Satellite computer multi-stage fault-tolerant starting method

Abstract

The application relates to the technical field of spacecraft electronic systems and discloses a multi-stage fault-tolerant starting method for a satellite-borne computer. BOOT The method comprises the following steps: in step 1, a management FPGA reads a BIOS startup source identification bit of a register, and a main BIOS storage address or a backup BIOS storage address is selected according to the identification bit value; in step 2, the management FPGA starts a BIOS-level watchdog timer corresponding to the BIOS storage address, and the timer length is configured by the BIOS register; in step 3, when the BIOS-level watchdog timer times out without receiving a reset signal, the management FPGA modifies the BIOS register of the startup source identification bit, and a system reset signal is generated. WDT The method comprises the following steps: in step 1, a management FPGA reads a BIOS startup source identification bit of a register, and a main BIOS storage address or a backup BIOS storage address is selected according to the identification bit value; in step 2, the management FPGA starts a BIOS-level watchdog timer corresponding to the BIOS storage address, and the timer length is configured by the BIOS register; in step 3, when the BIOS-level watchdog timer times out without receiving a reset signal, the management FPGA modifies the BIOS register of the startup source identification bit, and a system reset signal is generated. BOOT The method comprises the following steps: in step 1, a management FPGA reads a BIOS startup source identification bit of a register, and a main BIOS storage address or a backup BIOS storage address is selected according to the identification bit value; in step 2, the management FPGA starts a BIOS-level watchdog timer corresponding to the BIOS storage address, and the timer length is configured by the BIOS register; in step 3, when the BIOS-level watchdog timer times out without receiving a reset signal, the management FPGA modifies the BIOS register of the startup source identification bit, and a system reset signal is generated. The application takes the management FPGA as a core, combines a dual-BIOS redundancy architecture and a multi-disk hot backup mechanism, solves the problem of system starting single-point failure caused by BIOS firmware code bit flip or starting disk physical damage, realizes autonomous fault-tolerant recovery of firmware and storage media, and improves the defect that the existing single-BIOS single-storage medium architecture cannot self-repair hardware failure.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of spacecraft electronic system, in particular to a multi-level fault-tolerant starting method of a satellite computer. BACKGROUND

[0002] As the core information processing and control unit of a spacecraft, the reliability and stability of a satellite computer during on-orbit operation directly determine the success or failure of a space mission. During on-orbit operation of a spacecraft, it faces the continuous challenges of space high-energy particle radiation, severe temperature alternation, and high vacuum, etc. These factors are extremely prone to induce transient or permanent failure of the computer hardware, especially during the system startup phase. The startup process is the basis for the satellite computer to transition from the power-on state to the complete task execution capability. Any interruption of this process will result in the computer not working properly, which may further cause the mission failure of the satellite platform. Therefore, designing a fault-tolerant startup method that can resist various faults during the startup phase and has a high degree of autonomous recovery capability is of great significance to ensure the smooth implementation of long-period and high-reliability space missions. However, the existing technology still has the following shortcomings in realizing the reliable startup of a satellite computer:

[0003] The existing satellite computer system has a key single-point failure risk during the startup phase, mainly manifested in the lack of redundant design of the basic input / output system and storage medium. When encountering bit flipping of firmware code or physical damage of storage units caused by space radiation, the traditional single-image architecture will directly cause the interruption of the system startup process, and cannot be autonomously recovered on-orbit. This defect seriously restricts the continuous operation capability of the electronic system in long-period space missions.

[0004] The traditional software watchdog mechanism has a monitoring timing vulnerability and cannot cover the initialization phase before the power-on to the operating system loading. When the bootloader has an exception, the system cannot trigger the fault diagnosis mechanism, and cannot start the backup component, resulting in the satellite computer entering an unrecoverable failure state at the early stage of startup.

[0005] The existing technology relies on ground measurement and control instructions for system recovery, but there is a significant delay in communication between the ground and deep space in deep space exploration missions. When the satellite computer abnormally restarts, the ground control center cannot respond in real time, resulting in an extended system recovery window period, which may miss the best fault handling opportunity and seriously affect the autonomous survival capability of the spacecraft in complex space environments.

[0006] The traditional three-module redundant design relies on the superposition of hardware to realize fault-tolerant function, resulting in a significant increase in the volume, weight, and power consumption of the satellite computer. This resource-intensive solution cannot meet the design limitations of modern miniaturized satellite platforms.

[0007] Therefore, the present application proposes a multi-level fault-tolerant starting method of a satellite computer to solve the above-mentioned problems. SUMMARY

[0008] In view of the deficiencies of the prior art, the present application provides a multi-level fault-tolerant starting method for a satellite computer to solve the problems in the background art.

[0009] To achieve the above object, the present application is implemented by the following technical scheme: a multi-level fault-tolerant starting method for a satellite computer, comprising:

[0010] Step 1, the management FPGA reads the BIOS BOOT The starting source identification bit of the register, according to the identification bit value, selects the main BIOS storage address or the backup BIOS storage address;

[0011] Step 2, the management FPGA starts the BIOS-level watchdog timer corresponding to the BIOS storage address, and the timer length is configured by the BIOS WDT Register;

[0012] Step 3, when the BIOS-level watchdog timer times out without receiving a reset signal, the management FPGA modifies the starting source identification bit of the BIOS BOOT Register, and generates a system reset signal;

[0013] Step 4, the management FPGA reads the starting disk number of the OS BOOT Register, and according to the number value, selects the physical address of the operating system starting disk;

[0014] Step 5, the management FPGA starts the OS-level watchdog timer corresponding to the starting disk number, and the timer length is configured by the OS WDT Register;

[0015] Step 6, when the OS-level watchdog timer times out without receiving a reset signal, the management FPGA updates the starting disk number of the OS BOOT Register, and generates a system reset signal;

[0016] Step 7, when the starting disk number of the OS BOOT Register is traversed without success, the management FPGA acquires the operating system image data of the PXE server through the inter-satellite network interface;

[0017] Step 8, the management FPGA writes the operating system image data into the storage medium corresponding to the current starting disk number, and restores the OS BOOT Register to the initial starting disk number;

[0018] Step 9, the management FPGA calculates the feature value of the written starting disk image, and performs consistency check with the reference feature value issued by the PXE server;

[0019] Step 10, the management FPGA records the current boot source identification bit, boot disk number and feature value check result in the ring buffer of the non-volatile memory.

[0020] Preferably, the OS BOOT The register is a 4-bit wide register, supporting 16-bit boot disk number cyclic switching, and the number increment operation is implemented by using modulo 16 addition;

[0021] The OS image data sent by the PXE server is transmitted in a block encryption manner, each 512-byte data block is encrypted using the AES-256 algorithm and is additionally provided with a 4-byte CRC check code.

[0022] Preferably, the ring log buffer adopts a cyclic coverage storage structure, has a total capacity of 1024 record items, and each record item contains an 8-byte Beidou timestamp, a 2-byte error code and a 6-byte state identification;

[0023] The state identification contains a 2-bit priority code and a 4-bit recovery strategy code, the priority code determines the proportion of inter-satellite network bandwidth allocation, and the recovery strategy code defines the number of image download retries.

