Single-particle fault automatic detection and processing method and system, chip and electronic equipment

Abstract

The invention discloses a single-particle fault automatic detection and processing method and system, a chip and electronic equipment, and relates to the field of chip detection. And before or when the task instruction is sent to the business unit, configuring the temperature threshold value of each heat source and the power supply information of each power supply domain in the business unit. Respectively comparing the acquired real-time temperature and the real-time parameter of each power domain with a temperature threshold and power information, and determining whether a single-particle fault exists or not; if the single-particle fault exists, fault processing is carried out according to a preset processing method; and if the single-particle fault does not exist, a self-checking instruction is sent to the service unit, so that the service unit performs self-checking. According to the method and the device, two main influences of the single event effect, namely single event upset and single event locking, are solved, the reliability of single event fault checking and processing is high, and a related system built by a common device has relatively good space environment adaptability.

Description

Technical Field

[0001] This application relates to the field of chip testing, and more specifically, to an automatic single-event fault detection and handling method, system, chip, and electronic device. Background Technology

[0002] The working environment of satellites in orbit contains a large number of high-energy charged particles. There are three main sources of near-Earth space radiation particles: galactic cosmic rays, solar particle events, and the Van Allen radiation belts formed by charged particles trapped by the Earth's magnetic field.

[0003] The phenomenon where a single high-energy particle (such as a proton or heavy ion) incident on a microelectronic device or circuit causes it to malfunction is called the Single Event Effect (SEE). This effect typically occurs in spacecraft or other electronic devices in high-radiation environments, and has a serious impact on the reliability of the equipment. Summary of the Invention

[0004] In view of the above problems, this application proposes an automatic detection and processing method, system, chip and electronic device for single-event faults to overcome the shortcomings of the prior art.

[0005] This application provides an automatic detection and handling method for single-event faults, which configures the temperature threshold of each heat source and the power information of each power domain in the business unit before or at the same time as sending the task instruction to the business unit. The real-time temperature and parameters of each power domain are compared with the temperature threshold and the power information to determine whether there is a single-event fault. If a single-event fault occurs, the fault will be handled according to the preset handling method. If there is no single-event fault, a self-test command is sent to the service unit to enable the service unit to perform a self-test.

[0006] Optionally, before or simultaneously with sending the task instruction to the service unit, the temperature threshold of each heat source and the power information of each power domain in the service unit are configured, including: While sending task instructions to the business unit, configure the temperature threshold of each heat source in the business unit; Based on the task instructions and the real-time temperatures of each heat source collected, configure the power information of each power domain in the service unit. Optionally, before or simultaneously with sending the task instruction to the service unit, the temperature threshold of each heat source and the power information of each power domain in the service unit are configured, including: Before sending the task instruction to the business unit, configure all temperature thresholds and all power information, and send the task instruction to the business unit after the configuration is completed; Among them, all temperature thresholds refer to the temperature thresholds corresponding to each task instruction in all task instructions; All power information refers to the power information corresponding to each task instruction at different temperatures in all task instructions.

[0007] Optionally, while sending task instructions to the service unit, the temperature threshold of each heat source in the service unit is configured, including: While sending the task instruction to the business unit, the temperature threshold of each heat source is configured according to the type of the task instruction.

[0008] Optionally, based on the task instructions and the real-time collected temperatures of each heat source, the power information of each power domain in the service unit is configured, including: The temperature of each heat source is collected in real time to obtain the real-time temperature of each heat source. Configure the power information based on the real-time temperature of each heat source and the type of the task instruction.

[0009] Optionally, the power information includes: maximum current limit value, maximum and minimum voltage thresholds, target ammeter, and current tolerance value; the real-time parameters include: real-time voltage and real-time current. The real-time temperature and parameters of each power domain are compared with the temperature threshold and the power information to determine whether a single-event fault exists, including: The real-time temperature of each power domain is collected and compared with the temperature threshold corresponding to each power domain to determine whether there is a single event fault. The real-time voltage of each power domain is collected, and the real-time voltage is compared with the maximum and minimum voltage thresholds to determine whether there is a single-event fault. The real-time current of each power domain is collected, the real-time current is compared with the maximum current limit value, and the real-time current is comprehensively compared with the target ammeter and the current tolerance value to determine whether there is a single event fault.

[0010] Optionally, the power information includes: maximum current limit value, maximum and minimum voltage thresholds, target ammeter, and current tolerance value; the real-time parameters include: real-time voltage and real-time current. The real-time temperature and parameters of each power domain are compared with the temperature threshold and the power information to determine whether a single-event fault exists, including: Based on the type of task instruction sent by the business unit, query the temperature threshold corresponding to the task instruction from all temperature thresholds; Collect the real-time temperature of each power domain, and query the power information corresponding to the task instruction at the real-time temperature from all power information; Based on the real-time temperature, it is compared with the temperature threshold corresponding to each power domain to determine whether there is a single-event fault. The real-time voltage of each power domain is collected, and the real-time voltage is compared with the maximum and minimum voltage thresholds to determine whether there is a single-event fault. The real-time current of each power domain is collected, the real-time current is compared with the maximum current limit value, and the real-time current is comprehensively compared with the target ammeter and the current tolerance value to determine whether there is a single event fault.

[0011] Optionally, the real-time temperature of each power domain is collected and compared with the corresponding temperature threshold for each power domain to determine whether a single-event fault exists, including: If the real-time temperature of any power domain exceeds its corresponding temperature threshold, then a single-event fault occurs; otherwise, no single-event fault occurs.

