Camera controller on-orbit autonomous reconstruction system and method based on multiple SOCs

Abstract

The invention discloses a multi-SOC-based camera controller on-orbit autonomous reconstruction system and method, and relates to the technical field of space camera master control. The invention aims to solve the problem that the single event effect (such as function error or disorder) of the SOC device is easily caused in the space intense radiation environment in the prior art. Comprising a main control unit, an SPI communication data line, a switch channel unit, a FLASH storage unit, a CAN bus communication unit, an RS-422 bus communication unit, a focusing control unit and a temperature control and detection unit. According to the invention, three SOCs are adopted to form hardware redundancy, on-orbit autonomous error detection and correction functions are realized, and the operation stability and reliability of the camera controller in a harsh space radiation environment are effectively improved. The switch channel unit is adopted to dynamically allocate the peripheral control right, when a certain SOC fails, the SOC can be seamlessly switched to a normal SOC to take over a peripheral channel of the SOC, and the function continuity is guaranteed; and after the fault SOC is recovered, the default configuration can be automatically switched back.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of space camera master control, and in particular to a camera controller on-orbit autonomous reconstruction method based on multi-SOC (System on Chip). BACKGROUND

[0002] The space environment (especially the earth orbit) has high-intensity and various types of ionizing radiation (such as cosmic rays, solar flare particles, and earth radiation belt particles). These radiation particles bombarding semiconductor devices (such as SOC) are extremely prone to single event effects (SEE), mainly including: single event upset (SEU), single event transient (SET), single event latchup (SEL) and single event functional interrupt (SEFI). As the core control unit of the space camera, the SOC is highly sensitive to such effects and is a key weak link of system reliability.

[0003] With the development of space technology and electronic communication, modern high-performance space cameras (such as high-resolution optical cameras and hyperspectral cameras) need to have strong real-time processing capabilities to complete image acquisition compression, storage management, precise temperature control, multi-axis motor driving (focusing, image stabilization), multi-sensor data fusion, satellite platform high-speed communication (RS422, CAN, etc.) and autonomous task scheduling and other complex functions. Therefore, it is inevitable to use high-performance and high-integration SOC (such as processors based on ARM, RISC-V, etc.). However, such SOC has small transistor size, low node capacitance, and complex internal structure (including a large number of SRAM cache, complex state machine, high-speed serial interface, PLL, etc.), and has many radiation sensitive points, which makes it face serious challenges in the space radiation environment.

[0004] In view of the above technical limitations and key requirements, the present application proposes an on-orbit autonomous reconstruction method of a camera controller based on multi-SOC. The design uses an innovative hardware architecture (three-SOC redundancy) and supporting strategies to achieve high-reliability error detection and accurate positioning, accurately identify the fault source using the mutual detection and voting mechanism between the three SOC modules, and automatically isolate the faulty SOC and perform system software reconstruction to restore normal operation of the system without ground intervention. Comprehensive radiation effect protection not only protects against storage errors (SEU), but also effectively deals with SET, SEFI, and SEL that require power recovery.

[0005] In summary, the on-orbit autonomous reconstruction method of the camera controller based on multi-SOC provides an innovative solution for high-reliability and radiation-resistant camera control in complex space tasks. SUMMARY

[0006] The application provides a multi-SOC-based camera controller on-orbit autonomous reconstruction system and method to solve the problems in the prior art that a single SoC is prone to single event effects (SEU, SET, SEL and SEFI) caused by a space radiation environment (such as cosmic rays and solar flare particles), and that a single main control core has limited resources and cannot effectively cope with multiple radiation failure modes in complex space tasks and ensure continuous and highly reliable operation.

[0007] A multi-SOC-based camera controller on-orbit autonomous reconstruction system, which comprises a main control unit, a switch channel unit, a FLASH storage unit, a CAN bus communication unit, an RS-422 bus communication unit, a focusing control unit and a temperature control and detection unit, and is characterized in that:

[0008] The main control unit is composed of three SOCs, the three SOCs are connected to each other through SPI communication data lines, synchronous transmission of peripheral function data is realized, and mutual state monitoring and reconstruction command transmission between the three SOCs are realized;

[0009] Different peripherals are connected to the three SOCs through the switch channel unit; the switch channel unit is used to realize dynamic allocation of peripheral connection channels by the main control unit; in the default state, the three SOCs control different peripherals; when a certain SOC fails, the switch channel unit corresponding to the failed SOC is closed, and the channel unit corresponding to another normal SOC is opened; after the failed SOC is restored, the default state is switched back;

