Dynamic voting repair method and system for spaceborne memory chips

Abstract

This invention relates to the field of data storage reliability technology for spaceborne electronic devices, and discloses a dynamic voting repair method and system for spaceborne memory chips. The method includes determining the address of radiation disturbance, acquiring readout data, verification data, backup data, mission data, and environmental data; generating an abnormal bit set and identifying the abnormal mode type; performing dynamic voting repair based on multi-source reference bits to obtain the repair bit order; and obtaining reliable cells through integrity assessment, secondary scanning of risky sub-blocks, and replacement readback verification. This invention can improve the data repair reliability of spaceborne memory chips under radiation disturbances.

Description

Technical Field

[0001] This invention relates to the field of data storage reliability technology for spaceborne electronic devices, and in particular to a dynamic voting repair method and system for spaceborne memory chips. Background Technology

[0002] Currently, onboard memory chips are susceptible to space environment factors such as high-energy particle radiation, temperature fluctuations, and power supply disturbances during on-orbit operation, leading to single-event upsets, multiple bit flips, or localized data anomalies in the memory cells. To improve the reliability of onboard electronic systems, some satellite systems have introduced PHM (Prognostics and Health Monitoring) technology to monitor the health status, error rate, and environmental stress of memory chips, and to detect and repair abnormal data using error correction coding.

[0003] In existing technologies, stored data is typically verified using ECC, CRC, or redundant backups. When a single-bit error or a small number of correctable errors are detected, data recovery is performed directly based on the verification result. This method can handle regular random bit flips, but its repair is mainly based on fixed verification rules, making it difficult to dynamically determine when abnormal bits exhibit local clusters, continuous bursts, or are related to the mission context. As the complexity of spaceborne missions increases, stored data not only needs to meet bit-level correctness but also the integrity and reliability requirements during mission execution. Existing methods lack a joint voting mechanism for verification data, backup data, mission data, and environmental data when errors exceed the preset error correction range, making it difficult to accurately determine reliable repair bits and easily leading to false or missed repairs.

[0004] Therefore, existing technologies have the technical problem of being unable to dynamically vote to repair out-of-range abnormal bit sets caused by radiation disturbances. Summary of the Invention

[0005] This invention provides a dynamic voting repair method and system for spaceborne memory chips, to solve the technical problem in the prior art that it is difficult to perform dynamic voting repair for out-of-range abnormal bit sets caused by radiation disturbances.

[0006] In a first aspect, to solve the above-mentioned technical problems, the present invention provides a dynamic voting repair method for onboard memory chips, comprising: Obtain radiation data, determine the disturbance address based on the radiation data, obtain readout data, verification data, backup data and task data based on the disturbance address, and obtain environmental data related to the disturbance time period corresponding to the disturbance address; The original bit sequence is extracted from the read data, and the original bit sequence is initially verified according to the verification data to obtain the abnormal bit set. The distribution characteristics of abnormal bits are determined based on the abnormal bit set, and when the distribution characteristics exceed the preset error correction range, abnormal pattern recognition is performed on the abnormal bit set to obtain the abnormal pattern type. Reference bit groups are extracted from the verification data, backup data, and task data according to the anomaly mode type, and the reference bit groups are subjected to multi-level verification to obtain candidate bit groups. The voting weights are determined based on the candidate position groups, and dynamic voting is performed based on the voting weights to obtain the verification position groups. The verification position groups are then compared with the original position order to obtain the difference position set. The original bit sequence is repaired based on the difference bit set to obtain the repaired bit sequence, and an integrity value is determined based on the repaired bit sequence, the task data, and the environment data. If the integrity value is not less than the preset task integrity threshold, risk sub-blocks are extracted from the repair sequence, and the risk sub-blocks are subjected to a second anomaly scan to obtain stable sub-blocks. The corresponding data in the onboard storage chip is replaced with the stable sub-block to obtain the storage state, and error detection is performed on the storage state to obtain a reliable unit.

[0007] Secondly, the present invention provides a dynamic voting repair system for a spaceborne memory chip, comprising: The data acquisition module is used to acquire radiation data, determine the disturbance address based on the radiation data, acquire readout data, verification data, backup data and task data based on the disturbance address, and acquire environmental data related to the disturbance time period corresponding to the disturbance address. The preliminary verification module is used to extract the original bit sequence from the read data, perform preliminary verification on the original bit sequence according to the verification data, and obtain the abnormal bit set. An anomaly identification module is used to determine the distribution characteristics of the anomaly bits based on the anomaly bit set, and when the distribution characteristics exceed a preset error correction range, to perform anomaly pattern identification on the anomaly bit set to obtain the anomaly pattern type. The reference extraction module is used to extract reference bit groups from the verification data, the backup data and the task data according to the anomaly mode type, and to perform multi-level verification on the reference bit groups to obtain candidate bit groups. The dynamic voting module is used to determine the voting weight based on the candidate position group, and to perform dynamic voting based on the voting weight to obtain the verification position group. The verification position group is then compared with the original position order to obtain the difference position set. The repair evaluation module is used to repair the original bit sequence based on the difference bit set to obtain the repaired bit sequence, and to determine the integrity value based on the repaired bit sequence, the task data, and the environment data. The secondary scanning module is used to extract risky sub-blocks from the repair sequence and perform a secondary anomaly scan on the risky sub-blocks to obtain stable sub-blocks, provided that the integrity value is not less than a preset task integrity threshold. The storage confirmation module is used to replace the corresponding data in the onboard storage chip with the stable sub-block to obtain the storage status, and to perform error detection on the storage status to obtain a reliable unit.

