Satellite-borne SiP-based dual-core processor anti-single event upset protection method

Abstract

The invention belongs to the technical field of radiation hardening of processors, and particularly relates to a dual-core processor anti-single event upset protection method based on a satellite-borne SiP. According to the method, redundant resources of a dual-core processor are utilized, and error detection and recovery are achieved through the steps of initialization synchronization, program execution synchronization detection, check point updating, interrupt processing, error processing, rollback recovery and the like. The method specifically comprises the steps that two cores execute the same program in the same state, and check points are set every N times of operation; a signature is calculated synchronously when a memory command is written and exchanged through a message queue; independently judging the signature consistency, and if not, carrying out error processing; updating the state and the check point file when the check point is reached; and when an error occurs, system recovery is carried out through a multi-stage rollback recovery mechanism. According to the method, the reliability of the satellite-borne SiP microsystem in the space radiation environment is improved.

Description

Technical Field

[0001] The invention belongs to the technical field of processor radiation hardening, and in particular relates to a dual-core processor anti-single event upset protection method based on satellite-borne SiP. Background Art

[0002] Commercial Off-The-Shelf (COTS) products with high performance, low cost and short development cycle are increasingly widely used in satellites. Among them, SiP microsystems integrate complete functional electronic systems or subsystems through high-density interconnection of bare chips, greatly enhancing the flexibility and integration of the system, reducing costs and development cycles, and becoming an important direction for the development of future aerospace electronic systems with its higher flexibility, comprehensive integration density and cost-effectiveness.

[0003] SiP microsystems based on COTS devices, on the one hand, are highly integrated due to the miniaturization of system circuits, making them increasingly sensitive to various interferences in the radiation environment; on the other hand, the COTS devices integrated inside them have low radiation resistance and are extremely susceptible to single-particle upsets in the space environment, resulting in transient soft errors, leading to serious consequences such as erroneous calculation results, program error jumps, and even system crashes.

[0004] The design of the onboard system must not only meet the basic performance and functional requirements, but also take into account the high reliability requirements. Most of the existing onboard system designs use single-core processor systems. When result comparison or arbitration is required, they rely on the calculation and judgment capabilities of a single processor. Once this processor has errors such as single particle flips, it will lead to incorrect arbitration results, affecting the correctness and reliability of the entire system. The dual-core processor system has improved reliability to a certain extent, but the existing dual-core processor system still has the following shortcomings:

[0005] First, in order to achieve error detection and recovery, most of them need to add additional hardware resources, such as arbitrators, additional storage devices, etc., which not only increases the complexity and cost of the system, but also may lead to an increase in the size and weight of the system, which is not conducive to the application of spaceborne systems. Second, the error detection and recovery of dual-core processors often rely on the underlying hardware drivers and complex arbitration logic, which leads to complex software programming, poor portability of application programs, and inconvenience in migration and application between different systems. Third, the error detection of dual-core processors is often not timely and accurate enough, especially in terms of data flow and control flow errors. It is difficult to detect and isolate the erroneous data before writing it to the memory, which may lead to error diffusion and system crash. Fourth, when recovering after detecting an error, there are problems such as long recovery time and large performance loss. Fifth, the space radiation environment is prone to cause soft errors such as single-particle upsets in the system. Space-grade devices with strong single-particle resistance are expensive and difficult to purchase. Products that use low-cost devices but do not adopt effective protection and recovery mechanisms have poor single-particle resistance and insufficient system reliability on orbit. Summary of the invention

[0006] In order to solve the problems existing in the background technology, the present invention provides a dual-core processor anti-single particle flip protection method based on onboard SiP, which includes initialization and synchronization processing process, program execution and synchronization detection process, checkpoint update and interrupt processing process and error processing and rollback recovery processing process.

[0007] The specific steps of the initialization and synchronization process include:

[0008] Step 1: The two cores CPU0 and CPU1 of the onboard SiP processor execute the same application in the same state; a checkpoint is set synchronously every N runs; the N value is set based on the balance between performance and error detection requirements.

