High-reliability on-board intelligent computer and fault-tolerant control method and system
By introducing highly reliable onboard intelligent computer hardware and a multi-level fault-tolerant computing system, combined with Hypervisor, Docker, DDS and K3s technologies, the problems of the contradiction between computing power and cost of onboard computers, the imperfect fault tolerance system and low fault recovery efficiency have been solved, achieving high computing power, low cost and fast fault recovery.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- HARBIN ENG UNIV
- Filing Date
- 2026-04-28
- Publication Date
- 2026-07-24
AI Technical Summary
Existing spaceborne computers suffer from problems such as a conflict between computing power and cost, insufficient utilization of computing power, imperfect fault tolerance system, and low fault recovery efficiency.
It adopts highly reliable spaceborne intelligent computer hardware, a multi-level system fault-tolerant computing system, and a rapid fault recovery system, including the use of domestic automotive-grade SoC chips, anti-fuse FPGA chips, dual redundant power supply design, Hypervisor, Docker, DDS and K3s technologies, to achieve fault tolerance at the chip and circuit level, board level, system level, single machine level and cluster level, and to achieve rapid fault recovery through differentiated response measures.
Without compromising reliability, we can improve intelligent computing power, reduce costs, achieve second-level recovery from single-bit errors and seamless switching in case of node failure, enhance system fault tolerance, achieve a fault recovery time of less than 1 second, and achieve a computing power redundancy of 99.99%.
Smart Images
Figure CN122450719A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of spaceborne intelligent computer technology, and more specifically, to a highly reliable spaceborne intelligent computer and a fault-tolerant control method and system. Background Technology
[0002] With the deepening research on AI models and the successful deployment of various AI models on spacecraft, on-board missions can now be handled by AI to achieve intelligent task processing. Onboard intelligent computers play a crucial role in space missions. Traditional onboard computers use aerospace-grade chips with significantly lower computing power than automotive-grade chips, and their cost is nearly a hundred times higher, making it difficult to meet the demands of high computing power and large-scale constellation deployment (the core design goal of aerospace-grade chips is reliable operation in the extremely harsh space environment, not the pursuit of ultimate computing power). Existing onboard computers employ a "distributed computing architecture (relying on multiple 'small' computing units working collaboratively)," failing to pool computing resources. Heterogeneous computing power operates independently, making dynamic task allocation difficult and resulting in low computing power utilization.
[0003] Furthermore, existing spaceborne computer fault tolerance systems are inadequate. Fault tolerance designs are mostly concentrated on "board-level redundancy (backing up critical boards in the system so that when a working motherboard fails, the backup board can quickly take over, ensuring the entire system remains uninterrupted)," lacking end-to-end verification for space single-event effects and a hot-standby dual-system rapid switching mechanism. System recovery time after a crash exceeds 10 seconds. Simultaneously, traditional spaceborne software adopts a "monopolistic deployment" model, resulting in low fault recovery efficiency; a failure of a single functional module can cause the entire software and even the operating system to crash. Fault detection relies on ground commands, recovery processes require manual intervention, and service interruption times are generally long, making it difficult to meet the real-time mission requirements of disaster monitoring, autonomous navigation, and other tasks. Summary of the Invention
[0004] The technical problem to be solved by this invention is:
[0005] In order to address the problems faced by existing spaceborne computers, such as the contradiction between computing power and cost, insufficient computing power utilization, imperfect fault tolerance system, and low fault recovery efficiency.
[0006] The technical solution adopted by the present invention to solve the above-mentioned technical problems is as follows:
[0007] This invention provides a highly reliable spaceborne intelligent computer and a fault-tolerant control method, including highly reliable spaceborne intelligent computer hardware, a multi-level system fault-tolerant computing architecture, and a rapid fault recovery system.
[0008] The high-reliability spaceborne intelligent computer hardware includes two intelligent computing boards, one main control board, and one power supply board mounted on the base plate.
