Satellite control safety kernel system with isomerous redundancy and resource sharing and processing method

Abstract

The application discloses a satellite control safety kernel system with heterogeneous redundancy and resource sharing and a processing method, relates to the technical field of satellite attitude and orbit control systems and high-reliability control and safety-critical systems of spacecrafts. The system comprises a heterogeneous redundancy safety computing and processing unit, a resource sharing communication unit, a safety kernel management and control unit and an external interface unit. The heterogeneous redundancy safety computing and processing unit adopts processors with different processor architectures and different instruction sets to execute satellite attitude and orbit control algorithms in parallel. The resource sharing communication unit enables the safety computing and processing unit and the control subsystem computing and processing unit to share access to satellite control component resources. The safety kernel management and control unit independently performs consistency decision, control instruction legality verification, fault decision and isolation switching. The external interface unit is adapted to satellite sensors and satellite actuators. The application can improve the fault tolerance, safety and resource utilization of a satellite control core.

Description

Technical Field

[0001] This application relates to the technical fields of satellite attitude and orbit control systems and spacecraft high-reliability control and safety-critical systems, and in particular to a satellite control safety nuclear system and processing method with heterogeneous redundancy and resource sharing. Background Technology

[0002] The existing satellite attitude and orbit control core hardware mostly adopts a homogeneous processor redundancy architecture, using the same type of radiation-resistant processor to build the main and backup hardware circuits, and achieving redundancy backup through simple relay switching; the hardware circuits adopt a discrete design, with interfaces independent of other subsystems, and no resource sharing hardware mechanism; safety protection relies solely on software verification, and there is no minimum heterogeneous system takeover and processing capability, resulting in obvious defects in the overall hardware architecture.

[0003] The shortcomings of the existing technology are as follows:

[0004] Homogeneous redundancy is prone to common-mode failures. Traditional dual-machine hot standby and triple-mode redundancy often use the same model of processor. Once a common-mode failure such as a design flaw, single-event upset, or software dead loop occurs, the redundancy mechanism fails, and there is a risk of the entire satellite going out of control.

[0005] Low resource utilization, high hardware costs, independent configuration of dedicated processors for control functions, scattered hardware resources that cannot be dynamically scheduled result in a large amount of idle computing power, storage and interface resources on the satellite, and large system size, power consumption and weight.

[0006] The fault isolation capability is weak. Different functional tasks run in the same hardware environment. An anomaly in a single task can easily trigger a global crash, making it impossible to achieve strong isolation between security-critical and non-critical business processes.

[0007] The lack of a unified security control mechanism and the absence of an independent security kernel in the traditional architecture for fault monitoring, access control, command validity verification and redundancy decision-making make it difficult to meet the high reliability, high autonomy, high security and low cost requirements of the new generation of satellites.

[0008] In summary, existing technologies still face challenges in simultaneously achieving heterogeneous redundancy to resist common-mode faults, dynamic resource sharing, strong fault isolation, and unified security management. Summary of the Invention

[0009] To address the problems existing in the prior art, the purpose of this application is to provide a satellite control safety core system and processing method based on heterogeneous processor redundancy, control component resource sharing, fault isolation, and safety decision-making. This system achieves heterogeneous processor redundancy backup, global sharing of hardware resources, and fault hardware isolation in the attitude and orbit control system through hardware circuitry, thereby improving the reliability and safety of the satellite control core hardware. It is suitable for satellite control platforms such as low-Earth orbit satellite constellations that have stringent requirements for low cost, controller reliability, and space safety.

[0010] To achieve the above-mentioned objectives, this application provides a satellite control safety nuclear system with heterogeneous redundancy and resource sharing, comprising:

[0011] The heterogeneous redundant safety computing processing unit includes at least two processors with different processor architectures and different instruction sets, which are used to execute satellite attitude and orbit control algorithms in parallel based on the same satellite control input data to generate corresponding control calculation results.

[0012] An external interface unit is used to connect the satellite sensor and the satellite actuator, and to adapt the interface signals of the satellite sensor and the satellite actuator.

[0013] The resource-sharing communication unit is connected to the heterogeneous redundant security computing processing unit, the control subsystem computing processing unit, and the external interface unit, respectively, and is used to enable the heterogeneous redundant security computing processing unit and the control subsystem computing processing unit to share access to the data resources and interface resources of the satellite control unit components;

[0014] The security core control unit is set up independently of the heterogeneous redundant security computing processing unit and the control subsystem computing processing unit. It is used to make consistency decisions on the control computing results, verify the legality of the control commands to be output, and make fault decisions based on the processor status, communication status and consistency decision results.

[0015] The security core control unit is also used to control and isolate the faulty processor, faulty communication channel or abnormal interface when a fault is determined to exist, and switch to the healthy heterogeneous processor to output verified control commands.

[0016] According to one technical solution of this application, the at least two processors include at least two of the following: a central processing unit (CPU), a digital signal processor (DSP), a field-programmable gate array (FPGA), and a microcontroller (MCU), and the at least two processors adopt different processor architectures.

[0017] According to one technical solution of this application, the safety nuclear control unit includes a voltage acquisition circuit, an FPGA logic processing circuit, and a watchdog circuit;

[0018] The voltage acquisition circuit is used to acquire the power supply status of each module, the FPGA logic processing circuit is used to monitor bus messages, processor status and control calculation results and make fault judgments, and the watchdog circuit is used to monitor the processor's operating status and trigger a reset or redundancy switch when the processor is abnormal.

[0019] According to one technical solution of this application, the security kernel control unit is further configured to execute a trust boot process during the system power-on phase, including:

[0020] Hardware link integrity detection is performed on the heterogeneous redundant secure computing processing unit, the resource-sharing communication unit, and the external interface unit.

