A zynq operating system reliable loading method and system of a spaceborne platform

Abstract

The application discloses a ZYNQ operating system reliable loading method and system of a satellite-borne platform, and relates to computer technology, which comprises the following steps: storing the same U-boot in multiple flash memories; creating a UBOOT file directory in the EMMC, and setting multiple subdirectories under the UBOOT file directory to store the U-boot file after CRC calculation; in the case of ZYNQ starting, the U-boot programs in at least three flash memories are loaded into ZYNQ to start after two-out-of-three checking in the CPLD, the CPLD is in communication connection with the ZYNQ, and the two-out-of-three checking in the CPLD comprises the following steps: performing an OR operation on the data after the three-way AND operation of the one-bit signals output by the at least three flash memories two by two, and outputting the data as the final two-out-of-three result. The application is used for realizing the safe starting of U-boot on the satellite-borne platform and file error correction, and multiple dimensions are used to guarantee that the U-boot can be correctly loaded, thereby increasing the system stability.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a reliable loading method and system for the ZYNQ operating system on a spaceborne platform. Background Technology

[0002] Due to the powerful hardware and software synergy of the ZYNQ chip, its usage in the aerospace (low Earth orbit) field is gradually increasing. The use of ZYNQ is divided into two parts: the PS (Processing System) end and the PL (Programmable Logic) end. The PS end is an ARM architecture CPU, and its use is divided into bare-metal programming and operating system programming. Due to the limitations of bare-metal programming, it cannot handle more complex systems and will not be discussed in this invention. Operating system programming, due to its high boot complexity, requires separate program code to complete this task. Currently, the most mature method used in engineering is to use the open-source tool U-boot (Universal Boot Loader) to boot and load the operating system image file. The ability of U-boot to boot normally directly determines the normal operation of the system. Currently, the reliability method used in the aerospace field is aerospace-grade memory + triple redundancy. However, this method still has the potential to fail if multiple memory chips are damaged simultaneously, leading to a failure of the triple redundancy judgment and system boot failure. Furthermore, the system lacks certain error correction measures, making failure inevitable over time. Therefore, there is still significant room for improvement in the storage and protection of U-boot files.

[0003] Existing methods mainly include radiation-hardened memory chips, traditional 2-out-of-3 modular redundancy, and more complex 3-mode redundancy algorithms using three memory modules. 1) Radiation-resistant memory chip method Radiation-hardened memory chips come in two types. One type employs multi-layer hardening and screening, allowing for multiple write cycles, but due to its non-fixed circuitry, it carries a certain risk of data corruption. The other type is antifuse memory, which can only be written once and boasts strong radiation resistance. However, its single-write capability severely limits its application scenarios. As spacecraft become increasingly functional, requiring continuous application updates while in orbit, its single-write characteristic cannot meet the demands.

[0004] 2) Traditional three-out-of-two modular redundancy Traditional triple redundancy involves a two-out-of-three voting method. In the extreme environment of space, storage chips may be damaged over a large area, resulting in the same data area in different backups being destroyed. This causes the two-out-of-three voting function to fail, leading to chip startup failure, functional failure, or even inability to recover.

[0005] 3) Use three storage modules to implement a triple modular redundancy algorithm. Three storage modules are used to store the same U-boot file. During loading, a two-out-of-three vote is performed on each bit of the U-boot file in the three storage areas. Summary of the Invention

[0006] This application provides a reliable loading method and system for the ZYNQ operating system on a spaceborne platform, which enables secure booting of U-boot and file error correction on the spaceborne platform, ensuring correct loading of U-boot from multiple dimensions and increasing system stability.

[0007] This application provides a reliable loading method for the ZYNQ operating system on a spaceborne platform. The spaceborne platform includes multiple flash chips, an eMMC, a CPLD, and a ZYNQ chip. Each flash chip is connected to the CPLD via four signals: CLK, CS, DI, and DO. The CPLD and ZYNQ are connected via a set of CLK, CS, DI, and DO signals. The eMMC is mounted to the PS terminal of the ZYNQ. The multiple flash chips are divided into two groups: one group is a primary U-boot storage area used to store the same U-boot file, and the other group is a backup U-boot storage area. The reliable loading method for the ZYNQ operating system on the spaceborne platform includes: The same U-boot is stored in multiple flash memory chips; and a U-boot file directory is created in the EMMC, with multiple subdirectories set under the U-boot file directory, so that the CRC-calculated file of the U-boot file is stored in any subdirectory. When ZYNQ is booted, the U-boot program in at least three Flash chips is loaded into ZYNQ after a 3-out-of-2 check is performed in the CPLD. The CPLD is communicatively connected to ZYNQ. The 3-out-of-2 check in the CPLD includes: performing a pairwise AND operation on each bit signal output from at least three Flash chips, performing an OR operation on the three ANDed data, and the output data is the final 3-out-of-2 result.