[0010] The FLASH storage unit stores a plurality of version system programs for SOC reconstruction, and selects and loads a program according to a reconstruction command issued by the main control unit;

[0011] According to the fault detection result, the main control unit issues different reconstruction commands to select the corresponding version system program stored in the FLASH storage unit for reconstruction; meanwhile, the connection relationship between the SOC and the peripheral is dynamically switched through the control switch channel unit;

[0012] The CAN bus communication unit, the RS-422 bus communication unit, the focusing control unit and the temperature control and detection unit are respectively used to realize computer communication, imaging data input and output, space camera focusing and temperature control and detection of the space camera controller, are allocated to different SOCs according to different functions, and are switched between different SOCs through the switch channel unit.

[0013] The application further provides a multi-SOC-based camera controller on-orbit autonomous reconstruction method, which is realized through the autonomous reconstruction system and comprises the following steps:

[0014] Step one, reconfiguration system initialization;

[0015] Step two, each voting module of the three SOC outputs peripheral data;

[0016] Step three, judge whether the peripheral data output by the three SOC has error, if yes, execute step four; otherwise, return to step two;

[0017] Step four, determine the fault SOC, analyze the fault position, and record the voting error times;

[0018] Step five, judge whether the error times accumulation is greater than 10 times, if yes, execute step six; otherwise, return to execute step two;

[0019] Step six, switch the peripheral channel, send the reconfiguration command to the fault SOC, reconfigure the fault SOC through the reconfiguration module, switch back to the peripheral channel after the reconfiguration is completed, and return to step one.

[0020] The beneficial effects of the application are as follows:

[0021] The camera controller disclosed by the application utilizes the three SOC redundant architecture and the on-orbit autonomous reconfiguration mechanism, realizes efficient fault tolerance to the single particle effect (SEU, SET, SEL, SEFI) caused by space radiation, and ensures the long-term stable operation of the controller in the severe space environment. When any SOC fails, the mutual inspection mechanism of the system can accurately locate the fault source, and trigger the reconfiguration command in time, combines the multi-version program of the FLASH storage unit to recover the system, realizes the rapid isolation and function reconfiguration of the fault.

[0022] In order to improve the survivability and resource utilization of the system, the application adopts the switch channel unit to dynamically allocate the peripheral control right. When a certain SOC fails, it can be seamlessly switched to the normal SOC to take over its peripheral channel, and guarantee the function continuity; after the fault SOC is recovered, it can be automatically switched back to the default configuration. At the same time, the three SOC cooperatively manages the key function unit (including CAN bus, RS-422 bus, focusing control and temperature control detection), and improves the overall reliability through load sharing.

[0023] The application also constructs an intelligent autonomous decision system: the three SOC completes the fault diagnosis, reconfiguration strategy selection and resource scheduling autonomously through the real-time mutual inspection and voting mechanism, greatly reduces the dependence on ground intervention. Therefore, the camera controller based on the multi-SOC has the core advantages of high reliability, strong fault tolerance, fast recovery and self-adaptation, and significantly improves the on-orbit survivability and task continuity of the space camera. BRIEF DESCRIPTION OF DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description only some embodiments of the present application, and for those skilled in the art, on the premise of not creating labor, can also obtain other drawings from these drawings.

[0025] Figure 1 The structural schematic diagram of the multi-SOC based camera controller in the on-orbit autonomous reconstruction system.

[0026] Figure 2 The system block diagram of each module of the main control circuit and its signal flow when working normally; wherein, (a) is the schematic diagram of the switch channel unit A1 of SOC1 connecting the CAN bus communication unit; (b) is the schematic diagram of the switch channel unit B2 of SOC2 connecting the RS-422 bus communication unit; (c) is the schematic diagram of the switch channel unit C3 and the switch channel unit D3 of SOC3 connecting the focusing control unit and the temperature control and detection unit.

[0027] Figure 3 The schematic diagram of the FLASH storage unit storing programs.

[0028] Figure 4 The system block diagram of each module of the main control circuit and its signal flow when SOC2 fails in the multi-SOC based camera controller on-orbit autonomous reconstruction method; wherein, (a) is the schematic diagram of SOC1 when SOC2 fails; (b) is the schematic diagram of SOC3 when SOC2 fails.