[0021] Perform integrity verification on the satellite control procedure image and the consistency decision procedure image; and

[0022] After the hardware link integrity check and program image integrity verification pass, the control releases the clock signal and power supply signal of the corresponding module.

[0023] According to one technical solution of this application, the external interface unit includes at least one of an RS422 interface circuit, a CAN interface circuit, and an input / output drive interface circuit, and includes protection circuits for interface protection and level conversion.

[0024] According to one technical solution of this application, the resource sharing communication unit uses a single pair of Ethernet communication links or CAN communication links to construct a resource sharing communication bus;

[0025] The security core control unit is used to allocate control rights of hardware resources in the resource-sharing communication bus according to the priority of control tasks and the health status of each processor, and to isolate resource access for security-critical control tasks and non-security-critical tasks.

[0026] According to one aspect of this application, a satellite control security processing method is proposed, applied to a satellite control security nuclear system as described in any of the above technical solutions, comprising:

[0027] The input data of the satellite sensor is obtained through an external interface unit;

[0028] The input data is distributed to at least two processors with different processor architectures and instruction sets via a resource-sharing communication unit;

[0029] The at least two processors are controlled to execute the satellite attitude and orbit control algorithm in parallel to obtain multiple control calculation results;

[0030] The multiple control calculation results are determined by an independently configured security core control unit, and the legality of the output control command is verified.

[0031] Monitor processor status, communication status, and interface status; and

[0032] When it is determined that there is a fault in the processor, communication channel or external interface, or that the multiple control calculation results do not meet the consistency requirements, the corresponding faulty object is isolated and the healthy heterogeneous processor is switched to output the verified control instructions.

[0033] According to one technical solution of this application, before acquiring the input data of the satellite sensor, the method further includes:

[0034] Hardware link integrity detection is performed on heterogeneous redundant secure computing processing units, resource-sharing communication units, and external interface units;

[0035] Perform integrity verification on the satellite control procedure image and the consistency decision procedure image; and

[0036] After the detection and verification are passed, clock signals and power supply signals are released to the processor, communication bus and external interface in a preset order.

[0037] According to one technical solution of this application, the validity verification of the output control command includes:

[0038] Perform instruction format verification, operation permission whitelist matching, and control output threshold verification on control commands;

[0039] If a control command fails the validity check, the control command will be prevented from being sent to the satellite actuator.

[0040] According to one technical solution of this application, the satellite control security processing method further includes:

[0041] The trust startup verification record, control command verification record, fault judgment parameters, and redundancy switching events are stored in a memory with error correction and verification functions.

[0042] Compared with existing technologies, the heterogeneous redundancy and resource-sharing satellite control safety nuclear system and processing method provided in this application have the following significant technical advantages:

[0043] The heterogeneous redundant security computing processing unit, employing different processor architectures and instruction sets, can reduce the risk of common-mode failures caused by identical hardware architectures, instruction sets, or design flaws. Through a resource-sharing communication unit, the heterogeneous redundant security computing processing unit and the control subsystem computing processing unit can share satellite control unit component resources, reducing the volume, weight, and power consumption costs associated with redundant stacking. An independently configured security core management unit can handle consistency determination of control calculation results, verification of the legality of control commands, fault determination, and redundancy switching. An external interface unit can accommodate the access requirements of satellite sensors and satellite actuators. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are only some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0045] Figure 1 This is a schematic diagram of the overall architecture of a satellite control safety nuclear system with heterogeneous redundancy and resource sharing, as described in one embodiment of this application.

[0046] Figure 2 This is a schematic diagram of resource sharing scheduling and hardware isolation in one embodiment of this application;

[0047] Figure 3 A schematic diagram of security nuclear information processing in one embodiment of this application. Detailed Implementation

[0048] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0049] It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of this application can be combined with each other. The following embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the patent application. It should be pointed out that, for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application.

[0050] Implementation Method 1: Satellite Control Safety Nuclear System with Heterogeneous Redundancy and Resource Sharing

[0051] like Figure 1 As shown, this application provides a satellite control safety kernel system with heterogeneous redundancy and resource sharing. The system includes a heterogeneous redundancy safety computing processing unit, a resource-sharing communication unit, a safety kernel management unit, and a (compatible backup) external interface unit. The heterogeneous redundancy safety computing processing unit includes at least two processors with different processor architectures and instruction sets, used to execute satellite attitude and orbit control algorithms in parallel based on the same satellite control input data, generating corresponding control calculation results. The external interface unit connects to satellite sensors and satellite actuators, and adapts the interface signals of the satellite sensors and actuators. The resource-sharing communication unit is connected to the heterogeneous redundancy safety computing processing unit, the control subsystem computing processing unit, and the external interface unit, enabling the heterogeneous redundancy safety computing processing unit and the control subsystem computing processing unit to share access to the data resources and interface resources of the satellite control components. The safety kernel management unit is set independently of the heterogeneous redundancy safety computing processing unit and the control subsystem computing processing unit, used to perform consistency judgment on the control calculation results, verify the legality of the control commands to be output, and perform fault judgment based on processor status, communication status, and consistency judgment results. The safety nuclear control unit is also used to control and isolate faulty processors, faulty communication channels or abnormal interfaces when a fault is detected, and switch to healthy heterogeneous processors to output verified control commands.

