Star sensor storage system fault-tolerant implementation method against single event upset

Abstract

The application discloses a fault-tolerant implementation method of a star sensor storage system against single event upsets, and solves the short board of the existing star sensor storage system against single event upsets and the technical problem that the processor internal FLASH capacity is insufficient to implement triple modular redundancy and the like.The method comprises three parts of power-on loading fault-tolerant reading, external SRAM star table dynamic refreshing and internal FLASH data automatic repairing.The ECC error processing is accurate and efficient, and is suitable for the hardware characteristics.The hardware parameters of 32 bytes corresponding to 10 bits of ECC and 32 byte error positioning granularity are adapted, single-bit error is only recorded and not switched to backup, the data accuracy is guaranteed by relying on hardware error correction, double-bit error is temporarily switched to backup reading, the error correction efficiency and data reading fluency are considered, and the real-time operation requirement of the star sensor is met.The application greatly improves the reliability of the star sensor in long-term operation in orbit, and effectively reduces the failure rate in orbit and operation and maintenance cost.

Description

Technical Field

[0001] This invention relates to the field of aerospace star sensor technology, specifically to a single-event fault tolerance implementation method that adapts to the limited capacity storage architecture of star sensors and takes into account both data fault-tolerant reading and automatic repair. It is applicable to single-event protection, data error correction and fault repair scenarios of star sensor processors with built-in FLASH and internal and external SRAM combined storage architecture. Background Technology

[0002] Star sensors are core sensitive devices for attitude measurement of spacecraft. Operating long-term in the space radiation environment, their storage units are highly susceptible to single-event effects such as single-event upsets and single-event latch-up, leading to data errors and content flipping. These faults can range from minor errors in star sensor attitude calculation and reduced measurement accuracy to severe malfunctions causing program crashes and system failures, directly threatening the on-orbit safety of the spacecraft. Therefore, designing a storage system resistant to single-event faults is a critical technical challenge that urgently needs to be overcome during the development of star sensors.

[0003] Currently, common fault-resistant methods for star sensor storage systems mainly include triple redundancy (3 out of 2) decision-making, ECC hardware error correction, and periodic data refresh. However, in practical engineering applications, these conventional solutions have obvious adaptability defects: First, due to the limitations of the star sensor processor hardware specifications, the internal FLASH storage capacity is limited and cannot meet the requirement of three redundant data storages for triple redundancy, making conventional triple redundancy solutions difficult to implement. Second, the SRAM extended externally by the processor generally does not have ECC verification function. Under space irradiation, the probability of single-event upsets is extremely high, and conventional data refresh alone cannot accurately avoid data failures, making it difficult to guarantee the stability of star table data. Third, existing FLASH ECC error correction solutions have problems such as mismatched positioning granularity, coarse error handling logic, and non-closed-loop repair processes. They can only achieve basic single-bit error correction and double-bit error detection, and cannot complete targeted repair of damaged data. Furthermore, the reading and switching mechanism of the dual backup data is imperfect and cannot meet the stringent requirements of long-term stable operation of star sensors in orbit.

[0004] Given the numerous shortcomings of existing technologies, there is an urgent need for a complete single-event fault protection solution that fits the hardware storage architecture of star sensors, is suitable for capacity-constrained scenarios, and has fault-tolerant reading, dynamic refresh, and automated repair functions. This solution aims to address the fault protection challenges of star sensor storage systems and further improve the reliability of on-orbit operation. Summary of the Invention

[0005] This invention addresses the shortcomings of existing star sensor storage systems in resisting single-event faults (SIF) and the technical problems such as insufficient internal FLASH capacity in processors preventing the implementation of triple redundancy by providing a fault-tolerant implementation method for star sensor storage systems to resist SIF.

[0006] A fault-tolerant implementation method for a star sensor storage system to resist single-event faults is proposed. This method is achieved through three parts: power-on loading fault-tolerant reading, dynamic refreshing of the external SRAM star table, and automatic repair of internal FLASH data.

[0007] The power-on loading fault-tolerant reading process is as follows: After the star sensor is powered on, the BOOT program runs, reading the first star table in units of 32 bytes. When an ECC interrupt is triggered, if it is a single-bit error, the offset address of the 32-byte error area is recorded, and the corrected data is moved to the external SRAM; if it is a double-bit error, the offset address of the 32-byte error area is recorded, and then the corresponding offset address of the second star table is switched to read 32 bytes of data. The correct data is moved to the external SRAM, and then the process returns to the first star table to continue reading until the star table is loaded. Then, the same fault-tolerant logic is used to read the first program code, move it to the internal SRAM, and run it.

