Onboard router abnormality recovery system and method based on multi-level redundancy

Abstract

The present invention discloses a satellite-borne router abnormality recovery system and method based on multi-level redundancy, which supports the construction of intra-satellite, inter-satellite, and satellite-to-ground data link communication solutions in satellite constellation communication scenarios. The present invention designs a system-level recovery method based on multi-level redundancy for various abnormal scenarios faced by satellite-borne routers in satellite operating environments, combines telemetry status judgment with remote control command issuance, and realizes on-orbit recovery of data link communication service availability. Boot system-related abnormalities can be recovered through redundant system switching, dual flash configuration synchronization, on-orbit system updates, etc.; network operating system-related abnormalities can be recovered through adaptive network configuration reloading, GPIO monitoring-based system switching, redundant system switching, on-orbit system updates, etc. Based on the satellite-borne router abnormality recovery method constructed by the present invention, a single device can be combined to generate 16 system recovery routes, thereby improving the availability of satellite constellation data link communication services.

Description

Technical Field

[0001] The present invention relates to the technical field of satellite constellation communications, and in particular to a satellite-borne router abnormality recovery system and method based on multi-level redundancy. Background Art

[0002] In the field of satellite constellation communications, various business payloads within a satellite and integrated satellite electronics are interconnected through onboard routers based on the Ethernet protocol. The communication processes between various payloads within a satellite, between satellites between satellites, and between satellites and ground stations all rely on the correct configuration and normal operation of the onboard routers. Because the satellite operating environment is often subject to harsh conditions such as high / low temperature, vacuum, and single particles, onboard routers may face a variety of possible failure scenarios such as flash failure, EMMC failure, and power failure, resulting in abnormal forwarding and routing of Ethernet data, and unable to meet the needs of satellite constellations to achieve normal data link communication via onboard routers. Current existing technologies lack a system-level high-availability recovery mechanism for the above-mentioned communication anomaly scenarios to ensure the availability of onboard router communication services. Summary of the Invention

[0003] The purpose of the present invention is to address the deficiencies of the above-mentioned existing technologies and propose a satellite-borne router abnormality recovery system and method based on multi-level redundancy, aiming to provide a high-availability communication service recovery solution for satellite constellation systems in an abnormal state.

[0004] To achieve the above-mentioned object, the present invention adopts the following technical scheme: a satellite router abnormality recovery system based on multi-level redundancy, comprising satellite service integrated electronics and a satellite router; the satellite router internally integrates a main routing switching unit and a backup routing switching unit, each of which includes a CPLD, two flash memories and an EMMC, wherein the two flash memories serve as backups for each other; two operating systems, ONIE and SONIC, are installed in the EMMC; each time a flash memory is started, the CPLD controls the power-on of one of the flash memories, and the uboot installed in the flash memory guides the operating system stored in the EMMC to start via a boot system control link; the two switching units interact with the satellite service integrated electronics via a telemetry and remote control link; a single satellite router device selects any one of four routes: main flash memory-main SONIC, backup flash memory-main SONIC, main flash memory-backup SONIC, and backup flash memory-backup SONIC to enter the SONIC system; after entering the system via any route, four methods are selected to restore system availability: system restart, SONIC system configuration reload, SONIC system online reinstallation based on SONIC, and SONIC system reinstallation based on ONIE.

[0005] Furthermore, during the SONIC system configuration reloading process, only business containers other than the database are restarted while ensuring that the system does not restart. The telemetry status can be used to monitor whether the container restart is complete. When the container status returns to normal, it indicates that the reloading command has been executed.

[0006] Furthermore, the method of reinstalling the SONIC system includes reinstalling the SONIC system online based on SONIC and reinstalling the SONIC system based on ONIE; if the telemetry and remote control transmission and reception are normal under the SONIC system, either of the two methods can be selected; otherwise, only the method of reinstalling the SONIC system based on the ONIE system can be used.

[0007] Furthermore, before reinstalling the SONIC system online based on SONIC, the container status must be checked. If the status is normal, the reinstallation operation is performed. Otherwise, the system must be switched to the ONIE system for reinstallation. The online installation of the SONIC system is based on remote control commands. After the installation is complete, the current SONIC system contains two systems, and it will automatically switch to the new system after restart. The system status information returned by telemetry is used to determine whether the system business has returned to normal. If the business has recovered, the remote control command is executed to uninstall the old version of the system; otherwise, the system is switched to the ONIE system for reinstallation.

[0008] Furthermore, if the SONIC system is in an abnormal state and cannot be reinstalled online, it will switch to the ONIE system based on the telemetry and remote control commands and then reinstall the SONIC system; first determine whether the telemetry status of the ONIE system is normal. If normal, execute the remote control command to install the system and try to load the backup installation package from the mount disk. If the installation package does not exist or the verification code is abnormal, try to obtain the available installation package from the Star Service Integrated Electronics through the remote control command and execute the installation command again until the normal installation is completed; after the installation command is successfully executed, the system will switch to the SONIC system and determine whether the system business has returned to normal based on the system status information returned by the telemetry.

