Zynq on-orbit loading and reconfiguration method and system for commercial satellite field

Abstract

The application discloses a ZYNQ on-orbit loading reconstruction method and system for the commercial satellite field, and the method comprises the following steps: configuration data booting: powering on an on-orbit application system, wherein the system comprises a storage unit, a reconstruction management controller and a ZYNQ processor; reading and loading a header file and a first-stage loading program based on a magnetic random memory of the storage unit, and loading a programmable logic module and a processing system module of the ZYNQ processor based on a flash memory of the storage unit; back-reading verification: online monitoring the processing system module and the programmable logic module, and performing single event upset and single event function interruption judgment in real time; resetting and reconfiguring: resetting when the single event upset is determined to exist, and reconfiguring when the single event function interruption is determined to exist. The application can effectively monitor the running state of the ZYNQ in the on-orbit space running environment, and guarantee the high-reliability reconstruction of the on-orbit software of the ZYNQ in the space radiation environment.

Description

Technical Field

[0001] This invention relates to the field of digital signal processing technology, and in particular to a ZYNQ on-orbit loading and reconfiguration method and system for commercial satellites. Background Technology

[0002] The ZYNQ chip is a chip from Xilinx that integrates the PS (processor system) and PL (programmable logic) into a single SoC. The processing system integrates a homogeneous dual-core ARM processor, interfaces, and memory peripherals with programmable logic. ZYNQ combines the high parallel computing capabilities of programmable logic with the data and signal processing capabilities of ARM, making it suitable for applications in fields such as medical devices, instrumentation, automotive navigation, and aerospace.

[0003] In the aerospace field, with the advancement of science and technology in my country, satellite communication technology has been increasingly strengthened, and its application in both civilian and military fields has always been of paramount importance. Satellite communication is an effective supplement and necessary backup to terrestrial communication networks, especially in sparsely populated areas outside major cities and in dynamically changing user areas such as oceans and plateaus, where it is the most economical and effective means of communication. In recent years, with the rapid rise of new economic forms such as the marine economy and the digital economy, commercial aerospace satellite communication has been required to have lower power consumption, smaller size, higher bandwidth, higher communication capacity, stronger switching capabilities, and support for diverse signals. Commercial aerospace, not being restricted by imported components, has increasingly adopted the highly integrated, high-performance, low-power, and low-cost commercial device ZYNQ as its main control CPU.

[0004] Modern communication satellites operate at increasingly higher frequencies and lower voltages, making their main control CPUs more sensitive to single-event effects (SEE). The satellite operating environment is filled with various high-energy particles, such as protons, alpha ions, heavy ions, gamma rays, and electrons, all of which can cause SEE. ZYNQ, as a commercial device, has weak SEE resistance and is susceptible to SEU / SEFI caused by high-energy particles, leading to memory data flips, program anomalies, and even system failures, severely impacting the stability and reliability of the satellite. To adapt to the complex and ever-changing space environment, improve the high reliability of communication satellites, and ensure stable system operation, ZYNQ system hardening is necessary. Current hardening methods are limited, mainly including external hardware EDAC and FPGA programming to implement EDAC. ZYNQ itself has a highly integrated and fixed hardware architecture, making external EDAC circuitry inconvenient. Implementing EDAC in an FPGA also raises reliability questions due to the power-loss volatility of SRAM. Therefore, this invention proposes a software-level method for hardening ZYNQ-based systems for the commercial satellite industry, which is both necessary and valuable. Summary of the Invention

[0005] To address the aforementioned issues, this invention proposes an on-orbit loading and reconfiguration method and system for ZYNQ in the commercial satellite field. This method effectively monitors the operational status of ZYNQ in the orbital space environment, ensuring highly reliable on-orbit software reconfiguration of ZYNQ under space irradiation conditions. This enables the realization of software-defined satellites with different functions on a general platform. Furthermore, it improves the single-event fault tolerance capability of PS and PL in ZYNQ during on-orbit guidance and operation phases, significantly reducing the impact of SEU / SEFI on effective system communication, thereby achieving high-reliability and high-performance system operation.

