Backup device and method of satellite-borne router
By sharing and switching Flash synchronization data between the primary and backup systems, the problem of interruption caused by satellite router failures was solved, the reliability of the satellite network and the continuity of communication services were improved, and rapid protocol stack convergence was achieved.
Patent Information
- Application Number
- CN202511892450.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-16
- Publication Date
- 2026-04-17
AI Technical Summary
Spaceborne routers are susceptible to high-energy particles in space, which can cause chip bit flipping or latching, leading to system crashes or malfunctions. Existing technologies lack effective backup systems, resulting in insufficient reliability of satellite networks and interruptions of critical missions.
The host system and the standby system operate independently, and critical data is synchronized through shared Flash. When switching between the host and standby systems, the standby system takes over the shared Flash data to achieve state synchronization. The mapping table is maintained through FPGA to avoid frequent erase and write operations. The power system adopts dual parallel power supply, and degrades to cold backup in the event of a shared Flash failure.
It improves the reliability of satellite networks, ensures the continuity of critical missions, reduces hardware complexity, enables rapid convergence of protocol stacks, and ensures the stable operation of communication services.
Smart Images
Figure CN121887619A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of satellite communication technology, and in particular to a backup device and method for a satellite-borne router. Background Technology
[0002] As the core equipment of spacecraft networks, spaceborne routers are the "nerve nodes" in space, and their reliability directly affects the performance of the entire satellite constellation. High-energy particles in space can easily cause chip bit flips or latch-ups, leading to router crashes or malfunctions, in which case a backup system is needed to take over.
[0003] Therefore, a new backup device for satellite routers needs to be designed to improve the reliability of satellite networks and ensure the continuity of critical missions. Summary of the Invention
[0004] The purpose of this application is to provide a backup device and method for a satellite router, which solves the problem of service interruption and satellite failure caused by router failure in satellite communication.
[0005] To achieve the above objectives, this application adopts the following technical solution:
[0006] On one hand, this application provides a backup device for a spaceborne router, including a host system, a standby system, and a shared Flash memory, wherein:
[0007] The host system and the standby system operate independently and access the shared Flash in parallel through an interface.
[0008] The host system is used to periodically synchronize critical data to the shared Flash.
[0009] The standby system is used to take over the shared Flash when the host system is in an abnormal state, use the data in the shared Flash for status synchronization, and synchronize the key data to the shared Flash at regular intervals after the network converges.
[0010] Optionally, the shared Flash includes a mapping area and a data area. The data area uses the maximum number of Flash pages occupied by critical data as the granularity. When data is updated, the old data is not directly erased or overwritten, and the new data is written to the physical page of the free granularity. The mapping area is used to maintain a mapping table from logical address to physical address, pointing to the physical page where the new data is located.
[0011] Optionally, the mapping table of the shared Flash mapping area is maintained and updated within the FPGA of the host system or the standby system. The FPGA is responsible for maintaining the mapping relationship according to the changes in data. After the number of updates of the mapping table in the FPGA reaches a preset threshold, the mapping table is synchronously updated to the mapping table in the shared Flash mapping area, and the number of updates of the mapping table in the FPGA is reset to 0.
[0012] Optionally, the physical pages of old data in the data area are marked as invalid and erased by the garbage collection process when the host system or standby system is idle, thus avoiding frequent write operations.
[0013] Optionally, after the host system and the standby system write the critical data into the data area, they perform a readback verification. If the verification matches, the write is successful; if the verification does not match, bad block management is enabled, and the data is rewritten to the physical pages of the idle granular blocks.
[0014] Optionally, the hardware of the host system and the standby system is installed on the same PCB board.
[0015] Optionally, the host system includes a host FPGA, the standby system includes a standby FPGA, the host FPGA and the standby FPGA operate independently and access the shared Flash in parallel through the QSPI interface.
[0016] Optionally, the host system includes a host power supply, and the standby system includes a standby power supply. The host power supply and the standby power supply operate independently. When the host system is running, the host FPGA controls the power-on and power-off of the shared Flash memory. When the standby system is running, the standby FPGA controls the power-on and power-off of the shared Flash memory.