[0009] The multi-level system fault-tolerant computing architecture applies Hypervisor, Docker, DDS and K3s technologies to achieve chip and circuit level fault tolerance, board level fault tolerance, system level fault tolerance, single machine level fault tolerance and cluster level fault tolerance;
[0010] The rapid fault recovery system matches differentiated response measures for different levels of faults; the rapid fault recovery system includes rapid recovery response for neglect-level faults, rapid recovery response for software-level faults, rapid recovery response for system-level faults, rapid recovery response for module-level faults, rapid recovery response for single-machine-level faults, and rapid recovery response for cluster-level faults.
[0011] Furthermore, the intelligent computing board is equipped with a domestically produced automotive-grade SoC chip, the Optical-to-R1 chip.
[0012] Furthermore, the main control board uses an antifuse FPGA chip to independently control the power-on and power-off of the intelligent computing board, receive the watchdog signal from the intelligent computing board at 10ms intervals, and trigger the power-off and restart of the intelligent computing board after a 30ms timeout.
[0013] Furthermore, the power supply board uses a dual-redundant DC-DC converter based on the SpaceVPX internal bus standard.
[0014] Furthermore, the implementation method of the multi-level system fault-tolerant computing architecture includes,
[0015] The circuit-level fault-tolerant implementation method involves the optical-to-R1 chip detecting and correcting single-event error through ECC memory verification, bus parity verification, and lockstep core calculation comparison.
[0016] The board-level fault tolerance implementation method uses LPDDR5 ECC memory to detect and correct single-bit errors; uses large-capacity UFS storage files for data recovery; the power board has a dual redundancy design to ensure that a single failure does not affect the normal operation of a single machine; and the power components are placed independently in the power board to reduce EMC interference to other boards.
[0017] The system-level fault tolerance implementation method uses a Type-1 Hypervisor to run two Linux systems, a primary system and a backup system, on the optical-to-R1 chip. The primary system runs business containers, while the backup system loads the core task image and stands by. If the primary system crashes, the system will switch to the backup system within 300ms.
[0018] The single-machine level fault tolerance implementation method is as follows: under normal operation, both intelligent computing boards run in 50W mode; when the first intelligent computing board fails, the main control board controls the second intelligent computing board to switch to 100W mode, and at the same time, the K3s orchestration system starts the backup container on the second intelligent computing board within 500ms and synchronizes historical data through the DDS middleware.
[0019] The cluster-level fault tolerance implementation method involves multiple onboard intelligent computers forming a cluster through QSFP optical ports, and realizing dynamic scheduling of computing power based on K3s technology. When a single machine fails, the task is allocated to an idle single machine.
[0020] Furthermore, the implementation method of the rapid fault recovery system includes,
[0021] For fault-level fast recovery in the cache, DDR and bus areas, which are verifiable recoverable or unrepairable but have no impact, the system automatically repairs or ignores them and logs them.
[0022] Rapid recovery from software-level faults is based on Docker containers, using K3s technology for container orchestration, and relying on the DDS message middleware for intra-board or inter-board interaction. When a single service crash causes an image to exit, a new image is started within 50ms to take over using K3s technology. If DDS is normal, rapid recovery from negligible faults is achieved based on historical data. Multiple identical images are started and used in conjunction with individual images for voting output to avoid task interruption caused by data errors in a single image.
[0023] Rapid recovery from system-level failures employs a Type-1 Hypervisor running dual operating systems on the same SoC. When the Hypervisor detects a primary system crash, it switches to the backup system within 300ms. The backup system takes over the work by calling historical data through DDS. After the original crashed primary system restarts, it becomes the backup system and stands by.
[0024] The rapid recovery of board-level faults is controlled by the main control module card. When the dog feeder malfunctions, it is powered off and restarted. At the same time, another module is put into high computing power mode and the corresponding task image is started in combination with DDS to take over the work. After the faulty module is recovered, both modules return to normal.
[0025] Rapid recovery from single-machine failures: In scenarios involving multiple single-machine task clusters with the same functionality, the single machines are connected via a 10G network and share data based on the DDS communication middleware. K3s technology is used to orchestrate tasks on each single machine, and all programs run in container images using a microservice model. When a single machine fails, its tasks can be automatically taken over by the other single machines.
[0026] Rapid recovery from cluster-level failures is achieved by using multiple single machines on the satellite to form a cluster. When some single machines fail completely or partially, K3s technology automatically uses the idle computing resources of the remaining single machines to take over.