[0006] The technical solution adopted in this invention is as follows:

[0007] A ZYNQ on-orbit loading and reconfiguration method for commercial satellites includes:

[0008] Configuration data guidance: Power on the on-orbit application system, which includes a storage unit, a reconfiguration management controller, and a ZYNQ processor; read the loading header file and the first-stage loading program based on the magnetic random access memory of the storage unit, and load the programmable logic module and processing system module of the ZYNQ processor based on the flash memory of the storage unit;

[0009] Readback verification: Based on the reconfiguration management controller, the processing system module is monitored online, and single-event upset and single-event function interruption are determined in real time; based on the processing system module, the configuration status register and configuration bit stream of the programmable logic module are monitored and refreshed online through the PCAP channel, and single-event function interruption is determined in real time;

[0010] Reset and Reconfiguration: Reset is performed when a single-event upset is detected, and reconfiguration is performed when a single-event interrupt is detected.

[0011] Furthermore, the storage unit includes a magnetic random access memory and multiple flash memories. The magnetic random access memory is electrically connected to the programmable logic module and the processing system module of the ZYNQ processor through the reconfiguration management controller, and stores the bit stream file of the programmable logic module and the program file of the processing system module. The flash memories store the loading header file and the first-stage loading program.

[0012] Furthermore, the reconfiguration management controller includes a storage controller, a bitstream parser, and an FPGA controller. The bitstream parser is connected to the storage controller and the FPGA controller, respectively. The storage controller is electrically connected to the magnetic random access memory and flash memory of the storage unit. The FPGA controller is electrically connected to the programmable logic module and the processing system module of the ZYNQ processor.

[0013] Furthermore, the ZYNQ processor includes a programmable logic module and a processing system module. The programmable logic module and the processing system module are connected through an internal high-speed bus to achieve data interaction and communication. The processing system module loads the programmable logic module through the PCAP channel.

[0014] Furthermore, the programmable logic module includes an FPGA chip, and the processing system module includes an ARM processor, an internal memory module, and an external interface module, wherein the ARM processor is electrically connected to the internal memory module, the external interface module, and the FPGA chip.

[0015] Furthermore, the reconfiguration management controller can read the bitstream file of the programmable logic module from the flash memory according to the timing requirements of the ZYNQ processor. The processing system module loads the programmable logic module through the PCAP channel. During startup, the programmable logic module is used as a peripheral of the processing system module to complete the initialization configuration. That is, the first-stage loader completes the initialization configuration of the processing system module, and the programmable logic module is loaded and configured through the PCAP channel and the bitstream file of the programmable logic module.

[0016] Furthermore, the method for determining single-event upset and single-event interruption includes: the reconfiguration management controller selects any two of the flash memories, reads the bit stream information of the stored programmable logic module and compares them; if they match, it indicates that the reading is correct; otherwise, it indicates that the reading is incorrect and there is a probability that a single-event upset and / or single-event interruption has occurred.

[0017] Furthermore, the ZYNQ processor can generate a fixed-period heartbeat signal and a program execution status signal, which are sent to the reconfiguration management controller via a UART serial port. The latter monitors the operating status of the ZYNQ processor. When the reconfiguration management controller does not receive a heartbeat signal from a certain unit or receives an abnormal heartbeat signal, it indicates that the unit's operating status is abnormal, requiring a single unit's SRST soft reset or a system-wide POR hard reset. When program execution is abnormal, the reconfiguration management controller decides whether to perform related operations, including reset or program jump operations.

[0018] Furthermore, when the processing system module monitors the configuration status register of the programmable logic module through the PCAP channel, the monitoring status can interact with the programmable logic module through the UART interface. The configuration status register includes a FAR register and a STAT register. When the processing system module refreshes the bit stream of the programmable logic module through the PCAP channel, the refresh content includes configuration data of the CLB, IO, DSP and BRAM interconnects.

