Satellite-borne computer triple-modular redundancy main and standby computer system architecture

Abstract

The invention aims to solve the problems that the correctness of an output result of a dual-computer cold standby spaceborne computer cannot be judged, a triple modular redundancy computer cannot perform synchronous analog quantity acquisition on AD of an SPI interface, the reliability is low, and the long-term on-orbit requirement of spacecrafts such as satellites and the like cannot be met. The invention discloses a three-modular redundancy host and standby computer system architecture of a spaceborne computer. The three-modular redundancy host and standby computer system architecture comprises an arbitration circuit, a first computer unit (host) and a second computer unit (standby), the arbitration circuit is respectively connected with the first computer unit (host) and the second computer unit (standby unit); the first computer unit (host) and the second computer unit (standby unit) are completely the same in composition and function; the first computer unit (host) or the second computer unit (standby unit) is composed of three identical SOC computers and an interface circuit. The reliability of the whole computer is improved through a main and standby machine and single machine triple modular redundancy architecture, CS and SCLK signals in SPI buses of the three SOC computers are connected pairwise, the three SOC computers receive analog quantity collected by AD at the same time, the data accuracy is improved, and the data transmission complexity is reduced.

Description

TECHNICAL FIELD

[0001] The application relates to the field of spacecraft electronics technology of satellites, spaceships and the like, in particular to a three-module redundant main-backup computer architecture of a satellite-borne computer. BACKGROUND

[0002] The satellite-borne computer controls a spacecraft to normally run on a space orbit, but the satellite-borne computer is always affected by complex space environments such as neutral atmosphere, plasma, high-energy charged particles, the earth magnetic field, solar electromagnetic radiation and other space environmental factors.

[0003] The satellite-borne computer has a long on-orbit running time and is in a complex space environment, in order to improve the reliability of the computer and take into account the cost of design, currently, the satellite-borne computer is mostly used in a dual-computer cold backup or three-module redundancy. The working principle of the dual-computer cold backup architecture is that, in normal operation, one is used as a main computer to be powered on to perform operation control functions, and the other is used as a backup computer without power, when the main computer fails, the system switches the output to the backup computer through an arbitration circuit and powers off the main computer, so that system switching is realized. The working principle of the three-module redundancy architecture is that three SOC computers exchange data with each other through a communication bus, perform three-out-of-two on the calculation results, and output correct results.

[0004] In the dual-computer cold backup architecture, the result output by a single computer cannot be judged for its correctness; and in the three-module redundancy architecture, when two modules fail, the entire computer loses its function, and when the three-module computer uses an SPI interface to collect analog quantities, only the on-duty computer can directly communicate with the AD, and finally the analog quantities are transmitted to the off-duty computer through the bus among the three modules, so that the accuracy of data is reduced and the complexity of data transmission is increased in the entire transmission process. SUMMARY

[0005] The application discloses a three-module redundant main-backup computer architecture of a satellite-borne computer, solves the problem that the result output by the dual-computer cold backup cannot be judged for its correctness, and solves the problems of data delay and low data reliability existing in the three-module redundancy analog quantity collection, so that the reliability of the satellite-borne computer and the accuracy of data are improved.

[0006] The application is a kind of starboard computer three-mode redundancy main / standby computer architecture, comprising: arbitration circuit, main computer and standby computer. Wherein the main computer and standby computer are exactly the same, the arbitration circuit is connected with the three SOC computers of the main computer and standby computer through power-off signal, dog-feeding signal, setting signal, state signal and bus signal at the same time, realizing the switching of on-duty module; through main machine switching signal and standby machine switching signal, the switching of on-duty machine is realized, so as to realize computer multi-mode redundancy. In the main computer / standby computer architecture, for the AD using SPI interface, by connecting the CS and SCLK signals in the SPI signal between the three SOC computers, three-mode synchronous acquisition of analog quantity is realized.

[0007] The arbitration circuit is generally realized by FPGA circuit, and in order to improve reliability, the selected FPGA quality level is higher.

[0008] The arbitration circuit is connected with the three SOC computers of the main computer and standby computer through power-off signal, dog-feeding signal, setting signal, state signal and bus signal at the same time. Wherein the state signal is composed of at least two I / O signals. In addition, the arbitration circuit controls the power-on and power-off of the main computer and standby computer through the main machine switching signal and standby machine switching signal.