[0029] Figure 5 The basic flow block diagram of the multi-SOC based camera controller on-orbit autonomous reconstruction method.

[0030] Figure 6 The basic flow block diagram of the reconstruction process of the multi-SOC based camera controller on-orbit autonomous reconstruction method. DETAILED DESCRIPTION

[0031] In order to make the objects, technical solutions and advantages of the present application clearer, the following will further describe the present application in combination with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and not used to limit the present application.

[0032] It is to be understood that the references used herein to "one embodiment", "an embodiment", "example embodiment", etc. do not necessarily all refer to the same embodiment, although they can. Furthermore, the described features, structures, or characteristics can be combined in any suitable manner in one or more embodiments. The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of other embodiments.

[0033] In addition, a certain terminology can also be used in the specification and claims that have commonly understood meanings to a person skilled in the art, and in some instances terms can have been assigned a special meaning in this specification. It is intended that the definitions given in this specification be applicable to all instances of the particular term and not just to instances in which the term is used in the particular paragraph. It is to be understood that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of other embodiments.

[0034] DETAILED DESCRIPTION Figures 1 to 4 In this embodiment, a multi-SOC-based camera controller on-orbit autonomous reconfiguration system includes a master control unit, an SPI communication data line, a switch channel unit, a FLASH storage unit, a CAN bus communication unit, an RS-422 bus communication unit, a focusing control unit, and a temperature control and detection unit.

[0035] The master control unit is composed of three SOCs, each of which is responsible for interacting with different peripherals. The SOCs are connected by an SPI communication data line to achieve synchronous transmission of peripheral function data and to monitor the state of each other and transfer reconfiguration commands. According to the fault detection results, the master control unit sends different reconfiguration commands to select the corresponding version of the system program stored in the FLASH storage unit for reconfiguration. At the same time, the connection relationship between the SOC and the peripheral can be dynamically switched by controlling the switch channel unit.

[0036] The SPI communication data line connects the three SOCs and transmits peripheral data based on a specific data protocol to achieve synchronization. When a SOC fails, one of the remaining normal SOCs sends a reconfiguration command to the failed SOC through the SPI communication data line.

[0037] The switch channel unit realizes dynamic allocation of the external device connection channel by the master control unit. In the default state, three SOCs control different external devices. When a certain SOC fails, the corresponding external device channel is closed, and another normal SOC takes over (opens the channel). After the fault SOC recovers, it can be switched back to the default connection state.

[0038] The FLASH storage unit stores multiple version system programs for SOC reconstruction, and selects and loads the program according to the reconstruction command issued by the master control unit.

[0039] The CAN bus communication unit, RS-422 bus communication unit, focusing control unit, and temperature control and detection unit realize the core functions of the space camera controller, including space camera focusing, host computer communication, temperature control and detection, and imaging data input / output. These units are allocated to different SOCs according to their functions, and their physical connections can be switched between different SOCs through the switch channel unit.

[0040] As shown in Figure 1 , the switch channel unit is composed of 54 analog switch chips (each analog switch chip is responsible for the on-off of 2 pin channels of the SOC), and is divided into 12 groups (4 groups are allocated to each SOC). Four independent external devices are connected to three SOCs through the switch channel unit, and the SOC realizes the on-off control of the channel through three control pins. The default configuration is as shown in Figure 2 : SOC1 enables the switch channel unit A1 connected to the CAN bus communication unit; SOC2 enables the switch channel unit B2 connected to the RS-422 bus communication unit; SOC3 enables the switch channel unit C3 and the switch channel unit D3 connected to the focusing control unit and the temperature control and detection unit.

[0041] In this embodiment, as shown in Figure 1 , the FLASH storage unit is connected to the SPI0 interface of the three SOCs, and the SOC reads the program in the FLASH storage unit through system service to reconstruct the system. As shown in Figure 3 , the FLASH storage unit stores three different versions of programs according to different fault positions, and the initial program contains FPGA and ARM programs, which are stored from address 0x00000400; the FPGA program only contains the FPGA program, which is stored from address 0x00A00000; the ARM program only contains the ARM program, which is stored from address 0x01400000; and the index of the three different versions of programs is stored from address 0, and each index occupies 4 bytes. According to the fault positioning of the reconstruction instruction, the SOC can directly read the target address program or jump to execute the reconstruction through the index.