[0019] A ZYNQ on-orbit application system for commercial satellites includes a storage unit, a reconfiguration management controller, and a ZYNQ processor. The reconfiguration management controller is electrically connected to the storage unit and the ZYNQ processor. The storage unit includes a magnetic random access memory (MRMemory) and a flash memory. The ZYNQ processor includes a programmable logic module (PLC) and a processing system module. The MRMemory can read and load header files and a first-stage loading program. The flash memory can load the PLC and the processing system module of the ZYNQ processor. The reconfiguration management controller can monitor the processing system module online and perform real-time single-event upset (SWE) and single-event interruption (SEE) determinations. The processing system module can monitor and refresh the configuration status register and configuration bitstream of the PLC online via a PCAP channel and perform real-time SEE determinations. When a SWE is determined to exist, a reset is performed; when a SEE is determined to exist, a reconfiguration is performed.

[0020] The beneficial effects of this invention are as follows:

[0021] (1) The ZYNQ on-orbit loading and reconfiguration method for commercial satellites provided by this invention is a complement to the ZYNQ on-orbit software fault-tolerant processing method. It is a system hardware hardening method and a software-insensitive hardening method that does not increase the difficulty of ZYNQ software design. It ensures the relatively reliable on-orbit application of ZYNQ, a high-performance commercial processor, makes up for the low performance of traditional aerospace CPUs, promotes the miniaturization, high integration and ultra-low power consumption of commercial satellites, and can be widely used in micro-nano satellites, commercial communication satellites and other fields.

[0022] (2) This invention can effectively monitor the operation status of ZYNQ in the orbital space environment, ensure high reliability reconfiguration of ZYNQ on-orbit software under space irradiation environment, thereby realizing software-defined satellites based on different functions under a general platform; improve the anti-single-event fault tolerance capability of PS and PL in ZYNQ during the on-orbit guidance and operation phase, greatly reduce the impact of SEU / SEFI on the effective communication of the system, and realize the high reliability and high performance of the system operation.

[0023] (3) This invention can effectively solve the problems of on-orbit software reconfiguration failure, errors in loading operating system and application files affecting PS loading, errors in reading PL bit stream from FLASH affecting PL loading, and PL bit stream being overturned by single event causing single event interruption.

[0024] (4) Compared with the traditional satellite architecture of DSP+FPGA, the present invention utilizes the system's hardware and software co-processing technology and uses ZYNQ as the main control CPU, which has lower power consumption, higher integration, lower cost, higher and more flexible performance, while having stronger anti-interference capabilities. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the ZYNQ on-orbit application system according to Embodiment 1 of the present invention.

[0026] Figure 2 This is a flowchart of the ZYNQ on-orbit loading and reconfiguration method according to Embodiment 1 of the present invention.

[0027] Figure 3 This is a flowchart of the application method for configuring a programmable logic module via PCAP in the processing system module of Embodiment 1 of the present invention. Detailed Implementation

[0028] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments are now described. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention; that is, the described embodiments are only a part of the embodiments of the invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0029] Example 1

[0030] like Figure 1 As shown, this embodiment provides a ZYNQ on-orbit application system for the commercial satellite field, including a storage unit, a reconfiguration management controller, and a ZYNQ processor. The reconfiguration management controller is electrically connected to the storage unit and the ZYNQ processor, wherein:

[0031] The ZYNQ processor includes a programmable logic module (PL) and a processing system module (PS). The PL and PS are connected via an internal high-speed bus (e.g., AXI4-Lite) for data communication. The PS loads the PL through a PCAP channel. Preferably, the PL includes an FPGA chip, and the PS includes an ARM processor, an internal memory module (e.g., QSPI Flash memory), and an external interface module (e.g., UART). The ARM processor is electrically connected to the internal memory module, the external interface module, and the FPGA chip.

[0032] The storage unit includes magnetic random access memory (MRAM) and multiple flash memories. The MRAM is electrically connected to the ZYNQ processor's programmable logic module and processing system module via a reconfiguration management controller, and stores the bitstream file of the programmable logic module and the program file of the processing system module. The flash memories store the boot ROM header and the first stage boot loader (FSBL). Preferably, the flash memory can be TMR Flash, where TMR, or triple modular redundancy, is a commonly used fault-tolerant technique. It copies the fault-tolerant portion three times, and then a voter outputs the result based on a majority vote principle.