[0012] Optionally, the real-time voltage of each power domain is collected, and the real-time voltage is compared with the maximum and minimum voltage thresholds respectively to determine whether there is a single-event fault, including: If the real-time voltage of any power domain is greater than its corresponding maximum voltage threshold, then there is a single-event fault; otherwise, there is no single-event fault. If the real-time voltage of any power domain is less than its corresponding minimum voltage threshold, then there is a single-event fault; otherwise, there is no single-event fault.

[0013] Optionally, the real-time current of each power domain is collected, the real-time current is compared with the maximum current limit value, and the real-time current is comprehensively compared with the target ammeter and the current tolerance value to determine whether there is a single-event fault, including: If the real-time current is greater than the maximum current limit, then there is a single event fault; otherwise, there is no single event fault. If the difference between the real-time current corresponding to the current task instruction and the target current corresponding to the target current table is greater than the current tolerance value, then the cumulative number of over-limit times is incremented by 1; otherwise, the number of over-limit times is not accumulated. If the cumulative number of times exceeding the limit plus 1 exceeds the preset number, then the single-event fault occurs; otherwise, the single-event fault does not occur. The target ammeter is a function of the task command and temperature, representing the current value corresponding to different types of task commands at different temperatures.

[0014] Optionally, fault handling is performed according to a preset handling method, including: The real-time temperature of each power domain is collected and compared with the temperature threshold corresponding to each power domain. If a single-event fault is detected, a software shutdown command is sent to the service unit to cut off the power supply to each power domain and report the fault. The real-time voltage of each power domain is collected, and the real-time voltage is compared with the maximum and minimum voltage thresholds respectively. If a single-event fault is found, a shutdown command is sent to the service unit to shut down the power of each power domain and report the fault. The system collects the real-time current of each power domain, compares the real-time current with the maximum current limit value, and performs a comprehensive comparison with the target ammeter and the current tolerance value. If a single-event fault occurs, a shutdown command is sent to the service unit to shut down the power supply of each power domain and report the fault.

[0015] Optionally, after the business unit performs a self-test, it further includes: The self-test results of the business unit are received. The self-test results include self-test errors and self-test successes. If a self-test error occurs, the business unit repeats the self-test and provides feedback on the self-test results after each self-test until the self-test is successful or a relevant instruction is received. If the self-test result of a self-test error is received more than N times in a row, a software restart command is sent to the service unit so that the service unit can perform a software restart. After the business unit performs a software restart, it starts a self-test again. If it receives more than N consecutive self-test error results, it sends a hardware power-off restart command to the business unit so that the business unit performs a hardware power-off restart. After the service unit performs a hardware power-off restart, it starts a self-test again. If it receives more than N consecutive self-test error results, it sends a shutdown command to the service unit so that the power of each power domain in the service unit is turned off and the fault is reported.

[0016] This application provides an automatic single-event fault detection and processing system, including: a control unit and a business unit; The control unit includes: an instruction module, a temperature detection module, and a power supply module; The business unit includes: various functional modules, each of which has its own power domain; The instruction module is used to configure the temperature threshold of each heat source in the service unit in the temperature detection module before or at the same time as sending the task instruction to the service unit, and to configure the power information of each power domain in the service unit in the power module. The temperature detection module is also used to compare the real-time temperature of each power domain with the temperature threshold to determine whether there is a single event fault, and to provide feedback to the instruction module when there is a single event fault. The power module is used to collect real-time parameters of each power domain, compare the real-time parameters with the power information, determine whether there is a single event fault, and provide feedback to the instruction module when there is a single event fault. The instruction module is also used to handle faults according to a preset method when there is a single-event fault, and to send a self-test instruction to the service unit when there is no single-event fault, so that the service unit can perform a self-test.

[0017] This application provides a chip configured to perform automatic single-event fault detection and processing using the automatic single-event fault detection and processing method as described in any of the preceding claims.

[0018] This application provides an electronic device, which includes the chip described above.

[0019] The single-event fault automatic detection and handling method proposed in this application includes: configuring the temperature threshold of each heat source and the power information of each power domain in the service unit before or at the same time as sending the task instruction to the service unit.

[0020] Then, the real-time temperature, real-time parameters and temperature thresholds of each power domain are compared to determine whether there is a single event fault. If there is a single event fault, the fault is handled according to the preset handling method. If there is no single event fault, a self-test command is sent to the service unit to enable the service unit to perform a self-test.

[0021] This application creatively proposes a new method for automatic detection and handling of single-event faults. It configures temperature thresholds based on task instructions and power information for each power domain based on task instructions and real-time temperature. That is, different types of task instructions correspond to different temperature thresholds and power information. Then, it compares them with real-time temperature and real-time parameters to perform single-event fault detection and handling.

[0022] The automatic detection and handling method for single-event faults proposed in this application comprehensively considers the effects of operating load, temperature, and program randomness, enabling more accurate detection and handling of single-event faults. It solves the two main effects of single-event effects: single-event upset and single-event lockout. Not only is the reliability of single-event fault detection and handling high, but it also enables related systems built with common devices to have good adaptability to the space environment, showing broad application prospects and high practicality. Attached Figure Description

[0023] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which: Figure 1 This is a schematic diagram of a prior art structure; Figure 2 This is a schematic diagram of a device structure using another existing technology; Figure 3 This is a flowchart illustrating the third type of existing technology; Figure 4 This is a flowchart of an automatic single-event fault detection and processing method according to an embodiment of this application; Figure 5 This is a schematic diagram of the workflow of the business units exemplified in the embodiments of this application; Figure 6 This is a flowchart illustrating the workflow in the embodiments of this application; Figure 7 This is a framework diagram of an automatic single-event fault detection and processing system according to an embodiment of this application. Detailed Implementation

[0024] The embodiments of this application will now be described in detail. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0025] Currently, there are three main sources of near-Earth space radiation particles: galactic cosmic rays, solar particle events, and the Van Allen radiation belts formed by charged particles trapped by the Earth's magnetic field.

