On-orbit storage data recovery method, device, equipment and medium

Abstract

The present application relates to a method, device, equipment and medium for recovering data in orbit storage, and belongs to the technical field of data processing. The method comprises the following steps: dividing an independent recovery area; determining a trigger timing of data correctness verification, and performing correctness verification after key data reading is completed; reading three pieces of data stored in three modes to perform consistency verification, if there is at least one piece of abnormal data, constructing recovery data based on the majority consistent correct data, obtaining an address to be recovered, and storing the recovery data and the address to be recovered in the recovery area in association; detecting the recovery area, if there is data to be recovered, reading the recovery data and the address to be recovered, writing the recovery data after erasing the error data, and erasing the processed data in the recovery area; repeating the step until there is no data to be recovered in the recovery area, and then entering a normal working process; if there is no data in the recovery area, directly entering the normal working process. The present application can actively repair abnormal data in data storage to eliminate the risk of error accumulation.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, apparatus, device, and medium for recovering data stored in orbit. Background Technology

[0002] With the rapid development of aerospace technology, the functions of on-orbit payloads are becoming increasingly complex. The reliable storage of core data such as key parameters, configuration information, and status data generated during their operation directly determines the payload's on-orbit lifespan and mission success rate. Currently, the industry generally adopts a combination of hardware and software hardening methods to ensure the security of critical data. At the software level, data fault tolerance is achieved through a triple-modulus redundancy storage mechanism, while at the hardware level, the radiation resistance of storage chips such as FLASH and MRAM is utilized to resist interference from the space environment. This ensures that the data actually used by the payload can remain correct through AND / OR verification of the triple-modulus data.

[0003] However, this traditional approach only achieves "passive voting output" of data. When a single-event upset (SWE) causes an anomaly in one of the three-mode storage data, the system will only select the correct data for current use and will not perform any repair operations on the erroneous data already existing in the storage medium. This means that the errors caused by the SWE will be permanently retained in the storage medium. As the on-orbit operation time increases, SWE events accumulate. When two modes of the same data are simultaneously abnormal, the three-mode verification mechanism will completely fail, leading to critical data anomalies and bringing unpredictable systemic risks to payload operation. Summary of the Invention

[0004] Therefore, it is necessary to provide an on-orbit storage data recovery method, apparatus, device, and medium that can proactively repair abnormal data in data storage to eliminate the risk of error accumulation, in order to address the aforementioned technical problems.

[0005] A method for recovering data stored in orbit, the method comprising: Step 201: Pre-divide independent recovery areas in the memory chip; Step 202: Determine the triggering time for data correctness verification based on the key data reading method and the working mode of the payload. After the key data reading is completed, perform data correctness verification. Step 203: When performing the data correctness verification, read the first module data, the second module data, and the third module data stored in the three modules, perform consistency verification on the three data sets, and obtain a verification result that includes whether each module data is abnormal; Step 204: If the verification result shows that there is at least one abnormal data, then construct recovery data based on the majority of the correct data that are consistent among the three data sets, obtain the address to be recovered corresponding to the abnormal data, and store the recovery data and the address to be recovered in the recovery area. Step 205: Detect whether there is data to be recovered in the recovery area; if so, read the recovery data and the corresponding address to be recovered in the recovery area, then first erase the erroneous data in the storage area corresponding to the address to be recovered, then write the recovery data to the address to be recovered, and after completing the processing of the data to be recovered, erase the corresponding processed data in the recovery area. Step 206: Repeat step 205 until there is no data to be recovered in the recovery area. After all data recovery is completed, the load normal operation process will begin. If there is no data to be recovered in the recovery area, the load normal operation process will begin directly.