[0033] The reconfiguration management controller includes a storage controller, a bitstream parser, and an FPGA controller. The bitstream parser is connected to the storage controller and the FPGA controller, respectively. The storage controller is electrically connected to the magnetic random access memory and flash memory of the storage unit. The FPGA controller is electrically connected to the programmable logic module and the processing system module of the ZYNQ processor.

[0034] like Figure 2 This embodiment also provides a ZYNQ on-orbit loading and reconfiguration method for commercial satellites, including:

[0035] Configuration data guidance: Power on the on-orbit application system, which includes a storage unit, a reconfiguration management controller, and a ZYNQ processor; read the loading header file and the first-stage loading program based on the magnetic random access memory of the storage unit, and load the programmable logic module and processing system module of the ZYNQ processor based on the flash memory of the storage unit;

[0036] Readback verification: Based on the reconfiguration management controller, the processing system module is monitored online, and single-event upset (SEU) and single-event function interruption (SEFI) are determined in real time; based on the processing system module, the configuration status register and configuration bit stream of the programmable logic module are monitored and refreshed online through the PCAP channel, and single-event function interruption is determined in real time.

[0037] Reset and Reconfiguration: Reset is performed when a single-event upset is detected, and reconfiguration is performed when a single-event interrupt is detected.

[0038] The reconfiguration management controller can read the bitstream file of the programmable logic module from the flash memory according to the timing requirements of the ZYNQ processor. The processing system module loads the programmable logic module through the PCAP channel. During the startup process, the programmable logic module is used as a peripheral of the processing system module to complete the initialization configuration. That is, the first-stage loader completes the initialization configuration of the processing system module, and completes the loading configuration of the programmable logic module through the PCAP channel and the bitstream file of the programmable logic module.

[0039] Preferably, the method for determining single-event upsets (SWEs) and single-event interrupts (SEEs) can employ the TMR (Transmission Method Registry) decision method: the reconfiguration management controller selects two of the three flash memories, reads the bitstream information of the stored programmable logic modules, and compares them. If they match, the read is correct; otherwise, the read is incorrect, and a SWE or SEE may have occurred. The system then decides whether to perform a soft reset or a hard reset. This TMR decision method effectively avoids misreading caused by SWEs, ensuring the reliability of the ZYNQ processor.

[0040] The ZYNQ processor can generate fixed-period heartbeat signals and program execution status signals, which are sent to the reconfiguration management controller via UART serial port. The latter monitors the operating status of the ZYNQ processor. When the reconfiguration management controller does not receive a heartbeat signal from a certain unit or receives an abnormal heartbeat signal, it indicates that the unit is in an abnormal operating state and requires a soft reset of the individual unit (SRST) or a hard reset of the entire system (POR). When the program execution is abnormal, the reconfiguration management controller decides whether to perform a reset or program jump, thereby improving the on-orbit single-event fault tolerance capability of the processing system module.

[0041] Preferably, when the processing system module monitors the configuration status register of the programmable logic module through the PCAP channel, the monitored status can interact with the A3P FPGA via the UART interface, exhibiting good real-time performance, interactivity, and reliability. The configuration status register includes the FAR register and the STAT register. When the processing system module refreshes the bit stream of the programmable logic module through the PCAP channel, the refreshed content includes configuration data for the CLB, I / O, DSP, and BRAM interconnects.

[0042] like Figure 3As shown, this embodiment also provides a method for configuring a programmable logic module (PL) via PCAP using a processing system module (PS). After reconfiguration is enabled and a reset is performed, the system enters the configuration state machine. First, the system clears the programmable logic module configuration register. Next, it waits for the programmable logic module configuration logic to initialize. If the watchdog counter overflows during this period, it indicates a configuration error, and the system handles the configuration error. After reconfiguration is enabled, the system re-enters the configuration state machine. If the counter is normal and the INIT_B signal is high, the configuration operation for data read / write begins. If the watchdog counter overflows during the data read / write configuration operation, it indicates a configuration error, and the system handles the configuration error. After reconfiguration is enabled, the system re-enters the configuration state machine. If the counter is normal and the DONE signal goes high, the programmable logic module configuration is complete. The FPGA watchdog counter is responsible for subsequent state monitoring and can guide a reset operation or trigger a reset when the counter overflows, thus re-entering the configuration state machine.