[0024] Preferably, in step 1, the management FPGA reads the BIOS BOOT register, selects a main BIOS storage address or a backup BIOS storage address according to the identification bit value, and further comprises:

[0025] Substep 1.1, after receiving a system power-on instruction, the management FPGA accesses the BIOS BOOT register at an internal address of 0x0000, reads a 1-bit wide boot source identification bit V boot ;

[0026] Substep 1.2, the management FPGA calculates a target BIOS physical address A boot according to the read boot source identification bit V target by the following formula:

[0027] A target = (1-V boot )·A main +V boot ·A backup ,

[0028] wherein A target is the final selected physical address for loading firmware, V boot is the value of the boot source identification bit, A main is the physical base address of the preset main BIOS storage chip, and A backup is the physical base address of the preset backup BIOS storage chip.

[0029] Sub-step 1.3, the management FPGA places the calculated target BIOS physical address A target on the system address bus, and drives the address decoding logic to generate a chip select enable signal CS target to initiate the firmware loading process of the corresponding memory chip; enable

[0030] In step 2, the management FPGA starts a BIOS-level watchdog timer corresponding to the BIOS storage address, and the timer duration is configured by the BIOS WDT register, further comprising:

[0031] Sub-step 2.1, after determining the target BIOS physical address A target , the management FPGA accesses the BIOS WDT register at internal address 0x0008 to read an 8-bit unsigned integer as a watchdog timeout configuration value V wdt ;

[0032] Sub-step 2.2, the management FPGA calculates the BIOS-level watchdog timeout T wdt in seconds according to the read watchdog timeout configuration value V bios :

[0033] T bios = V wdt · T unit ,

[0034] where T bios is the final timeout time of the BIOS-level watchdog timer, V wdt is the 8-bit unsigned integer value read by the BIOS WDT register, and T unit is a preset base time unit constant;

[0035] Sub-step 2.3, after calculating the timeout T bios in seconds, the management FPGA determines whether the timeout T bios in seconds satisfies a preset valid time range condition C valid ,

[0036] If the condition C valid is true, load the timeout T bios in seconds into the hardware timer and start it,

[0037] If the condition C valid is false, load a preset default timeout T default in seconds into the hardware timer and start it, and the calculation formula of the condition C valid is:​

[0038] C valid = (T bios ≥ T min ) Λ (T bios ≤ T max ),

[0039] wherein C valid is a Boolean validity judgment result, T min is the minimum watchdog timeout allowed by the system, and T max is the maximum watchdog timeout allowed by the system.

[0040] Preferably, in step 3, when the BIOS-level watchdog timer expires without receiving a reset signal, the management FPGA modifies the boot source identification bit of the BIOS BOOT register to generate a system reset signal, further comprising:

[0041] Sub-step 3.1, the management FPGA detects the timeout interrupt signal sent by the hardware timer when the count value of the hardware timer reaches the timeout T bios ;

[0042] Sub-step 3.2, the management FPGA reads the current boot source identification bit V BOOT of the BIOS current register after detecting the timeout interrupt signal, and accesses the non-volatile memory to obtain the BIOS boot failure count F current associated with the boot source identification bit V count ;

[0043] Sub-step 3.3, the management FPGA determines whether the BIOS switching condition C count is met according to the read BIOS boot failure count F switch by the following formula:

[0044] C switch = (F count < F max ),

[0045] wherein C switch is a Boolean switching condition judgment result, F count is the number of consecutive failures of the current BIOS boot source, and F max is the maximum number of consecutive failures allowed by a single BIOS source;

[0046] Sub-step 3.4, when the determination result of the BIOS switching condition C switch is true, the management FPGA modifies the current boot source identification bit V currentPerform a bit-flipping operation to calculate the new boot source identifier bit V. new Then the new boot source identifier V will be set. new Write to the BIOS BOOT The register ultimately generates the system reset signal.

[0047] Preferably, in step 4, the FPGA is managed to read the OS. BOOT The register's boot disk number, used to select the physical address of the operating system boot disk, further includes:

[0048] Sub-step 4.1: After the BIOS is successfully loaded and control is transferred, the FPGA accesses the OS at internal address 0x0004. BOOT The register was used to read the 4-bit boot disk ID. os ;

[0049] Sub-step 4.2, the FPGA management system reads the boot disk ID. os The physical address A of the target operating system boot disk is calculated using the following formula. os :

[0050] A os =A base +ID os ·S partition ,

[0051] Among them, A os A is the final selected physical address of the boot disk used to load the operating system. base The physical base address of the preset operating system storage area, ID os For OS BOOT The 4-bit unsigned integer value read from the register, S partition The size of the address space occupied by a single operating system boot disk partition;

[0052] Sub-step 4.3: The FPGA calculates the physical address A of the target operating system boot disk. os Then, the physical address A is determined using the following formula. os Validity condition C valid :

[0053] C valid =(A os ≥A base )∧(A os base +N max ·S partition ),

[0054] Among them, C valid The result of the address validity judgment is a Boolean value, N.​max the maximum number of boot disks supported by the system;

[0055] Sub-step 4.4, when the determination result of the validity condition C valid is true, the management FPGA sets the physical address A os of the target operating system boot disk on the system address bus to start the operating system kernel loading process;

[0056] In step 5, the management FPGA starts the OS-level watchdog timer corresponding to the boot disk number, and the timer duration is configured by the OS WDT register, further comprising:

[0057] Sub-step 5.1, after issuing the operating system kernel loading instruction, the management FPGA accesses the OS WDT register at internal address 0x000C to read an 8-bit wide operating system watchdog timeout configuration value Vos wdt ;

[0058] Sub-step 5.2, the management FPGA calculates the OS-level watchdog timeout time Tos according to the read operating system watchdog timeout configuration value Vos wdt by the following formula:

[0059] Tos=Vos wdt ·T unit ,

[0060] wherein Tos is the final timeout time of the OS-level watchdog timer, Vos wdt is an 8-bit unsigned integer value read from the OS WDT register, and T unit is a preset operating system watchdog base time unit constant;

[0061] Sub-step 5.3, after calculating the timeout time Tos, the management FPGA determines whether the timeout time Tos satisfies the preset operating system valid time range condition C valid , if the condition C valid is true, the timeout time Tos is loaded into the hardware timer and started,

[0062] if the condition C valid is false, the preset operating system default timeout time Tos default is loaded into the hardware timer and started, and the calculation formula of the condition C valid is:

[0063] C valid =(Tos≥Tos min )∧(Tos≤Tos max ),

[0064] wherein C valid is a Boolean type validity judgment result, Tos min is the minimum operating system watchdog timeout seconds allowed by the system, Tos max is the maximum operating system watchdog timeout seconds allowed by the system.

[0065] Preferably, in the step 6, when the OS-level watchdog timer expires without receiving a reset signal, the management FPGA updates the OS BOOT register with the boot disk number, generates a system reset signal, and further comprises:

[0066] Sub-step 6.1, the management FPGA detects an operating system level timeout interrupt signal issued by the hardware timer when the count value of the OS-level hardware timer reaches the timeout seconds Tos;

[0067] Sub-step 6.2, after detecting the operating system level timeout interrupt signal, the management FPGA accesses the OS BOOT register at the internal address 0x0004, reads the 4-bit wide current boot disk number ID current ;

[0068] Sub-step 6.3, the management FPGA calculates the next boot disk number ID current according to the read current boot disk number ID next by the following formula:

[0069] ID next = (ID current + 1) and (mod N total ),

[0070] wherein ID next is the updated next boot disk number to be tried, ID current is the current boot disk number read by the OS BOOT register, and N total is the total number of boot disks;

[0071] Sub-step 6.4, the management FPGA writes the calculated next boot disk number ID next to the OS BOOT register, and finally generates a system reset signal to use the next boot disk number ID next for the next boot attempt.

