On-line loading method and device for onboard embedded SoC firmware

Abstract

The present invention provides an online loading method and device for satellite-borne embedded SoC firmware, comprising: receiving an SoC program data packet and performing unpacking processing to obtain original program data; writing the original program data into three independent Flashes respectively; reading the original program data in each Flash respectively to obtain first data, second data and third data, and performing verification respectively; when the verification result shows that at least one of the first data, the second data and the third data has damaged data, regenerating the first data, the second data and the third data into write-back data; writing the write-back data into the three independent Flashes respectively, until all the verification results are correct data, loading the correct data into a target SoC, and automatically regenerating and writing back when erroneous data is detected, until the correct data is obtained, and then loading it into the target SoC, thereby ensuring the long-term correctness of the data and the reliability of the satellite function.

Description

Technical Field

[0001] The present invention relates to the field of satellite communication technology, and in particular to an online loading method and device for satellite-borne embedded SoC firmware. Background Art

[0002] With the development of satellite technology, a large number of commercial satellites have been launched and put into use. Compared with traditional satellites, commercial satellites must significantly reduce development costs and improve performance-price ratio due to their commercial attributes. The development of commercial satellites must significantly reduce development costs while adopting effective methods to improve the reliability of satellites, ensure the integrity of satellites in orbit, and extend the service life of satellites in order to achieve good economic and social benefits. At present, most commercial satellites use embedded chips with SoC architecture as the core processing devices of the system.

[0003] However, the programs of chips with SoC architecture are basically stored in various types of Flash. Under the conditions of outer space radiation, once a single particle flip occurs, the program will fail and the SoC device will become disabled, causing partial or even overall function of the satellite to fail. Summary of the invention

[0004] The present invention provides an online loading method and device for satellite-borne embedded SoC firmware, which are used to solve the defect in the prior art that a single particle upset easily causes satellite function failure.

[0005] In a first aspect, the present invention provides an online loading method for onboard embedded SoC firmware, comprising:

[0006] Receive a SoC program data packet, and unpack the program data packet to obtain original program data;

[0007] Writing the original program data into three independent Flash memories respectively;

[0008] Reading the original program data in each piece of the Flash respectively to obtain first data, second data and third data;

[0009] respectively verifying the first data, the second data, and the third data;

[0010] When the verification result shows that at least one of the first data, the second data and the third data has damaged data, regenerating the first data, the second data and the third data into write-back data;

[0011] The write-back data are written into the three independent Flashes respectively, until all the verification results are correct data, and then the correct data are loaded into the target SoC.

[0012] According to an online loading method of onboard embedded SoC firmware provided by the present invention, the regenerating the first data, the second data and the third data into write-back data comprises:

[0013] determining a corruption type of the corrupted data;

[0014] When the damage type is a data bit error caused by a single particle upset, performing error correction recovery on the first data, the second data, and the third data, and re-encoding them to generate write-back data;

[0015] When the damage type is physical damage to the Flash data block and damage to the program data, the write-back data is regenerated through a triple modular redundancy algorithm.

[0016] According to an online loading method of onboard embedded SoC firmware provided by the present invention, the first data, the second data and the third data are error corrected and recovered, and re-encoded to generate write-back data, including:

[0017] Based on a preset formula for three-mode comparison, the first data, the second data and the third data are combined to obtain combined data;

[0018] Error correction and recovery are performed on the merged data, and re-encoding is performed to generate write-back data.

[0019] According to an online loading method of a satellite-borne embedded SoC firmware provided by the present invention, the preset formula for the three-mode comparison is:

[0020] D=AB+BC+CA

[0021] Among them, D represents the merged data, A represents the first data, B represents the second data, and C represents the third data.

[0022] According to an online loading method of onboard embedded SoC firmware provided by the present invention, regenerating write-back data by triple modular redundancy algorithm comprises:

[0023] When the first data is damaged data, comparing the second data and the third data to see whether they are the same, and if they are the same, using the second data or the third data as the write-back data;

[0024] When the first data and the second data are damaged data, the third data is used as write-back data;

[0025] When the first data, the second data and the third data are all damaged data, data are returned.

[0026] According to an online loading method of onboard embedded SoC firmware provided by the present invention, the damaged data includes: the original storage location becomes a bad block, the number of decoding errors is not 0, and the three independent buffers are different when compared bit by bit;

[0027] The verifying the first data, the second data and the third data respectively includes:

[0028] Before performing a read or write operation on any one of the first data, the second data and the third data, a dummy write operation is performed, where the dummy write operation refers to issuing a write command without writing any actual data;

[0029] Reading a response code of the Flash for the virtual write operation;

[0030] If the bad block of the response code is 1, it is determined that the original storage location becomes a bad block.

[0031] According to an online loading method of onboard embedded SoC firmware provided by the present invention, the checking of the first data, the second data and the third data respectively further includes:

[0032] Encoding the first data, the second data and the third data to obtain encoded data including redundant data and original data;

[0033] Storing the encoded data in Flash;

[0034] After reading the encoded data from the Flash, decoding the encoded data to obtain redundant data and original data;

[0035] If the correspondence between the redundant data and the original data is incorrect, it is determined that the number of decoding errors of the first data, the second data and the third data is not zero.