[0052] like Figure 1 As shown, in the hardware layer, the heterogeneous redundant security computing processing unit can be arranged in the control computing area of ​​the system board, the resource-sharing communication unit and the compatible backup external interface unit can be arranged in the communication and interface area, and the security core control unit can be arranged in the independent security control area. A bidirectional data path is established between the heterogeneous redundant security computing processing unit and the resource-sharing communication unit to receive satellite sensor input data and output control calculation results; a bidirectional interface path is established between the resource-sharing communication unit and the external interface unit to receive component data and send control commands; the security core control unit is connected to the heterogeneous redundant security computing processing unit, the resource-sharing communication unit, and the external interface unit respectively, for acquiring status, implementing decisions, and outputting isolation control signals. Figure 1 The functional domain section further explains that the heterogeneous redundant security computing processing unit performs parallel acquisition and processing of satellite control algorithms and heterogeneous computing consistency decision-related operations, the resource sharing communication unit acquires control unit component data in parallel, the external interface unit serves as the communication interface for the direct control unit components, and the security core management and control unit undertakes full-domain monitoring, fault judgment, and redundancy switching.

[0053] The system's hardware circuit consists of four core modules: heterogeneous multi-core processing hardware circuit, global resource sharing and exchange bus communication module, interface adaptation hardware circuit, and security core control unit hardware circuit. Each module is connected through a hardware matching circuit, and the whole adopts an integrated PCB board design to meet the requirements of aerospace radiation resistance, vibration resistance, and wide temperature operation.

[0054] The heterogeneous multi-core processing hardware circuit employs a processor hardware circuit with a different processor architecture and instruction set than the SPARC V8 processor used in mainstream high-reliability control subsystems. This is to reduce the risk of common-mode failures caused by homogeneous processor architectures, identical instruction sets, or design flaws. The safety core main control processor circuit can use an FPGA device that meets the requirements of the mission environment. The FPGA device can integrate an ARM Cortex-M3 processor to build a minimum hardware system circuit, including an external clock circuit, power supply circuit, reset circuit, JTAG debugging circuit, ECC verification memory interface circuit, and carries the attitude and orbit control core operation program and a consistency judgment program for heterogeneous computing processing results. As the main control hardware core, the safety core adopts a redundant main backup circuit design.

[0055] Among them, the global resource sharing and exchange communication circuit realizes hardware-level sharing of satellite control components such as satellite sensors and satellite actuators. A network communication bus circuit is designed, and resource sharing is realized through information interaction via the communication bus. The communication bus can be a general SPE+APL Ethernet communication or a high-speed communication CAN bus to realize power supply control and resource sharing of satellite control components.

[0056] Among them, the compatible external interface adapter hardware circuit adopts a generalized and expandable hardware interface circuit to meet the compatibility of multiple types of satellite control unit components with the existing satellite control system. The standard hardware interface circuit integrates RS422, CAN and IO driver interface circuits, and each interface is equipped with hardware protection circuit design and radiation-resistant chip.

[0057] The hardware circuit of the security core control unit mainly consists of an AD acquisition circuit, an FPGA timing and logic processing circuit, and a watchdog circuit. The security core control unit circuit is designed to monitor the power supply voltage in real time, and the watchdog reset and abnormal reset trigger redundancy switching to ensure continuous operation between the security core master and backup.

[0058] The entire information processing flow is independently and uniformly managed by the security core control unit. It relies on hardware-based solidified logic to achieve autonomous handling across the entire chain, including trust-based startup, multi-level instruction verification, hardware fault diagnosis, and proactive fault switching. It utilizes a global resource-sharing exchange bus to complete data interaction across all modules. The shared bus architecture is as follows: Figure 1As shown, the security core control unit performs resource access control based on the priority of control tasks and the health status of the processor, thereby enabling the satellite control core to operate autonomously, securely, and stably.

[0059] During the system power-up phase, a hardware-level trusted boot process is executed: The security core control unit performs a hardware link integrity self-check on the heterogeneous multi-core processing hardware circuit, global resource sharing exchange bus, and interface adaptation circuits of each channel through FPGA timing logic circuits; combined with the integrity verification mechanism, the attitude and orbit control calculation firmware and the heterogeneous result consistency discrimination program image are verified for integrity. After confirming that the hardware link is undamaged, the clock and power supply are released to the processor, communication bus, and external satellite sensor / satellite actuator interface step by step, thereby avoiding boot security risks caused by program abnormalities and hardware failures from the source.

[0060] During normal on-orbit operation, the onboard satellite's sensors collect raw attitude and orbit sensing data. After level conversion and hardware filtering protection by the interface adaptation hardware circuit, the data is sent to the global resource sharing exchange bus and distributed to the primary and backup heterogeneous processors to perform attitude and orbit control calculations in parallel and independently. Output control commands are uploaded to the safety core control unit for parallel hardware verification, including command format compliance verification, operation permission whitelist matching, control output threshold exceeding judgment, and consistency comparison of heterogeneous dual-channel calculation results. Illegal or out-of-tolerance commands that fail verification can be manually intervened through the telemetry channel or directly intercepted and discarded by hardware logic, preventing their issuance to the actuators.

[0061] The safety core control unit collects the power supply status of each module on the entire board in real time through the AD acquisition circuit. Combined with the FPGA bus frame verification logic and multiple independent watchdog circuits, it continuously monitors the processor's watchdog signal, bus message packet loss and communication anomalies, and completes fault judgment based on the built-in hardware discrimination logic.

[0062] When the fault judgment logic determines that the system has an operational risk, the safety nuclear control unit outputs a hardware switch control signal to complete the active redundancy switch, and simultaneously cuts off the power supply to the fault processor, fault bus channel or abnormal interface to achieve hardware electrical isolation. Within the preset switching delay that meets the real-time requirements of attitude and orbit control closed loop, it switches to the healthy backup heterogeneous processor to continue the attitude and orbit control closed loop operation. The valid control command after verification is once again sent to the momentum wheel, thruster and other actuators through the global resource sharing exchange bus to complete the satellite attitude and orbit adjustment.

