Multistage detection power failure data protection system and method based on MCU

Abstract

The invention belongs to the field of aviation airborne computers, and provides a multi-stage detection power-down data protection system and method based on an MCU (Microprogrammed Control Unit), which are used for protecting key health data generated by a main module when a main power supply of the system is powered down. The system comprises a to-be-tested power supply module, an MCU energy storage power supply module, a data communication module and an MCU control module. The MCU integrates an ADC, an interrupt GPIO, a detector PVD, an SRAM and a Flash; the to-be-tested power supply module is respectively connected with the ADC and the GPIO, and monitors a main power supply for supplying power to the main module; the MCU energy storage power supply module provides backup power supply for the MCU when the main power supply is powered down; and the main module writes key data into the SRAM through the data communication module, and the MCU transfers the key data into the Flash after detecting a power failure event. The method does not need an NVRAM (Non-Volatile Random Access Memory) or a special monitoring chip, is low in cost and high in reliability, and is suitable for high-reliability embedded systems such as aviation and airborne systems.

Description

Technical Field

[0001] This invention belongs to the field of airborne computers and relates to embedded system power management technology. Specifically, it relates to a multi-level detection power failure data protection system and method based on MCU, which can reliably save critical data when the main power supply fails. Background Technology

[0002] In high-reliability airborne electronic systems, health management modules must continuously record equipment operating status, fault codes, and key parameters to support post-flight maintenance and fault tracing. However, the airborne power environment is complex and susceptible to factors such as engine start-stop, electromagnetic interference, or transient line interruptions, which can cause millisecond-level power outages or voltage drops in the main power supply. If the system lacks an effective power outage warning and data protection mechanism, the dynamic operating data in the MCU's internal SRAM will be lost instantly, causing a gap in health management information and severely impacting the system's testability and maintainability.

[0003] Currently, common power-loss protection solutions in the airborne field mainly fall into two categories: One approach uses a separate external voltage monitoring chip (such as MAX809, TLV7031, etc.) in conjunction with non-volatile memory (NVRAM or FRAM) for data backup. While this solution can achieve fast power-down response, it has significant drawbacks: NVRAM is expensive, has complex interfaces, and has high static power consumption, which does not meet the design requirements of airborne equipment for low power consumption and long lifespan; at the same time, the additional monitoring chip and memory significantly occupy valuable PCB board space, violating the economical design principles of low cost and miniaturization.

[0004] Another approach involves directly connecting a supercapacitor in parallel between the main power supply and the MCU, utilizing its energy storage characteristics to maintain short-term power supply. However, to prevent the supercapacitor from reverse discharging when the main power supply is normal, an isolation diode is typically connected in series. This diode introduces a forward voltage drop of 0.3~0.7V. When the main power supply is already at a critical voltage (e.g., 3.0V), this may cause the actual supply voltage of the MCU to fall below its operating threshold (e.g., 2.7V), triggering a premature reset and interrupting data write operations, thus increasing the risk of data loss. Furthermore, this type of solution generally lacks effective filtering and trend judgment of power failure signals, easily misinterpreting instantaneous voltage spikes caused by load changes as real power failures, frequently triggering unnecessary data transfer processes. This not only wastes the supercapacitor's energy but may also shorten the lifespan of the FLASH memory due to frequent erasure and rewriting.

[0005] In addition, most existing solutions are not deeply integrated with the original health management circuits of the airborne system, and are often superimposed as independent functional modules, resulting in system architecture redundancy and reduced testability.