[0072] Preferably, in the step 7, when the OS BOOTThe boot disk number of the register is not successfully loaded, the management FPGA obtains the operating system image data of the PXE server through the inter-satellite network interface, and further comprises:

[0073] Sub-step 7.1, after the system reset signal generated by the OS-level watchdog timer timeout, the management FPGA reads the OS BOOT Register current boot disk number ID current , determines the local boot disk traversal completion condition C traverse Whether to establish:

[0074] C traverse = ((ID current +1)(mod N total ) = ID initial ),

[0075] Where C traverse is a Boolean traversal completion determination result, ID current is the current boot disk number read by the OS BOOT Register, N total is the total number of boot disks, and ID initial is the initial boot disk number;

[0076] Sub-step 7.2, when the determination result of the local boot disk traversal completion condition C traverse is true, the management FPGA broadcasts a PXE discovery request message on a preset network channel through the inter-satellite network interface;

[0077] Sub-step 7.3, after broadcasting the PXE discovery request message, the management FPGA listens to and collects all PXE response messages within a preset response waiting time T wait , determines a unique PXE server from the PXE response message according to a preset server selection strategy;

[0078] Sub-step 7.4, the management FPGA extracts the PXE server network address A pxe and the operating system image file name F image from the response message sent by the unique PXE server, and sends a data acquisition request to the PXE server network address A pxe for the operating system image file name F image to obtain the operating system image data;

[0079] In the step 8, the management FPGA writes the operating system image data into the storage medium corresponding to the current boot disk number, and restores the OS BOOT Register to the initial boot disk number, further comprising:

[0080] Sub-step 8.1: After the FPGA obtains the operating system image data from the unique PXE server, it designates the last boot disk number before the local boot disk traversal is completed as the faulty boot disk number ID to be repaired. fault ;

[0081] Sub-step 8.2, the FPGA management system uses the fault boot disk number ID. fault The starting physical address A of the target storage medium used to write the operating system image data is calculated using the following formula. write :

[0082] A write =A base +ID fault ·S partition ,

[0083] Among them, A write The starting physical address for writing the operating system image data, A base The physical base address of the preset operating system storage area, ID fault S is the number of the faulty boot disk currently awaiting repair. partition The size of the address space occupied by a single operating system boot disk partition;

[0084] Sub-step 8.3: The FPGA manages the operating system image data in blocks, decrypting each received encrypted data block to obtain a plaintext data block. Based on the plaintext data block and the accompanying checksum, the data block writing condition C is determined using the following formula. write Is it true or false?

[0085] C write =(Func CRC (B plain ) = B crc ),

[0086] Among them, C write Write the conditional decision result to a Boolean data block, Func CRC (·) represents the preset cyclic redundancy check function, B plain For plaintext data blocks, B crc This is a verification code;

[0087] Sub-step 8.4, when the data block is written under condition C write When the determination result is true, the management FPGA writes the plaintext data block to the target storage medium starting at physical address A. write The specified contiguous storage space, and after all data blocks have been successfully written, will be used to store the OS. BOOTThe boot disk number in the register is reset to the initial boot disk number ID initial .

[0088] Preferably, in step 9, the management FPGA performs consistency check on the feature value of the written boot disk image and the reference feature value issued by the PXE server, further comprising:

[0089] Sub-step 9.1, the management FPGA initiates the physical address A write of the target storage medium after completing the write operation on all the plaintext data blocks image . written ;

[0090] Sub-step 9.2, the management FPGA applies a preset feature value calculation function Func feature to the written image copy M written to generate a locally calculated boot disk image feature value F local by the following formula:

[0091] F local =Func feature (M written ),

[0092] wherein F local is the feature value calculated according to the written image copy, Func feature is a function for mapping data blocks of arbitrary length to fixed length feature values, and M written is the operating system image data read completely from the target storage medium;

[0093] Sub-step 9.3, the management FPGA extracts the reference feature value F baseline obtained by the unique PXE server, and determines the image write consistency check condition C verify according to the reference feature value F baseline and the locally calculated boot disk image feature value F local by the following formula, and takes the Boolean result of the consistency check condition C verify as the feature value check result:

[0094] C verify =(F local ==F baseline ),

[0095] wherein C verify is the Boolean consistency check determination result, F local is the locally calculated boot disk image feature value, and F baselineThese are the baseline feature values ​​used for comparison, obtained from a single PXE server.

[0096] Preferably, in step 10, the management FPGA records the current boot source identifier, boot disk number, and feature value verification result in a circular buffer of non-volatile memory, further including:

[0097] Sub-step 10.1: Manage the FPGA after obtaining the image write consistency verification condition C. verify Then, obtain the BeiDou time-indicated TS bytes. bds According to the consistency check condition C verify The Boolean result is obtained through a preset error mapping table M. error Error code E for determining bytes code At the same time, combine the preset bit priority code P code And bit recovery strategy code R code The state identifier S formed by the bytes id ;

[0098] Sub-step 10.2: The FPGA is managed to read the current circular log buffer write pointer I from the preset address of the non-volatile memory. write Combined with the aforementioned BeiDou time standard TS bds The error code E code and the status identifier S id The current boot source identifier and the faulty boot disk ID will be set. fault The feature value verification results are encapsulated into a package with a total capacity of S. log single record item R log ;

[0099] Sub-step 10.3: The FPGA writes pointer I according to the read circular log buffer. write The single record item R is calculated using the following formula. log The target is written to physical address A log :

[0100]

[0101] Among them, A log The physical address to be written to the target of a single record entry in non-volatile memory. I is the physical base address of the circular log buffer. write S is the index number of the current log record. log The fixed byte length for a single record item;

[0102] Sub-step 10.4: The FPGA manages the single record item R. log Completely write physical address A by the targetlog After the specified position, the updated next annular log buffer write pointer is calculated by the following modulo addition formula

[0103]

[0104] wherein, is the index number of the updated next log record, is the total record item capacity supported by the annular log buffer;

[0105] Sub-step 10.5, the management FPGA writes the value of the calculated next annular log buffer write pointer back to the preset address of the non-volatile memory for subsequent record operation. Sub-step 10.5, the management FPGA writes the value of the calculated next annular log buffer write pointer back to the preset address of the non-volatile memory for subsequent record operation.

[0106] The present application provides a multi-level fault-tolerant starting method for a satellite computer. The following advantages are provided:

[0107] 1. The present application takes the management FPGA as the core, combines the dual-BIOS redundant architecture and the multi-disk hot standby mechanism, solves the single-point failure problem of system starting caused by BIOS firmware code bit flip or physical damage of the starting disk, realizes autonomous fault-tolerant recovery of firmware and storage medium, and improves the defect that the existing single-BIOS single storage medium architecture cannot repair hardware failure.

[0108] 2. The present application realizes whole-process monitoring of the system from power-on to stable operation of the operating system through the dual-watchdog mechanism controlled by the management FPGA combined with the hierarchical timeout strategy, solves the monitoring blind area problem of the traditional software watchdog in the BIOS boot stage, ensures complete monitoring of the starting chain and timely fault handling, and improves the reliability of the boot loader.

[0109] 3. The present application realizes autonomous recovery by combining the multi-disk starting strategy and the network layer regeneration mechanism, automatically triggers PXE for system reinstallation and recovery through inter-satellite link in the case of failure of all local starting disks, solves the problem that ground instructions cannot be timely intervened due to communication delay in deep space exploration, realizes on-orbit fault self-healing without relying on ground instructions, compared with the prior art, shortens the recovery period, and improves the autonomous survival ability of the spacecraft.

