Spaceborne processor anti-single-particle reinforcement method based on SRIO

Abstract

The invention relates to an SRIO-based satellite-borne processor anti-single-particle reinforcement method, and belongs to the technical field of spaceflight embedded software. Between a processor supporting SRIO and an FPGA, the FPGA reads PCPU from a processor program storage area according to an agreed packet size through an SRIO interface, reads backup packets P1, P2 and P3 at corresponding positions from a backup area and carries out bitwise two-out-of-three calculation; then the PS is compared with the PCPU, the P1, the P2 and the P3, and when an error is found, the PS is used for error correction and overwriting. The program storage area of each processor core is inspected packet by packet in sequence, so that the refreshing and error correction of the running program in the multi-core processor are realized, and the correctness of the backup area is maintained. When a PCPU error is found, a preferential comprehensive check of the error core may be triggered.

Description

Technical Field

[0001] This invention belongs to the field of aerospace embedded software technology, specifically relating to a single-event hardening method for spaceborne processors based on SRIO. Background Technology

[0002] In the aerospace field, the heterogeneous multi-core architecture of processor + FPGA in spaceborne equipment has been widely used. However, during the operation of spacecraft in orbit, the high-energy particle radiation present in the space environment may cause certain bits of the embedded software running on the processor to flip, thereby causing abnormal operation of the embedded software and interruption of equipment functions.

[0003] Common SEU (Single Event Upset) mitigation measures include redundant design, hardware hardening, and software hardening to improve operational reliability and fault tolerance. Due to the short development cycles or high-performance, low-cost requirements of spaceborne equipment, the use of non-aerospace-grade processors in spaceborne equipment development often results in SEUs occurring in processor memory units or logic circuits because the processors themselves lack sufficient radiation resistance and are vulnerable to high-energy particles in space. This severely impacts the reliable operation of the equipment. Typically, non-aerospace-grade processors lack corresponding hardware EDAC (Error Detection and Correction), or their hardware EDAC error correction capabilities are insufficient (usually only supporting correction of one bit and detection of two), failing to correct or even detect multi-bit flips occurring within a single error correction / detection region.

[0004] Domestically and internationally, technologies for achieving single-event immunity for processors through software hardening typically include N Versioning methods, recovery block methods, software-simulated EDAC methods, and fault-tolerant algorithms such as EDDI and ED4I all require processor computing resources, which not only increases the complexity of software development but also increases the processor's time and space overhead.

[0005] SRIO (Serial RapidIO) is a highly reliable, high-performance, packet-switched high-speed interconnect technology for embedded systems. It enables the establishment of a low-latency, high-speed transmission channel between SRIO-enabled processors and FPGAs. FPGAs can initiate direct memory access to the processor via SRIO, achieving seamless read / write operations on the processor's memory.

[0006] The patent "A Real-time Error Detection and Recovery Method and System for Online Parallel Processing of Soft Errors" (Publication No. CN112053737A) connects an FPGA to a processor via a high-speed interface. It uses multiple checksums to perform parallel comparison and error detection on the processor's protected RAM space and backups, achieving error location and recovery processing. This method primarily confirms correct data blocks and detects abnormal data blocks through checksum consistency comparison, using correct data to overwrite erroneous data. The error judgment and processing logic is relatively complex. It has certain shortcomings in error correction; for example, if different bits of the same data block in each backup contain errors, the correct data block cannot be found, making it impossible to recover the abnormal data and leading to error correction failure. Furthermore, it does not consider the single-event risk faced by FPGA operation in complex environments and lacks anti-single-event measures. Summary of the Invention

[0007] The purpose of this invention is to provide a single-event hardening method for spaceborne processors based on SRIO. The FPGA directly inspects the processor's running program through the SRIO interface, detects and corrects program errors caused by single-event upsets in a timely manner, thereby reducing the risk of error accumulation. The reliability of the processor software during operation can be significantly improved with relatively small resource costs.

[0008] The above-mentioned objectives of the present invention are mainly achieved through the following technical solutions: A single-event hardening method for a spaceborne processor based on SRIO includes the following steps: (1) The processor is set to the inspection function module mode, and the inspection cycle and the number of inspection packages per cycle of the inspection function module are configured. (2) Initialize the inspection function module using the inspection parameters stored in the FPGA; (3) The inspection function module establishes the storage mapping relationship between the core program running address of each processor and the program image in the non-volatile memory and external RAM according to the inspection parameters, and copies the three program images to the external RAM to obtain three sets of backups of the processor program. The external RAM can enable the ECC error correction function through the storage controller to further protect the backups. (4) The inspection function module starts running based on the configuration parameters obtained in step (1) and performs inspection on core 0. When the trigger signal is triggered, the backup program package and the processor program package are compared and corrected. (5) Repeat step (4) until the inspection of the remaining inspection packages of core 0 in this cycle is completed; (6) Repeat steps (4) to (5) to complete the inspection of other processor core program storage areas in turn.