[0017] Optionally, when the shared Flash fails, it automatically downgrades to cold backup mode.
[0018] On the other hand, this application also provides a method for backing up a satellite-borne router, including:
[0019] The host system periodically synchronizes critical data to the shared Flash memory.
[0020] Regularly monitor the health status of the host system. When an abnormal status is detected, send an abnormal status report to the ground controller, which will then make a decision on the primary / standby status.
[0021] In response to the primary / backup status decision sent by the ground controller, the primary / backup system switches over. After the primary system performs a final synchronization of critical data and mapping tables, the backup system takes over the shared Flash and uses the data in the shared Flash for status synchronization. After network convergence, the critical data is periodically synchronized to the shared Flash.
[0022] Based on the above technical solution, this application can achieve the following technical effects:
[0023] This application discloses a hardware system architecture featuring shared flash memory, a separate control plane, and dual power supplies. When the shared flash memory is active, it stores critical data from the onboard router and updates it periodically. The onboard router periodically checks its health status and reports it to the ground controller, which then makes the switchover decision. After a primary / backup switchover, the backup router can quickly take over services based on the data in the flash memory. In the event of a shared flash memory failure, a cold backup method is implemented. This hybrid backup method improves the reliability of the satellite network and ensures the continuity of critical missions. Attached Figure Description
[0024] Figure 1 This is a schematic diagram of the hardware architecture of a backup device for a spaceborne router provided in one embodiment of this application; Figure 2 This is a flowchart illustrating a backup method for a satellite router provided in one embodiment of this application.
[0025] Figure 2 This is a flowchart illustrating a backup method for a satellite router provided in one embodiment of this application.
[0026] Figure 3 is a schematic diagram illustrating the specific implementation process of a backup method for a satellite router provided in an embodiment of this application. Detailed Implementation
[0027] The present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. The advantages and features of the present application will become clearer from the following description and claims. It should be noted that the drawings are all in a very simplified form and are not to scale, and are only used to facilitate and clarify the illustration of the embodiments of the present application.
[0028] It should be noted that, in order to clearly illustrate the content of this application, several embodiments are provided to further explain the different implementations of this application. These embodiments are enumerated rather than exhaustive. Furthermore, for the sake of brevity, content mentioned in the preceding embodiments is often omitted in the following embodiments. Therefore, content not mentioned in the following embodiments can be referred to in the preceding embodiments.
[0029] Example 1
[0030] like Figure 1 The diagram shown is a hardware architecture schematic of a backup device for a spaceborne router provided in this embodiment. It includes a host system, a backup system, and shared Flash memory, wherein:
[0031] The host system and the standby system operate independently and access the shared Flash in parallel through an interface.
[0032] The host system is used to periodically synchronize critical data to the shared Flash.
[0033] The standby system is used to take over the shared Flash when the host system is in an abnormal state, use the data in the shared Flash for status synchronization, and synchronize the key data to the shared Flash periodically after the network converges.
[0034] In one embodiment, the shared Flash includes a mapping area and a data area. The data area is granular with the maximum number of Flash pages occupied by critical data as the unit. When data is updated, the old data is not directly erased or overwritten, and the new data is written to the physical page of the free granular area. The mapping area is used to maintain a mapping table from logical address to physical address, pointing to the physical page where the new data is located.
[0035] In one embodiment, the mapping table of the shared Flash mapping area is maintained and updated within the FPGA of the host system or the standby system. The FPGA is responsible for maintaining the mapping relationship according to the changes in data. After the number of updates of the mapping table in the FPGA reaches a preset threshold, the mapping table is synchronously updated to the mapping table of the shared Flash mapping area, and the number of updates of the mapping table in the FPGA is reset to 0.
[0036] In one embodiment, physical pages of old data in the data area are marked as invalid and erased by the garbage collection process when the host or standby system is idle, thus avoiding frequent write / erase operations.
[0037] In one embodiment, after the host system and the standby system write critical data into the data area, they perform a readback verification. If the verification matches, the write is successful; if the verification does not match, bad block management is enabled, and the data is rewritten to the physical pages of the free granular blocks.
