Satellite payload anti-single event upset fpga configuration data error correction method and system
By combining RS encoding with cross-sector interleaved storage and a triple-modal redundancy error correction method, the problems of single-event upset and multi-copy common-mode failure of SRAM-type FPGA configuration data in aerospace systems are solved. This achieves efficient configuration data correction and avoidance of error locking, thereby improving the safety and continuity of satellite missions.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHANDONG UNIV
- Filing Date
- 2026-04-07
- Publication Date
- 2026-06-09
AI Technical Summary
In existing aerospace electronic systems, the configuration data of SRAM-type FPGAs is susceptible to single-event upsets. Traditional TMR architectures cannot effectively correct this when faced with multiple copy in-place flips, leading to incorrect configuration data locking and affecting the continuity and safety of satellite missions.
An error correction method combining RS encoding and cross-sector interleaved storage with triple mode redundancy is adopted. The RS encoded data is distributed and stored through address remapping. Combined with RS decoding and triple mode redundancy algorithm, the error correction of single-event flip and multi-replica common mode failure is achieved.
It effectively corrects single-event independent flip and multi-copy common-mode failure, avoids erroneous locking, ensures the correctness and reliability of configuration data under extreme radiation environments, and improves the on-orbit operation capability of the satellite payload system.
Smart Images
Figure CN121979720B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of aerospace electronic integrated circuit technology, specifically relating to a method and system for error correction of satellite payload FPGA configuration data against single-event upsets. Background Technology
[0002] In aerospace electronic systems, SRAM-based FPGAs, with their reconfigurable characteristics, are widely used in satellite control and various payload systems, serving as key programmable logic devices for performing core functions. Because the configuration data of SRAM-based FPGAs is stored in volatile memory cells, its configuration bitstream is lost upon power failure, requiring external non-volatile memory for reloading upon system power-up. Therefore, the secure storage and reliable loading of configuration data in non-volatile memory chips are crucial prerequisites for the stable operation of the entire satellite system.
[0003] In traditional engineering outside the aerospace field, systems typically use SPI Flash memory chips directly connected to FPGAs, with the FPGA actively reading configuration data and loading it after power-on. However, this architecture has significant limitations in high-reliability aerospace applications:
[0004] On the one hand, high-energy particles in the space environment may induce a single event upset (SEU), causing random bit flips in the configuration bit stream stored in Flash. The traditional SPI direct connection architecture lacks an effective data detection and error correction mechanism. Once the configuration data inside the memory chip is flipped or damaged, the system is almost unable to identify and recover the erroneous data, thus causing loading verification failure or functional abnormality.
[0005] On the other hand, single-event upsets can even directly affect the configuration network or logic unit of an operating FPGA, causing the digital integrated circuit to malfunction or fail. In an architecture without an independent configuration management chip, such operational anomalies usually require a complete power-off and restart of the board to reload, making it impossible to achieve independent online reconfiguration and fault self-healing of the satellite payload FPGA in orbit, which seriously affects the continuity and safety of space missions.
[0006] Existing aerospace systems typically employ an independent configuration management chip, connected to three external NOR Flash memory chips as the storage area for configuration data (i.e., the bitstream running on the FPGA). Each Flash chip is logically divided into two independent halves, forming six independent configuration mirror areas that store six identical copies of the configuration data. During configuration loading, triple Modular Redundancy (TMR) is used to select two out of three for error correction on a single copy, and erroneous copies can be written back to repair them.
[0007] However, in complex space radiation environments, factors such as high-energy particle beams, secondary particle shower effects, and the physical adjacency of integrated circuit device layouts can all lead to temporal and spatial correlation errors in multiple memory chips, a phenomenon known as "common-mode failure." In this case, the same logic bit may flip simultaneously in two or even more redundant copies.
[0008] When a co-mode flip occurs between two replicas, the TMR majority vote will output an erroneous result. Since the TMR is essentially a memoryless combined decision mechanism, after an erroneous value is output, during subsequent three-mode write-back repair, this erroneous result will be written back to the originally correct replica, causing the three data sets to converge but all contain the erroneous value, creating an "error lock" phenomenon. Once such a co-mode flip occurs and the write-back propagation is complete, the system will lose its ability to recover correct data through redundant structures, resulting in permanent configuration corruption. For satellite payload systems lacking on-orbit reconfiguration capabilities, this type of corruption often directly leads to mission failure.
[0009] Therefore, while the traditional TMR architecture can effectively suppress single-copy, independently distributed SEUs, its decision-making mechanism has structural flaws when facing multi-copy parity flips. This flaw stems from the majority voting mechanism's lack of ability to measure the reliability of the decision result, as well as the lack of redundancy verification methods across symbols or data blocks. It relies solely on the number of physical copies to improve reliability without introducing higher-level coding redundancy. Summary of the Invention
[0010] To address the shortcomings of existing technologies, this invention provides a method and system for correcting FPGA configuration data for satellite payloads against single-event upsets.
