Single particle fault tolerance method based on satellite-borne operating system

Abstract

The invention discloses a single particle fault tolerance method based on a satellite-borne operating system. The method comprises the following steps: dividing satellite-borne software into operating system software and application software; calling application software, performing two-out-of-three redundancy check protection on the key data, and linking the key data to a fixed memory address; operating system software is called, and resources are allocated and tasks are created according to executable file information of application software; distributing a redundant data segment for storing an instruction of an executable code segment; and calling operating system software to take over exceptions occurring in the operation of the system, and carrying out grading and partitioning processing. According to the method, redundant information loaded when the application software is started by the operating system software is matched with protection of the application software on an important data area, and when single-particle abnormal upset occurs, the operating system software carries out grading and partitioning processing on the exception, so that the protection range of the exception of the memory when the application software runs is expanded, and the reliability of the memory is improved. The problem that the EDAC cannot recover multi-bit errors is solved.

Description

Technical Field

[0001] The present invention belongs to the field of aerospace technology, and in particular relates to a single-particle fault tolerance method based on a satellite-borne operating system. Background Art

[0002] As spacecraft lifespans increase and mission complexity increases, onboard software becomes larger and larger, requiring longer continuous operation times. This increases the risk of single-event upsets (SEFs) in memory in the space environment. Single-event fault-tolerance design involves identifying and resolving memory and register anomalies caused by SEFs through coordinated hardware and software system design, ensuring stable operation of onboard software in the harsh space environment. Onboard computers typically use processors with triple-module redundancy, ensuring that SEFs do not affect the correct use of registers. Onboard memory typically includes an EDAC function, which detects and corrects single-bit memory upsets by storing redundant checksums in hardware. This function is typically enabled by onboard software, requiring no significant intervention. However, the EDAC function of onboard memory only provides one-bit error detection and one-bit error correction capabilities, and is unable to guarantee proper software operation in the presence of multiple-bit errors.

[0003] In the prior art, patent CN111506451B discloses a design method for single-particle protection based on a satellite-borne operating system through the coordinated use of software and hardware. In the satellite-borne operating system running in the virtual address space, the system can promptly know when a single-particle upset occurs in the memory and take necessary measures to correct the error. At the same time, the method can periodically refresh the more fragile cache using software to ensure that the data in the cache is not "dirty." Or when the data is "dirty," it can achieve protection against single particles by invalidating the data in the cache, thereby improving the reliability and security of the satellite-borne system. Compared with relying solely on software or hardware to achieve single-particle protection, the method is easy to implement, reliable, and more flexible, and has strong engineering practice value. For example, patent CN102521082A discloses a checkpoint recovery fault-tolerant method and system in a satellite-borne real-time operating system. The method includes the following steps: redundant execution of critical tasks and distributed processing of non-critical tasks; saving checkpoints based on the execution results; and performing checkpoint recovery based on the saved checkpoints. The method achieves the purpose of improving the reliability of the satellite-borne computer by adopting a self-designed checkpoint saving and checkpoint recovery method based on the file system.

[0004] The above method mainly has the following problems:

[0005] (1) Method 1 cannot solve the multi-bit upset problem, and periodic cache refreshes will result in a continuous loss of performance under normal operating conditions. This method can mitigate the risk of single-event upsets, but because it relies on the error correction capability of EDAC and does not store redundant data, it cannot improve EDAC's single-bit error correction and double-bit detection capabilities.

[0006] (2) Method 2 avoids the shortcomings of Method 1, but requires setting a large number of checkpoints in the original program. This makes it less universal and unsuitable for reinforcing existing software. The introduction of checkpoints also results in a continuous loss of performance under normal operating conditions. Summary of the Invention

[0007] The technology of the present invention solves the problem of overcoming the shortcomings of the existing technology and providing a single-particle fault tolerance method based on a satellite operating system. By using redundant information loaded when the operating system software starts the application software and cooperating with the application software to protect important data areas, when a single-particle abnormal flip occurs, the operating system software performs hierarchical and partitioned processing on the abnormality, thereby expanding the protection range of memory abnormalities when the application software is running and solving the problem that EDAC cannot recover multi-bit errors.

[0008] In order to solve the above technical problems, the present invention discloses a single-event fault tolerance method based on a spaceborne operating system, comprising:

[0009] Design onboard software and divide it into operating system software and application software according to the principle of functional division;

[0010] Call application software to perform two-out-of-three redundancy check protection on key data and link it to a fixed memory address;

[0011] Call the operating system software, allocate resources and create tasks based on the application software executable file information; and allocate redundant data segments to store instructions of the executable code segment;

[0012] Real-time monitoring of system operation status; when an abnormality occurs in the system operation, the operating system software is called to take over the abnormality in the system operation, determine and save the address and cause of the abnormality;

[0013] Perform hierarchical and partitioned processing based on the address and cause of the exception.