[0043] Preferably, the reconstruction management controller in this embodiment can write a reconstruction program to a specified version of the flash memory according to a remote control command. The smallest unit of the reconstruction file is a page (used for single-particle flip reset), which means that the specified position can be updated according to the page, or the entire bit stream can be updated, and it supports breakpoint resume.

[0044] More preferably, the specific implementation steps of the ZYNQ on-orbit loading and reconfiguration method in this embodiment are as follows:

[0045] 1. The reconfiguration management controller reads the load header file and the first-stage load program from the magnetic random access memory according to the timing requirements of the ZYNQ processor;

[0046] 2. The reconfiguration management controller reads the bit stream of the programmable logic module from three flash memories based on TMR decision according to the timing requirements of the ZYNQ processor. The processing system module completes the loading of the programmable logic module through the PCAP interface.

[0047] 3. The reconfiguration management controller reads the operating system and application files from the three flash memories based on TMR decisions according to the timing requirements of the ZYNQ processor, and completes the loading of the processing system modules;

[0048] 4. During the above reading process, no automatic fault write-back is performed, and the granularity of fault information recording is in units of pages;

[0049] 5. The fixed-period heartbeat signal and program execution status signal of the ZYNQ processor's processing system module are sent to the reconfiguration management controller via serial port. The latter monitors its operating status in the space environment. When the program is abnormal, the reconfiguration management controller decides whether to reset or jump the program, thereby improving the on-orbit single-event fault tolerance capability of the processing system module.

[0050] 6. The ZYNQ processor's processing system module uses the PCAP channel to refresh the configuration area of ​​the programmable logic module and monitor the configuration status register. The monitoring status can be interacted with the A3P FPGA via the UART interface.

[0051] 7. The reconstructing management controller writes the reconstructing program to the specified version of the flash memory according to the remote control command. The smallest unit of the reconstructing file is a page (used for single-particle flip reset). That is, it can update the specified position according to the page, or it can update the entire bit stream, and it supports breakpoint resume.

[0052] Example 2

[0053] This embodiment is based on embodiment 1:

[0054] This embodiment provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the steps of the ZYNQ on-orbit loading and reconfiguration method for the commercial satellite field described in Embodiment 1. The computer program can be in the form of source code, object code, executable file, or some intermediate form.

[0055] Example 3

[0056] This embodiment is based on embodiment 1:

[0057] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the ZYNQ on-orbit loading and reconfiguration method for the commercial satellite field described in Embodiment 1. The computer program can be in the form of source code, object code, executable file, or some intermediate form. The storage medium includes any entity or device capable of carrying computer program code, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc. It should be noted that the content contained in the storage medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, the storage medium does not include electrical carrier signals and telecommunication signals.

[0058] It should be noted that, for the sake of simplicity, the foregoing method embodiments are described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

Claims

1. A ZYNQ on-orbit loading and reconfiguration method for commercial satellites, characterized in that, include: Configuration data boot: Power on the on-orbit application system, which includes a storage unit, a reconfiguration management controller, and a ZYNQ processor; The magnetic random access memory of the storage unit reads and loads the header file and the first-stage loading program, and loads the programmable logic module and processing system module of the ZYNQ processor based on the flash memory of the storage unit. Readback verification: Based on the reconfiguration management controller, the processing system module is monitored online, and single-event upset and single-event function interruption are determined in real time; based on the processing system module, the configuration status register and configuration bit stream of the programmable logic module are monitored and refreshed online through the PCAP channel, and single-event function interruption is determined in real time; Reset and Reconfiguration: Reset is performed when a single-event upset is detected, and reconfiguration is performed when a single-event interrupt is detected. The storage unit includes a magnetic random access memory and multiple flash memories. The magnetic random access memory is electrically connected to the programmable logic module and the processing system module of the ZYNQ processor through the reconfiguration management controller, and stores the bit stream file of the programmable logic module and the program file of the processing system module. The flash memories store the loading header file and the first-stage loading program. The reconfiguration management controller includes a storage controller, a bitstream parser, and an FPGA controller. The bitstream parser is connected to the storage controller and the FPGA controller, respectively. The storage controller is electrically connected to the magnetic random access memory and flash memory of the storage unit. The FPGA controller is electrically connected to the programmable logic module and the processing system module of the ZYNQ processor. The ZYNQ processor includes a programmable logic module and a processing system module. The programmable logic module and the processing system module are connected through an internal high-speed bus to achieve data interaction and communication. The processing system module loads the programmable logic module through the PCAP channel.