[0006] Therefore, there is an urgent need for a power-loss protection solution that can reuse MCU internal resources, requires no additional NVRAM, has a compact structure, and has intelligent discrimination capabilities, so as to meet the comprehensive requirements of aviation airborne equipment for high reliability, low cost, small size, and easy testability while ensuring data security. Summary of the Invention

[0007] To address the technical challenges of existing power-down protection solutions, such as high cost, large size, susceptibility to false triggering, and difficulty in deep integration with onboard health management circuits, this invention provides a multi-level detection power-down data protection system and method based on an MCU. By introducing a health management system centered on a microcontroller (MCU), this system rationally utilizes existing hardware resources without additional NVRAM, achieving critical power-down detection and data protection functions through the MCU. The system and method, while retaining the reliability and testability of the original health management circuit, employs multiple monitoring mechanisms to improve fault identification accuracy, prevents erroneous backup operations, and reliably transfers critical health data to the MCU's internal non-volatile memory during power loss via an SRAM-Flash hierarchical storage architecture. This saves PCB space, reduces component costs, and demonstrates high economic efficiency and engineering practicality.

[0008] Specifically, a multi-level detection power-down data protection system based on an MCU is provided to protect critical health data generated by the main module when the main power supply of the system fails. The power-down protection system includes a power supply module under test, an MCU energy storage power supply module, a data communication module, and an MCU control module.

[0009] The MCU control module integrates an internal ADC, an external interrupt GPIO, a programmable voltage detector PVD, an internal SRAM, and an internal Flash. The programmable voltage detector PVD is configured to monitor the power input voltage of the MCU control module and generate a PVD interrupt signal when the voltage is lower than a preset threshold. The PVD interrupt signal is used to participate in the comprehensive judgment of the system main power failure event. The power supply module under test includes an analog voltage monitoring circuit and a discrete quantity isolation circuit, which are respectively connected to the internal ADC and the external interrupt GPIO, and are used to monitor the voltage status of the main power supply of the system that powers the main module. The MCU energy storage power module is connected to the power input terminal of the MCU control module and is used to provide backup power to the MCU control module when the main power supply of the system fails. The data communication module is connected between the main module and the MCU control module. It is used to transmit the key health data generated by the main module to the internal SRAM, and to transfer the key health data in the internal SRAM to the internal Flash when a system main power failure event is detected.

[0010] Furthermore, the power supply module under test employs a triple monitoring mechanism to monitor the voltage status of the system's main power supply, including: The analog voltage monitoring circuit continuously samples the system's main power supply through its internal ADC; The discrete quantity isolation circuit receives the power-down discrete quantity signal and triggers an interrupt through the external interrupt GPIO; The PVD detection circuit of the main power supply is used to detect whether a power failure event has occurred in the main power supply.

[0011] Furthermore, the analog voltage monitoring circuit includes an ADC front-end conditioning circuit, which includes a current-limiting resistor R5 and a filter capacitor C3. One end of the current-limiting resistor R5 is connected to the system main power supply, and the other end is connected to the input pin of the internal ADC. One end of the filter capacitor C3 is connected to the input pin of the internal ADC, and the other end is grounded.

[0012] Furthermore, the discrete quantity isolation circuit includes diode D2, diode D3, resistor R3, resistor R2, and resistor R4; One end of the resistor R3 is connected to the power-off signal input terminal, and the other end is connected to the anode of the diode D2; The cathode of the diode D2 is connected to one end of the resistor R2, and the other end of the resistor R2 is grounded. One end of the resistor R4 is connected to the MCU power supply voltage, and the other end is connected to the external interrupt GPIO pin; The anode of diode D3 is grounded, and the cathode is connected to the external interrupt GPIO pin.

[0013] Furthermore, the MCU energy storage power module includes a reverse isolation diode D1, a current limiting resistor R1, an energy storage capacitor C1, and an energy storage capacitor C2; The anode of the reverse isolation diode D1 is connected to the main power supply of the system, and the cathode is connected to one end of the current limiting resistor R1. The other end of the current-limiting resistor R1 is connected to the power input terminal of the MCU control module, the positive terminal of the energy storage capacitor C1, and the positive terminal of the energy storage capacitor C2, respectively. The negative terminals of both the energy storage capacitor C1 and the energy storage capacitor C2 are grounded. The programmable voltage detector (PVD) is integrated inside the MCU control module and is used to monitor the voltage at the power input terminal of the MCU control module and generate an internal interrupt when it is lower than a preset threshold.

