Processor starting method based on dual-redundancy Flash storage architecture
By employing a dual-redundant Flash memory architecture and a FPGA-based dynamic switching boot method, the problem of Flash memory boot failure in harsh environments is solved, achieving high reliability, low false alarm rate, and fast recovery of processor boot, which is suitable for airborne embedded systems.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- XIAN AVIATION COMPUTING TECH RES INST OF AVIATION IND CORP OF CHINA
- Filing Date
- 2025-12-26
- Publication Date
- 2026-05-01
AI Technical Summary
Existing technologies are prone to damage to Flash memory under harsh environments such as high vibration, extreme temperature and strong electromagnetic interference, which can lead to processor startup failure. Furthermore, existing redundancy mechanisms rely on additional hardware, have low detection accuracy and a high false alarm rate, and are difficult to adapt to general-purpose SPI interface processors, thus affecting system reliability and availability.
It adopts a dual-redundant Flash storage architecture, monitors the processor startup status in real time through FPGA, dynamically switches the SPI chip select signal to the backup Flash, and automatically repairs the main Flash boot program with CRC-32 verification, so as to achieve fault-tolerant startup with no external auxiliary storage and low false alarm rate.
It significantly improves the startup reliability and versatility of airborne systems, reduces the false alarm rate to 0.1%, system recovery time to ≤2 seconds, is compatible with all SPI interface processors, reduces cost and failure risk, and increases startup success rate from 95% to 99.998%.
Smart Images
Figure CN121957698A_ABST
Abstract
Description
Processor boot method based on dual-redundant Flash memory architecture Technical Field
[0001] This invention belongs to the field of airborne embedded computer technology and relates to a processor boot method based on a dual-redundant Flash memory architecture. Background Technology
[0002] The boot process of an embedded computer relies on a bootloader stored in non-volatile Flash memory. In airborne applications, the system is exposed to harsh environments such as high vibration, extreme temperature fluctuations, and strong electromagnetic interference for extended periods. This can easily lead to charge leakage, bit flips, or read / write errors within the Flash memory cells. If the bootloader is corrupted due to such physical damage or transient interference, the processor will be unable to complete the initialization process, causing the entire system to become completely inoperable and seriously threatening flight safety and mission reliability.
[0003] To improve boot robustness, existing technologies attempt to introduce redundancy mechanisms. These technologies periodically check the consistency between the bootloader in the main Flash and NVRAM, switching to a backup storage medium for reboot when an inconsistency is detected. However, this approach has significant limitations. However, this method has the following drawbacks: 1. Dependence on additional hardware: An additional NVRAM module must be configured as a reference, which not only increases system cost and power consumption, but also introduces a new single point of failure—if the NVRAM itself fails, it will lead to misjudgment, invalid switching, or even complete system paralysis; 2. Insufficient versatility: Its architecture relies on the processor to support both Local Bus Controller (LBC) and SPI interface (such as the domestic FT-2000A / 2 chip), making it difficult to adapt to mainstream embedded processor platforms that only have a standard SPI interface (such as ARM Cortex-A / R / M series, RISC-V SoC, etc.), thus limiting the promotion of the technology; 3. Low detection accuracy: It only uses static data comparison to determine the integrity of the boot program, and cannot dynamically perceive the processor's operating status during the actual boot process. It is difficult to distinguish between "permanent data corruption" and "temporary boot failure caused by transient environmental interference", resulting in a false alarm rate of more than 10%, frequently triggering unnecessary switching operations, and reducing system availability.
[0004] Therefore, there is an urgent need for a boot fault-tolerant mechanism that does not rely on external auxiliary memory, is compatible with general-purpose SPI interface processors, and can accurately detect faults by combining dynamic behavior during the boot process, so as to achieve a lightweight, highly versatile and low false alarm rate boot solution for airborne embedded systems while ensuring high reliability. Summary of the Invention
[0005] To address the technical problem of processor boot failure due to Flash memory data corruption in harsh environments such as high vibration, extreme temperatures, and strong electromagnetic interference, this invention discloses a processor boot method based on a dual-redundant Flash memory architecture. This method achieves fault-tolerant boot capability with high versatility and low false alarm rate, requiring no external auxiliary storage, through pure Flash hardware redundancy design, a multi-modal state awareness mechanism during the boot process, and a dynamic switching strategy for the chip select signal.
[0006] Specifically, the method includes the following steps: S100, configuring two main Flash and a backup Flash for the processor, both storing the same boot program, with the main Flash boot program loaded by default when the processor starts; S200, during the processor startup process, the FPGA senses the processor startup status in real time and determines whether the boot program of the main Flash is abnormal based on the startup status; S300, if an abnormality is determined, the FPGA dynamically switches the processor's SPI chip select signal to the backup Flash, triggering a processor reset and restarting from the backup Flash; S400, after the processor successfully starts from the backup Flash, it automatically repairs and verifies the boot program of the main Flash, and after the verification is passed, restores the main Flash as the default boot medium.
