A software self-recovery hardware system for a spaceborne computer

Abstract

The application relates to a satellite computer software self-recovery hardware system. The method comprises the following steps: deploying in a satellite computer, presetting a satellite computer software strategy; determining a periodic feeding signal sent by the satellite computer software and received by a hardware watchdog circuit according to a watchdog circuit starting time and a feeding signal time set by a delay time starting circuit, and outputting a satellite computer software loading or resetting signal through a time judgment circuit and a satellite computer resetting circuit; converting a received high-level signal into a low-level signal and counting the number of high-level signals through a hardware register circuit, and outputting a hardware register circuit low-level signal or a clear signal through a value judgment circuit and a level conversion circuit; and executing power-off restart of the satellite computer through a power-off restart circuit receiving the clear signal. The method can adjust relevant parameters of a hardware system, and realizes high reliability and high applicability of the satellite computer software self-recovery system.

Description

TECHNICAL FIELD

[0001] The application provides the technical field of spaceborne computers, and particularly relates to a spaceborne computer software self-recovery hardware system. BACKGROUND

[0002] With the deepening exploration of the outer space by satellites, various spaceborne computer software is loaded in the satellites, which is responsible for data processing and logical control of the whole satellite. In the changeable and complex space environment, the spaceborne computer software may be affected by space particles and other environments, causing logical errors in software operation, so that the spaceborne computer software works abnormally. At this time, the ground control center cannot normally communicate with and control the satellite, so that the spaceborne computer software is not maintainable. Therefore, the spaceborne computer software system must have certain automatic reset and other recovery functions through the hardware system to ensure the normal operation of the spaceborne computer, thereby improving the reliability of the spaceborne computer software system.

[0003] At present, the spaceborne computer software system strategy is customized according to the use purpose of the satellite. The software self-recovery through the spaceborne computer software system needs to formulate the spaceborne computer hardware configuration strategy for the sudden situation in the space and the performance in the use process of the satellite, cannot be compatible with different spaceborne computer strategies, and further increases the development cycle and cost of the spaceborne computer. With the increasing complexity of the software operation process, the spaceborne computer software system operation will frequently appear the situation of operation overload or operation abnormality which cannot be repaired in time, and lacks the reliability supervision of the spaceborne computer hardware system on the software system operation self-recovery. SUMMARY

[0004] Therefore, it is necessary to provide a computer software self-recovery hardware system with high adaptability and capable of being compatible with computers of satellites with different purposes, so as to reduce the development cycle and cost of the spaceborne computer. The application provides a spaceborne computer software self-recovery hardware system.

[0005] The spaceborne computer software self-recovery hardware system is arranged in a spaceborne computer,

[0006] The spaceborne computer software self-recovery hardware system comprises a spaceborne computer software strategy, a software real-time monitoring hardware component and a software reset hardware component.

[0007] The spaceborne computer software strategy sets a start delay time, a target dog-feeding time and a target total number of software.

[0008] The software real-time monitors hardware components, including: a delay time starting circuit, a hardware watchdog circuit and a time judging circuit; the delay time starting circuit is used for setting a watchdog circuit starting time and a dog feeding signal time of the hardware watchdog circuit after power-on; the hardware watchdog circuit receives a periodic dog feeding signal sent by a satellite computer software after starting according to the watchdog circuit starting time and the dog feeding signal time; and the time judging circuit is used for judging a size of the periodic dog feeding signal and a target dog feeding time, and outputting a satellite computer software loading or resetting signal.

[0009] The software resets hardware components, including: a satellite computer resetting circuit, a hardware register circuit, a level conversion circuit, a numerical value judging circuit and a power-off restarting circuit; the satellite computer resetting circuit is used for resetting and restarting the software real-time monitoring hardware components after receiving a resetting signal, and outputting a high-level signal to the hardware register circuit through the level conversion circuit; the hardware register circuit converts the received high-level signal into a low-level signal and counts a number of high-level signals; the numerical value judging circuit is used for judging a size of the number of high-level signals and a target software total number, and outputting a low-level signal or a clear signal of the hardware register circuit; and the power-off restarting circuit receives the clear signal to restart the satellite computer.