[0008] The external SRAM star table dynamic refresh process is as follows: when the star sensor is in an idle state where it does not call the star table, the power-on loading fault-tolerant reading process is reused every 10 minutes to read the standard star table data from the internal FLASH and refresh and overwrite the star table data of the external SRAM.

[0009] The automatic repair process for internal FLASH data is as follows: Upon receiving the repair instruction, the target stored data is read into the internal SRAM cache in units of 32 bytes. If it is a single-bit error, the error correction is completed and the offset address is recorded. If it is a double-bit error, the corresponding offset address of the backup is switched to read. In units of 128KB sectors, if an error is detected, the corresponding sector is erased and the correct data in the internal SRAM cache is written back. After data verification, the repair is completed. The full repair of two star tables and two program codes is completed sector by sector.

[0010] The beneficial effects of this invention are:

[0011] The fault-tolerant implementation method for single-event faults described in this invention has the following advantages compared to existing star sensor storage fault-tolerant technologies:

[0012] 1. Adapts to capacity-constrained scenarios, overcoming the bottleneck of triple redundancy applications. Addressing the hardware limitation that internal FLASH cannot store three redundant copies of data, it employs a fault-tolerant logic of dual-source data backup + ECC hierarchical error handling. This achieves reliable data retrieval without requiring additional storage capacity, perfectly resolving the contradiction between insufficient storage capacity and data fault tolerance requirements.

[0013] 2. Precise and efficient ECC error handling, suitable for hardware characteristics. Adapts to the hardware parameters of 32 bytes of internal FLASH corresponding to 10-bit ECC and 32-byte error location granularity. Single-bit errors are only recorded without switching backups, relying on hardware error correction to ensure data accuracy. Double-bit errors temporarily switch to backup reading, balancing error correction efficiency and data reading smoothness, meeting the real-time operation requirements of star sensors.

[0014] 3. Long-term and reliable protection for external SRAM satellite arrays. Through a fixed 10-minute idle refresh mechanism, the power-on loading process is reused to calibrate satellite array data, specifically addressing the single-event fault (SIF) problem in external SRAM without ECC. This significantly reduces the probability of satellite array data errors and improves data stability without requiring additional hardware circuitry.

[0015] 4. The data repair process is closed-loop and controllable, with extremely high fault tolerance. Employing an internal ECC SRAM for secure data caching, meticulous repair of 128KB sectors at a time, and a closed-loop process of 3 retries plus failure marking, the system achieves automated and standardized repair of damaged FLASH data. This results in high repair accuracy and ample fault tolerance redundancy, significantly improving the reliability of the star sensor during long-term on-orbit operation and effectively reducing on-orbit failure rates and maintenance costs. Attached Figure Description

[0016] Figure 1 This is a flowchart of the fault-tolerant reading process for power-on loading of the star sensor in a fault-tolerant implementation method for single-event fault resistance in a star sensor storage system according to the present invention.

[0017] Figure 2 This is a schematic diagram of the external SRAM star table dynamic refresh process in the method of the present invention;

[0018] Figure 3 This is a schematic diagram of the automatic repair process of internal FLASH data in the method of the present invention. Detailed Implementation

[0019] Combination Figures 1 to 3This embodiment describes a fault-tolerant implementation method for a star sensor storage system to resist single-event faults. In this method, an SRAM without ECC check function is extended externally to the star sensor processor. This chip is susceptible to data flipping due to space single-event effects. Inside the processor, 2MB of FLASH and 864KB of internal SRAM are integrated. The internal FLASH has a dedicated ECC function, with 10 ECC check bits per 32 bytes, enabling single-bit error correction and double-bit error detection. When a single-bit or double-bit error occurs, it can only locate the starting address of the region containing the erroneous 32 bytes, not the specific erroneous byte within that region. The total capacity of the internal FLASH is 2MB, divided into two independent 1MB storage blocks. Each 1MB block is further subdivided into eight 128KB sectors, which are the smallest erase unit of the internal FLASH. The internal SRAM also has a built-in ECC function, enabling single-bit error correction and double-bit error detection per 32 bits. It is mainly used for loading and running the star sensor program code and storing runtime-related variables.