[0009] Furthermore, if the main flash is abnormal and the backup flash is normal, the system switches to the backup flash, deletes the latest configuration information and the main-backup flash synchronization identifier saved in the EMMC through remote control commands, updates the configuration information of the backup flash to the EMMC, and creates a synchronization identifier for the backup flash in the EMMC; after switching back to the main flash, the boot system synchronizes the configuration information of the default flash according to the flash synchronization identifier saved in the EMMC, and creates a synchronization identifier for the main flash in the EMMC; if the backup flash is abnormal and the main flash is normal, the recovery method is the same; if both the main and backup flashes are abnormal, the current SONIC system cannot be recovered, and the system switches to the backup SONIC system to restore the communication link service; the backup SONIC system is the SONIC system in the backup routing switching unit.

[0010] Furthermore, if an abnormality occurs in the ONIE system, switch to the SONIC system to check whether the telemetry and remote control functions are available. If the telemetry and remote control of the SONIC system are normal, reinstall the SONIC system to restore system availability; first try to load the ONIE system image installation package from the mount disk through remote control commands. If the target image does not exist on the mount disk or the verification code is abnormal, obtain the correct installation package from the Star Service Integrated Electronics, decompress and execute the installation script to link the latest image to the system, and judge whether the system reinstallation is successful based on the system status information returned by telemetry.

[0011] The present invention also provides a satellite router abnormality recovery method based on multi-level redundancy, which is implemented based on the above-mentioned satellite router abnormality recovery system based on multi-level redundancy; for the abnormal scenarios of intra-satellite, inter-satellite or satellite-to-ground data link services during satellite constellation communication, combined with the satellite service integrated electronics, the satellite router system CPLD, the satellite router SONIC system and the satellite router ONIE system, a corresponding recovery plan is executed to ensure the availability of data link services; the recovery plan includes the following steps:

[0012] a) Check the SONIC system status. If the SONIC system telemetry status and remote control command transmission and reception are abnormal, proceed to step b. Otherwise, check the SONIC system status based on the SONIC system telemetry status and remote control command. If there is an abnormality, proceed to step b. Otherwise, end this step.

[0013] b) Try to restart the SONIC system. After restarting, check whether the SONIC system status is restored. If it is restored, end this step, otherwise go to step c;

[0014] c) If the SONIC system can send and receive telemetry and remote control status information normally, proceed to step d; otherwise, check the ONIE system status. If the ONIE system can send and receive telemetry and remote control status information normally and the MAC configuration status is normal, proceed to step e; otherwise, proceed to step f;

[0015] d) Try to reload the SONIC system configuration. If the system recovers after the operation, end this step. Otherwise, check whether the SONIC system MAC is abnormal. If there is an abnormality, go to step f, otherwise go to step g;

[0016] e) Try to reinstall SONIC based on telemetry and remote control commands in the ONIE system to restore system availability. If the recovery fails, proceed to step h, otherwise terminate this step.

[0017] f) Try to switch to the backup flash to enter the SONIC system and restore the system availability by synchronizing the configuration of the backup boot system. If the restoration fails, go to step h, otherwise end this step;

[0018] g) Try to reinstall SONIC in the SONIC system to restore system availability. If the restoration fails, proceed to step h, otherwise end this step;

[0019] h) Try to restore service availability by switching to the standby routing switching unit through remote control commands.

[0020] Furthermore, if the SONIC system status is normal, check the status of other loads and network configuration on the communication link;

[0021] The status of other payloads and network configuration on the communication link are analyzed in combination with the corresponding port status and port count returned by the onboard router telemetry. If the count increases normally, it means that the message has been sent. If the satellite-to-ground link is not working, the satellite-to-ground communication payload and the ground station will investigate the fault. If the inter-satellite link is not working, the inter-satellite communication payload will locate the problem.

[0022] Furthermore, a method for restoring system availability based on the configuration of the backup boot system is based on a dual-flash redundant architecture design. The SONIC system is controlled by telemetry commands to update the configuration information stored in the backup flash to the EMMC to complete the synchronization. When the onboard router enters the default flash again, it first loads the latest configuration information after synchronization, thereby realizing the restoration of the boot system availability.

[0023] The beneficial effect of the present invention is that a system-level satellite router abnormality recovery method is proposed based on a multi-level redundancy design. For the intra-satellite, inter-satellite, or satellite-to-ground data link communication service abnormality scenarios caused by satellite router abnormalities during satellite constellation communication, the control link communication status between the satellite service integrated electronics, the satellite router system CPLD, the satellite router SONIC system and the satellite router ONIE system is combined to achieve on-orbit recovery of data link communication service availability based on high-availability on-orbit recovery means. Compared with traditional satellite communication solutions, the constellation router described in the present invention is based on a multi-level redundancy design. A single device can choose four routes to enter the SONIC system: main flash-main SONIC, backup flash-main SONIC, main flash-backup SONIC, and backup flash-backup SONIC. After entering the system through any route, the system availability can be restored by selecting four methods: system restart, software configuration reload, online reinstallation of the SONIC system, and reinstallation of the SONIC system based on ONIE. 16 system recovery routes can be generated in combination to ensure the high availability of constellation data link communication services. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 This is a flow chart of an embodiment of the present invention.

[0026] Figure 2 Figure 1 is a schematic diagram of the onboard router control link. Flash0 corresponds to the primary flash, and Flash1 corresponds to the backup flash.

[0027] Figure 3 Schematic diagram of satellite constellation communication link.

[0028] Figure 4 This is a timing diagram for booting the system to recover.

[0029] Figure 5 This is the online recovery timing diagram of the SONIC system.