[0014] Furthermore, the key health data includes at least one of fault codes, self-test results, and operating status parameters. After confirming a power failure event in the system main power supply, the MCU control module moves the key health data in the internal SRAM to the internal Flash.

[0015] This invention also provides a power failure protection method based on the above system, the method comprising the following steps: Step 1: The main module periodically sends key health data to the MCU control module through the data communication module, and the MCU control module stores the data in its internal SRAM. Step 2: Through the power supply module under test, the voltage of the main power supply of the system is sampled to obtain the ADC sample value, the power failure discrete signal is received and an external interrupt is triggered; Step 3: Determine whether the system main power supply has actually lost power by using the ADC sampled value, the external interrupt signal, and the PVD interrupt signal; Step 4: If a real power failure is confirmed, turn off unnecessary peripherals, write the key health data in the internal SRAM into the internal Flash in blocks according to the preset priority order, and attach CRC check codes and completion marks.

[0016] Further, in step 4, the key health data in the internal SRAM is written into the internal Flash in blocks according to a preset priority order, including: Pre-erase the target sector before the system loses power; After a system power failure, an incremental update mechanism, a Flash wear leveling strategy, and a storage space monitoring and early warning mechanism are used to write critical health data from the internal SRAM to the internal Flash, updating only the data blocks that have changed.

[0017] Furthermore, the method also includes determining the fault type based on the cause of the power outage, specifically including: If the ADC voltage remains below the threshold and no PVD interrupt occurs, it is determined that the system main power supply has failed. If a PVD interrupt occurs but the system main power supply voltage monitored by the ADC is normal, it is determined that the MCU power supply is abnormal.

[0018] Compared with the prior art, the beneficial effects that at least one technical solution adopted in the embodiments of this specification can achieve include at least: 1. Reduced cost and size: Multi-source power monitoring is achieved by reusing the MCU's built-in ADC, GPIO interrupts, and PVD, eliminating the need for an external voltage monitoring chip; internal Flash memory is used to replace NVRAM for data backup, saving BOM cost and PCB space.

[0019] 2. Maintain high reliability and testability: While adding power loss protection, it is compatible with the original health management architecture to avoid system redundancy and increased verification complexity.

[0020] 3. Improve fault identification accuracy: Combine external discrete interrupt, ADC voltage sampling and PVD triple detection to comprehensively judge the power supply status and effectively suppress false triggering.

[0021] 4. Supports fault type diagnosis: Based on the combination of the system's main power supply and MCU power supply status, it automatically distinguishes and records different power failure types, which facilitates maintenance and tracing.

[0022] 5. Extend Flash lifespan: Employing strategies such as prioritizing critical data storage, incremental updates, and wear leveling significantly reduces invalid writes and erases. Additionally, a storage space monitoring and early warning mechanism prevents backup failures due to insufficient space.

[0023] 6. Ensure reliable data recovery: When power is lost, a CRC checksum and a completion marker are written. After restarting, the data can be verified and recovered safely.

[0024] 7. Strong engineering applicability: Based on a general-purpose MCU, it requires no special components, only firmware adaptation, minimal hardware modifications, and is easy to integrate into existing high-reliability systems. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is an architecture diagram of the MCU-based multi-level detection power-down data protection system of the present invention; Figure 2 This is a circuit diagram of the power supply module under test in this invention; Figure 3 This describes the algorithm execution flow in a multi-level power failure data protection system. Detailed Implementation

[0027] The embodiments of this application will now be described in detail with reference to the accompanying drawings.

[0028] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features of the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0029] This invention provides a multi-level detection power-down data protection system based on an MCU, used to protect critical health data generated by the main module when the system's main power supply fails. (See also...) Figure 1 As shown, the power failure protection system includes a power supply module under test, an MCU energy storage power supply module, a data communication module, and an MCU control module.