[0110] 4. The present application uses a lightweight FPGA as the core, realizes logical redundancy and intelligent switching of components such as dual-BIOS and multi-starting disks, reduces system overhead and provides high reliability, solves the high overhead problem of traditional triple modular redundancy design in terms of volume, weight and power consumption, realizes high-performance system fault tolerance, overcomes the resource-intensive problem caused by hardware resource stacking in the prior art, and meets the design limitations of modern miniaturized satellite platforms. BRIEF DESCRIPTION OF DRAWINGS

[0111] Figure 1 is a flow chart of the present application;

[0112] Figure 2 is a system architecture diagram of the present application;

[0113] Figure 3 is a dual watchdog monitoring timing diagram of the present application;

[0114] Figure 4 is a primary and standby BIOS switching flow chart of the present application;

[0115] Figure 5 is a multi-disk startup and PXE switching logic flow chart of the present application. DETAILED DESCRIPTION

[0116] In order for those skilled in the art to understand the technical solutions of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, other embodiments obtained by those skilled in the art without creative labor should be within the scope of protection of the present application.

[0117] The present application will be described in detail below in conjunction with the accompanying drawings:

[0118] Embodiment 1, the present application provides a multi-level fault-tolerant startup method for a satellite computer, characterized in that it comprises:

[0119] Step 1, the management FPGA reads the BIOS BOOT of the register, and selects the primary BIOS storage address or the standby BIOS storage address according to the value of the identification bit;

[0120] Substep 1.1, the management FPGA accesses the BIOS BOOT register at an internal address of 0x0000 after receiving a system power-on instruction, reads a 1-bit wide startup source identification bit V boot ;

[0121] Substep 1.2, the management FPGA calculates the target BIOS physical address A boot according to the read startup source identification bit V target by the following formula:

[0122] A target = (1-V boot )·A main +V boot ·A backup ,

[0123] wherein A targetV is the final selected physical address for loading the firmware. boot The value of the startup source flag, A main A is the preset physical base address of the main BIOS memory chip. backup The default physical base address of the backup BIOS storage chip;

[0124] Sub-step 1.3: The FPGA will calculate the target BIOS physical address A. target Placed on the system address bus, based on the target BIOS physical address A target Drive the address decoding logic to generate the chip select enable signal CS. enable This initiates the firmware loading process for the corresponding storage chip.

[0125] Step 2: Manage the FPGA startup and the BIOS-level watchdog timer corresponding to the BIOS memory address. The timer duration is determined by the BIOS. WDT Register configuration;

[0126] Sub-step 2.1, managing the FPGA to determine the target BIOS physical address A target Then, access the BIOS at internal address 0x0008. WDT The register reads an 8-bit unsigned integer as the watchdog timeout configuration value V. wdt ;

[0127] Sub-step 2.2: The FPGA is managed based on the read watchdog timeout configuration value V. wdt The timeout duration T of the BIOS-level watchdog timer is calculated using the following formula. bios :

[0128] T bios =V wdt ·T unit ,

[0129] Among them, T bios V is the final timeout period for the BIOS-level watchdog timer. wdt For BIOS WDT The 8-bit unsigned integer value read from the register, T unit These are preset basic time unit constants;

[0130] Sub-step 2.3: Manage the FPGA after calculating the timeout in seconds T. bios Then, determine the timeout period T in seconds. bios Does it meet the preset valid time range condition C? valid ,

[0131] If condition C valid If true, the timeout period in seconds will be T. bios Load and start the hardware timer.

[0132] If condition C valid is false, preset default timeout seconds T default is loaded into the hardware timer and started, and condition C valid is calculated as follows:

[0133] C valid = (T bios ≥ T min ) Λ (T bios ≤ T max ),

[0134] where C valid is a Boolean validity determination result, T min is the minimum watchdog timeout seconds allowed by the system, and T max is the maximum watchdog timeout seconds allowed by the system.

[0135] Step 3, when the BIOS-level watchdog timer times out without receiving a reset signal, the management FPGA modifies the start source identification bit of the BIOS BOOT register to generate a system reset signal.

[0136] Sub-step 3.1, the management FPGA detects the timeout interrupt signal sent by the hardware timer when the count value of the hardware timer reaches the timeout seconds T bios .

[0137] Sub-step 3.2, after detecting the timeout interrupt signal, the management FPGA reads the current start source identification bit V BOOT of the BIOS current register and accesses the non-volatile memory to obtain the BIOS startup failure count value F current associated with the start source identification bit V count .

[0138] Sub-step 3.3, the management FPGA determines whether the BIOS switching condition C count is met according to the read BIOS startup failure count value F switch by the following formula:

[0139] C switch = (F count < F max ),

[0140] where C switch is a Boolean switching condition determination result, F count is the number of consecutive failures of the current BIOS start source, and F max is the maximum number of consecutive failures allowed by a single BIOS source.

[0141] Sub-step 3.4, when the determination result of BIOS switching condition C switch is true, the management FPGA performs a bit flip operation on the current boot source identification bit V current to calculate a new boot source identification bit V new , and then writes the new boot source identification bit V new into the BIOS BOOT register, finally generating a system reset signal;

[0142] Step 4, the management FPGA reads the boot disk number of the OS BOOT register, and selects the physical address of the operating system boot disk according to the number value;

[0143] Sub-step 4.1, after the management FPGA successfully loads the BIOS and hands over the control right, it accesses the OS BOOT register at internal address 0x0004, reads the 4-bit wide boot disk number ID os ;

[0144] Sub-step 4.2, the management FPGA calculates the physical address A os of the target operating system boot disk according to the read boot disk number ID os by the following formula:

[0145] A os = A base + ID os · S partition ,

[0146] wherein A os is the final selected boot disk physical address for loading the operating system, A base is the preset physical base address of the operating system storage area, ID os is the 4-bit unsigned integer value read by the OS BOOT register, and S partition is the address space size occupied by the single operating system boot disk partition;

[0147] Sub-step 4.3, after the management FPGA calculates the physical address A os of the target operating system boot disk, it determines the validity condition C os of the physical address A valid by the following formula:

[0148] C valid = (A os ≥ A base ) ∧ (A os < A base + N max · S partition ),

[0149] wherein C valid is a Boolean result of the address validity judgment, N max is the maximum number of boot disks supported by the system;

[0150] Sub-step 4.4, when the result of the judgment of the validity condition C valid is true, the management FPGA sets the physical address A os of the target operating system boot disk on the system address bus to start the loading process of the operating system kernel.

