A high-reliability starting method for a satellite-borne processor D2000V
By employing multi-level storage redundancy and real-time monitoring mechanisms, the reliability of onboard processors under space radiation environments has been addressed, achieving high reliability and autonomous recovery capabilities, and enhancing the continuity and autonomous operation of on-orbit missions.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- THE 54TH RESEARCH INSTITUTE OF CHINA ELECTRONICS TECHNOLOGY GROUP CORPORATION
- Filing Date
- 2026-04-21
- Publication Date
- 2026-07-31
AI Technical Summary
In existing technologies, onboard processors are susceptible to single-event upsets and single-event functional interruptions in the space radiation environment, which can lead to abnormal startup timing, program crashes, and memory data errors. The lack of real-time monitoring and fault-tolerant recovery mechanisms affects mission continuity and on-orbit autonomous operation capabilities.
It adopts multi-level storage redundancy, timing monitoring, verification and fault-tolerant recovery mechanisms, including intrinsic safety measurement, majority voting mechanism and independent power supply design. It improves startup reliability through multi-level storage redundancy and dynamic switching mechanism, and combines FPGA for real-time monitoring and anomaly handling.
It improves the processor's startup reliability and autonomous recovery capability in the space radiation environment, reduces the need for ground intervention, enhances on-orbit autonomous operation capability and radiation resistance, and ensures the system's high reliability and flexibility.
Smart Images
Figure CN122489148A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a highly reliable startup method for a spaceborne processor D2000V, belonging to the field of satellite technology, and is particularly suitable for reliable startup control of processors during spacecraft operation, especially for protection against single-event effects in the space radiation environment. Background Technology
[0002] The D2000V processor in the spacecraft's onboard computer serves as the core computing unit, and its startup reliability directly impacts the success or failure of the entire mission. Current technologies typically employ simple power-on reset or watchdog reset methods for processor startup. However, in the space radiation environment, effects such as single-event upsets and single-event interrupts can lead to startup timing anomalies, program crashes, and memory data errors. Traditional methods lack real-time monitoring, multi-level verification, and fault-tolerant recovery mechanisms for the startup process. If startup fails, ground intervention or a complete satellite reset is required, severely impacting mission continuity and on-orbit autonomous operation capabilities. Summary of the Invention
[0003] To address the problems existing in the above-mentioned background technology, the present invention provides a highly reliable startup method for the spaceborne processor D2000V. Through multi-level storage redundancy, intrinsic safety measurement, timing monitoring, verification and fault-tolerant recovery mechanisms, the startup reliability and autonomous recovery capability of the processor in the space radiation environment are improved, the need for ground intervention is reduced, and the adaptability to the space environment is enhanced.
[0004] The technical solution of this invention is implemented as follows:
[0005] A high-reliability startup method for a spaceborne processor D2000V, characterized by the following steps:
[0006] Procedure 1: System Power-On and Initialization
[0007] After the onboard processor D2000V is powered on, it loads the Uboot program from the Boot memory; Uboot sets the bootargs boot parameters, including parameters such as rootfs_index and isafety; the root key performs intrinsically safe static measurement on Uboot to verify the integrity of the program;
[0008] If the verification fails, the processor sends a feedback identification message to the control FPGA, triggering a system processor reset, restarting the processor startup process, loading the backup boot, and returning the telemetry identification; if the verification passes, the version selection process begins.
[0009] Step 2: Kernel System Version Boot Selection
[0010] During the processor U-boot phase, read the level status of pin GPIO0_B7;
[0011] When GPIO0_B7 is low, the firmware version startup mode is automatically selected; when GPIO0_B7 is high, it waits for a ground remote control command and selects the startup version according to the command.
[0012] Switch to the corresponding memory group (group 1, group 2, group 3) by controlling the FPGA.
[0013] Step 3: System File Loading and Verification
[0014] The processor reads the kernel system files from the selected memory group;
[0015] The processor uses a triple modulo redundancy check algorithm to verify the data in the three Flash memory chips and outputs the correct data through a majority voting mechanism.
[0016] If the verification fails, the system will dynamically switch to the backup storage group to reread the data. If all groups fail the verification, the system will be reset and returned to telemetry, pending reconstruction and maintenance of the kernel and file system.
[0017] Step 4: Kernel Booting and File System Mounting
[0018] Load the kernel into the specified address in DDR memory; start the kernel and mount the corresponding data partition to the / opt directory; extract the application to the / home directory and complete the system boot.