[0008] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention obtains radiation data and determines the disturbance address, and then obtains read data, verification data, backup data, task data and environmental data based on the disturbance address. This makes the location of bit flip anomalies no longer rely solely on a single verification result, but establishes a correspondence with the radiation disturbance source and storage access location, thereby improving the accuracy of abnormal bit set location.

[0009] (2) This invention analyzes the distribution characteristics and identifies abnormal patterns of the abnormal bit set, extracts reference bit groups from the verification data, backup data and task data, and then performs multi-level verification and dynamic voting, so that the repair basis can be adjusted according to the abnormal type and data credibility, thereby improving the reliability of data repair when it exceeds the conventional error correction range.

[0010] (3) The present invention determines the integrity value based on the repair sequence, task data and environmental data, and extracts risk sub-blocks for secondary anomaly scanning after the integrity value meets the preset task integrity threshold. Then, stable sub-blocks are used to replace the corresponding data in the on-board storage chip, so that the data repair results can be continuously confirmed by task integrity, environmental correlation and secondary anomaly status, thereby improving the stability and reliability of the repaired stored data. Attached Figure Description

[0011] Figure 1 This is a schematic flowchart of a dynamic voting repair method for a spaceborne memory chip provided in the first embodiment of the present invention; Figure 2 This is a schematic diagram of a dynamic voting repair system for a spaceborne memory chip provided in the second embodiment of the present invention. Detailed Implementation

[0012] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0013] Reference Figure 1The first embodiment of the present invention provides a dynamic voting repair method for onboard memory chips, comprising the following steps: S11, acquire radiation data, determine the disturbance address based on the radiation data, acquire readout data, verification data, backup data and task data based on the disturbance address, and acquire environmental data related to the disturbance period corresponding to the disturbance address; S12, extract the original bit sequence from the read data, perform preliminary verification on the original bit sequence according to the verification data, and obtain the abnormal bit set; S13, determine the distribution characteristics of abnormal bits based on the abnormal bit set, and when the distribution characteristics exceed the preset error correction range, perform abnormal pattern recognition on the abnormal bit set to obtain the abnormal pattern type. S14, extract reference bit groups from the verification data, the backup data and the task data according to the abnormal mode type, and perform multi-level verification on the reference bit groups to obtain candidate bit groups; S15, determine the voting weight according to the candidate position group, and perform dynamic voting according to the voting weight to obtain the verification position group. Compare the verification position group with the original position order to obtain the difference position set. S16, repair the original bit sequence according to the difference bit set to obtain the repaired bit sequence, and determine the integrity value according to the repaired bit sequence, the task data and the environment data; S17, if the integrity value is not less than the preset task integrity threshold, extract the risk sub-block from the repair sequence, and perform a second anomaly scan on the risk sub-block to obtain the stable sub-block; S18, the corresponding data in the onboard storage chip is replaced by the stable sub-block to obtain the storage state, and the storage state is subjected to error detection to obtain a reliable unit.

[0014] In step S11, the process of acquiring radiation data, determining the disturbance address based on the radiation data, acquiring readout data, verification data, backup data, and task data based on the disturbance address, and acquiring environmental data related to the disturbance time period corresponding to the disturbance address includes: The radiation data is obtained by reading the radiation particle count, radiation dose rate, radiation pulse amplitude, monitoring unit number, and radiation acquisition timestamp output by the radiation monitoring unit during the operation of the on-board storage chip. The disturbance period is determined based on the radiation pulse amplitude, radiation dose rate and radiation acquisition timestamp in the radiation data, and the disturbance address corresponding to the disturbance period is determined by reading the preset address mapping table according to the monitoring unit number. Based on the disturbance address, the onboard storage chip's storage readout value, storage address, and data readout timestamp during the disturbance period are read to obtain the readout data; The corresponding checksum, check bit, and error correction syndrome are read from the perturbation address to obtain the check data; The backup data is obtained by reading the corresponding data bit in the redundant storage area or historical backup area according to the disturbance address; The task data is obtained by reading the corresponding data block identifier, task instruction type, and task priority based on the disturbance address; The environmental data is obtained by reading the space radiation intensity, temperature status, and power supply status of the satellite during its on-orbit operation during the disturbance period.

[0015] It should be noted that the radiation monitoring unit is located in the vicinity of the onboard storage chip. The sampling period of the radiation monitoring unit is determined to be half of the minimum storage access period of the onboard storage controller, and the reciprocal of the sampling period is determined as the sampling frequency. In this embodiment, the radiation particle count, radiation dose rate, radiation pulse amplitude, and monitoring unit number output under the same radiation acquisition timestamp are mapped to obtain a radiation data record; the above mapping is performed on all radiation acquisition timestamps to obtain the radiation data.