[0030] Figure 6 This is a timing diagram for restoring the SONIC system based on ONIE.

[0031] Figure 7 This is a timing diagram for restoring the ONIE system based on SONIC. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. Of course, the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0033] To address the issue of abnormal status of onboard routers located based on telemetry and remote control data sent and received by ground stations during satellite constellation operation, the present invention proposes a system and method for recovering onboard router abnormalities based on a multi-level redundancy design. If a service abnormality occurs in a satellite constellation communication link, the system first checks whether the onboard router's system status is normal based on telemetry status and remote control instructions. If the onboard router system status is normal, the system attempts to check the status of other payloads and network configurations on the communication link. Otherwise, a system recovery plan is implemented for the specific abnormal status. The present invention is applicable to scenarios where intra-satellite, inter-satellite, or satellite-to-ground data link service abnormalities are caused by onboard router abnormalities during satellite constellation communication.

[0034] The schematic diagram of the onboard router control link in the embodiment of the present invention is as follows Figure 2As shown, based on a multi-level redundancy design, each onboard router integrates two active and standby switching units. Each switching unit contains a CPLD, two flash memories, and an EMMC. The two flash memories serve as backups for each other. During each boot, the CPLD controls the power-up of one of the flash memories. The uboot program installed in the flash memories then boots the operating system stored in the EMMC via a boot system control link. The EMMC is installed with two operating systems, ONIE and SONIC. ONIE serves as the installation and boot system for the SONIC system and is only used when reinstalling SONIC if the SONIC system is inaccessible. The two switching units interact with the satellite service integrated electronics via a telemetry and remote control link. The satellite service integrated electronics receives telemetry data to detect the status of each module within the system and controls its orderly operation through remote control commands. Based on this multi-level redundancy design, a single onboard router can access the SONIC system through four routes: primary flash to primary SONIC, backup flash to primary SONIC, primary flash to backup SONIC, and backup flash to backup SONIC. After entering the system through any of these routes, system availability can be restored through four methods: system restart, software configuration reload, online SONIC reinstallation, and ONIE-based SONIC reinstallation. A total of 16 system recovery routes are available. The primary and backup flash and backup SONIC in the primary flash to backup SONIC and backup flash to backup SONIC routes refer to the primary and backup flash and SONIC in the backup routing switch unit.

[0035] The schematic diagram of the satellite constellation communication link in the embodiment of the present invention is as follows: Figure 3 As shown, an onboard router connects each payload within the constellation, interconnecting them via intra-satellite communication links. These include satellite integrated electronics (abbreviated as STAIC EE), intersatellite communication payloads, satellite-to-ground communication payloads, and intra-satellite computing payloads. Satellites within the constellation establish links with each other via inter-satellite communication links, and satellites establish links with ground stations via satellite-to-ground communication links. The status of other payloads and network configuration on the communication links can be analyzed in conjunction with the corresponding port status and port counts returned by the onboard router telemetry. If the counts are increasing normally, it indicates that messages are being sent. If the satellite-to-ground link is unavailable, the satellite-to-ground communication payload and the ground station will be responsible for troubleshooting. If the inter-satellite link is unavailable, the inter-satellite communication payload will be responsible for locating the problem.

[0036] The satellite constellation communication link consists of a control link and a data link. Data link anomalies can be troubleshooted based on the control link. Using the satellite-to-ground control link, the ground station can send remote control commands to the satellite service integrated electronics, the onboard router system CPLD, the onboard router SONIC system, and the onboard router ONIE system, and receive telemetry status information from these systems. Collaborative services between computing clusters comprised of various computing loads within the constellation are carried out over the data link.

[0037] The embodiment of the present invention provides a method for recovering a satellite router system in an abnormal state based on multi-level redundancy. The specific process is as follows: Figure 1 As shown, it includes the following steps:

[0038] Step 1: During satellite constellation communication, if the communication link service is abnormal, first check whether there is any abnormality in the onboard router SONIC system. If it is determined that the system is abnormal, implement the corresponding recovery plan; otherwise, check the status of other loads on the communication link and the network configuration.

[0039] Specifically, whether there are any abnormalities in the onboard router SONIC (Software for Open Networking in the Cloud) system needs to be checked based on the remote control commands sent by the ground station and the telemetry status information received.

[0040] 1. First, determine whether the onboard router SONIC system is normally sending and receiving telemetry and remote control status information. If the SONIC system telemetry status and remote control command transmission and reception still fail ten minutes after the satellite service integrated electronics sends the remote control command for the SONIC system to power on, proceed to step 2 to further locate the cause of the abnormality;

[0041] 2. If the satellite router SONIC system can send and receive telemetry and remote control status information normally, you need to check the SONIC system telemetry and remote control information. If the system status returned by the SONIC system telemetry is abnormal, go to step 2. Otherwise, it means that the SONIC system is operating normally, and end this step.

[0042] The specific cause of the anomaly needs to be analyzed and located based on the system status information returned by telemetry. Different anomaly causes correspond to different system recovery plans. After executing the corresponding recovery plan based on the located anomaly cause, it is necessary to determine whether business has recovered based on the status information returned by telemetry. If business has not recovered, further investigation is required.

[0043] Check the status of other payloads and network configuration on the communication link. This can be analyzed in conjunction with the corresponding port status and port counts reported by the onboard router telemetry. If the counts are increasing normally, messages are being sent. If the satellite-to-ground link is unavailable, the satellite-to-ground communication payload and ground station should be responsible for troubleshooting. If the intersatellite link is unavailable, the intersatellite communication payload should be responsible for locating the problem.