[0011] The technical solution of the present invention is as follows:
[0012] This invention provides a method for correcting FPGA configuration data for satellite payloads against single-event upsets, comprising:
[0013] S1: For the original configuration bitstream data of the satellite payload FPGA, group the data into information segments with preset bytes, perform encoding operations on each information segment, generate the first byte check symbol, and construct the second byte of RS encoded configuration data;
[0014] S2: By address remapping, a mapping relationship between logical addresses and physical addresses is constructed, and continuous RS-encoded configuration data is distributed and written to different physical sectors;
[0015] S3: Parallel synchronously reads data from the same address of three NOR Flash chips, performs three-modular redundancy operation on each bit of data, and obtains the first data stream;
[0016] S4: For the first data stream, perform RS decoding operation on the second byte as the unit to obtain the second data stream;
[0017] S5: Based on the second data stream, write back and repair erroneous data, and report single-particle flip events and error correction status.
[0018] Based on the above-described satellite payload FPGA configuration data error correction method for resisting single-event upsets, S1 specifically includes:
[0019] For the original configuration bitstream data of the satellite payload FPGA, the data is grouped into 239-byte segments. Encoding operations are performed on each segment to generate a 16-byte check symbol and construct 255-byte RS-encoded configuration data.
[0020] Based on the above-described satellite payload FPGA configuration data error correction method for resisting single-event upsets, S2 specifically includes:
[0021] For three NOR Flash chips, each NOR Flash chip is divided into upper and lower halves;
[0022] Based on RS-encoded configuration data, multiple sets of consecutive RS codewords are concatenated into standard storage words according to byte sequence number;
[0023] After establishing the mapping relationship between logical addresses and physical addresses through address remapping, standard storage words are written sequentially to the corresponding half-area addresses of the three NOR Flash chips according to the mapped addresses.
[0024] Based on the above-described satellite payload FPGA configuration data error correction method against single-event upsets, S4 specifically includes:
[0025] The first data stream is grouped into units of 255 bytes. By calculating the comprehensive vector, it is determined whether there are errors in the data. If there are errors, an error location polynomial is constructed to solve for the error location and error value. Byte-level correction is performed when the number of error symbols is less than 8.
[0026] Based on the above-described method for correcting satellite payload FPGA configuration data against single-event flips, step S3 describes performing a triple modulo redundancy operation on each bit of data. When inconsistencies are detected among the three data streams, the majority bit value is output and the single-event flip error correction is completed. Simultaneously, the single-event flip event count is recorded.
[0027] Based on the above-described method for correcting FPGA configuration data for satellite payloads against single-event upsets, step S5, which involves writing back and repairing erroneous data based on the second data stream, specifically includes:
[0028] Based on the second data stream, the differences between the three NOR Flash read data and the second data stream are compared. Only the upper half of the NOR Flash is written back for correction, while the lower half remains read-only.
[0029] This invention also provides a satellite payload FPGA configuration data error correction system resistant to single-event upsets, comprising:
[0030] RS encoding module: Used to group the original configuration bitstream data of the satellite payload FPGA into information segments with preset bytes, perform encoding operations on each information segment, generate the first byte check symbol, and construct the second byte of RS encoded configuration data;
[0031] Cross-sector interleaved storage module: used to construct a mapping relationship between logical addresses and physical addresses through address remapping, and to write continuous RS-encoded configuration data into different physical sectors;
[0032] First error correction module: used to read data from the same address of three NOR Flash chips in parallel and synchronously, perform three-modular redundancy operation on each bit of data, and obtain the first data stream;
[0033] The second error correction module is used to perform RS decoding operations on the first data stream, with the second byte as the unit, to obtain the second data stream.
[0034] Repair module: Used to write back and repair erroneous data based on the second data stream, and report single-particle flip events and error correction status.
[0035] Based on the above-described satellite payload FPGA configuration data error correction system for resisting single-event upsets, the RS encoding module specifically comprises:
[0036] For the original configuration bitstream data of the satellite payload FPGA, the data is grouped into 239-byte segments. Encoding operations are performed on each segment to generate a 16-byte check symbol and construct 255-byte RS-encoded configuration data.
[0037] Based on the above-described satellite payload FPGA configuration data error correction system for resisting single-event upsets, the cross-sector interleaved storage module specifically comprises:
[0038] For three NOR Flash chips, each NOR Flash chip is divided into upper and lower halves;
[0039] Based on RS-encoded configuration data, multiple sets of consecutive RS codewords are concatenated into standard storage words according to byte sequence number;
[0040] After establishing the mapping relationship between logical addresses and physical addresses through address remapping, standard storage words are written sequentially to the corresponding half-area addresses of the three NOR Flash chips according to the mapped addresses.