[0016] It should be noted that the sampling period is determined during the assembly and debugging phase, specifically by reading the radiation pulse amplitude and radiation dose rate within the sampling period. Specifically, it involves reading the minimum storage access period of the onboard storage controller and determining half of the minimum storage access period as the sampling period. The pulse amplitude excess is obtained by subtracting the pulse amplitude background reference from the radiation pulse amplitude and taking the larger value between the difference and 0. The pulse amplitude excess is then divided by the pulse amplitude background fluctuation value to obtain the pulse amplitude excess multiple. The dose rate excess is obtained by subtracting the dose rate background reference from the radiation dose rate and taking the larger value between the difference and 0. The dose rate excess is then divided by the dose rate background fluctuation value to obtain the dose rate excess multiple. The larger value between the pulse amplitude excess multiple and the dose rate excess multiple is taken as the radiation disturbance comparison value, and the radiation acquisition timestamp corresponding to the radiation disturbance comparison value being greater than 0 is determined as the candidate disturbance timestamp. Continuous candidate disturbance timestamps are merged to obtain the candidate disturbance period. The candidate disturbance period is then extended forward and backward according to the storage access delay time of the onboard storage chip to obtain the disturbance period.

[0017] It should be noted that the radiation background benchmark is determined based on historical radiation data during the normal operation of the onboard storage chip. Historical radiation pulse amplitudes and historical radiation dose rates during periods without storage verification anomalies are read; the median of each historical radiation pulse amplitude and historical radiation dose rate is taken as the corresponding background center value; the absolute value of the difference between each historical data point and the corresponding background center value is calculated, and the median of these absolute values ​​is taken as the background fluctuation value; the sum of the background center value and the background fluctuation value by a preset multiple is determined as the corresponding radiation background benchmark.

[0018] It should be noted that the preset multiple is determined based on ground irradiation test data. In this embodiment, radiation data under normal read / write conditions and under conditions of storage verification anomalies are collected during the ground irradiation test phase. For radiation pulse amplitude, the background center value and background fluctuation value of the pulse amplitude under normal read / write conditions are first calculated according to the aforementioned method. Then, the absolute value of the pulse amplitude background center value is subtracted from the radiation pulse amplitude under each normal read / write condition, and divided by the pulse amplitude background fluctuation value to obtain the normal pulse deviation multiple. The maximum value among all normal pulse deviation multiples is taken as the normal pulse boundary multiple. The absolute value of the pulse amplitude background center value is subtracted from the radiation pulse amplitude under each storage verification anomaly condition, and divided by the pulse amplitude background fluctuation value to obtain the abnormal pulse deviation multiple. The minimum value among all abnormal pulse deviation multiples is taken as the abnormal pulse boundary multiple. The arithmetic mean of the normal pulse boundary multiple and the abnormal pulse boundary multiple is determined as the preset multiple corresponding to the radiation pulse amplitude. For radiation dose rate, the preset multiple corresponding to the radiation dose rate is calculated using the same method.

[0019] In one implementation, the preset address mapping table is established during the assembly and debugging phase of the onboard memory chip. The physical layout file, memory addressing file, and radiation monitoring unit installation location file of the onboard memory chip are read. A correspondence between physical locations and memory addresses is established based on the physical locations of the memory blocks and the memory address ranges. The corresponding monitoring coverage area is determined based on the installation coordinates and calibration coverage radius in the radiation monitoring unit installation location file. The memory address ranges falling within the monitoring coverage area are then associated with the corresponding monitoring unit numbers to obtain the preset address mapping table.

[0020] Furthermore, in this embodiment, the monitoring unit number is used as an index to read the corresponding storage address range from a preset address mapping table; the storage access records of the onboard storage chip during the disturbance period are read, and the storage addresses whose data reading timestamps fall within the disturbance period and whose storage addresses fall within the storage address range are determined as the disturbance addresses. When multiple disturbance addresses exist, they are arranged in order of data reading timestamps and storage addresses.

[0021] In one implementation, this embodiment uses the disturbance address and the disturbance period as indexes to read the storage read value, storage address, and data read timestamp from the storage access record to obtain the read data; read the check code, check bit, and error correction syndrome from the error correction verification record to obtain the verification data; read the corresponding data bit from the redundant storage area or historical backup area to obtain the backup data; read the data block identifier, task instruction type, and task priority from the task management unit to obtain the task data; read the space radiation intensity, temperature status, and power supply status from the on-orbit environment monitoring record to obtain the environmental data; when multiple environmental sampling values ​​exist, the environmental sampling value with the smallest time interval from the data read timestamp is selected as the environmental data for the corresponding disturbance address.

[0022] In step S12, the step of extracting the original bit sequence from the read data and performing a preliminary check on the original bit sequence based on the check data to obtain an abnormal bit set includes: Read the stored read value, storage address, and data read timestamp from the read data; sort the stored read value according to the storage address and the data read timestamp to obtain the original position order; Read the check code, check bit, and error correction syndrome from the check data, and perform check calculation on the original bit sequence based on the check code and the check bit to obtain the check result; The verification results are matched with the error correction syndrome to obtain the location of the verification anomaly; Based on the location of the verification anomaly, the abnormal data bits are extracted from the original bit sequence, and the bit sequence number of the abnormal data bits, the corresponding perturbation address, and the data reading timestamp are associated to obtain the abnormal bit set.