[0009] The program execution and synchronization detection process includes:

[0010] Step 2: Write memory command synchronization and signature calculation. When the program runs to the write memory command, CPU0 and CPU1 synchronize, calculate the signature of the write command, and exchange data through the independent message queue of the operating system;

[0011] Step 3: CPU0 and CPU1 independently determine whether the signatures of the two processors are consistent. If they are consistent, they continue; if they are inconsistent, they enter the error handling process.

[0012] The checkpoint update and interrupt handling process includes:

[0013] Step 4: Status update and write command execution. If the signatures are consistent, the status variables and checkpoint file data are updated and the write command is executed.

[0014] Step 5: Checkpoint judgment: judge whether the program has reached the checkpoint according to the write command count. If it has reached the checkpoint, proceed to the next step; otherwise, return to step 2 to continue execution;

[0015] Step 6: Calculate the signature of checkpoint file A and exchange it;

[0016] Step 7: CPU0 and CPU1 independently determine whether the signatures of the two processors are inconsistent. If the result is no, go to step 8;

[0017] Step 8, CPU0 and CPU1 send checkpoint interrupt requests to themselves and each other, and execute step 9;

[0018] Step 9, CPU0 and CPU1 receive the interrupt request, avoid repeated interrupt execution through semaphore, and go to step 10;

[0019] Step 10, CPU0, CPU1 state variables are initialized, watchdog count is cleared, each overwrites the data of checkpoint file A to checkpoint file B, clears checkpoint file A, records register group, stack data to checkpoint file A, exits interrupt, and executes step 2.

[0020] The error handling and rollback recovery process specifically includes:

[0021] Step 11, CPU0 and CPU1 send a rewind interrupt request to themselves and each other, and then execute step 12;

[0022] Step 12, CPU0 and CPU1 receive the interrupt request, avoid repeated interrupt execution through the semaphore, and increase the rollback count by 1, and enter step 13;

[0023] Step 13, determine whether the continuous rewind count value is 1, if yes, go to step 16, if no, go to step 14;

[0024] Step 14, CPU0 and CPU1 determine whether the continuous rewind count value is 2. If yes, execute step 17; if no, execute step 15;

[0025] Step 15, CPU0 and CPU1 determine whether the continuous rewind count value is 3. If yes, execute step 18; if no, execute step 19;

[0026] Step 16, CPU0 and CPU1 re-execute the write memory command and go to step 2;

[0027] Step 17, CPU0 and CPU1 use their respective checkpoint files A to perform backward recovery, restore the register group, stack data and part of the memory data, and the system rolls back to the most recent checkpoint m, and executes step 6;

[0028] Step 18, CPU0 and CPU1 use their respective checkpoint files A and B to perform backward recovery, restore the register group, stack data and part of the memory data, and the system rolls back to the m-1th checkpoint, and executes step 6;

[0029] Step 19, wait for the watchdog counter to time out, reset the system, re-execute the application program, and go to step 1.

[0030] In addition, in step 3, CPU0 and CPU1 independently determine whether the signatures of the two processors are consistent. If the result is yes, step 4 is executed.

[0031] If the answer is no, go to step 11.

[0032] In step 6, CPU0 and CPU1 calculate the signatures of their respective checkpoint file A, exchange the signatures through the message queue, and execute step 7; if the message queue wait times out, execute step 11.

[0033] In step 7, CPU0 and CPU1 independently determine whether the signatures of the two processors are inconsistent. If the result is yes, step 11 is executed.

[0034] The beneficial effects achieved by the present invention are:

[0035] First, the present invention utilizes the redundant resources of the dual-core processors in the SiP microsystem, combines the dual-core mutual check based on the lockstep technology, and the checkpoint and rollback recovery technology, to achieve error detection and recovery between the dual-core processors. Compared with the external arbitration method, no additional hardware resources are required, and the reliability is higher than that of the single-core arbitration.