[0014] In the above-mentioned single-particle fault tolerance method based on the onboard operating system, the application software is used for business logic processing; the operating system software is used for application software loading and exception handling.

[0015] In the above-mentioned single-event fault tolerance method based on the onboard operating system, the application software is loaded into the memory by the operating system software and executed.

[0016] In the above-mentioned single-event fault tolerance method based on the onboard operating system, the redundant data segment allocated for storing instructions of the executable code segment does not require executable permission and does not participate in the normal operation of the program.

[0017] In the above-mentioned single-particle fault tolerance method based on the onboard operating system, the anomalies that occur during system operation include: single-particle upset anomalies, illegal instruction anomalies, instruction access anomalies, and data access anomalies.

[0018] In the above-mentioned single-particle fault tolerance method based on the onboard operating system, when performing hierarchical and partitioned processing according to the address and cause of the exception, for hardware-correctable errors, the errors are recorded and handed over to the hardware for correction processing.

[0019] In the above-mentioned single-event fault tolerance method based on the onboard operating system, when performing hierarchical partitioning processing according to the address where the exception occurred and the cause of the exception, for hardware uncorrectable errors, partitioning processing is performed according to the address where the exception occurred.

[0020] In the above-mentioned single-particle fault tolerance method based on the onboard operating system, partition processing is performed according to the address where the exception occurs, including: if the address where the exception occurs is located in an independent important data area, the application software performs a three-out-of-two operation to correct it; if the address where the exception occurs is located in the code segment, write-back correction is performed through the allocated redundant data segment; if the address where the exception occurs is located in an independent important data area or other location outside the code segment, the task is restarted for recovery.

[0021] The present invention has the following advantages:

[0022] (1) The present invention discloses a single-particle fault-tolerance method based on a satellite-borne operating system, which expands the fault-tolerance level of single-particle errors in satellite-borne software. Compared with traditional fault-tolerance methods that can only recover single-particle single-bit errors, the present invention extends it to single-particle multi-bit error recovery processing.

[0023] (2) The present invention discloses a single-particle fault tolerance method based on a satellite-borne operating system, which expands the spatial range of single-particle multi-bit errors in satellite-borne software. The two-out-of-three fault tolerance method can only handle single-particle errors in the data area, and the present invention extends it to the code area.

[0024] (3) The present invention discloses a single-particle fault tolerance method based on a satellite-borne operating system, which does not require additional operations during normal operation after the satellite-borne software is started, and does not reduce the software operation efficiency.

[0025] (4) The present invention discloses a single-particle fault-tolerant method based on a satellite-borne operating system, which can protect the code area of ​​existing application software, has strong forward compatibility, and has a wide range of applications.

[0026] (5) The present invention discloses a single-particle fault-tolerant method based on a satellite-borne operating system. The satellite-borne operating system exception handling does not require reloading of the application software executable image, does not require file system access and address space switching, and the code area data recovery processing speed is fast. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 This is a flow chart of a single-event fault tolerance method based on a satellite-borne operating system in an embodiment of the present invention;

[0028] Figure 2 This is a flowchart of an operating system software exception handling process in an embodiment of the present invention;

[0029] Figure 3 This is a schematic diagram of abnormal classification and partitioning processing in an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the objectives, technical solutions and advantages of the present invention more clear, the embodiments disclosed in the present invention will be described in further detail below with reference to the accompanying drawings.

[0031] One of the core concepts of the present invention is to disclose a single-particle fault tolerance method based on an onboard operating system. Based on the onboard operating system, the onboard operating system performs hierarchical partitioning to reinforce the software, achieving comprehensive management of single- and double-bit detectable errors. Based on the three-out-of-two fault tolerance in important data areas, the onboard operating system redundantly loads non-writable program code segments. When an execution exception occurs, the erroneous content is corrected using the data in the redundantly loaded non-writable program code segments. By parsing the application software executable file format, appropriate storage space is allocated for the application software, and the application software is loaded into memory in segments and started running, handling illegal instruction exceptions, instruction access exceptions, and data access exceptions that occur during the operation of the onboard operating system. The application software includes program segments and data segments. Important data in the application software is linked to independent data segments and adopts a three-out-of-two protection design. The operating system software parses the application software executable file image, analyzes the executable file information, and applies for additional space to store redundant data. The redundant code segments are not accessed during normal program operation and are only read by the exception handling module. The operating system software takes over exception handling and triggers execution when illegal instructions, single-bit errors, data access errors, etc. occur. The exception handling module obtains the exception type and the program address where the exception occurs from the system register, and performs different processing according to different exception types and address ranges. For example, for single-bit errors, the EDAC error correction function is used for fault tolerance; for multi-bit errors, the error location is determined. If the error location is in the important data area, it is not processed and is handed over to the application software for three-out-of-two fault tolerance. If the error location is the code segment or read-only data segment, the loaded redundant data is used for error correction.