[0023] It should be noted that in this embodiment, the storage address, storage read value, and data read timestamp in the read data are read. First, the storage read values ​​are arranged in ascending order of data read timestamp. When there are multiple storage read values ​​under the same data read timestamp, they are arranged in ascending order of storage address. Then, each storage read value is expanded in ascending order of bit sequence number to obtain the original bit sequence.

[0024] In one implementation, this embodiment reads the checksum, check bits, and error correction syndrome from the verification data. The checksum is the error correction encoding identifier used by the storage block corresponding to the current perturbation address, used to index the corresponding check matrix and check bit arrangement order in the error correction verification configuration table; the check bits are redundant check bits synchronously read by the onboard storage chip during the storage read process; the error correction syndrome is hardware syndrome data output by the onboard storage controller based on the current storage read operation.

[0025] It should be noted that the verification matrix is ​​constructed using test vectors during the assembly and debugging phase of the onboard storage chip. Specifically, in this embodiment, the number of data bits and the number of parity bits corresponding to a single storage read operation are first read. The number of data bits is determined as the number of columns in the verification matrix, and the number of parity bits is determined as the number of rows in the verification matrix. An all-zero test bit sequence is generated and input into the error correction coding circuit to read the reference parity bit. Then, one bit in the all-zero test bit sequence is set to 1, while the remaining bits remain 0, to obtain a single-bit test bit sequence. Each single-bit test bit sequence is input into the error correction coding circuit to read the output parity bit, and the output parity bit is XORed bit by bit with the reference parity bit to obtain the verification participation vector corresponding to the bit sequence number. Each verification participation vector is written into the matrix column according to the bit sequence number to obtain the verification matrix, and the verification matrix is ​​written into the error correction verification configuration table.

[0026] Further, in this embodiment, the corresponding parity matrix and parity bit arrangement order are read from the error correction and verification configuration table according to the parity code. For any parity bit, the bit sequence number with a value of 1 in the corresponding row of the parity matrix is ​​read, and the corresponding data bit is extracted from the original bit sequence; an XOR operation is performed on all the extracted data bits to obtain the calculated parity bit corresponding to the parity bit; then, the calculated parity bit is XORed with the parity bit at the corresponding position in the parity data to obtain the comprehensive parity bit corresponding to the parity bit. The above calculation is performed on all parity bits, and the comprehensive parity bits are combined according to the parity bit arrangement order to obtain the calculated comprehensive parity, which is determined as the verification result.

[0027] Further, in this embodiment, the verification result and the error correction syndrome are adjusted to have the same bit width and then compared bit by bit. The calculated syndrome in the verification result is determined as the target syndrome. The syndrome position mapping table in the error correction verification configuration table is queried according to the target syndrome to obtain the corresponding bit sequence number, and this bit sequence number is determined as the verification anomaly position. The syndrome position mapping table is generated based on the verification matrix. Specifically, it involves sequentially reading the matrix column vector corresponding to each bit sequence number in the verification matrix and associating the matrix column vector with the corresponding bit sequence number to obtain the syndrome position mapping table. When the target syndrome is all 0s, no verification anomaly position is generated; when the target syndrome does not match the syndrome position mapping table, the readout data range corresponding to the target syndrome is marked as a multi-bit anomaly range, and all bit sequence numbers within this readout data range are determined as verification anomaly positions.

[0028] In one implementation, the bit sequence number in the verification anomaly position is read, and the perturbation address, data read timestamp, and bit sequence number arrangement rule corresponding to each stored read value in the original bit sequence are read. The target stored read value in the original bit sequence is located based on the perturbation address and the data read timestamp. Then, the corresponding data bit is read from the target stored read value based on the bit sequence number to obtain the abnormal data bit. If the verification anomaly position is a multi-bit anomaly range, all bit sequence numbers within the multi-bit anomaly range are read, and the corresponding data bits are extracted sequentially from the original bit sequence to obtain multiple abnormal data bits. Subsequently, each abnormal data bit is associated with its corresponding bit sequence number, perturbation address, and data read timestamp to obtain an abnormal bit record. All abnormal bit records are arranged according to the data read timestamp and perturbation address to obtain the abnormal bit set.

[0029] In step S13, determining the distribution characteristics of abnormal bits based on the abnormal bit set, and when the distribution characteristics exceed a preset error correction range, performing abnormal pattern recognition on the abnormal bit set to obtain the abnormal pattern type, includes: Read the bit sequence number, disturbance address and data reading timestamp corresponding to each abnormal data bit in the abnormal bit set; Based on the address distribution statistics of each of the disturbance addresses, the number of abnormal addresses, the span of abnormal addresses, and the interval between adjacent abnormal addresses are obtained; Based on the timestamps of the data read, time distribution statistics are performed to obtain the duration of the anomaly and the number of anomalies per unit time. Based on the bit sequence number, perform bit distribution statistics to obtain the number of abnormal bits and the consecutive length of abnormal bits; The distribution characteristics are obtained by combining the number of abnormal addresses, the span of abnormal addresses, the interval between adjacent abnormal addresses, the duration of the abnormality, the number of abnormalities per unit time, the number of abnormal bits, and the continuous length of abnormal bits. The distribution feature is compared with the corresponding range item in the preset error correction range. If at least one feature value in the distribution feature exceeds the corresponding range item, it is determined that the distribution feature exceeds the preset error correction range. If the distribution features exceed the preset error correction range, an abnormal pattern feature vector is generated based on the distribution features, and pattern matching is performed on the abnormal pattern feature vector to obtain the abnormal pattern type.