[0036] According to the present invention, an online loading method for onboard embedded SoC firmware also includes:

[0037] determining redundant information of the redundant coding;

[0038] The damaged data is corrected based on the redundant information and the decoding algorithm to restore the integrity of the first data, the second data and the third data.

[0039] According to an online loading method of onboard embedded SoC firmware provided by the present invention, the loading of the correct data into the target SoC comprises:

[0040] Generate the timing signals required by the target SoC port;

[0041] Based on the timing signal, correct data is loaded into the target SoC.

[0042] In a second aspect, the present invention further provides an online loading device for onboard embedded SoC firmware, comprising:

[0043] A receiving module, used for receiving a SoC program data packet, and unpacking the program data packet to obtain original program data;

[0044] A writing module, used for writing the original program data into three independent Flash memories respectively;

[0045] A reading module, used for reading the original program data in each piece of the Flash respectively to obtain the first data, the second data and the third data;

[0046] A verification module, used to verify the first data, the second data and the third data respectively;

[0047] a write-back module, configured to regenerate write-back data from the first data, the second data, and the third data when the verification result indicates that at least one of the first data, the second data, and the third data has damaged data;

[0048] The loading module is used to write the write-back data into the three independent Flashes respectively, until the verification results are all correct data, and then load the correct data into the target SoC.

[0049] In a third aspect, the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an online loading method of a satellite-borne embedded SoC firmware as described above is implemented.

[0050] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the online loading method of the onboard embedded SoC firmware as described in any one of the above.

[0051] In a fifth aspect, the present invention further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the online loading method of the onboard embedded SoC firmware as described in any one of the above.

[0052] The present invention provides an online loading method and device for satellite-borne embedded SoC firmware, comprising: receiving an SoC program data packet, unpacking the program data packet to obtain original program data; writing the original program data into three independent Flashes respectively; reading the original program data in each Flash respectively to obtain first data, second data and third data; verifying the first data, second data and third data respectively; when the verification result shows that at least one of the first data, second data and third data has damaged data, regenerating the first data, second data and third data into write-back data; writing the write-back data into three independent Flashes respectively, until the verification results are all correct data, loading the correct data into a target SoC, because when erroneous data is detected, regeneration and write-back can be automatically performed until all erroneous data are corrected to obtain correct data, and then loading into the target SoC, thereby ensuring the long-term correctness of the data and the reliability of the satellite function. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0054] Figure 1 It is a flow chart of an online loading method of a satellite-borne embedded SoC firmware provided by an embodiment of the present invention;

[0055] Figure 2 yes Figure 1 Schematic diagram of the hardware architecture;

[0056] Figure 3 yes Figure 2 Detailed hardware architecture diagram;

[0057] Figure 4 is a data flow diagram of a loading system provided in this embodiment;

[0058] Figure 5 is a schematic diagram of the process of the self-calibration module provided in this embodiment;

[0059] Figure 6 It is a structural schematic diagram of an online loading device for onboard embedded SoC firmware provided by an embodiment of the present invention;

[0060] Figure 7 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] Combine the following Figure 1-Figure 7 The invention describes an online loading method and device for onboard embedded SoC firmware.

[0063] Figure 1 is a flow chart of an online loading method of a satellite-borne embedded SoC firmware provided by an embodiment of the present invention, Figure 2 yes Figure 1 Schematic diagram of the hardware architecture. Figure 3 yes Figure 2 Detailed hardware architecture diagram.

[0064] like Figure 2 As shown in the figure, the hardware architecture consists of a payload / SoC integrated management unit, three Flashes (NAND Flash0, NAND Flash1, NAND Flash2) and related interfaces.

[0065] The payload / SoC integrated management unit is an FPGA with a certain degree of radiation resistance. It provides hardware support for loading data processing firmware and physical layer support for various data interfaces. The specific selection of the payload / SoC integrated management unit is highly related to the overall reliability requirements of the satellite. In actual applications, all satellite payloads are equipped with an integrated management unit and can be directly borrowed.

[0066] Flash, since the data storage unit and the data loading function module are independent, the choice of Flash has nothing to do with the specific selection of SoC. You can choose NAND Flash, which supports ONFI interface and multiple access modes. The access speed can also be flexibly selected as required. It not only has large capacity but also low price. Choosing a large-capacity Flash can make more suitable choices as needed when designing coding redundancy, and realize more times of program data storage block migration when some storage units of Flash are physically damaged. NAND Flash has a faster programming speed. Because NAND Flash is cheap, choosing multiple Flash chips for data redundant storage will not significantly increase the development cost. To ensure the reliability of stored data, the Flash storing data should use 3 devices of the same model to store the same data.

[0067] Note interface: RS422, easy to use.

[0068] ONFI interface: As a standard interface for NAND Flash, it supports SDR, NV-DDR2, and NV-DDR3 access modes, with an access speed of up to 800MB / s, and can perform high-speed read and write operations on Flash data.

[0069] Program loading / programming interface: It is the physical interface for the integrated management unit to program the SoC, which is highly related to the specific model of the SoC.

