Configurable fault-tolerant star service software task scheduling system based on multi-core processor

Abstract

A configurable fault-tolerant satellite service software task scheduling system based on a multi-core processor is statically configured into a low-power mode, a three-mode redundancy mode or a high-performance mode through at least three processors, and is dynamically configured by mode switching according to a satellite running state and a task demand; the application can fully utilize the advantages of the multi-core processor in various scenes; the application is low in cost, does not need additional hardware to realize arbitration, and is convenient for troubleshooting and debugging; the application is flexible in function, and can dynamically configure a working mode according to a satellite running state and a remote control instruction.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of satellite computer software and hardware, and particularly relates to a configurable fault-tolerant satellite software task scheduling system based on a multi-core processor. BACKGROUND

[0002] With the increasing requirements of satellite systems for control frequency, autonomous operation capability, fault diagnosis capability, etc., single-core processors are limited by Moore's law and affected by the power wall factor, and cannot further improve their computing power under the condition of limited power, gradually becoming a bottleneck in the design of satellite control and information systems. Multi-core processors have greater advantages in computing power and energy consumption. Therefore, using multi-core processors in the design of satellite control and data processing units is an inevitable choice to improve the processing power of satellite information systems.

[0003] When a satellite is in a space radiation environment, the electronic equipment of the satellite is impacted by various high-energy particles, which will produce certain radiation effects. Radiation effects mainly include total dose, single event latchup, and single event upset. Single event upset accounts for nearly 40% of the faults, and is one of the main reasons for satellite on-orbit failures. The fault caused by single event upset belongs to a repairable fault, which can be corrected by hardware redundancy, data coding, and other fault-tolerant technologies. How to design a fault-tolerant scheme for the needs of multi-core processors and satellite software is an important problem worth exploring.

[0004] The prior art document CN112667450A discloses a multi-core processor fault-tolerant system that can be dynamically configured. The register of the main core CPU0 is subjected to a hardware state saving operation, and the checkpoint state saving operation of CPU1 and CPU2 is saved to the on-chip SRAM in a software manner. The dynamic operation is transparent to the software, so the software only needs to perform a checkpoint state saving operation when a mode switching signal is received, and reads it when it is restored. However, all processors need to be enabled in the three modes, which has high power consumption, and a special voting circuit is needed for fault-tolerant processing of each 1-bit data stream output at the instruction level. SUMMARY

[0005] In order to overcome the shortcomings of the prior art, in particular, the high implementation cost of existing fault-tolerant technologies, the need for additional hardware, and the difficulty of dynamically configuring traditional fault-tolerant systems according to the running state and task requirements of satellites, a configurable fault-tolerant satellite software task scheduling system based on a multi-core processor is proposed.

[0006] The technical solution of the present application is:

[0007] The application discloses a configurable fault-tolerant satellite service software task scheduling system based on a multi-core processor, and has the characteristics that the system is statically configured into a low-power consumption mode, a three-module redundancy mode or a high-performance mode through at least three processors, and is dynamically configured by mode switching according to a satellite operation state and task demand.

[0008] The low-power consumption mode enables one processor core to run satellite service software with basic functions.

[0009] The three-module redundancy mode enables at least four processor cores, wherein one processor core controls and supervises the operation of other modules, runs a data acquisition module and runs an arbitration module, and the remaining three processor cores simultaneously run respective function modules of the satellite service software, and the arbitration unit arbitrates the calculation results and transmits the results to respective executing mechanisms.

[0010] The high-performance mode enables multiple processor cores, adopts partition scheduling, and independently runs satellite service software modules distributed on the processor cores.

[0011] The mode switching module is used for switching the configurable fault-tolerant satellite service software task scheduling mode according to a remote control instruction when the instruction is received, and automatically or manually switching into the low-power consumption mode when the satellite energy is in shortage.

[0012] The multi-core processor is an SMP processor with four or more cores.

[0013] The arbitration module adopts a voting system, votes according to the calculation results of the three fault-tolerant processors, and the result with more votes is taken as the output.

[0014] The satellite service software with basic functions comprises a supervision module, a data acquisition module, an attitude control module, an energy module, a thermal control module, a remote control module, a telemetry module and a ground measurement module.

[0015] Compared with the prior art, the application has the beneficial effects that:

[0016] (1) The application can fully utilize the advantages of the multi-core processor in various scenes, realizes low cost, does not need additional hardware to realize arbitration, and is convenient for troubleshooting and debugging, and is flexible in function and can dynamically configure the working mode according to the satellite operation state and the remote control instruction.

[0017] (2) The application is realized at the application level and is applicable to various processor architectures and operating systems.

[0018] (3) For module level (thread level) granularity, switching is based on thread migration, thread start and termination, and based on module level granularity, the partition scheduling of the module is comprehensively considered, only the final result of the calculation module except the supervision module and the data acquisition module is fault-tolerant by using triple modular redundancy, and a special voting circuit is not required. BRIEF DESCRIPTION OF DRAWINGS

[0019] Figure 1 Low-power mode schematic diagram

[0020] Figure 2 Triple modular redundancy mode schematic diagram

[0021] Figure 3 High-performance mode schematic diagram

[0022] Figure 4 Mode switching schematic diagram DETAILED DESCRIPTION

[0023] The application will be further described below in combination with the drawings and examples, but the protection scope of the application should not be limited thereby.

