to help the equipment to work normally.

[0016] Furthermore, the present invention aims to solve problems in traditional reliability architectures such as single point of failure of comparators, large storage resource consumption during information interaction of multiple cores, health management of automatic core shutdown and automatic wake-up, and high cost of hardware hardening.

[0017] To achieve the above objectives, the technical solution of the present invention is as follows:

[0018] This invention provides a lightweight, single-point-of-reliability hardening method that takes into account health management, comprising:

[0019] S1. Select three CPU cores to form a hardened system. Select one of the three CPU cores as the main CPU core. The main CPU core is responsible for exchanging data with the outside world and storing information during task execution.

[0020] S2. The task to be executed is encapsulated and sent to the three CPU cores respectively. The task is bound to each CPU core as a process, and the three CPU cores execute the task simultaneously.

[0021] S3. Each CPU core executes tasks simultaneously and sends real-time task information to the other two CPU cores respectively;

[0022] S4. Each CPU core compares its three task information entries pairwise. If a task information entry is different from the other two task information entries but the other two task information entries are the same, then the CPU core corresponding to this task information entry is determined to be a suspected abnormal core. The three CPU cores give three judgment results at the same time.

[0023] S5. If the three judgment results are not completely the same, it is considered that there is a problem in the process of task information transmission. No CPU core is excluded, and S9 is executed directly.

[0024] S6. If the three judgment results are exactly the same, it is determined that there is a problem with the suspected abnormal core. During the execution of this task, the abnormal core is removed from the hardening system.

[0025] S7. If the excluded abnormal core is the main core, then upgrade one of the remaining two CPU cores to the main core.

[0026] S8. After this task is completed, attempt to enable the excluded abnormal kernel. If it works normally, re-add it to the hardened system; otherwise, do not add it to the system.

[0027] S9. Execute the next task, repeating S2 to S8.

[0028] The beneficial effects achieved by this invention are as follows:

[0029] (1) In the context of outer space, in order to address the problem of the lack of a completely reliable CPU core, the system disclosed in this invention uses three CPU cores to perform single-point voting, which to some extent solves the problem of "who provides the initial reliability" and there is no single point of failure problem of the comparator in the system.

[0030] (2) The system uses technologies such as Pipeline to solve the problem of multiple cores occupying a large amount of storage resources during information interaction, which reduces the overhead of the system during operation and is a light-occupancy reliability-enhanced system.

[0031] (3) The reliability hardening system in this invention can detect the task execution status in real time, promptly detect abnormal CPU cores, realize automatic shutdown and automatic wake-up of the cores, provide health management functions, and ensure the long-term normal operation of the system.

[0032] (4) The system in this method is implemented in software and does not intrude on the hardware. If this system is adopted, there is no need to consider issues such as hardware redundancy backup, which can reduce the cost of equipment such as onboard computers to a certain extent. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the structures shown in these drawings without creative effort.

[0034] Figure 1 This is a diagram of a reliability-enhanced system architecture with no single point of failure.

[0035] Figure 2This is a schematic diagram of a voting process without a single point of contact.

[0036] Figure 3 A schematic diagram of the system in operation to enhance reliability.

[0037] Figure 4 This is a comparison table of the core operating status.

[0038] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0040] It should be noted that if the embodiments of the present invention involve directional indicators (such as up, down, left, right, front, back, etc.), the directional indicators are only used to explain the relative positional relationship and movement of the components in a certain specific posture (as shown in the figure). If the specific posture changes, the directional indicators will also change accordingly.

[0041] Furthermore, if the embodiments of this invention involve descriptions such as "first" or "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" or "second" may explicitly or implicitly include at least one of those features. Additionally, if the word "and / or" appears throughout the text, it means including three parallel solutions; for example, "A and / or B" includes solution A, solution B, or a solution that simultaneously satisfies A and B. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by this invention.

[0042] like Figures 1-4 As shown, the present invention provides a lightweight, single-point-free reliability hardening method that takes into account health management, including:

[0043] S1. Select three CPU cores to form a hardening system. The three CPU cores transmit data to each other through an information transmission channel. Select one of the three CPU cores as the main CPU core. The main CPU core is responsible for exchanging data with the outside world and storing information during task execution. The hardening system can directly use existing equipment without adding additional hardware to the spaceborne system. That is, the single-point-of-reliability hardening method can run on any spaceborne equipment that meets the hardware requirements without incurring additional hardware costs.

[0044] S2. The task to be executed is encapsulated and sent to the three CPU cores respectively. The task is bound to each CPU core as a process, and the three CPU cores execute the task simultaneously.

[0045] S3. Each CPU core executes tasks simultaneously and sends real-time task information to the other two CPU cores respectively; that is, during task execution, each CPU core not only has the task information generated by its own task execution, but also receives task information sent to it by the other two CPU cores.