[0010] In one of the embodiments, the method further comprises: formulating a satellite computer software strategy according to a use of a carrier satellite of the satellite computer;

[0011] The starting delay time sets a starting time point of monitoring according to a running period of the satellite computer software, and is updated by accumulating a target dog feeding time; the target dog feeding time is a time period of normal running of a single copy of the satellite computer software; the watchdog circuit is controlled to start according to a time point sequence formed by the starting delay time and the target dog feeding time; and the target software total number is a total number of software to be loaded for a carrier satellite to execute a work process.

[0012] In one of the embodiments, the software real-time monitoring hardware components further comprises: a satellite computer power-on completion indication circuit and a satellite computer software system component;

[0013] The satellite computer power-on completion indication circuit is used for starting the software real-time monitoring hardware components, receiving a resetting signal of the satellite computer resetting circuit, and outputting a satellite computer software running signal and connecting the delay time starting circuit;

[0014] The satellite computer software system component is used for receiving the resetting signal of the satellite computer resetting circuit, mounting a currently abnormally loaded satellite computer software, and reading and loading the satellite computer software according to the target software total number copy by copy.

[0015] In one of the embodiments, the hardware watchdog circuit is further configured to record the current single portion of the satellite computer software runtime, and record and obtain the periodic watchdog feeding signal time according to the target software total number, and output the periodic watchdog feeding signal.

[0016] In one of the embodiments, the time determination circuit is configured to determine the number of high level signals and the target software total number, and further comprises:

[0017] If the periodic watchdog feeding signal time is greater than the target watchdog feeding time, or the periodic watchdog feeding signal is incorrect, the time determination circuit outputs a satellite computer software reset signal;

[0018] If the periodic watchdog feeding signal time is not greater than the target watchdog feeding time and the periodic watchdog feeding signal is correct, the time determination circuit outputs a satellite computer software loading signal.

[0019] In one of the embodiments, the satellite computer reset circuit performs bidirectional transmission processing according to the reset signal; the bidirectional transmission processing includes software reset signal transmission processing and hardware reset signal transmission processing;

[0020] The software reset signal transmission processing is configured to enable the satellite computer power completion indication circuit to receive the reset signal, and perform a restart operation on the satellite computer software system component and the delay time start circuit, and the hardware reset signal transmission processing is configured to enable the level conversion circuit to receive the reset signal, convert the reset signal to a high level signal, output the high level signal to the hardware register circuit, and count the number of high level signals.

[0021] In one of the embodiments, the software reset hardware component further comprises a hardware system start circuit.

[0022] The hardware system start circuit is configured to receive the satellite computer power-on signal, and initialize and set the low level signal value in the hardware register circuit to 0 and the high level signal value to 1.

[0023] The level conversion circuit is configured to convert the received reset signal to a high level signal, the hardware register circuit is configured to receive the high level signal and count, and the high level signal is output to the value determination circuit to trigger the value determination circuit to determine the current number of high level signals stored in the hardware register and determine whether to restart.

[0024] In one of the embodiments, the value determination circuit is further configured to retrieve the number of high level signals stored in the hardware register circuit, and if the number of high level signals is equal to the target software total number, the value determination circuit outputs a clear signal to the hardware register through the level conversion circuit to clear the data in the hardware register; otherwise, the value determination circuit converts the received high level signal to a low level signal, outputs the low level signal to the level conversion circuit, and waits for the level conversion and output of the next reset signal.

[0025] In one of the embodiments, the level conversion circuit comprises a first level conversion circuit and a second level conversion circuit.

[0026] The first level conversion circuit is configured to receive the reset signal output by the on-board computer reset circuit and the low-level signal output by the power-off restart circuit, convert the reset signal and the low-level signal into the high-level signal, and output the high-level signal to the hardware register circuit.

[0027] The second level conversion circuit is configured to receive the clear signal output by the numerical judgment circuit, convert the clear signal into a low-level signal, and output the low-level signal to the hardware register circuit and the power-off restart circuit.

[0028] In one of the embodiments, the hardware system startup circuit is further configured to control the power-on startup of the software reset hardware component, and the on-board computer reset circuit, the hardware register circuit, the level conversion circuit, the numerical judgment circuit, and the power-off restart circuit are connected in parallel with the hardware system startup circuit.