[0151] Step 5, the management FPGA starts the OS-level watchdog timer corresponding to the boot disk number, and the timer duration is configured by the OS WDT register;

[0152] Sub-step 5.1, after issuing the operating system kernel loading instruction, the management FPGA accesses the OS WDT register at the internal address 0x000C to read the 8-bit wide operating system watchdog timeout configuration value Vos wdt ;

[0153] Sub-step 5.2, the management FPGA calculates the timeout seconds Tos of the OS-level watchdog according to the read operating system watchdog timeout configuration value Vos wdt by the following formula:

[0154] Tos = Vos wdt · T unit ,

[0155] wherein Tos is the final timeout time of the OS-level watchdog timer, Vos wdt is the 8-bit unsigned integer value read from the OS WDT register, and T unit is a preset operating system watchdog base time unit constant;

[0156] Sub-step 5.3, after calculating the timeout seconds Tos, the management FPGA judges whether the timeout seconds Tos satisfies the preset operating system valid time range condition C valid , if the condition C valid is true, the timeout seconds Tos is loaded into the hardware timer and started,

[0157] if the condition C valid is false, the preset operating system default timeout seconds Tos default is loaded into the hardware timer and started, and the calculation formula of the condition C valid is:

[0158] C valid = (Tos ≥ Tos min) ∧ (Tos ≤ Tos max ),

[0159] wherein C valid is a Boolean validity judgment result, Tos min is the minimum operating system watchdog timeout allowed by the system, and Tos max is the maximum operating system watchdog timeout allowed by the system;

[0160] Step 6, when the OS-level watchdog timer times out without receiving a reset signal, the management FPGA updates the boot disk number of the OS BOOT register and generates a system reset signal;

[0161] Sub-step 6.1, the management FPGA detects an operating system level timeout interrupt signal sent by the hardware timer when the count value of the OS-level hardware timer reaches the timeout second number Tos;

[0162] Sub-step 6.2, after detecting the operating system level timeout interrupt signal, the management FPGA accesses the OS BOOT register at the internal address 0x0004 to read the 4-bit wide current boot disk number ID current ;

[0163] Sub-step 6.3, the management FPGA calculates the next boot disk number ID current according to the read current boot disk number ID next by the following formula:

[0164] ID next = (ID current + 1) and (mod N total ),

[0165] wherein ID next is the updated next boot disk number to be tried, ID current is the current boot disk number read by the OS BOOT register, and N total is the total number of boot disks;

[0166] Sub-step 6.4, the management FPGA writes the calculated next boot disk number ID next into the OS BOOT register, finally generates a system reset signal to use the next boot disk number ID next for the next boot attempt;

[0167] Step 7, when the boot disk number of the OS BOOT register is traversed without successful loading, the management FPGA acquires the operating system image data of the PXE server through the interstellar network interface;

[0168] Sub-step 7.1: After the system reset signal generated due to the OS-level watchdog timer timeout is triggered, the FPGA reads the OS. BOOT Register the current boot disk ID current The following formula is used to determine the condition C for the local boot disk traversal to be completed. traverse Is it true or false?

[0169] C traverse =((ID) current +1)(mod N total ) = ID initial ),

[0170] Among them, C traverse The result of the traversal completion judgment is a boolean type, ID. current For OS BOOT The current boot disk number read from the register, N total Total number of boot disks, ID initial This is the preset initial boot disk number;

[0171] Sub-step 7.2, when the local boot disk traversal is complete under condition C traverse When the determination result is true, the management FPGA broadcasts a PXE discovery request message on a preset network channel through the inter-satellite network interface;

[0172] Sub-step 7.3: After the FPGA broadcasts the PXE discovery request message, it waits for a preset response time T. wait It listens to and collects all PXE response messages, and determines a unique PXE server from the PXE response messages according to the preset server selection strategy.

[0173] Sub-step 7.4: The FPGA management extracts the PXE server network address A from the response message sent by the unique PXE server. pxe and operating system image file name F image And to PXE server network address A pxe Send the filename F for the operating system image. image The data acquisition request is used to obtain operating system image data;

[0174] Step 8: The FPGA management module writes the operating system image data to the storage medium corresponding to the current boot disk number, thus transferring the OS... BOOT The registers were restored to the initial boot disk number;

[0175] Sub-step 8.2, manage the FPGA according to the fault boot disk number ID fault The starting physical address A of the target storage medium used to write the operating system image data is calculated using the following formula.write :

[0176] A write = A base + ID fault · S partition ,

[0177] wherein, A write is the start physical address of the operating system image data writing, A base is the preset physical base address of the operating system storage area, ID fault is the current fault startup disk number to be repaired, S partition is the address space size occupied by the single operating system startup disk partition;

[0178] Substep 8.3, the management FPGA processes the operating system image data in units of data blocks, decrypts each encrypted data block received to obtain a plaintext data block, and determines whether the data block writing condition C write is established according to the plaintext data block and the accompanying check code through the following formula:

[0179] C write = (Func CRC (B plain ) = B crc ),

[0180] wherein, C write is the Boolean data block writing condition determination result, Func CRC (·) is a preset cyclic redundancy check function, B plain is the plaintext data block, and B crc is the check code;

[0181] Substep 8.4, when the determination result of the data block writing condition C write is true, the management FPGA writes the plaintext data block into the continuous storage space specified by the target storage medium start physical address A write , and after all the data blocks are successfully written, resets the startup disk number in the OS BOOT register to the initial startup disk number ID initial ;

[0182] Step 9, the management FPGA calculates the feature value of the written startup disk image, and performs consistency check with the reference feature value issued by the PXE server;

[0183] Substep 9.1, the management FPGA starts from the target storage medium start physical address A write after completing the writing operation on all plaintext data blocks, reads a data block with a preset image size S image as the written image copy Mwritten ;

[0184] Sub-step 9.2, manage the FPGA application's preset feature value calculation function Func feature In the already written mirror copy M written A locally computed boot disk image feature value F is generated using the following formula. local :

[0185] F local =Func feature (M written ),

[0186] Among them, F local Func is the feature value calculated based on the written mirror copy. feature M is a deterministic function that maps data blocks of arbitrary length to eigenvalues ​​of fixed length. written This refers to the operating system image data that has been completely read from the target storage medium.

[0187] Sub-step 9.3: Manage the FPGA to extract the baseline feature value F obtained from the unique PXE server. baseline Based on the benchmark eigenvalue F baseline The characteristic value F of the boot disk image calculated locally local The following formula is used to determine the consistency check condition C for image writes. verify The consistency check condition C verify The Boolean result is used as the feature value verification result:

[0188] C verify =(F local ==F baseline ),

[0189] Among them, C verify The consistency check result is a Boolean value, F. local F is the characteristic value of the boot disk image calculated locally. baseline These are the baseline feature values ​​used for comparison, obtained from a single PXE server.

[0190] Step 10: The FPGA is managed to record the current boot source identifier, boot disk number, and feature value verification result in the non-volatile memory's circular buffer.

[0191] Sub-step 10.1, manage the FPGA to obtain the image write consistency verification condition C verify Then, obtain the BeiDou time-indicated TS bytes. bds According to the consistency check condition C verify The Boolean result is obtained through a preset error mapping table M. error Error code E for determining bytes codeAt the same time, combine the preset bit priority code P code And bit recovery strategy code R code The state identifier S formed by the bytes id ;

[0192] Sub-step 10.2: Manage the FPGA to read the current circular log buffer write pointer I from the preset address of the non-volatile memory. write Combined with BeiDou time standard TS bds Error code E code and status identifier S id Set the current boot source identifier and the faulty boot disk ID. fault The feature value verification results are encapsulated into a package with a total capacity of S. log single record item R log ;

[0193] Sub-step 10.3: The FPGA writes pointer I based on the read circular log buffer. write The R value for a single record item is calculated using the following formula. log The target is written to physical address A log :

[0194]

[0195] Among them, A log The physical address to be written to the target of a single record entry in non-volatile memory. I is the physical base address of the circular log buffer. write S is the index number of the current log record. log The fixed byte length for a single record item;

[0196] Sub-step 10.4, manage the FPGA to transfer a single record item R log Full write is performed by the target writing to physical address A. log After specifying the position, calculate the updated next circular log buffer write pointer using the following modular addition formula.