[0008] This application provides a reliable loading system for the ZYNQ operating system on a spaceborne platform, including a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements the steps of the aforementioned reliable loading method for the ZYNQ operating system on a spaceborne platform.

[0009] This application employs a multi-layered, multi-dimensional approach, combining multiple sets of triple-redundant storage, triple-redundant algorithm decision-making, startup monitoring, and storage information rereading and error correction, to ensure U-boot loads correctly and achieves secure booting and file error correction on the spaceborne platform.

[0010] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0011] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 This application describes the three-mode redundancy system architecture of the spaceborne platform. Figure 2 This is a basic flowchart illustrating the reliable loading method of the ZYNQ operating system on a spaceborne platform according to an embodiment of this application. Figure 3 This is an example of how the U-boot of the spaceborne platform is stored in the EMMC according to an embodiment of this application; Figure 4 This is a schematic diagram of the U-boot structure of the reliable loading method of the ZYNQ operating system on the spaceborne platform according to an embodiment of this application; Figure 5 This is a schematic diagram of the three-mode redundancy algorithm for the spaceborne platform in an embodiment of this application; Figure 6 This is an example of an error identification method for the reliable loading of the ZYNQ operating system on a spaceborne platform according to an embodiment of this application. Figure 7 This is a schematic diagram of the overall process of the reliable loading method of the ZYNQ operating system on the spaceborne platform according to an embodiment of this application. Detailed Implementation

[0012] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0013] This application provides a reliable loading method for the ZYNQ operating system on a spaceborne platform, such as... Figure 1The spaceborne platform shown includes multiple flash chips, an embedded memory EMMC, a complex programmable logic device (CPLD), and a fully programmable system-on-a-chip (ZYNQ). Each flash chip is connected to the CPLD via four signals: CLK, CS, DI, and DO. The CPLD and ZYNQ are connected via a set of CLK, CS, DI, and DO signals. The EMMC is mounted to the PS terminal of the ZYNQ. The multiple flash chips are divided into two groups: one group is the primary U-boot storage area used to store the same U-boot file, and the other group is the backup U-boot storage area.

[0014] like Figure 2 As shown, the reliable loading method for the ZYNQ operating system on the spaceborne platform includes: In step S101, the same U-boot is stored in multiple flash memory chips; and a UBOOT file directory is created in the EMMC, with multiple subdirectories set up under the UBOOT file directory to store the CRC calculated file of the U-boot file in any subdirectory, i.e., the U-boot source file and the CRC file. Figure 3 As shown, the U-boot source file is stored in the EMMC. This application stores U-boot in three parts, but more parts can be stored. Specifically, a UBOOT file directory can be created in the root directory, containing three folders: V1, V2, and V3. Each folder stores one copy of the U-boot source file and a file containing the CRC result of that U-boot file.

[0015] Because the U-boot file is small and has the technical requirements for updates and iterations, this application does not use antifuse memory but uses ordinary radiation-hardened memory chips. To enhance the system's resistance to damage, this application adopts a hardware triple backup + software 2-out-of-3 method. In step S102, when ZYNQ is booting, the U-boot program in at least three Flash chips is loaded into ZYNQ after a 2-out-of-3 check is performed in the CPLD. The CPLD is communicatively connected to ZYNQ. The 2-out-of-3 check in the CPLD includes: performing a pairwise AND operation on each of the three output bits of the at least three Flash chips, and then performing an OR operation on the three ANDed data. The output data is the final 2-out-of-3 result.

[0016] In a specific example, the same U-boot can be stored in three small-capacity QSPI_flash chips. The CPLD (Complex Programmable Logic Device) connected to the ZYNQ is a radiation-hardened device. When the ZYNQ boots up, the U-boot program in the three flash chips is checked against a 2-out-of-3 checksum in the CPLD and then loaded into the ZYNQ for booting.

[0017] Traditional CRC check performs a CRC check on a whole block of data at once. The advantage of this method is its simplicity, but the disadvantages are that it takes a long time to calculate and its reliability is relatively poor.

[0018] This application addresses this problem and improves the CRC verification method based on the usage scenario. This application adopts a layered verification method. For example... Figure 4 As shown, the U-boot file consists of smaller functional data segments, namely Image Header, FSBL, BIT, and APP. The FSBL, BIT, and APP files each have a fixed header at the beginning of their data segments. The ASCII code for the FSBL string header is (58 69 6C 69 6E 78), the BIT starts with the synchronization word 0xAA995566, and the APP partition's file header is 0x7F454C46.