[0027] A highly reliable spaceborne intelligent computer and fault-tolerant control system is provided. The system has program modules corresponding to the above steps and executes the steps in the above-described highly reliable spaceborne intelligent computer and fault-tolerant control method when running.
[0028] A computer-readable storage medium storing a computer program configured to implement, when invoked by a processor, the steps of a highly reliable spaceborne intelligent computer and a fault-tolerant control method.
[0029] Compared with the prior art, the beneficial effects of the present invention are:
[0030] This method introduces domestically produced automotive-grade high-performance SoC chips as the computing core of the onboard computer, improving intelligent computing power and reducing costs without compromising the reliability of the onboard computer, providing up to 500 TOPS of deep learning computing power. Simultaneously, it employs a multi-layered fault-tolerant computing architecture. Based on the use of chips and hardware designs with error correction capabilities, it combines Hypervisor, Docker, DDS, and K3s technologies, and utilizes cloud-native and microservice design concepts to construct a comprehensive fault-tolerant system from chip to cluster. This ensures second-level recovery from single-bit errors and seamless switching in case of node failure, ultimately achieving a 99.99% error detection rate and computing power redundancy under 50% node failure, further enhancing the system's fault tolerance.
[0031] In addition, the rapid fault recovery design ensures that when a random fault occurs in the system, the built-in fault management unit can manage the fault through error correction and detection mechanisms, and perform fault recovery or fault reporting through software and hardware security protection mechanisms, with the system's reliable recovery time being less than 1 second. Attached Figure Description
[0032] Figure 1 This is a structural diagram of the high-reliability spaceborne intelligent computer hardware in an embodiment of the present invention;
[0033] Figure 2 This is a structural diagram of the intelligent processing board in an embodiment of the present invention;
[0034] Figure 3 This is a structural diagram of the main control board in an embodiment of the present invention;
[0035] Figure 4 This is a block diagram of the power supply board in an embodiment of the present invention;
[0036] Figure 5This is a schematic diagram of the base plate interface connection in an embodiment of the present invention;
[0037] Figure 6 This is a flowchart of the multi-level system fault-tolerant calculation architecture in an embodiment of the present invention. Detailed Implementation
[0038] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.
[0039] Specific Implementation Plan 1: Combining Figures 1 to 6 As shown, this invention provides a highly reliable spaceborne intelligent computer and a fault-tolerant control method, including highly reliable spaceborne intelligent computer hardware, a multi-level system fault-tolerant computing architecture, and a rapid fault recovery system.
[0040] Combination Figure 1 As shown, the high-reliability spaceborne intelligent computer hardware includes two intelligent computing boards, one main control board, and one power supply board mounted on the baseboard. The baseboard is a 3U board with a VPX interface. The standardized and universal boards can be configured with any number of intelligent processing modules to expand computing power, and their working modes can be set to simultaneous operation, hot standby, or cold standby. The boards support high-speed interconnection using PCIe and 10G network interfaces.
[0041] in,
[0042] Combination Figure 2As shown, the intelligent computing board is equipped with the domestically produced automotive-grade SoC chip, Guangzhi R1, manufactured using the N7A 7nm automotive-grade process. It integrates up to 45 billion transistors and features an 8-core SIMT architecture neural network accelerator, providing over 500 TOPS of computing power. It also has a 24-core ARM A78AE processor, providing over 420kDMIPS of CPU computing power, and 1TFLOPS of GPU computing power, placing its overall performance at an industry-leading level. It exposes standard interfaces such as PCIe, 10G ETH, and UART through the VPX interface; RJ45, UART, JTAG, RS422, and GPIO interfaces through the J30J-51 connector interface; external data input / output interfaces through the QSFP optical module interface; and a USB Type-C interface for use during the debugging phase. The board features an M.2 NVMe interface for adding a solid-state drive; the intelligent computing board provides intelligent computing power for a single machine, offering 200 TOPS of computing power at an average power consumption of 50W and 400 TOPS at 100W; the optical-to-R1 chip incorporates ECC memory verification and a lockstep core mechanism to correct single-bit flip (SEU) errors, and the functional safety island meets ASIL-D functional safety level, while the optical-to-R1 chip as a whole meets ASIL-B functional safety level.