[0006] On the other hand, an on-orbit data recovery device is also provided, comprising: The recovery area partitioning module is used to pre-divide independent recovery areas in the memory chip; The verification trigger module is used to determine the triggering time for data correctness verification based on the reading method of key data and the working mode of the load, and to perform data correctness verification after the key data is read. The consistency verification module is used to read the first, second, and third model data from the three-model storage when performing the data correctness verification, perform consistency verification on the three data sets, and obtain a verification result that includes whether each model data is abnormal. The recovery construction module is used to construct recovery data based on the majority of correct data in the three data sets if the verification result shows that at least one data set is abnormal, and to obtain the address to be recovered corresponding to the abnormal data, and to associate the recovery data with the address to be recovered and store it in the recovery area. The power-on recovery module is used to detect whether there is data to be recovered in the recovery area; if so, it reads the recovery data and the corresponding address to be recovered in the recovery area, then first erases the erroneous data in the storage area corresponding to the address to be recovered, then writes the recovery data to the address to be recovered, and after completing the processing of the data to be recovered, erases the corresponding processed data in the recovery area. The loop control module is used to repeatedly execute the power-on recovery module's process until there is no data to be recovered in the recovery area. After all data recovery is completed, the load enters the normal operation process. If there is no data to be recovered in the recovery area, the load directly enters the normal operation process.

[0007] In another aspect, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described on-orbit data recovery method.

[0008] Furthermore, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the above-described on-orbit data recovery method.

[0009] Compared with existing technologies, the on-orbit storage data recovery method, apparatus, device, and medium provided by this invention have the following beneficial effects: 1. By pre-dividing an independent recovery area in the storage chip and postponing the data correctness verification process until after the critical data is read, the interference of the verification operation on the normal output of critical data is avoided, ensuring the real-time operation of the load, and providing an independent temporary storage medium for the reliable recovery of abnormal data.

[0010] 2. By reading three copies of data from the three-mode storage for consistency verification and actively constructing recovery data and corresponding addresses to be recovered and storing them in the recovery area, the traditional three-mode storage's defect of only passively voting and outputting correct data is changed. It realizes the active repair of abnormal data, fundamentally eliminating the risk of errors caused by single-event flips being permanently retained and accumulated in the storage medium, and avoiding the problem of the three-mode verification mechanism completely failing due to the simultaneous abnormality of the same data in two modes.

[0011] 3. By prioritizing the detection of the recovery area upon power-on of the payload and completing data recovery group by group, the continuity of the data recovery process is ensured. Even if abnormal situations such as power outages occur during the recovery process, the remaining recovery operations can still be completed automatically upon the next power-on, ensuring that the three-mode data always remain complete and valid. This significantly improves the long-term storage reliability of key data of the on-orbit payload, thereby extending the on-orbit working life of the payload and improving the success rate of space missions. Attached Figure Description

[0012] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required in the embodiments will be briefly described below. It should be understood that the following drawings only show some embodiments of the present invention, and those skilled in the art can obtain other related drawings based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart illustrating an on-orbit data recovery method in one embodiment; Figure 2 This is a structural block diagram of an on-orbit data recovery device in one embodiment; Figure 3 This is an internal structural diagram of a computer device in one embodiment.

[0014] The objectives, features, and advantages of this invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0016] It should be noted that in this invention, the use of terms such as "first," "second," etc., is for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0017] It is understood that the technical solutions of the various embodiments of the present invention can be combined with each other, but only if they are based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or cannot be implemented, it should be considered that such combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0018] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0019] Example 1 like Figure 1 As shown, an on-orbit data recovery method is provided, including the following steps: Step 201: Pre-divide an independent recovery area in the memory chip.

[0020] Step 202: Determine the triggering time for data correctness verification based on the key data reading method and the working mode of the payload. Perform data correctness verification after the key data reading is completed.

[0021] Step 203: When performing data correctness verification, read the first, second, and third model data from the three-model storage, perform consistency verification on the three sets of data, and obtain the verification result containing whether each model data is abnormal.

[0022] Step 204: If the verification result shows that there is at least one abnormal data, then construct the recovery data based on the majority of the correct data that are consistent among the three data sets, obtain the address to be recovered corresponding to the abnormal data, and store the recovery data and the address to be recovered in the recovery area.

[0023] Step 205: Detect whether there is data to be recovered in the recovery area; if so, read the recovery data and the corresponding address to be recovered in the recovery area, then first erase the erroneous data in the storage area corresponding to the address to be recovered, then write the recovery data to the address to be recovered, and after completing the processing of the data to be recovered, erase the corresponding processed data in the recovery area.

[0024] Step 206: Repeat step 205 until there is no data to be recovered in the recovery area. After all data recovery is completed, the load will enter the normal working process. If there is no data to be recovered in the recovery area, the load will directly enter the normal working process.