[0019] The process involves layered verification of four parts, with the Image Header having a fixed length of 32 bytes. Each verification step first compares the data in the file header, then performs a CRC check on the entire fixed-length data area. The checksum of each segment is stored in a fixed location. When comparing the CRC of two files, each segment is compared sequentially; if any segment is inconsistent, subsequent verification stops.

[0020] In some embodiments, the CRC algorithm used for files stored in any subdirectory satisfies: Y CRC =X 16 +X 12 +X 5 +1 Where Y CRC The final calculated CRC value is represented by X, where X is each bit of data.

[0021] In some embodiments, it also includes: Before each file read, perform a CRC check on the length of the uboot file; and, The U-boot file is checked using a CRC algorithm. If all checks pass, the file is considered read correctly. By planning the storage content of the EMMC according to the method described in this application, it can be ensured that even if any bit in the EMMC flips, a correct image can still be read from the EMMC.

[0022] In some embodiments, the spaceborne platform includes six flash memory chips, three of which are primary U-boot storage areas and three are backup U-boot storage areas, with the primary and backup U-boot storage areas each in x1 mode, such as... Figure 5 As shown, the algorithm process for its output signal includes: D out =(D1&D2)|(D1&D3)|(D2&D3) Where D out The final output data of the CPLD is represented by D1, D2, and D3, which are the output data of the three SPI_flash chips, respectively.

[0023] like Figure 6 The diagram illustrates the principle of error identification in this application. Figure 5 The output of the three-mode redundancy is XORed with the original output data of the SPI_flash. If a data path is corrupted, the XORed output will be 1; otherwise, it will be 0. This step identifies the corrupted flash memory, down to a specific data bit. The specific algorithm is shown in the following formula: D1 check =(D1^D out ) D2 check =(D2^D out ) D3 check =(D3^D out ) Where D1check, D2check, and D3check are the output data after verification, and D1, D2, and D3 are the SPI_flash output data. out The output is the result of taking two out of three.

[0024] In some embodiments, loading the U-boot program into ZYNQ for startup includes: After the CPLD completes the tri-mode verification, the U-boot program is transferred to ZYNQ; and, The CPLD performs a timing operation. After the timing operation is completed, the DONE pin of the ZYNQ chip is checked to determine whether the loading was successful. Figure 7 As shown, after power-on, the ZYNQ chip loads U-boot, which can default to loading the file in the main SPI_flash. Three independent data sets are first subjected to tri-mode verification and error detection in the CPLD, and then the data is transmitted to the ZYNQ. Simultaneously, a timing operation is performed in the CPLD, for example, setting the timing to 2 seconds. After 2 seconds, the DONE pin of the ZYNQ chip is checked. If it is high, it indicates that the ZYNQ has loaded successfully, meaning the U-boot file is correct. If the DONE signal is low, it indicates that the U-boot file is incorrect, and the CPLD controls the ZYNQ to reset and reload from the backup SPI_flash.

[0025] In some embodiments, after the U-boot program is loaded into ZYNQ and started, it also includes: After normal loading and booting, the system first checks the error detection result output by the CPLD. If an error is found, the correct file is extracted from the eMMC for verification before directly writing the faulty SPI_flash. If there are no errors, the operating system begins a timed operation, where the ZYNQ reads the U-boot file from both the primary and backup flash memory at regular intervals, performs a CRC check, and stores the check result in the U-boot folder of the eMMC. Figure 5 As shown, a timed operation can be performed within the operating system. The timer is 1 hour. Every hour, ZYNQ will read the U-boot file from the main and backup SPI_flash, perform CRC verification, and store the verification result in the U-boot folder of the EMMC.

[0026] The CRC check file stored in the EMMC undergoes a triple modulo redundancy calculation, and the result is compared with the CRC values ​​calculated for the files in each flash memory chip to determine if they match. If they match, the file in the SPI_flash is correct. If they do not match, a reprogramming operation is performed.

[0027] In some embodiments, comparing the calculation result with the CRC value calculated by the file in each flash chip further includes: if it is determined that the CRC value calculated by any flash chip is inconsistent, performing CRC verification on the U-boot file backed up in the EMMC and comparing it with the stored CRC value until a consistent backup file is obtained, and using the consistent backup file to rewrite the inconsistent flash chip.

[0028] This application employs aerospace-grade small-capacity storage devices and a triple-mode redundancy algorithm to achieve stable loading of the U-boot file, laying a stable foundation for subsequent image file loading. Addressing the limitation of traditional triple-mode redundancy methods that cannot perform file repair, this application adds a single file correctness check and a file error correction algorithm, significantly enhancing the file's resilience against corruption. This application's method monitors and determines whether ZYNQ has booted correctly and performs hardware dual triple-mode redundancy backups, further increasing system stability.