[0009] The arbitration circuit communicates with the three SOC computers of the main / standby computer through bus signal, which is used to store key data in the computer. The key data is stored after three-out-of-two comparison in the arbitration circuit. Wherein the bus signal can be selected as low-speed serial bus or High-speed serial bus is adopted.

[0010] There are three SOC computers in the main / standby computer respectively, and the SOC computer can be realized by ZYNQ7000 series chip.

[0011] The three SOC computers are connected with each other through bus, realizing data communication of any two SOC computers, wherein the communication bus can be selected as low-speed serial bus or high-speed serial bus.

[0012] The three SOC computers are connected with each other through synchronous interrupt signal, wherein the synchronous interrupt signal of on-duty module is as output, and the synchronous interrupt signal of non-on-duty module is as input.

[0013] The three SOC computers are connected with each other through CS and CLK signals of SPI bus. Wherein the CS and CLK signals of on-duty module are as output, and the synchronous interrupt signal of non-on-duty module is as input.

[0014] The three SOC computers further include an SPI module, an IO input and output module, and a UART module. Functions of the modules are realized by the PL end. The module signals are interacted with external circuits after being combined by a level conversion circuit.

[0015] The three SOC computers further include a CAN bus module and a network communication module. Functions of the modules are realized by the PS end. The module signals can be directly mounted on the bus.

[0016] Compared with the prior art, the present application has the following beneficial effects: (1) The starboard computer three-module redundant master-slave computer architecture improves the reliability of the entire computer through the master-slave computer redundancy and single computer three-module redundancy architecture. (2) The starboard computer three-module redundant master-slave computer architecture improves the accuracy of data and reduces the complexity of data transmission by connecting the CS and SCLK signals in the SPI bus of the three SOC computers. BRIEF DESCRIPTION OF DRAWINGS

[0017] Figure 1 It is a starboard computer three-module redundant master-slave architecture diagram.

[0018] Figure 2 It is a three-module redundant architecture diagram in the master / slave computer single machine.

[0019] Figure 3 It is a three-module redundant synchronization signal connection diagram in the master / slave computer single machine.

[0020] Figure 4 It is an analog quantity acquisition connection diagram in the master / slave computer single machine. DETAILED DESCRIPTION

[0021] The technical solutions of the present application will be described clearly and completely below with reference to the drawings. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0022] In addition, the technical features involved in the embodiments of the present application described below can be combined with each other as long as there is no conflict.

[0023] The embodiment of the present application provides a starboard computer three-module redundant master-slave architecture, as shown in the figure. Figure 1 The architecture is composed of an arbitration circuit, The main computer and the backup computer are combined. The arbitration circuit is composed of high-level FPGA circuits, and particularly, anti-fuse FPGA can be selected to have higher reliability. The main computer and the backup computer have the same functions and components, and are respectively composed of three completely independent computers with ZYNQ7000 series SOC as the core. The arbitration circuit realizes the monitoring and control of the main computer and the backup computer through several I / O circuits.

[0024] The arbitration circuit in the embodiment of the application realizes the switching between the main computer and the backup computer: three SOC modules output state signals to the arbitration circuit, wherein the state signals are at least composed of two I / O signals, for example, when the two I / O signals are 01, the SOC module is the on-duty module, when the two I / O signals are 10, the SOC module is the off-duty module, and when the two I / O signals are 11, the SOC module has a fault. When the main computer is powered on and works, if two SOC modules in the main computer have errors, the arbitration outputs a backup computer switching signal, the main computer is powered off, the backup computer is powered on, and the switching between the main computer and the backup computer is realized.

[0025] The arbitration circuit in the embodiment of the application also realizes the switching of the three on-duty modules in the main / backup computer: when the main computer is powered on and works, the arbitration circuit monitors the watchdog signals output by the three SOC modules of the main computer at all times, for example, when the SOC module 1 (the on-duty module) has a program runaway error and cannot output the watchdog signal in time, the arbitration circuit outputs a power-off signal to the SOC module 1 to make the module powered off, and at the same time, the arbitration circuit outputs a setting signal to the SOC module 2 to set it as the on-duty module. The same is true for the SOC module 3.