[0036] Second, the present invention realizes dual-core comparison based on the operating system by combining inter-core interrupts with the message queue of the operating system. While improving the system's ability to resist single particles, the application program does not need to pay attention to the underlying hardware driver, has good portability, and greatly improves the convenience of software programming and application;

[0037] Third, the present invention uses a dual-core mutual inspection method based on lockstep technology, so that the processor can detect the calculation result errors caused by data flow errors in the system, as well as the error jumps and program runaway problems caused by control flow errors. CPU0 and CPU1 are synchronized based on the write memory command, so that the error data is 100% detected before writing to the memory, and the error area isolation is realized;

[0038] Fourth, the present invention uses double checkpoint backup and multi-level rollback recovery technology, so that the processor can perform backward recovery when an error is detected, and select different rollback methods to correct the error according to the number of consecutive rollbacks, thereby improving the soft error detection and recovery capabilities and reducing the calculation loss of repeated program execution. In the absence of faults, the performance loss is about 18% to 20%, which is negligible for the use of high-performance processors for onboard data management and control, and can meet the application requirements of most scenarios. It can also achieve 100% single-particle fault detection and greatly shorten the fault handling time. The additional performance loss of the first-level rollback is less than 1%;

[0039] Fifth, the present invention improves the ability of the dual-core processor to cope with soft errors through software fault-tolerant design, so that the SiP microsystem with an internally integrated dual-core processor has the ability to detect soft errors and recover autonomously, thereby improving the reliability of the device when used in space missions. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 The present invention is a flow chart of a dual-core processor anti-single event upset protection method based on onboard SiP. DETAILED DESCRIPTION

[0041] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the present invention. In addition, the forms of the various structures recorded in the following embodiments are merely illustrative, and the present invention is not limited to the various structures recorded in the following embodiments. All other embodiments obtained by ordinary technicians in this field without making creative work belong to the scope of protection of the present invention.

[0042] Reference Figure 1 The present invention discloses a dual-core processor anti-single particle upset protection method based on onboard SiP, which includes an initialization and synchronization processing process, a program execution and synchronization detection process, a checkpoint update and interrupt processing process, and an error processing and rollback recovery processing process.

[0043] The specific steps of the initialization and synchronization process include:

[0044] Step 1: The two cores CPU0 and CPU1 of the onboard SiP processor execute the same application in the same state; a checkpoint is set synchronously every N runs; the N value is set based on the balance between performance and error detection requirements.

[0045] The program execution and synchronization detection process includes:

[0046] Step 2: Write memory command synchronization and signature calculation. When the program runs to the write memory command, CPU0 and CPU1 synchronize, calculate the signature of the write command, and exchange data through the independent message queue of the operating system;

[0047] Step 3: CPU0 and CPU1 independently determine whether the signatures of the two processors are consistent. If they are consistent, they continue; if they are inconsistent, they enter the error handling process.

[0048] The checkpoint update and interrupt handling process includes:

[0049] Step 4: Status update and write command execution. If the signatures are consistent, the status variables and checkpoint file data are updated and the write command is executed.

[0050] Step 5: Checkpoint judgment: judge whether the program has reached the checkpoint according to the write command count. If it has reached the checkpoint, proceed to the next step; otherwise, return to step 2 to continue execution;

[0051] Step 6: Calculate the signature of checkpoint file A and exchange it;

[0052] Step 7: CPU0 and CPU1 independently determine whether the signatures of the two processors are inconsistent. If the result is no, go to step 8;

[0053] Step 8, CPU0 and CPU1 send checkpoint interrupt requests to themselves and each other, and execute step 9;

[0054] Step 9, CPU0 and CPU1 receive the interrupt request, avoid repeated interrupt execution through semaphore, and go to step 10;

[0055] Step 10, CPU0, CPU1 state variables are initialized, watchdog count is cleared, each overwrites the data of checkpoint file A to checkpoint file B, clears checkpoint file A, records register group, stack data to checkpoint file A, exits interrupt, and executes step 2.

[0056] The error handling and rollback recovery process specifically includes:

[0057] Step 11, CPU0 and CPU1 send a rewind interrupt request to themselves and each other, and then execute step 12;

[0058] Step 12, CPU0 and CPU1 receive the interrupt request, avoid repeated interrupt execution through the semaphore, and increase the rollback count by 1, and enter step 13;

[0059] Step 13, determine whether the continuous rewind count value is 1, if yes, go to step 16, if no, go to step 14;

[0060] Step 14, CPU0 and CPU1 determine whether the continuous rewind count value is 2. If yes, execute step 17; if no, execute step 15;