[0029] Compared with the prior art, the present application can achieve the following technical effects:

[0030] The conventional on-board computer software self-recovery relies on the on-board computer software system strategy, and such a recovery method cannot support the on-board computer strategy with complex satellite operation, and lacks the support of the hardware system during the operation of the on-board computer software. The on-board computer software self-recovery hardware system is configured to pre-configure different on-board computer software strategies according to different on-board computers, adjust three reference parameters of the startup delay time, the watchdog time, and the target software total number, adopt the circuit connection of the watchdog circuit, the time judgment circuit, and the on-board computer reset circuit, realize the real-time monitoring of the software reset hardware system on the operation time of the on-board computer software system and the self-recovery of the operation exception, and use the counting function of the hardware register in the software reset hardware component in combination with the numerical judgment circuit to determine the overflow of the target software total number, so as to meet the compatibility of the on-board computer software self-recovery hardware system with multiple different types of on-board computers, eliminate the limitation of the system on the satellite operation purpose, reduce the development cost of the on-board computer, and accumulate the self-recovery process of the software system to a certain number of times, which is equal to the target software total number, so as to start the self-recovery process of the hardware system and restart the entire on-board computer software self-recovery hardware system. Therefore, compared with the conventional software system self-recovery, the on-board computer software self-recovery hardware system can not only realize the real-time monitoring and self-recovery control of the hardware system on the operation of the on-board computer software system, but also can be compatible with multiple on-board computers, and has high applicability and high reliability. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 A flow chart of a software self-recovery hardware system for a satellite computer in one embodiment;

[0032] Figure 2 A flow chart of a software self-recovery hardware system for a satellite computer in one embodiment. DETAILED DESCRIPTION

[0033] The technical solutions in the embodiments of the present application will be clearly and completely described with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative effort belong to the scope of protection of the present application.

[0034] The present application provides a software self-recovery hardware system for a satellite computer, which is deployed in a satellite computer and includes a software strategy for a satellite computer, a software real-time monitoring hardware component, and a software reset hardware component. The software strategy for a satellite computer is used to set a start delay time, a target feeding time, and a target total number of software. It is worth noting that the software strategy for a satellite computer can be customized according to the working purpose of a carrier satellite in space. Currently, the carrier satellite mainly includes functions such as monitoring, photography, data communication, and scientific research. Obviously, different satellites require different numbers of software to start, and therefore, the start delay time, the target feeding time, and the target total number of software and the like can be changed. Based on the current software system self-recovery method, the target total number of software needs to be customized, and the start delay time T and the target feeding time W are calculated according to the customized target total number of software N.

[0035] Specifically, the time required for a satellite computer to normally run one piece of software is referred to as a target feeding time W. A satellite computer system has a total of N pieces of software loaded therein. According to the order in which the N pieces of software are called during satellite operation, the start time point of each piece of software can be calculated to form a start delay time sequence T. Running N pieces of software will generate N start delay time points. Correspondingly, in the case of normal operation of a satellite computer software, each piece of software has a running time corresponding to a target feeding time W, and therefore, the time of software start running and the feeding time need to be monitored by a software real-time monitoring hardware component.

[0036] Further, the software real-time monitoring hardware components includes: a delay time starting circuit, a hardware watchdog circuit and a time determination circuit. The delay time starting circuit is used to set the watchdog circuit starting time and the feeding signal time of the hardware watchdog circuit after power-on. The hardware watchdog circuit receives the periodic feeding signal sent by the satellite computer software after starting according to the watchdog circuit starting time and the feeding signal time. The time determination circuit is used to determine the size of the periodic feeding signal and the target feeding time, and outputs the satellite computer software loading or reset signal. It is worth noting that the starting delay time sequence T and the target feeding time W are stored in the delay time starting circuit. The hardware watchdog circuit is the next stage of the delay time starting circuit. After receiving the starting instruction sent by the delay time starting circuit, the delay time sequence T is called, the feeding signal time, the feeding signal and the target feeding time W of the current loaded software are received and stored according to the time arrangement of the delay time sequence T, and the stored data and the feeding signal are transmitted to the next stage time determination circuit. Specifically, the time determination circuit reads the feeding signal and the target feeding time W piece by piece, determines the high and low level signals according to the size of the abnormal feeding signal and the target feeding time, and inputs the signals for loading or resetting the satellite computer software. The time determination circuit can output the dog bite low level signal to trigger the self-diagnosis function of each chip in the satellite computer, which is more durable than the high level signal.