[0197]

[0198] in, This is the index number for the next log record after the update. The total number of records supported by the circular log buffer;

[0199] Sub-step 10.5: The FPGA will write the calculated next circular log buffer pointer. The value is written back to a preset address in the non-volatile memory for use in subsequent recording operations.

[0200] The advantage of step 1 is that, by introducing a startup source dynamic selection mechanism based on FPGA register configuration in the initial stage of system startup, the dependence on a single BIOS chip is eliminated from the hardware level, the redundant backup of the basic firmware is established, and it is ensured that even if the main BIOS is completely disabled due to physical damage or data corruption, the system can still complete the boot using the backup BIOS.

[0201] The advantage of step 2 is that, by configuring an independent watchdog timer with a flexible time length managed directly by FPGA hardware for the BIOS startup phase, the key blind area from system power-on to BIOS bootstrap completion that cannot be covered by traditional software watchdog is monitored throughout, and it is ensured that any suspension or exception occurring during this phase can be accurately captured.

[0202] The advantage of step 3 is that the BIOS-level watchdog timeout event is directly and rigidly associated with the modification of the startup source identification bit controlled by FPGA and the system reset operation, forming a closed-loop autonomous fault recovery logic without any software intervention, ensuring that after detecting the failure of the main BIOS startup, the system can automatically switch to the backup BIOS and attempt to restart at the fastest speed and highest reliability, realizing rapid fault isolation and recovery at the firmware level.

[0203] The advantage of step 4 is that the startup target of the operating system is expanded from a fixed single disk to a dynamically specified logical addressing scheme supporting multiple redundant disks by FPGA registers, which makes the system flexible in selecting the startup path among multiple physical storage media, effectively avoiding the risk of startup failure due to physical damage of a single system disk or file system crash, and is the basis for realizing fault tolerance at the operating system level.

[0204] The advantage of step 5 is that before the BIOS hands over control to the operating system, an independent OS-level watchdog is started for the entire process of loading the operating system, with a longer timeout tolerance than the BIOS level, and the differentiated monitoring strategy can handle complex time-consuming operations during the operating system initialization phase.

[0205] The advantage of step 6 is that by automatically performing a modulo addition increment on the startup disk number in the FPGA after the OS-level watchdog times out and triggering a restart, an orderly and automated local multi-disk startup polling mechanism is realized, which can sequentially traverse all available local system images without relying on any external intervention, maximize the use of local redundant resources to attempt to recover the system, and constitute the first line of defense for autonomous fault tolerance in orbit.

[0206] The step 7 has the advantage that when all local boot disks fail to try, the system can autonomously determine the exhaustion of local recovery resources, actively activate the network layer recovery mechanism, seamlessly connect from local fault tolerance to network recovery, provide the last survival path for the system when the local completely fails, and make the on-board computer have the fault recovery potential beyond the local hardware limit.

[0207] The step 8 has the advantage that a brand new operating system image is obtained and written through the automatic PXE process, the in-situ repair of all fault boot disks is realized, the boot disk number is reset to the initial state, the function of the single boot disk is restored, the local redundant backup capability of the system is restored to the full blood state, and a complete fault disposal and capability recovery closed loop is formed.

[0208] The step 9 has the advantage that a forced consistency check link based on the feature value comparison is added after the completion of the image writing, which ensures that the operating system image recovered through the network recovery mechanism is complete and correct, and effectively avoids the situation that the repaired boot disk cannot be used due to data transmission errors or writing abnormalities.

[0209] The step 10 has the advantage that the state information of each fault switching and recovery operation is solidified into the ring log of the non-volatile memory, which provides indispensable, detailed and continuous data records for the fault diagnosis and trend analysis of the ground personnel, greatly improves the maintainability of the system and the reliability evolution capability under the long-term task.

[0210] Embodiment 2, fault tolerance process of main BIOS startup failure and autonomous switching to backup BIOS:

[0211] This embodiment aims to illustrate the autonomous recovery capability of the application when facing the BIOS firmware level fault. The system is powered on and starts, and enters step 1. The management FPGA first reads the BIOS BOOT register with the internal address of 0x0000, and the initial value is 0, which is mapped to the physical address of the main BIOS storage chip. According to this, the management FPGA generates a chip selection enable signal of the main BIOS chip, and the system starts to execute the boot code by the main BIOS.

[0212] Then enter step 2, the management FPGA starts the BIOS level watchdog timer corresponding to the main BIOS storage address. The management FPGA reads the BIOS WDT register with the address of 0x0008, obtains the preset timeout time, and loads the value into the hardware timer to start counting down.

[0213] In the failure scenario of this embodiment, the firmware code region of the emulated main BIOS is corrupted by a single event upset, causing the main BIOS to get stuck in a loop when executing the device initialization flow, thus failing to send a signal to the management FPGA to reset the watchdog timer before the preset timeout of 60 seconds is reached.

[0214] In step 3, the BIOS-level watchdog timer of the management FPGA overflows due to the timeout of not receiving the reset signal from the main BIOS. The management FPGA captures this timeout event and determines that the BIOS startup has failed. In response, the management FPGA immediately modifies the value of the BIOS BOOT register at address 0x0000 from 0 to 1. The management FPGA then generates a global system reset signal.

[0215] The system restarts in response to the reset signal and begins execution again from step 1. This time, the management FPGA reads the value of the BIOS BOOT register as 1. The value of 1 is mapped to the physical address of the backup BIOS storage chip. Therefore, the management FPGA generates a chip select enable signal for the backup BIOS chip, and the system starts to execute the startup code from the backup BIOS. The backup BIOS firmware is intact and can successfully complete the initialization flow and successfully feed the watchdog before the watchdog timeout, finally successfully hands over the control to the operating system bootloader, completing the BIOS-level failure self-recovery without ground intervention.

[0216] Embodiment 3, multi-level system disk startup failure and network layer regeneration recovery process:

[0217] This embodiment is based on the successful startup of the BIOS in embodiment 2, and further illustrates the multi-level progressive recovery capability of the present application in the face of operating system-level storage medium failure.

[0218] After the BIOS successfully starts, step 4 is entered. The BIOS initiates a request to the management FPGA, which reads the OS BOOT register at address 0x0004 to obtain the current operating system startup disk number, with an initial value of '0000' corresponding to Disk 0 in the physical. The BIOS attempts to load the operating system from Disk 0 accordingly.

[0219] In step 5, before handing over control to the operating system bootloader, the BIOS triggers the management FPGA to start the OS-level watchdog timer. The management FPGA reads the timeout configuration in the OS WDT register at address 0x000C to start the corresponding hardware timer.

[0220] In the failure scenario of the present embodiment, the OS image file of Disk 0 is simulated to be corrupted, causing the OS to encounter a fatal error during kernel initialization and fail to successfully start the watchdog timer in user mode.

[0221] In step 6, after the 120-second timeout elapses, the OS-level watchdog timer overflows because no reset signal is received. The management FPGA captures this timeout event and determines that Disk 0 failed to boot. The management FPGA then reads the current boot disk number '0000' from the OS BOOT register, performs a modulo operation to obtain a new boot disk number '0001', and writes the new boot disk number back to the OS BOOT register. Finally, the management FPGA generates a system reset signal.

[0222] After the system restarts, steps 4-6 are repeated. The management FPGA reads the OS BOOT register value '0001' and attempts to boot from Disk 1. If Disk 1 also fails, the OS-level watchdog will timeout again, and the management FPGA will continue to update the OS BOOT register to '0010' and restart. This process repeats until the management FPGA has attempted to boot from all the redundant disks.