[0009] The embedded software running by the processor is stored in a non-volatile memory attached to the FPGA, and the FPGA can control the processor's reset and startup.

[0010] The inspection parameters are stored in the non-volatile memory. The inspection parameters include the starting address of the processor core program, the starting address of the program image storage, and the inspection length (number of packets).

[0011] In step (1), the inspection function module modes include reporting errors without correction, manual correction, and automatic correction.

[0012] In step (2), the inspection function module reads three inspection parameters, performs a two-out-of-three calculation, and checks the format of the calculation result. If the calculation result parameter is correct, the inspection function module is initialized using the calculation result parameter. If the calculation result parameter is incorrect, the initialization state of the inspection function module is set to abnormal.

[0013] In step (3), the external RAM is a DDR memory.

[0014] In step (4), the inspection method is as follows: when the trigger signal is triggered, the inspection function module reads the backup package P with core 0 package number 0 from the backup obtained in step (3). 1_CORE0_0 P 2_CORE0_0 P 3_CORE0_0 P is obtained by rounding down from three to two. S_CORE0_0 The first program package P is read from the starting address of the kernel 0 program execution via SRIO. CPU_CORE0_0 Then, data comparison is performed. If the program package P... CPU_CORE0_0 With P S_CORE0_0 If they match, then the package is correct; if package P... CPU_CORE0_0 With P S_CORE0_0 Inconsistency is an error; P will be removed. S_CORE0_0 Error correction is completed by writing back the data to the corresponding location on the processor via SRIO; similarly, if the backup package P... 1_CORE0_0 P 2_CORE0_0 and P 3_CORE0_0 All with P S_CORE0_0 If they match, then the package is correct; if the backup package P... 1_CORE0_0 P 2_CORE0_0 or P 3_CORE0_0 With P S_CORE0_0 If they are inconsistent, it is an error; P will be removed. S_CORE0_0 Write back to the corresponding location in the backup package to complete the error correction.

[0015] The inspection processes for different core components are completed independently in turn.

[0016] If an error is detected in a package of a core x, a comprehensive check of core x will be performed first, according to the inspection strategy configured in the inspection function module.

[0017] An SRIO-based onboard processor is hardened according to the hardening method described above.

[0018] Compared with the prior art, the present invention has at least the following beneficial effects: This invention can harden multiple cores of non-aerospace-grade processors against single-event stress tests. The inspection process does not require the processor software to participate and does not affect the normal operation of the processor's own software. The logic is simple, easy to implement, has low hardware requirements, strong versatility, and can achieve a significant reliability improvement with less system resources. Attached Figure Description

[0019] Figure 1 This is a block diagram illustrating the principle of the SRIO-based spaceborne processor anti-single-event hardening method of the present invention. Figure 2 This is a flowchart of the single-event hardening method for spaceborne processors based on SRIO according to the present invention. Detailed Implementation

[0020] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments: The core technology of this invention is that, between a processor supporting SRIO and an FPGA, the FPGA reads the processor's program storage area according to a pre-agreed packet size via the SRIO interface. CPU Simultaneously, backup packages P1, P2, and P3 at the corresponding locations are read from the backup area and a bitwise rounding (two out of three) is performed to obtain the calculation result P. S Then P S With P CPU And compare P1, P2, and P3; when an error is found, use P... S Error correction and overwriting are performed. By sequentially inspecting the program storage area of ​​each processor core, errors are refreshed and corrected for programs running within the multi-core processor, and the correctness of the backup area is maintained. Specifically, when P is detected... CPU When an error occurs, a priority comprehensive check of the core of the error can be triggered.

[0021] like Figure 1 and Figure 2 As shown, the specific steps of the present invention are as follows: 1) The hardware components include an SRIO-enabled processor and an FPGA, which are connected via SRIO bus, EMIF bus, and GPIO. The embedded software running on the processor is stored in a non-volatile memory external to the FPGA. The FPGA can control the processor's reset and startup. The non-volatile memory also stores inspection parameters in a three-dimensional manner, such as the starting address of each core program of the processor, the starting address of the program image storage, and the inspection length (number of packets), which are used for the initialization of the FPGA inspection function module. This module implements the inspection and error correction function of the processor program area, which mainly includes sub-functions such as configuration management, trigger control, SRIO read / write, backup initialization, bitwise 3-to-2 calculation, data comparison, and backup error correction write-back.