2. The ZYNQ on-orbit loading and reconfiguration method for commercial satellites according to claim 1, characterized in that, The programmable logic module includes an FPGA chip, and the processing system module includes an ARM processor, an internal memory module, and an external interface module. The ARM processor is electrically connected to the internal memory module, the external interface module, and the FPGA chip.

3. The ZYNQ on-orbit loading and reconfiguration method for commercial satellites according to claim 1, characterized in that, The reconfiguration management controller can read the bitstream file of the programmable logic module from the flash memory according to the timing requirements of the ZYNQ processor. The processing system module loads the programmable logic module through the PCAP channel. During startup, the programmable logic module is used as a peripheral of the processing system module to complete the initialization configuration. That is, the first-stage loader completes the initialization configuration of the processing system module, and the programmable logic module is loaded and configured through the PCAP channel and the bitstream file of the programmable logic module.

4. The ZYNQ on-orbit loading and reconfiguration method for commercial satellites according to claim 1, characterized in that, The method for determining single-event upset and single-event interruption includes: the reconfiguration management controller selects any two of the flash memories, reads the bit stream information of the stored programmable logic module and compares them. If they match, it means that the reading is correct; otherwise, it means that the reading is incorrect and there is a probability that a single-event upset and / or single-event interruption has occurred.

5. The ZYNQ on-orbit loading and reconfiguration method for commercial satellites according to claim 1, characterized in that, The ZYNQ processor can generate a fixed-period heartbeat signal and a program execution status signal, and send them to the reconfiguration management controller via a UART serial port. The reconfiguration management controller monitors the operating status of the ZYNQ processor. When the reconfiguration management controller does not receive a heartbeat signal from a certain unit or receives an abnormal heartbeat signal, it indicates that the unit is in an abnormal working state and a single unit's SRST soft reset or the entire system's POR hard reset is required. When a program execution error occurs, the refactoring management controller decides whether to perform relevant operations, including reset or program jump operations.

6. The ZYNQ on-orbit loading and reconfiguration method for the commercial satellite field according to any one of claims 1-5, characterized in that, When the processing system module monitors the configuration status register of the programmable logic module through the PCAP channel, the monitoring status can interact with the programmable logic module through the UART interface. The configuration status register includes the FAR register and the STAT register. When the processing system module refreshes the bit stream of the programmable logic module through the PCAP channel, the refresh content includes the configuration data of the CLB, IO, DSP and BRAM interconnects.

7. A ZYNQ on-orbit application system for the commercial satellite sector, used to implement the ZYNQ on-orbit loading and reconfiguration method for the commercial satellite sector as described in claim 1, characterized in that, The device includes a storage unit, a reconfiguration management controller, and a ZYNQ processor. The reconfiguration management controller is electrically connected to the storage unit and the ZYNQ processor. The storage unit includes a magnetic random access memory (MRMemory) and a flash memory. The ZYNQ processor includes a programmable logic module (PLM) and a processing system module. The MRAM is capable of reading and loading header files and a first-stage loader. The flash memory is capable of loading the PLM and processing system module of the ZYNQ processor. The reconfiguration management controller can monitor the processing system module online and determine single-event upsets and single-event interruptions in real time. The processing system module can monitor and refresh the configuration status register and configuration bit stream of the programmable logic module online through the PCAP channel and determine single-event interruptions in real time. When a single-event upset is determined, a reset is performed, and when a single-event interruption is determined, a reconfiguration is performed.

Images