[0223] In step 7, when the management FPGA detects that the OS BOOT register value has completed a full cycle from '0000' to '1111' and each attempt has failed with an OS-level watchdog timeout, the management FPGA determines that all local boot disks have failed. At this point, the management FPGA activates the network-level recovery mechanism, i.e., the PXE boot function.

[0224] In step 8, the management FPGA broadcasts a boot request to a preconfigured PXE server through the inter-satellite network interface of the on-board computer. After the server responds, the management FPGA downloads a brand-new, intact OS image data through the inter-satellite link in block-encrypted form. For each received data block, the management FPGA first decrypts the block and then performs integrity verification using the appended checksum.

[0225] In step 9, after all the data blocks are successfully received and verified, the management FPGA writes the complete OS image data to each physical boot disk in sequence, achieving system reinstallation on all local boot disks. After the reinstallation is complete, the management FPGA calculates the local feature value for the image copy written to Disk 0 and performs consistency verification with the reference feature value issued by the PXE server.

[0226] Proceed to step 10. After the consistency check passes, the management FPGA records this recovery event in the circular log buffer of the non-volatile memory, including the final boot source, the number of the repaired boot disk, the feature value verification result, and the BeiDou time stamp.

[0227] Finally, managing the FPGA will involve the OS BOOT The register value is reset to the initial boot disk number '0000', and a system reset signal is issued. After the system restarts, the operating system will successfully boot from the newly revitalized Disk 0, completing a closed-loop fault handling process with the highest privileges and complete autonomy, switching from local multi-disk redundancy to network regeneration and recovery.

[0228] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A multi-level fault-tolerant startup method for a spaceborne computer, characterized in that, include: step ,manage Read The boot source flag bit in the register is used to select the master. Storage address or backup Storage address; step ,manage Startup and storage address corresponding Level watchdog timer, timer duration is determined by Register configuration; step ,when The watchdog timer expired without a reset signal, and the management... Revise The boot source flag bit in the register generates a system reset signal; step ,manage Read The register contains the boot disk number, and the physical address of the operating system boot disk is selected based on the number value; step ,manage Startup disk corresponding to the boot disk number Level watchdog timer, timer duration is determined by Register configuration; step ,when The watchdog timer expired without a reset signal, and the management... renew The boot disk number in the register is used to generate a system reset signal; step ,when The boot disk number traversal in the registers was completed but loading failed. (Management) Obtained via inter-satellite network interface The operating system image data on the server side; step ,manage Write the operating system image data to the storage medium corresponding to the current boot disk number. The registers were restored to the initial boot disk number; step ,manage Calculate the characteristic value of the boot disk image after writing, and... The baseline feature values ​​issued by the server are used for consistency verification. step ,manage The current boot source identifier, boot disk number, and feature value verification result are recorded in the circular buffer of the non-volatile memory.

2. The multi-level fault-tolerant startup method for a spaceborne computer according to claim 1, characterized in that, The Register is Bit-width registers, support The boot disk number cycles through a loop, and the incrementing number is calculated using a modulo operation. Addition is implemented; The The operating system image data sent by the server uses a block-based encrypted transmission method, each... Byte data block usage Algorithm encryption and appending byte Verification code.

3. The multi-level fault-tolerant startup method for a spaceborne computer according to claim 1, characterized in that, The steps The storage structure for the recorded information is a circular log buffer, which uses a circular overwrite storage structure and has a total capacity of [missing information]. Bit record entries, each record entry contains ByteDance Beidou time marker Byte error codes and Byte status identifier; The status identifier includes Bit priority code and The recovery policy code is a bit-based code. The priority code determines the inter-satellite network bandwidth allocation ratio, and the recovery policy code defines the number of times the image download will be retried.

4. The multi-level fault-tolerant startup method for a spaceborne computer according to claim 1, characterized in that, The steps In China, management Read The boot source flag bit in the register is used to select the master. Storage address or backup Storage address, further including: Sub-step ,manage After receiving the system power-on command, access the internal address as follows: of Register, read Bit-width boot source identifier bits ; Sub-step ,manage Based on the read startup source identifier bit The target is calculated using the following formula. physical address : ， in, The final selected physical address for loading the firmware. The value of the start source flag. For the preset main The physical base address of the memory chip, For preset backup The physical base address of the storage chip; Sub-step ,manage The calculated target physical address Placed on the system address bus, according to the target physical address Drive the address decoding logic to generate the chip select enable signal. This initiates the firmware loading process for the corresponding storage chip. The steps In China, management Startup and storage address corresponding Level watchdog timer, timer duration is determined by Register configuration, further including: Sub-step ,manage In determining the target physical address Then, access the internal address is of Register, read A bit-wide unsigned integer is used as the watchdog timeout configuration value. ; Sub-step ,manage Based on the read watchdog timeout configuration value Calculated using the following formula Watchdog timeout seconds : ， in, for The final timeout period of the watchdog timer. for Register read Bit unsigned integer value, These are preset basic time unit constants; Sub-step ,manage After calculating the timeout in seconds Then, determine the timeout in seconds. Does it meet the preset valid time range conditions? , If the conditions are If true, the timeout will be counted in seconds. Load and start the hardware timer. If the conditions are If false, the preset default timeout in seconds will be used. Load the hardware timer and start it, the conditions The calculation formula is: ， in, The result is a Boolean validity assessment. The minimum watchdog timeout in seconds allowed by the system. This is the maximum watchdog timeout in seconds allowed by the system.

5. According to the claims The aforementioned multi-level fault-tolerant startup method for a spaceborne computer is characterized in that, The steps In the middle, when The watchdog timer expired without a reset signal, and the management... Revise The boot source flag bit of the register generates a system reset signal, and further includes: Sub-step ,manage In the steps The count value of the hardware timer loaded and started in the middle reaches the step described above. The timeout in seconds calculated in At that time, a timeout interrupt signal issued by a hardware timer was detected; Sub-step ,manage After detecting the timeout interrupt signal, read the The current boot source flag in the register And access to non-volatile memory to obtain and boot source identifier bits Related Startup failure count ; Sub-step ,manage According to the reading Startup failure count Determine using the following formula Switching conditions Is it true or false? ， in, The result of the switching condition determination is a Boolean value. For the present The number of consecutive failures to start the source. For the preset single The maximum number of consecutive failures allowed by the source is the threshold. Sub-step When the Switching conditions When the judgment result is true, the management For the current boot source identifier bit Perform a bit-flipping operation to calculate the new boot source identifier bit. Then the new startup source identifier will be set. write as described The register ultimately generates the system reset signal.