[0025] In the aforementioned on-orbit storage data recovery method, by pre-dividing an independent recovery area in the storage chip as a temporary carrier for abnormal data recovery, and postponing the data correctness verification process until after the critical data is read, it ensures that the real-time output of critical data is not affected by the verification operation, and also realizes the proactive detection and repair of abnormal data in the three-mode storage. This fundamentally solves the problem of erroneous data being permanently retained and gradually accumulating in traditional solutions. At the same time, by prioritizing the detection of the recovery area upon power-on of the payload and completing data recovery group by group, the risk of interruption of the recovery process due to sudden power-off of the periodically powered-on payload is effectively avoided, ensuring that the three-mode data always remains intact and valid, and significantly improving the long-term storage reliability of critical data of the on-orbit payload.

[0026] In the specific implementation of step 201, a contiguous storage space independent of the three-mode storage area is pre-allocated within the storage chip used to store critical data as a recovery area. This recovery area is used to temporarily store the data to be recovered and its corresponding storage address. Preferably, the storage capacity of the recovery area is not less than the storage capacity of the largest single piece of critical data to meet the requirements of full data recovery. The storage chip uses a radiation-resistant FLASH chip or MRAM chip, and is the same chip used for storing the critical data in the three-mode storage.

[0027] This step provides a reliable temporary storage medium for recovering abnormal data by dividing the data into independent recovery areas. Even if abnormal situations such as power outages or software crashes occur during the data recovery process, the data to be recovered can still be completely preserved in the recovery area, providing a foundation for subsequent recovery. At the same time, the independent recovery area can quickly release the processor's data cache space, avoiding the long-term occupation of processor resources due to the time-consuming erase operation of the storage chip.

[0028] In the specific implementation of step 202, the working mode of the load is first divided into a constant power-on mode and a periodic power-on mode, and the reading method of key data is divided into power-on reading, periodic reading and event reading. Among them, event reading refers to the data reading behavior triggered by the load receiving external instructions, state switching, external interaction, etc.

[0029] When the load is in constant power-on mode and the critical data is read upon power-on, the first full data correctness check is performed after the power-on reading is completed. Then, the data correctness check is repeated according to the preset cycle, which can be adjusted according to the radiation intensity of the load's on-orbit operating environment.

[0030] When the load is in a periodic power-on mode and the critical data is read upon power-on, a full data correctness check is performed only once after each power-on read, without the need for repeated checks during operation.

[0031] When critical data is read periodically or event-driven, the system selects to perform data integrity verification after each read or after a preset number of reads, depending on the read frequency. Specifically, when stored data is read infrequently, the verification process is executed after each read; when stored data is frequently read due to business needs, and there is no spare time to execute the verification process during work, the verification is set to be executed after the business is completed or after multiple reads.

[0032] In addition, for scenarios where processor resources such as MCUs are limited, the timing of verification is dynamically adjusted according to business resources. When the processor has other high-priority business to process, the priority of the data verification task is set to a lower level, and the data verification task is processed after the high-priority task is completed. If the verification task is suspended for more than the preset time, the verification is forced to be executed to avoid the task being delayed for a long time. At the same time, the priority of the data verification business is gradually increased according to the reading frequency or waiting time.

[0033] This step designs differentiated verification trigger strategies based on the payload's operating mode, data reading method, and system resource availability, and introduces a dynamic priority adjustment mechanism. While ensuring data reliability, it reasonably controls the system resource consumption of verification operations. At the same time, the verification process is postponed until after data reading is completed, completely avoiding interference with the normal output of critical data and ensuring the real-time performance of the payload.

[0034] In the specific implementation of step 203, any one of the following three consistency verification methods can be selected based on the size of the critical data, the on-chip cache resources, and the characteristics of the memory chip: The first method is a full comparison verification after reading, which is suitable for scenarios with a small amount of critical data and sufficient on-chip cache resources. Specifically, the first, second, and third modulo data of the three-modulo storage are read sequentially, and a three-modulo verification operation is performed on the three data sets to obtain the three-modulo verification data. The three-modulo verification operation involves performing a pairwise AND operation on corresponding data bits of the three data sets, and then performing an OR operation on all the AND operation results. The result obtained is the correct data that matches the majority of the three data sets.