[0026] Astrophysics suggests that galactic cosmic rays primarily originate from high-energy charged particles ejected into space by supernova explosions. Protons comprise approximately 90%, helium nuclei about 9%, and heavy ions about 1%. One study, under conditions of minimal solar activity, clearly shows that the peak energy of H~U ions in galactic cosmic rays, after passing through a 2.54mm aluminum shield in geosynchronous orbit, corresponds to energies ranging from 50 to 1000 MeV / u, indicating a maximum flux peak. Although heavy ions constitute a relatively small proportion of galactic cosmic rays, their high energy (up to 100 GeV / u) gives them strong penetrating power, posing a significant threat to the operational safety of spacecraft in orbit.

[0027] When a solar particle event occurs, it ejects a large number of high-energy particles, including 96.4% protons, 3.5% helium nuclei, and 0.1% heavy ions. Therefore, solar particle events can modulate the radiation environment around the Earth. Solar particle events can also indirectly threaten ground power or communication equipment to a certain extent, such as the Quebec blackout that occurred in 1989.

[0028] The Van Allen radiation belts were discovered in 1958 after the launch of the Explorer 1 satellite by the United States to study high-energy charged particles in space. Van Allen and others found that when the satellite reached a certain altitude, the Geiger counter would fail. Through analysis, they determined that the failure was caused by the Geiger counter being bombarded by a large number of charged particles instantaneously, thus discovering the existence of relatively stable high-energy particle trapping belts in the space surrounding the Earth. The inner radiation belt is located 1,000 km to 6,000 km above the Earth's surface, with electron energies of approximately several hundred keV and proton energies exceeding 100 MeV. The outer radiation belt is mainly composed of electrons, with energies ranging from 0.1 MeV to 10 MeV, and distances from the Earth's surface ranging from 13,000 km to 60,000 km.

[0029] Among the aforementioned high-energy charged particles, the phenomenon where a single high-energy particle (such as a proton or heavy ion) can cause a malfunction in a microelectronic device or circuit is called the single-event effect. Single-event effects can be classified into several types based on the different mechanisms by which they cause malfunctions, primarily including single-event upsets and single-event lockouts.

[0030] Single Event Upset (SEU) refers to the phenomenon where a single high-energy charged particle bombards a large-scale or very large-scale logic microelectronic device, causing ionization along its trajectory in the vicinity of the PN junction, generating a certain number of electron-hole pairs (charge carriers). These charge carriers drift and redistribute under the influence of the internal electric field of the chip, thus altering the normal distribution and motion state of charge carriers within the chip. When this change is sufficiently large, it will cause alterations in the electrical performance of the device, leading to logic errors in the logic device or circuit. For example, data flipping in memory can cause logical malfunctions, computer programs crashing, and even catastrophic consequences.

[0031] Single Event Latch-up (SEL) is a highly hazardous space radiation effect that occurs in bulk silicon CMOS devices. Due to the inherent characteristics of bulk silicon CMOS manufacturing processes, a pnpn four-layer structure exists, forming parasitic thyristors. Under appropriate triggering conditions, two of these parasitic transistors can reach and remain in a saturated state, resulting in a latch-up effect. This latch-up effect can cause the device to generate large currents, even burning out, and can also damage the power supply or cause a pull-down of the power supply voltage, leading to system malfunction.

[0032] The inventors have discovered that current methods for addressing single-event effects can be mainly categorized into the following four types: 1) Process reinforcement Improve device structure: By optimizing the physical structure of the device, such as increasing the doping concentration of the well, the device's resistance to single-event effects can be improved.

[0033] Adopt new materials: Use materials with better radiation resistance to manufacture devices, such as SOI (silicon-on-insulator) materials, which exhibit superior performance in resisting single-event effects.

[0034] 2) Device design hardening Layout hardening: In layout design, various hardening techniques can be used to mitigate single-event effects, such as designing well contacts to reduce well resistance, using heavily doped electrodes to collect charge, and adjusting the layout to maximize charge sharing.

[0035] Redundancy design: Redundancy design techniques such as redundant storage units and triple modular redundancy (TMR) are adopted to correct the fault in the event of a single-event failure by using the correct output of the redundant units.

[0036] Fault Detection and Recovery: The system incorporates fault detection mechanisms, such as data parity checks and cyclic redundancy checks, to promptly detect and report single-event failures. Simultaneously, fault recovery mechanisms, such as CPU reset and DSP reboot, are designed to repair faults and restore normal system operation.

[0037] 3) Software hardening Software fault tolerance technology: Fault tolerance technology, such as parity check and cyclic redundancy check, is used in software design to improve the software's resistance to single-event effects.

[0038] Watchdog monitoring: Watchdog monitoring technology can periodically check the internal condition of critical chips. Once an error occurs, it sends a restart signal to the chip, thereby effectively mitigating the impact of single-event failures on the system.

[0039] Lockstep technology: Lockstep technology is a redundant hardware technology that uses the main hardware and redundant hardware to work synchronously and monitor each other. Once an inconsistency is detected, a fault alarm is triggered and corresponding corrective actions are taken.