[0029] This application also proposes a reliable loading system for the ZYNQ operating system on a spaceborne platform, including a processor and a memory. The memory stores a computer program, which, when executed by the processor, implements the steps of the aforementioned reliable loading method for the ZYNQ operating system on a spaceborne platform.

[0030] It should be noted that, in the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0031] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0032] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0033] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A reliable loading method for the ZYNQ operating system on a spaceborne platform, characterized in that, The spaceborne platform includes multiple flash chips, an eMMC, a CPLD, and a ZYNQ processor. Each flash chip is connected to the CPLD via four signals: CLK, CS, DI, and DO. The CPLD and ZYNQ are connected via a set of CLK, CS, DI, and DO signals. The eMMC is mounted to the PS terminal of the ZYNQ. The multiple flash chips are divided into two groups: one is the primary U-boot storage area for storing the same U-boot file, and the other is a backup U-boot storage area. The reliable loading method for the ZYNQ operating system on the spaceborne platform includes: The same U-boot is stored in multiple flash memory chips; and a U-boot file directory is created in the EMMC, with multiple subdirectories set under the U-boot file directory, so that the file after calculating the CRC of the U-boot file is stored in any subdirectory, namely the U-boot source file and the CRC file. When ZYNQ is booted, the U-boot program in the three Flash chips in the main U-boot storage area is loaded into ZYNQ after a 3-out-of-2 check is performed in the CPLD. The CPLD is communicatively connected to ZYNQ. The 3-out-of-2 check in the CPLD includes: performing a pairwise AND operation on each of the three Flash chips' output bit signals, performing an OR operation on the ANDed data of the three sets, and the output data is the final 3-out-of-2 result. It also includes: performing an XOR operation on the 2-out-of-3 output data and the original output data from the three flash chips, so as to determine whether the data of each channel has been corrupted based on the XOR value; The U-boot program loads and boots ZYNQ, including: After the CPLD completes the tri-mode verification, the U-boot program is transferred to ZYNQ; and, The CPLD performs timing operations. After the timing operation is completed, the DONE pin of the ZYNQ chip is checked to determine whether the loading was successful. If the loading was unsuccessful, the CPLD controls the ZYNQ to reset and reload from the backup flash. After the U-boot program is loaded into ZYNQ and started, it also includes: After normal loading and startup, the system checks if the CPLD outputs an error message. If an error is found, the correct file is extracted from the EMMC for verification and then directly programmed into the faulty flash memory. If no error is found, a timed operation is performed internally. At regular intervals, the ZYNQ reads the U-boot file from both the primary and backup flash memory, performs a CRC check, and stores the check result in the U-boot folder of the EMMC. The CRC check file stored in the EMMC is subjected to triple modulo redundancy calculation, and the calculation result is compared with the CRC value calculated in the file of each flash chip to determine whether they are consistent. If they are consistent, it means that the file in the flash is correct. If the CRC value calculated in any flash chip is inconsistent, the U-boot file backed up in the EMMC is subjected to CRC check and compared with the stored CRC value until a consistent backup file is obtained. The inconsistent flash chip is then rewritten using the consistent backup file.

2. The reliable loading method for the ZYNQ operating system on a spaceborne platform as described in claim 1, characterized in that, The CRC algorithm used for files stored in any subdirectory satisfies: Y CRC =X 16 +X 12 +X 5 +1 Among them, Y CRC The final calculated CRC value is represented by X, where X is each bit of data.

3. The reliable loading method for the ZYNQ operating system on a spaceborne platform as described in claim 2, characterized in that, The CRC calculation for the U-boot file also includes: For each functional data segment of the U-boot file, each segment is subjected to layered verification, including: Each time a verification is performed, the file headers of each functional data segment are compared first, and then a CRC check is performed on the entire fixed-length data area. The checksum of each segment is stored in a fixed location so that each segment can be compared when the CRC of the two U-boot files is compared.

4. The reliable loading method for the ZYNQ operating system on a spaceborne platform as described in claim 2, characterized in that, Also includes: Before each file read, the length of the uboot file is checked using a CRC check. as well as, Perform CRC check on the U-boot file; if all checks pass, the file is considered to have been read correctly.

5. The reliable loading method for the ZYNQ operating system on a spaceborne platform as described in claim 1, characterized in that, The onboard platform includes six flash chips, three of which are primary U-boot storage areas and three are backup U-boot storage areas. The primary and backup U-boot storage areas are in x1 mode, and the algorithm for their output signals includes: D out =(D1&D2)|(D1&D3)|(D2&D3) Where D out This is the final output data of the CPLD. D1, D2, and D3 are the output data of the three flash chips, respectively.

6. A reliable loading system for the ZYNQ operating system on a spaceborne platform, characterized in that: It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, implements the steps of the reliable loading method of the ZYNQ operating system for a spaceborne platform as described in any one of claims 1 to 5.

Images