[0007] Further, in step S100, the FPGA senses the processor's startup status in real time, and determines whether the boot program of the main Flash is abnormal based on the startup status, including: S101, after the processor completes each preset startup stage, it sends the corresponding completion flag bit to the FPGA via GPIO; S102, the FPGA configures an independent timeout timer for each critical startup stage and monitors whether the corresponding flag bit is set within the preset time limit; S103, if any critical startup stage times out without receiving the flag bit, or if the accumulated errors of non-critical startup stages reach the threshold, the boot program is determined to be abnormal.
[0008] Furthermore, the preset startup phase includes: reset vector initialization, phase-locked loop configuration, memory controller initialization, multi-core startup, peripheral initialization, and application loading; wherein, the phase-locked loop configuration and the memory controller initialization are defined as critical startup phases.
[0009] Furthermore, the logic for determining bootloader anomalies includes: triggering an anomaly check if any critical startup stage times out; triggering an anomaly check if a non-critical startup stage times out two or more times in the same startup attempt.
[0010] Further, in step S300, the FPGA dynamically switches the processor's SPI chip select signal, including: after the FPGA determines that the boot program of the main Flash is abnormal, it redirects the chip select signal CS0, which was originally mapped to the main Flash, to the backup Flash; the FPGA sends a forced reset signal to the processor through the hardware reset line, so that it reloads the boot program from the backup Flash.
[0011] Further, in step S400, the boot program of the main Flash is automatically repaired and verified, including the following steps: S401, the processor reads the boot program data from the spare Flash and writes it to the main Flash through the SPI interface; S402, each page of boot program data written to the main Flash is checked by CRC-32, and the verification result is fed back to the FPGA by the processor; S403, only when all the boot program data written to the main Flash has been verified, the FPGA restores the chip select signal to the default mapping to the main Flash.
[0012] Furthermore, if a page of boot program data fails three consecutive CRC-32 checks, the processor terminates the main Flash repair process and reports a permanent damage signal to the FPGA. In addition, the FPGA will not switch back to the main Flash as the boot medium.
[0013] Compared with existing technologies, this solution eliminates the need for NVRAM, is compatible with all SPI interface processors, has a false alarm rate of less than 0.1%, and a system recovery time of ≤2 seconds, significantly improving the startup reliability of airborne systems in harsh environments. The beneficial effects achievable by the method of this invention include at least the following: 1. Eliminating the dependence on NVRAM modules and achieving dynamic switching between primary and backup Flash through logic design, reducing costs and hardware failure risks; 2. Significantly improving fault detection accuracy through multimodal perception based on startup status, combined with timing monitoring and flag feedback; 3. A closed-loop repair mechanism that automatically repairs primary Flash data after switching to backup Flash, ensuring the system quickly recovers to a healthy state, with a mean time to recovery (MTTR) of ≤2 seconds, greatly improving availability; 4. Full-process status awareness: For the first time, the status flags of the processor startup phase are combined with timeout monitoring to achieve full lifecycle monitoring of the startup process, reducing the false alarm rate to below 0.1%.
[0014] 5. No hardware redundancy dependency: Only two standard SPI Flash chips are required, which are compatible with all processors that support the SPI interface, improving versatility by 300%. Attached Figure Description
[0015] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0016] Figure 1 is a flowchart of the processor boot method based on the dual-redundant Flash storage architecture of the present invention; Figure 2 is a schematic diagram of the dual-redundant Flash storage architecture; Figure 3 is the processor boot execution flow. Detailed Implementation
[0017] The embodiments of this application will now be described in detail with reference to the accompanying drawings.
[0018] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. This application can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. It should be noted that, in the absence of conflict, the following embodiments and features of the embodiments can be combined with each other. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0019] This invention discloses a processor boot method based on a dual-redundant Flash memory architecture. The method achieves fault-tolerant boot capability with high versatility and low false alarm rate by employing a pure Flash hardware redundancy design, a multi-modal state awareness mechanism during the boot process, and a dynamic switching strategy for the chip select signal.
[0020] Specifically, as shown in Figures 1 to 3, the method includes the following steps: S100, as shown in Figure 2, the processor is configured with two main Flash and a backup Flash, which serve as backups for each other. Both flashes store the same boot program, and the main Flash boot program is loaded by default when the processor starts; S200, during the processor startup process, the FPGA senses the processor's startup status in real time and determines whether the boot program of the main Flash is abnormal based on the startup status; S300, if an abnormality is determined, the FPGA dynamically switches the processor's SPI chip select signal to the backup Flash, triggering a processor reset and restarting from the backup Flash; S400, after the processor successfully starts from the backup Flash, the boot program of the main Flash is automatically repaired and verified. After the verification is passed, the main Flash is restored as the default boot medium.