[0042] As shown in Figure 1As shown, the CAN bus communication unit includes two CAN bus communication units connected with the on-board computer, realizing the communication between the space camera controller and the on-board computer; the RS-422 bus communication unit includes three RS-422 bus communication units connected with the CCD, realizing the imaging data receiving and information output of the space camera controller and the CCD; the focusing control unit is connected with the peripheral motor, encoder and Hall, executing the precise focusing control instruction of the space camera controller; the temperature control and detection unit is connected with the thermistor and heating band, mainly realizing the temperature monitoring and closed-loop control task of the space camera controller. These units are distributed to different SOC controls according to functions, and the physical connection can be switched among different SOC through the switch channel unit, so that the function will not be interrupted when a fault occurs.

[0043] As shown in Figure 2 The three SOC realize the default allocation of peripheral resources by controlling the switch channel unit, and complete data transmission by using the SPI communication data line to realize the synchronization of peripheral data. The system adopts a 50MHz external crystal oscillator, which provides clock signals for each module of the SOC master circuit through a phase-locked loop frequency division.

[0044] In this embodiment, the three SOC each include a focusing control module, a temperature control and detection module, a computer communication module, a CCD imaging communication module, a FLASH control module, an SPI drive module, a reconstruction module, a switch control module, a voting module, and RS422 bus drive module and CAN bus drive module, these peripheral drive modules, but the space camera controller will allocate the peripherals by default when working normally, only the corresponding functional modules are enabled (the unenabled modules are used when a piece of SOC fails, and the normal SOC takes over the failed SOC), as shown in Figure 2(a), (b), (c) in FIG. 1 respectively show the default peripheral allocation and the enabled internal module structure of SOC1, SOC2, SOC3 when working normally. The blue line represents the signal flow of the space camera controller receiving peripherals, the red line represents the signal flow of the space camera controller sending, and the black line represents the signal flow of the internal signals of the space camera controller. When working normally, after the CAN bus communication unit receives the data transmitted by the onboard computer, the computer communication module of SOC1 processes the data first, and at the same time, the data is transmitted to the computer communication modules of SOC2 and SOC3 through the SPI communication data line for parallel processing. After the processed data is returned to SOC1 through the SPI communication data line, it is input into the voting module together with the local processing result for consistency check. After the voting passes, the CAN bus drive module of SOC1 returns the data to the onboard computer through the CAN bus communication unit. Similarly, the RS-422 bus communication unit, the focusing control unit, and the temperature control and detection unit of SOC2 and SOC3 in (b) and (c) also adopt this working process: after the peripheral data is processed by the corresponding SOC, the data is synchronized across SOCs through the SPI communication data line, and the processed result is output after the accuracy is ensured through the voting mechanism, thereby ensuring the synchronization and reliability of the overall data processing of the system.

[0045] In this embodiment, as shown in Figure 4 When SOC2 fails, the signal flow diagram of SOC1 taking over the peripherals of SOC2 is shown in FIG. 1. The blue line represents the signal flow of the space camera controller receiving peripherals, the red line represents the signal flow of the space camera controller sending, and the black line represents the signal flow of the internal signals of the space camera controller. When SOC2 fails, SOC2 closes the switch channel unit B2 allocated by it and performs the reconstruction process as shown in Figure 4 (a) of FIG. 1. SOC1 opens the switch channel unit B1 to take over the peripheral function of SOC2. After the CAN bus communication unit and the RS-422 bus communication unit receive the data transmitted by the onboard computer and the CCD respectively, the computer communication module and the CCD imaging communication module of SOC1 process the data, and at the same time, the data is transmitted to the computer communication module and the CCD imaging communication module of SOC3 through the SPI communication data line for parallel processing. After the processed data is returned to SOC1 through the SPI communication data line, it is input into the voting module together with the local processing result for consistency check. After the voting passes, the CAN bus drive module and the RS-422 bus drive module of SOC1 send the data to the onboard computer and the CCD. Similarly, as shown in (b) of FIG. 1, the focusing control unit and the temperature control and detection unit of SOC3 also adopt this working process. When SOC2 is reconstructed, SOC1 closes the switch channel unit B1, and SOC2 opens the switch channel unit B2, and returns to the default working state as shown in Figure 2 , thereby completing the troubleshooting of the space camera controller.