[0061] Step 15, CPU0 and CPU1 determine whether the continuous rewind count value is 3. If yes, execute step 18; if no, execute step 19;

[0062] Step 16, CPU0 and CPU1 re-execute the write memory command and go to step 2;

[0063] Step 17, CPU0 and CPU1 use their respective checkpoint files A to perform backward recovery, restore the register group, stack data and part of the memory data, and the system rolls back to the most recent checkpoint m, and executes step 6;

[0064] Step 18, CPU0 and CPU1 use their respective checkpoint files A and B to perform backward recovery, restore the register group, stack data and part of the memory data, and the system rolls back to the m-1th checkpoint, and executes step 6;

[0065] Step 19, wait for the watchdog counter to time out, reset the system, re-execute the application program, and go to step 1.

[0066] In addition, in step 3, CPU0 and CPU1 independently determine whether the signatures of the two processors are consistent. If the result is yes, step 4 is executed.

[0067] If the answer is no, go to step 11.

[0068] In step 6, CPU0 and CPU1 calculate the signatures of their respective checkpoint file A, exchange the signatures through the message queue, and execute step 7; if the message queue wait times out, execute step 11.

[0069] In step 7, CPU0 and CPU1 independently determine whether the signatures of the two processors are inconsistent. If the result is yes, step 11 is executed.

[0070] Example 1, in order to better understand the technical solution of the present invention, this embodiment is based on the onboard SiP containing the processor as the application object, the operating system is the high-reliability embedded operating system Vxworks, the dual-core operation mode is AMP mode, combined with the attached Figure 1 The present invention is described in further detail.

[0071] The specific implementation steps are as follows:

[0072] Step 1: The two cores CPU0 and CPU1 of the onboard SiP processor execute the same application in the same state, and the processors synchronously set a checkpoint every N runs. N can be set as needed. The smaller N is, the more frequent the checkpoint setting is, and the greater the performance impact is when there is no single particle on board. The larger N is, the sparser the checkpoint setting is, and the smaller the performance impact is when there is no single particle on board. However, too large a value will result in a long system recovery time when there is a single particle on board.

[0073] Step 2: When the program runs to the memory write command, CPU0 and CPU1 synchronize and calculate the signature of the write command by performing data AND or XOR on the write command, and exchange data through two independent message queues of the operating system. Taking CPU0 as an example, send the signature to CPU1 through message queue A, start timing, wait for the signature from CPU1 in message queue B, and execute step 3. If the message queue wait times out, execute step 11;

[0074] Step 3, CPU0 and CPU1 independently determine whether the signatures of the two processors are consistent. If the result is yes, go to step 4; if the result is no, go to step 11;

[0075] Step 4: CPU0 and CPU1 update the state variables and checkpoint file data, execute the write command, and proceed to step 5.

[0076] Step 5, CPU0 and CPU1 respectively determine whether the program has been executed to the checkpoint according to the write command count. If the result is yes, execute step 6; if the result is no, execute step 2;

[0077] Step 6: CPU0 and CPU1 calculate the signatures of their respective checkpoint file A, exchange the signatures through the message queue, and execute step 7. If the message queue wait times out, execute step 11;

[0078] Step 7, CPU0 and CPU1 independently determine whether the signatures of the two processors are inconsistent. If the result is no, go to step 8. If the result is yes, go to step 11.

[0079] Step 8, CPU0 and CPU1 send checkpoint interrupt requests to themselves and each other, and execute step 9;

[0080] Step 9, CPU0 and CPU1 receive the interrupt request, avoid repeated interrupt execution through semaphore, and go to step 10;

[0081] Step 10, CPU0 and CPU1 state variables are initialized, the watchdog count is cleared, the data of checkpoint file A is overwritten to checkpoint file B, checkpoint file A is cleared, register group and stack data are recorded to checkpoint file A, the interrupt is exited, and step 2 is executed;

[0082] Step 11, CPU0 and CPU1 send a rewind interrupt request to themselves and each other, and then execute step 12;

[0083] Step 12, CPU0 and CPU1 receive the interrupt request, avoid repeated interrupt execution through the semaphore, and increase the rollback count by 1, and enter step 13;