[0043] Combination Figure 3 As shown, the main control board uses an antifuse FPGA chip to independently control the power-on and power-off of the intelligent computing board, receive the 10ms interval watchdog signal from the intelligent computing board, and trigger the intelligent computing board to power off and restart after a 30ms timeout. The antifuse FPGA chip is connected to a DDR4 cluster and a Flash cluster. Externally, the antifuse chip supports CAN bus for information communication and provides J30J-51 connectors supporting GPIO and UART for connection to the satellite bus. Internally, the antifuse FPGA chip connects to control the power-on and power-off of other single boards and forwards remote control and telemetry information through the UART and GPIO interfaces brought out by the VPX. The Flash cluster on the board can store programs for the antifuse chip and other single boards.
[0044] Combination Figure 4As shown, the power supply board uses a dual-redundant DC-DC converter based on the SpaceVPX internal bus standard. In the event of a single DC-DC failure, it meets the requirements of an open system architecture for a highly reliable, high-power-density power supply system. The secondary power module, as a core component, undertakes the critical task of converting the external 30V bus voltage to 12V system power, achieving an output power level of 240W@12V, meeting the power density requirements of the VPX backplane bus. It adopts a dual-channel redundant architecture with a total output power of 240W, meeting aerospace derating requirements. The parallel power supply system consists of two independently operating DC / DC converters, ensuring that even if one DC-DC device fails, it can still meet the 120W power supply requirement for the entire unit. This converter model has the following technical characteristics: input voltage range 20-50VDC, rated output 12V / 10A (single channel 120W), conversion efficiency ≥88%, operating temperature range -55℃ to +125℃, and complies with MIL-STD-461 electromagnetic compatibility standards.
[0045] Combination Figure 5 As shown, the VPX baseboard serves as a high-speed communication channel between the main control module and the intelligent processing module, and supplies power to the other three boards via a power supply board. It enables high-speed interconnection between the intelligent computing board, the main control board, and the power supply board. The intelligent processing modules exchange data via the baseboard's PCIe x4 interface and 10G Ethernet port. The VPX baseboard provides two sets of PCIe x4 interfaces, two sets of UART interfaces, one 10G Ethernet port, and one high-speed data port for the current layout. It also provides GPIO and UART interfaces for the FPGA. The baseboard connects to the four boards via the VPX interface, and the power supply board provides a stable 12V voltage to the other three modules through the baseboard's VPX interface. The main control board manages the two intelligent processing boards and assigns tasks to them via the baseboard's two sets of UART interfaces.
[0046] Combination Figure 6 As shown, the multi-layered system fault-tolerant computing architecture comprehensively applies Hypervisor, Docker, DDS and K3s technologies, and uses cloud-native and microservice design concepts to improve the fault tolerance capability of the multi-layered system from "circuit-board-system-single machine-cluster".
[0047] Specifically, including,
[0048] Chip and circuit-level fault tolerance implementation method: The optical-to-R1 chip achieves single-event error detection and correction through ECC memory verification, bus parity verification, and lockstep core calculation comparison; the intelligent processing board is equipped with the optical-to-R1 chip, which adopts a hardware and software collaborative diagnostic strategy to achieve comprehensive fault detection coverage; the optical-to-R1 chip integrates multi-level hardware diagnostic functions, including hardware units specifically designed for fault detection (such as the lockstep processing mechanism of the FSI R52 core), redundant backup of safety-critical modules, memory error correction code ECC, CAN bus CRC verification, CPU machine check for anomalies, and on-chip bus protocol monitoring; the optical-to-R1 chip uses ECC technology to protect memory on all RAMs affecting functionality during its design; LPDDR itself has built-in Inline ECC to protect stored data, while Link ECC protects the data and address of the transmission path; the optical-to-R1 chip's bus adopts a combination of Parity and ECC: Parity protects the data path and data on AHB / APB, while ECC protects the data, address, and transmission path;
[0049] Board-level fault tolerance implementation methods: LPDDR5 ECC memory is used to detect and correct single-bit errors; large-capacity UFS is used to store multiple complete files (system, program, data, etc.) for data recovery; the power supply board has a dual redundancy design, and the failure of a single circuit does not affect the normal operation of a single machine; power supply components are placed independently in the power supply board to reduce EMC interference to other boards;