[0070] For SoCs with built-in Flash (Cortex-R or Cortex-M), the Jtag port standard is used. The specific pins are TCK, TMS, TDO, and TDI. These signals are defined by IEEE1149.1 and comply with the provisions of IEEE1149.1. For SoCs with external Flash (Cortex-A), the required digital interface is designed according to the selection of its boot mode. For example, for QSPI, the interface signals are CS, SCK, and IO0~IO3. The timing of QSPI is simple and convenient for firmware programming. Whether it is a built-in Jtag interface or an external QSPI interface, the FPGA hardware interface of the integrated management unit must match the electrical interface requirements of the SoC loading interface.

[0071] Figure 3 Yes Figure 2 A schematic diagram of the load / SoC integrated management unit in detail is shown in FIG. Figure 3 As shown, the load / SoC integrated management unit mainly includes a control module, an input receiving module, an encoding module, a storage block management, a writing module, a reading module, a decoding module, a self-calibration module and a loading module. These firmwares run on the integrated management platform to realize the functions of SOC data receiving, storing and loading, and can automatically correct errors when single particle flips of the Flash storage unit are caused by external space radiation and program data errors occur, ensuring that the loaded program data is correct.

[0072] Depend on Figure 3 It can be seen that the functions of program data reception, storage management, etc. are completely unrelated to the type of SoC to be loaded and the loading method. The specific SoC loading method and loading sequence are completed by the loading firmware. This architecture design decouples data reception, data management and loading operations, separating them into two completely independent parts. The data management part is responsible for data reception, encoding, storage management, readback, self-calibration, and providing correct data for the data loading module. The loading module loads the data provided by the data management module into the SoC according to the loading sequence required by the SoC.

[0073] The advantage of functional separation is that the data management process is independent of the data loading process. Data management is independently developed and can be configured with different encoding methods, different redundancy options, and different calibration algorithms according to design requirements and hardware resources. After development, all of these firmware can be packaged into different (software) standard libraries or (firmware) IPs, called by different loading processes, and improve the reliability of the development process. The data loading firmware is closely related to the SOC device being loaded, and different systems may use different SoC devices. The development of the loading process only needs to implement the loading timing specified by the loaded SOC device. The development work is highly focused, the development cycle is short, and the iteration speed of the loading firmware is fast. The same or similar SoC loading firmware can be packaged into a standard library to improve the standardization and reliability of the development process.

[0074] like Figure 1 As shown, in the online loading method of the onboard embedded SoC firmware provided by the embodiment of the present invention, the control module, the upload receiving module, the encoding module, the storage block management, the writing module, the reading module, the decoding module, the self-calibration module and the loading module are separately arranged and independent of each other. The method mainly includes the following steps:

[0075] 101. Receive a SoC program data packet, and unpack the program data packet to obtain original program data.

[0076] In a specific implementation process, Figure 2 and Figure 3 After the hardware structure is built, the data loading process needs to be carried out. First, the SoC program data packet forwarded by the star service computer is received, and then the data packet is unpacked to obtain the original program data (Raw Data), and the original program data is transferred to the program data buffer area to prepare for the next step of data encoding. Among them, the receiving method adopts the RS422 injection method to ensure the integrity and timeliness of data reception.

[0077] 102. Write the original program data into three independent Flash memories respectively.

[0078] After completing the data reception, the original program data packet is encoded through the encoding module, and managed through the storage block to remove bad blocks to ensure that only correct data is written when data is written. The encoding module is a flexible and configurable module. All algorithms (error correction algorithm, interleaving algorithm) in the configuration module can be flexibly configured according to the resources of the integrated management unit and user requirements, or they can be integrated into a series of standard module libraries in advance and directly called when used.

[0079] The encoding module performs redundant error correction encoding on the original program data (Raw Data) through FPGA programming. The choice of encoding mode is determined by the FPGA programming resources and the capacity of Flash. If the resources are abundant, TURBO encoding is preferred, otherwise LDPC encoding or other encoding is selected. If the integrated management system is configured with a large-capacity memory (usually DDR), the entire program data can be cached in the memory, interleaved, and then error correction encoding is performed. The interleaved encoding will increase the success rate of recovering data through encoding after the entire block of stored data is damaged. Different from the usual direct loading of Flash or simple three-mode redundancy, the selection of professional encoding mode will obtain better error correction effect. The encoded program data is stored in the data buffer, waiting to be written to Flash.

[0080] Unlike the simple sequential storage of ordinary Flash, NAND Flash itself has bad block detection and bad block management functions, and these bad blocks should be avoided when writing data. The reason for the formation of bad blocks may be the Flash itself, or it may be a permanent functional failure caused by a single particle upset. If these bad blocks are formed before data is written, there will be no effect on data storage. If these bad blocks are formed after data is written, the data in these bad blocks may be damaged, and the data needs to be read out, restored to correct data through coding error correction, and then rewritten into new data blocks.

[0081] After data encoding and detection, the data is read out from the data buffer and written to the Flash through the ONFI interface. The writing method adopts sequential writing to avoid bad block algorithms. ONFI supports SDR, NV-DDR2, and NV-DDR3. SDR has the slowest speed and consumes the least resources, while NV-DDR3 has the fastest speed and consumes the most resources. The corresponding selection can be made according to user requirements and the resource configuration of the integrated management unit. Regardless of the method selected, the access speed can be close to 50MB / s, which meets the writing requirements under most conditions.