[0046] DETAILED DESCRIPTION TWO, COMBINATION Figure 5 and Figure 6 The present embodiment adopts the method of a multi-SOC-based camera controller in-orbit autonomous reconstruction system described in embodiment one. The method realizes efficient fault tolerance to space radiation single event effects through a three-SOC redundant architecture and in-orbit autonomous reconstruction mechanism, ensuring long-term stable operation of the controller in a harsh space environment. When any SOC fails, the system accurately locates the fault source and triggers a reconstruction command through the mutual inspection mechanism, and performs system recovery in combination with the multi-version program stored in FLASH. This design can realize autonomous fault-tolerant reconstruction in a space radiation environment, meeting the task requirements of high reliability operation of space cameras in orbit. The specific method steps are as follows:

[0047] Step one, reconstruction system initialization;

[0048] Step two, each voting module of the three SOCs outputs peripheral data;

[0049] Step three, judge whether the peripheral data output by the three SOCs has errors, if yes, execute step four; otherwise, return to step two;

[0050] Step four, determine the faulty SOC, analyze the fault location, and record the number of voting errors;

[0051] Step five, judge whether the cumulative number of errors is greater than 10, if yes, execute step six; otherwise, return to execute step two;

[0052] Step six, switch the peripheral channel, send a reconstruction command to the faulty SOC, and perform reconstruction of the faulty SOC through the reconstruction module. After reconstruction is completed, switch back to the peripheral channel and return to step one.

[0053] As Figure 5As shown, when the voting module finds that the voting is inconsistent, it first analyzes which SOC has an error to determine the faulty SOC and transmits information to the reconstruction module for fault analysis to determine the fault location. Meanwhile, the voting module records whether the error is persistent and exceeds 10 times. If not, the SOC returns to normal, and if it has exceeded, the information is transmitted to the reconstruction module for processing. If the faulty SOC is the current SOC, the peripheral switch channel unit of the current SOC is closed, and one of the other two SOCs opens the corresponding peripheral channel to replace the faulty SOC and communicate with the peripheral. If the faulty SOC is another SOC, the reconstruction module transmits the reconstruction instruction to the reconstruction module in the faulty SOC through the SPI communication data line corresponding to the faulty SOC, closes the peripheral switch channel unit of the faulty SOC, and opens the corresponding peripheral channel by the current SOC or the other SOC to replace the faulty SOC and communicate with the peripheral, thereby ensuring the stability of the camera controller function. After the reconstruction is completed, the corresponding peripheral channel is switched back to the default working state.

[0054] In this embodiment, as shown in Figure 6 Figure 6 The specific reconstruction process is as follows: after receiving the reconstruction command, the reconstruction module enables the SPI master mode, specifies the program version according to the analyzed fault location, selects the FPGA program if only the FPGA part has an error, selects the ARM program if only the ARM part has an error, and selects the initial program if both have errors. After selecting the program version, the system service of the SOC is enabled. First, the program is verified by bit stream. After verification, the version program is used to reconstruct the faulty SOC. Then, it is checked whether the SOC is successfully reconstructed. If so, a signal indicating successful reconstruction is sent to the other two SOCs, and the peripheral channel is switched back to initialization and program execution to restore the default state. If the verification is not successful, the initial program is used to reconstruct the faulty SOC. Then, it is checked whether the SOC is successfully reconstructed. If so, a signal indicating successful reconstruction is sent to the other two SOCs, and the peripheral channel is switched back to initialization and program execution to restore the default state. Then, it communicates with the on-board computer to update the repair FLASH storage unit program and reinitiates the reconstruction.

[0055] ​In the embodiment, three SOC redundancy architectures are adopted to realize cross-SOC data synchronization and mutual inspection with SPI communication data lines, so as to ensure long-term reliable operation of the system in a space radiation environment. In addition, by dynamically allocating peripheral control rights through a switch channel unit, the connection channel of the SOC and the functional unit can be switched in real time, multi-version program reconstruction configuration is supported, and the survivability and resource utilization of the system are significantly improved. The application also constructs a full-autonomous fault diagnosis and reconstruction system, the voting module and the reconstruction module intelligently cooperate to realize closed-loop control of fault positioning, program selection and channel switching, the system function can be restored without manual intervention, and the operation and maintenance complexity of the space camera is greatly reduced. Therefore, the space camera controller based on the multiple SOC has the core advantages of high reliability, strong fault tolerance, fast recovery and self-adaptation.