[0050] System-level fault tolerance implementation method: A Type-1 Hypervisor is used to run two Linux systems, a primary and a backup, on the optical-to-R1 chip. The primary system runs the business container, while the backup system loads the core task image and is ready to go. In the event of a primary system crash, the system switches to the backup system within 300ms. A built-in self-test (BIST) performs a full address scan of the RAM during system startup or idle periods to detect fixed faults (such as stuck-at-0 / 1) and dynamic faults (such as data retention failure). SEC-DED (Single Error Correction, Double Error Detection) ECC technology is used to generate a checksum for each 64 / 128-bit data block, correcting single-bit errors in real time and alerting to multi-bit errors. Management software is deployed within the system to monitor the operating system and other application software. Application software is started by the management software, which performs a full check on each application before starting it. Integrity verification; the management software periodically runs file scanning tasks to verify the integrity of important files within the system. If a file is corrupted, it is repaired using a 2 / 3 out of 3 approach. The management software is the existing software, which receives and parses remote control commands via serial port and forwards commands and receives status information from the computing program via network port. It performs device management functions such as switching computing program versions and switching between primary and backup systems, and periodically collects its own status, packages telemetry data in a fixed format, and transmits it back via serial port, meeting the reliable, offline, and secure management requirements of single-machine devices. Docker containers are used for software deployment to achieve fault tolerance and isolation. Hypervisor technology is used to run dual systems, one of which is in hot standby mode. When one system fails, the other system automatically takes over. The intelligent processing board supports on-orbit OTA technology, which can update container images, programs, and other data on-orbit.
[0051] Single-machine-level fault tolerance implementation method: Under normal operation, both intelligent computing boards run in 50W mode; when the first intelligent computing board fails, the main control board controls the second intelligent computing board to switch to 100W mode, and at the same time, the K3s orchestration system starts the backup container on the second intelligent computing board within 500ms, synchronizing historical data through the DDS middleware; the two intelligent boards interact with each other at high speed through PCIe and ETH interfaces, enabling rapid data flow, and supporting both boards to receive the same data simultaneously through external optical ports. The failure of part or all of one board will not cause the loss of the entire single-machine data input; the main control board acts as the control center of the entire single machine, controlling the power-on and power-off of the intelligent computing boards, and acting as an external watchdog, etc.; the single machine supports on-orbit injection and remote control command configuration functions; more intelligent computing boards can be installed to achieve cold standby function;
[0052] Cluster-level fault tolerance implementation method: Multiple onboard intelligent computers form a cluster through QSFP optical ports, use DDS communication middleware for inter-machine communication, and implement dynamic scheduling of computing power based on K3s to deal with the problem of a task image crash. When a single machine fails, the task is assigned to an idle single machine; it supports multi-machine mutual backup. When a single machine fails, K3s will automatically call on the backup single machine or idle computing power in the cluster to fill the gap.
[0053] The rapid fault recovery system matches differentiated response measures for different levels of faults;
[0054] Specifically, including,
[0055] The ignore-level fault fast recovery is for verifiable recoverable or unrepairable but non-impactful errors in areas such as cache, DDR, and bus. The system will automatically repair or ignore the errors and record them in the log.
[0056] Rapid software-level fault recovery is based on Docker containers, using K3s for container orchestration and relying on the DDS message middleware for intra-board or inter-board interaction. When a single service crash causes an image to exit, K3s can start a new image to take over within 50ms, with the entire recovery process taking approximately 100ms. If DDS is functioning normally, "seamless recovery" can be achieved using historical data. For critical tasks, multiple identical images can be started simultaneously, with separate images used for voting output to avoid task interruption due to data errors in a single image. In this mode, the fault recovery time is 0.
[0057] Rapid recovery from system-level failures employs a Type-1 Hypervisor running dual operating systems on the same SoC. One system is in hot standby mode, loading partial task images and remaining in standby mode without performing any tasks. When the Hypervisor detects a primary system crash, it switches to the standby system within 300ms. The standby system takes over the work by calling historical data through DDS, thus ensuring that the single machine recovers from the system-level failure. The overall recovery time is approximately 800ms. After the original crashed primary system restarts, it becomes the standby system in standby mode.