[0035] Then, the first modulus data is compared bit by bit with the three-modulus verification data. If they do not match, the first modulus data is marked as abnormal. The second modulus data is compared bit by bit with the three-modulus verification data. If they do not match, the second modulus data is marked as abnormal. The third modulus data is compared bit by bit with the three-modulus verification data. If they do not match, the third modulus data is marked as abnormal. The marking results of all modulus data are integrated to obtain a verification result that includes whether each modulus data is abnormal. If all three modulus data are determined to be abnormal, comprehensive benchmark data is directly generated through the three-modulus verification operation as the data source for subsequent data recovery.

[0036] The second type is block-based verification with checksum. This method avoids the need to cache three copies of the data and only requires a block of data for verification. It is suitable for scenarios with a large amount of critical data and limited on-chip cache resources. Specifically, it has two implementation methods.

[0037] The basic implementation involves associating block checksums with data blocks for storage before verification. Specifically, during the critical data storage stage, each piece of critical data is divided into multiple data blocks of the same size. The size of the data blocks is designed based on the read / write operation logic of the storage chip and system resources. When using NOR FLASH as the storage chip, since its minimum erase size is 4KB, the data blocks are designed to be multiples of 4KB to avoid erasing additional correct data when erasing abnormal data blocks. The size of the data blocks is also limited by the processing chip's maximum data cache space divided by 4, ensuring that the processing chip can cache three data blocks and one set of data after three-modulus verification simultaneously. The maximum data cache space is 4 times the size of the data blocks. The smaller the blocks, the larger the storage space occupied by the checksums. The block size and checksum overhead need to be balanced according to actual needs.

[0038] A corresponding block checksum is generated for each data block. The type of block checksum is selected based on the system's storage resources. When system storage resources are sufficient, ECC is used as the verification method, and the error correction code is set to a multiple of 8 bits to maximize storage space utilization. Typically, 72-bit ECC data storage is used, containing a 64-bit data segment and an 8-bit error correction code. When a single bit flip occurs, error correction can be performed directly without referring to the remaining modulo data. After ECC completes the single bit flip error correction, the original data in the storage area is synchronously refreshed, and a single bit flip anomaly log is recorded. When system storage resources are limited, methods such as cumulative checksum or CRC checksum are used, requiring only a few bytes of checksum for each data block.

[0039] When storing data, allocate additional storage space for each data block and associate each block checksum with the corresponding data block and store them in the same area.

[0040] During the verification phase, the first, second, and third module data blocks with the same sequence number in the three-module storage are read sequentially. The valid data portion of the data block is read and the actual check code is calculated. The actual check code is compared with the block check code associated with the data block.

[0041] If they match, the correctness check of the module and the data block is considered to have passed.

[0042] If they are inconsistent, read the block check codes corresponding to the same sequence number data blocks from the other two modulus data, perform a three-modulus check operation on the three block check codes, generate a check code baseline value for the current sequence number, and compare the currently checked block check code with the check code baseline value bit by bit; if they are inconsistent, the currently checked block check code is determined to be abnormal, and the check code baseline value is used to overwrite the currently checked block check code, completing the check code refresh; after the refresh, the block check code returns to normal, and no abnormality marking is required. The current round of data block verification process ends, and the next sequence number data block is verified. If they are consistent, the currently checked block check code is determined to be normal, indicating that the correctness verification of the valid data part of the data block has failed, and the modulus and data block are marked as abnormal by flag. If all three data blocks under the same sequence number are determined to be abnormal, a baseline data block is generated through the three-modulus check operation as the basis for recovery.

[0043] After traversing all data blocks with different serial numbers to complete the verification, all the marked results are integrated to obtain the verification results containing whether each data block of each module is abnormal.

[0044] The optimized implementation mainly involves storing the block checksums independently and then performing verification. Specifically, during the critical data storage stage, each piece of critical data is divided into multiple data blocks of the same size, a corresponding block checksum is generated for each data block, and all block checksums are written into an independent checksum storage area in the storage chip. The block checksums also adopt a three-mode storage method.