[0037] Further, the software real-time monitoring hardware components includes: a delay time starting circuit, a hardware watchdog circuit and a time determination circuit. The delay time starting circuit is used to set the watchdog circuit starting time and the feeding signal time of the hardware watchdog circuit after power-on. The hardware watchdog circuit receives the periodic feeding signal sent by the satellite computer software after starting according to the watchdog circuit starting time and the feeding signal time. The time determination circuit is used to determine the size of the periodic feeding signal and the target feeding time, and outputs the satellite computer software loading or reset signal. It is worth noting that the starting delay time sequence T and the target feeding time W are stored in the delay time starting circuit. The hardware watchdog circuit is the next stage of the delay time starting circuit. After receiving the starting instruction sent by the delay time starting circuit, the delay time sequence T is called, the feeding signal time, the feeding signal and the target feeding time W of the current loaded software are received and stored according to the time arrangement of the delay time sequence T, and the stored data and the feeding signal are transmitted to the next stage time determination circuit. Specifically, the time determination circuit reads the feeding signal and the target feeding time W piece by piece, determines the high and low level signals according to the size of the abnormal feeding signal and the target feeding time, and inputs the signals for loading or resetting the satellite computer software. The time determination circuit can output the dog bite low level signal to trigger the self-diagnosis function of each chip in the satellite computer, which is more durable than the high level signal.

[0038] Specifically, the hardware register stores both the high-level signal and the number of high-level signals, and the numerical judgment circuit, as the next circuit unit of the hardware register, first reads the stored high-level signal and the number of high-level signals of the hardware register, and then calls the pre-stored target software total number N value, and determines the output potential signal by comparing the number of high-level signals with the target software total number N value. For the input of the hardware register circuit clear signal, the numerical judgment circuit can select to output a high-level signal, and for the input of the hardware register continue counting signal, the numerical judgment circuit can select to output a low-level signal to the level conversion circuit, which is converted into a high-level signal by the level conversion circuit to form a loop counting circuit. In the above-mentioned satellite computer software self-recovery hardware system, the satellite computer software strategy is pre-configured, the circuit connection of the watchdog circuit, the time judgment circuit and the satellite computer reset circuit is adopted, the real-time monitoring of the software reset hardware system on the running time of the satellite computer software system and the self-recovery of the running abnormality are realized, the three parameters of the watchdog circuit start delay time T, the dog feeding time W and the target software total number N are adjusted to adapt to the satellite computer software strategy loaded by different functional satellites, and combined with the overflow judgment of the target software total number by the numerical judgment circuit using the counting function of the hardware register, the satellite computer software self-recovery hardware system can meet multiple different types of satellite computers, eliminate the limitation of the system on the working purpose of the satellite, reduce the development cost of the satellite computer, and when the self-recovery process of the software system accumulates to a certain number, which is equal to the target software total number, the self-recovery process of the hardware system is started, so as to restart the entire satellite computer software self-recovery hardware system. It can be seen that, compared with the traditional software system self-recovery, the system has high applicability and high reliability.

[0039] In one embodiment, the satellite computer software strategy is formulated according to the purpose of the satellite carrying the satellite computer, the start delay time is set according to the starting point of the monitoring of the running period of the satellite computer software, the target dog feeding time is updated by accumulation, the target dog feeding time is the time period of the normal running of a single software of the satellite computer, the watchdog circuit is controlled according to the time point sequence composed of the start delay time and the target dog feeding time, and the target software total number is the total number of software loaded for the working process of the carrier satellite. It should be noted that the start delay time is T value, which is set according to the customized target software total number N and the target dog feeding time W, and can be adjusted according to different purpose satellites, and is used to control the time point at which the hardware watchdog circuit starts to work. The time point sequence is arranged according to the running order of the software loaded by the satellite computer, the running time of the software in the satellite computer is rounded to zero, and the running efficiency of the subsequent watchdog circuit and time judgment circuit is improved.