[0030] The MCU control module integrates an internal ADC, an external interrupt GPIO, a programmable voltage detector PVD, an internal SRAM, and an internal Flash. The programmable voltage detector PVD is configured to monitor the power input voltage of the MCU control module and generate a PVD interrupt signal when the voltage is lower than a preset threshold. The PVD interrupt signal is used to participate in the comprehensive judgment of the system main power failure event. The power supply module under test includes an analog voltage monitoring circuit and a discrete quantity isolation circuit, which are respectively connected to the internal ADC and the external interrupt GPIO, and are used to monitor the voltage status of the main power supply of the system that powers the main module. The MCU energy storage power module is connected to the power input terminal of the MCU control module and is used to provide backup power to the MCU control module when the main power supply of the system fails. The data communication module is connected between the main module and the MCU control module. It is used to transmit the key health data generated by the main module to the internal SRAM, and to transfer the key health data in the internal SRAM to the internal Flash when a system main power failure event is detected.

[0031] In addition, in one embodiment, the data communication module can also periodically transfer key health data from the internal SRAM to the internal Flash for storage.

[0032] In one embodiment, the data communication module adopts an SRAM-Flash hierarchical storage architecture, and the main module processor communicates via a communication interface (including but not limited to SPI interface, I...). 2 (e.g., C or serial port) periodically writes critical data into the MCU's internal SRAM, and only transfers the data in the internal SRAM to the internal Flash memory when a power abnormality is detected or according to a set period.

[0033] In one embodiment, the power supply module under test employs a triple monitoring mechanism to monitor the voltage status of the system's main power supply, achieving accurate voltage sampling and power-down early warning monitoring. This module can monitor both the external power supply status and the MCU operating power supply status, analyze the two power supply states, and execute different data storage strategies based on the internal and external power supply states. Specifically, it includes the analog voltage monitoring circuit, the discrete quantity isolation circuit, and the PVD detection circuit for the main power supply.

[0034] The analog voltage monitoring circuit continuously samples the system's main power supply via its internal ADC; the discrete quantity isolation circuit receives the power-down discrete quantity signal and triggers an interrupt via the external interrupt GPIO; and the main power supply's PVD detection circuit detects whether a power-down event has occurred. In the event of a power-down, the following is employed: Figure 3 The illustrated tiered response mechanism performs backup. The specific detection process and emergency backup operation are as follows: When the external power supply voltage is detected to be below the emergency threshold (via ADC or discrete interrupt), and PVD is not triggered (indicating normal MCU power supply), the system determines it as a valid power failure event and immediately initiates the data backup process. When the external power supply voltage is normal, but PVD detects an abnormal MCU operating power supply, the system determines it as an MCU power supply failure, executes a safety shutdown procedure, and records the fault information. When both internal and external power supplies are abnormal, the system determines it as a complete power failure event. At this time, the system immediately uses the backup power supply to enter a low-power mode, performing only critical data backup operations. When both internal and external power supplies are normal, the system is in normal operating condition and does not perform any backup or protection operations.

[0035] More specifically, such as Figure 1 As shown, the PVD detection circuit of the main power supply is a programmable voltage detector (PVD) integrated into the microcontroller.

[0036] For more details, see Figure 2 As shown, the analog voltage monitoring circuit includes an ADC front-end conditioning circuit, which includes a current-limiting resistor R5 and a filter capacitor C3. One end of the current-limiting resistor R5 is connected to the system main power supply, and the other end is connected to the input pin of the internal ADC. One end of the filter capacitor C3 is connected to the input pin of the internal ADC, and the other end is grounded.

[0037] For more details, see Figure 2 As shown, the discrete quantity isolation circuit includes diode D2, diode D3, resistor R3, resistor R2, and resistor R4; One end of the resistor R3 is connected to the power-off signal input terminal, and the other end is connected to the anode of the diode D2; The cathode of the diode D2 is connected to one end of the resistor R2, and the other end of the resistor R2 is grounded. One end of the resistor R4 is connected to the MCU power supply voltage, and the other end is connected to the external interrupt GPIO pin; The anode of diode D3 is grounded, and the cathode is connected to the external interrupt GPIO pin.