[0030] It should be noted that in this embodiment, the bit sequence number, perturbation address, and data read timestamp of each abnormal bit record in the abnormal bit set are read. The bit sequence number represents the bit arrangement number of the abnormal data bit in the corresponding stored read value. Subsequently, all perturbation addresses are deduplicated to obtain an abnormal address set, and the number of perturbation addresses in the abnormal address set is counted to obtain the number of abnormal addresses. Each perturbation address is converted into an address sequence number according to the storage address addressing file, and arranged in ascending order of address sequence number. The abnormal address span is obtained by subtracting the end address sequence number from the start address sequence number. The difference between adjacent address sequence numbers is calculated, and the median of the difference is taken as the interval between adjacent abnormal addresses. If the abnormal address set contains only one perturbation address, then both the abnormal address span and the interval between adjacent abnormal addresses are set to 0.

[0031] It is worth noting that in this embodiment, the physical arrangement order corresponding to each storage address in the storage address addressing file is read, and the physical arrangement order is determined as the address sequence number of the corresponding storage address; if the storage address addressing file already contains consecutive address numbers, then the consecutive address numbers are directly determined as the address sequence number.

[0032] In one implementation, this embodiment arranges all data read timestamps in chronological order and determines the duration of the anomaly as the time difference between the end timestamp and the start timestamp. The total number of anomaly records is counted, and this total number is divided by the duration of the anomaly to obtain the number of anomalies per unit time. If the duration of the anomaly is 0, the total number is divided by the sampling period in step S11 to obtain the number of anomalies per unit time.

[0033] Specifically, this embodiment counts the number of abnormal data bits in the abnormal bit set to obtain the number of abnormal bits; it groups the abnormal bit records according to the same disturbance address and the same data read timestamp, and arranges them in ascending order of bit sequence number within each group; abnormal data bits with an adjacent bit sequence number difference of 1 are grouped into the same continuous abnormal bit segment, the number of data bits in each continuous abnormal bit segment is counted, and the maximum value is taken as the continuous length of the abnormal bit. If there are no adjacent continuous bit sequence numbers, the continuous length of the abnormal bit is determined to be 1.

[0034] Furthermore, in this embodiment, the number of abnormal addresses, the span of abnormal addresses, the interval between adjacent abnormal addresses, the duration of abnormality, the number of abnormalities per unit time, the number of abnormal bits, and the continuous length of abnormal bits are combined in the order of the fixed fields to obtain the distribution characteristics.

[0035] It should be noted that the preset error correction range is determined based on the error correction coding configuration data and anomaly repair sample set of the onboard storage chip. Specifically, this embodiment reads the number of single-time correctable bits, the length of consecutive correctable bits, and the range of correctable data blocks from the error correction verification configuration table, and determines the number of single-time correctable bits as the initial upper limit of the number of abnormal bits, the length of consecutive correctable bits as the initial upper limit of the consecutive length of abnormal bits, and the number of addresses and address span corresponding to the range of correctable data blocks as the initial upper limits of the number of abnormal addresses and the abnormal address span, thus obtaining the initial error correction range. The anomaly repair sample set consists of ground irradiation test samples, ground mission replay test samples, and on-orbit operation repair logs. Before satellite insertion into orbit, the ground irradiation test samples and ground mission replay test samples are written into the anomaly repair sample set as initial samples. After satellite insertion into orbit, each anomaly bit set successfully repaired by the error correction mechanism and passed readback verification is written into the anomaly repair sample set, and the corresponding number of anomaly addresses, anomaly address span, interval between adjacent anomaly addresses, anomaly duration, number of anomalies per unit time, number of anomalies, and consecutive length of anomalies are recorded. Subsequently, the minimum and maximum values ​​of each field in the anomaly repair sample set are calculated to obtain the sample value range corresponding to each field. The intersection of the initial error correction range and the sample value range is calculated to obtain the corresponding range item in the preset error correction range. When the lower limit of the range item corresponding to any field is greater than the upper limit of the range item, the initial error correction range is used as the preset error correction range corresponding to that field.

[0036] Specifically, in this embodiment, each feature value in the distribution feature is read and compared with the corresponding range item in the preset error correction range; when at least one feature value is lower than the lower limit of the corresponding range item or higher than the upper limit of the corresponding range item, it is determined that the distribution feature exceeds the preset error correction range; when all feature values ​​fall within the corresponding range item, it is determined that the distribution feature does not exceed the preset error correction range.

[0037] Specifically, each feature value in the distribution features is read according to the fixed field order, and then divided by the upper limit value of the corresponding range item in the preset error correction range to obtain the normalized feature value corresponding to each feature value; for a range item with a lower limit and an upper limit, the absolute value of the difference between the feature value and the center value of the range item is divided by the width of the range item to obtain the normalized feature value; all normalized feature values ​​are arranged according to the fixed field order to obtain the abnormal pattern feature vector.