[0019] Step 5: Security Monitoring and Anomaly Handling
[0020] After the application initialization is complete, a start-up completion signal is sent to the control FPGA. The control FPGA firstly sets a watchdog timer, which automatically triggers a system reset if the timeout occurs, and secondly monitors the telemetry information and running status returned by the APP in real time, as well as the running status of the CPU application. During the operation of the processor system, the intrinsically safe module continuously performs dynamic measurements and monitors the running status of the application, thus realizing security monitoring and real-time anomaly handling.
[0021] Furthermore, if an anomaly is detected, in addition to performing corresponding processing according to the anomaly level, an anomaly log is recorded in a non-volatile memory; after the log is transmitted back to the ground, fault analysis is performed.
[0022] Furthermore, during the startup process, the processor controls the FPGA to perform timing monitoring, and sets timeout monitoring for each startup stage. If the startup is not completed within the timeout period, the processor is automatically reset.
[0023] Furthermore, the processor supports on-orbit reconfiguration during or after startup, enabling the reconfiguration of the boot program, kernel, and application programs via ground-based commands, and program burning is completed by controlling the FPGA to switch memory bank channels.
[0024] Furthermore, the intrinsically safe metrics include static and dynamic metrics for Uboot, kernel, and applications. Static metrics are executed when the program is loaded, while dynamic metrics are executed periodically during program execution.
[0025] After the kernel system is installed in the trusted environment, static metrics are used to create a whitelist. Before program execution, the trusted software base agent calculates the hash value of the binary program and dynamic library, compares the calculated hash value with the whitelist, and if they match, program execution is allowed; otherwise, program execution is denied, and a security log is sent via telemetry.
[0026] Dynamic measurement is a continuous trustworthiness measurement performed by a trusted monitoring mechanism during program execution. Upon detecting abnormal measurement, security controls such as stopping or forensics are implemented on untrusted programs.
[0027] Furthermore, the Boot memory uses radiation-hardened Flash memory, with the kernel, applications, etc. stored in three COTS Flash memories, achieving triple redundancy. The memory groups are independently powered and support power isolation.
[0028] Furthermore, the triple redundancy check adopts a bit-data fine-grained majority voting mechanism to output correct data and record the data error location in the processor group. For erroneous data, after the processor starts up successfully, the corresponding memory error data is written back and corrected.
[0029] Furthermore, in the event of a processor boot failure, the FPGA is controlled to receive a remote control command to switch to FPGA reconstruction of the processor boot. The FPGA receives reconstruction data and directly writes data to the boot memory according to the Flash timing sequence. This method can be used for reconstruction when the processor boot fails.
[0030] Furthermore, the processor in this invention can refer to the processor D2000V, and can also be applied to other processors that boot via the SPI interface.
[0031] Compared with the prior art, the advantages of the present invention are as follows:
[0032] 1. High reliability: This invention effectively reduces the risk of startup failure caused by radiation effects such as single-event upsets through a multi-level redundant storage architecture (Boot memory + triple-modular redundant system memory) and a dynamic switching mechanism during the startup process. Single point of failure will not lead to system failure.
[0033] 2. High flexibility: This invention supports automatic selection of the startup version via GPIO level or forced switching via ground command, meeting the needs of different mission scenarios, supporting on-orbit program reconfiguration, and improving system maintenance capabilities.
[0034] 3. High security: This invention adopts an intrinsically safe measurement mechanism to verify the integrity of key programs at each stage of startup, and combines external monitoring to achieve security monitoring and anomaly handling.
[0035] 4. Strong anti-radiation capability: The independent power supply design of the memory in this invention reduces radiation interference; the triple modulo redundancy check algorithm can correct single-event upset errors and improve data reliability. Attached Figure Description
[0036] Figure 1 This is a system composition topology diagram of the present invention.
[0037] Figure 2 This is the overall system startup flowchart of the present invention.
[0038] Figure 3 This is a flowchart of the Uboot kernel boot process of the present invention.
[0039] Figure 4 This is a flowchart of the Boot memory software refactoring process of the present invention. Detailed Implementation
[0040] The following is combined Figure 1 , Figure 2 , Figure 3 , Figure 4 The present invention will be described in detail below.
[0041] A high-reliability boot method for a spaceborne processor D2000V, the system topology of which is as follows: Figure 1 As shown, the onboard processor D2000V connects to five SPI interface memories via a control FPGA: two boot memories (radiation-hardened Flash) and three system memories (each containing three COTS Flash chips, forming a triple-modal redundancy). The control FPGA is responsible for remote control and telemetry information processing, memory group switching control, processor startup control, and operational status monitoring, monitoring the processor's startup and operational status.