[0040] In one of the embodiments, the software real-time monitoring hardware component further comprises a satellite computer power-on completion indication circuit and a satellite computer software system component, wherein the satellite computer power-on completion indication circuit is configured to start the software real-time monitoring hardware component and receive a reset signal from the satellite computer reset circuit, and output a satellite computer software running signal and a turn-on delay time starting circuit; and the satellite computer software system component is configured to receive the reset signal from the satellite computer reset circuit, load the current abnormal satellite computer software, and read and load the target software according to the total number of the satellite computer software.

[0041] It is worth mentioning that, as shown in Figure 1 the satellite computer power-on completion indication circuit is a subordinate of the satellite computer power-on circuit, and at the same time, the satellite computer power-on completion indication circuit is a control switch of the software real-time monitoring hardware component, receives a reset signal from the satellite computer reset circuit in the software reset hardware component, distinguishes the two processes of the satellite computer software self-recovery and software running as a medium, forms two closed loops, reduces the working burden of the satellite computer software system component, and provides a relatively stable working environment for the real-time monitoring of software running and the self-recovery of software.

[0042] Specifically, the number of built-in software in the satellite computer software system component is adjusted according to different satellite computer software strategies, wherein the satellite computer software system component is preset with a target software total number of N software, and each time the satellite computer software system component loads one of them, when the satellite computer power-on completion indication circuit transmits the reset signal to the satellite computer software system component, the satellite computer software system component reloads another software, and the software running abnormally is placed at the end of the loading process to avoid signal conflicts during the satellite computer software loading process, and improve the reliability of the satellite computer software system component reset.

[0043] In one of the embodiments, the hardware watchdog circuit is further configured to record the current single-portion satellite computer software running time, record and obtain a periodic watchdog signal time according to the total number of target software, and output the periodic watchdog signal.

[0044] In one of the embodiments, as shown in Figure 2As shown, the time determination circuit determines the received dog feeding signal and the dog feeding signal time, and takes the periodic dog feeding signal time greater than the target dog feeding time or the periodic dog feeding signal error as the determination basis. If the determination result is yes, the time determination circuit outputs the satellite computer software reset signal; if the determination result is no, it represents that the periodic dog feeding signal time is not greater than the target dog feeding time and the periodic dog feeding signal is normal, and the time determination circuit outputs the satellite computer software loading signal. It is worth noting that the values of the target dog feeding time W corresponding to each software are adjusted according to the satellite computer software strategy configured according to the software properties installed in the satellite computer software strategy, and then the running situation of the satellite computer software is comprehensively judged from the signal transmission situation and the running period of the satellite computer software according to the time determination circuit. When the dog feeding signal time of the current loaded software is greater than the target dog feeding time or the dog feeding signal of the current loaded software is wrong, the time determination circuit outputs the dog bite low-level signal to the satellite computer reset circuit. When the dog feeding signal time of the current loaded software is less than or equal to the target dog feeding time, and the dog feeding signal of the current loaded software is normal, the time determination circuit outputs the dog bite low-level signal to the satellite computer software system component. In addition, the time determination circuit is connected in series with the satellite computer reset circuit and the satellite computer software system component, and the satellite computer reset circuit and the satellite computer software system component are connected in parallel, which guarantees the stability of the signal transmission process from the hardware system to the software system, thereby improving the reliability of the self-recovery of the satellite computer software system.

[0045] In one of the embodiments, the on-board computer reset circuit performs bidirectional transmission processing according to the reset signal, including software reset signal transmission processing and hardware reset signal transmission processing. The software reset signal transmission processing is used for the on-board computer power-on completion indication circuit to receive the reset signal and perform a restart operation on the on-board computer software system components and the delay time start circuit. In addition, the hardware reset signal transmission processing is used for the level conversion circuit to receive the reset signal, perform potential conversion on the reset signal, output a high-level signal to the hardware register circuit, and perform high-level signal quantity statistics. It is worth noting that, first, the on-board computer reset circuit processes the dog bite low-level signal output by the time determination circuit into a low-level signal, while satisfying the transmission of the software real-time monitoring hardware component and the software reset hardware component circuit signal. Second, the bidirectional transmission processing of the reset signal is performed as a bridge for the signal connection between the on-board computer software system and the hardware system. The on-board computer power-on completion indication circuit serves as the signal receiving end of the on-board computer reset circuit, so that the on-board computer reset circuit is not controlled by the software real-time monitoring hardware component. When the software real-time monitoring hardware component is damaged or has an abnormal signal, the on-board computer power-on completion indication circuit or the on-board computer software system component cannot complete the software self-recovery function. However, the on-board computer reset circuit can still reset the abnormal problem of the software real-time monitoring hardware component through the hardware system, thereby improving the reliability of the real-time monitoring hardware component.