[0038] It should be noted that the anomaly pattern matching is performed based on a preset anomaly pattern template library. This preset anomaly pattern template library is established through ground irradiation experiments and updated after historical on-orbit anomaly data is read back and verified. Specifically, this embodiment collects sample anomaly bit sets corresponding to single-bit flips, multi-bit flips, continuous bit flips, address clustering anomalies, and time burst anomalies. Each sample anomaly bit set is obtained by comparing the bit sequence written before the experiment with the bit sequence read after the experiment, and the corresponding anomaly pattern label is determined based on the number of anomaly bits, the continuous length of anomaly bits, the span of anomaly addresses, and the duration of anomalies. For each anomaly pattern, when the number of valid samples is not less than the number of fields in the anomaly pattern feature vector plus 1, and the change in each field of the template vector before and after adding a new sample is not greater than the quantization resolution of the corresponding field, the current number of samples is determined as the number of samples for that anomaly pattern, and the arithmetic mean vector of the anomaly pattern feature vectors of each sample is determined as the corresponding pattern template vector. The addition of 1 to the number of fields in the feature vector of anomaly patterns indicates that the number of valid samples for each anomaly pattern must be greater than the number of feature fields. This ensures that the pattern template vector is not determined by a single field or a small number of samples, and that the comparison of template stability before and after adding new samples has a sample basis.

[0039] Further, this embodiment calculates the distance between the current anomaly pattern feature vector and each pattern template vector. The distance is the Euclidean distance, specifically calculated by determining the difference between the corresponding feature values ​​of each dimension in the current anomaly pattern feature vector and the pattern template vector, summing the squared differences, and taking the square root of the sum to obtain the distance value. The anomaly pattern name corresponding to the pattern template vector with the smallest distance value is determined as the anomaly pattern type. If multiple identical minimum distance values ​​exist, the anomaly pattern name that matches first is selected as the anomaly pattern type, following the template order of single-bit flip, multi-bit flip, consecutive bit flip, address clustering anomaly, and time burst anomaly.

[0040] In step S14, the step of extracting reference bit groups from the verification data, the backup data, and the task data according to the anomaly mode type, and performing multi-level verification on the reference bit groups to obtain candidate bit groups, includes: Determine the target abnormal address range and target bit range based on the abnormal mode type; Based on the target abnormal address range and the target bit range, extract the corresponding check bits and error correction syndrome from the check data to obtain the check reference bits; Based on the target abnormal address range and the target bit range, extract the data bits corresponding to the address from the backup data to obtain the backup reference bits; Based on the target abnormal address range, extract the corresponding data block identifier, task instruction type and task priority from the task data, and determine the task association reference bit based on the data block identifier, the task instruction type and the task priority; The verification reference bit, the backup reference bit, and the task association reference bit are associated according to their corresponding perturbation addresses and bit numbers to obtain the reference bit group; The reference bit group is subjected to verification consistency, backup consistency, and task correlation verification respectively to obtain the verification results, backup verification results, and task verification results. The reference bit group whose verification result, backup verification result, and task verification result all satisfy the corresponding verification conditions is determined as the candidate bit group.

[0041] It should be noted that in this embodiment, the abnormal mode type obtained in step S13 is read, and the perturbation address and bit number corresponding to each abnormal data bit in the abnormal bit set are read. When the abnormal mode type is a single bit flip, the corresponding single perturbation address is determined as the target abnormal address range, and the corresponding single bit number is determined as the target bit range. When the abnormal mode type is one of multiple bit flips or consecutive bit flips, the set of perturbation addresses appearing in the abnormal bit set is determined as the target abnormal address range, and the continuous bit interval between the minimum bit number and the maximum bit number under the same perturbation address is determined as the target bit range. When the abnormal mode type is one of address clustering abnormality or time burst abnormality, the address interval between the minimum perturbation address and the maximum perturbation address in the abnormal bit set is determined as the target abnormal address range, and all bit numbers corresponding to a single storage read operation are determined as the target bit range.

[0042] In one implementation, the check bits and error correction syndromes corresponding to the target abnormal address range are read, and the check matrix constructed in step S12 is read. For any perturbation address and any target bit sequence number within the target abnormal address range, two candidate bit sequences with candidate bit values ​​of 0 and 1 are constructed respectively. The two candidate bit sequences are substituted into the check matrix for check calculation to obtain two candidate syndromes. The number of different bits between the two candidate syndromes and the error correction syndrome is calculated, and the candidate bit value with the smaller number of different bits is determined as the check reference bit corresponding to the perturbation address and the target bit sequence number. When the number of two different bits is the same, the original bit value corresponding to the original bit sequence is determined as the check reference bit.

[0043] In one implementation, the data bits corresponding to each disturbed address within the target abnormal address range are read from the redundant storage area or historical backup area. For any disturbed address, the data bits with the corresponding bit sequence number are read according to the target bit range, and the read data bits are determined as backup reference bits. When there are multiple backup timestamps in the historical backup area, the data bits corresponding to the backup timestamp that is earlier than the disturbed period and closest to the disturbed period are read.