[0041] Based on the above-described satellite payload FPGA configuration data error correction system for resisting single-event upsets, the second error correction module is specifically as follows:
[0042] The first data stream is grouped into units of 255 bytes. By calculating the comprehensive vector, it is determined whether there are errors in the data. If there are errors, an error location polynomial is constructed to solve for the error location and error value. Byte-level correction is performed when the number of error symbols is less than 8.
[0043] Beneficial effects
[0044] This invention presents a two-layer error correction method based on "bit-symbol" error correction, cascaded with RS decoding operators based on finite field algebra, on a "two-out-of-three" majority voting logic. This method can simultaneously correct single-particle independent flips and multi-copy common-mode failures, solving the error locking problem of traditional TMR. Furthermore, when writing configuration data to non-volatile memory, a cross-sector spatial interleaving and distributed storage mechanism is introduced to ensure that symbols within the same RS codeword are physically separated as much as possible, thereby transforming clustered physical damage into dispersed symbol-level errors. Attached Figure Description
[0045] Figure 1 This is a schematic diagram of a single-particle flip under ideal conditions.
[0046] Figure 2 This is a schematic diagram of aggregated single-particle flipping.
[0047] Figure 3 This is a schematic diagram of the cross-sector interleaved storage in step S2 of the present invention, wherein squares of the same color are regarded as a group of RS encoded data. Detailed Implementation
[0048] The following examples are intended to illustrate the present invention, and not to further limit the invention.
[0049] This invention provides a method for error correction of satellite payload FPGA configuration data resistant to single-event upsets, comprising:
[0050] S1: For the original configuration bitstream data of the satellite payload FPGA, group the data into information segments with preset bytes, perform encoding operations on each information segment, generate the first byte check symbol, and construct the second byte of RS encoded configuration data.
[0051] Specifically:
[0052] For the original configuration bitstream data of the satellite payload FPGA, the data is grouped into 239-byte segments. Encoding operations are performed on each segment to generate a 16-byte check symbol and construct 255-byte RS-encoded configuration data.
[0053] Reed-Solomon codes (RS codes) are a class of codes defined in the finite field GF(2). 8 Block error correction codes on ) are widely used in high-reliability integrated circuit systems.
[0054] Building upon this foundation, the present invention employs the RS(255,239) encoding method. This involves grouping information into 239-byte segments, performing encoding operations on each segment to generate a 16-byte checksum, and constructing 255 bytes of RS-encoded configuration data. Thus, even if bit corruption occurs at any position within an 8-byte data block due to a single-event flip, lossless repair can be achieved.
[0055] Coding redundancy for: .
[0056] This redundancy overhead is extremely low for aerospace-grade non-volatile memories (such as NOR Flash memory chips), making it well-suited for engineering applications.
[0057] This invention performs RS(255,239) encoding on the above data to generate symbol-level redundancy information for error correction and consistency verification during subsequent reading.
[0058] S2: By address remapping, a mapping relationship between logical addresses and physical addresses is constructed, and continuous RS-encoded configuration data is distributed and written to different physical sectors.
[0059] like Figure 1 As shown, ideally, single-event upsets (SEMUs) should exhibit a random and discrete spatial distribution. However, in extreme aerospace environments, due to manufacturing tolerances of the satellite's precise structure, mechanical vibrations during on-orbit operation, or irradiation aging of shielding materials, external non-volatile memory chips (such as NOR Flash) may have localized weak shielding areas. When these weak areas encounter high-energy particle tracks, they are prone to single-event multiple-cell upsets (SEMUs), leading to spatially concentrated bit damage within the memory array of the memory chip. For example... Figure 2 As shown.
[0060] In the traditional sequential address storage mode, since each group of 255 bytes of data generated by RS(255,239) encoding is stored continuously and adjacently in the NOR Flash physical array, once a physically clustered single-event flip occurs, this high-energy radiation event can easily hit multiple storage cells in the same group of data at the same time.
[0061] This damage distribution can significantly increase the number of erroneous bytes in a single 255-byte data group, which is very likely to exceed the performance threshold that the algorithm can only correct 8 bytes, thus causing the error correction of the entire data group to fail.
[0062] Therefore, traditional sequential address storage strategies have significant reliability bottlenecks when dealing with localized high-intensity radiation damage to memory chips.
[0063] To address the aforementioned issues, this invention proposes a cross-sector interleaved storage mechanism for memory chips. Its core idea is to break the strong coupling between "physical proximity" and "logical continuity," so that local damage in the physical space of the memory chip no longer corresponds to continuous data blocks in the logical space.