[0038] Furthermore, the MCU energy storage power module includes a reverse isolation diode D1, a current limiting resistor R1, an energy storage capacitor C1, and an energy storage capacitor C2; The anode of the reverse isolation diode D1 is connected to the main power supply of the system, and the cathode is connected to one end of the current limiting resistor R1. The reverse isolation diode D1 can prevent power backflow and ensure that the MCU is not affected when switching to the backup power supply state when the MCU working power supply is abnormal. The other end of the current-limiting resistor R1 is connected to the power input terminal of the MCU control module, the positive terminal of the energy storage capacitor C1, and the positive terminal of the energy storage capacitor C2, respectively. The negative terminals of both the energy storage capacitor C1 and the energy storage capacitor C2 are grounded. The programmable voltage detector (PVD) is integrated inside the MCU control module and is used to monitor the voltage at the power input terminal of the MCU control module and generate an internal interrupt when it is lower than a preset threshold.

[0039] Furthermore, the key health data includes at least one of fault codes, self-test results, and operating status parameters. After confirming a power failure event in the system main power supply, the MCU control module moves the key health data in the internal SRAM to the internal Flash.

[0040] In one embodiment, the MCU control module is used to comprehensively determine the abnormal state of the MCU main power supply and perform corresponding data backup operations. Specifically, see [link to relevant documentation]. Figure 3 As shown, a decision sequence for the triple detection fusion algorithm is designed. This algorithm is deployed in the MCU control module to comprehensively judge the power supply status of the system's main power supply and the MCU's own power supply, and accordingly decide whether to perform data backup and what protection strategy to adopt. Its decision logic is executed in the following order: S1. Check ADC sampling value Read the continuous sampling voltage of the system main power supply from the internal ADC; If the ADC sample value is lower than the preset emergency threshold, then "external power supply abnormality" is confirmed.

[0041] S2. Check the interrupt status of external discrete quantities. If the external power failure signal input terminal triggers a GPIO external interrupt through a discrete isolation circuit, then "external power failure" is immediately marked.

[0042] S3. Check the internal PVD interrupt status. Check if the MCU's internal programmable voltage detector (PVD) has triggered an interrupt; If a PVD interrupt occurs, it indicates that the MCU's own power supply voltage has fallen below the safe threshold, i.e., "MCU power supply abnormality".

[0043] S4. Combine the results of S1 to S3 and perform the corresponding operations. Based on the combination of the three signals obtained from S1 to S3 above, determine which type of fault scenario it belongs to, and initiate the corresponding data protection or shutdown process.

[0044] In one embodiment, such as Figure 3 As shown, the software portion of the aforementioned power failure data protection system includes four key algorithm modules: a detection fusion algorithm module, a data lifecycle management module, an emergency backup control module, and an integrity assurance module.

[0045] Specifically, the detection fusion algorithm module is deployed within the main module of the power supply module under test. It is responsible for the coordinated processing of the triple detection results from external ADC monitoring, discrete interrupt input, and MCU internal PVD monitoring. It makes data backup decisions by comprehensively analyzing the internal and external power supply states. The execution flow of the decision logic is as follows: First, check the external discrete interrupt status. If triggered, immediately mark the external power supply as abnormal. Second, check the ADC sampling value. If it is lower than the emergency threshold, confirm the external power supply as abnormal. Then, check the PVD status to determine whether the MCU power supply is normal. Finally, based on the combination of internal and external power supply states, execute the corresponding operation according to the above decision conditions.