[0046] In one of the embodiments, the software reset hardware component sets the hardware system start circuit. The hardware system start circuit is used to receive the on-board computer power-on signal and initialize the hardware register circuit with a low-level signal value of 0 and a high-level signal value of 1. The level conversion circuit is used to convert the received reset signal into a high-level signal. The hardware register circuit receives the high-level signal and counts, and outputs the high-level signal to the value determination circuit to trigger the value determination circuit to determine the current high-level signal quantity stored in the hardware register and determine whether to restart. It is worth noting that the low-level signal value of 0 indicates that the current high-level state quantity is 0, and the high-level signal value of 1 indicates that the current high-level state quantity is 1. The high-level state quantity represents the high-level signal received by the hardware register circuit. When the stored high-level signal state quantity is equal to the target software total number N, it indicates that the on-board computer software system component has run N software programs once. Therefore, the on-board computer software system reset condition can be obtained through the hardware register circuit, and the reset number is stored and transmitted to the value determination circuit through the high-level signal, thereby realizing the storage of the on-board computer software self-recovery condition by the hardware system. When the satellite is attacked by the software system, the reset condition can be obtained from the software reset hardware component, thereby providing certain data support for the subsequent security upgrade of the on-board computer software system.

[0047] In one embodiment, as shown in FIG. 1, the software reset hardware component includes a hardware register circuit, a level conversion circuit, a value determination circuit, and a power-off restart circuit. The hardware register circuit is connected to the level conversion circuit, the value determination circuit, and the power-off restart circuit. The level conversion circuit is connected to the value determination circuit and the power-off restart circuit. The value determination circuit is connected to the power-off restart circuit. Figure 2 As shown in FIG. 3, the value determination circuit fetches the number of high-level signals stored in the hardware register circuit, compares the number of high-level signals with the target software total N value, and determines whether the number of high-level signals is equal to the target software total N value. If the determination result is yes, the value determination circuit outputs a clear signal to the hardware register through the level conversion circuit, and clears the data in the hardware register. If the determination result is no, indicating that the number of high-level signals is not equal to the target software total N value, and there may be a situation of repeated reset of the software system, then the number of high-level signals is greater than the target software total N value, and the value determination circuit converts the received high-level signal into a low-level signal, and outputs the low-level signal to the level conversion circuit, waiting for the level conversion and output of the next reset signal. It is worth noting that by adjusting the value of the target software total N, combined with the value determination circuit fetching the count value of the high-level signal received by the hardware register, different on-board computer software strategies can be compatible, thus being applicable to different on-board computer strategies and different purpose satellites. Moreover, the software reset hardware component is controlled by an independent hardware system startup circuit, which is connected in series with each circuit in the software reset hardware component. Therefore, the on-board computer reset circuit, the hardware register circuit, the level conversion circuit, the value determination circuit, and the power-off restart circuit are connected in parallel, the restart of the on-board computer software system component does not affect the value statistics of the hardware register circuit, and the high reliability requirement of the hardware system for the self-recovery control of the on-board computer software system is met.

[0048] In one embodiment, as shown in FIG. 1, the software reset hardware component includes a hardware register circuit, a level conversion circuit, a value determination circuit, and a power-off restart circuit. The hardware register circuit is connected to the level conversion circuit, the value determination circuit, and the power-off restart circuit. The level conversion circuit is connected to the value determination circuit and the power-off restart circuit. The value determination circuit is connected to the power-off restart circuit. Figure 2 As shown in FIG. 4, the software reset hardware component includes two sets of level conversion circuits, including a first level conversion circuit and a second level conversion circuit. The first level conversion circuit is used to receive the reset signal output by the on-board computer reset circuit and the low-level signal output by the power-off restart circuit, convert the reset signal and the low-level signal into a high-level signal, and output the high-level signal to the hardware register circuit. The second level conversion circuit is used to receive the clear signal output by the value determination circuit, convert the clear signal into a low-level signal, and output the low-level signal to the hardware register circuit and the power-off restart circuit.