[0032] Reference Figure 1 In this embodiment, the single-event fault tolerance method based on the onboard operating system includes:

[0033] Step 1: Design the onboard software and divide it into operating system software and application software according to the principle of functional division.

[0034] In this embodiment, the application software is used for business logic processing and is loaded into the memory by the operating system software for execution; the operating system software is used for application software loading and exception handling.

[0035] Step 2: Call the application software to perform two-out-of-three redundancy check protection on key data (such as working mode data) and link it to a fixed memory address (such as 0x30000000).

[0036] Step 3: Call the operating system software, allocate resources and create tasks according to the application software executable file information; and allocate redundant data segments for storing instructions of the executable code segment.

[0037] In this embodiment, the redundant data segment allocated for storing instructions of the executable code segment does not require executable permission and does not participate in the normal running of the program.

[0038] Step 4: monitor the system operation status in real time; when an abnormality occurs in the system operation, call the operating system software to take over the abnormality that occurs in the system operation, determine and save the address where the abnormality occurs and the cause of the abnormality.

[0039] In this embodiment, the exceptions that occur during system operation include but are not limited to: single event upset exception, illegal instruction exception, instruction access exception, and data access exception.

[0040] Step 5: Perform hierarchical and partitioning processing based on the address where the exception occurred and the cause of the exception.

[0041] In this embodiment, when performing hierarchical and partitioned processing based on the address and cause of the exception, there are:

[0042] 51) For hardware-correctable errors, record the error and hand it over to the hardware for correction.

[0043] 52) For hardware uncorrectable errors, partition processing is performed based on the address where the exception occurred:

[0044] If the address where the exception occurs is located in an independent important data area, the application software performs a two-out-of-three operation to correct it.

[0045] If the address where the exception occurs is located in the code segment, the redundant data segment allocated in step 3 is used for write-back correction.

[0046] If the address where the exception occurs is located outside of an independent important data area or code segment, the task is restarted for recovery.

[0047] In summary, the present invention discloses a single-particle fault tolerance method based on an onboard operating system. On the basis of hardware memory EDAC fault tolerance, the fault tolerance management of multi-bit single-particle anomalies is realized by collaborative design based on operating system software and application software, which can reduce the risk of abnormal reset caused by single particles during program operation. The application software is loaded into the memory by the operating system software for execution, including code segments, important data segments and other data segments, wherein the important data segments are important parameter variables that are redundantly protected by the application software using two out of three. When loading the application software, the operating system software allocates redundant data areas to save code segment data as a data source for recovering damaged instructions during the exception handling process. When illegal instructions, single-bit errors and multi-bit errors occur in the onboard operating system, the operating system software takes over the error, obtains the error type and error address, and performs hierarchical and partitioned processing according to the error type and error address, including using redundant code area data to recover damaged instructions, handing over data to hardware for recovery, and handing over data to application software using two out of three areas for recovery.

[0048] In this embodiment, application software code can be written in a separate source file, depending on task requirements. The application software code is independently compiled and linked into an executable file, which is then loaded into memory and executed by the operating system software. When accessing critical data, the application software implements three-out-of-two protection to prevent interference from single-particle events. During linking, the application software must place critical data in a special data segment with a fixed address. Multi-bit errors within this segment can be handled by the application software, eliminating the need for operating system fault tolerance. Depending on task requirements, the application software can design all data for three-out-of-two protection, or select a subset of critical data for protection.

[0049] In this embodiment, the operating system software loads the application software executable file image and starts the application software. The operating system software reads the executable file image, obtains the addresses, data, and other attributes of each segment of the application software according to the file format, allocates corresponding address space in the memory to store each segment of the application software data, and creates a task to start the application software. In addition to the regular application software segment data, the operating system software needs to apply for additional space in the memory to store the application software code segment (which may include read-only important data segments that are not protected by Zone 3, Zone 2). The redundant data segments can be one or more copies. The redundant data segments only need to be read-only and do not participate in the normal operation of the application software. They are only used as a source of recovery data.