[0045] During the verification phase, the correctness of the block check codes is verified first, followed by the correctness verification of the data portion. This avoids the problem of discontinuous operation caused by jumping to the check code correctness verification branch when check code matching anomalies occur. Specifically, each block check code in the check code storage area is read first, and a three-modulus check operation is performed on the three groups of block check codes with the same sequence number to obtain the check code baseline value for the corresponding sequence number. Each block check code is compared bit by bit with the check code baseline value. If any group of block check codes is abnormal, the check code recovery data is constructed and stored in the recovery area. After the check code recovery process is completed, the three groups of block check codes with the corresponding sequence number are read again, and a new check code baseline value is generated. Then, the data block is verified.

[0046] When verifying a data block, the first, second, and third module data blocks with the same sequence number in the three-module storage are read sequentially. The valid data portion of each data block is read, and the actual checksum is calculated. The actual checksum is compared with the corresponding checksum baseline value. If they do not match, the corresponding module's data block is marked as abnormal using a flag. It is worth noting that if a new checksum baseline value has been generated in the preceding steps, the actual checksum is compared with the new checksum baseline value during data block verification.

[0047] After traversing all data blocks with different serial numbers to complete the verification, all the marked results are integrated to obtain the verification results containing whether each data block of each module is abnormal.

[0048] The third type is global checksum verification, which is suitable for key parameter verification scenarios with extremely small data volumes and simple structures. Specifically, during the key data storage stage, a global checksum is generated for each piece of key data, and the global checksum is associated with the corresponding key data and stored. The global checksum also adopts a three-modal storage method.

[0049] During the verification phase, the actual global checksums for the first, second, and third modulus data stored in the three-modulus system are calculated respectively. The actual global checksums for each modulus are compared with the correct global checksum after verification across all three modulus systems. If they do not match, the corresponding modulus data is marked as abnormal. All marked results are integrated to obtain a verification result that includes whether the data for each modulus is abnormal.

[0050] Furthermore, in the overall checksum verification method, when a checksum matching failure occurs or the data is deemed abnormal, the abnormal data is refreshed using the data from the successfully matched checksum. Specifically, if only one modal data is abnormal, the correct data from any of the other two modal data is used for refreshing; if two modal data are abnormal, the correct data from the third modal is used for refreshing; if all three modal data are abnormal, a three-modal checksum is performed on the three sets of data to generate comprehensive data, and a three-modal checksum is also performed on the three global checksums to generate a correct global checksum. The comprehensive data is then checked against the correct global checksum. If the checksum passes, the comprehensive data and the correct global checksum are used to construct recovery data, and the three modal data are refreshed as a whole.

[0051] This step provides three independent consistency verification methods, covering verification requirements under different data volumes, system resource conditions, and storage chip characteristics, thus improving the versatility and applicability of the method. At the same time, through the three-mode storage of check codes and the optimized process of verifying check codes first and then verifying data blocks, the continuity of verification operations is ensured, unnecessary branch jumps are avoided, and verification efficiency is further improved. The introduction of ECC verification method also enables direct error correction of single-bit errors, reducing the number of recovery operations.

[0052] In the specific implementation of step 204, based on the verification result obtained in step 203, if at least one modulus of data is abnormal, recovery data of the corresponding granularity is constructed based on the majority of consistent correct data among the three sets of data. The format of the recovery data is divided into two types according to the storage method of the checksum. When the checksum and data are stored in the same data block, the recovery data includes the address to be recovered and the correct data; when the checksum and data are stored in two separate areas, the recovery data includes the address to be recovered, the correct data, and the corresponding correct checksum. If a full comparison verification or overall checksum verification is used and the entire modulus of data is abnormal, complete recovery data for that modulus is constructed, and the starting storage address corresponding to that modulus data is obtained as the address to be recovered. If a block-based checksum verification is used and only a portion of the data blocks of a certain modulus are abnormal, recovery data corresponding to each abnormal data block is constructed separately, and the storage address corresponding to each abnormal data block is obtained as the address to be recovered. The constructed recovery data and the corresponding address to be recovered are associated and stored in the recovery area as key-value pairs, where the address to be recovered is the key and the recovery data is the value.