[0044] Further, this embodiment reads the data block identifier, task instruction type, and task priority corresponding to the target abnormal address range, and queries the task coding rule table according to the task instruction type to obtain the corresponding fixed field position, opcode field position, and check constraint field position; matches the above field positions with the target bit range, and reads the task constraint value corresponding to the matched bit sequence number to obtain the task association reference bit. The task coding rule table is established by reading the task instruction format file and the task data block definition file. The task instruction format file includes an instruction type field, a field name field, a field start bit sequence number field, a field end bit sequence number field, a field function field, and a field constraint identifier field; for example, when the task instruction type is an attitude control instruction, bits 0 to 7 are the opcode field, bits 8 to 23 are the control parameter field, and bits 24 to 31 are the check constraint field, and the correspondence between the field position, field value, and task instruction type is written into the task coding rule table.

[0045] In one implementation, this embodiment associates the check reference bit, backup reference bit, and task association reference bit corresponding to the same perturbation address and the same bit sequence number to obtain a reference bit record; the above association operation is performed on all target abnormal address ranges and target bit ranges to obtain the reference bit group.

[0046] The reference bit record includes at least the perturbation address, bit sequence number, check reference bit, backup reference bit, task association reference bit, and task priority.

[0047] Furthermore, this embodiment performs multi-layer verification on the reference bit group. Specifically, the verification reference bit is written into the corresponding perturbation address and bit sequence number in the original bit sequence to obtain the verification replacement bit sequence, and the replacement syndrome is calculated according to the verification matrix in step S12; when the number of different bits between the replacement syndrome and the error correction syndrome is less than the number of different bits between the calculated syndrome and the error correction syndrome corresponding to the original bit sequence, the verification result is determined to be passed. The verification reference bit and backup reference bit in the same reference bit record are read. If they are the same, the backup verification result is determined to be passed. When there is a task-related reference bit, the verification reference bit is compared with the task-related reference bit. If they are the same, the task verification result is determined to be passed; when there is no task-related reference bit, the task verification result is determined to be passed, and the corresponding reference bit record is marked as a non-task constraint bit.

[0048] In one implementation, this embodiment determines the reference bit record where the verification result, backup verification result, and task verification result are all passed as the candidate bit record; all candidate bit records are arranged according to the perturbation address and bit sequence number to obtain the candidate bit group.

[0049] In step S15, determining the voting weights based on the candidate bit groups and performing dynamic voting based on the voting weights to obtain a verification bit group, and comparing the verification bit group with the original bit order to obtain a set of differences, includes: The verification credibility, backup matching degree, and task relevance are determined based on the candidate bit group. The verification credibility, the backup matching degree, and the task relevance are weighted and normalized to obtain the verification voting weight, the backup voting weight, and the task voting weight. The check reference bit, backup reference bit and task association reference bit corresponding to the same perturbation address and the same bit sequence number are weighted and calculated with the corresponding voting weights to obtain the bit voting value; The verification bit value corresponding to the bit sequence number is determined based on the bit voting value, and the verification bit values ​​are arranged according to the perturbation address and bit sequence number to obtain the verification bit group; The verification bit value in the verification bit group is compared bit by bit with the original bit value of the corresponding bit number in the original bit sequence to obtain the bit number that has a difference. The difference bit set is obtained by associating the differing bit sequence number, the corresponding perturbation address, the original bit value, and the verification bit value.

[0050] It is worth noting that in this embodiment, the verification reference bit, backup reference bit, task-related reference bit, number of syndrome differences before replacement, and number of syndrome differences after replacement are read from the candidate bit group. The number of syndrome differences before replacement and the number of syndrome differences after replacement are subtracted from the number of syndrome differences after replacement to obtain the syndrome improvement amount; when the syndrome improvement amount is greater than 0, the syndrome improvement amount is determined as the verification confidence; when the syndrome improvement amount is not greater than 0, the verification confidence is determined as 0. The number of backup reference bits with the same value as the verification reference bit and the total number of backup reference bits participating in the verification are read, and the two are divided to obtain the backup matching degree; when the total number of backup reference bits is 0, the backup matching degree is determined as 0. When there is a task-related reference bit and the task-related reference bit passes the task constraint verification, the task priority in the task data is read, and the corresponding priority value is determined according to the arrangement order of the task priorities in the task data. The priority value is determined as the task correlation degree; wherein, the priority value corresponding to the lowest task priority is 1, and the other task priorities are incremented by 1 in ascending order; when there is no task-related reference bit or the task-related reference bit fails the task constraint verification, the task correlation degree is determined as 0.

[0051] Specifically, in this embodiment, the verification credibility, backup matching degree, and task relevance corresponding to the same candidate position record are added together to obtain a weight benchmark value; the verification credibility, backup matching degree, and task relevance are each divided by the weight benchmark value to obtain the verification voting weight, backup voting weight, and task voting weight. When the weight benchmark value is 0, the verification voting weight is determined to be 1, and the backup voting weight and task voting weight are determined to be 0.

