Program guiding method and system with operation space capable of being reconstructed on orbit

Abstract

The invention relates to the technical field of spaceflight electronic systems, and discloses a program guiding method and system capable of realizing on-orbit reconstruction of a running space, and the method comprises the steps: storing a guiding program in each of a PROM (programmable read-only memory) and a software-programmable nonvolatile memory of a spaceborne computer system; the method comprises the following steps of: after a system is reset, running a bootstrap function code of a bootstrap program in a programmable read-only memory (PROM), selecting a corresponding bootstrap program according to a system state register to load and run, and loading an application program by the bootstrap program to run; the states of random access memories (RAM) operated by a boot program and an application program are respectively monitored, system state register bit switching is performed through a ground instruction to realize fault isolation, program operation space redundancy and fault isolation are realized, the boot program can still be normally operated after a part of RAM devices fail, and the reliability of the boot program is improved. The on-orbit fault diagnosis and reconstruction repair functions of the system are implemented, and the reliability and safety of long-term on-orbit operation of the system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of aerospace electronic systems, and in particular to a program guiding method and system with an on-orbit reconfigurable operating space. Background Art

[0002] With the increasing complexity of current aerospace model development tasks and the continuous compression of product development cycles, the on-orbit quality problems are also increasing, which poses higher requirements for redundant backup, fault isolation, and on-orbit reconfiguration of on-board computers.

[0003] The main function of the traditional on-board computer boot software in orbit is to load the on-board computer application software code from EEPROM or Nor Flash into RAM for operation. Due to considerations of the security of on-board computers, more and more models now require the boot software to have a safe mode function, that is, when an irreparable fault occurs in the on-board computer application software, on-orbit fault diagnosis and reconfiguration repair can be performed through the safe mode of the boot software. Since the safe mode of the boot software plays a life-saving role for on-board computer software, its own reliability and security are particularly important.

[0004] However, although the PROM device storing the boot software code is safe and reliable, the external extended RAM device on which it operates has a certain risk of failure. Since the operating space address of the boot software code stored in the PROM is fixed and cannot be loaded into other RAM spaces for operation, and the PROM cannot perform on-orbit programming modification, even if the system is designed with multiple RAM chip backups, the purpose of redundant operating space for the boot software cannot be achieved. That is, in this fault mode, even if the boot software has a safe mode function, it cannot operate normally by itself, and thus cannot perform on-orbit reconfiguration and fault repair functions.

[0005] Therefore, designing a program guiding method and an on-board computer system with an on-orbit reconfigurable operating space has become an urgent problem to be solved in the development of current aerospace on-board computer systems. Summary of the Invention

[0006] The purpose of the present invention is to solve the above-mentioned disadvantages existing in the prior art, and to provide a program guiding method and system with an on-orbit reconfigurable operating space, realizing redundant operating space and fault isolation of the boot software, ensuring that the boot software can still operate normally after some RAM devices fail, implementing on-orbit fault diagnosis and reconfiguration repair functions of the system, and ensuring the long-term safe and reliable operation of the spacecraft in orbit.

[0007] On the one hand, a program guiding method with an on-orbit reconfigurable operating space is provided, including the following steps: S1: Store a copy of the boot program in each of the programmable read-only memory (PROM) and the software-programmable non-volatile memory of the on-board computer system; S2: After the system is reset, first run the boot function code of the boot program in the programmable read-only memory (PROM), select the corresponding boot program for loading and running according to the system status register, and load and run the application program by the boot program; S3: Monitor the random access memory (RAM) status of the boot program and the application program respectively for fault diagnosis, implement fault isolation by switching the system status register bits through ground commands, and implement reconstruction and repair through the on-orbit programming function of the boot program.