[0022] 2) After the processor starts running from reset, it initializes peripherals and configures the FPGA inspection module during the initialization phase. The inspection module is disabled by default. The processor first initializes the inspection parameters. After initialization, the module can be set to modes such as error reporting only, manual correction, or automatic correction. The inspection cycle and the number of packets inspected per cycle can also be configured. The inspection module reads three sets of inspection parameters from non-volatile memory, performs a two-out-of-three calculation, and checks the format of the result. If the parameters are correct, they are used for module initialization; otherwise, the module initialization status is set to abnormal for the processor software to query. Based on the correct inspection parameters, the module establishes a storage mapping relationship between the core program execution addresses of each processor and the program images in non-volatile memory and external RAM. It then copies the three program images to external RAM, such as DDR memory. After the migration is complete, the module obtains three backups of the processor program. The external RAM can be further protected by enabling ECC error correction through the storage controller.

[0023] 3) The FPGA inspection function module starts running based on the configuration parameters. When the trigger signal is triggered for the first time, the inspection module reads the backup packet P with core 0 packet number 0 from the 3 backup areas. 1_CORE0_0 P 2_CORE0_0 P 3_CORE0_0 After rounding down to two out of three, we get P. S_CORE0_0 Simultaneously, it reads the first program package P from the kernel 0 program execution start address via SRIO. CPU_CORE0_0 Then, data comparison is performed, when program package P... CPU_CORE0_0 With P S_CORE0_0 If the values ​​match, the packet is correct; otherwise, it is incorrect. (P) S_CORE0_0 Error correction is completed by writing back to the corresponding location on the processor via SRIO; similarly, when the backup package P... 1_CORE0_0 P 2_CORE0_0 P 3_CORE0_0 With P S_CORE0_0If the values ​​match, the packet is correct; otherwise, it is incorrect. (P) S_CORE0_0 Write back to the corresponding location in the backup package to complete the error correction.

[0024] 4) Following the operation process in 3), complete the inspection of the remaining inspection packages for the core 0 cycle.

[0025] 5) After all core 0 inspections have been completed in this cycle, inspect the program storage areas of other processor cores in sequence according to the processor core inspection settings in steps 3)-4).

[0026] 6) Once all core inspections for this cycle have been completed, wait for the next trigger signal and proceed with the next cycle inspection according to steps 3)-5).

[0027] 7) The number of inspection packages for each core can be different. The inspection process is completed independently in turn. When the inspection of all program storage areas of a certain core is completed, the inspection module will restart the inspection of that core, and so on, to perform the inspection in a loop.

[0028] 8) In particular, when a core x has a y package P CPU_COREx_y When an error is detected, the core x can be fully checked first, according to the inspection strategy configured in the inspection function module, so as to eliminate potential single-event upset hazards in a timely manner.

[0029] Example 1 1) A certain 4-core processor has a core 0 program image size of 256KB and cores 1-3 program images of 128KB each. Core 0 powers on and boots, loads cores 1-3, and completes initialization. Then, the FPGA inspection module is configured accordingly, and its initialization is triggered. The settings are as follows: The inspection packet size is 256 bytes, the inspection cycle is 1ms, and the number of inspection packets per core per cycle is 4. The total number of packets for core 0 is 1024, and the total number of packets for cores 1 to 3 is 512 each.

[0030] 2) The inspection module reads the inspection parameters stored in the non-volatile memory (such as Nor Flash), and moves the program image of each core to the RAM (DDR3 SDRAM in this embodiment) on the FPGA according to the inspection parameters, thus completing the establishment of the program backup 1 / 2 / 3 of each core. The inspection module initialization is completed.

[0031] 3) After the inspection module is initialized, processor core 0 sets the inspection module's working mode to automatic correction, and the inspection module begins its inspection work.

[0032] 4) After the inspection module detects the trigger signal, it reads the backup package P with package number 0 from the core 0 program backup area in DDR3. 1_CORE0_0 P 2_CORE0_0 P 3_CORE0_0After rounding down to two out of three, we get P. S_CORE0_0 Simultaneously, it reads the corresponding program package P from the kernel 0 program execution start address via SRIO. CPU_CORE0_0 Then, data comparison is performed, when program package P... CPU_CORE0_0 With P S_CORE0_0 If the values ​​match, the packet is correct; otherwise, it is incorrect, and P will be removed. S_CORE0_0 Error correction is completed by writing back to the corresponding location on the processor via SRIO; similarly, when the backup package P... 1_CORE0_0 P 2_CORE0_0 P 3_CORE0_0 With P S_CORE0_0 If the values ​​match, the packet is correct; otherwise, it is incorrect. (P) S_CORE0_0 Write back to the corresponding location in the backup package to complete the error correction.

[0033] 5) The inspection module completes the inspection of core 0 packages 1 to 3 in sequence according to the process described in 4), then performs the inspection of core 1 packages 0 to 3, and completes the inspection of core 2 and core 3 packages 0 to 3 in the same way, thus completing the inspection operation of this cycle.