[0044] Step 2: First try to restart the SONIC system. If the abnormal state is restored after the restart, end this step. If the abnormal state still exists after the restart, check whether the SONIC system is sending and receiving telemetry and remote control status information normally. If it is normal, go to step 3. Otherwise, based on the remote control command, power off the current SONIC system, switch to the ONIE system and power it on, check the telemetry and remote control status under the ONIE (Open Network Install Environment) system, and further locate the cause of the system abnormality.

[0045] Specifically, locating the cause of system anomalies in the ONIE system includes the following steps:

[0046] 1. If the ONIE system can send and receive remote control commands and telemetry status information normally and the MAC configuration status is normal, proceed to step 3;

[0047] 2. If the ONIE system cannot send and receive telemetry and remote control status information normally, or can send and receive remote control commands and telemetry status information normally but the MAC configuration status is abnormal, go to step 4;

[0048] In one embodiment, if the onboard router system is determined to be in an abnormal flash boot state in step 2, a direct SONIC system reinstallation cannot be used for recovery because the system lacks basic MAC configuration, which will cause the reinstallation to fail. Instead, the dual-flash design can be used to synchronize the onboard system configuration to restore the current system boot.

[0049] It should be noted that the onboard router SONIC system and the onboard router ONIE system are two independent systems, both requiring booting from the onboard router flash. The SONIC system can be reinstalled from the ONIE system, and vice versa. The onboard router can only boot from one flash memory at a time and enter either the ONIE or SONIC system. The onboard router CPLD system controls flash power on and off and GPIO signal switching, thereby specifying the selection between the onboard router SONIC system and the onboard router ONIE system. A low level selects the ONIE system, while a high level selects the SONIC system.

[0050] After receiving the satellite service integrated electronic remote control command, the onboard router CPLD system selects the ONIE system or the SONIC system. The switching process includes the following steps:

[0051] 1. The satellite service integrated electronics sends a remote control command to the onboard router CPLD system to control the onboard router flash to power off;

[0052] 2. The satellite service integrated electronics sends a telemetry request command to the onboard router CPLD system to confirm the system status;

[0053] 3. The satellite service integrated electronics sends remote control commands to the satellite router CPLD system to control the GPIO signal switching of the satellite router;

[0054] 4. The satellite service integrated electronics sends remote control commands to the onboard router CPLD system to control the onboard router flash power-on. The onboard router uboot system selects to start from the corresponding system by reading the specified GPIO signal. A low level selects the ONIE system, and a high level selects the SONIC system. The default is high level.

[0055] 5. The satellite service integrated electronics sends a telemetry request command to the onboard router's current operating system (ONIE / SONIC), and the onboard router's current operating system returns the current status information.

[0056] Step 3: If the SONIC system remote control command and telemetry status information are sent and received abnormally, proceed to step 5. Otherwise, try to execute step 6. After successful execution, wait for the container to restart successfully and then check the system status. If the system recovers, end this step; if it still does not recover, check whether there is any MAC (Media Access Control) configuration abnormality in the current SONIC system. If there is an abnormality, proceed to step 4; otherwise, proceed to step 5;

[0057] Step 4: If the boot system is abnormal, you can restore the system configuration by synchronizing the backup boot system. First, switch to the backup flash and power on through remote control commands. If you can enter the SONIC system normally after switching to the backup flash, execute the following instructions. Based on the dual flash configuration synchronization design, update the configuration information stored in the backup flash to the EMMC (Embedded MultiMedia Card). After synchronization is completed, enter the default flash (default is the main flash) to load the latest configuration information to restore the boot system. If both flashes are abnormal or the boot system recovery fails, you can switch to the backup board communication through remote control commands.

[0058] The recovery process of the boot system specifically includes the following steps:

[0059] 1. Select the backup flash to power on via remote control command;

[0060] 2. After power-on, the backup flash automatically reads the flash synchronization flag saved in the EMMC and selects whether to synchronize the configuration information of the default flash according to the flag. If the backup flash synchronization flag already exists at this time, the backup flash does not need to be synchronized again and proceeds to the next step. Otherwise, end this step.

[0061] 3. Enter the SONIC system from the backup flash, call the configuration information synchronization script through remote control commands, delete the latest configuration information and the main and backup flash synchronization flags saved in the EMMC, and update the configuration information of the backup flash to the EMMC;

[0062] 4. Since the backup flash and EMMC configuration information have been synchronized, create a synchronization mark for the backup flash in EMMC;

[0063] 5. Use the remote control command to power off the backup flash and choose to power on the default flash;

[0064] 6. After power-on, the default flash automatically reads the flash synchronization identifier saved in the EMMC. At this time, the backup flash synchronization identifier already exists, and the default flash synchronization identifier has not been created. The default flash automatically performs a synchronization operation to update the configuration information stored in the EMMC to the current flash;

[0065] 7. Since the default flash and EMMC configuration information have been synchronized, create a synchronization mark for the default flash in EMMC;

[0066] 8. Complete the configuration synchronization of the boot system and enter the SONIC system from the default flash.