[0008] Further, in step S1, storing a copy of the boot program in each of the programmable read-only memory (PROM) and the software-programmable non-volatile memory of the on-board computer system includes: The software-programmable non-volatile memory includes, but is not limited to, electrically erasable programmable read-only memory (EEPORM), non-volatile flash memory (Nor Flash), or magnetoresistive random access memory (MRAM); The boot programs in the programmable read-only memory (PROM) and the software-programmable non-volatile memory both have the basic functions of the boot program, including application program loading and boot function, on-orbit programming function, and at the same time have different memory mapping configuration parameters, corresponding to different physical address spaces of the random access memory (RAM).

[0009] Further, in step S2, the running of the boot function code of the boot program in the programmable read-only memory (PROM) includes: The boot function code is the entry of the boot program. When the system is powered on or reset, it automatically jumps to this address and runs directly in the secure programmable read-only memory (PROM), without relying on the random access memory (RAM) space.

[0010] Preferably, in step S2, further including selecting the corresponding boot program for loading and running according to the system status register: The boot program selection status bit of the system status register is converted from the relay switch state, and the switching of the relay state is directly controlled by the ground sending command. By default, the system status register selects to load the boot program in the programmable read-only memory (PROM) into the corresponding RAM for running; Perform integrity verification on the boot program code before loading the boot program. When the verification fails, trigger the system automatic reset mechanism.

[0011] Further, in step S3, the implementation of fault isolation by switching the system status register bits through ground commands includes: Monitor the random access memory (RAM) where the bootstrap program runs. If a failure occurs in the RAM where the bootstrap program runs, causing the bootstrap program to be unable to run, or if it is necessary to switch to run another bootstrap program, send an instruction from the ground to switch the bootstrap program selection status bit of the system status register.

[0012] Preferably, in step S3, the implementation of reconstruction and repair through the in-orbit programming function of the bootstrap program includes: Monitor the random access memory (RAM) where the application program runs. If a failure occurs in the RAM where the application program runs, causing the application program to be unable to run: Through the in-orbit programming function of the bootstrap program, upload an application program running in another RAM space to replace the original application program and store it in the software-programmable non-volatile memory, or, Enable a standby application program that was previously redundantly stored in another RAM space. The bootstrap program selects and loads the application program in the software-programmable non-volatile memory to the corresponding RAM space for running according to the configuration parameters.

[0013] Furthermore, the method further includes: When the bootstrap program stored in the programmable read-only memory (PROM) has the basic functions of loading and booting and in-orbit programming, the bootstrap program is pre-cured, and then the bootstrap program in the software-programmable non-volatile memory is modified through ground instructions or in-orbit programming to add other functions of the bootstrap program.

[0014] On the other hand, a program boot system with an in-orbit reconfigurable operating space is provided, including: A redundant storage management module for storing a copy of the bootstrap program in both the programmable read-only memory (PROM) and the software-programmable non-volatile memory of the on-board computer system; A boot loading control module for, after system reset, first running the bootstrap function code in the programmable read-only memory (PROM), selecting the corresponding bootstrap program for loading and running according to the system status register, and loading and running the application program by the bootstrap program; A monitoring, reconstruction, and repair module for respectively monitoring the status of the random access memory (RAM) where the bootstrap program and the application program run for fault diagnosis, implementing fault isolation by switching the system status register bit through ground instructions, and implementing reconstruction and repair through the in-orbit programming function of the bootstrap program.

[0015] Meanwhile, a computer-readable storage medium is provided, on which a computer program is stored. The program includes a bootstrap program and an application program, and when executed by a processor, implements the program boot method with on-orbit reconfigurable running space described in any one of the above.

[0016] In addition, an electronic device is provided, including: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the program boot method with on-orbit reconfigurable running space described in any one of the above.