[0064] Specifically, for three NOR Flash chips, each NOR Flash chip is divided into upper and lower halves;
[0065] Based on RS-encoded configuration data, multiple sets of consecutive RS codewords are concatenated into standard storage words according to byte sequence number;
[0066] After establishing the mapping relationship between logical addresses and physical addresses through address remapping, standard storage words are written sequentially to the corresponding half-area addresses of the three NOR Flash chips according to the mapped addresses.
[0067] like Figure 3 As shown, this invention constructs a mapping relationship between logical addresses and physical addresses, and disperses originally continuous logical data blocks into different sectors and different physical regions, thereby realizing the physical distributed storage of a single set of RS codewords in different sectors.
[0068] Through the aforementioned cross-sector interleaved storage mechanism, logically continuous data blocks are reconstructed into a physical structure that is discretely distributed within the memory chip, significantly reducing the risk of concentrated damage to a single codeword caused by local physical damage.
[0069] This method requires no additional hardware resources and can effectively suppress space radiation clustering failures simply by using the address mapping logic and data reorganization mechanism inside the configuration management chip. This allows the error correction capability of RS codes to be fully utilized in complex space environments, further improving the security and reliability of on-orbit configuration management of satellite payload systems.
[0070] S3: Parallel synchronously reads data from the same address of three NOR Flash chips, performs three-modular redundancy operations on each bit of data, and obtains the first data stream.
[0071] Specifically, the process involves performing a triple modulo redundancy operation on each bit of data. When inconsistencies are detected among the three data streams, the majority bit value is output, and single-event flip error correction is completed. Simultaneously, the single-event flip event count is recorded.
[0072] Specifically, when the satellite payload performs FPGA loading, Flash verification, or write-back tasks, the configuration management chip extracts configuration data in parallel from three external NOR Flash chips and performs a "two-out-of-three" majority vote. This voting logic can identify and filter out bit deviations caused by single-event upsets in any single physical copy in real time.
[0073] S4: For the first data stream, perform RS decoding operation on the second byte as the unit to obtain the second data stream.
[0074] Specifically:
[0075] The first data stream is grouped into units of 255 bytes. By calculating the comprehensive vector, it is determined whether there are errors in the data. If there are errors, an error location polynomial is constructed to solve for the error location and error value. Byte-level correction is performed when the number of error symbols is less than 8.
[0076] To address the common-mode effect that may occur under extreme radiation environments, specifically when two or more storage replicas flip at the same bit, the Triple Modular Redundancy (TMR) decision will output an error bit, causing damage to the data byte to which it belongs.
[0077] Therefore, the present invention performs RS(255,239) decoding within a fixed-length data block of 255 bytes, and has the algebraic error correction capability to correct 8 bytes of errors at any position, and can perform forced correction on damaged bytes.
[0078] Given the highly sparsity and random location characteristics of common-mode failures caused by single-event effects in aerospace environments, this aligns perfectly with the error-correcting properties of the RS(255,239) decoding algorithm. While the algorithm can only correct 8 damaged bytes within a fixed-length block of 255 bytes, it has no specific requirements regarding the location of the erroneous bytes and possesses the ability to correct random location errors. This efficient repair capability for small-scale, discrete damage precisely covers the residual errors caused by common-mode flipping in the TMR voting logic, thus achieving accurate self-healing of uncertain location errors with extremely low computational overhead.
[0079] This invention achieves the coordinated operation of bit-level redundancy decision and symbol-level error correction algorithms at the digital integrated circuit architecture level through the cascaded TMR decision and RS error correction of S3 and S4. It solves the problem that the traditional single-level TMR architecture cannot identify common-mode flips, and realizes effective repair of random bit flips and common-mode failures in external memory chips, ensuring the correctness of satellite payload configuration data in the extreme radiation environment of space.
[0080] S5: Based on the second data stream, write back and repair erroneous data, and report single-particle flip events and error correction status.
[0081] Specifically, the step of writing back and repairing erroneous data based on the second data stream includes:
[0082] Based on the second data stream, the differences between the three NOR Flash read data and the second data stream are compared. Only the upper half of the NOR Flash is written back for correction, while the lower half remains read-only.
[0083] This invention presents a two-layer error correction method based on "bit-symbol" error correction, cascaded with RS decoding operators based on finite field algebra, on a "two-out-of-three" majority voting logic. This method can simultaneously correct single-particle independent flips and multi-copy common-mode failures, solving the error locking problem of traditional TMR. Furthermore, when writing configuration data to non-volatile memory, a cross-sector spatial interleaving and distributed storage mechanism is introduced to ensure that symbols within the same RS codeword are physically separated as much as possible, thereby transforming clustered physical damage into dispersed symbol-level errors.