[0063] Throughout the system's operation, the trust startup verification log, instruction verification record, fault judgment parameters, and redundancy switching events are written to a memory with ECC or EDAC error correction function via the ECC or EDAC memory interface. The entire closed-loop link of data acquisition, parallel heterogeneous operation, security verification, fault monitoring, isolation switching, and instruction output is independently managed by the security core hardware. Relying on the shared bus, the system achieves efficient reuse of on-board hardware resources, ensuring the satellite's long-term autonomous, highly reliable, and highly secure on-orbit control and operation.

[0064] Through the aforementioned system, the heterogeneous redundant secure computing processing unit no longer relies on a single processor architecture and instruction set, reducing the risk of common-mode failures caused by the same design flaws or operational anomalies in homogeneous redundancy. The resource-sharing communication unit enables both the control subsystem's computing processing unit and the heterogeneous redundant secure computing processing unit to access the data and interface resources of the satellite control unit components, thereby reducing idle computing power, interfaces, and storage caused by independently stacked hardware. The secure core control unit is set up independently of the computing processing unit, ensuring that consistency decisions, instruction validity checks, and fault isolation are not dependent on the monitored processor itself, maintaining independent decision-making capabilities in the event of processor, communication, or interface anomalies. The external interface unit adapts interface signals to satellite sensors and satellite actuators, enabling heterogeneous computing results and verified control commands to enter the closed-loop control link, thereby improving the reliability, security, and resource utilization efficiency of the satellite control core.

[0065] Implementation Method 2: Heterogeneous Processor Combination

[0066] In some embodiments of this application, at least two processors in the heterogeneous redundant secure computing processing unit include at least two of the following: a central processing unit (CPU), a digital signal processor (DSP), a field-programmable gate array (FPGA), and a microcontroller (MCU), and the at least two processors employ different processor architectures.

[0067] The heterogeneous redundant safety computing processing unit employs a combination of processors with different architectures, including but not limited to CPUs, DSPs, FPGAs, and MCUs, to improve its ability to withstand common-mode failures. The processors in the heterogeneous multi-core processing hardware circuit execute the attitude and orbit control core computation program in parallel based on the same satellite control input data. The control calculation results of each processor are then fed into a consistency judgment program for the heterogeneous computing processing results.

[0068] The safety core main control processor circuit can use an FPGA device that meets the requirements of the mission environment. The FPGA device can integrate an ARM Cortex-M3 processor to build a minimum hardware system circuit. The minimum hardware system circuit includes an external clock circuit, a power supply circuit, a reset circuit, a JTAG debugging circuit, an ECC verification memory interface circuit, and carries an attitude and orbit control core calculation program and a consistency judgment program for heterogeneous computing processing results. As the main control hardware core, the safety core adopts a redundant main backup circuit design.

[0069] When employing the aforementioned processor combination, the CPU is suitable for executing general control logic and task management, the DSP is suitable for performing digital signal processing operations in attitude and orbit control calculations, the FPGA is suitable for implementing parallel decision-making, bus monitoring, or timing control through hardware logic, and the MCU is suitable for undertaking lightweight control and status monitoring tasks. Different types of processors differ in architecture, instruction sets, and execution mechanisms. When performing parallel computations and comparing results under the same input data, this reduces the probability of erroneous results being directly output due to defects in a single processor. This processor combination is not limited to specific models or manufacturing processes, facilitating configuration based on mission environment, power consumption constraints, and the availability of onboard devices, while retaining the safety benefits of heterogeneous redundancy.

[0070] Implementation Method 3: Hardware Configuration of the Nuclear Safety Control Unit

[0071] In some embodiments of this application, the security core control unit includes a voltage acquisition circuit, an FPGA logic processing circuit, and a watchdog circuit. The voltage acquisition circuit is used to acquire the power supply status of each module, the FPGA logic processing circuit is used to monitor bus messages, processor status, and control calculation results, and to determine faults, and the watchdog circuit is used to monitor the processor's operating status and trigger a reset or redundancy switch when the processor malfunctions.

[0072] like Figure 1 and Figure 3 As shown, the security core control unit is located outside the heterogeneous redundant security computing processing unit and the resource-sharing communication unit, and can independently receive processor heartbeats, bus status, power supply status, and interface status. The voltage acquisition circuit can use a multi-channel analog-to-digital converter to periodically sample the processor core power supply, interface power supply, communication transceiver power supply, and external interface power supply. The FPGA logic processing circuit can implement state machines, bus frame verification, time window counting, result comparison, fault latching, and isolation control output. The watchdog circuit can monitor the feed signals of different processors separately, and output an abnormal signal to the FPGA logic processing circuit when the feed cycle exceeds a preset window, the feed sequence is incorrect, or the processor does not respond for a long time.

[0073] The hardware circuit of the safety core control unit mainly consists of a voltage acquisition circuit, an FPGA timing and logic processing circuit, and a watchdog circuit. The safety core control unit circuit design includes real-time power supply voltage monitoring, watchdog reset, and abnormal reset triggering redundancy switching to ensure continuous operation between the primary and backup safety cores.

[0074] The safety control unit collects the power supply status of all modules on the board in real time through the voltage acquisition circuit (AD acquisition circuit). Combined with FPGA bus frame verification logic and multiple independent watchdog circuits, it continuously monitors the processor's watchdog signal, bus message packet loss and communication anomalies, and completes fault judgment based on the built-in hardware discrimination logic.

[0075] When the processor fails to output the dog feed signal according to the preset cycle, the communication bus experiences continuous message anomalies, or the control calculation results do not meet the consistency requirements, the safety core control unit outputs a hardware switch control signal to complete active redundancy switching, and simultaneously cuts off the power supply to the faulty processor, faulty bus channel, or abnormal interface to achieve hardware electrical isolation. The reset, isolation, and switching actions in this process are initiated by hardware logic independent of the computing processing unit to avoid the inability to perform self-recovery actions when the faulty processor itself fails.