[0017] Compared with the prior art, the beneficial effects of the present invention are: In the present invention, a bootstrap program is redundantly stored in a software-programmable non-volatile memory. Meanwhile, by switching the system status register bits through ground instructions, program running space redundancy and fault isolation are achieved, ensuring that the bootstrap program can still run normally after some RAM devices fail; In the present invention, fault diagnosis is performed by monitoring the random access memory (RAM) status of the bootstrap program and the application program, and reconstruction and repair are achieved through the on-orbit programming function of the bootstrap program, improving the reliability and safety of the system during long-term on-orbit operation; When the bootstrap program stored in the programmable read-only memory (PROM) has basic loading and on-orbit programming functions, the bootstrap program can be pre-cured. Then, by ground instructions or on-orbit programming to modify the bootstrap program in the software-programmable non-volatile memory to add other functions of the bootstrap program, the development time of the bootstrap program and the PROM storage cost can be effectively reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings are used to provide a further understanding of the present invention, and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention, and do not constitute a limitation to the present invention. In the drawings: Figure 1 is a schematic flow chart of a program boot method with on-orbit reconfigurable running space according to the present invention; Figure 2 is a flow and topology schematic diagram of a program for loading a traditional boot method; Figure 3 is a flow and topology schematic diagram of a program for loading a boot method according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the following will clearly and completely describe the technical solutions in the embodiments of this application with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, rather than all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in this application without creative efforts shall fall within the scope of protection of this application.

[0020] The following will illustrate the specific implementation manners of the present invention in conjunction with the accompanying drawings and embodiments.

[0021] First Embodiment As Figure 1 shown, the following is a technical solution of a program guiding method with an on-orbit reconfigurable operating space provided in this embodiment, including the following steps: S1: Store a copy of the boot program in each of the programmable read-only memory (PROM) and the software-programmable non-volatile memory of the on-board computer system; S2: After the system is reset, first run the boot function code of the boot program in the programmable read-only memory (PROM), select the corresponding boot program for loading and running according to the system status register, and load and run the application program by the boot program; S3: Monitor the random access memory (RAM) status of the running boot program and application program respectively for fault diagnosis, implement fault isolation by switching the bits of the system status register through ground commands, and implement reconstruction and repair through the on-orbit programming function of the boot program.

[0022] This embodiment is applied to an on-board computer system. The boot program and the application program are stored separately in the system. When powered on, the boot program is first loaded and run, and then the application program is loaded and run by the boot program.

[0023] Among them, in step S1, in addition to the programmable read-only memory (PROM), a copy of the boot program is redundantly stored in the software-programmable non-volatile memory. Specifically, the software-programmable non-volatile memory includes but is not limited to electrically erasable programmable read-only memory (EEPORM), non-volatile flash memory (Nor Flash), or magnetoresistive random access memory (MRAM). When on-orbit reconfiguration is required, the program code stored therein can be modified through software on-orbit programming.

[0024] In addition, the boot programs in the programmable read-only memory (PROM) and the software-programmable non-volatile memory both have the basic functions of the boot program, including the application program loading and guiding function and the on-orbit programming function, and have different memory mapping configuration parameters, corresponding to different physical address spaces of the random access memory (RAM).

[0025] Figure 2shows the process and storage topology of the traditional on - board computer loader, while Figure 3 is the flow and topology of the loader provided in this embodiment. By comparison, in addition to storing a copy of the bootloader in the programmable read - only memory (PROM), the system design redundantly stores a bootloader with the same function but different running spaces in the software - programmable electrically erasable programmable read - only memory (EEPROM). The bootloader stored in the PROM runs in the static random - access memory (SRAM), and the bootloader stored in the EEPROM runs in the synchronous dynamic random - access memory (SDRAM).

[0026] It should be noted that the running space of the bootloader stored in the EEPROM can also be the same as that of the bootloader in the PROM, which can be specified by the configuration parameters in the EEPROM.