[0084] This invention utilizes the interleaved storage mechanism across sectors of memory chips to break the coupling between the physical proximity and logical continuity of configuration data. By discretizing local clustered damage at the physical level into isolated symbol errors at the logical level, it ensures that the damage suffered by each group of RS coding units is within the error correction capability of the RS(255,239) algorithm, greatly enhancing the satellite payload system's tolerance to localized devastating radiation attacks.
[0085] This invention also provides a satellite payload FPGA configuration data error correction system resistant to single-event upsets, comprising:
[0086] RS Encoding Module: Used to group the raw configuration bitstream data of the satellite payload FPGA into information segments with preset bytes, perform encoding operations on each information segment, generate the first byte check symbol, and construct the second byte of RS encoded configuration data.
[0087] Furthermore, the RS encoding module specifically includes:
[0088] For the original configuration bitstream data of the satellite payload FPGA, the data is grouped into 239-byte segments. Encoding operations are performed on each segment to generate a 16-byte check symbol and construct 255-byte RS-encoded configuration data.
[0089] Cross-sector interleaved storage module: used to construct a mapping relationship between logical addresses and physical addresses through address remapping, and to write continuous RS-encoded configuration data to different physical sectors.
[0090] Furthermore, the cross-sector interleaved storage module specifically includes:
[0091] For three NOR Flash chips, each NOR Flash chip is divided into upper and lower halves;
[0092] Based on RS-encoded configuration data, multiple sets of consecutive RS codewords are concatenated into standard storage words according to byte sequence number;
[0093] After establishing the mapping relationship between logical addresses and physical addresses through address remapping, standard storage words are written sequentially to the corresponding half-area addresses of the three NOR Flash chips according to the mapped addresses.
[0094] The first error correction module is used to read data from the same address of three NOR Flash chips in parallel and synchronously, perform three-modulus redundancy operations on each bit of data, and obtain the first data stream.
[0095] The second error correction module is used to perform RS decoding operations on the first data stream, with the second byte as the unit, to obtain the second data stream.
[0096] Furthermore, the second error correction module specifically includes:
[0097] The first data stream is grouped into units of 255 bytes. By calculating the comprehensive vector, it is determined whether there are errors in the data. If there are errors, an error location polynomial is constructed to solve for the error location and error value. Byte-level correction is performed when the number of error symbols is less than 8.
[0098] Repair module: Used to write back and repair erroneous data based on the second data stream, and report single-particle flip events and error correction status.
[0099] Example 1
[0100] This embodiment details the implementation method of spatial interleaving storage using the S29GL512P (512M bit, or 64MB) NOR Flash, a commonly used model on satellite platforms. This device employs a Uniform Sector architecture, divided into 512 sectors, each with a capacity of 128KB.
[0101] In satellite payload control systems, to further enhance resistance to single-sector physical damage, this invention not only logically distributes the RS-encoded data groups consisting of 255 bytes, but also uses a physical address mapping mechanism to distribute the symbols within the same RS codeword across different sectors as much as possible, thereby avoiding the risk of the entire data group becoming unrecoverable due to the failure of a local physical region.
[0102] This model of NOR Flash uses a 16-bit data bus structure and has 25 address lines, therefore its addressable word address space is [missing information]. Each address unit stores 16 bits (2 bytes) of data, therefore the total storage capacity is:
[0103] .
[0104] Each NOR Flash chip is logically divided into two halves, each with a capacity of 32MB, corresponding to 256 sectors. The upper and lower halves store the same configuration program data, with the lower half serving as a read-only backup area, where write-back operations are prohibited during on-orbit operation, thus forming a reliable on-board storage redundancy structure.
[0105] In terms of encoding organization, each RS(255,239) encoding result contains 255 bytes of data, and each half-zone has exactly 256 sectors. Utilizing this structural feature, a one-to-one cross-sector mapping strategy can be constructed, distributing the 255 bytes of each RS codeword across different sectors, thus satisfying the requirement for distribution. That is, any two symbols within the same RS codeword are not located in the same physical sector.
[0106] Even if a sector suffers catastrophic damage due to radiation or device defects, at most one symbol will be lost within the RS codeword. Since the NOR Flash uses 16 bits as the basic storage unit, while the RS encoding output is a byte stream (8 bits), this invention performs data concatenation processing to improve space utilization and maintain the simplicity of the address mapping rules.
[0107] Specifically, the two sets of RS-encoded data (a total of 2 × 255 = 510 bytes) are concatenated according to their byte numbers, with each pair of bytes forming a 16-bit word. If the y-th byte of the x-th data set is written as... All data in group x are written as The y-th 16-bit word obtained by concatenating the x-th group and the (x+1)-th group is Then the RS-coded data for the m-th and m+1-th groups are respectively:
[0108] ; .
[0109] The i-th 16-bit word after concatenating these two sets of data is: .
[0110] This allows for the formation of 255 16-bit storage units, achieving a perfect match with the physical word width while maintaining RS symbol-level independence.