[0042] The program storage is divided into five groups: fixed location memory 1, fixed location memory 2, fixed location memory 2, fixed location memory 3, and fixed location memory 4. Memory 1 is used to store the processor boot file, and memory 2 and 3 are used to store the processor system and application files. The memory type adopts the SPI interface form memory. The five memory groups use five SPI buses to avoid the overall memory access failure caused by bus failure.
[0043] Furthermore, the solidified location memory and the injection location memory are powered by different power supply devices, and power-on and power-off control can be performed as needed. During processor operation, the idle memory is powered off to prevent the memory from being affected by space radiation and causing single-event events.
[0044] The overall flowchart of the system startup of this invention is as follows: Figure 2 As shown, the steps are as follows:
[0045] Step 1: The system is powered on. The FPGA detects that the processor power supply is stable and sends a reset pulse. The processor starts up. The processor reads the root key and the external Uboot internally. The root key measures the Uboot. If the measurement is successful, the Uboot is entered. If the measurement fails, the Uboot in the above location memory is started.
[0046] Step 2: After entering Uboot, the Uboot processor parses the kernel boot version based on the remote control information from the FPGA. The CPU selects to boot the kernel version at the fixed location or wait for remote control and telemetry commands from the ground based on the level of GPIO0_B7. The processor reads the kernel system file from the selected memory group.
[0047] Step 3: Start and enter the ramdisk file system; mount the partition corresponding to mtd to the / opt directory, with the mount type being ubi.
[0048] Step 4: Before Uboot boots the kernel, enable the FPGA watchdog timer and then boot into the kernel.
[0049] Step 5: The intrinsically safe static measurement telemetry program is started. Then, the intrinsically safe system performs dynamic measurement on the telemetry program. After the telemetry program runs, it sends a command to the ground indicating that the kernel system has started successfully.
[0050] Step 6: Extract the compressed file in the application software directory under the kernel to the application's running directory.
[0051] Step 7: Intrinsically safe static measurement of application software in the UBI file system. After the measurement is normal, start the application software. Intrinsically safe dynamic measurement of the running application software.
[0052] Step 8: After the application initialization is complete, a startup completion signal is sent to the control FPGA. The startup status monitoring thread begins running and continuously monitors the processor status. It collects error information from all components, counts the number of errors, including correctable and non-correctable errors, reports interrupts, and supports error masking.
[0053] like Figure 3 The diagram shows the Uboot kernel boot process in this invention, which further describes the fault-tolerant processing mechanism during the boot process.
[0054] 1. After the system powers on and enters U-boot, it waits for a certain period of time to obtain the level of the processor's GPIO0_B7. If the level is high, it enters the remote control and telemetry mode, waits for instructions from the ground, and starts different versions of the image and selects to enter the uplink system mode according to the instructions from the ground, and returns telemetry response information, including the current status of the processor; if the level is low, it directly starts the kernel system in the fixed location.
[0055] When 2GPIO0_B7 is low, the flash kernel system is selected, and the processor reads the kernel system file from the selected memory group.
[0056] The processor uses a triple modal redundancy check algorithm to verify the data in the three Flash memory chips, outputs a correct data file, and verifies the file. If the verification fails, it dynamically switches to the backup memory group to reread the data. If all groups fail the verification, it triggers a system reset, returns to telemetry, and waits for the kernel and file system to be reconstructed and maintained.
[0057] The processor performs an intrinsic safety measurement; if the measurement passes, the system starts; if the measurement fails, it actively sends a remote telemetry response frame to the ground and then enters remote telemetry mode to wait for ground instructions.
[0058] 3. In remote telemetry mode, if the ground sends an uplink command, a kernel and application software refactoring process will be initiated. After the system files are refactored, intrinsic safety measurement will be started. If the intrinsic safety measurement is successful, the kernel system and application software will be started. If the intrinsic safety measurement fails, it will continue to wait for ground commands and send back a remote telemetry response message to the ground, including error codes and the current status.
[0059] 4. In remote telemetry mode, if the ground sends a command to select the Flash version for startup, depending on whether the command is to start the pre-installed version or the fixed version, the system will start tri-mode redundancy and intrinsic safety measurement. If the intrinsic safety measurement is successful, the system will start. If the intrinsic safety measurement fails, the failure will be recorded and the system will continue to wait for the ground command. If the startup fails or succeeds, a remote telemetry response message will be sent back to the ground.