[0076] Figure 3 The "Fault Monitoring" box lists "Lightweight Neural Networks and Physical Constraint Intelligence," which can be implemented as a non-safety-critical auxiliary monitoring function, such as providing early warnings of long-term trends, thermal drift, or communication quality degradation. This auxiliary task has a lower priority than safety-critical control tasks and fault-switching tasks, and can be stopped, downgraded, or migrated when safety-critical tasks require resources. It does not participate in the deterministic decision-making logic that replaces the safety core control unit. Through this boundary constraint, auxiliary intelligent processing will not affect the verification, isolation, and switching of safety-critical control instructions.

[0077] Through the aforementioned hardware configuration, the voltage acquisition circuit provides power supply health status, the FPGA logic processing circuit centrally monitors bus messages, processor status, and control calculation results, and the watchdog circuit detects anomalies such as processor program crashes, blockages, or failure to respond in time. After various statuses are aggregated to the safety core control unit, they form independent fault judgment criteria and drive reset, isolation, or redundancy switching actions. Therefore, the safety core control unit not only undertakes status acquisition functions but also safety judgment and execution control functions, enabling the satellite control closed loop to continue outputting verified control commands even in the event of partial failure of the processor or communication link.

[0078] Implementation Method 4: Trust Startup Process

[0079] In some embodiments of this application, the security kernel control unit is also used to execute a trust startup process during the system power-on phase, including: performing hardware link integrity detection on the heterogeneous redundant security computing processing unit, resource sharing communication unit and external interface unit; performing integrity verification on the satellite control program image and consistency decision program image; and controlling the release of the clock signal and power supply signal of the corresponding module after the hardware link integrity detection and program image integrity verification are passed.

[0080] During the system power-up phase, a hardware-level trusted boot process is executed: The security core control unit performs a hardware link integrity self-test on the heterogeneous multi-core processing hardware circuit, the global resource sharing exchange bus, and the interface adaptation circuits of each channel through the FPGA timing logic circuit; combined with the integrity verification mechanism, the attitude and orbit control operation firmware and the heterogeneous result consistency judgment program image are verified. After the program image integrity verification and hardware link integrity detection pass, the clock and power supply are released to the processor, communication bus, and external satellite sensor / satellite actuator interface step by step, thereby avoiding the boot security risks caused by program abnormalities and hardware failures from the source.

[0081] The integrity verification mechanism can compare the program image with preset check values ​​in the memory, or it can adopt an image verification process suitable for the spaceborne environment. ECC or EDAC is mainly used for error detection and correction of memory data, while integrity verification is used to confirm whether the satellite control program image and the consistency decision program image meet the startup requirements.

[0082] like Figure 3 As shown, upon system startup, a security kernel security configuration initialization is performed first. Then, relevant statuses are collected through the component information sharing communication bus, and log storage, command recording, fault judgment parameter configuration, and satellite remote control and telemetry channels are established. Hardware link integrity detection may include processor reset line status detection, bus transceiver loopback detection, interface channel short circuit or open circuit detection, external interface power supply status detection, and detection of critical clock stability.

[0083] Through this trusted startup process, the security kernel control unit first confirms that the hardware links, communication buses, and external interfaces are in an available state, then confirms that the satellite control program image and consistency decision program image meet the integrity requirements, and finally releases the clock signal and power supply signal. This sequence avoids the processor, communication bus, or external interface from directly entering the control closed loop before completing detection and verification, reducing the risk of erroneous control outputs caused by program image anomalies, bus link anomalies, or interface anomalies during the startup phase. Because the startup process is uniformly controlled by the security kernel control unit, even when the processor is not yet running or in an untrusted state, pre-start checks can still be completed by independent hardware logic.

[0084] Implementation Method 5: External Interface Unit

[0085] In some embodiments of this application, the external interface unit includes at least one of an RS422 interface circuit, a CAN interface circuit, and an input / output drive interface circuit, and includes protection circuits for interface protection and level conversion.

[0086] The external interface adapter hardware circuit adopts a universal and expandable hardware interface circuit to meet the compatibility requirements of various types of satellite control unit components and existing satellite control systems. The standard hardware interface circuit integrates RS422, CAN, and IO driver interface circuits, and each interface is equipped with hardware protection circuit design and radiation-resistant chip.

[0087] The external interface unit is used to connect the satellite sensor and the satellite actuator, and to adapt the interface signals of the satellite sensor and the satellite actuator.

[0088] During normal on-orbit operation, the onboard satellite's sensors collect raw attitude and orbit sensing data. After level conversion and hardware filtering protection by the interface adaptation hardware circuit, the data is sent to the global resource sharing exchange bus and distributed to the primary and backup heterogeneous processors to perform attitude and orbit control calculations in parallel and independently. Validated control commands are then sent again through the global resource sharing exchange bus to actuators such as the momentum wheel and thrusters to complete the satellite's attitude and orbit adjustment.

[0089] like Figure 2 As shown, the component communication interface is located between the unified shared bus and components A and B, and can be implemented by the aforementioned RS422 interface circuit, CAN interface circuit, or input / output driver interface circuit. Through the component communication interface, the resource-sharing communication unit and the control subsystem can share data resources of the same type of satellite control components. Through the security core management unit's management of interface enabling, remote control command filtering, and power supply control, abnormal interfaces can be isolated, preventing faulty interfaces from continuously occupying the shared bus or outputting abnormal control signals to the actuators.

[0090] By incorporating RS422, CAN, and I / O driver interface circuits, the external interface unit can adapt to the communication or drive requirements of different types of satellite sensors and satellite actuators. Protection and level conversion circuits enhance interface stability under varying interface levels, external interference, and abnormal input conditions. This external interface unit connects to a resource-sharing communication unit, enabling satellite sensor data to be distributed to heterogeneous processors for parallel computation and allowing verified control commands to be sent to satellite actuators. Thus, interface adaptation, data sharing, and security verification form a closed loop, balancing compatibility with existing satellite control systems and the unified management requirements of the security core system.