[0056] The above-described embodiments only express the embodiments of the present application, which are described in detail, but should not be understood as a limitation on the scope of the patent. It should be noted that for ordinary skilled persons in the art, without departing from the concept of the present application, a number of modifications and improvements can be made, which are within the scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims.

Claims

1. An on-orbit autonomous reconfiguration system for a camera controller based on multiple SOCs, comprising a main control unit, a switch channel unit, a FLASH storage unit, a CAN bus communication unit, an RS-422 bus communication unit, a focus control unit, and a temperature control and detection unit; characterized by: The main control unit consists of three SOCs, which are interconnected via SPI communication data lines to achieve synchronous transmission of peripheral function data and to monitor the mutual status and transmit reconfiguration commands among the three SOCs. Different peripherals are connected to the three SOCs through the switching channel unit; the switching channel unit realizes the dynamic allocation of the connection channel of the main control unit to the peripherals. In the default state, the three SOCs control different peripherals; when a SOC fails, the switching channel unit of its corresponding peripheral is turned off, and the channel unit corresponding to another normal SOC is turned on. After the faulty SOC is restored, it switches back to the default state. The FLASH storage unit stores multiple versions of system programs for SOC reconstruction, and selects and loads programs according to the reconstruction command issued by the main control unit. Based on the fault detection results, the main control unit issues different reconfiguration commands, selects the corresponding version of the system program stored in the FLASH storage unit for reconfiguration; at the same time, it dynamically switches the connection relationship between the SOC and peripherals by controlling the switch channel unit. The CAN bus communication unit, RS-422 bus communication unit, focusing control unit, and temperature control and detection unit are respectively used to realize communication with the host computer of the space camera controller, input and output of imaging data, focusing of the space camera, and temperature control and detection. They are assigned to different SOCs according to their functions and switched between different SOCs through the switching channel unit.

2. The on-orbit autonomous reconfiguration system for a camera controller based on multiple SOCs according to claim 1, characterized in that: The CAN bus communication unit includes two CAN bus communication units connected to the onboard computer in the peripheral device, enabling communication between the space camera controller and the onboard computer; the RS-422 bus communication unit includes three RS-422 bus communication units connected to the CCD in the peripheral device, enabling the space camera controller to receive imaging data and output information to the CCD; the focusing control unit is connected to the motor, encoder and Hall effect sensor in the peripheral device, executing the precision focusing control commands of the space camera controller; the temperature control and detection unit is connected to the heating belt and thermistor, realizing the temperature monitoring and closed-loop control tasks of the space camera controller.

3. The on-orbit autonomous reconfiguration system for camera controllers based on multiple SOCs according to claim 1, characterized in that: The switching channel unit is divided into 12 groups, with 4 groups allocated to each SOC; Four independent peripherals are connected to three SOCs respectively through a switch channel unit. The SOCs control the opening and closing of the channels through three control pins.

4. The on-orbit autonomous reconfiguration system for a camera controller based on multiple SOCs according to claim 3, characterized in that: SOC1 is the switch channel unit A1 connected to the CAN bus communication unit; SOC2 is the switch channel unit B2 connected to the RS-422 bus communication unit; SOC3 is the switch channel unit C3 and switch channel unit D3 connected to the focusing control unit and the temperature control and detection unit.

5. The on-orbit autonomous reconfiguration system for a camera controller based on multiple SOCs according to claim 4, characterized in that: During normal operation, after the CAN bus communication unit receives data transmitted from the onboard computer, it is first processed by the computer communication module of SOC1. Simultaneously, the data is synchronously transmitted to the computer communication modules of SOC2 and SOC3 via the SPI communication data line for parallel processing. The processed data is then sent back to SOC1 via the SPI communication data line and input together with the local processing result into the voting module for consistency verification. After the vote is passed, the CAN bus driver module of SOC1 returns the data to the onboard computer via the CAN bus communication unit. Similarly, the RS-422 bus communication units, focusing control unit, and temperature control and detection unit of SOC2 and SOC3 also perform the same process. After the peripheral data is processed by the corresponding SOC, cross-SOC data synchronization is achieved via the SPI communication data line, and the voting module ensures the accuracy of the processing result before outputting it.