[0020] Due to limitations in the actual capacity of the internal FLASH memory, a conventional triple-redundancy (2 out of 3) fault-tolerance scheme cannot be adopted. Therefore, in this embodiment, the internal FLASH memory is partitioned and stored according to fixed addresses: one copy of the BOOT startup program, two copies of identical application code, and two copies of identical star table data. The fault-tolerance implementation process of this invention mainly consists of three parts: power-on loading fault-tolerance reading, external SRAM star table dynamic refresh, and internal FLASH data automatic repair. These processes are seamlessly connected and work together to achieve end-to-end fault protection for the star sensor storage system. The specific implementation process is as follows:

[0021] Step 1. Power-on load fault-tolerant read; such as Figure 1 As shown.

[0022] After the star sensor is powered on and reset, the processor first runs the BOOT boot program in the internal FLASH, and then sequentially starts the loading process of the star table and application code. It reads data in 32-byte units and uses the ECC verification function of the internal FLASH to achieve fault detection and hierarchical fault-tolerant reading. The specific steps are as follows:

[0023] Step 11. Load the star catalog data. Starting from the beginning address of the first star catalog, read 32 bytes of star catalog data at a time. If an ECC interrupt is triggered during the reading process, handle it differently according to the interrupt type: If it is determined to be a single-bit error, record the offset address of the 32-byte error area, and use the single-bit error correction function built into the ECC hardware to directly retrieve the 32 bytes of correct star catalog data after error correction. Move the star catalog data to the corresponding address in the external SRAM, and then continue reading the subsequent star catalog data; If it is determined to be a double-bit error, record the offset address of the 32-byte error area, and then switch to the offset address of the second star catalog to read 32 bytes of data. After the data is verified to be correct, move it to the corresponding address in the external SRAM, and then return to the first star catalog to continue reading from the 32nd address after the error offset address. Repeat the above operation until the entire star catalog has been read and moved.

[0024] Step 12. Load Program Code. Following the complete logic of fault-tolerant star table reading described above, read the first piece of application code and move it segment by segment into the internal SRAM with built-in ECC functionality. After the complete program code is moved, the processor jumps to run the program code in the internal SRAM. Even if a portion of the star table or program code experiences partial data corruption, the star sensor can still be guaranteed to start normally and begin operation. Figure 1 As shown, Figure 1 The diagram also illustrates the process of loading the star table and program code; the specific reading process is as follows:

[0025] Step A1. After the star sensor is powered on and reset, the processor will run the BOOT boot program first;

[0026] Step A2. Start the star table loading process: Read the first star table data address by address in 32-byte units, and determine whether an ECC interrupt is triggered; if yes, proceed to step A3; otherwise, proceed to step A5.

[0027] Step A3. Determine whether an ECC single-bit error is triggered. If so, record the offset address of the 32-byte region, and the ECC hardware will automatically complete the error correction. Proceed to step A5. Otherwise, an ECC double-bit error is triggered. After recording the corresponding offset address, switch to reading the 32-byte data at the same offset address in the second star table and proceed to step A4.

[0028] Step A4. Determine if the backup data verification is correct. If yes, proceed to step A5; otherwise, set the data error flag and proceed to step A5.

[0029] Step A5. Move the data to the external SRAM and determine whether the full star table data has been loaded. If so, after the star table is loaded, refer to the same process as the fault-tolerant loading of the star table, read the first piece of program code and move it to the internal ECC SRAM. After the complete code is moved, the processor jumps to run the program, and the star sensor successfully enters the normal working state; otherwise, return to step A2.

[0030] Step 2. Dynamically refresh the external SRAM star table;

[0031] Because the external SRAM lacks ECC verification, it is susceptible to data flipping due to single-event events during on-orbit operation. To completely eliminate this potential fault, the star sensor performs a periodic dynamic refresh operation during idle periods when it is not accessing the external SRAM star table: a fixed refresh cycle of 10 minutes is set. After the cycle ends, the complete process of star table reading, ECC error correction, and data transfer during power-on loading is strictly reused. Standard star table data is retrieved from the internal FLASH and a full-coverage refresh is performed on the star table data in the external SRAM to promptly correct data errors caused by single-event events and ensure that the star table data in the external SRAM remains accurate and reliable at all times. Figure 2 As shown. The specific process of dynamic refresh of the external SRAM star table is as follows:

[0032] Step B1. The star sensor is operating normally in orbit;

[0033] Step B2. The built-in timer starts a 10-minute cycle; determine if the timing cycle has been reached. If yes, proceed to step B3; otherwise, continue with this step.