[0091] Implementation Method Six: Resource Sharing Communication Unit and Resource Access Isolation

[0092] In some embodiments of this application, the resource-sharing communication unit uses a single pair of Ethernet communication links or CAN communication links to construct a resource-sharing communication bus. The security kernel control unit is used to allocate control rights of hardware resources in the resource-sharing communication bus according to the priority of control tasks and the health status of each processor, and to isolate resource access for security-critical control tasks and non-security-critical tasks.

[0093] A global resource sharing and exchange communication circuit is designed to enable hardware-level sharing of satellite control components such as satellite sensors and satellite actuators. A network communication bus circuit is designed so that resource sharing can be achieved through information exchange via the communication bus. The communication bus can be a general-purpose SPE+APL Ethernet communication or a high-speed communication CAN bus to realize power supply control and resource sharing of satellite control components.

[0094] The resource-sharing communication unit enables the satellite control safety core system and attitude and orbit control subsystem to communicate and interact with satellite control components such as satellite sensors and satellite actuators, and dynamically allocates control of hardware resources according to mission priority and health status.

[0095] The entire information processing flow is independently and uniformly managed by the security kernel control unit. It relies on hardware-encapsulated logic to achieve autonomous handling across the entire chain, including trusted startup, multi-level instruction verification, hardware fault diagnosis, and proactive fault switching. It also utilizes a global resource-sharing exchange bus to complete data interaction across all modules. Based on the priority of control tasks and the health status of each processor, the security kernel control unit allocates control over hardware resources on the resource-sharing communication bus and isolates resource access for both security-critical and non-security-critical tasks.

[0096] By employing SPE+APL Ethernet communication or CAN bus, the resource-sharing communication unit can establish a unified data interaction channel between heterogeneous redundant safety computing processing units, control subsystem computing processing units, and external interface units. The safety kernel control unit allocates control rights based on task priority and processor health status, ensuring that safety-critical control tasks receive priority or exclusive access during resource contention, while non-safety-critical tasks are isolated or degraded. This resource-sharing approach reduces the redundant stacking caused by independently configuring sensor interfaces, actuator interfaces, and communication hardware for each task. Simultaneously, access isolation prevents non-safety-critical tasks from abnormally occupying critical control links, thus balancing resource utilization and control security.

[0097] Implementation Method Seven: Satellite Control Security Handling Method

[0098] This application also provides a satellite control security processing method, applied to the satellite control security core system of any of the above embodiments. The method includes: acquiring input data from a satellite sensor through an external interface unit; distributing the input data to at least two processors with different processor architectures and instruction sets through a resource-sharing communication unit; controlling the at least two processors to execute satellite attitude and orbit control algorithms in parallel to obtain multiple control calculation results; performing consistency judgment on the multiple control calculation results through an independently configured security core management unit, and verifying the legality of the output control commands; monitoring processor status, communication status, and interface status; and isolating the corresponding faulty object and switching to a healthy heterogeneous processor to output verified control commands when it is determined that the processor, communication channel, or external interface is faulty, or that multiple control calculation results do not meet consistency requirements.

[0099] During normal on-orbit operation, the onboard satellite's sensors collect raw attitude and orbit sensing data. After level conversion and hardware filtering protection by the interface adaptation hardware circuit, the data is sent to the global resource sharing exchange bus and distributed to the primary and backup heterogeneous processors to perform attitude and orbit control calculations in parallel and independently. Control commands to be output are uploaded to the safety core control unit for parallel hardware verification, including command format compliance verification, operation permission whitelist matching, control output threshold exceeding judgment, and consistency comparison of heterogeneous dual-channel calculation results.

[0100] The safety core control unit collects the power supply status of all modules on the board in real time through voltage acquisition circuits. Combined with FPGA bus frame verification logic and multiple independent watchdog circuits, it continuously monitors the processor's watchdog signals, bus packet loss, and communication anomalies. It relies on built-in hardware discrimination logic to complete fault diagnosis. When the fault diagnosis logic determines that the system has an operational risk, the safety core control unit outputs a hardware switch control signal to complete active redundancy switching. It simultaneously cuts off the power supply to the faulty processor, faulty bus channel, or abnormal interface to achieve hardware electrical isolation. Within a preset switching delay that meets the real-time requirements of attitude and orbit control closed-loop operation, it switches to the healthy backup heterogeneous processor to continue the attitude and orbit control closed-loop calculation. The verified valid control commands are then sent again to the momentum wheel, thruster, and other actuators through the global resource sharing exchange bus to complete the satellite attitude and orbit adjustment.

[0101] Combination Figure 3 During operation, the satellite sensor and component status data can be collected first via the component information sharing communication bus, and then the multi-task processing flow can begin. The parallel heterogeneous computing module corresponds to the control calculations of at least two heterogeneous processors; the security verification module corresponds to consistency judgment and control command validity verification; the fault monitoring module corresponds to processor status, communication status, power supply status, and interface status monitoring; and the isolation switching module corresponds to fault object isolation and takeover by healthy heterogeneous processors. Log storage, command recording, fault judgment parameter configuration, and satellite remote control and telemetry provide traceable data and ground maintenance information for the operation process.

[0102] This method involves the satellite sensor input data first being adapted by an external interface unit, then distributed by a resource-sharing communication unit to heterogeneous processors for parallel computation. The safety kernel control unit does not participate in ordinary computation tasks but instead handles consistency decisions, legality verification, and fault handling. This process clearly defines the roles of computation execution, resource sharing, and safety control: the heterogeneous processors provide parallel control computation results, the resource-sharing communication unit provides data distribution and interface resource access capabilities, and the safety kernel control unit provides independent decision-making and isolation switching capabilities. When any processor, communication channel, or interface malfunctions, the faulty object can be isolated, while healthy heterogeneous processors continue to output verified control commands, thereby maintaining the continuity and safety of the attitude and orbit control closed-loop operation.