[0046] The data storage management module is deployed within the main processor of the data communication module, ensuring the periodic updates and validity verification of SRAM data. The Flash memory adopts a dual-bank architecture, supporting read-while-write operations and featuring a built-in wear leveling algorithm to extend memory lifespan. An adaptive communication protocol identification algorithm is employed to automatically identify and adapt to the communication requirements and data formats of different main processor devices. Storage resources utilize a tiered storage architecture with dynamic partition management, adjusting the space allocation of the cache and backup areas according to backup needs, and designing differentiated backup schemes for different levels of faults.

[0047] The emergency backup control module is deployed in the main processor of the data communication module to optimize high-speed, safe, and reliable data transfer from SRAM to Flash during power failure. When backup conditions are met, the backup control program is immediately activated. The system first disables all unnecessary interrupt sources and switches the system clock to the internal RC oscillator to reduce power consumption and improve stability. Then, all unnecessary peripheral clocks are disabled to minimize system power consumption and extend the supercapacitor's power supply time. During the data transfer phase, the actual data transfer operation from SRAM to Flash is performed. The system reads the data to be backed up from a predefined SRAM address area, reading data in words (32 bits) to improve transfer efficiency. The read data is directly written to predefined sectors of the Flash memory. Flash sector erase time is approximately 1-10ms; the target sector is pre-erased before system power failure (after power-on) to avoid erasure during writing. To improve backup success rate, critical data is backed up first, followed by less important data. The completion confirmation phase is executed after all data backup is complete. Data pipeline backup technology is employed to significantly improve backup efficiency through parallel processing and process optimization.

[0048] The integrity assurance module is deployed in the main processor of the data communication module. It ensures the reliability of backup data through data verification, retry mechanisms, and status tracking. The system writes a backup completion marker and verification information to a specific address in the Flash memory. The verification information includes metadata such as the data CRC32 checksum and backup timestamp. After the marker is written, the system enters a low-power shutdown mode, waiting for a complete power outage.

[0049] This invention also provides a power failure protection method based on the above system, the method comprising the following steps: Step 1: The main module periodically sends key health data to the MCU control module through the data communication module, and the MCU control module stores the data in its internal SRAM. Step 2: Through the power supply module under test, the voltage of the main power supply of the system is sampled to obtain the ADC sample value, the power failure discrete signal is received and an external interrupt is triggered; Step 3: Determine whether the system main power supply has actually lost power by using the ADC sampled value, the external interrupt signal, and the PVD interrupt signal; Step 4: If a real power failure is confirmed, turn off unnecessary peripherals, write the key health data in the internal SRAM into the internal Flash in blocks according to the preset priority order, and attach CRC check codes and completion marks. After the high-priority key health data (i.e. core data) is transferred and backed up, other data is transferred.

[0050] In one embodiment, to avoid write-on-write erasure and backup failure due to insufficient space, in step 4, key health data in the internal SRAM is written to the internal Flash in blocks according to a preset priority order. This includes: pre-erasing the target sector before the system power failure; and after the system power failure, using an incremental update mechanism, Flash wear leveling strategy, and storage space monitoring and early warning mechanism to write key health data from the internal SRAM to the internal Flash, updating only the data blocks that have changed.

[0051] In one embodiment, the method further includes determining the fault type based on the cause of the power outage, specifically including: If the ADC voltage remains below the threshold and no PVD interrupt occurs, it is determined that the system main power supply has failed. If a PVD interrupt occurs but the system main power supply voltage monitored by the ADC is normal, it is determined that there is a local power supply abnormality in the MCU. In addition, the fault type code and timestamp can be written to Flash for subsequent maintenance analysis.

[0052] The embodiments of the present invention achieve the following technical effects: 1. Reduced cost and size: Power-down protection is achieved by making reasonable use of existing hardware resources of the MCU, without the need for additional NVRAM or dedicated voltage monitoring chips; specifically, a multi-source power monitoring mechanism is built by utilizing the MCU's built-in ADC, external interrupt GPIO and programmable voltage detector (PVD), and the MCU's internal Flash is used to replace traditional NVRAM for critical data backup, which significantly reduces BOM cost and saves PCB board area.