[0049] In one embodiment, as shown in FIG. 1, the software reset hardware component includes a hardware register circuit, a level conversion circuit, a value determination circuit, and a power-off restart circuit. The hardware register circuit is connected to the level conversion circuit, the value determination circuit, and the power-off restart circuit. The level conversion circuit is connected to the value determination circuit and the power-off restart circuit. The value determination circuit is connected to the power-off restart circuit. Figure 2As shown, the hardware system startup circuit is also used to control the power-on startup of the software reset hardware component, the on-board computer reset circuit, the hardware register circuit, the level conversion circuit, the value determination circuit, and the power-off restart circuit are connected in parallel with the hardware system startup circuit. It should be noted that the hardware register circuit receives the reset signal from the on-board computer reset circuit through the first level conversion circuit, when the value determination circuit reads the register count value equal to the target software total number N, it indicates that the on-board computer reset circuit has been reset N times, that is, the on-board computer software system component has loaded and run N copies of the program once, and none of them has run normally. At this time, the value determination circuit will output a high-level signal, and then convert it to a low-level signal through the second level conversion circuit. The low-level signal is sent to the hardware register circuit for value "clearing" operation, so that the hardware register circuit starts counting again. At the same time, the low-level signal is sent to the power-off restart circuit, so that the on-board computer performs power-off restart after power-on. The entire software self-recovery hardware system starts working again. As can be seen, by judging the size of the hardware register count value and the target software total number, the on-board computer hardware system controls the software system self-recovery while being compatible with different on-board computer devices. By placing an independent startup control circuit in the software reset hardware component, the software system running error is avoided to affect the operation of the hardware system, thereby improving the stability and applicability of the overall on-board computer software self-recovery hardware system.

[0050] It should be understood that, although Figure 1 、 2 The steps in the flowchart are displayed in sequence according to the direction of the arrow, but these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise stated herein, the execution of these steps has no strict order limitation, and these steps can be executed in other orders. Moreover, Figure 1 、 2 At least part of the steps in

[0051] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer readable storage medium, and when the computer program is executed, the processes of the above-mentioned embodiments of the methods can be included. Any reference to memory, storage, databases, or other media in the embodiments provided by the present application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration but not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0052] The technical features of the above embodiments can be combined in any way. In order to make the description simple, not all possible combinations of the technical features in the above embodiments are described, but as long as the combinations of the technical features do not exist, they should be considered as the scope of the present application.

[0053] The above embodiments only express several implementation manners of the present application, and the description is more specific and detailed, but it should not be understood as a limitation on the scope of the patent. It should be pointed out that for ordinary skilled in the art, without departing from the concept of the present application, some modifications and improvements can be made, which are all within the scope of the present application. Therefore, the scope of the patent of the present application should be subject to the appended claims.

Claims

1. A spaceborne computer software self-recovery hardware system, characterized by, The system is deployed in a satellite computer, The system comprises a satellite computer software strategy, a software real-time monitoring hardware component, and a software reset hardware component; The system sets a start delay time, a target watchdog time, and a target software total number according to the satellite computer software strategy; The software real-time monitoring hardware component comprises a delay time start circuit, a hardware watchdog circuit, and a time judgment circuit; the delay time start circuit is used to set a watchdog circuit start time and a watchdog signal time of the hardware watchdog circuit after power-on; the hardware watchdog circuit receives a periodic watchdog signal sent by the satellite computer software after start according to the watchdog circuit start time and the watchdog signal time; the time judgment circuit is used to judge the size of the periodic watchdog signal and the target watchdog time, and output a satellite computer software loading or reset signal; The software reset hardware component comprises a satellite computer reset circuit, a hardware register circuit, a level conversion circuit, a numerical judgment circuit, and a power-off restart circuit; the satellite computer reset circuit is used to reset and restart the software real-time monitoring hardware component after receiving the reset signal, and output a high-level signal to the hardware register circuit through the level conversion circuit; the hardware register circuit converts the received high-level signal into a low-level signal and counts the number of high-level signals; the numerical judgment circuit is used to judge the size of the number of high-level signals and the target software total number, and output a low-level signal or a clear signal of the hardware register circuit; the power-off restart circuit receives the clear signal to restart the satellite computer; The software real-time monitoring hardware component further comprises a satellite computer power-on completion indication circuit and a satellite computer software system component; The satellite computer power-on completion indication circuit is used to start the software real-time monitoring hardware component, receive the reset signal of the satellite computer reset circuit, and output a satellite computer software running signal and turn on the delay time start circuit; The satellite computer software system component is used to receive the reset signal of the satellite computer reset circuit, mount the currently abnormally loaded satellite computer software, and read and load the target software total number of satellite computer software by portions; The satellite computer reset circuit performs bidirectional transmission processing according to the reset signal; the bidirectional transmission processing comprises software reset signal transmission processing and hardware reset signal transmission processing; The software reset signal transmission processing is used for the satellite computer power-on completion indication circuit to receive the reset signal, and perform a restart operation on the satellite computer software system component and the delay time start circuit; the hardware reset signal transmission processing is used for the level conversion circuit to receive the reset signal, convert the reset signal into a high-level signal, output the high-level signal to the hardware register circuit, and count the number of high-level signals.