[0067] It should be noted that if the primary and backup flashes of the onboard router system have been synchronized before the default flash has an abnormality, the backup flash synchronization flag already exists and is not affected by the abnormal flash configuration; otherwise, the backup flash will automatically synchronize the abnormal configuration of the default flash, causing both flashes to enter an abnormal state.

[0068] Step 5: If the SONIC system is operating abnormally, you can recover by reinstalling SONIC. Depending on the availability of the SONIC system, two corresponding installation methods are available: online reinstallation of the SONIC system based on SONIC and reinstallation of the SONIC system based on the ONIE system. If the SONIC system's telemetry and remote control transmission and reception are normal, both methods can be used; otherwise, reinstalling the SONIC system based on the ONIE system is the only option. If the SONIC system reinstallation fails, you can use remote control commands to switch to the backup card to ensure communication services.

[0069] Specifically, the SONIC online reinstallation solution includes the following steps:

[0070] 1. Execute remote control commands. First, try to load the backup installation package from the mount disk and install the system online. If the installation package does not exist or the verification code is abnormal, you can obtain installation failure status information through telemetry. Then try to obtain a valid installation package from the integrated power supply or intelligent computer through remote control commands and execute the installation command again until the installation is completed normally.

[0071] 2. Determine whether the installation command has been executed based on telemetry. If it is successful, the current system has two versions of the Sonic system installed. Restarting the system through remote control commands will automatically switch to the new system. Otherwise, you need to further locate the reason why the system installation command failed to execute. If the command sending or receiving failed, try to resend the command to solve the problem. Otherwise, end this step and switch to the ONIE system for reinstallation.

[0072] 3. After switching to the new system, determine whether the system service has returned to normal based on the system status information returned by telemetry. If the service has been restored, execute the remote control command to uninstall the old version of the system; otherwise, end this step and switch to the ONIE system for reinstallation.

[0073] The onboard router's system switching design based on GPIO monitoring can switch to the ONIE system to reinstall the SONIC system in the event of an abnormality in the current SONIC operating system, thereby restoring system availability. Specifically, the solution for reinstalling the SONIC system based on the ONIE system includes the following steps:

[0074] 1. Execute the system switching command based on the onboard router CPLD remote control command, power off the current SONIC system, switch to the ONIE system and then power on again;

[0075] 2. Determine whether the system status information returned by ONIE system telemetry is normal. If the system status is normal, proceed to step 3 to execute the remote control command to install the system; otherwise, it means that the ONIE system is abnormal, and end this step;

[0076] 3. Execute remote control commands. First, try to load the backup installation package from the mount disk to install the system. If the installation package does not exist or the verification code is abnormal, you can obtain the installation failure status information through telemetry. Then try to obtain a valid installation package from the integrated power supply through remote control commands and execute the installation command again until the installation is completed normally.

[0077] After the system is successfully installed, it will automatically enter the sonic system and determine whether the system business has returned to normal based on the system status information returned by telemetry.

[0078] If the onboard router ONIE system is abnormal, perform the following steps to reinstall the ONIE system:

[0079] 1. After powering on, first enter the SONIC system and check whether the telemetry and remote control functions are available. If the telemetry and remote control functions are abnormal and cannot be used, end this step; otherwise, go to step 2 to execute the remote control command to reinstall the ONIE system;

[0080] 2. First, try to load the ONIE system image installation package from the mount disk through remote control commands. If the target image does not exist on the mount disk or the verification code is abnormal, you can obtain the correct installation package from the above file from the integrated power supply.

[0081] 3. Based on the remote control command, unzip the image installation package and execute the installation script to link the latest image to the system. If the execution is successful, proceed to step 4. Otherwise, it means that the current installation package is abnormal, and proceed to step 2 to obtain the installation package again;

[0082] Execute the system switching instruction through CPLD, power off the current board and switch to booting from the ONIE system, then power it on again. Determine whether the system reinstallation is successful based on the system status information returned by telemetry.

[0083] Step 6: Based on the default network configuration, execute the reload command and restart the business container without restarting the system to restore the default network configuration. Triple-mode redundancy implemented at the software level ensures that business availability is restored by automatically synchronizing data if the current business configuration is inconsistent with the backup data.

[0084] Example 1:

[0085] In the embodiment of the present invention, if a problem is found in the boot system based on the telemetry status, the availability of the current boot system can be restored by synchronizing the configuration of the backup boot system. The timing diagram corresponding to the positioning and recovery process is shown in FIG. Figure 4 As shown, it includes the following steps:

[0086] 1. The satellite service integrated circuit sends a remote control command to the satellite router CPLD, selects to start the SONIC system and power it on from the main flash;

[0087] 2. The onboard router CPLD controls the main flash to power on and updates the designated GPIO to a high level. The main flash selects to enter the SONIC system based on the GPIO signal.

[0088] 3. The integrated power system requests the telemetry status from the SONIC system. After the system is successfully started, the corresponding status information will be returned. Based on the system startup time, container status, and port status information contained in the telemetry status, it is determined whether the SONIC system is in an abnormal state. If the status is normal, this step ends. Otherwise, a remote control command is sent to the onboard router CPLD to power off the main flash.

[0089] 4. The onboard router CPLD controls the main flash to power off;

[0090] 5. The integrated power supply sends a remote control command to the onboard router CPLD to start the ONIE system and power it on from the main flash;

[0091] 6. The onboard router CPLD controls the main flash to power on and updates the designated GPIO to a low level. The main flash selects to enter the ONIE system based on the GPIO signal.