[0046] S4. Each CPU core compares its three task information entries pairwise. If a task information entry is different from the other two task information entries but the other two task information entries are the same, then the CPU core corresponding to this task information entry is determined to be a suspected abnormal core. The three CPU cores give three judgment results at the same time.

[0047] S5. If the three judgment results are not completely the same, it is considered that there is a problem in the process of task information transmission. No CPU core is excluded, and S9 is executed directly.

[0048] S6. If the three judgment results are exactly the same, it is determined that there is a problem with the suspected abnormal core. During the execution of this task, the abnormal core is removed from the hardening system.

[0049] S7. If the excluded abnormal core is the main core, then upgrade one of the remaining two CPU cores to the main core.

[0050] S8. After this task is completed, try to enable the excluded abnormal kernel. If it is normal, re-add it to the hardened system; otherwise, do not add it to the system.

[0051] S9. Execute the next task, repeating S2 to S8.

[0052] Specifically, one of the three CPU cores will be selected as the master core. The master core is responsible for storing information during task execution, and the master core is also responsible for sending the results after the task is completed.

[0053] This invention first encapsulates the tasks to be executed in the processor and sends them to three CPU cores. Each task is bound to a CPU core as a process, and the three CPU cores execute the tasks simultaneously, exchanging task execution information in real time. Specifically, during task trial, each CPU core receives information from its own task execution, as well as information from the other two CPU cores. Each CPU core performs a judgment based on these three pieces of information and the corresponding strategy. If the judgment determines that an abnormal CPU core exists, the abnormal CPU core is shut down after this information exchange and then restarted to wait for the next task to be executed.

[0054] To enable those skilled in the art to better understand the present invention, the present invention will be described in detail below with reference to embodiments.

[0055] The processor used in this embodiment is the ATLAS 200 module manufactured by Huawei. The ATLAS 200 can run a Linux operating system independently for edge computing. It contains an Ascend 310 chip, an AI chip developed by Huawei, with eight ARM architecture CPU cores, manufactured using a 12nm process, and a maximum power consumption of only 8W. In terms of performance, its FP16 computing power reaches 8 TFLOPS, and its INT8 computing power reaches 16 TOPS. Its low power consumption-to-computing power ratio makes the ATLAS 200 suitable as an on-board software operating platform.

[0056] 1. Reliability-hardened system with no single point of failure

[0057] Figure 1 This is a diagram of a reliability hardening system with no single point of failure. The system comprises three CPU cores that communicate with each other via a data transfer channel. The ATLAS 200 has eight built-in ARM architecture CPU cores, from which three can be selected to build the system. These three cores are named cores A, B, and C. The data transfer channel utilizes the Pipeline mechanism in the Linux operating system. Pipelines provide an interface consistent with file read / write operations while storing data in memory instead of the hard drive, providing a universal read / write interface without requiring data to be written to disk. This Pipeline-based reliability hardening system performs all data exchange within memory, resolving the issue of excessive storage resource consumption during multi-core data exchange and reducing system overhead, resulting in a lightweight reliability hardening system.

[0058] One of the three CPU cores will be randomly selected as the master core to ensure the uniqueness of the real-time information output of the entire system. For the receiver that needs the real-time information provided by the system, the multi-point voting process is transparent and it always receives the information sent by the master core. Figure 1 In this context, M_AB represents the message sent from core A to core B, M_BA represents the message sent from core B to core A; M_AC represents the message sent from core A to core C, M_CA represents the message sent from core C to core A; M_BC represents the message sent from core B to core C, and M_CB represents the message sent from core C to core B.

[0059] After the system starts running, the same task will be assigned to three cores, A, B, and C. Taking core A as an example, the real-time information generated by its own task is called M_A. Simultaneously, core B will send real-time information to core A, i.e., M_BA, and core C will also send real-time information to core A, i.e., M_CA. These three pieces of information are sent by different CPU cores when the task reaches the same point, and under normal circumstances they are identical. Core A will then vote on these three pieces of information (the voting strategy is described in detail below). Figure 4 Different actions will be taken before the subsequent parts of the task are executed. The same voting will also occur in core B and core C.

[0060] 2. Voting process without single points of failure

[0061] Figure 4 The core operational status comparison table is checked using the rule of triple redundancy. Figure 2 This is a partial explanation of the voting process without single points of failure. The following explanation uses the entry "Core A and B are normal, C is abnormal, and Core C will be shut down" from the core operation status comparison table as an example.

[0062] (1) The real-time information generated by core A itself is M_A, the information sent from core B to A is M_BA, and the information sent from C to A is M_CA. If the contents of M_A and M_BA are the same (M_A = M_BA), but the contents of M_A and M_CA are different (M_A ≠ M_CA), and the contents of M_BA and M_CA are also different (M_BA ≠ M_CA), i.e., the situation in Table 1 where core A: M_A = M_BA, M_A ≠ M_CA, M_BA ≠ M_CA, it indicates that during the execution of the task, the information generated by core A and core B is the same, while the information generated by core C is different from both A and B. According to the strategy of selecting two out of three in triple modular redundancy, core C is considered to have a problem. This is the first vote in the multi-point voting process, i.e., core A considers core C to be abnormal.