2. The on-board computer software self-recovery hardware system according to claim 1, wherein, Setting a start delay time, a target watchdog time, and a target software total number comprises: Formulating the satellite computer software strategy according to the use of the satellite carrying the satellite computer; The start delay time is updated by accumulating the target feeding time according to the start time point of the monitoring set by the software running cycle of the satellite computer, the target feeding time is the time cycle of the normal running of the single software of the satellite computer, and the start of the watchdog circuit is controlled according to the time point sequence formed by the start delay time and the target feeding time, and the target software total number is the total software quantity required to be loaded by the working process of the satellite.

3. The satellite computer software self-recovery hardware system according to claim 1, characterized in that: The hardware watchdog circuit is further used for recording the current single satellite computer software running time, recording and obtaining the periodic feeding signal time according to the target software total number, and outputting the periodic feeding signal.

4. The on-board computer software self-recovery hardware system of claim 1, wherein, The time determination circuit is used for determining the size of the high-level signal quantity and the target software total number, and further comprises: If the periodic feeding signal time is greater than the target feeding time or the periodic feeding signal is incorrect, the time determination circuit outputs the satellite computer software reset signal; If the periodic feeding signal time is not greater than the target feeding time and the periodic feeding signal is correct, the time determination circuit outputs the satellite computer software loading signal.

5. The on-board computer software self-recovery hardware system of claim 1, wherein, The software reset hardware component further comprises a hardware system start circuit. The hardware system start circuit is used for receiving the satellite computer power-on signal, and initializing and setting the low-level signal value in the hardware register circuit to 0 and the high-level signal value to 1. The level conversion circuit is used for converting the received reset signal into a high-level signal, the hardware register circuit receives the high-level signal and counts, and outputs the high-level signal to the numerical value determination circuit to trigger the numerical value determination circuit to determine the current high-level signal quantity stored in the hardware register and determine whether to restart.

6. The satellite computer software self-recovery hardware system according to claim 5, characterized in that: The numerical value determination circuit is further used for calling the high-level signal quantity stored in the hardware register circuit, if the high-level signal quantity is equal to the target software total number, the numerical value determination circuit outputs a clear signal to the hardware register through the level conversion circuit to clear the data in the hardware register; otherwise, the numerical value determination circuit converts the received high-level signal into a low-level signal, outputs the low-level signal to the level conversion circuit, and waits for the level conversion and output of the next reset signal.

7. The on-board computer software self-recovery hardware system of claim 6, wherein, The level conversion circuit comprises a first level conversion circuit and a second level conversion circuit. The first level conversion circuit is used for receiving the reset signal output by the satellite computer reset circuit and the low-level signal output by the power-off restart circuit, converting the reset signal and the low-level signal into the high-level signal, and outputting the high-level signal to the hardware register circuit. The second level conversion circuit is used for receiving the clear signal output by the numerical judgment circuit, converting the clear signal into a low level signal, and outputting to the hardware register circuit and the power-off restart circuit.

8. The hardware system for software self-recovery of the on-board computer according to claim 5, characterized in that: The hardware system startup circuit is further used for controlling the power-on startup of the software reset hardware component, and the on-board computer reset circuit, the hardware register circuit, the level conversion circuit, the numerical judgment circuit and the power-off restart circuit are connected in parallel with the hardware system startup circuit.

Images