[0021] In implementation, as shown in Figure 2, the primary Flash and the backup Flash use identical NOR Flash chips, and the boot programs stored inside them are completely identical. The processor can generate two chip select signals, which are mapped to the primary and backup Flash respectively via the SWITCH mapping module within the FPGA. By default, CS0 is mapped to the primary Flash, and CS1 is mapped to the backup Flash.
[0022] In one embodiment of step S100, the FPGA senses the startup status of the processor in real time and determines whether the boot program of the main Flash is abnormal based on the startup status, including: S101, after the processor completes each preset startup stage, it sends the corresponding completion flag bit to the FPGA through GPIO.
[0023] In implementation, the processor startup process can be divided into 6 preset startup stages, which include: reset vector initialization, phase-locked loop configuration, memory controller initialization, multi-core startup, peripheral initialization, and application loading; among them, the phase-locked loop configuration and the memory controller initialization are defined as critical startup stages.
[0024] S102: The FPGA configures an independent timeout timer for each critical startup phase and monitors whether the corresponding flag bit is within the preset time limit.
[0025] S103. If any critical startup stage times out without receiving the flag bit, or if the accumulated errors in non-critical startup stages reach the threshold, the bootloader is judged to be abnormal.
[0026] During implementation, an independent timeout threshold can be set for each preset startup stage, ranging from 10ms to 200ms. After each preset startup stage is completed, the processor immediately sets the corresponding GPIO pin, and the FPGA resets the timer for that stage upon receiving the signal. If the timer for a preset startup stage times out and the flag is not set, the FPGA records an error counter.
[0027] Furthermore, the logic for determining bootloader anomalies includes: triggering an anomaly check if any critical startup stage times out; triggering an anomaly check if a non-critical startup stage times out two or more times in the same startup attempt.
[0028] In one embodiment of step S300, the FPGA dynamically switches the processor's SPI chip select signal, including: after the FPGA determines that the boot program of the main Flash is abnormal, it redirects the chip select signal CS0, which was originally mapped to the main Flash, to the backup Flash; the FPGA sends a forced reset signal to the processor through a hardware reset line, so that the processor reloads the boot program from the backup Flash.
[0029] During implementation, a SWITCH chip select mapping module, a multimodal intelligent sensing module, and a SWITCH chip select dynamic switching module can be deployed within the FPGA.
[0030] Specifically, the SWITCH chip select mapping module executes step S1, and the multimodal intelligent sensing module executes step S2 to perform status monitoring and phased timeout monitoring. Specifically: 1) Phase completion flag: After the processor completes the key stages of the startup process, such as reset vector initialization, phase-locked loop configuration, and memory controller initialization, it sends a flag signal to the multimodal intelligent sensing module in the FPGA through the GPIO pin (e.g., GPIO1 indicates "phase-locked loop initialization completed").
[0031] 2) Phased Timeout Monitoring: The FPGA independently configures timers for each critical phase (e.g., a 50ms timeout for the memory controller initialization phase). If a flag is not detected within the threshold time for the first time, the current phase is considered abnormal, indicating a startup failure, and a fault signal is output. The SWITCH chip select dynamic switching module is used to switch between the main Flash and the backup Flash. For example, after receiving a fault signal from the multi-mode module, the SWITCH chip select dynamic switching module switches the processor's SPI chip select signal from CS 0 to CS 1. After the switch is completed, the FPGA forces the processor to restart via the reset signal line (RST), ensuring that the boot program is reloaded from the backup Flash, and the same judgments as the main Flash are performed to complete a successful startup.
[0032] In one embodiment of step S400, automatically repairing and verifying the boot program in the main Flash includes the following steps: S401, the processor reads boot program data from the spare Flash and writes it to the main Flash via the SPI interface; S402, each page of boot program data written to the main Flash is checked using CRC-32, and the verification result is fed back to the FPGA by the processor; S403, only when all the boot program data written to the main Flash has passed the verification, the FPGA restores the chip select signal to the default mapping to the main Flash.
[0033] Furthermore, if a page of boot program data fails three consecutive CRC-32 checks, the processor terminates the main Flash repair process and reports a permanent damage signal to the FPGA. In addition, the FPGA will not switch back to the main Flash as the boot medium.
[0034] In practice, the processor and FPGA are interconnected via GPIO, and all startup status flags are actively sent by the processor, without relying on a specific bus protocol or hardware interface.
[0035] In addition, data is transferred in batches through the DMA controller to accelerate the repair process of the main Flash, so that the total time for writing and verifying a single page of 256KB data does not exceed 10ms.