[0084] Step 13, determine whether the continuous rewind count value is 1, if yes, go to step 16, if no, go to step 14;

[0085] Step 14, CPU0 and CPU1 determine whether the continuous rewind count value is 2. If yes, execute step 17; if no, execute step 15;

[0086] Step 15, CPU0 and CPU1 determine whether the continuous rewind count value is 3. If yes, execute step 18; if no, execute step 19;

[0087] Step 16, CPU0 and CPU1 re-execute the write memory command and go to step 2;

[0088] Step 17, CPU0 and CPU1 use their respective checkpoint files A to perform backward recovery, restore the register group, stack data and part of the memory data, and the system rolls back to the most recent checkpoint m, and executes step 6;

[0089] Step 18, CPU0 and CPU1 use their respective checkpoint files A and B to perform backward recovery, restore the register group, stack data and part of the memory data, and the system rolls back to the m-1th checkpoint, and executes step 6;

[0090] Step 19, wait for the watchdog counter to time out, reset the system, re-execute the application program, and go to step 1.

[0091] The dual-core processor anti-single particle flip protection method based on the satellite SiP described in this embodiment includes dual-core mutual checking technology, checkpoint and rollback recovery technology. First, the dual-core processor works in the asymmetric multi-processing (AMP) mode, and the two CPUs execute the same application program at the same time, and synchronize at the write memory command. A checkpoint is set every N synchronizations (the checkpoint interval N is configurable), and then soft error detection is implemented through the dual-core mutual checking method, and finally error correction is implemented through the rollback recovery technology. In the present invention, a dual checkpoint backup and multi-level rollback recovery mechanism are designed, and the soft error detection and recovery capabilities of the SiP microsystem are improved through the two-level checkpoint file, and the impact on the performance of the backward recovery system is reduced through four rollback recovery methods with different overheads.

[0092] Inter-core communication is an important part of the operation of the dual-core mutual inspection mechanism. The synchronization of CPU0 and CPU1, the signature of the calculation result, the result of the mutual inspection and judgment, and other data all need to be transmitted through inter-core communication. In the present invention, a message queue is used for data exchange between CPU0 and CPU1, and an inter-core interrupt is used to perform checkpoint and rollback recovery operations. The signature of the write command is calculated before the processor core is synchronized, and the signature is transmitted through the message queue during the kernel synchronization process. The processor obtains the mutual inspection and judgment result after comparison.

[0093] In this embodiment, CPU0 and CPU1 have the same input and execute the same application program, and their status is equal. Taking CPU0 as an example, when the program runs to the write memory command, it enters the synchronization point. CPU0 calculates the signature of the write data and the write address, sends the signature to CPU1 through message queue A, and prepares to receive the data of message queue B at the same time. After receiving the signature of the calculation result from CPU1 within a limited time, CPU0 starts to compare the signatures of the two cores. If the two are equal, the consistency check passes, the core synchronization of the processor is completed, the write command is stored in the memory, and CPU0 and CPU1 record the write command. Then determine the number of consecutive write synchronizations. If it does not reach N times, continue to execute the program; if N consecutive write synchronizations have been performed, update the checkpoint file and record the processor status.

[0094] During the execution of the program, if the waiting message queue times out or the calculation results of the two processors are judged to be inconsistent, it is considered that a soft error has occurred in the processor, and the CPU calls the multi-level rollback recovery mechanism to correct the error. According to the number of consecutive rollbacks, the first-level rollback will re-execute the instruction; the second-level rollback will rewrite the status of the two CPUs and use the checkpoint file A to roll back to the most recent checkpoint m; the third-level rollback will rewrite the status of the two CPUs and use the checkpoint file B to roll back to the m-1th checkpoint; the fourth-level rollback resets the system through the watchdog timer and re-executes the program.

[0095] In the present invention, CPU0 and CPU1 execute programs independently, and a semaphore mechanism is used to constrain interrupt hook functions, thereby solving the problem of repeated or conflicting interrupt requests between cores.

[0096] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A dual-core processor anti-single event upset protection method based on onboard SiP, characterized in that: It includes initialization and synchronization processing, program execution and synchronization detection process, checkpoint update and interrupt processing process, and error processing and rollback recovery processing process.