[0060] The triple redundancy check adopts a bit-data fine-grained majority voting mechanism to output correct data and record the data error locations in the processor group. For erroneous data, after the processor starts up successfully, the corresponding memory error data is written back and corrected to achieve autonomous memory error correction.
[0061] 5. After loading and verifying the kernel system and application software related files into DDR, Uboot enables the watchdog function in the FPGA before starting the kernel to monitor the CPU running status. If the timeout occurs, the system is reset.
[0062] The flowchart of the Boot memory software reconfiguration process in this invention is as follows: Figure 4 As shown, the process is further described below.
[0063] Before reconstructing the software in the boot memory, the ground sends the boot flash command to the control FPGA to be reconstructed, and waits for a successful switch. The control FPGA detects the switch response signal through the GPIO0_A2 pin. After the control FPGA successfully switches the boot flash channel, the ground receives the response information from the control FPGA and uploads the boot data to the processor through the upload channel. The processor receives the reconstructed boot data and verifies its integrity, erasing the corresponding MTD0 partition; it writes the reconstructed boot data into the boot flash to be reconstructed, performing data verification during the data writing process to ensure data correctness; after the ground confirms successful reconstruction, it sends a command to the control FPGA to switch back to the original boot flash channel, completing the boot reconstruction process, and transmits the reconstruction result via telemetry.
[0064] Furthermore, in the event of a processor boot failure, data reconstruction of the boot memory is required. The FPGA is controlled to receive and switch remote control commands, allowing the FPGA to reconstruct the processor boot process. When using FPGA reconstruction, the reconstructed data does not need to pass through the processor; the FPGA caches the data and directly performs read, write, and verification functions on the memory. This reconstruction method is highly reliable and can be used to reconstruct the processor in the event of a boot failure.
Claims
1. A high-reliability starting method for a spaceborne processor D2000V, characterized by, Includes the following steps: After the system is powered on, the Uboot program is loaded from the Boot memory and intrinsic safety static measurement is performed; The startup version is selected based on the GPIO level or ground command, and the corresponding memory group is switched via the FPGA. The system file is read using a triple modulo redundancy check algorithm, and the kernel is loaded after the check passes. After the kernel boots, it mounts the file system and starts the application. The system performs dynamic measurements and hardware watchdog monitoring during operation.
2. The high-reliability starting method of a spaceborne processor D2000V according to claim 1, characterized by, The boot memory uses radiation-hardened Flash memory. The kernel system and application software data are stored in three sets of COTS Flash memory. Each set contains three memory chips to form a three-mode redundancy. The memory sets are powered independently and support power isolation.
3. The high-reliability starting method of a spaceborne processor D2000V according to claim 1, characterized by, The intrinsically safe metrics include static and dynamic metrics for Uboot, kernel, and applications. Static metrics are executed when the program is loaded, while dynamic metrics are executed periodically during program execution.
4. The high-reliability starting method of a spaceborne processor D2000V according to claim 1, characterized by, The triple redundancy check adopts a bit-data fine-grained majority voting mechanism, outputs a correct data file, verifies the file, records the data error location in the processor group, and for the erroneous data, after the processor starts up successfully, writes back and corrects the corresponding memory error data. If the verification fails, the system will dynamically switch to the backup memory group to reread the data. If all groups fail the verification, the system will be reset.
5. The high-reliability starting method of a spaceborne processor D2000V according to claim 1, characterized by, It supports reconstructing the Boot program or system program via ground-based commands. The program is burned after the FPGA switches the Flash channel. The Boot and kernel system data are reconstructed separately and reconstructed independently. When the processor fails to start, the U-boot data is reconstructed by controlling the FPGA.
6. The high-reliability starting method of a spaceborne processor D2000V according to claim 1, characterized by, During the startup process, the processor performs timing monitoring and sets timeout monitoring for each startup stage. If the startup is not completed within the timeout period, the processor is automatically reset.
7. The high-reliability startup method for a spaceborne processor D2000V according to claim 1, characterized in that, After the kernel system is installed in the trusted environment, static measurement is performed. The kernel system creates a whitelist. Before the program is executed, the trusted software base agent calculates the HASH value of the binary program and dynamic library, compares the calculated HASH value with the whitelist. If they match, the program is allowed to execute. If they do not match, the program is rejected and a security log is sent through the telemetry function. Dynamic measurement is a continuous trustworthiness measurement performed by a trusted monitoring mechanism during program execution. Upon detecting abnormal measurement, security controls are implemented to stop or obtain evidence for untrusted programs.