[0038] In one embodiment, the host system includes a host CPU, a host FPGA, and a host power supply, and the standby system includes a standby CPU, a standby FPGA, and a standby power supply.
[0039] In one specific embodiment, the spaceborne router adopts a highly integrated hardware architecture, with both the main and backup systems deployed on the same PCB board. Redundancy and fault tolerance are achieved through resource sharing and functional isolation. The system uses shared Flash storage, accessed in parallel by the main and backup FPGAs via a QSPI interface, ensuring synchronization of critical data between the main and backup units. The control plane is physically separated, with the main and backup CPUs operating independently, reading and writing to the shared Flash only indirectly through their respective FPGAs, achieving both data consistency and strict isolation of fault domains. The power system adopts a dual-path parallel power supply scheme. When the main unit is running, the main FPGA controls the power-on and power-off operations of the shared Flash; when the backup unit is running, the backup FPGA controls the power-on and power-off operations of the shared Flash. The power path can independently maintain the operation of the storage system and complete the power-on enable control of the shared Flash. Under this architecture, if an unrecoverable fault occurs in the shared Flash, the system will be unable to maintain the shared Flash backup state and will automatically degrade to a cold backup mode.
[0040] This completes the design of the backup device for the spaceborne router. This hardware design, based on cold backup, adds shared Flash memory for synchronizing critical data. Due to the non-volatile nature of Flash memory, power outages during primary / standby switching will not cause loss of critical data. This device reduces hardware complexity, and the standby unit can take over the shared Flash memory resources after switching, enabling rapid convergence of the protocol stack. This improves the continuity of communication services and ensures stable system operation.
[0041] Example 2
[0042] Based on Example 1, this example provides a backup method for a spaceborne router, such as... Figure 2 As shown. The method includes:
[0043] Step 202: The host system periodically synchronizes key data to the shared Flash.
[0044] Step 204: Regularly monitor the health status of the host system. When an abnormal status is detected, send an abnormal status report to the ground controller, which will then make a decision on the primary / standby status.
[0045] Step 206: In response to the primary / backup status decision result sent by the ground controller, the primary / backup system is switched. After the primary system performs the final synchronization of key data and mapping table, the backup system takes over the shared Flash and uses the data in the shared Flash for status synchronization. After network convergence, the key data is synchronized to the shared Flash at regular intervals.
[0046] Furthermore, before switching between primary and backup systems in response to the primary / backup status decision sent by the ground controller, the following steps are also included:
[0047] The host system performs a final synchronization of critical data and mapping tables to the shared Flash.
[0048] In one specific embodiment, the process of backing up the satellite router shown includes the following steps: The first step is for the host FPGA to periodically synchronize existing key data to the shared Flash memory for full status synchronization.
[0049] The first step is for the host FPGA to periodically synchronize existing key data to the shared Flash memory for full status synchronization.
[0050] Key data includes, but is not limited to, routing tables, topology data, routing policies, TCP / UDP session tables, ACL policies, and IPSec SA.
[0051] The flash memory is divided into a mapping area and a data area. The data area is granular, with the maximum number of pages occupied by critical data in the flash memory. When data is updated, the old data is not directly erased or overwritten. The new data is written to the physical page of the free space. The mapping area maintains a mapping table from logical address to physical address, pointing to the physical page where the new data is located. This table is also cached in the FPGA.
[0052] In this process, physical pages containing old data are marked as invalid and erased by the garbage collection process when the system is idle, thus avoiding frequent write operations.
[0053] After the critical data is written to the data area, a readback verification is performed. If the verification matches, the write is successful; if the verification does not match, bad block management is enabled, and the data is rewritten to the physical page of the free granular block.
[0054] The second step is to regularly monitor the health status of the host, including CPU, memory, and port status.
[0055] The third step involves detecting uncorrectable errors from the underlying hardware, hardware failures such as watchdog timeout resets, or monitoring performance degradation phenomena such as CPU usage exceeding 60%, and then sending abnormal status reporting information to the ground controller.