[0058] Rapid recovery from module-level faults is controlled by the main control module (which also functions as an external watchdog). The main control module within a single machine can independently control the power-on and power-off of each intelligent processing module, and it also acts as an external watchdog for these modules. When a module experiences a watchdog malfunction, it is powered off and restarted. Simultaneously, another module enters a high-computing-power mode and initiates the corresponding task image combined with DDS to take over the work. Once the faulty module recovers, both modules can return to normal operation. In other words, when a particular intelligent processing module experiences a watchdog malfunction, the main control module will power off and restart it, while simultaneously controlling another module via remote control commands. Once the module enters high-computing-power mode, its energy consumption will increase from no more than 50W to no more than 100W, and its computing power will increase from approximately 200 TOPS to 400 TOPS. It will also launch the corresponding task image, combined with DDS, to take over the work of the crashed module. The entire process can be completed within 800ms (300ms for module computing power increase + 500ms for container startup and task takeover). After the crashed module recovers and restarts, the main control module will automatically or according to ground remote control commands restore both modules to normal operating status.
[0059] Single-machine-level rapid fault recovery response measures: In scenarios involving multiple single-machine task clusters with identical functions, the single machines are connected via a 10G network, share data based on the DDS communication middleware, and K3s orchestrates tasks on each single machine. All programs run in container images using a microservice model. When a single machine fails, its tasks can be automatically taken over by the remaining single machines, with the entire process taking less than 1 second.
[0060] Cluster-level fault rapid recovery response measures: If the satellite is equipped with multiple single machines to form a cluster, when some single machines fail completely or partially, the principle is the same as that of single machine-level failure. K3s will automatically call the idle computing resources of the remaining single machines to take over, and the task recovery time is less than 1 second.
[0061] Specific Implementation Scheme 2: The present invention provides a highly reliable spaceborne intelligent computer and fault-tolerant control system. The system has program modules corresponding to the above steps, and executes the steps in the above-mentioned highly reliable spaceborne intelligent computer and fault-tolerant control method when running.
[0062] The other combinations and connections in this implementation scheme are the same as in Specific Implementation Scheme 1.
[0063] Specific Implementation Scheme 3: The present invention provides a computer-readable storage medium storing a computer program configured to implement, when called by a processor, the steps of a highly reliable spaceborne intelligent computer and a fault-tolerant control method.
[0064] The other combinations and connections in this implementation scheme are the same as in Specific Implementation Scheme 1.
[0065] While the present invention has been disclosed above, its scope of protection is not limited thereto. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention, and all such changes and modifications will fall within the scope of protection of the present invention.
Claims
1. A highly reliable spaceborne intelligent computer and a fault-tolerant control method, characterized in that: This includes highly reliable spaceborne intelligent computer hardware, a multi-layered system fault-tolerant computing architecture, and a rapid fault recovery system. The high-reliability spaceborne intelligent computer hardware includes two intelligent computing boards, one main control board, and one power supply board mounted on the base plate. The multi-level system fault-tolerant computing architecture applies Hypervisor, Docker, DDS and K3s technologies to achieve chip and circuit level fault tolerance, board level fault tolerance, system level fault tolerance, single machine level fault tolerance and cluster level fault tolerance; The rapid fault recovery system matches differentiated response measures for different levels of faults; The rapid fault recovery system includes rapid recovery response for neglect-level faults, rapid recovery response for software-level faults, rapid recovery response for system-level faults, rapid recovery response for module-level faults, rapid recovery response for single-machine-level faults, and rapid recovery response for cluster-level faults.
2. The highly reliable spaceborne intelligent computer and fault-tolerant control method according to claim 1, characterized in that: The intelligent computing board is equipped with the domestically produced automotive-grade SoC chip, the Optical R1 chip.
3. The highly reliable spaceborne intelligent computer and fault-tolerant control method according to claim 2, characterized in that: The main control board uses an antifuse FPGA chip to independently control the power-on and power-off of the intelligent computing board, receive the watchdog signal from the intelligent computing board at 10ms intervals, and trigger the power-off and restart of the intelligent computing board after a 30ms timeout.