[0092] 7. The integrated power system requests the telemetry status from the ONIE system. After the system is successfully started, the corresponding status information will be returned. Based on the system startup time and network status information contained in the telemetry status, it is determined whether the ONIE system is in an abnormal state. If the status is normal, this step ends. Otherwise, a remote control command is sent to the onboard router CPLD to power off the main flash.

[0093] 8. The onboard router CPLD controls the main flash to power off;

[0094] 9. The integrated power supply sends a remote control command to the satellite router CPLD to start the SONIC system and power it on from the backup flash;

[0095] 10. The onboard router CPLD controls the backup flash to power on and updates the designated GPIO to a high level; the backup flash selects to enter the SONIC system based on the GPIO signal;

[0096] 11. The integrated power system requests the telemetry status from the SONIC system. After the system is successfully started, it will return the corresponding status information. Based on the telemetry status, it will determine whether the system MAC configuration is normal. If it is normal, the integrated power system will send a remote control command to the onboard router CPLD to synchronize the flash configuration.

[0097] 12. The SONIC system executes the synchronization instruction, deletes the latest configuration information and the master-slave flash synchronization mark saved in the EMMC, updates the backup flash configuration information to the EMMC, and creates the backup flash synchronization mark in the EMMC;

[0098] 13. The integrated power system requests the telemetry status from the SONIC system. The system returns the current status information of the integrated power system and determines whether the synchronization is completed based on the telemetry. After the synchronization is completed, it sends a remote control command to the onboard router CPLD to power off the backup flash.

[0099] 14. The onboard router CPLD controls the main flash to power off;

[0100] 15. The integrated circuit sends a remote control command to the onboard router CPLD, selects to start the SONIC system and powers on from the main flash;

[0101] 16. The onboard router CPLD controls the main flash to power on and updates the designated GPIO to a high level; the main flash selects to enter the SONIC system based on the GPIO signal;

[0102] 17. The integrated power system requests the telemetry status from the SONIC system. After the system is successfully started, the corresponding status information will be returned. The telemetry status will be used to determine whether the SONIC system has been successfully restored.

[0103] Example 2:

[0104] In the embodiment of the present invention, if a problem is found in the SONIC system based on the telemetry status, the availability of the current system can be restored by reinstalling the SONIC system online. The specific timing diagram corresponding to the recovery process is as follows: Figure 5 As shown, it includes the following steps:

[0105] 1. The satellite service integrated circuit sends a remote control command to the satellite router CPLD, selects to start the SONIC system and power it on;

[0106] 2. The onboard router CPLD controls the power-on of the SONIC system;

[0107] 3. The integrated power system requests the telemetry status from the SONIC system. After the system is successfully started, it will return the corresponding status information. After judging that each container of the system is in a stable state based on the telemetry status, the integrated power system sends a remote control command to the onboard router SONIC to install the new version of SONIC.

[0108] 4. The satellite router SONIC system executes the remote control command and first attempts to load the backup installation package from the mounting disk to install the system online. If the installation package does not exist or the verification code is abnormal, it attempts to obtain an available installation package from the integrated power supply and executes the installation command again until the installation is completed normally. After the installation is completed, the current EMMC contains both the old and new versions of the SONIC system;

[0109] 5. The integrated power system requests the telemetry status from the SONIC system. After judging that the system installation is complete based on the telemetry status, the integrated power system sends a remote control command to the satellite router SONIC to restart the current SONIC system.

[0110] 6. The SONIC system automatically enters the new version of the SONIC system after executing the remote control command to restart the system;

[0111] 7. The integrated power system requests the telemetry status from the SONIC system. After judging that the system restart is complete and all containers are in a stable state based on the telemetry status, the integrated power system sends a remote control command to the onboard router SONIC to uninstall the old version of the SONIC system.

[0112] 8. The integrated power system requests the telemetry status from the SONIC system and determines whether the SONIC system has been successfully restored based on the telemetry status.

[0113] Example 3:

[0114] In the embodiment of the present invention, if a problem is found in the SONIC system based on the telemetry status, but the current state of the SONIC system does not support online installation, the availability of the current system can be restored by reinstalling the SONIC system based on the ONIE system. The timing diagram corresponding to the specific positioning and recovery process is shown in the following figure. Figure 6 As shown, it includes the following steps:

[0115] 1. The satellite service integrated circuit sends a remote control command to the satellite router CPLD, selects to start the SONIC system and power it on;

[0116] 2. The onboard router CPLD updates the designated GPIO to a high level, and the flash selects to enter the SONIC system based on the GPIO signal;

[0117] 3. The integrated power system requests the telemetry status from the SONIC system. After the system is successfully started, the corresponding status information will be returned. Based on the system startup time, container status, and port status information contained in the telemetry status, it is determined whether the SONIC system is in an abnormal state. If the status is normal, this step ends. Otherwise, a remote control command is sent to the onboard router CPLD to power off the SONIC system.

[0118] 4. The onboard router CPLD controls the SONIC system to power off;

[0119] 5. The integrated circuit sends a remote control command to the satellite router CPLD to start the ONIE system and power it on;

[0120] 6. The onboard router CPLD updates the designated GPIO to a low level, and the flash selects to enter the ONIE system based on the GPIO signal;

[0121] 7. The integrated power system requests the telemetry status from the ONIE system. After the system is successfully started, the corresponding status information will be returned. According to the system startup time and network status information contained in the telemetry status, it is determined whether the ONIE system is in an abnormal state. If the status is abnormal, this step is terminated. Otherwise, a remote control command is sent to the satellite router ONIE system to reinstall the SONIC system.