[0053] This step actively constructs and stores recovery data in the recovery area, overcoming the shortcomings of traditional tri-mode storage that only passively votes to output correct data. It achieves proactive repair of abnormal data, eliminating the risk of errors caused by single-event upsets being permanently retained and accumulated in the storage medium from the source. It also avoids the problem of the tri-mode verification mechanism completely failing due to the simultaneous abnormality of the same data in two modes. At the same time, the design of the two recovery data formats is adapted to different check code storage methods, ensuring the integrity of the recovery operation.

[0054] In the specific implementation of steps 205 and 206, when the load is in a periodic power-on mode, the power-on initialization process is executed first after each power-on to check if there is data to be recovered in the recovery area. If so, the data recovery process is executed directly. After all data in the recovery area has been processed, the power-on read and full data verification are then executed. This mechanism is specifically designed to solve the problem of process interruption caused by abnormal power outages, software crashes, or other factors during the previous recovery process.

[0055] When the load is in always-on mode, since there is no risk of recovery interruption due to unexpected power-off, the data recovery process can be executed immediately after the recovery data construction is completed in step 204, without waiting for the next power-on. The data recovery process executed immediately is as follows: read a set of recovery data and the corresponding address to be recovered from the recovery area, erase the erroneous data in the storage area corresponding to the address to be recovered, write the recovery data to the address to be recovered, erase the corresponding processed data in the recovery area after completion, and repeat the above operations until there is no data to be recovered in the recovery area.

[0056] Repeat the above operations until there is no data to be recovered in the recovery area. After all data recovery is completed, the load will enter the normal working process. If there is no data to be recovered in the recovery area, the load will directly enter the normal working process.

[0057] This step designs differentiated recovery execution timings for loads operating in different modes and employs an atomic operation method of processing and clearing data group by group, ensuring the reliability and continuity of the data recovery process. Even if abnormal situations such as power outages occur during the recovery process, the unprocessed data to be recovered is still stored in the recovery area, and can be automatically resumed and the remaining recovery operations completed on the next power-on. This completely solves the core pain point of the periodic power-on load recovery process being easily interrupted, ensuring that the three-mode data always remains complete and valid.

[0058] It should be understood that, although this embodiment Figure 1 The steps are shown sequentially as indicated by the arrows, but they are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order in which these steps are performed; they can be executed in other orders. Figure 1At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0059] Example 2 Based on the on-orbit storage data recovery method in Embodiment 1, this embodiment discloses an on-orbit storage data recovery device, such as... Figure 2 As shown, the on-orbit storage data recovery device includes: a recovery area partitioning module 401, a verification triggering module 402, a consistency verification module 403, a recovery construction module 404, a power-on recovery module 405, and a loop control module 406, wherein: The recovery area partitioning module 401 is used to pre-divide independent recovery areas in the memory chip.

[0060] The verification trigger module 402 is used to determine the triggering time for data correctness verification based on the reading method of key data and the working mode of the load, and to perform data correctness verification after the key data is read.

[0061] The consistency verification module 403 is used to perform data correctness verification by reading the first, second, and third model data from the three-model storage, performing consistency verification on the three sets of data, and obtaining a verification result that includes whether each model data is abnormal.

[0062] The recovery construction module 404 is used to construct recovery data based on the majority of the correct data in the three data sets if the verification result shows that there is at least one abnormal data set, and to obtain the address to be recovered corresponding to the abnormal data, and to associate the recovery data with the address to be recovered and store it in the recovery area.

[0063] The power-on recovery module 405 is used to first detect whether there is data to be recovered in the recovery area when the load is powered on; if it exists, it reads the recovery data and the corresponding address to be recovered in the recovery area, then first erases the erroneous data in the storage area corresponding to the address to be recovered, then writes the recovery data to the address to be recovered, and after completing the processing of the data to be recovered, erases the corresponding processed data in the recovery area.

[0064] The loop control module 406 is used to repeatedly execute the power-on recovery module process until there is no data to be recovered in the recovery area. After all data recovery is completed, the load normal operation process is entered. If there is no data to be recovered in the recovery area, the load normal operation process is entered directly.

[0065] In this embodiment, the specific working process and working principle of the recovery area partitioning module 401, the verification triggering module 402, the consistency verification module 403, the recovery construction module 404, the boot recovery module 405, and the loop control module 406 are the same as those in Embodiment 1, and therefore will not be described again in this embodiment. Each unit module can be implemented entirely or partially through software, hardware, or a combination thereof. Each unit module can be embedded in or independent of the processor in the computer device in hardware form, or it can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to the above unit modules.