[0082] Therefore, after encoding and detecting the program data packets, they are written into three independent Flashes respectively. That is, the data in each Flash is the same and has no influence on each other, and they all operate independently. When one or two of the three independent Flashes fail, the data can be operated through another Flash, which ensures the normal operation of the data and the normal operation of the satellite and reduces the error rate.

[0083] 103. Read the original program data in each Flash respectively to obtain first data, second data and third data.

[0084] The data written into the Flash has been encoded, so decoding is required when reading data from the Flash through the ONFI interface and writing it into the data buffer. The read module is the reverse process of the write module, and the data access method and resource consumption are the same as those of the write module.

[0085] The decoding module is the reverse process of the encoding module, and its module calling and resource configuration are completely determined by the encoding module. The decoding module decodes the data read by the reading module and converts it into raw program data (RAW Data) and stores it in the data buffer. In actual engineering applications, the resource occupancy evaluation of the encoding and decoding functions is carried out simultaneously, and the encoding and decoding scheme is reasonably selected according to the resource occupancy amount and the resource configuration amount of the integrated control unit.

[0086] 104. Verify the first data, the second data, and the third data respectively.

[0087] The program data (first data, second data and third data) is read out from three independent Flashes through the reading module. After decoding by the decoding module, it is stored in three independent data buffers. The first data, second data and third data are verified respectively through the self-calibration module. Through data error correction, three-mode comparison, etc., the correct program data is regenerated, the data encoding is regenerated, and the re-encoded data is written back to the Flash to complete the self-calibration of the data. Each self-calibration process will correct data errors caused by various reasons including single particle upsets, thereby ensuring the long-term correctness of the program data.

[0088] 105. When the verification result shows that at least one of the first data, the second data, and the third data contains damaged data, the first data, the second data, and the third data are regenerated into write-back data.

[0089] If after verification, it is found that the verification result is that at least one of the first data, the second data and the third data contains damaged data, the write back is started immediately, and the data is re-written into the Flash after passing through the encoding module, storage block management and write module, and then re-read and decoded for verification.

[0090] The process of regenerating the write-back data includes different methods. Different methods are used to regenerate the write-back data for different data error types, such as error correction coding, data reorganization, etc. Regardless of which method is used to regenerate the data, data damage caused by various reasons can be effectively recovered and rewritten to ensure the correctness of the loaded data.

[0091] 106. Write the write-back data to three independent Flashes respectively until all the verification results are correct data, and then load the correct data into the target SoC.

[0092] After completing self-calibration and data regeneration, the write-back data is written to three independent Flash chips respectively. Before writing to the disk, a bad block detection is performed first to ensure that the program data is written in the normal data block, and the code position migration in the bad block is automatically realized. Through coding error correction and three-chip redundant storage, the reliability of data storage can be greatly improved, and the correctness of program code data can be guaranteed throughout the product life cycle. It can also ensure the correctness of the data loaded into the target SoC, ensuring the normal and safe operation of the satellite.

[0093] In addition, the Flash used for the loading function is no longer limited to the devices specified by the SoC, but uses the powerful programming capabilities of the FPGA to generate the loading timing required by the SoC. This greatly improves the flexibility and adaptability of programming. At the same time, multiple methods with the same loading method can be encapsulated into a standard library for calling, effectively improving the efficiency of program loading.

[0094] The loading method provided in this embodiment separates the storage, readback, and processing of program data from the loading interface, and ensures the correct storage of program data through comprehensive data processing such as redundant data encoding, storage, readback, writeback, arbitration, and judgment, and can self-correct errors while ensuring the correctness of the loaded program data. The loading interface and loading timing for different types of SoCs can be completed by FPGA programming. Since when erroneous data is detected, it can automatically regenerate and write back until all erroneous data are corrected to obtain correct data, and then loaded into the target SoC, the long-term correctness of the data is guaranteed, and the reliability of the satellite function is guaranteed.

[0095] Furthermore, based on the above embodiments, the first data, the second data and the third data are regenerated into write-back data in this embodiment, including: determining the damage type of the damaged data; when the damage type is a data bit error caused by a single particle flip, the first data, the second data and the third data are error corrected and recovered, and re-encoded to generate write-back data; when the damage type is physical damage to the Flash data block and damage to the program data, the write-back data is regenerated through a triple-module redundancy algorithm.

[0096] Specifically, there are different types of damaged data, and different types of damage correspond to different recovery methods. Therefore, in order to ensure the accuracy of data recovery and rewriting, the type of damaged data must be determined first. There are two types. The first is a data bit error caused by a single particle flip, which is not physically damaged. The second is physical damage to the Flash data block caused by various reasons, and program data is damaged. For the first type of damaged data, data readback, encoding rewriting, error correction and recovery are mainly used to regenerate it. For the second type of damaged data, it is mainly recovered through the redundant design of three Flash chips and regenerated data. The corresponding data rewrite generation method is used for different types of damaged data, which effectively guarantees the efficiency and accuracy of data regeneration.