[0103] Implementation Method 8: Power-on Detection and Verification in Safety Handling Methods

[0104] In some embodiments of this application, before acquiring the input data of the satellite sensor, the method further includes: performing hardware link integrity detection on the heterogeneous redundant security computing processing unit, the resource sharing communication unit, and the external interface unit; performing integrity verification on the satellite control program image and the consistency decision program image; and, after the detection and verification are passed, releasing clock signals and power supply signals to the processor, the communication bus, and the external interface in a preset order.

[0105] During the system power-up phase, a hardware-level trust startup process is executed: The security core control unit performs a hardware link integrity self-test on the heterogeneous multi-core processing hardware circuit, the global resource sharing exchange bus, and the interface adaptation circuits of each channel through the FPGA timing logic circuit; combined with the integrity verification mechanism, the attitude and orbit control operation firmware and the heterogeneous result consistency judgment program image are verified. After the program image integrity verification and hardware link integrity detection pass, the clock and power supply are released to the processor, communication bus, and external satellite sensor / satellite actuator interface level by level.

[0106] This power-on process occurs before the satellite sensor input data enters the closed-loop control. The clocks and power supplies for the processor, communication bus, and external interfaces are released in a preset sequence, enabling the system to complete link self-tests and program image verification before entering the data acquisition and control calculation phase. Compared to direct power-on operation, this process reduces the possibility of untested hardware links or unverified program images participating in the control closed loop. Because the safety kernel control unit executes this process, even if the heterogeneous processor has not yet entered its working state, the necessary safety checks during the startup phase can be completed through independent hardware timing logic.

[0107] Implementation Method Nine: Control Command Validity Verification

[0108] In some embodiments of this application, the legality verification of the control command to be output includes: verifying the command format, matching the operation permission whitelist, and verifying the control output threshold; if the control command fails the legality verification, the control command is prevented from being sent to the satellite actuator.

[0109] During normal on-orbit operation, all control commands to be output are uniformly uploaded to the safety core control unit for parallel hardware verification, including command format compliance verification, operation permission whitelist matching, control output threshold exceeding judgment, and heterogeneous dual-channel operation result consistency comparison. Illegal or out-of-tolerance commands that fail verification can be manually intervened through the telemetry channel or directly intercepted and discarded by hardware logic, and are prohibited from being sent to the actuator.

[0110] Control commands undergo format verification to identify commands whose message structure, field length, verification fields, or encoding formats do not meet requirements; operation permission whitelist matching restricts unauthorized operations from entering the actuator control link; control output threshold verification restricts the output of torque, pulses, speed, or other actuator quantities that exceed the allowable range of attitude and orbit control. All of the above verifications apply to the control commands to be output, rather than requiring all data to undergo the same security verification process.

[0111] By implementing legality checks at three levels—instruction format, permission whitelist, and output threshold—the security kernel control unit can intercept control commands before they reach the satellite actuator. Even if a computation result in one of the heterogeneous processors is abnormal, or an abnormal control command is generated during communication, the security kernel control unit can still prevent the command from being issued based on format, permission, and threshold rules. This verification mechanism, in conjunction with heterogeneous result consistency judgment, addresses both the consistency of control results and whether the final control command is allowed to be output, thereby improving the security of the actuator control link.

[0112] Implementation Method 10: Operation Record and Error Correction Storage

[0113] In some embodiments of this application, the satellite control security processing method further includes storing the trust start verification record, control command verification record, fault judgment parameters and redundancy switching events into a memory with error correction and verification functions.

[0114] Throughout the system operation, the trust startup verification log, instruction verification record, fault judgment parameters, and redundancy switching events are written to a memory with ECC or EDAC error correction function through the ECC or EDAC memory interface.

[0115] The stored content includes hardware link integrity detection records, program image integrity verification records, control command legitimacy verification records, processor status monitoring parameters, communication status monitoring parameters, consistency decision parameters, fault isolation actions, and redundancy switching events during the trust startup phase. These records can be used for on-orbit status analysis, fault tracing, and ground maintenance interpretation. The memory with error correction and verification capabilities reduces the impact of random bit flips in the space environment on the reliability of the recorded data, preventing critical fault records from becoming unusable due to single-event upsets or storage errors. Because the recorded content covers the startup, operation, decision-making, isolation, and switching processes, it provides a basis for long-term on-orbit health management of the satellite control safety core system.

[0116] According to one aspect of this application, an electronic device is provided, comprising: one or more processors, one or more memories, and one or more computer programs; wherein the processor is connected to the memory, and the one or more computer programs are stored in the memory; when the electronic device is running, the processor executes the one or more computer programs stored in the memory to cause the electronic device to perform a heterogeneous redundancy and resource sharing satellite control security kernel method as described in any of the above technical solutions.

[0117] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0118] The memory can be an internal storage unit of the terminal device, such as a hard drive or RAM. Alternatively, it can be an external storage device, such as a plug-in hard drive, Smart Media Card (SMC), Secure Digital (SD) card, or Flash Card. Furthermore, the memory can include both internal and external storage units. The memory is used to store the computer program and other programs and data required by the terminal device. It can also be used to temporarily store data that has been output or will be output.

[0119] According to one aspect of this application, a computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement a satellite control security kernel method with heterogeneous redundancy and resource sharing as described in any of the above technical solutions.

[0120] For example, computer-readable storage media can be read-only memory (ROM), random access memory (RAM), read-only optical disc (CD-ROM), magnetic tape, floppy disk, and optical data storage devices, etc. They can be implemented using program code executable by a computing device, thus allowing them to be stored in a storage device for execution by a computing device, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Therefore, this application is not limited to any particular hardware and software combination.