[0063] (2) Core B will vote according to the strategy in the core operation status checklist, such as... Figure 2 As shown (for ease of description), Figure 2The voting processes of different cores in the system are sequential (in reality, the voting processes are conducted simultaneously). If core B also deems core C problematic after undergoing three-modal redundancy checks, then the second vote in the multi-point voting process will also deem core C problematic.

[0064] (3) Core C will conduct a third vote based on the strategy in the core operation status checklist. If the third vote also deems Core C abnormal, Core C will be shut down by the system. During this task execution cycle, it will no longer participate in the reliability hardening system. Core C will only rejoin when a new task arrives.

[0065] (4) If core A votes that core C is abnormal, while core B or core C votes that core C is normal, then the system believes that there is a problem with the message transmission pipeline (located in memory), that is, there is a problem with memory or other hardware facilities. The system will not remove core C, but will continue to execute the task.

[0066] (5) After the current task is completed, the next task in the task list will be executed.

[0067] 3. System runtime status description

[0068] Figure 3 This is a schematic diagram of a multi-point voting system in operation, illustrating the switching of the main core and the connection between different tasks. In the diagram, "main" indicates that the core is acting as the main core at the current stage, "normal" indicates that the core is working normally but is not the main core, and "stopped" indicates that the core has been shut down due to an abnormality.

[0069] (1) When the first task (Task 1) begins execution, A is selected as the primary core by default. To distinguish the running status of the cores, the system assigns a status bit to each core. At this time, all three cores are working normally, and the status bits are all enabled. When the system detects an anomaly in the real-time information of core A, i.e. Figure 3 At the location indicated by error 1, according to the strategy in Table 1, the status bit of core A will be turned off, core A will be removed from the system and will no longer participate in the execution of Task 1, and core B will be promoted to the master core. During the remaining execution cycle of Task 1, cores B and C will continue to participate, with B becoming the master core.

[0070] When each task begins execution, the system attempts to have a core with its status flag disabled execute the task. If the core successfully executes the task, the system will re-enable the core's status flag and add the core back to the system. For example... Figure 3 As shown, when the second task (task 2) begins execution, core A rejoins the system, and the three cores resume normal operation.

[0071] (2) During the execution of Task 2, when the system detects an anomaly in the real-time information of Core B, that is... Figure 3 At position ERROR2, according to the strategy in Table 1, core B will be shut down. Since core B is the primary core, after B is shut down, core C will be upgraded to become the primary core and take over the responsibilities of the primary core.

[0072] (3) After Task 2 is completed, all three cores will participate in the execution of Task 3. At this time, because the system detected an anomaly in core A when the task started, core A will not participate in the execution of Task 3. Cores B and C are normal, and core C will continue to be the primary core.

[0073] Through the methods described above, the reliability hardening system presented in this paper can perform the following functions: detecting abnormal cores, shutting down abnormal cores, restarting abnormal cores, core status monitoring, and core wake-up. The system implements automatic core shutdown and wake-up, provides health management functions, and can ensure the long-term normal operation of the system.

[0074] The above description is merely an optional embodiment of the present invention and does not limit the patent scope of the present invention. All equivalent structural transformations made using the contents of the present invention's specification and drawings under the inventive concept of the present invention, or direct / indirect applications in other related technical fields, are included within the patent protection scope of the present invention.

Claims

1. A lightweight, single-point-of-reliability reinforcement method that also considers health management, characterized in that, include: S1. Select three CPU cores to form a hardened system. Select one of the three CPU cores as the main CPU core. The main CPU core is responsible for exchanging data with the outside world and storing information during task execution. S2. The task to be executed is encapsulated and sent to the three CPU cores respectively. The task is bound to each CPU core as a process, and the three CPU cores execute the task simultaneously. S3. Each CPU core executes tasks simultaneously and sends real-time task information to the other two CPU cores respectively; S4. Each CPU core compares its three task information entries pairwise. If a task information entry is different from the other two task information entries but the other two task information entries are the same, then the CPU core corresponding to this task information entry is determined to be a suspected abnormal core. The three CPU cores give three judgment results at the same time. S5. If the three judgment results are not completely the same, it is considered that there is a problem in the process of task information transmission. No CPU core is excluded, and S9 is executed directly. S6. If the three judgment results are exactly the same, it is determined that there is a problem with the suspected abnormal core. During the execution of this task, the abnormal core is removed from the hardening system. S7. If the excluded abnormal core is the main core, then upgrade one of the remaining two CPU cores to the main core. S8. After this task is completed, try to enable the excluded abnormal kernel. If it is normal, re-add it to the hardened system; otherwise, do not add it to the system. S9. Execute the next task, repeating S2 to S8.

Images