[0024] 1. Three modes

[0025] In order to meet different performance and reliability requirements under different satellite operating states and task demand conditions, and to fully utilize the multi-core processor in various scenarios, the configurable fault-tolerant satellite software task scheduling is realized at the application level, and there are three modes:

[0026] 1.1 Low-power mode

[0027] When the satellite energy is tight, the power consumption of the multi-core processor needs to be reduced, and at this time the satellite software only runs the most basic modules. As shown in the figure, in this mode the satellite software enters the basic function running mode, each module is executed in turn according to the priority, and runs on the main core of the processor, and the remaining processor cores are turned off. Figure 1

[0028] 1.2 Triple modular redundancy mode

[0029] When the satellite runs in an orbit with a harsh space environment, the probability of single event effects increases, at which time the triple modular redundancy mode needs to be switched to increase the reliability of the system. As shown in the figure, the triple modular redundancy mode enables at least 4 processor cores. Figure 2

[0030] ​​The supervisory module runs on Core0, which is responsible for controlling and supervising the running of other modules; the data acquisition module runs, which inputs the collected data of each sensitive sensor into each fault-tolerant Core; the arbitration module runs, which synchronizes and arbitrates the calculation results of each fault-tolerant Core after completing the calculation of a module, and then transmits the arbitrated data to the corresponding actuator.

[0031] The arbitration module adopts a voting system. Since transient faults are small probability events, the final result can be determined by voting. According to the calculation results of the three fault-tolerant Cores, the result with more votes is taken as the output.

[0032] The fault-tolerant technology of data encoding can be used on Core0 to monitor and correct its own running state.

[0033] Core 1, Core 2, and Core 3 are fault-tolerant Cores, each of which runs the same functional module. The functional module on each Core is controlled by the supervisory module running on Core0, and is executed in order according to the priority. After the module is completed, it waits for Core0 to synchronize.

[0034] 1.3 High-performance mode

[0035] When the satellite needs to enhance the computing power to perform complex tasks, it can switch to high-performance mode. As shown in Figure 3 , the high-performance mode enables some or all processor cores according to the computing power requirement.

[0036] Partition scheduling is adopted. According to the calculation amount and constraint relationship between modules, the modules are allocated to each core, and each core executes the allocated module according to the FIFO strategy.

[0037] 2. Mode switching

[0038] The switching between modes can be automatically triggered by the change of the satellite running state, or controlled by remote control command. The switching between modes is shown in Figure 4 .

[0039] 2.1 Enter low-power mode

[0040] The satellite software is reset, the processor cores such as Core1, Core2, and Core3 are turned off, the basic function running supervisory module is created on Core0, the data acquisition module, attitude control module, energy module, thermal control module, remote control module, telemetry module, and ground test module in the basic function running mode are initialized by the basic function running supervisory module, and each module is executed in order according to the above sequence in each cycle.

[0041] 2.2 Enter three-module redundancy mode

[0042] When entering the triple modular redundancy mode from the low power mode, the star service software is reset, Core1, Core2 and Core3 are enabled. The supervisory module is created on Core0, the supervisory module creates the data acquisition module and the arbitration module on Core0, and the remaining all functional module copies are created on Core1, Core2 and Core3 respectively.

[0043] When entering the triple modular redundancy mode from the high performance mode, the supervisory module and the data acquisition module are migrated to Core0, and the modules and functions running only in the high performance mode are closed. The remaining all functional modules are migrated to Core1. The functional module copies are created on Core2 and Core3 respectively.

[0044] 2.3 Entering the high performance mode

[0045] When entering the high performance mode from the low power mode, the star service software is reset, and the processor cores such as Core1, Core2 and Core3 are enabled. The supervisory module is created on the main core Core0, and the supervisory module creates the corresponding modules belonging to each core according to the partition table.

[0046] When entering the high performance mode from the triple modular redundancy mode, the supervisory module migrates the created modules to the corresponding cores according to the partition table, and creates the modules running only in the high performance mode on the corresponding cores, and opens the functions running only in the high performance mode.

Claims

1. A configurable fault-tolerant star service software task scheduling system based on a multi-core processor, characterized in that, The system is statically configured as a low-power mode, a three-mode redundancy mode or a high-performance mode by at least three processors, and is dynamically configured by mode switching according to a satellite running state and a task demand; The low-power mode enables one processor core to run satellite software with basic functions, wherein the satellite software with basic functions comprises a supervision module, a data acquisition module, an attitude control module, an energy module, a thermal control module, a remote control module, a telemetry module and a ground test module; The three-mode redundancy mode enables at least four processor cores, wherein one processor core is used as a supervision core to run the supervision module, the data acquisition module and an arbitration module, the supervision module is used to control and supervise the running of other modules, the data acquisition module is used to acquire data of each sensitive sensor and input the data into each fault-tolerant core, the arbitration module adopts a voting system to vote the calculation results of the three fault-tolerant cores, and the result with more votes is transmitted to each execution mechanism as an output, and the supervision core adopts a data encoding fault-tolerant technology to monitor and correct the running state of itself; the remaining three processor cores are used as fault-tolerant cores, each of which runs each functional module in the satellite software except the supervision module and the data acquisition module, and the arbitration module transmits the result to each execution mechanism after arbitrating the calculation results; The high-performance mode enables multiple processor cores to adopt a partition scheduling mode, to distribute each functional module of the satellite software to each core according to the calculation amount and constraint relationship among the modules, and each processor core independently runs the satellite software module distributed thereto.

2. The configurable fault-tolerant star service software task scheduling system based on a multi-core processor according to claim 1, wherein, The multi-core processor is an SMP processor with four or more cores.

Images