[0026] The arbitration circuit in the embodiment of the application also realizes the storage of key data: the three SOC modules respectively send key data to the arbitration circuit through a serial bus at a fixed time, the arbitration circuit stores the key data after three-out-of-two comparison, and the key data is used for state recovery when the main / backup computer is initially powered on. The serial bus in communication with the arbitration circuit can also be replaced with other buses, such as a high-speed serial bus.

[0027] The single SOC module in the embodiment of the application has ZYNQ7000 series chips as the core, for example, the ZYNQ7020 chip. Figure 2The external communication function includes network communication, CAN communication, serial port communication and SPI communication, wherein the network communication and the CAN communication adopt the controller of the PS end of the ZYNQ7000 series chip, and are directly hung on the bus through an interface circuit. The serial port communication control, the SPI communication control and the I / O input and output control are realized by the PL end of the ZYNQ7000 series chip, and the combination of the signals of the three SOC modules is realized through a level conversion chip, and the combination is realized after the corresponding functions are realized. In addition, the synchronization module, the data interaction module and the SPI communication module are also realized by the PL end of the ZYNQ7000 series chip, and are connected in pairs in the module 1, the module 2 and the module 3.

[0028] The synchronization of the three SOC modules in the embodiment of the application is as shown in Figure 3 The key of the three-module redundancy one core is to realize the three-module synchronization, and the input and output I / O of the PL end of the ZYNQ7000 series chip is adopted in the patent. The PL end of the ZYNQ7000 series chip is a FPGA with certain resources, and the I / O of the interrupt signal is set as an input and output signal. It is illustrated that when the SOC module 1 is the on-duty module, the interrupt signal is set as an output, and the SOC module 2 and the SOC module 3 are set as inputs, and the interrupt output signal is used as the input of the SOC module 2 and the SOC module 3. At the same time, the interrupt output signal is output to the PS end in the form of an interrupt in the ZYNQ7000 chip, and the SOC module 2 and the SOC module 3 also receive the synchronization interrupt signal in the form of an interrupt in the ZYNQ7000 series chip and output to the PS end, so as to realize the synchronization interrupt of the three modules.

[0029] The three-module synchronization collection of the analog quantity in the embodiment of the application is as shown in Figure 4 The commonly used AD chip is mainly an SPI interface, and the SPI has four signals of CS, MOSI, MISO and SCLK. The three SOC modules only control one AD chip, and the SPI signals of the three SOC modules are first combined through a level conversion chip and then interact with the AD chip. In order to realize that the three SOC modules can directly receive the data of the AD chip at the same time, the connection as shown in Figure 4 is adopted, and the working principle is as follows: when the SOC module 1 is the on-duty module, the CS, the MOSI and the SCLK The three-way signal directly communicates with the AD chip through a level conversion chip, and the CS and SCLK signals of the SOC module 1 are output to the SOC module 2 and the module 3; the SOC module 2 and the module 3 are non-shift modules, and the CS, MOSI and SCLK signals of each of the SOC module 2 and the module 3 cannot be output to the AD chip by controlling the level conversion chip; the MISO signal output by the AD chip is output to the three SOC modules through the level chip, and the MISO signal is parsed according to the CS and SCLK signal time sequence of the SOC module 1; since the SOC module 2 and the module 3 also receive the CS and SCLK signals of the SOC module 1, the MISO signal data can also be parsed. In this way, three-module synchronous acquisition of analog quantities is realized.

[0030] In the embodiment of the application, the arbitration circuit and the three SOC modules interact with each other through a serial port, and the three SOC modules interact with each other through a serial port.

[0031] The single-SOC computer of the three-module redundant master-slave architecture of a satellite computer provided in the embodiment of the application further includes a crystal oscillator, a DDR3 memory, a QSPI FLASH, an EMMC FLASH and a power supply circuit.