[0053] 2. Improve system reliability and testability: While introducing an MCU to implement power-down protection, the system is fully compatible with and retains the original health management circuit architecture and test interface. This avoids system redundancy, signal path complexity, and increased verification workload caused by adding an independent protection module, ensuring that overall reliability is not degraded and test coverage is comprehensive.

[0054] 3. Multiple monitoring mechanisms improve fault identification accuracy: By integrating external discrete interrupt signals, continuous voltage sampling of the system's main power supply by the ADC, and monitoring of its own power supply voltage by the MCU's internal PVD, a triple heterogeneous detection channel is constructed to comprehensively distinguish between external power supply abnormalities and MCU local power supply faults, effectively suppressing invalid data backup operations caused by interference or false triggering of a single signal.

[0055] 4. Support for fault type differentiation and diagnosis: The system can automatically identify and classify different types of power supply faults based on the combination of the main power supply and MCU power supply status (e.g., external power failure only, MCU energy storage power supply failure only, simultaneous failure of both power supplies, etc.), and store the fault type code and timestamp together in Flash, providing structured data support for subsequent maintenance analysis and fault tracing.

[0056] 5. Extend the lifespan of Flash memory: Adopt a hierarchical data storage strategy to prioritize the integrity of critical health data; at the same time, introduce an incremental update mechanism (only write the data blocks that have changed) and a Flash wear leveling algorithm (dynamically select the sector with the fewest erase / write cycles for writing), which significantly reduces unnecessary erase / write operations and effectively extends the lifespan of the internal Flash.

[0057] 6. Ensure data transfer reliability: During the power outage emergency phase, the MCU uses the energy storage power to maintain short-term operation. When transferring critical data from SRAM to internal Flash, a backup completion mark and CRC check code are written simultaneously. After the system restarts, the validity of the backup data is determined through the triple verification mechanism of the check mark and CRC, and a safe recovery process is executed accordingly to prevent the use of damaged or incomplete data.

[0058] 7. Excellent engineering applicability: This solution is based on a general-purpose MCU platform and does not rely on special or customized components. It can be seamlessly integrated into existing airborne equipment or other high-reliability embedded systems. Only firmware logic needs to be adapted, and the hardware changes are minimal. It has engineering advantages such as convenient deployment, strong portability, and low maintenance costs.

[0059] Obviously, those skilled in the art should understand that the above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Various modifications and variations of the embodiments of the present invention are possible for those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A multi-level detection power-down data protection system based on an MCU, characterized in that, Used to protect critical health data generated by the main module when the system main power supply fails, including the power supply module under test, MCU energy storage power module, data communication module and MCU control module; The MCU control module integrates an internal ADC, an external interrupt GPIO, a programmable voltage detector (PVD), an internal SRAM, and an internal Flash. The programmable voltage detector (PVD) is configured to monitor the power input voltage of the MCU control module and generate a PVD interrupt signal when the voltage is lower than a preset threshold. The PVD interrupt signal is used to participate in the comprehensive judgment of the system's main power failure event. The power supply module under test includes an analog voltage monitoring circuit and a discrete quantity isolation circuit, which are respectively connected to the internal ADC and the external interrupt GPIO, and are used to monitor the voltage status of the main power supply of the system that powers the main module. The MCU energy storage power module is connected to the power input terminal of the MCU control module and is used to provide backup power to the MCU control module when the main power supply of the system fails. The data communication module is connected between the main module and the MCU control module. It is used to transmit the key health data generated by the main module to the internal SRAM, and to transfer the key health data in the internal SRAM to the internal Flash when a system main power failure event is detected.