[0040] 4) System protection measures Radiation shielding: Adding a radiation shielding layer to the outside of electronic devices can effectively reduce the bombardment of devices by high-energy particles, thereby reducing the incidence of single-event failures.

[0041] System architecture design: In system architecture design, strategies such as layered design and modular design can be adopted to improve the reliability and maintainability of the system.

[0042] For example: a prior art reference Figure 1 As shown, an nwell minority carrier protection ring is added between the driver module and the other modules of the chip. This reduces the substrate concentration near the minority carrier ring and increases the substrate resistance, thereby preventing latch-up effects in the chip. The chip structure mainly consists of a driver module and other modules, including a digital-to-analog module. The nwell minority carrier protection ring is loaded between the driver module and the other modules. This produces an anti-latch-up effect without affecting the normal operating performance of the chip. This prior art mainly improves upon the chip through process hardening and device design hardening.

[0043] Another existing technology is the design of a single-event latch-up protection device for CMOS devices in a space environment, referring to... Figure 2As shown, it comprises a power supply and CMOS devices forming an electrical circuit. The current acquisition module converts the current signal in the electrical circuit into a voltage signal. The voltage comparison module compares the converted voltage signal with a reference voltage signal. If the former is less than or equal to the latter, the switch control module keeps the electrical circuit connected via a switch module; otherwise, the switch control module disconnects the electrical circuit via a switch module. A switch timer module is used to reconnect the electrical circuit after a certain period of time following its disconnection. This prior art mainly improves upon the system's protection measures.

[0044] The third existing technology is a method for monitoring chip latch-up state, referring to... Figure 3 The flowchart shown illustrates how a chip's operating state is determined by monitoring its power data. If the rate of increase in the power data is less than or equal to a preset rate, the chip's operating state is identified. This operating state is associated with corresponding target power data. Based on the power data and the target power data, the system determines whether the chip is in a latched state. This allows for setting different target power data for different operating states. For example, a larger target power data can be set for operating states with higher power data, and a smaller target power data can be set for operating states with lower power data. This eliminates the possibility of misjudging a latched state due to a higher power data operating state and a lower target power data, thereby improving the accuracy of latch-up state monitoring. This existing technology primarily improves upon the chip through software hardening and system protection measures.

[0045] Further research by the inventors revealed that although the first prior art described above is designed to produce an anti-latch-up effect, its limitation lies in the fact that it is reinforced inside the chip, which is costly, increases production costs, affects chip performance, and does not improve other effects such as single-particle flipping.

[0046] In the second prior art mentioned above, the anti-latch-up effect is also achieved through overcurrent protection design. However, during chip operation, the current changes with the load. Therefore, the invention does not provide a method for setting the current protection threshold, which affects the implementation effect of the device and does not improve other effects such as single-particle flipping.

[0047] The third prior art is essentially similar to the second prior art, designed to produce an anti-latch-up effect. However, during chip operation, the current changes with the load, and the transient current of the power supply has a certain degree of randomness. Therefore, setting the current protection threshold by the operating state can still lead to the chip being misjudged as being in a latch-up state, which also affects the implementation effect of the method. At the same time, it does not improve other effects such as single-event flips.

[0048] To address the aforementioned problems, the inventors, through extensive research, have creatively proposed an automatic single-event fault detection and processing method, system, chip, and electronic device, as described in this application. The technical solution of this application is explained and described in detail below.

[0049] This application provides an automatic single-event fault detection and handling method, referring to... Figure 4 The flowchart shown illustrates the automatic detection and handling method for single-event faults, which includes: Step 401: Before or at the same time as sending the task instruction to the business unit, configure the temperature threshold of each heat source in the business unit.

[0050] Generally, a business unit executes various task instructions. It contains corresponding functional modules for executing these instructions, including but not limited to: interface modules, storage modules, processing modules, etc. A business unit receives and executes a series of task instructions. There are two methods: one is that the business unit receives and executes multiple task instructions and then runs a self-check program; the other is that the business unit runs a self-check program after receiving and executing each task instruction. The process for the latter method can be referenced. Figure 5 The flowchart illustrating the workflow of the business unit provides a more intuitive understanding. During task execution, the business unit repeatedly performs the sequence "Instruction → Self-Check → Instruction → Self-Check…".

[0051] Based on the latter workflow, after the entire system is powered on, before or at the same time as sending task instructions to the business units, the temperature thresholds of each heat source and the power information of each power domain in the business units are configured.

[0052] Configure the temperature thresholds for each heat source within the business unit. This can typically be done by the control unit. However, other functional units can also be selected to perform this operation based on actual needs.

[0053] In one embodiment of this application, the first configuration is as follows: If the temperature thresholds for each heat source within a business unit are configured simultaneously with the task command sent to the business unit, then the power information for each power domain within the business unit is subsequently configured based on the task command and the collected real-time temperatures of each heat source. In this case, each task command essentially configures both the temperature thresholds and power information once.

[0054] The second configuration option: If all temperature thresholds and power information are configured before sending task instructions to the service unit, then the task instructions are sent to the service unit after configuration is complete. Here, "all temperature thresholds" refers to the temperature threshold corresponding to each task instruction; and "all power information" refers to the power information corresponding to each task instruction at different temperatures. In this case, all temperature thresholds and power information corresponding to all task instructions are configured at once. Those skilled in the art can choose which configuration to sample based on actual needs.