[0097] Furthermore, when the damaged data type is a data bit error caused by a single particle flip and is not physically damaged, the first data, the second data, and the third data are error corrected and recovered, and re-encoded to generate write-back data, specifically including: based on a preset formula for three-mode comparison, the first data, the second data, and the third data are merged to obtain merged data; error corrected and recovered the merged data, and re-encoded to generate write-back data.

[0098] Specifically, if it is a type of damage caused by a single particle upset, the location of each damage is random and the damaged area is limited. You only need to read back the data, restore it, re-encode and write it back, and the original erroneous data will be corrected. The erroneous data is corrected in time, and at the same time the error rate of the entire program data is low. The error correction code can correct the erroneous data, and the three-module redundancy calculation of the other two chips can completely restore the program data errors and obtain the correct program code.

[0099] When there are no bad blocks, there are no errors in decoding. Or there are no bad blocks, but there are errors in decoding, but it can be recovered. Or there are bad blocks, but there are errors in decoding, but it can be recovered. First, an output buffer is established, and a three-mode operation of the first data, the second data, and the third data is performed in the output buffer. The data can be merged by comparing the three-mode preset formula to obtain the merged data, such as formula (1):

[0100] D = AB + BC + CA (1)

[0101] Among them, D represents the merged data, A represents the first data, B represents the second data, and C represents the third data.

[0102] Through the redundant calculation of the three modes, the correctness of data recovery is effectively guaranteed, and the good effect of calibration and correction is guaranteed.

[0103] Furthermore, on the basis of the above embodiments, if the damaged data is caused by physical damage to the Flash data block or program data caused by various reasons, the write-back data is regenerated through a triple-module redundancy algorithm, specifically including: when the first data is damaged data, comparing whether the second data and the third data are the same, if they are the same, using the second data or the third data as the write-back data; when the first data and the second data are damaged data, using the third data as the write-back data; when the first data, the second data and the third data are all damaged data, data is transmitted back.

[0104] Specifically, when the Flash data block is physically damaged or the program data is damaged due to various reasons, the size of the damaged data block should be considered. Considering the worst case, the data block is damaged on a large scale and the error correction algorithm can no longer recover the data. At this time, if the other two Flashes are not fatally damaged (can be recovered by the error correction code), the correct program data can be obtained by the triple module redundancy algorithm. If the data in only one data Flash can be recovered, the program data can still be recovered.

[0105] When a Flash is damaged, that is, the first data is damaged, a new output buffer is created, and the second data and the third data are compared in the output buffer. If the second data and the third data are consistent, it means that the second data and the third data are not damaged, and the second data or the third data is used as the write-back data, and re-encoded and written back. When the second data and the third data are inconsistent, it means that the second data or the third data is also damaged, and the data is transmitted back.

[0106] When two Flash blocks are damaged, that is, the first data and the second data are damaged data, a new output buffer is created, and the third data is used as write-back data in the output buffer to re-encode and write-back, and data is transmitted back at the same time.

[0107] When all three Flashes are damaged, that is, when the first data, the second data, and the third data are all damaged, the data are directly returned.

[0108] It should be pointed out that the first data, the second data and the third data are data corresponding to the same Flash, and therefore do not constitute any limiting effect, and the first, second and third are only for clarity.

[0109] Further, based on the above embodiment, the first data, the second data and the third data are verified respectively in this embodiment, including: respectively verifying from three independent data buffers, and when at least one of the following three conditions occurs to any data, it indicates that data is damaged and data needs to be written back. The damage conditions or damaged data include: the original storage location becomes a bad block, the number of decoding errors is not 0, and the three independent buffers are different when compared bit by bit.

[0110] Among them, the first data, the second data and the third data are verified respectively, including performing a virtual write operation before performing a read or write operation on any Flash data among the first data, the second data and the third data, the virtual write operation refers to issuing a write command without writing any actual data; reading the response code of the Flash for the virtual write operation; if the bad block of the response code is 1, it is determined that the original storage location has become a bad block.

[0111] Specifically, before performing a read / write operation on a Flash data block among the first data, the second data and the third data, a "virtual" write operation is performed on this data block, that is, only a write command is issued without writing any actual data, and then the response code of the Flash to this virtual write operation is read out. If the bad block bit of the response code is 1, it means that this data block is a bad block, and the data in this data block may have been damaged. It needs to be read out and written to other data blocks after correction and calibration.

[0112] The first data, the second data and the third data are checked respectively, and further include: encoding the first data, the second data and the third data to obtain encoded data including redundant data and original data; storing the encoded data in Flash; after reading the encoded data from Flash, decoding the encoded data to obtain redundant data and original data; if the corresponding relationship between the redundant data and the original data is incorrect, determining that the number of decoding errors of the first data, the second data and the third data is not 0. Determining redundant information of redundant coding; correcting the damaged data based on the redundant information and the decoding algorithm to restore the integrity of the first data, the second data and the third data.