6. The multi-level fault-tolerant startup method for a spaceborne computer according to claim 1, characterized in that, The steps In China, management Read The register's boot disk number, used to select the physical address of the operating system boot disk, further includes: Sub-step ,manage In the After successful loading and transfer of control, access the internal address is of Register, read Bit width boot disk number ; Sub-step ,manage Based on the read boot disk number The physical address of the target operating system boot disk is calculated using the following formula. : ， in, The final selected physical address of the boot disk used to load the operating system. This is the default physical base address of the operating system's storage area. For the reason Register read Bit unsigned integer value, The size of the address space occupied by a single operating system boot disk partition; Sub-step ,manage After calculating the physical address of the target operating system boot disk Then, the physical address is determined using the following formula. Validity conditions : ， in, This is a Boolean result for address validity assessment. This represents the maximum number of boot disks supported by the system. Sub-step When the validity condition When the judgment result is true, the management The physical address of the target operating system boot disk It is placed on the system address bus to initiate the loading process of the operating system kernel; The steps In China, management Startup disk corresponding to the boot disk number Level watchdog timer, timer duration is determined by Register configuration, further including: Sub-step ,manage After issuing the operating system kernel load instruction, access its internal address is of Register, read Bit width operating system watchdog timeout configuration value ; Sub-step ,manage Based on the read operating system watchdog timeout configuration value Calculated using the following formula Watchdog timeout seconds : ， in, for The final timeout period of the watchdog timer. For the reason Register read Bit unsigned integer value, This is a preset operating system watchdog timer basic time unit constant; Sub-step ,manage After calculating the timeout in seconds Then, determine the timeout in seconds. Does it meet the preset operating system valid time range conditions? If the conditions are If true, the timeout will be counted in seconds. Load and start the hardware timer. If the conditions are If false, the default operating system timeout in seconds will be used. Load the hardware timer and start it, under the aforementioned conditions The calculation formula is: ， in, The result is a Boolean value indicating validity. This is the minimum number of seconds allowed for the operating system watchdog timeout. This is the maximum number of seconds allowed for the operating system watchdog timeout.

7. According to the claims The aforementioned multi-level fault-tolerant startup method for a spaceborne computer is characterized in that, The steps In the middle, when The watchdog timer expired without a reset signal, and the management... renew The register's boot disk number generates a system reset signal, and further includes: Sub-step ,manage In the steps Loaded and started The count value of the hardware timer reaches the step described above. The timeout in seconds calculated in At that time, an operating system-level timeout interrupt signal issued by a hardware timer was detected; Sub-step ,manage After detecting the operating system-level timeout interrupt signal, access the internal address is of Register, read Current boot disk number with bit width ; Sub-step ,manage Based on the read current boot disk number The next boot disk number can be calculated using the following formula. : ， in, This will be the next boot disk number to be attempted after the update. For the purposes of the above The register reads the current boot disk number. Total number of boot disks; Sub-step ,manage The calculated next boot disk number write as described The register ultimately generates the system reset signal to use the next boot disk number. Proceed to the next startup attempt.

8. The multi-level fault-tolerant startup method for a spaceborne computer according to claim 1, characterized in that, The steps In the middle, when The boot disk number traversal in the registers was completed but loading failed. (Management) Obtained via inter-satellite network interface The operating system image data on the server side further includes: Sub-step ,manage In the reason stated After the system reset signal generated by the watchdog timer expires, the following is read: Register the current boot disk number The following formula is used to determine the conditions for completing the traversal of the local boot disk. Is it true or false? ， in, The result of the traversal is a Boolean type. For the purposes of the above The register reads the current boot disk number. Total number of boot disks This is the preset initial boot disk number; Sub-step When the local boot disk traversal is complete When the judgment result is true, the management Broadcast via the inter-satellite network interface on a preset network channel Request message detected; Sub-step ,manage As stated in the broadcast Upon detecting the request message, wait for the preset response time. Internal listening and collecting all The response message is sent according to the preset server selection strategy. The response message identifies the unique Server-side; Sub-step ,manage By the unique Extract from the response message sent by the server server network address and operating system image file name And towards server network address Send the filename of the operating system image. The data acquisition request is used to obtain the operating system image data; The steps In China, management Write the operating system image data to the storage medium corresponding to the current boot disk number. The registers are restored to the initial boot disk number, further including: Sub-step ,manage In the only After the server obtains the operating system image data, it designates the last boot disk number before the local boot disk traversal is completed as the faulty boot disk number to be repaired. ; Sub-step ,manage According to the faulty boot disk number The starting physical address of the target storage medium used to write the operating system image data is calculated using the following formula. : , in, The starting physical address for writing the operating system image data. The default physical base address of the operating system's storage area. The number of the faulty boot disk currently awaiting repair. The size of the address space occupied by a single operating system boot disk partition; Sub-step ,manage The operating system image data is processed in blocks. Each received encrypted data block is decrypted to obtain a plaintext data block. Based on the plaintext data block and the accompanying checksum, the data block writing conditions are determined using the following formula. Is it true or false? ， in, Write the condition judgment result to the Boolean data block. This is a preset cyclic redundancy check function. For plaintext data blocks, This is a verification code; Sub-step When the data block write condition When the judgment result is true, the management Write the plaintext data block to the starting physical address of the target storage medium. The specified contiguous storage space, and after all data blocks have been successfully written, will be used to... The boot disk number in the register is reset to the sub-step described above. The initial boot disk number defined in [the document / reference] .

9. According to the claims The aforementioned multi-level fault-tolerant startup method for a spaceborne computer is characterized in that, The steps In China, management Calculate the characteristic value of the boot disk image after writing, and... The consistency of the baseline feature values ​​issued by the server is further verified, including: Sub-step ,manage After completing the claims After the write operation of all plaintext data blocks in the middle, as claimed in the claims The starting physical address of the target storage medium determined in the middle Begin by reading the preset image size. The data blocks are written as mirror copies. ; Sub-step ,manage Apply the preset eigenvalue calculation function In the already written mirror copy A locally computed boot disk image feature value is generated using the following formula. : ， in, These are the feature values ​​calculated based on the written mirror copy. A deterministic function that maps data blocks of arbitrary length to feature values ​​of a fixed length. This refers to the operating system image data that has been completely read from the target storage medium. Sub-step ,manage Extraction by the claims The only one determined in the middle Baseline feature values ​​obtained by the server Based on the benchmark eigenvalue Compared with the locally calculated boot disk image feature value The following formula is used to determine the consistency check condition for image writes. Consistency check conditions The Boolean result is used as the feature value verification result: ， in, The result of the consistency check is a Boolean value. These are the locally calculated boot disk image characteristics. For the only The baseline feature values ​​obtained by the server for comparison.

10. According to claims The aforementioned multi-level fault-tolerant startup method for a spaceborne computer is characterized in that, The steps In China, management The current boot source identifier, boot disk number, and feature value verification result are recorded in a circular buffer of non-volatile memory, further including: Sub-step ,manage In obtaining the claims The image write consistency verification condition determined in the middle Then, obtain the BeiDou time standard of the bytes. According to the consistency verification conditions The Boolean result is processed through a preset error mapping table. Error code for determining bytes At the same time, combine the preset bit priority code and bit recovery strategy code To form a byte status identifier ; Sub-step ,manage The current circular log buffer write pointer is read from the preset address of the non-volatile memory. Combined with the aforementioned BeiDou time standard The error code and the status identifier The current startup source identifier bit, the claim The faulty boot disk number specified in [the document / reference] The feature value verification results are encapsulated into a package with a total capacity of single record item ; Sub-step ,manage Write pointer based on the read circular log buffer. The single record item is calculated using the following formula. The target is written to the physical address : ， in, The physical address to be written to the target of a single record entry in non-volatile memory. This is the physical base address of the circular log buffer. This is the index number of the current log record. The fixed byte length for a single record item; Sub-step ,manage The single record item Complete write to the physical address of the target After specifying the position, calculate the updated next circular log buffer write pointer using the following modular addition formula. : ， in, This is the index number for the next log record after the update. The total number of records supported by the circular log buffer; Sub-step ,manage Write the calculated next circular log buffer pointer The value is written back to the preset address of the non-volatile memory for use in subsequent recording operations.

Images