[0055] In one embodiment of this application, for the first configuration described above: While sending task instructions to the service unit, the temperature thresholds of each heat source can be configured according to the type of the task instruction. Each heat source refers to a functional module within the service unit. Since these modules emit heat when executing task instructions, and each functional module differs in its components, materials, parameters, and operating characteristics, and some task instructions may not even utilize all functional modules for execution, the heat emitted by each functional module may vary. Therefore, a preferred approach is to configure the temperature thresholds of each heat source according to the type of the task instruction; that is, for each task instruction sent to the service unit, the temperature thresholds of each heat source are configured according to the type of that task instruction.

[0056] After configuring the temperature thresholds for each heat source, the power information for each power domain in the business unit is configured based on the task instructions and the collected real-time temperatures of each heat source. Since the physical components that make up each functional module will have different power information for their corresponding power domains due to different temperatures, one of the requirements for power information configuration is the real-time temperature of each functional module.

[0057] In one embodiment of this application, a method for optimally configuring power information of each power domain in a service unit includes: First, the temperature of each heat source (i.e., each functional module) is collected in real time to obtain the real-time temperature of each heat source. Then, based on the real-time temperature of each heat source and the type of task instruction, the power information is configured. The power information includes: maximum current limit value, maximum and minimum voltage thresholds (i.e., maximum voltage threshold and minimum voltage threshold), target ammeter, and current tolerance value.

[0058] The second configuration scenario differs from the first in that it configures all temperature thresholds and power information at once. Therefore, it is not necessary to collect the real-time temperature of each heat source and then configure the power information based on the real-time temperature of each heat source and the type of task instruction.

[0059] Step 402: Compare the real-time temperature, real-time parameters, temperature thresholds, and power information of each power domain to determine whether there is a single-event fault.

[0060] Once the temperature threshold and power information are configured, the business unit executes the task instructions. During this process, it continuously collects real-time temperature and parameters from each power domain (i.e., each functional module). These real-time parameters include real-time voltage and real-time current. This collected data is compared with the temperature threshold and power information to determine if a single-event fault exists.

[0061] In one embodiment of this application, for a first configuration, a preferred method for determining whether a single-event fault exists includes: Real-time temperature of each power domain is collected and compared with the corresponding temperature threshold for each power domain to determine if a single event fault (SIF) is present. Real-time voltage of each power domain is collected and compared with the maximum and minimum voltage thresholds to determine if a SIF is present. Real-time current of each power domain is collected and compared with the maximum current limit value, as well as with the target ammeter and current tolerance value, to determine if a SIF is present.

[0062] The second configuration differs from the method used in the first configuration to determine the presence of a single-event fault. Since all temperature thresholds and power information are configured at once, it's necessary to first query the temperature threshold corresponding to the task instruction sent by the service unit from all temperature thresholds. Then, the real-time temperature of each power domain is collected, and the corresponding power information for that task instruction at that real-time temperature is queried from all power information. After these two steps, the subsequent comparisons and steps are the same for both configurations and will not be described separately.

[0063] Regarding the above comparisons, we have: 1) If the real-time temperature of any power domain exceeds its corresponding temperature threshold, there is a single event fault (SIF); otherwise, there is no SIF. That is, if the real-time temperature of each power domain does not exceed its corresponding temperature threshold, there is no SIF.

[0064] 2) If the real-time voltage of any power domain is greater than its corresponding maximum voltage threshold, then there is a single event fault (SIF); otherwise, there is no SIF. That is, if the real-time voltage of each power domain is not greater than its corresponding maximum voltage threshold, then there is no SIF.

[0065] If the real-time voltage of any power domain is less than its corresponding minimum voltage threshold, then there is a single-event fault; otherwise, there is no single-event fault. That is, if the real-time voltage of each power domain is not less than its corresponding minimum voltage threshold, then there is no single-event fault.

[0066] 3) If the real-time current is greater than the maximum current limit, there is a single event fault; otherwise, there is no single event fault. That is, if the real-time current of each power domain is not greater than the maximum current limit, there is no single event fault.

[0067] 4) If the difference between the real-time current corresponding to the current command and the target current in the target ammeter is greater than the current tolerance value, the cumulative over-limit count is incremented by 1; otherwise, no over-limit count is incremented. If the cumulative over-limit count exceeds the preset number after incrementing by 1, a single-event fault (SIF) is confirmed; otherwise, no SIF is confirmed. In other words, each time the difference between the real-time current and the target current in the target ammeter exceeds the current tolerance value, the cumulative over-limit count is incremented by 1. Assuming the preset number is M, if the cumulative over-limit count exceeds M after incrementing by 1, a SIF is confirmed; otherwise, no SIF is confirmed.

[0068] Here, the target ammeter is a function of the mission command and temperature, representing the current value corresponding to different types of mission commands at different temperatures, and can be expressed as follows:

[0069] This target ammeter is based on the current values ​​corresponding to each task command at different temperatures, obtained through extensive simulations and actual measurements. For example, taking command 1 as an example, its corresponding current value at A℃ is IA1. That is, ideally, when each functional module is operating at A℃, its real-time current when executing command 1 should be IA1. However, considering device manufacturing and measurement errors, there may be a difference between the collected real-time current and IA1. Therefore, a current tolerance value K is set. If one functional module is operating at A℃ and the difference between its real-time current when executing command 1 and IA1 is greater than K, the cumulative number of over-limit counts is incremented by 1. If two functional modules are operating at A℃ and the difference between their real-time current when executing command 1 and IA1 is greater than K, the cumulative number of over-limit counts is incremented by 2. Naturally, it can be understood that if the difference between the real-time current when a functional module is operating at A℃ and its real-time current when executing command 1 and IA1 is not greater than K, then no increment is made to the cumulative number of over-limit counts.