[0066] Example 3 like Figure 3 The diagram illustrates a computer device disclosed in this embodiment, including a transmitter, a receiver, a memory, and a processor. The transmitter is used to send instructions and data, the receiver is used to receive instructions and data, the memory is used to store computer execution instructions, and the processor is used to execute the computer execution instructions stored in the memory to implement the method in Embodiment 1 above.

[0067] It is important to note that the aforementioned memory can be either standalone or integrated with the processor. When the memory is set up independently, the terminal device also includes a bus for connecting the memory and the processor.

[0068] Example 4 This embodiment discloses a computer-readable storage medium storing computer-executable instructions. When a processor executes the computer-executable instructions, it implements the method in Embodiment 1 above.

[0069] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0070] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0071] The embodiments described above are merely examples of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.

Claims

1. A method for recovering data stored in orbit, characterized in that, The method includes: Step 201: Pre-divide independent recovery areas in the memory chip; Step 202: Determine the triggering time for data correctness verification based on the key data reading method and the working mode of the payload. After the key data reading is completed, perform data correctness verification. Step 203: When performing the data correctness verification, read the first module data, the second module data, and the third module data stored in the three modules, perform consistency verification on the three data sets, and obtain a verification result that includes whether each module data is abnormal; Step 204: If the verification result shows that there is at least one abnormal data, then construct recovery data based on the majority of the correct data that are consistent among the three data sets, obtain the address to be recovered corresponding to the abnormal data, and store the recovery data and the address to be recovered in the recovery area. Step 205: Detect whether there is data to be recovered in the recovery area; if so, read the recovery data and the corresponding address to be recovered in the recovery area, then first erase the erroneous data in the storage area corresponding to the address to be recovered, then write the recovery data to the address to be recovered, and after completing the processing of the data to be recovered, erase the corresponding processed data in the recovery area. Step 206: Repeat step 205 until there is no data to be recovered in the recovery area. After all data recovery is completed, the load normal operation process will begin. If there is no data to be recovered in the recovery area, the load normal operation process will begin directly. In step 202, the triggering time for data correctness verification is determined based on the key data reading method and the payload's operating mode. After the key data reading is completed, data correctness verification is performed, including: The working modes of the load are divided into constant power-on mode and periodic power-on mode, and the reading methods of the key data are divided into power-on reading, periodic reading and event reading. When the load is in constant power-on mode and the key data is read upon power-on, the first full data correctness check is performed after the power-on reading is completed, and then the data correctness check is repeated according to the preset cycle. When the load is in a periodic power-on mode and the key data is read upon power-on, a full data correctness check is performed only once after each power-on read is completed; When the key data is read periodically or by events, the data correctness check is performed after each read is completed, or the data correctness check is performed after a preset number of reads is completed, depending on the reading frequency.

2. The on-orbit data recovery method according to claim 1, characterized in that, In step 203, a consistency check is performed on the three sets of data, including: Read the first, second, and third model data from the three-model storage sequentially; perform a three-model verification operation on the three data sets to obtain the three-model verification data; Compare the first modulus data with the three modulus verification data bit by bit. If they are inconsistent, mark the first modulus data as abnormal. Compare the second modulus data with the three modulus verification data bit by bit; if they are inconsistent, mark the second modulus data as abnormal. Compare the third-mode data with the three-mode verification data bit by bit. If they are inconsistent, mark the third-mode data as abnormal. By integrating all the labeled results, a verification result is obtained that includes whether the data of each module is abnormal.

3. The on-orbit data recovery method according to claim 1, characterized in that, In step 203, a consistency check is performed on the three sets of data, including: During the critical data storage phase, each piece of critical data is divided into multiple data blocks of the same size, a corresponding block check code is generated for each data block, and the block check code is associated with and stored with the corresponding data block. During the verification phase, the first, second, and third module data blocks with the same sequence number in the three-module storage are read sequentially. Calculate the actual checksum for each data block, compare the actual checksum with the block checksum associated with the data block, and mark the corresponding data block as abnormal if they do not match. After traversing all data blocks with different serial numbers to complete the verification, all the marked results are integrated to obtain the verification results containing whether each data block of each module is abnormal.