[0111] Regarding address mapping, the original sequential writing to the address is denoted as: .
[0112] In the traditional method, addresses increment linearly. To achieve distributed storage across sectors, this invention employs a bit rearrangement mapping method to reconstruct the address as follows: .
[0113] This mapping is equivalent to performing a cyclic shift and swap of the lower 9 bits and the higher 16 bits of the original address. Since each sector has a capacity of 128KB, the corresponding number of word addresses is... Therefore, the high 16 bits of the original address determine the offset within the sector, and the low 9 bits (a total of 512 possible values) correspond to the number of sectors.
[0114] If the m-th group of RS encoded data is arranged in the original order as shown in Table 1, then after the above bit rearrangement, the RS word data that were originally arranged in order will be distributed in the physical space as shown in Table 2.
[0115] Table 1. Data placement in Flash during sequential data delivery.
[0116]
[0117] Table 2. Location of data in Flash during distributed data release.
[0118]
[0119] Example 2
[0120] This embodiment further illustrates that when the satellite platform memory encounters single-sector failure or large-area clustered single-event upset effect due to high-energy particle tracks, the present invention can still achieve complete repair of configuration data through "cascaded double-layer error correction" combined with "spatial interleaved storage".
[0121] In this embodiment, taking the FPGA that the configuration management chip needs to serve as a XILINX XC7K325T as an example, its configuration file size is 5,258,000 bytes (approximately 5MB), and the NOR Flash model remains the S29GL512P from Embodiment 1. The raw data is split into groups of 239 bytes each, totaling 22,000 raw data groups. After RS(255,239) encoding, each group is expanded to 255 bytes, increasing the total data volume to 5,610,000 bytes (a total of 22,000 RS code blocks).
[0122] Let the y-th byte in the x-th RS code block be written as After address remapping, the originally logically contiguous 255 bytes were forcibly discretely stored in 255 different physical sectors. The physical distribution matrix is shown in Table 3.
[0123] Table 3 Physical distribution matrix of data in Flash during decentralized emissions
[0124]
[0125] As shown in Table 3, the 255 bytes of any single RS code block (i.e., when x is a constant value) are completely stripped, resulting in a lack of physical proximity. Assuming that during satellite operation, Sector 1 of the external Flash memory is struck by high-energy heavy-ion tracks or experiences a physical hardware defect, causing the complete loss or unpredictable flipping of all 21.5KB of data (corresponding to 11,000 memory addresses) stored in that sector, in this extreme scenario, although a total of 22,000 bytes are corrupted, they are evenly distributed across all 22,000 independent RS code blocks.
[0126] For each independent RS(255,239) code block (i.e. to Although its bytes stored in Sector 1 (i.e. The NOR Flash memory block was severely damaged, but the bytes stored in the remaining 254 sectors remained intact. For each RS block, the number of erroneous symbols E=1, which is much smaller than the error correction threshold of 8 for the RS(255,239) algorithm, so the configuration data in the NOR Flash was successfully recovered.
[0127] Ultimately, through the collaborative work of the TMR voting circuit and RS decoding module inside the configuration management chip, the configuration data in the external NOR Flash memory chip is fully recovered, thereby ensuring that the configuration loading of the satellite payload FPGA can be completed normally under extreme space radiation environment.
[0128] Example 3
[0129] This embodiment provides a satellite payload FPGA configuration data error correction system resistant to single-event upsets. This system is deployed within the digital integrated circuit system of the satellite payload platform to provide highly reliable configuration data loading and error correction capabilities for the mission FPGA.
[0130] During the system loading process, the Flash controller inside the configuration management chip reads three external NOR Flash chips in parallel and synchronously via three independent address / data buses. The raw bit stream read is first sent to a 2-out-of-3 majority voter.
[0131] If the three input bits are inconsistent (e.g., 1, 1, 0), the voter outputs a bit value with a higher frequency (i.e., 1), which means that a single-event upset (SEU) has been repaired, and at the same time, a single-event upset (SEU) count is reported to the system register.
[0132] After the voting, the data stream immediately enters the RS decoding module, which performs real-time decoding on the consecutive 255-byte data blocks according to the RS(255,239) algorithm.
[0133] If residual errors due to common-mode switching still exist in the data stream after voting, RS decoding can complete byte-level correction before the data is output to the target FPGA configuration port, and simultaneously report an RS decoding error correction to the system register.
[0134] Next, this embodiment will use a portion of the data in a set of RS(255,239) encoding units as an example to demonstrate the entire process from reading from Flash to final correction output.
[0135] Suppose that the configuration data segment of a certain FPGA in the satellite payload is: 0xAA, 0xBB, 0xCC.
[0136] After RS encoding, a coded block containing parity bits is generated, and its data block should be... .