[0034] Step B3. Determine if the star catalog is in an idle and unused state. If so, automatically start the external SRAM star catalog refresh operation: completely replicate the star catalog reading, ECC classification processing, and data transfer process during power-on loading, retrieve standard star catalog data from internal FLASH, write it to external SRAM with full overwrite, and clear erroneous data caused by single-event upsets; proceed to step B4; otherwise, continue with this step.

[0035] Step B4. Reset the timer to zero and restart the timing cycle to dynamically maintain the satellite catalog data and ensure its continuous accuracy; return to step B2.

[0036] Step 3. Automatic repair of FLASH data;

[0037] After receiving the data repair command, the star sensor automatically repairs the two star catalogs and two program codes stored in its internal FLASH memory, sector by sector, in 128KB units. In this embodiment, taking the repair of the first star catalog as an example, the specific repair process is as follows:

[0038] Step 31. Data Caching and Error Detection: Starting from the beginning address of the first star table, data is read segment by segment in 32-byte units. The read data is cached in the safe storage space of the internal SRAM. The ECC function of the internal SRAM ensures the safety of the cached data. If an ECC interrupt is triggered during the reading process, single-bit errors can be automatically corrected by the ECC hardware. The 32-byte offset address corresponding to the error is recorded synchronously, and the cached data is still valid and usable. Double-bit errors can only be detected and cannot be corrected by hardware. The corresponding 32-byte offset address is also recorded, and the system switches to the offset address of the second star table to read 32 bytes of data. If the read data is verified to be correct, it is cached in the internal SRAM. If the data at the address of the second star table also has a double-bit error (this situation has an extremely low probability of occurring), the 32-byte area is marked as unrepairable. The currently read data is still cached in the internal SRAM, and the system returns to the first star table to continue reading the next group of 32 bytes of data until the data reading and caching of a single 128KB sector is completed.

[0039] Step 32. Sector Erasure and Data Rewriting; After reading the data of a single 128KB sector, check whether there are single-bit or double-bit error records during the sector reading process: If there are no error records, the sector data is determined to be intact and no repair operation is required; if there are error records, the sector data is determined to be corrupted, and the sector repair program is started. First, the 128KB sector is erased, and then the corresponding 128KB of correct data cached in the internal SRAM is rewritten to the corresponding sector address of the first star table in the internal FLASH.

[0040] Step 33. Data Verification and Retry Mechanism: After the data rewrite operation is completed, the sector data verification process is initiated. Starting from the beginning address of the repaired 128KB sector, data is still read in units of 32 bytes. In this step, the system does not switch to the second backup data. The read data is compared with the cached data in the internal SRAM offset address by offset, and the comparison results are recorded throughout the process. If there is no error in the comparison, the sector is determined to be repaired. If at least one error occurs in the comparison, the sector erasure, data rewrite, and data verification operations are repeated. The maximum number of repair retries is 3. If the verification still fails after 3 repairs, the 128KB sector is marked as repaired unsuccessfully.

[0041] Step 34. Full data repair; After repairing a single 128KB sector of the first star table, process the subsequent sectors in sequence according to the above process until the full data of the first star table is repaired; The repair process of the second star table, the first program code, and the second program code is completely consistent with that of the first star table, and finally realizes full-dimensional fault-tolerant repair of the internal FLASH full storage data.

[0042] like Figure 3 As shown, the automated FLASH data repair process is as follows:

[0043] Step C1. Upon receiving the repair instruction from the ground station, the processor immediately initiates the internal FLASH data automated repair process. Taking the first star catalog as an example:

[0044] Step C2. Read the target data in 32-byte units and cache it in the internal SRAM. Determine if an ECC interrupt is triggered. If yes, proceed to step C3; otherwise, proceed to step C4.

[0045] Step C3. Determine if a single-bit error is triggered. If so, perform hardware ECC error correction and record the offset address. Otherwise, it is a double-bit error. Record the offset address, switch to the corresponding address in the second star table (second backup), and read it. If the backup address is still a double-bit error, mark the 32-byte area as unrepairable. Proceed to step C4.

[0046] Step C4. Read the next set of data and determine whether the reading of a single 128KB sector is complete. If yes, proceed to step C5; otherwise, return to step C2.