4. The on-orbit data recovery method according to claim 1, characterized in that, In step 203, a consistency check is performed on the three sets of data, including: During the critical data storage stage, each piece of critical data is divided into multiple data blocks of the same size, a corresponding block check code is generated for each data block, and all block check codes are uniformly written into the independent check code storage area in the storage chip. During the verification phase, the block verification codes in the verification code storage area are read first, and the three-modulus verification operation is performed on the block verification codes to obtain the verification code base value. Each block check code is compared with the check code baseline value. If an anomaly is found, check code recovery data is constructed and stored in the recovery area. Then, the data blocks are verified. The actual check code for each data block is calculated and compared with the corresponding check code baseline value. If they are inconsistent, the corresponding data block is marked as abnormal. After traversing all data blocks with different serial numbers to complete the verification, all the marked results are integrated to obtain the verification results containing whether each data block of each module is abnormal.

5. The on-orbit data recovery method according to claim 1, characterized in that, In step 203, a consistency check is performed on the three sets of data, including: During the critical data storage phase, a global checksum is generated for each piece of critical data, and the global checksum is associated with and stored with the corresponding critical data. During the verification phase, the actual global check codes for the first, second, and third module data stored in the three-module storage are calculated respectively. Compare the actual global checksum of each module with the associated stored global checksum; if they do not match, mark the data of the corresponding module as abnormal. By integrating all the labeled results, a verification result is obtained that includes whether the data of each module is abnormal.

6. The on-orbit data recovery method according to any one of claims 1 to 5, characterized in that, When the load is in a constantly powered-on mode, the data recovery process is executed immediately after step 204 is completed, without waiting for the next power-on. The immediate data recovery process includes: reading a set of recovery data and the corresponding address to be recovered in the recovery area; first, erasing the erroneous data in the storage area corresponding to the address to be recovered; writing the recovery data into the address to be recovered; after completion, erasing the corresponding processed data in the recovery area; and repeating the above operation until there is no data to be recovered in the recovery area.

7. An on-orbit data recovery device, characterized in that, The device includes: The recovery area partitioning module is used to pre-divide independent recovery areas in the memory chip; The verification trigger module is used to determine the triggering time for data correctness verification based on the reading method of key data and the working mode of the load, and to perform data correctness verification after the key data is read. The consistency verification module is used to read the first, second, and third model data from the three-model storage when performing the data correctness verification, perform consistency verification on the three data sets, and obtain a verification result that includes whether each model data is abnormal. The recovery construction module is used to construct recovery data based on the majority of correct data in the three data sets if the verification result shows that at least one data set is abnormal, and to obtain the address to be recovered corresponding to the abnormal data, and to associate the recovery data with the address to be recovered and store it in the recovery area. The power-on recovery module is used to detect whether there is data to be recovered in the recovery area; if so, it reads the recovery data and the corresponding address to be recovered in the recovery area, then first erases the erroneous data in the storage area corresponding to the address to be recovered, then writes the recovery data to the address to be recovered, and after completing the processing of the data to be recovered, erases the corresponding processed data in the recovery area. The loop control module is used to repeatedly execute the power-on recovery module's process until there is no data to be recovered in the recovery area. After all data recovery is completed, the load normal operation process begins. If there is no data to be recovered in the recovery area, the load normal operation process begins directly. The verification triggering module determines the triggering time for data correctness verification based on the key data reading method and the load's operating mode. After the key data reading is completed, the data correctness verification is performed, including: The working modes of the load are divided into constant power-on mode and periodic power-on mode, and the reading methods of the key data are divided into power-on reading, periodic reading and event reading. When the load is in constant power-on mode and the key data is read upon power-on, the first full data correctness check is performed after the power-on reading is completed, and then the data correctness check is repeated according to the preset cycle. When the load is in a periodic power-on mode and the key data is read upon power-on, a full data correctness check is performed only once after each power-on read is completed; When the key data is read periodically or by events, the data correctness check is performed after each read is completed, or the data correctness check is performed after a preset number of reads is completed, depending on the reading frequency.

8. A computer device, comprising a memory and a processor, characterized in that, The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the on-orbit data recovery method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the steps of the on-orbit data recovery method according to any one of claims 1 to 6.

Images