[0122] 8. The ONIE system executes remote control commands and first attempts to load the backup installation package from the mount disk and install it. If the installation package does not exist or the verification code is abnormal, it attempts to obtain a usable installation package from the integrated power supply and executes the installation command again until the SONIC system installation is completed normally.

[0123] 9. The integrated power system requests telemetry status from the ONIE system and waits for the system installation to be completed;

[0124] 10. After the ONIE system is installed, it will automatically restart and enter the SONIC system;

[0125] 11. The integrated power system requests the telemetry status from the SONIC system. After the system is successfully started, the corresponding status information will be returned. The telemetry status will be used to determine whether the SONIC system has been successfully restored.

[0126] Example 4:

[0127] In the embodiment of the present invention, if a problem is found in the ONIE system based on the telemetry status and the current state of the SONIC system is normal, the availability of the current system can be restored by reinstalling the ONIE system based on the SONIC system. The timing diagram corresponding to the specific positioning and recovery process is as follows: Figure 7 As shown, it includes the following steps:

[0128] 1. The satellite service integrated circuit sends a remote control command to the satellite router CPLD, selects to start the SONIC system and power it on;

[0129] 2. The onboard router CPLD updates the designated GPIO to a high level, and the flash selects to enter the SONIC system based on the GPIO signal;

[0130] 3. The integrated power system requests the telemetry status from the SONIC system. After the system is successfully started, the corresponding status information will be returned. According to the system startup time, container status, and port status information contained in the telemetry status, it is determined whether the SONIC system is in an abnormal state. If the status is abnormal, this step ends. Otherwise, a remote control command is sent to the SONIC system to reinstall the ONIE system.

[0131] 4. The SONIC system executes the remote control command and first attempts to load the ONIE system installation package from the mount disk to install the system online. If the installation package does not exist or the verification code is abnormal, it attempts to obtain an available installation package from the integrated power supply and executes the installation command again until the ONIE system installation is completed normally.

[0132] 5. The integrated power system requests the telemetry status from the SONIC system. After the system is successfully started, the corresponding status information will be returned. The ONIE system will be judged based on the telemetry status to determine whether it has been reinstalled successfully. If the status is abnormal, this step is terminated. Otherwise, a remote control command is sent to the onboard router CPLD to power off the SONIC system.

[0133] 6. The onboard router CPLD controls the SONIC system to power off;

[0134] 7. The integrated electrical system sends a remote control command to the satellite router CPLD to start the ONIE system and power it on;

[0135] 8. The onboard router CPLD updates the designated GPIO to a low level, and the flash selects to enter the ONIE system based on the GPIO signal;

[0136] 9. The integrated power system requests the telemetry status from the ONIE system. After the system is successfully started, the corresponding status information will be returned. The telemetry status will be used to determine whether the ONIE system has been successfully restored.

[0137] The above embodiments are intended only to illustrate the design concepts and features of the present invention. Their purpose is to enable those skilled in the art to understand the contents of the present invention and implement them accordingly. The scope of protection of the present invention is not limited to the above embodiments. Therefore, any equivalent changes or modifications made based on the principles and design concepts disclosed in the present invention are within the scope of protection of the present invention.

Claims

1. A satellite router abnormality recovery system based on multi-level redundancy, characterized in that: The invention comprises a satellite service integrated electronics and a satellite-borne router; the satellite-borne router internally integrates a main routing switching unit and a backup routing switching unit, each of which contains a CPLD, two flash memories and an EMMC, wherein the two flash memories serve as backups for each other; the EMMC is installed with two operating systems, ONIE and SONIC; each startup is controlled by the CPLD to power on one of the flash memories, and the uboot installed in the flash memory guides the startup of the operating system stored in the EMMC via a boot system control link; the two switching units interact with the satellite service integrated electronics via a telemetry and remote control link; a single satellite-borne router device selects any of the four routes, namely, main flash memory-main SONIC, backup flash memory-main SONIC, main flash memory-backup SONIC, and backup flash memory-backup SONIC, to enter the SONIC system; after entering the system via any route, the system availability can be restored by selecting four methods: system restart, SONIC system configuration reload, SONIC system online reinstallation based on SONIC, and SONIC system reinstallation based on ONIE; If the main flash is abnormal and the backup flash is normal, the system switches to the backup flash, deletes the latest configuration information and the main-backup flash synchronization mark saved in the EMMC through remote control commands, updates the configuration information of the backup flash to the EMMC, and creates a synchronization mark for the backup flash in the EMMC; after switching back to the main flash, the boot system synchronizes the configuration information of the default flash according to the flash synchronization mark saved in the EMMC, and creates a synchronization mark for the main flash in the EMMC; If the backup flash is abnormal and the main flash is normal, the recovery method is the same; if both the main and backup flashes are abnormal, the current SONIC system cannot be recovered, and the communication link service is restored by switching to the backup SONIC system; the backup SONIC system is the SONIC system in the backup routing switching unit.