[0034] 6) When the next trigger signal arrives, the inspection module starts a new round of inspection operations, that is, it sequentially completes the inspection of core 0~3 package numbers 4~7, and so on, and performs inspections periodically.

[0035] 7) When the inspection reaches round 128, each core has completed the inspection of 512 packages. At this time, core 0 will continue to inspect packages 512 to 515, and the inspection of cores 1 to 3 will start from the beginning, that is, restart the inspection of packages 0 to 3.

[0036] 8) Assuming that core 1 detects an error when inspecting packet 120, the inspection module will block the periodic generation of the trigger signal and switch to prioritizing the inspection of the entire program storage area of ​​core 1. That is, it will complete the inspection of packets 121 to 511 in sequence, then complete the inspection of packets 0 to 120, and then continue to inspect other cores. After completion, the trigger signal blocking will be canceled, and the inspection process will return to periodic inspection.

[0037] The above description is only the best specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the protection scope of the present invention.

[0038] The contents not described in detail in this specification are common knowledge to those skilled in the art.

Claims

1. A single-event hardening method for a spaceborne processor based on SRIO, characterized in that: Includes the following steps: (1) The processor is set to the inspection function module mode, and the inspection cycle and the number of inspection packages per cycle of the inspection function module are configured. (2) Initialize the inspection function module using the inspection parameters stored in the FPGA; (3) The inspection function module establishes the storage mapping relationship between the core program running address of each processor and the program image in the non-volatile memory and external RAM according to the inspection parameters, and copies the 3 program images to the external RAM to obtain 3 sets of backups of the processor program. (4) The inspection function module starts running based on the configuration parameters obtained in step (1) and performs inspection on core 0. When the trigger signal is triggered, the backup program package and the processor program package are compared and corrected. (5) Repeat step (4) until the inspection of the remaining inspection packages of core 0 in this cycle is completed; (6) Repeat steps (4) to (5) to complete the inspection of other processor core program storage areas in turn.

2. The single-event hardening method for a spaceborne processor based on SRIO according to claim 1, characterized in that: The embedded software running by the processor is stored in a non-volatile memory attached to the FPGA, and the FPGA can control the processor's reset and startup.

3. The single-event hardening method for a spaceborne processor based on SRIO according to claim 2, characterized in that: The inspection parameters are stored in the non-volatile memory. The inspection parameters include the starting address of the processor core program, the starting address of the program image storage, and the inspection length.

4. The single-event hardening method for a spaceborne processor based on SRIO according to claim 1, characterized in that: In step (1), the inspection function module modes include reporting errors without correction, manual correction, and automatic correction.

5. A single-event hardening method for a spaceborne processor based on SRIO according to claim 1, characterized in that: In step (2), the inspection function module reads three inspection parameters, performs a two-out-of-three calculation, and checks the format of the calculation result. If the calculation result parameter is correct, the inspection function module is initialized using the calculation result parameter. If the calculation result parameter is incorrect, the initialization state of the inspection function module is set to abnormal.

6. The single-event hardening method for a spaceborne processor based on SRIO according to claim 1, characterized in that: In step (3), the external RAM is a DDR memory.

7. A single-event hardening method for a spaceborne processor based on SRIO according to claim 1, characterized in that: In step (4), the inspection method is as follows: when the trigger signal is triggered, the inspection function module reads the backup package P with core 0 package number 0 from the backup obtained in step (3). 1_CORE0_0 P 2_CORE0_0 P 3_CORE0_0 P is obtained by rounding down from three to two. S_CORE0_0 The first program package P is read from the starting address of the kernel 0 program execution via SRIO. CPU_CORE0_0 Then, data comparison is performed. If the program package P... CPU_CORE0_0 With P S_CORE0_0 If they match, then the package is correct; if package P... CPU_CORE0_0 With P S_CORE0_0 Inconsistency is an error; P will be removed. S_CORE0_0 Error correction is completed by writing back the data to the corresponding location on the processor via SRIO; similarly, if the backup package P... 1_CORE0_0 P 2_CORE0_0 and P 3_CORE0_0 All with P S_CORE0_0 If they match, then the package is correct; if the backup package P... 1_CORE0_0 P 2_CORE0_0 or P 3_CORE0_0 With P S_CORE0_0 If they are inconsistent, it is an error; P will be removed. S_CORE0_0 Write back to the corresponding location in the backup package to complete the error correction.

8. A method for single-event hardening of a spaceborne processor based on SRIO according to claim 1, characterized in that: The inspection processes for different core components are completed independently in turn.

9. A single-event hardening method for a spaceborne processor based on SRIO according to claim 1, characterized in that: If an error is detected in a package of a core x, a comprehensive check of core x will be performed first, according to the inspection strategy configured in the inspection function module.

10. A spaceborne processor based on SRIO, characterized in that: The reinforcement is carried out according to any one of claims 1 to 9.

Images