[0113] Before writing the original data into the Flash, it must first be encoded in some type. These codes are error correction redundant codes. The original data is encoded to obtain the encoded data. In addition to the original data, the encoded data also contains some redundant data. There is a certain correspondence between these redundant data and the original data. The storage system stores the original data and redundant data together in the Flash. After reading the data (original data and redundant data) from the Flash, it performs a decoding operation to obtain the original data. During the decoding process, the correspondence between the redundant data and the original data is confirmed. If the data block is intact, the correspondence between the redundant data and the original data during the decoding process is correct. If the data block is damaged, the correspondence is incorrect. Due to the use of redundant coding, the decoding algorithm can correct the damaged data through redundant information. The probability of correction is related to the specific encoding method.

[0114] Further, based on the above embodiment, loading correct data into the target SoC in this embodiment includes: generating a timing signal required by a port of the target SoC; and loading the correct data into the target SoC based on the timing signal.

[0115] Specifically, the loading process is implemented through the loading module, which is independent of the data processing and self-calibration modules, that is, the data loaded by the loading module always remains correct. The loading module generates the timing signal required by the SoC loading port, and the correct data after calibration is loaded into the SoC. The loading module is essentially a waveform generator that simulates the waveform required for SoC loading.

[0116] The loading types include:

[0117] QSPI Flash: There are 6 signals in total, which are used to load Arm or Xilinx Zynq, Zynqultrascal, Zynq Ultrascale Plus series FPGAs with Cortex-A architecture. The communication protocol generally only needs to meet some specific models.

[0118] JTAG: There are 4 signal lines in total, which are used for Cortex-M or Cortex-R program loading. The physical layer protocol adopts IEEE1149.1. The specific boundary scan and register reading and writing are private protocols.

[0119] SELECT MAP: used for loading Xilinx FPGA. For loading timing, please refer to the technical reference manual on the specific FPGA.

[0120] By loading the module, the Flash used by the loading function is no longer limited to the devices specified by the SoC. Instead, the powerful programming capability of FPGA is used to generate the loading timing required by the SoC, greatly improving the flexibility and adaptability of programming.

[0121] Figure 4 This is a data flow diagram of the loading system provided in this embodiment.

[0122] like Figure 4 As shown, the data loading flow of the present invention is to first receive the original program data through the data receiving module, unpack it and put it into the data buffer, then interleave and encode the data through the encoding module, put it into the encoded data buffer, and then query the bad block and manage the storage block through the storage management module, and then write the data into three identical and independent Flash through the Flash writing module. Read the data from the three Flashes, and then decode them through the decoding module respectively, put the decoded data into the decoding buffer, and output the decoding error. Then input the decoded data into the self-calibration module for calibration. When there is damaged data, the data is calibrated through the calibration operation, and then input into the loading data buffer. In the loading data buffer, if the book data is damaged data, write back the data, re-enter the encoding module, and re-encode and write back until all the data in the loading data buffer are correct data, then load the correct data into the target SoC through the loading module, and the loaded interface includes JTAG, QSPI and SELBCT MAP. The control module completes the control of the entire loading process. Since the data loaded is always correct, the reliability of satellite operation is guaranteed. At the same time, when data corruption occurs, automatic data recovery can be performed through the self-calibration module, which also ensures the timeliness of data processing.

[0123] Figure 5 It is a schematic diagram of the flow of the self-calibration module provided in this embodiment.

[0124] like Figure 5 As shown, the self-calibration process is described again in conjunction with the attached drawings. First, the first data is program data A, the second data is program data B, and the third data is program data C. After decoding and deinterleaving program data A, program data B, and program data C respectively, data output and status output are performed to obtain corresponding A, B, and C. The status output directly enters the storage status comprehensive judgment module to determine whether the data is damaged, and then the output data is analyzed and processed. While decoding the data, bad block detection is also performed, and the detection results are also input into the storage status comprehensive judgment module.

[0125] After all the data and test results enter the data integration module, the corresponding write-back operation is performed for different types of damaged data. When there are no bad blocks and no decoding errors, a new output buffer is created, and three-module operations are performed on the three groups of data A, B, and C in the data buffer to obtain the write-back data. The calculation method is as shown in formula (1). At this time, since the data is in an undamaged state, there is no need to write back and it can be directly loaded.

[0126] When there are no bad blocks but there are decoding errors, or when there are bad blocks and there are decoding errors, data recovery can be performed. In this case, a new output buffer is created and three-modulus operations are performed on the three groups of data A, B and C in the output buffer to obtain the write-back data. The calculation method is as shown in formula (1). Then the write-back data is written back and the output buffer is re-encoded and written.

[0127] When a Flash has a bad block, assuming that the C chip is damaged, a new output buffer is created, and data A and B are compared in the output buffer. If A≠B, data is transmitted back, and if A=B, A is used as the write-back data, and data is written back and re-encoded after being output to the buffer.

[0128] When there are bad blocks in two Flashes, assuming that B and C are damaged, a new output buffer is created, and A data is used as write-back data in the output buffer. After the data is transmitted back, it is written back and output to the buffer, and then re-encoded and written.

[0129] When three Flash blocks are bad, data can be directly returned.

[0130] Through self-calibration in different ways, data verification is automatically completed without data transmission, ensuring that the loaded data is always correct. The stored program data is read back, and data damaged for various reasons is restored through redundant encoding and decoding, and the data is written back to Flash. During the write-back process, bad block detection is performed and bad blocks are automatically skipped to ensure data correctness.