[0070] Step 403: If a single-event fault occurs, the fault shall be handled according to the preset handling method.

[0071] Steps 401-402 determine whether there is a single-event fault. If there is a single-event fault, the fault is handled according to the preset handling method.

[0072] In one embodiment of this application, a preferred method for fault handling according to a preset processing method includes: For temperature comparison, if a single event fault (SIF) is detected, a software shutdown command is sent to the service unit to cut off the power supply to each power domain and report the fault. For voltage comparison, if a SIF is detected, a shutdown command is sent to the service unit to shut down the power supply to each power domain and report the fault. For current comparison, if a SIF is detected, a shutdown command is sent to the service unit to shut down the power supply to each power domain and report the fault.

[0073] In the embodiments of this application, software shutdown involves sending a shutdown command, allowing the system to automatically and safely shut down according to a procedure, similar to shutting down a personal computer, allowing the system and data to enter a safe standby or stopped state. Sending a shutdown command to directly shut down the power supply, on the other hand, is a hard cut-off of power, similar to unplugging a computer, immediately interrupting all ongoing work. Since temperature changes are relatively slow, while voltage and current changes are rapid and easily damage devices, single-event faults caused by temperature issues can be allowed a period of time for the system to resolve itself before shutting down; however, single-event faults caused by current or voltage issues must be resolved by immediately shutting down the power supply.

[0074] Step 404: If there is no single-event fault, send a self-test command to the service unit so that the service unit can perform a self-test.

[0075] If there is no single-event fault, a self-test command is sent directly to the service unit to initiate a self-test. Following the service unit's self-test, the following steps are also taken: Receive the self-test results from the business unit. The self-test results include: self-test error and self-test success. If a self-test error occurs, the business unit repeats the self-test and provides feedback on the self-test result after each self-test until the self-test is successful or a relevant instruction is received. If more than N consecutive self-test errors are received, or no self-test result is received within a preset time, a software restart command is sent to the business unit to cause the business unit to restart its software. After the business unit restarts its software, the self-test starts again. If more than N consecutive self-test errors are received, or no self-test result is received within a preset time, a hardware power-off restart command is sent to the business unit to cause the business unit to restart its hardware. After the business unit restarts its hardware, the self-test starts again. If more than N consecutive self-test errors are received, or no self-test result is received within a preset time, a shutdown command is sent to the business unit to shut down the power of each power domain in the business unit and report the fault.

[0076] The entire process described above is referred to Figure 6 The flowchart shown can be simply summarized as follows: After the system is powered on, it sends commands and temperature / power configuration (that is, before or simultaneously with sending task commands, it configures the temperature thresholds and power information of each functional module). Then it checks whether the voltage exceeds the limit (that is, it compares the collected real-time voltage with the voltage in the power information). If it exceeds the limit, it directly shuts down the power and reports a fault. If it does not exceed the limit, it checks whether the current difference of M commands exceeds the limit (that is, it compares the real-time current with the maximum current limit value, and comprehensively compares the real-time current with the target ammeter and the current tolerance value). If it exceeds the limit, it directly shuts down the power and reports a fault. If it does not exceed the limit, it checks whether the temperature exceeds the limit (that is, it compares the real-time temperature with the temperature threshold). If it exceeds the limit, it first shuts down the system via software, then shuts down the power and reports a fault. If it does not exceed the limit, it enters the self-test module.

[0077] During the self-test, it determines whether N errors have occurred (i.e., whether the self-test result of the self-test error has been received more than N times consecutively). If not, it continues to send instructions, i.e., temperature / power configuration (i.e., send new task instructions to configure new temperature thresholds and power information for each functional module) and the subsequent process. If N errors occur, it performs a software reset (i.e., sends a software restart instruction to the business unit so that the business unit can restart the software).

[0078] After the business unit restarts its software, it begins a self-test again to determine if N errors have occurred (i.e., whether the self-test results of receiving self-test errors have exceeded N consecutively). If not, it continues to send instructions, i.e., temperature / power configuration and subsequent processes. If N errors occur, it performs a hardware reset (i.e., sends a hardware power-off restart instruction to the business unit to cause the business unit to perform a hardware power-off restart).

[0079] After the business unit performs a hardware power-off restart, it starts a self-test again to determine whether N errors have occurred (i.e., whether the self-test results of self-test errors have been received more than N times consecutively). If not, it continues to send instructions, i.e. temperature / power configuration and subsequent processes. If N errors occur, it sends a shutdown instruction to the business unit to shut down the power of each power domain in the business unit and report the fault.

[0080] As can be seen from the above explanation and description, the automatic detection and handling method for single-event faults in this application comprehensively considers the influence of multiple factors such as operating load, temperature and program randomness, and more accurately checks and handles single-event faults. It solves the two main effects of single-event effects, namely single-event upset and single-event lockout. Not only is the reliability of single-event fault detection and handling high, but it also enables related systems built with ordinary devices to have good spatial environment adaptability.

[0081] Based on the above-described automatic single-event fault detection and processing method, this application also proposes an automatic single-event fault detection and processing system, referring to... Figure 7The system framework diagram shown includes: a control unit and a service unit; the control unit includes: an instruction module, a temperature detection module, and a power module; the service unit includes: various functional modules, each of which has its own power domain. Figure 7 The example shown includes a processing module, a storage module, and an interface module, but this does not mean that a business unit can only have these functional modules.

[0082] The instruction module is used to send task instructions to business units. Figure 7 Before sending the command data or at the same time as sending the task command, configure the temperature threshold of each heat source in the business unit in the temperature detection module, and configure the power information of each power domain in the business unit in the power module.