[0121] This application presents a satellite control safety nuclear system and processing method with heterogeneous redundancy and resource sharing, achieving the following significant and beneficial technical effects:

[0122] Heterogeneous redundancy enhances resistance to common-mode failures and significantly improves security. Processors with different architectures are less likely to suffer from the same design flaws simultaneously, thus improving their resistance to single-event and software common-mode failures.

[0123] Resource sharing and high level of lightweight design. Multi-task sharing of hardware resources reduces the number of redundant hardware components, lowers onboard size, weight, and power consumption, and is compatible with microsatellites and constellation platforms.

[0124] The independent and secure core is under unified management and control, and has the capabilities of trusted startup, command verification, fault diagnosis, and active switching, enabling the satellite control core to operate autonomously and securely.

[0125] It is highly versatile and easy to port. The architecture is not dependent on a specific processor and can be adapted to various spaceborne controllers, attitude and orbit control computers, and integrated electronic systems.

[0126] The above description is merely one embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to the technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A satellite control safety nuclear system with heterogeneous redundancy and resource sharing, characterized in that, include: The heterogeneous redundant safety computing processing unit includes at least two processors with different processor architectures and different instruction sets, which are used to execute satellite attitude and orbit control algorithms in parallel based on the same satellite control input data to generate corresponding control calculation results. An external interface unit is used to connect the satellite sensor and the satellite actuator, and to adapt the interface signals of the satellite sensor and the satellite actuator. The resource-sharing communication unit is connected to the heterogeneous redundant security computing processing unit, the control subsystem computing processing unit, and the external interface unit, respectively, and is used to enable the heterogeneous redundant security computing processing unit and the control subsystem computing processing unit to share access to the data resources and interface resources of the satellite control unit components; The security core control unit is set up independently of the heterogeneous redundant security computing processing unit and the control subsystem computing processing unit. It is used to make consistency decisions on the control computing results, verify the legality of the control commands to be output, and make fault decisions based on the processor status, communication status and consistency decision results. The security core control unit is also used to control and isolate the faulty processor, faulty communication channel or abnormal interface when a fault is determined to exist, and switch to the healthy heterogeneous processor to output verified control commands.

2. The satellite control safety nuclear system according to claim 1, characterized in that, The at least two processors include at least two of the following: a central processing unit (CPU), a digital signal processor (DSP), a field-programmable gate array (FPGA), and a microcontroller (MCU), and the at least two processors employ different processor architectures.

3. The satellite control safety nuclear system according to claim 1, characterized in that, The safety nuclear control unit includes a voltage acquisition circuit, an FPGA logic processing circuit, and a watchdog circuit. The voltage acquisition circuit is used to acquire the power supply status of each module, the FPGA logic processing circuit is used to monitor bus messages, processor status and control calculation results and make fault judgments, and the watchdog circuit is used to monitor the processor's operating status and trigger a reset or redundancy switch when the processor is abnormal.

4. The satellite control safety nuclear system according to claim 1, characterized in that, The security kernel control unit is also used to execute a trust boot process during the system power-on phase, including: Hardware link integrity detection is performed on the heterogeneous redundant secure computing processing unit, the resource-sharing communication unit, and the external interface unit. Perform integrity verification on the satellite control procedure image and the consistency decision procedure image; and After the hardware link integrity check and program image integrity verification pass, the control releases the clock signal and power supply signal of the corresponding module.

5. The satellite control safety nuclear system according to claim 1, characterized in that, The external interface unit includes at least one of an RS422 interface circuit, a CAN interface circuit, and an input / output drive interface circuit, and includes protection circuits for interface protection and level conversion.

6. The satellite control safety nuclear system according to claim 1, characterized in that, The resource-sharing communication unit uses a single pair of Ethernet communication links or CAN communication links to construct a resource-sharing communication bus. The security core control unit is used to allocate control rights of hardware resources in the resource-sharing communication bus according to the priority of control tasks and the health status of each processor, and to isolate resource access for security-critical control tasks and non-security-critical tasks.

7. A satellite control security processing method, applied to the satellite control security nuclear system according to any one of claims 1 to 6, characterized in that, include: The input data of the satellite sensor is obtained through an external interface unit; The input data is distributed to at least two processors with different processor architectures and instruction sets via a resource-sharing communication unit; The at least two processors are controlled to execute the satellite attitude and orbit control algorithm in parallel to obtain multiple control calculation results; The multiple control calculation results are determined by an independently configured security core control unit, and the legality of the output control command is verified. Monitor processor status, communication status, and interface status; as well as When it is determined that there is a fault in the processor, communication channel or external interface, or that the multiple control calculation results do not meet the consistency requirements, the corresponding faulty object is isolated and the healthy heterogeneous processor is switched to output the verified control instructions.

8. The satellite control security processing method according to claim 7, characterized in that, Before acquiring the input data from the satellite sensor, the process also includes: Hardware link integrity detection is performed on heterogeneous redundant secure computing processing units, resource-sharing communication units, and external interface units; Perform integrity verification on the satellite control procedure image and the consistency decision procedure image; and After the detection and verification are passed, clock signals and power supply signals are released to the processor, communication bus and external interface in a preset order.

9. The satellite control security processing method according to claim 7, characterized in that, The validation of the output control command includes: Perform instruction format verification, operation permission whitelist matching, and control output threshold verification on control commands; If a control command fails the validity check, the control command will be prevented from being sent to the satellite actuator.

10. The satellite control security processing method according to claim 7, characterized in that, Also includes: The trust startup verification record, control command verification record, fault judgment parameters, and redundancy switching events are stored in a memory with error correction and verification functions.

Images