[0131] The present invention is very simple to use and can be easily embedded in the integrated management system of satellite-borne equipment, and is a part of the firmware of the telemetry and remote control functional units of the satellite-borne equipment. It is only necessary to properly configure the resources required by the present invention (such as Flash, DDR, etc.) in the integrated management system of the satellite-borne equipment. By dynamically loading the SoC in the satellite-borne load, it has a good recovery effect on the single particle flip caused by radiation, thereby improving the reliability of the satellite-borne load. This is of great significance for reducing the cost of commercial satellites and improving satellite reliability.

[0132] Based on the same general inventive concept, the present invention also protects an online loading device for satellite-borne embedded SoC firmware. The online loading device for satellite-borne embedded SoC firmware provided by the present invention is described below. The online loading device for satellite-borne embedded SoC firmware described below and the online loading method for satellite-borne embedded SoC firmware described above can be referenced to each other.

[0133] Figure 6 It is a structural schematic diagram of an online loading device for onboard embedded SoC firmware provided by an embodiment of the present invention.

[0134] like Figure 6 As shown, this embodiment provides an online loading device for onboard embedded SoC firmware, including:

[0135] The receiving module 601 is used to receive a SoC program data packet, and unpack the program data packet to obtain original program data;

[0136] A writing module 602 is used to write the original program data into three independent Flash memories respectively;

[0137] A reading module 603 is used to read the original program data in each piece of the Flash respectively to obtain the first data, the second data and the third data;

[0138] A verification module 604, configured to verify the first data, the second data, and the third data respectively;

[0139] A write-back module 605, configured to regenerate write-back data from the first data, the second data, and the third data when the verification result indicates that at least one of the first data, the second data, and the third data has damaged data;

[0140] The loading module 606 is used to write the write-back data into the three independent Flashes respectively, until the verification results are all correct data, and then load the correct data into the target SoC.

[0141] Furthermore, the write-back module 605 in this embodiment is specifically used for:

[0142] determining a corruption type of the corrupted data;

[0143] When the damage type is a data bit error caused by a single particle upset, performing error correction recovery on the first data, the second data, and the third data, and re-encoding them to generate write-back data;

[0144] When the damage type is physical damage to the Flash data block and damage to the program data, the write-back data is regenerated through a triple modular redundancy algorithm.

[0145] Furthermore, the write-back module 605 in this embodiment is specifically used for:

[0146] Based on a preset formula for three-mode comparison, the first data, the second data and the third data are combined to obtain combined data;

[0147] Error correction and recovery are performed on the merged data, and re-encoding is performed to generate write-back data.

[0148] Furthermore, the preset formula for the three-mode comparison in this embodiment is:

[0149] D=AB+BC+CA

[0150] Among them, D represents the merged data, A represents the first data, B represents the second data, and C represents the third data.

[0151] Furthermore, the write-back module 605 in this embodiment is specifically used for:

[0152] When the first data is damaged data, comparing the second data and the third data to see whether they are the same, and if they are the same, using the second data or the third data as the write-back data;

[0153] When the first data and the second data are damaged data, the third data is used as write-back data;

[0154] When the first data, the second data and the third data are all damaged data, data are returned.

[0155] Furthermore, the damaged data in this embodiment includes: the original storage location becomes a bad block, the number of decoding errors is not 0, and the three independent buffers are different when compared bit by bit;

[0156] The verification module 604 is specifically used for:

[0157] Before performing a read or write operation on any one of the first data, the second data and the third data, a dummy write operation is performed, where the dummy write operation refers to issuing a write command without writing any actual data;

[0158] Reading a response code of the Flash for the virtual write operation;

[0159] If the bad block of the response code is 1, it is determined that the original storage location becomes a bad block.

[0160] Furthermore, the verification module 604 in this embodiment is specifically used for:

[0161] Encoding the first data, the second data and the third data to obtain encoded data including redundant data and original data;

[0162] Storing the encoded data in Flash;

[0163] After reading the encoded data from the Flash, decoding the encoded data to obtain redundant data and original data;

[0164] If the correspondence between the redundant data and the original data is incorrect, it is determined that the number of decoding errors of the first data, the second data and the third data is not zero.

[0165] Furthermore, the verification module 604 in this embodiment is specifically used for:

[0166] determining redundant information of the redundant encoding;

[0167] The damaged data is corrected based on the redundant information and the decoding algorithm to restore the integrity of the first data, the second data and the third data.

[0168] Furthermore, the loading module 606 in this embodiment is specifically used for:

[0169] Generate the timing signals required by the target SoC port;

[0170] Based on the timing signal, correct data is loaded into the target SoC.

[0171] Figure 7 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present invention.

[0172] like Figure 7As shown, the electronic device may include: a processor 710, a communication interface 720, a memory 730 and a communication bus 740, wherein the processor 710, the communication interface 720 and the memory 730 communicate with each other through the communication bus 740. The processor 710 may call the logic instructions in the memory 730 to execute the online loading method of the onboard embedded SoC firmware, the method comprising: receiving a SoC program data packet, unpacking the program data packet to obtain the original program data; writing the original program data into three independent Flashes respectively; reading the original program data in each Flash respectively to obtain the first data, the second data and the third data; verifying the first data, the second data and the third data respectively; when the verification result is that at least one of the first data, the second data and the third data has damaged data, regenerating the first data, the second data and the third data into write-back data; writing the write-back data into the three independent Flashes respectively until the verification results are all correct data, loading the correct data into the target SoC.