2. The MCU-based multi-level detection power-down data protection system according to claim 1, characterized in that, The power supply module under test employs a triple monitoring mechanism to monitor the voltage status of the system's main power supply, including: The analog voltage monitoring circuit continuously samples the system's main power supply through its internal ADC; The discrete quantity isolation circuit receives the power-down discrete quantity signal and triggers an interrupt through the external interrupt GPIO; The PVD detection circuit of the main power supply is used to detect whether a power failure event has occurred in the main power supply.

3. The MCU-based multi-level detection power-down data protection system according to claim 2, characterized in that, The analog voltage monitoring circuit includes an ADC front-end conditioning circuit, which includes a current-limiting resistor R5 and a filter capacitor C3. One end of the current-limiting resistor R5 is connected to the system main power supply, and the other end is connected to the input pin of the internal ADC. One end of the filter capacitor C3 is connected to the input pin of the internal ADC, and the other end is grounded.

4. The MCU-based multi-level detection power-down data protection system according to claim 2, characterized in that, The discrete quantity isolation circuit includes diode D2, diode D3, resistor R3, resistor R2, and resistor R4; One end of the resistor R3 is connected to the power-off signal input terminal, and the other end is connected to the anode of the diode D2; The cathode of the diode D2 is connected to one end of the resistor R2, and the other end of the resistor R2 is grounded. One end of the resistor R4 is connected to the MCU power supply voltage, and the other end is connected to the external interrupt GPIO pin; The anode of diode D3 is grounded, and the cathode is connected to the external interrupt GPIO pin.

5. The MCU-based multi-level detection power-down data protection system according to claim 1, characterized in that, The MCU energy storage power module includes a reverse isolation diode D1, a current limiting resistor R1, an energy storage capacitor C1, and an energy storage capacitor C2. The anode of the reverse isolation diode D1 is connected to the main power supply of the system, and the cathode is connected to one end of the current limiting resistor R1. The other end of the current-limiting resistor R1 is connected to the power input terminal of the MCU control module, the positive terminal of the energy storage capacitor C1, and the positive terminal of the energy storage capacitor C2, respectively. The negative terminals of both the energy storage capacitor C1 and the energy storage capacitor C2 are grounded. The programmable voltage detector (PVD) is integrated inside the MCU control module and is used to monitor the voltage at the power input terminal of the MCU control module and generate an internal interrupt when it is lower than a preset threshold.

6. The MCU-based multi-level detection power-down data protection system according to claim 1, characterized in that, The key health data includes at least one of fault codes, self-test results, and operating status parameters. After confirming a power failure event in the system main power supply, the MCU control module moves the key health data in the internal SRAM to the internal Flash.

7. A power failure protection method, applied to a power failure protection system as described in any one of claims 1 to 6, characterized in that, Its features are, The method includes: The main module periodically sends key health data to the MCU control module through the data communication module, and the MCU control module stores the data in its internal SRAM. The power supply module under test samples the voltage of the main power supply of the system to obtain the ADC sampling value, receives the power failure discrete signal and triggers an external interrupt. The system's main power supply is determined to have experienced a real power failure based on the ADC sampled value, the external interrupt signal, and the PVD interrupt signal. If a genuine power failure is confirmed, non-essential peripherals are shut down, and critical health data from the internal SRAM is written into the internal Flash memory in blocks according to a preset priority order, with CRC checksums and completion markers added.

8. The power failure protection method according to claim 7, characterized in that, The critical health data in the internal SRAM is written into the internal Flash in blocks according to a preset priority order, including: Pre-erase the target sector before the system loses power; After a system power failure, an incremental update mechanism, a Flash wear leveling strategy, and a storage space monitoring and early warning mechanism are used to write critical health data from the internal SRAM to the internal Flash, updating only the data blocks that have changed.

9. The power failure protection method according to claim 7, characterized in that, The method further includes: Determine the fault type based on the cause of the power outage, including: If the ADC voltage remains below the threshold and no PVD interrupt occurs, it is determined that the system main power supply has failed. If a PVD interrupt occurs but the system main power supply voltage monitored by the ADC is normal, it is determined that the MCU power supply is abnormal.

Images