[0036] Verification has shown that the entire process, from the FPGA determining the bootloader to the system completing the main Flash repair and restoring it as the default boot medium, using the method of this invention takes no more than 2 seconds, and the false switching rate caused by environmental interference is less than 0.1%.
[0037] The embodiments of the present invention achieve the following technical effects: 1. DMA accelerated verification: By using the DMA controller to read Flash data in batches and calculate CRC, the single-page verification time is compressed to 5ms.
[0038] 2. Anti-interference design: During the repair phase, if three consecutive pages of the main Flash fail to verify, the repair will stop and the fault will be reported to avoid infinite loop.
[0039] 3. Improved Reliability: The dual-Flash redundancy design, combined with a multi-stage sensing mechanism, increases the measured boot success rate from 95% of the traditional solution to 99.998%; 4. False Alarm Suppression: Multi-dimensional judgment reduces the false handover rate to below 0.05%; 5. Repair Efficiency: The complete repair of a 1MB bootloader takes less than 2 seconds, meeting airborne real-time requirements.
[0040] In this embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements any of the processor boot methods based on the dual-redundant Flash memory architecture described above.
[0041] Specifically, the computer device can be a computer terminal, a server, or a similar computing device.
[0042] In this embodiment, a computer-readable storage medium is provided, which stores a computer program that executes any of the processor boot methods based on the dual-redundant Flash memory architecture described above.
[0043] Specifically, computer-readable storage media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer-readable storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable storage media does not include transient media, such as modulated data signals and carrier waves.
[0044] Obviously, those skilled in the art should understand that the modules or steps of the above-described embodiments of the present invention can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, the embodiments of the present invention are not limited to any particular hardware and software combination.
[0045] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, various modifications and variations can be made to the embodiments of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.
Claims
1. A processor boot method based on a dual-redundancy Flash memory architecture, characterized in that, include: The processor is configured with two main Flash and a backup Flash, which serve as backups for each other. Both flashes store the same boot program, and the boot program from the main Flash is loaded when the processor is in default mode. During the processor startup process, the FPGA senses the processor's startup status in real time and determines whether the boot program in the main Flash is abnormal based on the startup status. If an anomaly is detected, the FPGA dynamically switches the processor's SPI chip select signal to the backup Flash, triggering a processor reset and restarting from the backup Flash. After the processor successfully boots from the backup Flash, it automatically repairs and verifies the boot program in the main Flash. Once the verification is successful, the main Flash is restored as the default boot medium.
2. The processor boot method based on a dual-redundancy Flash memory architecture according to claim 1, characterized in that, The FPGA senses the processor's startup status in real time and determines whether the boot program in the main Flash is abnormal based on the startup status. This includes: after the processor completes each preset startup stage, it sends the corresponding completion flag bit to the FPGA via GPIO; the FPGA configures an independent timeout timer for each critical startup stage and monitors whether the corresponding flag bit is set within the preset time limit; if any critical startup stage times out without receiving the flag bit, or if the accumulated errors in non-critical startup stages reach the threshold, the boot program is determined to be abnormal.
3. The processor boot method based on a dual-redundancy Flash memory architecture according to claim 2, characterized in that, The preset startup phase includes: reset vector initialization, phase-locked loop configuration, memory controller initialization, multi-core startup, peripheral initialization, and application loading; wherein, the phase-locked loop configuration and the memory controller initialization are defined as critical startup phases.
4. The processor boot method based on a dual-redundancy Flash memory architecture according to claim 2, characterized in that, The logic for determining bootloader anomalies includes: triggering an anomaly check if any critical boot stage times out; triggering an anomaly check if a non-critical boot stage times out two or more times in the same boot attempt.
5. The processor boot method based on a dual-redundancy Flash memory architecture according to claim 1, characterized in that, The FPGA dynamically switches the processor's SPI chip select signal, including: after the FPGA determines that the boot program of the main Flash is abnormal, it redirects the chip select signal CS0, which was originally mapped to the main Flash, to the spare Flash; the FPGA sends a forced reset signal to the processor through the hardware reset line, so that it reloads the boot program from the spare Flash.
6. The processor boot method based on a dual-redundancy Flash memory architecture according to claim 1, characterized in that, The automatic repair and verification of the boot program in the main Flash includes the following steps: the processor reads the boot program data from the spare Flash and writes it to the main Flash via the SPI interface; each page of boot program data written to the main Flash is checked using CRC-32, and the verification result is fed back to the FPGA by the processor; only when all the boot program data written to the main Flash has passed the verification will the FPGA restore the chip select signal to the default mapping to the main Flash.
7. The processor boot method based on a dual-redundancy Flash memory architecture according to claim 6, characterized in that, If a page of boot program data fails three consecutive CRC-32 checks, the processor terminates the main Flash repair process and reports a permanent damage signal to the FPGA. Furthermore, the FPGA will not switch back to the main Flash as the boot medium.