[0056] The fourth step involves receiving the primary / standby status decision information from the ground controller. Before the handover operation, a final synchronization of critical data and mapping tables is performed to ensure successful synchronization. The primary / standby status decision is made by the ground controller based on received abnormal status reports, fast remote sensing, slow remote sensing, and other status reports, combined with a pre-defined handover strategy. To prevent misjudgment, a secondary confirmation is performed manually before the ground controller sends the primary / standby status decision information to the onboard router.
[0057] In summary, this method is based on a hybrid backup mechanism, utilizing shared flash memory to synchronize critical status data and making handover decisions based on data detected by the onboard router. Flash data is non-volatile upon power loss, and final data synchronization is performed before primary / standby switchover. After the primary unit powers down and the standby unit powers on, the flash data is read, enabling rapid convergence of the protocol stack. If a flash memory failure occurs, the system reverts to a cold backup mode. This method solves the service interruption problem caused by single-point failures of routers in satellite communication, implements a backup method for onboard routers, and improves the reliability of system operation.
[0058] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.
Claims
1. A backup apparatus of a spaceborne router, characterized by comprising: This includes the main system, the backup system, and shared Flash memory, among which: The host system and the standby system operate independently and access the shared Flash in parallel through an interface. The host system is used to periodically synchronize critical data to the shared Flash. The standby system is used to take over the shared Flash when the host system is in an abnormal state, use the data in the shared Flash for status synchronization, and synchronize the key data to the shared Flash periodically after the network converges.
2. The apparatus according to claim 1, characterized in that, The shared Flash includes a mapping area and a data area. The data area uses the maximum number of Flash pages occupied by critical data as the granularity. When data is updated, the old data is not directly erased or overwritten. The new data is written to the physical page of the free granularity. The mapping area is used to maintain a mapping table from logical address to physical address, pointing to the physical page where the new data is located.
3. The apparatus according to claim 2, characterized in that, The mapping table of the shared Flash mapping area is maintained and updated in the FPGA of the host system or the standby system. The FPGA is responsible for maintaining the mapping relationship according to the changes in data. Once the number of updates to the mapping table within the FPGA reaches a preset threshold, the mapping table will be synchronously updated to the mapping table in the shared Flash mapping area, and the number of updates to the mapping table within the FPGA will be reset to 0.
4. The apparatus according to claim 2, characterized in that, The physical pages of old data in the data area are marked as invalid and erased by the garbage collection process when the host system or standby system is idle, thus avoiding frequent write operations.
5. The apparatus according to claim 4, characterized in that, After the host system and the standby system write critical data into the data area, they perform a readback verification. If the verification matches, the write is successful; if the verification does not match, bad block management is enabled, and the data is rewritten to the physical pages of the idle granular blocks.
6. The apparatus according to claim 1, characterized in that, The hardware of the host system and the standby system is installed on the same PCB board.
7. The apparatus according to claim 1, characterized in that, The host system includes a host FPGA, and the standby system includes a standby FPGA. The host FPGA and the standby FPGA operate independently and access the shared Flash in parallel through the QSPI interface.
8. The apparatus according to claim 7, characterized in that, The host system includes a host power supply, and the standby system includes a standby power supply. The host power supply and the standby power supply operate independently. When the host system is running, the host FPGA controls the power-on and power-off of the shared Flash memory. When the standby system is running, the standby FPGA controls the power-on and power-off of the shared Flash memory.
9. The apparatus according to claim 8, characterized in that, When the shared Flash fails, it automatically downgrades to cold backup mode.
10. A method for using a backup device in a satellite router as described in claim 1, characterized in that, include: The host system periodically synchronizes critical data to the shared Flash memory. Regularly monitor the health status of the host system. When an abnormal status is detected, send an abnormal status report to the ground controller, which will then make a decision on the primary / standby status. In response to the primary / backup status decision sent by the ground controller, the primary / backup system switches over. After the primary system performs a final synchronization of critical data and mapping tables, the backup system takes over the shared Flash and uses the data in the shared Flash for status synchronization. After network convergence, the critical data is periodically synchronized to the shared Flash.