[0032] In the embodiment of the application, the ZYNQ7000 series chip selects XC7Z010, the main frequency can reach 866MHz, the crystal oscillator selects SiT8924BA-22-33N-50.000000E of SiTime company as the clock of PS, the DDR3 memory selects IS46TR16128DL-125KBLA1 of ISSI company, a total of two pieces, each piece is 16*12Mb in capacity, the QSPI FLASH selects S25FL512SDSMFBG10 of CYPRESS company, the capacity is 64MB, the EMMC FLASH selects IS22ES08G-JCLA1 of ISSI company, the capacity is 8GB, the power supply of XC7Z010 selects LTM4643I of ADI, provides 1.0V, 1.5V, 1.8V and 3.3V voltage for SOC, the power supply of DDR selects the special power supply TPS51200DRCT of TI company for DDR, the CAN controller uses the controller of the PS end of XC7Z010, the CAN interface chip uses TJA1042 of NXP company, supports 5Mbit / s at most, a total of two ways, the network controller also uses the controller of the PS end of XC7Z010, the PHY transceiver selects KSZ9031RNXIC-TR of MICROCHIP company, supports 1000Mbps, the level conversion chip uses CLVC16T245MDGGREP of TI, supports output enable, AD selects ADC121S101 of TI, 12-bit resolution, supports 1Msps sampling rate at most, communicates with other single computers through RS422, uses DS26C31ME / 883 and DS26C32AME / 883 of TI to realize the sending and receiving of RS422 respectively.It needs to be explained that all chip models in the embodiment of the application are for example, other models can also be selected in actual application, and the application is not limited.

[0033] The content not described in detail in the specification of the application belongs to the known technology of the person skilled in the art.

Claims

1. A spaceborne computer triple modular redundant primary-backup computer architecture, characterized by, The application relates to a computer multi-mode redundancy system. In the main computer / backup computer architecture, for the AD adopting an SPI interface, the CS and SCLK signals in the SPI signals are interconnected between the three CPU computers, so that three-mode synchronous acquisition of analog signals is realized. The arbitration circuit is generally realized by an FPGA circuit, and a high-quality FPGA is selected to improve reliability.

2. The three modular redundant master-backup computer architecture for a spaceborne computer according to claim 1, wherein: The arbitration circuit is connected with the three CPU computers of the main computer and the backup computer through power-off signals, dog-feeding signals, setting signals, state signals and bus signals. The state signals are composed of at least two I / O signals. In addition, the arbitration circuit controls the power-on and power-off of the main computer and the backup computer through main computer switching signals and backup computer switching signals.

3. The computer architecture of claim 1 and 2, wherein: The arbitration circuit communicates with the three CPU computers of the main / backup computer through bus signals, and is used for storing key data in the computer. The key data is stored after three-out-of-two comparison in the arbitration circuit. The bus signals can be low-speed serial bus or high-speed serial bus.

4. The computer architecture of claim 1 and 2, wherein: The main / backup computer comprises three CPU computers, and the CPU computers can be realized by ZYNQ7000 series chips.

5. The three modular redundant primary and backup computer architecture for a spaceborne computer of claim 1, wherein: The three CPU computers are connected with each other through bus lines, so that data communication between any two CPU computers is realized. The communication bus can be a low-speed serial bus or a high-speed serial bus.

6. The three modular redundant master-back computer architecture of claim 5, wherein: The three CPU computers are connected with each other through synchronous interrupt signals, wherein the synchronous interrupt signal of the on-duty module is taken as output, and the synchronous interrupt signal of the non-on-duty module is taken as input.

7. The computer architecture of claim 5, wherein: The three CPU computers are connected with each other through the CS and CLK signals of the SPI bus. The synchronous interrupt signal of the on-duty module is taken as output, and the synchronous interrupt signal of the non-on-duty module is taken as input.

8. The computer architecture of claim 1 and 5, wherein: The three CPU computers further comprise SPI modules, IO input / output modules and UART modules. The module functions are realized by the PL end. The module signals are all connected with external circuits after being combined by level conversion circuits.

9. The three modular redundant primary and backup computer architecture for a spaceborne computer of claim 5, wherein: The three CPU computers further comprise CAN bus modules and network communication modules. The module functions are realized by the PS end, and the modules can be directly mounted on the bus.

10. The three modular redundant primary and backup computer architecture for a spaceborne computer of claim 5, wherein: ​

Images