[0027] After the system is reset, first run the bootloader self - boot function code in the programmable read - only memory (PROM). In this embodiment, the bootloader self - boot function code is the entry of the bootloader. When the system is powered on or reset, it automatically jumps to this address and directly runs in the secure programmable read - only memory (PROM), without relying on the random - access memory (RAM) space. Among them, only the bootloader stored in the PROM has the bootloader self - boot function code. [[ID=A]]

[0028] Then, select the corresponding bootloader for loading and running according to the system status register. Specifically, the bootloader selection status bit of the system status register is converted from the relay switch state, and the switching of the relay state is directly controlled by the command sent from the ground. Under normal circumstances, the system status register defaults to selecting to load the bootloader in the programmable read - only memory (PROM) into the corresponding RAM for running; Before loading the bootloader, perform an integrity check on the bootloader code. When the check fails, trigger the system automatic reset mechanism.

[0029] In this embodiment, as Figure 3 shown, the physical address of the PROM storing the bootloader is the system startup address. When the system is powered on or reset, it automatically jumps to this address to run. The beginning of the PROM stores the bootloader self - boot function code, which is implemented by assembly code without function calls and no stack space. By reading the bootloader selection status bit in the system status register, it is determined whether to load the bootloader in the PROM into the SRAM for running or load the bootloader in the EEPROM into the SDRAM for running.

[0030] The bootloader selection status bit of the system status register is acquired by the FPGA from the operating voltage of the relay, and the switch state of the relay is controlled by a direct command sent from the ground. When the relay is closed, the relay voltage is high, the bootloader selection status bit is 1, and the bootloader selects to load the bootloader in the PROM into the SRAM for operation; when the relay is open, the relay voltage is low, the bootloader selection status bit is 0, and the bootloader selects to load the bootloader in the EEPROM into the SDRAM for operation. Under normal circumstances, the relay state is closed, that is, it is default to select to load the bootloader in the PROM into the SRAM for operation.

[0031] Furthermore, the random access memory (RAM) status during the operation of the bootloader and the application program is monitored respectively for fault diagnosis. When a fault occurs in the RAM where the bootloader is running or a switch is required, a command is sent from the ground to change the system status register bit.

[0032] Specifically, when a fault occurs in the RAM where the bootloader is running, resulting in the inability of the bootloader to run, or when another bootloader needs to be run for other reasons (such as the bootloader stored in the software-programmable non-volatile memory has been on-orbit programmed and upgraded), a direct command is sent from the ground to switch the bootloader selection status bit of the system status register.

[0033] In this embodiment, as Figure 3 shown, when the ground determines that the SRAM where the bootloader is running has failed and the operation fails, a direct command is sent to switch the relay to the open state. When the system is reset and the bootloader self-boot function code in the PROM is run, and the system status is judged, where the bootloader selection status bit is 0, then the bootloader in the EEPROM is selected to be loaded into the SDRAM for normal operation, achieving fault isolation for the SRAM.

[0034] When the ground needs to improve the function of the bootloader, the bootloader code stored in the EEPROM can be replaced first through the on-orbit programming function, and then a direct command is sent to switch the relay to the open state. When the system is reset and the bootloader self-boot function code in the PROM is run, and the system status is judged, where the bootloader selection status bit is 0, then the upgraded bootloader in the EEPROM is selected to be loaded into the SDRAM for operation.

[0035] Next, the random access memory (RAM) during the operation of the application program is monitored. If a fault occurs in the random access memory where the application program is running, resulting in the inability of the application program to run: Through the on-orbit programming function of the bootloader, an application program running in another random access memory (RAM) space is uploaded to replace the original application program and stored in the software-programmable non-volatile memory, or, Enable pre-redundant storage of a standby application running in another random access memory (RAM) space; The bootloader selects and loads the application stored in the software-programmable non-volatile memory into the corresponding RAM space for operation according to the configuration parameters.

[0036] In this embodiment, as Figure 3 shown, the system is designed to use three EEPROMs to store three identical primary applications. By default, the bootloader loads two out of three into the SRAM for operation. Additionally, one EEPROM is redundantly designed to store the standby application. The backup application has the same function as the primary application but runs in the SDRAM. Each EEPROM stores the corresponding application configuration parameters, including information such as the program running start address, length, and checksum. When the SRAM fails and causes the primary application to fail, the bootloader can load the backup application stored in the EEPROM into the SDRAM for operation; or the bootloader can replace the primary application code and configuration parameters stored in the EEPROM through the on-orbit programming function. The bootloader selects and loads the application to the corresponding RAM address for operation according to the ground command and configuration parameters.