2. The method for protecting a dual-core processor against single event upset based on a satellite-borne SiP according to claim 1, characterized in that: The specific steps of the initialization and synchronization process include: Step 1: The two cores CPU0 and CPU1 of the onboard SiP processor execute the same application in the same state; a checkpoint is set synchronously every N runs; the N value is set based on the balance between performance and error detection requirements.

3. The method for protecting a dual-core processor against single event upset based on a satellite-borne SiP according to claim 2, characterized in that: The program execution and synchronization detection process includes: Step 2: Write memory command synchronization and signature calculation. When the program runs to the write memory command, CPU0 and CPU1 synchronize, calculate the signature of the write command, and exchange data through the independent message queue of the operating system; Step 3: CPU0 and CPU1 independently determine whether the signatures of the two processors are consistent. If they are consistent, they continue; if they are inconsistent, they enter the error handling process.

4. The method for protecting a dual-core processor against single event upset based on a satellite-borne SiP according to claim 3, characterized in that: The checkpoint update and interrupt handling process includes: Step 4: Status update and write command execution. If the signatures are consistent, the status variables and checkpoint file data are updated, and the write command is executed. Step 5: Checkpoint judgment: judge whether the program has reached the checkpoint according to the write command count. If it has reached the checkpoint, proceed to the next step; otherwise, return to step 2 to continue execution; Step 6: Calculate the signature of checkpoint file A and exchange it; Step 7: CPU0 and CPU1 independently determine whether the signatures of the two processors are inconsistent. If the result is no, go to step 8; Step 8, CPU0 and CPU1 send checkpoint interrupt requests to themselves and each other, and execute step 9; Step 9, CPU0 and CPU1 receive the interrupt request, avoid repeated interrupt execution through semaphore, and go to step 10; Step 10, CPU0, CPU1 state variables are initialized, watchdog count is cleared, each overwrites the data of checkpoint file A to checkpoint file B, clears checkpoint file A, records register group, stack data to checkpoint file A, exits interrupt, and executes step 2.

5. The method for protecting a dual-core processor against single event upset based on a satellite-borne SiP according to claim 4, characterized in that: The error handling and rollback recovery process specifically includes: Step 11, CPU0 and CPU1 send a rewind interrupt request to themselves and each other, and then execute step 12; Step 12, CPU0 and CPU1 receive the interrupt request, avoid repeated interrupt execution through the semaphore, and increase the rollback count by 1, and enter step 13; Step 13, determine whether the continuous rewind count value is 1, if yes, go to step 16, if no, go to step 14; Step 14, CPU0 and CPU1 determine whether the continuous rewind count value is 2. If yes, execute step 17; if no, execute step 15; Step 15, CPU0 and CPU1 determine whether the continuous rewind count value is 3. If yes, execute step 18; if no, execute step 19; Step 16, CPU0 and CPU1 re-execute the write memory command and go to step 2; Step 17, CPU0 and CPU1 use their respective checkpoint files A to perform backward recovery, restore the register group, stack data and part of the memory data, and the system rolls back to the most recent checkpoint m, and executes step 6; Step 18, CPU0 and CPU1 use their respective checkpoint files A and B to perform backward recovery, restore the register group, stack data and part of the memory data, and the system rolls back to the m-1th checkpoint, and executes step 6; Step 19, wait for the watchdog counter to time out, reset the system, re-execute the application program, and go to step 1.

6. The method for protecting a dual-core processor against single event upset based on a satellite-borne SiP according to claim 5, characterized in that: In step 3, CPU0 and CPU1 independently determine whether the signatures of the two processors are consistent. If the result is yes, execute step 4; if the result is no, execute step 11.

7. The method for protecting a dual-core processor against single event upset based on a satellite-borne SiP according to claim 5, characterized in that: In step 6, CPU0 and CPU1 calculate the signatures of their respective checkpoint file A, exchange the signatures through the message queue, and execute step 7; if the message queue wait times out, execute step 11.

8. The method for protecting a dual-core processor against single event upset based on a satellite-borne SiP according to claim 5, characterized in that: In step 7, CPU0 and CPU1 independently determine whether the signatures of the two processors are inconsistent. If the result is yes, step 11 is executed.

Images