[0137] in: =0xAA, =0xBB, =0xCC, to The checksum is 16 bytes.
[0138] The data is stored in three backups on external FlashA, FlashB, and FlashC.
[0139] Under ideal, interference-free conditions, the contents stored in the three Flash chips are completely identical, and the data at the corresponding location of each Flash chip is shown in Table 4.
[0140] Table 4. Data storage in Flash memory under ideal conditions
[0141]
[0142] Assuming the satellite payload is bombarded by high-energy particles in the space radiation environment, the data in certain logical address areas of the three Flash chips is flipped to varying degrees, as shown in Table 5.
[0143] Table 5. Data storage status in Flash memory after single-particle flip.
[0144]
[0145] That is, at the position of byte 1, bit 0 of FlashA, bit 2 of FlashC, and bit 4 of FlashB all have data errors due to the single event fault, but only one copy of each of these three bits has an error; at the position of byte 2, bits 2 and bit 7 of FlashA and FlashB are flipped at the same time, which is a double copy flip; and at the position of byte 3, all three Flash chips have a flip at the position of bit 4.
[0146] Therefore, after TMR voting, the three bytes of output data are shown in Table 6.
[0147] Table 6 Output Results After TMR Voting
[0148]
[0149] At this point, only single-copy flipped data can be corrected, while double-copy or triple-copy flipped data cannot be corrected. The erroneous data stream {0xAA, 0x3F, 0xDC, ...} output by TMR enters the RS decoding module. The RS decoding module constructs the error location polynomial by calculating the synthesis vector, and solves for the error location and error value. Under the condition that the number of error symbols is less than 8, it completes byte-level correction, correcting the two erroneous bytes to 0xBB and 0xCC. Thus, the data after RS decoding, as shown in Table 7, has been restored to correctness.
[0150] Table 7 Output results after RS decoding and error correction
[0151]
[0152] Therefore, by cascading TMR voting and RS decoding modules into the digital integrated circuit architecture of the configuration management chip, bit-level and symbol-level dual-layer error correction can be achieved simultaneously in spaceborne electronic equipment, thereby significantly improving the reliability of satellite payload FPGA configuration data in strong radiation environments.
[0153] Application Example 1
[0154] The RS(255,239) error correction enhancement mechanism proposed in this invention was analyzed in depth from the perspectives of integrated circuit implementation complexity and timing performance. Given that this encoding / decoding architecture has a very mature implementation in the field of digital integrated circuit design, although different logic implementation schemes differ slightly in their underlying mapping, their resource consumption and critical path latency exhibit high predictability.
[0155] Taking the Reed-Solomon Encoder (9.0) IP core provided by the mainstream integrated circuit design tool Vivado as an example, when using the parameter configuration shown in Table 8, the integrated circuit hardware resource consumption and timing indicators exhibit the following characteristics.
[0156] Table 8 Typical Example RS(255,239) Parameters
[0157]
[0158] In terms of logical resource consumption, this error correction system exhibits excellent lightweight characteristics. Specifically, the RS(255,239) encoding module only requires 181 Slice LUTs and 202 Slice Registers; the decoding module, as the logical core, consumes 800 Slice LUTs and 823 Slice Registers, and occupies 1 Block RAM for data buffering.
[0159] In summary, the total resource requirements of the complete encoding and decoding logic for the configuration management chip are approximately 981 Slice LUTs and 1025 Slice Registers. This level of logic overhead represents a very small percentage of the available resources in mainstream aerospace-grade programmable logic devices, validating the engineering feasibility of this solution in resource-constrained environments.
[0160] In terms of timing performance and throughput, the system's processing power fully meets the requirements of high-speed FPGA configuration in satellite payloads. The inherent latency of the encoding module is only 3 clock cycles, causing almost no link blocking. The pipelined processing delay (PD) of the decoding module is 203 clock cycles, and the total latency is only 470 clock cycles, while the length of a single codeword (n) is 255 bytes, satisfying the requirements. .
[0161] Because the processing latency is less than the codeword length, the decoding engine has continuous non-blocking decoding capabilities, enabling real-time line-speed processing of the input bitstream. Therefore, even if there are many sets of data to be decoded, the total latency is only 470 clock cycles.
[0162] If we take the 40MHz onboard operating clock frequency commonly used in configuration management chips ( For example, the total latency generated by the decoding module ( It can be calculated using the following formula: .
[0163] Compared to a typical FPGA (such as the XILINX XC7K325T FPGA, with a configuration file data size of approximately 5.45MB), a configuration management chip operating at the same frequency requires approximately 4 seconds of loading time to configure it. The microsecond-level delay introduced by RS decoding has a negligible impact on the overall configuration efficiency.