[0047] Step C5. Determine if there is an error record in the sector. If yes, proceed to step C6; otherwise, proceed to step C9.

[0048] Step C6. Verify the error record, erase the 128KB faulty sector, write the correct data from the internal SRAM cache back to the original sector, and perform data comparison and verification 32 bytes at a time; then proceed to step C7.

[0049] Step C7. Determine if the verification passes. If yes, proceed to step C9; otherwise, retry the repair, with a maximum of 3 retries, and return to step C6. If it still fails after 3 retries, mark the sector repair as failed and proceed to step C9.

[0050] Step C9. Jump to the next sector; determine whether the full data repair is complete. If so, complete the repair of all sectors of the first star table in sequence, and then complete the full repair of the second star table and the two program codes in sequence according to the same process, so as to achieve comprehensive fault repair of the internal FLASH storage data and ensure the long-term stable operation of the star sensor storage system; otherwise, return to step C2.

[0051] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0052] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this invention patent should be determined by the appended claims.

Claims

1. A fault-tolerant implementation method for a star sensor storage system to resist single-event failures, characterized in that: This method is implemented through three parts: power-on loading with fault tolerance, dynamic refreshing of the external SRAM star table, and automatic repair of internal FLASH data. The power-on loading fault-tolerant read process is as follows: After the star sensor is powered on, the BOOT program runs, reading the first star table in 32-byte units. When an ECC interrupt is triggered, if it is a single-bit error, the offset address of the 32-byte error area is recorded, and the corrected data is moved to the external SRAM; if it is a double-bit error, the offset address of the 32-byte error area is recorded, and then the corresponding offset address of the second star table is switched to read 32 bytes of data. The correct data is moved to the external SRAM, and then the process returns to the first star table to continue reading until the star table is loaded. Then, the first program code is read using the same fault-tolerant logic. After the complete program code is moved, the processor runs the program code in the SRAM. The external SRAM star table dynamic refresh process is as follows: when the star sensor is in an idle state where it does not call the star table, the power-on loading fault-tolerant reading process is reused every 10 minutes to read the standard star table data from the internal FLASH and refresh and overwrite the star table data of the external SRAM. The automatic repair process for internal FLASH data is as follows: Upon receiving the repair instruction, the target stored data is read into the internal SRAM cache in units of 32 bytes. If it is a single-bit error, the error correction is completed and the offset address is recorded. If it is a double-bit error, the corresponding offset address of the backup is switched to read. In units of 128KB sectors, if an error is detected, the corresponding sector is erased and the correct data in the internal SRAM cache is written back. After data verification, the repair is completed. The full repair of two star tables and two program codes is completed sector by sector.

2. The fault-tolerant implementation method for a star sensor storage system against single-event failures according to claim 1, characterized in that: In the fault-tolerant implementation method described above, an external SRAM without ECC function is extended to the star sensor processor, and 2MB of FLASH and 864KB of internal SRAM are integrated internally; both the internal FLASH and internal SRAM have built-in ECC function. Each 32 bytes of the internal FLASH corresponds to a 10-bit ECC check bit, enabling single-bit error correction and double-bit error detection. The error location granularity is the starting address of the 32-byte region. The internal FLASH is divided into two independent 1MB blocks, and each 1MB block is divided into eight 128KB sectors, with the sector being the smallest erasure unit. The internal FLASH stores one copy of the BOOT program, two copies of the same program code, and two copies of the same star table at fixed addresses.

3. The fault-tolerant implementation method for a star sensor storage system against single-event failures according to claim 1, characterized in that: During the power-on loading fault-tolerant read process, after the double-bit error is handled, the system returns to the first star table or the first program code and continues reading from the 32nd address after the error offset address until all data is loaded.

4. The fault-tolerant implementation method for a star sensor storage system against single-event failures according to claim 1, characterized in that: During the automatic repair process of internal FLASH data, if a double-bit error also occurs at the address corresponding to the second star table or the second program code, the 32-byte area is marked as unrepairable. The currently read data is still cached in the internal SRAM before continuing to read subsequent data.

5. The fault-tolerant implementation method for a star sensor storage system against single-event failures according to claim 1, characterized in that: In the verification process after the internal FLASH sector is repaired, the repaired target sector data is read and compared address by address with the standard data in the internal SRAM cache, without switching to read backup data.

Images