[0083] The temperature detection module is also used to compare the real-time temperature of each power domain with the temperature threshold to determine whether there is a single event fault, and to provide feedback to the instruction module when a single event fault is detected.

[0084] The power module is used to collect real-time parameters from each power domain. Figure 7 The power module compares the voltage and current data with real-time parameters and power information to determine if there is a single event fault (SIF) and provides feedback to the instruction module when an SIF is detected. The power module is also used to supply power to various functional modules.

[0085] The instruction module is also used to handle faults according to a preset method when a single-event fault occurs, and to send a self-test instruction to the service unit when there is no single-event fault, so that the service unit can perform a self-test, and to receive the self-test feedback result from the service unit, that is... Figure 7 The above modules work together to realize the automatic detection and handling method for single-event faults in steps 401 to 404.

[0086] Based on the above-described automatic single-event fault detection and processing method, this application also proposes a chip configured to perform automatic single-event fault detection and processing using any one of the above steps 401 to 404.

[0087] Based on the above-described chip, this application also proposes an electronic device, which includes the above-described chip.

[0088] In summary, the single-event fault automatic detection and handling method proposed in this application includes: configuring the temperature threshold of each heat source and the power information of each power domain in the service unit before or at the same time as sending the task instruction to the service unit.

[0089] Then, the real-time temperature, real-time parameters and temperature thresholds of each power domain are compared to determine whether there is a single event fault. If there is a single event fault, the fault is handled according to the preset handling method. If there is no single event fault, an execution instruction is sent to the business unit so that the business unit can execute the task instruction.

[0090] This application creatively proposes a new method for automatic detection and handling of single-event faults. It configures temperature thresholds based on task instructions and power information for each power domain based on task instructions and real-time temperature. That is, different types of task instructions correspond to different temperature thresholds and power information. Then, it compares them with real-time temperature and real-time parameters to perform single-event fault detection and handling.

[0091] The automatic detection and handling method for single-event faults proposed in this application comprehensively considers the effects of operating load, temperature, and program randomness, enabling more accurate detection and handling of single-event faults. It solves the two main effects of single-event effects: single-event upset and single-event lockout. Not only is the reliability of single-event fault detection and handling high, but it also enables related systems built with common devices to have good adaptability to the space environment, showing broad application prospects and high practicality.

[0092] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0093] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0094] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A method for single event upset automatic detection and handling, the method comprising: The method comprises the following steps: Before or at the same time when the task instruction is sent to the business unit, the temperature threshold of each heat source and the power supply information of each power supply domain in the business unit are configured; The real-time temperature and real-time parameter of each power supply domain are compared with the temperature threshold and the power supply information respectively to determine whether there is a single particle fault; If there is a single particle fault, the fault is handled according to a preset handling method; If there is no single particle fault, a self-checking instruction is sent to the business unit to make the business unit perform self-checking.

2. The method of claim 1, wherein, Before or at the same time when the task instruction is sent to the business unit, the temperature threshold of each heat source and the power supply information of each power supply domain in the business unit are configured, which comprises the following steps: At the same time when the task instruction is sent to the business unit, the temperature threshold of each heat source in the business unit is configured; Based on the task instruction and the real-time temperature of each heat source, the power supply information of each power supply domain in the business unit is configured.

3. The method of claim 1, wherein the method further comprises: Before or at the same time when the task instruction is sent to the business unit, the temperature threshold of each heat source and the power supply information of each power supply domain in the business unit are configured, which comprises the following steps: Before the task instruction is sent to the business unit, all temperature thresholds and all power supply information are configured, and after the configuration is completed, the task instruction is sent to the business unit; All temperature thresholds refer to the temperature threshold corresponding to each task instruction in all task instructions; All power supply information refers to the power supply information corresponding to each task instruction at different temperatures in all task instructions.

4. The method of claim 2, wherein the method further comprises: At the same time when the task instruction is sent to the business unit, the temperature threshold of each heat source in the business unit is configured, which comprises the following steps: At the same time when the task instruction is sent to the business unit, the temperature threshold of each heat source is configured according to the type of the task instruction.

5. The method of claim 2, wherein the method further comprises: Based on the task instruction and the real-time temperature of each heat source, the power supply information of each power supply domain in the business unit is configured, which comprises the following steps: The temperature of each heat source is collected in real time to obtain the real-time temperature of each heat source; Based on the real-time temperature of each heat source and the type of the task instruction, the power supply information is configured.

6. The method of automatic single event fault detection and handling of claim 2, wherein, The power supply information comprises a maximum current limiting value, maximum and minimum voltage thresholds, a target current table and a current tolerance value; the real-time parameter comprises real-time voltage and real-time current; The real-time temperature and real-time parameter of each power supply domain are compared with the temperature threshold and the power supply information respectively to determine whether there is a single particle fault, which comprises the following steps: The real-time temperature of each power supply domain is collected, which is compared with the temperature threshold corresponding to each power supply domain respectively to determine whether there is a single particle fault; The real-time voltage of each power supply domain is collected, which is compared with the maximum and minimum voltage thresholds respectively to determine whether there is a single particle fault; The real-time current of each power supply domain is collected, which is compared with the maximum current limiting value, and the real-time current is compared with the target current table and the current tolerance value comprehensively to determine whether there is a single particle fault.