[0037] In addition, the method provided in this embodiment further includes: When the bootloader stored in the programmable read-only memory (PROM) has the basic loading and boot functions and on-orbit programming functions, the bootloader is pre-cured. If other functions need to be added to modify the bootloader, the bootloader in the software-programmable non-volatile memory can be modified through ground commands or on-orbit programming to add other functions of the bootloader. The bootloader stored in the PROM has relatively simple and general functions, is not prone to errors, and the program object code can be controlled within one PROM (usually about 32KB). This can not only shorten the development time of the boot software, quickly determine the program status and cure it, but also save the storage cost of expensive PROM devices.

[0038] Through the above method, the problem that the entire on-board computer fails due to the failure of the on-board computer RAM chip and the failure of the bootloader to run is solved. By using the method provided by the present invention, program running space redundancy and fault isolation are achieved, ensuring that the bootloader can still run normally after some RAM devices fail, implementing the on-orbit fault diagnosis and reconstruction and repair functions of the system, and improving the reliability and safety of the system during long-term on-orbit operation.

[0039] This embodiment also provides a program boot system with an on-orbit reconfigurable running space, including: A redundant storage management module for storing a copy of the bootloader in the programmable read-only memory (PROM) and the software-programmable non-volatile memory of the on-board computer system; A boot loading control module, which, after the system is reset, first runs the boot function code of the programmable read-only memory (PROM), selects a corresponding boot program according to the system status register for loading and running, and loads and runs the application program by the boot program. A monitoring and reconstruction repair module, which is used to respectively monitor the random access memory (RAM) status during the running of the boot program and the application program for fault diagnosis, realize fault isolation by switching the bits of the system status register through ground instructions, and realize reconstruction and repair through the in-orbit programming function of the boot program.

[0040] It should be noted that the steps in the program boot method with in-orbit reconfigurable running space provided in this embodiment can be implemented by using corresponding modules, devices, units, etc. in the on-board computer system. Those skilled in the art can refer to the technical solutions of the system to implement the step flow of the method. That is, the embodiments in the system can be understood as the preferred examples for implementing the method, and will not be elaborated here.

[0041] In addition to implementing the system and its various devices provided by the present invention in the form of pure computer-readable program codes, the method steps can be logically programmed to enable the system and its various devices provided by the present invention to be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers, etc. to achieve the same functions. Therefore, the system and its various devices provided by the present invention can be regarded as a hardware component, and the devices included therein for implementing various functions can also be regarded as the structures within the hardware component; the devices for implementing various functions can also be regarded as both software modules for implementing the method and the structures within the hardware component.

[0042] Finally, it should be noted that the above are only the preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions falling within the idea of the present invention belong to the protection scope of the present invention. It should be pointed out that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements should also be regarded as the protection scope of the present invention.

[0043] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope recorded in this specification.

Claims

1. A program guiding method with an on-orbit reconfigurable operating space, characterized in that The steps are as follows: S1: Store a copy of the boot program in each of the programmable read-only memory (PROM) and the software-programmable non-volatile memory of the on-board computer system; S2: After the system resets, first run the boot function code of the boot program in the programmable read-only memory (PROM), select the corresponding boot program for loading and running according to the system status register, and load and run the application program by the boot program; S3: Monitor the random access memory (RAM) status of the boot program and the application program running for fault diagnosis, realize fault isolation by switching the system status register bit through ground commands, and realize reconstruction and repair through the on-orbit programming function of the boot program.