[0173] In addition, the logic instructions in the above-mentioned memory 730 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0174] On the other hand, the present invention also provides a computer program product, which includes a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the online loading method of the on-board embedded SoC firmware provided by the above methods, and the method includes: receiving a SoC program data packet, unpacking the program data packet to obtain original program data; writing the original program data into three independent Flashes respectively; reading the original program data in each Flash respectively to obtain first data, second data and third data; verifying the first data, the second data and the third data respectively; when the verification result is that at least one of the first data, the second data and the third data is damaged data, regenerating the first data, the second data and the third data into write-back data; writing the write-back data into the three independent Flashes respectively until the verification results are all correct data, and then loading the correct data into the target SoC.

[0175] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, it is implemented to execute the online loading method of the on-board embedded SoC firmware provided by the above-mentioned methods, the method comprising: receiving a SoC program data packet, unpacking the program data packet to obtain original program data; writing the original program data into three independent Flashes respectively; reading the original program data in each Flash respectively to obtain first data, second data and third data; verifying the first data, the second data and the third data respectively; when the verification result is that at least one of the first data, the second data and the third data is damaged data, regenerating the first data, the second data and the third data into write-back data; writing the write-back data into the three independent Flashes respectively until the verification results are all correct data, and then loading the correct data into the target SoC.

[0176] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0177] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0178] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for online loading of onboard embedded SoC firmware, characterized in that: include: Receive a SoC program data packet, and unpack the program data packet to obtain original program data; Writing the original program data into three independent Flash memories respectively; Reading the original program data in each piece of the Flash respectively to obtain first data, second data and third data; respectively verifying the first data, the second data, and the third data; When the verification result shows that at least one of the first data, the second data and the third data has damaged data, regenerating the first data, the second data and the third data into write-back data; The regenerating the first data, the second data and the third data into write-back data comprises: determining the damage type of the damaged data; when the damage type is a data bit error caused by a single particle upset, performing error correction recovery on the first data, the second data and the third data, and re-encoding to generate write-back data; when the damage type is physical damage to the Flash data block and damage to the program data, regenerating the write-back data by using a triple module redundancy algorithm; The write-back data are written into the three independent Flashes respectively, until all the verification results are correct data, and then the correct data are loaded into the target SoC.

2. The online loading method of onboard embedded SoC firmware according to claim 1, characterized in that: The performing error correction recovery on the first data, the second data, and the third data, and re-encoding to generate write-back data, includes: Based on a preset formula for three-mode comparison, the first data, the second data and the third data are combined to obtain combined data; Error correction and recovery are performed on the merged data, and re-encoding is performed to generate write-back data.

3. The online loading method of onboard embedded SoC firmware according to claim 2, characterized in that: The preset formula for the three-mode comparison is: D=AB+BC+CA Among them, D represents the merged data, A represents the first data, B represents the second data, and C represents the third data.

4. The online loading method of onboard embedded SoC firmware according to claim 1, characterized in that: The regenerating the write-back data by the triple-module redundancy algorithm includes: When the first data is damaged data, comparing the second data and the third data to see whether they are the same, and if they are the same, using the second data or the third data as the write-back data; When the first data and the second data are damaged data, the third data is used as write-back data; When the first data, the second data and the third data are all damaged data, data are returned.

5. The method for online loading of onboard embedded SoC firmware according to claim 1, characterized in that: The damaged data includes: the original storage location becomes a bad block, the number of decoded bit errors is not 0, and the three independent buffers are different when compared bit by bit; The verifying the first data, the second data and the third data respectively includes: Before performing a read or write operation on any one of the first data, the second data and the third data, a dummy write operation is performed, where the dummy write operation refers to issuing a write command without writing any actual data; Reading a response code of the Flash for the virtual write operation; If the bad block of the response code is 1, it is determined that the original storage location becomes a bad block.

6. The method for online loading of onboard embedded SoC firmware according to claim 5, characterized in that: The verifying the first data, the second data and the third data respectively further includes: Encoding the first data, the second data and the third data to obtain encoded data including redundant data and original data; Storing the encoded data in Flash; After reading the encoded data from the Flash, decoding the encoded data to obtain redundant data and original data; If the correspondence between the redundant data and the original data is incorrect, it is determined that the number of decoding errors of the first data, the second data and the third data is not zero.

7. The method for online loading of onboard embedded SoC firmware according to claim 6, characterized in that: Also includes: determining redundant information of the redundant coding; The damaged data is corrected based on the redundant information and the decoding algorithm to restore the integrity of the first data, the second data and the third data.

8. The method for online loading of onboard embedded SoC firmware according to any one of claims 1 to 7, characterized in that: The loading of the correct data into the target SoC includes: Generate the timing signals required by the target SoC port; Based on the timing signal, correct data is loaded into the target SoC.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the online loading method of the on-board embedded SoC firmware as described in any one of claims 1 to 8 is implemented.

Images