7. The method of automatic single event fault detection and handling of claim 3, wherein, The power supply information includes: maximum current limiting value, maximum and minimum voltage threshold, target current table and current tolerance value; the real-time parameter includes: real-time voltage and real-time current; The real-time temperature of each power supply domain is collected, and the real-time temperature is compared with the temperature threshold corresponding to each power supply domain to determine whether there is a single particle fault. According to the type of the task instruction sent by the business unit, the temperature threshold corresponding to the task instruction is queried among all temperature thresholds. The real-time temperature of each power supply domain is collected, and the power supply information corresponding to the task instruction at the real-time temperature is queried among all power supply information. Based on the real-time temperature, the real-time temperature is compared with the temperature threshold corresponding to each power supply domain to determine whether there is a single particle fault. The real-time voltage of each power supply domain is collected, and the real-time voltage is compared with the maximum and minimum voltage threshold to determine whether there is a single particle fault. The real-time current of each power supply domain is collected, and the real-time current is compared with the maximum current limiting value, and the real-time current is compared with the target current table and the current tolerance value to determine whether there is a single particle fault.

8. The single event upset automatic detection and handling method of claim 6 or 7, wherein, The real-time temperature of each power supply domain is collected, and the real-time temperature is compared with the temperature threshold corresponding to each power supply domain to determine whether there is a single particle fault. If the real-time temperature of any power supply domain exceeds the corresponding temperature threshold, there is the single particle fault, otherwise there is no single particle fault.

9. The method of automatic single event fault detection and handling of claim 6 or 7, wherein, The real-time voltage of each power supply domain is collected, and the real-time voltage is compared with the maximum and minimum voltage threshold to determine whether there is a single particle fault. If the real-time voltage of any power supply domain is greater than the corresponding maximum voltage threshold, there is the single particle fault, otherwise there is no single particle fault. If the real-time voltage of any power supply domain is less than the corresponding minimum voltage threshold, there is the single particle fault, otherwise there is no single particle fault.

10. The method of automatic single event fault detection and handling of claim 6 or 7, wherein, The real-time current of each power supply domain is collected, and the real-time current is compared with the maximum current limiting value, and the real-time current is compared with the target current table and the current tolerance value to determine whether there is a single particle fault. If the real-time current is greater than the maximum current limiting value, there is the single particle fault, otherwise there is no single particle fault. If the difference between the real-time current corresponding to the current task instruction and the target current corresponding to the target current table is greater than the current tolerance value, the accumulated over-limit times is incremented by 1, otherwise the over-limit times is not accumulated. If the accumulated over-limit times exceeds the preset number after being incremented by 1, there is the single particle fault, otherwise there is no single particle fault. The target current table is a function of task instruction and temperature, which represents the current value corresponding to different types of task instructions at different temperatures.

11. The method of automatic single event fault detection and handling of claim 6 or 7, wherein, According to the preset processing method, the real-time temperature of each power supply domain is collected, and the real-time temperature is compared with the temperature threshold corresponding to each power supply domain. If there is the single particle fault, a software shutdown instruction is sent to the business unit to cut off the power supply of each power supply domain and report the fault. ​ Collecting real-time voltages of the power domains, comparing the real-time voltages with the maximum and minimum voltage thresholds respectively, if there is the single event upset, sending a shutdown instruction to the service unit to shut down the power supply of the power domains and report the failure; Collecting real-time currents of the power domains, comparing the real-time currents with the maximum current limit value, and comprehensively comparing the real-time currents with the target current table and the current tolerance value, if there is the single event upset, sending a shutdown instruction to the service unit to shut down the power supply of the power domains and report the failure.

12. The method of automatic single event fault detection and handling of claim 1, wherein, The service unit further comprises, after self-checking: Receiving the self-checking result of the service unit, the self-checking result including self-checking error and self-checking correct; if the self-checking error occurs, the service unit repeatedly performs self-checking and feeds back the self-checking result after each self-checking until the self-checking is correct or a relevant instruction is received; If the self-checking result of the self-checking error is continuously received more than N times, a software restart instruction is sent to the service unit to make the service unit perform software restart; After the service unit performs software restart, self-checking is started again, if the self-checking result of the self-checking error is continuously received more than N times, a hardware power-off restart instruction is sent to the service unit to make the service unit perform hardware power-off restart; After the service unit performs hardware power-off restart, self-checking is started again, if the self-checking result of the self-checking error is continuously received more than N times, a shutdown instruction is sent to the service unit to make the power supply of each power domain in the service unit shut down and report the failure.

13. A single event fault automatic detection and handling system, characterized by, It comprises: a control unit and a service unit; The control unit comprises an instruction module, a temperature detection module, and a power supply module; The service unit comprises various functional modules, each functional module corresponding to a power domain; The instruction module is configured to configure the temperature threshold of each heat source in the service unit in the temperature detection module before or at the same time as sending a task instruction to the service unit, and configure the power supply information of each power domain in the service unit in the power supply module; The temperature detection module is further configured to compare the collected real-time temperature of each power domain with the temperature threshold, determine whether there is a single event upset, and feed back to the instruction module when there is the single event upset; The power supply module is configured to collect real-time parameters of each power domain, compare the real-time parameters with the power supply information, determine whether there is a single event upset, and feed back to the instruction module when there is the single event upset; The instruction module is further configured to perform failure processing according to a preset processing method when there is a single event upset, and send a self-checking instruction to the service unit to make the service unit perform self-checking when there is no single event upset.

14. A chip, characterized by The chip is configured to use the single event upset automatic detection and processing method of any one of claims 1-12 for single event upset automatic detection and processing.

15. An electronic device, comprising: The electronic device comprises the chip of claim 14. The chip is configured to use the single event upset automatic detection and processing method of any one of claims 1-12 for single event upset automatic detection and processing.

Images