2. The multi-level redundancy-based satellite router abnormality recovery system according to claim 1, characterized in that: During the SONIC system configuration reload process, only business containers other than the database are restarted without restarting the system. The telemetry status can be used to monitor whether the container restart is complete. If the container status returns to normal, it indicates that the reload command has been executed.

3. The multi-level redundancy-based satellite router abnormality recovery system according to claim 1, characterized in that: The methods for reinstalling the SONIC system include online reinstallation of the SONIC system based on SONIC and reinstallation of the SONIC system based on ONIE. If the telemetry and remote control transmission and reception are normal under the SONIC system, either method can be selected; otherwise, only the method of reinstalling the SONIC system based on the ONIE system can be used.

4. The multi-level redundancy-based satellite router abnormality recovery system according to claim 1, characterized in that: Before executing the SONIC system online reinstallation based on SONIC, you need to check the container status. If the status is normal, perform the reinstallation operation, otherwise you need to switch to the ONIE system for reinstallation; the SONIC system online installation is based on remote control instructions. After the installation is complete, the current SONIC system contains two systems, and it can automatically switch to the new system after restart; judge whether the system business has returned to normal based on the system status information returned by telemetry. If the business has recovered, execute the remote control command to uninstall the old version of the system; otherwise, switch to the ONIE system for reinstallation.

5. The multi-level redundancy-based satellite router abnormality recovery system according to claim 1, characterized in that: If the SONIC system is in an abnormal state and cannot be reinstalled online, it will switch to the ONIE system based on the telemetry and remote control commands and then reinstall the SONIC system; first determine whether the telemetry status of the ONIE system is normal. If normal, execute the remote control command to install the system and try to load the backup installation package from the mount disk. If the installation package does not exist or the verification code is abnormal, try to obtain the available installation package from the Star Service Integrated Electronics through the remote control command and execute the installation command again until the normal installation is completed; after the installation command is successfully executed, the system will switch to the SONIC system and determine whether the system business has returned to normal based on the system status information returned by the telemetry.

6. The multi-level redundancy based satellite router abnormality recovery system according to claim 1, characterized in that: If the ONIE system has an abnormality, switch to the SONIC system to check whether the telemetry and remote control functions are available. If the SONIC system telemetry and remote control are normal, reinstall the SONIC system to restore system availability. First, try to load the ONIE system image installation package from the mount disk through remote control commands. If the target image does not exist on the mount disk or the verification code is abnormal, obtain the correct installation package from the Star Service Integrated Electronics, decompress it and execute the installation script to link the latest image to the system. Determine whether the system reinstallation is successful based on the system status information returned by telemetry.

7. A method for recovering satellite-borne router abnormality based on multi-level redundancy, characterized in that: Based on the multi-level redundancy based on-board router abnormality recovery system of claim 1; for the abnormal scenarios of intra-satellite, inter-satellite or satellite-to-ground data link services during satellite constellation communication, in combination with the satellite service integrated electronics, the on-board router system CPLD, the on-board router SONIC system and the on-board router ONIE system, a corresponding recovery plan is executed to ensure the availability of data link services; the recovery plan includes the following steps: a) Check the SONIC system status. If the SONIC system telemetry status and remote control command transmission and reception are abnormal, proceed to step b. Otherwise, check the SONIC system status based on the SONIC system telemetry status and remote control command. If there is an abnormality, proceed to step b. Otherwise, end this step. b) Try to restart the SONIC system. After restarting, check whether the SONIC system status is restored. If it is restored, end this step, otherwise go to step c; c) If the SONIC system can send and receive telemetry and remote control status information normally, proceed to step d; otherwise, check the ONIE system status. If the ONIE system can send and receive telemetry and remote control status information normally and the MAC configuration status is normal, proceed to step e; otherwise, proceed to step f; d) Try to reload the SONIC system configuration. If the system recovers after the operation, end this step. Otherwise, check whether the SONIC system MAC is abnormal. If there is an abnormality, go to step f, otherwise go to step g; e) Try to reinstall SONIC based on telemetry and remote control commands in the ONIE system to restore system availability. If the recovery fails, proceed to step h, otherwise terminate this step. f) Try to switch to the backup flash to enter the SONIC system and restore the system availability by synchronizing the configuration of the backup boot system. If the restoration fails, go to step h, otherwise end this step; g) Try to reinstall SONIC in the SONIC system to restore system availability. If the restoration fails, proceed to step h, otherwise end this step; h) Try to restore service availability by switching to the standby routing switching unit through remote control commands.

8. The method for recovering an abnormality of a satellite-borne router based on multi-level redundancy according to claim 7, characterized in that: If the SONIC system status is normal, check the status of other loads and network configuration on the communication link; The status of other payloads and network configuration on the communication link are analyzed in combination with the corresponding port status and port count returned by the onboard router telemetry. If the count increases normally, it means that the message has been sent. If the satellite-to-ground link is not working, the satellite-to-ground communication payload and the ground station will investigate the fault. If the inter-satellite link is not working, the inter-satellite communication payload will locate the problem.

9. The method for recovering satellite-borne router abnormality based on multi-level redundancy according to claim 7, characterized in that: The method for restoring system availability based on the configuration of the backup boot system is based on a dual-flash redundant architecture design. The SONIC system is controlled by telemetry commands to update the configuration information stored in the backup flash to the EMMC to complete the synchronization. When the onboard router enters the default flash again, it first loads the latest configuration information after synchronization, thereby realizing the restoration of the boot system availability.

Images