6. The on-orbit autonomous reconfiguration system for a camera controller based on multiple SOCs according to claim 5, characterized in that: When a SOC fails, its corresponding switching channel unit is shut down and reconfigured; then, one of the other two normal SOCs is selected and its corresponding switching channel unit is turned on to perform data transmission between the failed SOC and the peripheral device; at the same time, the data is synchronously transmitted to another normal SOC for parallel processing via the SPI communication data line. After the processed data is transmitted back to the normal SOC via the SPI communication data line, it is input together with the local processing result into the voting module for consistency verification. After the vote is passed, the normal SOC sends the data to the corresponding peripheral. Once the faulty SOC has been reconstructed, the normal SOC will shut down the corresponding switch channel unit, and the restored SOC will turn on the switch channel unit and restore the default working state, thus completing the troubleshooting of the space camera controller.

7. The on-orbit autonomous reconfiguration system for a camera controller based on multiple SOCs according to claim 6, characterized in that: When the voting results of the voting module are inconsistent, it is necessary to identify the faulty SOC and transmit the information to the reconstruction module for fault analysis to determine the fault location. Simultaneously, the voting module records whether the error persists and exceeds 10 times. If not, the SOC returns to normal; if it exceeds 10 times, the information is transmitted to the reconstruction module for processing. If the faulty SOC is this SOC, the peripheral switching channel unit of this SOC is shut down, and the switching channel of the corresponding peripheral device of any of the other two SOCs is opened to take over the communication between the faulty SOC and the peripheral device. If the faulty SOC is another SOC, the reconstruction module transmits the reconstruction command through the SPI communication data line of the corresponding faulty SOC to the reconstruction module in the faulty SOC, shutting down the peripheral switching channel unit of the faulty SOC. This is then done by this SOC or another SOC opening the corresponding peripheral channel to take over the communication between the faulty SOC and the peripheral device, thus stabilizing the space camera controller function. After reconstruction is complete, the corresponding peripheral switching channel is switched back, restoring the default operating state.

8. The on-orbit autonomous reconfiguration system for a camera controller based on multiple SOCs according to claim 7, characterized in that: Upon receiving the reconfiguration command, the reconfiguration module enables SPI master mode and specifies the program version based on the analyzed fault location. If only the FPGA part has an error, the FPGA program is selected; if only the ARM part has an error, the ARM program is selected; if both have errors, the initial program is selected. After selecting the program version, the SOC's system services are enabled. First, the bitstream of the program is verified. If the verification is successful, the version of the program is used to reconfigure the faulty SOC. Then, the SOC is checked to see if it has been successfully reconfigured. If successful, the reconfiguration success signal is sent to the other two SOCs, and the peripheral channel initialization is switched back and the program is executed to restore the default state. If the verification fails, the initial program is used to reconstruct the faulty SOC automatically. Then, the reconstruction of the SOC is checked. If successful, the reconstruction success signal is sent to the other two SOCs. The peripheral channel initialization is switched back and the program is executed to restore the default state. Then, communication is established with the onboard computer to update and repair the FLASH storage unit program before reconstructing is initiated again.

9. The on-orbit autonomous reconfiguration system for a camera controller based on multiple SOCs according to claim 1, characterized in that: The FLASH storage unit uses three SPI FLASH chips, which are connected to the SPI0 interfaces of the three SOCs respectively. The SOCs reconstruct the system by calling system services to read the program in the FLASH storage unit.

10. A method for on-orbit autonomous reconfiguration of camera controllers based on multiple SOCs, characterized by: This method is implemented using the on-orbit autonomous reconfiguration system for a camera controller based on multiple SOCs as described in any one of claims 1-9; its characteristic is that the implementation process of this method is as follows: Step 1: Reconstruct system initialization; Step 2: Each voting module of the three SOCs outputs peripheral data; Step 3: Determine if there are any errors in the peripheral data output by the three SOCs. If so, proceed to Step 4; otherwise, return to Step 2. Step 4: Determine the faulty SOC, analyze the fault location, and record the number of voting errors; Step 5: Determine if the cumulative number of errors is greater than 10. If so, proceed to Step 6; otherwise, return to Step 2. Step 6: Switch the peripheral channel, send a refactoring command to the faulty SOC, refactor the faulty SOC through the refactoring module, and after the refactoring is completed, switch back to the peripheral channel and return to Step 1.

Images