2. The program guiding method with an orbit-reconfigurable operating space according to claim 1, characterized in that, In step S1, storing a copy of the boot program in each of the programmable read-only memory (PROM) and the software-programmable non-volatile memory of the on-board computer system further includes: The software-programmable non-volatile memory includes, but is not limited to, electrically erasable programmable read-only memory (EEPROM), non-volatile flash memory (Nor Flash), or magnetoresistive random access memory (MRAM); The boot programs in the programmable read-only memory (PROM) and the software-programmable non-volatile memory both have the basic functions of the boot program, including the application program loading and boot function and the on-orbit programming function, and at the same time have different memory mapping configuration parameters, corresponding to different physical address spaces of the random access memory (RAM).

3. The program guiding method with an orbit-reconfigurable operating space according to claim 1, characterized in that, In step S2, the running of the boot function code of the boot program in the programmable read-only memory (PROM) further includes: The boot function code is the entry of the boot program. When the system is powered on or reset, it automatically jumps to this address and directly runs in the secure programmable read-only memory (PROM), without relying on the random access memory (RAM) space.

4. The program guiding method with an orbit-reconfigurable operating space according to claim 1, characterized in that, In step S2, selecting the corresponding boot program for loading and running according to the system status register further includes: The boot program selection status bit of the system status register is converted from the relay switch state, and the switching of the relay state is directly controlled by the ground-sent command. By default, the system status register selects to load the boot program in the programmable read-only memory (PROM) into the corresponding RAM for running; Perform integrity verification on the boot program code before loading the boot program. When the verification fails, trigger the system automatic reset mechanism.

5. The program guiding method with an on-orbit reconfigurable operating space according to claim 1, characterized in that In step S3, realizing fault isolation by switching the system status register bit through ground commands further includes: Monitor the random access memory (RAM) where the boot program runs. If the random access memory where the boot program runs fails and causes the boot program to be unable to run, or it is necessary to switch to run another boot program, send a command from the ground to switch the boot program selection status bit of the system status register.

6. The program guiding method with an on-orbit reconfigurable operating space according to claim 1, characterized in that In step S3, realizing reconstruction and repair through the on-orbit programming function of the boot program further includes: Monitor the random access memory (RAM) where the application program runs. If the random access memory where the application program runs fails and causes the application program to be unable to run: Through the in-orbit programming function of the bootstrap program, upload an application program running in the random access memory (RAM) space of another chip to replace the original application program, and store it in the software-programmable non-volatile memory, or, Enable a standby application program redundantly stored in the random access memory (RAM) space of another chip; The bootstrap program selects and loads the application program in the software-programmable non-volatile memory into the corresponding random access memory (RAM) space for running according to the configuration parameters.

7. The program guiding method with an on-orbit reconfigurable operating space according to any one of claims 1-6, characterized in that, It further includes: When the bootstrap program stored in the programmable read-only memory (PROM) has the basic loading and booting function and in-orbit programming function, the bootstrap program is pre-cured, and then the bootstrap program in the software-programmable non-volatile memory is modified through ground instructions or in-orbit programming to add other functions of the bootstrap program.

8. A program guidance system with an orbit-reconfigurable operating space, characterized in that, It includes: A redundant storage management module for storing a copy of the bootstrap program in each of the programmable read-only memory (PROM) and the software-programmable non-volatile memory of the on-board computer system; A boot loading control module for, after the system is reset, first running the bootstrap function code in the programmable read-only memory (PROM), selecting the corresponding bootstrap program for loading and running according to the system status register, and loading the application program for running by the bootstrap program; A monitoring, reconstruction and repair module for respectively monitoring the random access memory (RAM) status of the bootstrap program and the application program running, realizing fault isolation by switching the system status register bits through ground instructions, and realizing reconstruction and repair through the in-orbit writing function of the bootstrap program.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, The program includes a bootstrap program and an application program, and when executed by a processor, realizes the program boot method with on-orbit reconfigurable running space as described in any one of claims 1-7.

10. An electronic device, characterized in that, It includes: One or more processors; A storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, enabling the one or more processors to realize the program boot method with on-orbit reconfigurable running space as described in any one of claims 1-7.

Images