4. The highly reliable spaceborne intelligent computer and fault-tolerant control method according to claim 3, characterized in that: The power supply board uses a dual-redundant DC-DC converter based on the SpaceVPX internal bus standard.
5. The highly reliable spaceborne intelligent computer and fault-tolerant control method according to claim 4, characterized in that: The implementation method of the multi-level system fault-tolerant computing architecture includes, The circuit-level fault-tolerant implementation method involves the optical-to-R1 chip detecting and correcting single-event error through ECC memory verification, bus parity verification, and lockstep core calculation comparison. The board-level fault tolerance implementation method uses LPDDR5 ECC memory to detect and correct single-bit errors; Large-capacity UFS storage is used for file storage to facilitate data recovery; the power supply board features a dual-redundancy design to ensure that a single circuit failure does not affect the normal operation of a single machine. The power supply components are placed independently in the power supply board to reduce EMC interference to other boards; The system-level fault tolerance implementation method uses a Type-1 Hypervisor to run two Linux systems, a primary system and a backup system, on the optical-to-R1 chip. The primary system runs business containers, while the backup system loads the core task image and stands by. If the primary system crashes, the system will switch to the backup system within 300ms. The single-machine level fault tolerance implementation method is as follows: under normal operation, both intelligent computing boards run in 50W mode; when the first intelligent computing board fails, the main control board controls the second intelligent computing board to switch to 100W mode, and at the same time, the K3s orchestration system starts the backup container on the second intelligent computing board within 500ms and synchronizes historical data through the DDS middleware. The cluster-level fault tolerance implementation method involves multiple onboard intelligent computers forming a cluster through QSFP optical ports, and realizing dynamic scheduling of computing power based on K3s technology. When a single machine fails, the task is allocated to an idle single machine.
6. The highly reliable spaceborne intelligent computer and fault-tolerant control method according to claim 5, characterized in that: The implementation method of the aforementioned rapid fault recovery system includes, For fault-level fast recovery in the cache, DDR and bus areas, which are verifiable recoverable or unrepairable but have no impact, the system automatically repairs or ignores them and logs them. Rapid recovery from software-level faults is based on Docker containers, using K3s technology for container orchestration, and relying on the DDS message middleware for intra-board or inter-board interaction. When a single service crash causes an image to exit, a new image is started within 50ms to take over using K3s technology. If DDS is normal, rapid recovery from negligible faults is achieved based on historical data. Multiple identical images are started and used in conjunction with individual images for voting output to avoid task interruption caused by data errors in a single image. Rapid recovery from system-level failures employs a Type-1 Hypervisor running dual operating systems on the same SoC. When the Hypervisor detects a primary system crash, it switches to the backup system within 300ms. The backup system takes over the work by calling historical data through DDS. After the original crashed primary system restarts, it becomes the backup system and stands by. The rapid recovery of board-level faults is controlled by the main control module card. When the dog feeder malfunctions, it is powered off and restarted. At the same time, another module is put into high computing power mode and the corresponding task image is started in combination with DDS to take over the work. After the faulty module is recovered, both modules return to normal. Rapid recovery from single-machine failures: In scenarios involving multiple single-machine task clusters with the same functionality, the single machines are connected via a 10G network and share data based on the DDS communication middleware. K3s technology is used to orchestrate tasks on each single machine, and all programs run in container images using a microservice model. When a single machine fails, its tasks can be automatically taken over by the other single machines. Rapid recovery from cluster-level failures is achieved by using multiple single machines on the satellite to form a cluster. When some single machines fail completely or partially, K3s technology automatically uses the idle computing resources of the remaining single machines to take over.
7. A highly reliable spaceborne intelligent computer and fault-tolerant control system, characterized in that: The system has a program module corresponding to the steps of any one of the claims 1-6 above, and executes the steps in the above-described highly reliable spaceborne intelligent computer and fault-tolerant control method when running.
8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program configured to, when invoked by a processor, implement the steps of any one of claims 1-6: a highly reliable spaceborne intelligent computer and a fault-tolerant control method.