[0050] In this embodiment, the process of operating system software performing exception handling is as follows: Figure 2As shown, the operating system software takes over the exception of the processor, obtains the exception type and the address where the exception occurs through the hardware, and handles the exception in a hierarchical and partitioned manner according to the exception type and the address where the exception occurs. Figure 3 As shown, for exceptions that can be corrected by hardware EDAC, such as single-particle single-bit data or instruction access exceptions, only the exception information (including the location, time, and cumulative count of the exception) is recorded, and no correction is performed. For exceptions that cannot be corrected by hardware EDAC, such as single-particle multi-bit data or instruction access exceptions, partitioning is required based on the address space where the exception occurred: If the exception occurs in an important data area fixed by the application software, the application software can handle the three-area two-fault tolerance, and the operating system software does not need to perform error correction management; if the exception occurs in the application software code segment, the operating system software can recover the operation by loading redundant code segment data. The redundant code segment can be one or more copies. If there are multiple copies, fault tolerance management can be achieved through checksum or three-out-of-two.

[0051] In this embodiment, in addition to data or instruction access exceptions caused by common single-event upsets, the operating system software can also perform correction management through redundant code data for illegal instructions caused by single-event multi-bit errors.

[0052] In this embodiment, for multi-bit errors caused by a single particle in non-critical data of the application software, the operating system software only needs to kill the task and reload it to start running, and the application software itself performs state recovery and fault tolerance processing.

[0053] In this embodiment, only the exception handling process caused by a single particle is described, and the handling of other exceptions not caused by a single particle is not described in detail. The processing method of the present invention does not affect the handling process of other exceptions taken over by the operating system software.

[0054] Although the present invention has been disclosed above in terms of preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art may make possible changes and modifications to the technical solutions of the present invention by using the methods and technical contents disclosed above without departing from the spirit and scope of the present invention. Therefore, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solutions of the present invention shall fall within the scope of protection of the technical solutions of the present invention.

[0055] The contents not described in detail in the specification of the present invention belong to the common knowledge of professionals in this field.

Claims

1. A single event fault tolerance method based on a spaceborne operating system, characterized in that: include: Design onboard software and divide it into operating system software and application software according to the principle of functional division; Call application software to perform two-out-of-three redundancy check protection on key data and link it to a fixed memory address; Call the operating system software, allocate resources and create tasks based on the application software executable file information; and allocate redundant data segments to store instructions of the executable code segment; Real-time monitoring of system operation status; when an abnormality occurs in the system operation, the operating system software is called to take over the abnormality in the system operation, determine and save the address and cause of the abnormality; Perform hierarchical and partitioned processing based on the address and cause of the exception.

2. The single event fault tolerance method based on a spaceborne operating system according to claim 1, characterized in that: Application software is used for business logic processing; operating system software is used for application software loading and exception handling.

3. The single event fault tolerance method based on a spaceborne operating system according to claim 1, characterized in that: Application software is loaded into memory by the operating system software and executed.

4. The single event fault tolerance method based on a spaceborne operating system according to claim 1, characterized in that: The redundant data segment allocated to store instructions of the executable code segment does not require executable permission and does not participate in the normal operation of the program.

5. The single event fault tolerance method based on a spaceborne operating system according to claim 1, characterized in that: Exceptions that occur during system operation include: single event upset exceptions, illegal instruction exceptions, instruction access exceptions, and data access exceptions.

6. The single event fault tolerance method based on a spaceborne operating system according to claim 1, characterized in that: When performing hierarchical and partitioned processing based on the address and cause of the exception, for hardware-correctable errors, the errors are recorded and handed over to the hardware for correction processing.

7. The single event fault tolerance method based on a spaceborne operating system according to claim 1, characterized in that: When performing hierarchical partitioning processing based on the address where the exception occurred and the cause of the exception, for hardware uncorrectable errors, partitioning processing is performed based on the address where the exception occurred.

8. The single event fault tolerance method based on a spaceborne operating system according to claim 7, characterized in that: Partitioning is performed based on the address where the exception occurred, including: if the address where the exception occurred is located in an independent important data area, the application software performs a two-out-of-three operation to correct it; if the address where the exception occurred is located in the code segment, write-back correction is performed through the allocated redundant data segment; if the address where the exception occurred is located in an independent important data area or other location outside the code segment, the task is restarted for recovery.

Images