[0164] Therefore, the RS(255,239) error correction enhancement mechanism proposed in this invention significantly improves data reliability without causing substantial damage to the real-time startup performance and mission response characteristics of the aerospace electronic system, and has extremely high on-orbit application value.
[0165] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.
Claims
1. A method for error correction of satellite payload FPGA configuration data resistant to single-event upsets, characterized in that, include: S1: For the original configuration bitstream data of the satellite payload FPGA, group the data into information segments with preset bytes, perform encoding operations on each information segment, generate the first byte check symbol, and construct the second byte of RS encoded configuration data; S2: By address remapping, a mapping relationship between logical addresses and physical addresses is established, and continuous RS-encoded configuration data is distributed and written to different physical sectors, specifically: For three NOR Flash chips, each NOR Flash chip is divided into upper and lower halves; Based on RS-encoded configuration data, multiple sets of consecutive RS codewords are concatenated into standard storage words according to byte sequence number; After establishing the mapping relationship between logical addresses and physical addresses through address remapping, the standard storage words are written sequentially to the corresponding half-area addresses of the three NOR Flash chips according to the mapped addresses. S3: Parallel synchronously reads data from the same address of three NOR Flash chips, performs three-modular redundancy operation on each bit of data, and obtains the first data stream; S4: For the first data stream, perform RS decoding operation on the second byte as the unit to obtain the second data stream; S5: Based on the second data stream, write back and repair erroneous data, and report single-particle flip events and error correction status.
2. The satellite payload FPGA configuration data error correction method against single-event upsets according to claim 1, characterized in that, S1 specifically refers to: For the original configuration bitstream data of the satellite payload FPGA, the data is grouped into 239-byte segments. Encoding operations are performed on each segment to generate a 16-byte check symbol and construct 255-byte RS-encoded configuration data.
3. The satellite payload FPGA configuration data error correction method against single-event upsets according to claim 1, characterized in that, S4 specifically refers to: The first data stream is grouped into units of 255 bytes. By calculating the comprehensive vector, it is determined whether there are errors in the data. If there are errors, an error location polynomial is constructed to solve for the error location and error value. Byte-level correction is performed when the number of error symbols is less than 8.
4. The satellite payload FPGA configuration data error correction method against single-event upsets according to claim 1, characterized in that, S3 performs a triple modulo redundancy operation on each bit of data. When the inconsistency of the three data paths is detected, the majority bit value is output and the single-event flip error correction is completed. At the same time, the single-event flip event count is recorded.
5. The satellite payload FPGA configuration data error correction method against single-event upsets according to claim 1, characterized in that, S5 describes the process of writing back and repairing erroneous data based on the second data stream, specifically as follows: Based on the second data stream, the differences between the three NOR Flash read data and the second data stream are compared. Only the upper half of the NOR Flash is written back for correction, while the lower half remains read-only.
6. A satellite payload FPGA configuration data error correction system resistant to single-event upsets, characterized in that, include: RS encoding module: Used to group the original configuration bitstream data of the satellite payload FPGA into information segments with preset bytes, perform encoding operations on each information segment, generate the first byte check symbol, and construct the second byte of RS encoded configuration data; Cross-sector interleaved storage module: Used to establish a mapping relationship between logical addresses and physical addresses through address remapping, distributing continuous RS-encoded configuration data into different physical sectors, specifically: For three NOR Flash chips, each NOR Flash chip is divided into upper and lower halves; Based on RS-encoded configuration data, multiple sets of consecutive RS codewords are concatenated into standard storage words according to byte sequence number; After establishing the mapping relationship between logical addresses and physical addresses through address remapping, the standard storage words are written sequentially to the corresponding half-area addresses of the three NOR Flash chips according to the mapped addresses. First error correction module: used to read data from the same address of three NOR Flash chips in parallel and synchronously, perform three-modulus redundancy operation on each bit of data, and obtain the first data stream; The second error correction module is used to perform RS decoding operations on the first data stream, with the second byte as the unit, to obtain the second data stream. Repair module: Used to write back and repair erroneous data based on the second data stream, and report single-particle flip events and error correction status.
7. The satellite payload FPGA configuration data error correction system against single-event upsets according to claim 6, characterized in that, The RS encoding module is specifically as follows: For the original configuration bitstream data of the satellite payload FPGA, the data is grouped into 239-byte segments. Encoding operations are performed on each segment to generate a 16-byte check symbol and construct 255-byte RS-encoded configuration data.
8. The satellite payload FPGA configuration data error correction system against single-event upsets according to claim 6, characterized in that, The second error correction module is specifically as follows: The first data stream is grouped into units of 255 bytes. By calculating the comprehensive vector, it is determined whether there are errors in the data. If there are errors, an error location polynomial is constructed to solve for the error location and error value. Byte-level correction is performed when the number of error symbols is less than 8.