[0052] It should be noted that in this embodiment, the verification reference bit, backup reference bit, and task-related reference bit are multiplied by their respective voting weights, and the multiplication results are summed to obtain the bit voting value. When there is no task-related reference bit, the multiplication result corresponding to the task-related reference bit is set to 0. When the bit voting value is greater than 0.5, the verification bit value is set to 1; when the bit voting value is less than 0.5, the verification bit value is set to 0; when the bit voting value is equal to 0.5, the verification reference bit is set as the verification bit value. The above dynamic voting operation is performed on all candidate bit records, and the verification bit values ​​are arranged according to the perturbation address and bit sequence number to obtain the verification bit group.

[0053] It is worth noting that in this embodiment, the perturbation address and bit sequence number corresponding to each verification bit value in the verification bit group are read, and the corresponding original bit value is read in the original bit sequence; the verification bit value and the original bit value are compared bit by bit, and the bit sequence numbers, corresponding perturbation addresses, original bit values ​​and verification bit values ​​that are inconsistent are associated to obtain the difference bit record; all difference bit records are arranged according to the perturbation address and bit sequence number to obtain the difference bit set.

[0054] In step S16, the original bit sequence is repaired based on the difference bit set to obtain the repaired bit sequence, and an integrity value is determined based on the repaired bit sequence, the task data, and the environment data, including: Read the difference bit set and locate the corresponding bit to be repaired in the original bit sequence; The original bit value of the bit to be repaired is replaced with the corresponding verification bit value to obtain the candidate repair bit order; The candidate repair order is verified and calculated based on the verification data to obtain the repair verification result. If the repair verification result meets the verification consistency condition, the candidate repair order will be determined as the repair order. Based on the task data, determine the data block identifier, task instruction type, and task priority corresponding to the repair sequence, and determine the task integrity weight based on the data block identifier, the task instruction type, and the task priority; Based on the environmental data, determine the spatial radiation intensity, temperature status, and power supply status corresponding to the disturbance period, and determine the environmental impact weight based on the spatial radiation intensity, temperature status, and power supply status; The integrity value is obtained by weighting the results of the verification of the repair order, the task integrity weight, and the environmental impact weight.

[0055] It should be noted that in this embodiment, the perturbation address and bit sequence number are read from the difference bit record, and the corresponding bit to be repaired is located in the original bit sequence; the original bit value of the bit to be repaired is replaced with the corresponding verification bit value. The above replacement operation is performed on all difference bit records to obtain the candidate repair bit sequence.

[0056] Specifically, in this embodiment, the checksum and check bits in the check data are read, and the check matrix determined in step S12 is read according to the checksum; the candidate repair bit sequence is XORed according to the check calculation method in step S12 to obtain the repair calculation syndrome, and the repair calculation syndrome is determined as the repair check result. When the repair calculation syndrome is all 0, it is determined that the repair check result meets the check consistency condition, and the candidate repair bit sequence is determined as the repair bit sequence; when the repair calculation syndrome is not all 0, the corresponding perturbation address is marked as the address to be scanned a second time.

[0057] Furthermore, this embodiment determines the task integrity weight based on the task data. Specifically, the data block identifier, task instruction type, and task priority in the task data are read, and the corresponding task priority value is read from the task priority table according to the task priority; the maximum value of all task priority values ​​in the task priority table is read, and the task priority value is divided by the maximum value to obtain the task integrity weight.

[0058] It should be noted that the task priority table is generated during the task software loading phase. Specifically, this embodiment reads the task configuration file in the task software. The task configuration file includes a task identifier, task instruction type, task execution time limit, and task failure impact level. The task failure impact level is determined by the safety mode trigger identifier, attitude and orbit control association identifier, payload control association identifier, communication link association identifier, and data retransmission identifier in the task configuration file. When a task failure will trigger a satellite safety mode, the task data belongs to attitude and orbit control data, the task data belongs to payload control data, the task data belongs to communication link control data, or the task data cannot be recovered through a backup link or ground retransmission, the corresponding identifier is set to 1. If the corresponding conditions are not met, the corresponding identifier is set to 0. The task failure impact level is obtained by adding the above identifiers together. Subsequently, the task failure impact levels corresponding to all tasks in the same task configuration file are read and sorted in ascending order of their numerical values. The sorting sequence number is used as the initial priority value. When multiple tasks have the same task failure impact level, they are sorted in ascending order of their execution time limits. The initial priority value of the task with the highest sorting time is increased by a unit correction value to obtain the task priority value. The unit correction value is 1 divided by the number of tasks with the same task failure impact level plus 1. The task identifier, task instruction type, and task priority value are mapped to obtain the task priority table, which is stored by the task management unit.

[0059] In one implementation, this embodiment determines the environmental impact weight based on environmental data. Specifically, it reads space radiation intensity, temperature status, and power supply status, along with their corresponding stable operating baseline ranges. For any environmental data, it takes the center value and half-width value of the corresponding stable operating baseline range, calculates the absolute value of the difference between the environmental data and the center value, and divides the absolute value of the difference by the half-width value to obtain the environmental deviation ratio. When the environmental deviation ratio is greater than 1, the environmental stability value is determined to be 0; when the environmental deviation ratio is not greater than 1, the value obtained by subtracting the environmental deviation ratio from 1 is determined as the environmental stability value. After obtaining the environmental stability values ​​corresponding to space radiation intensity, temperature status, and power supply status, the arithmetic mean of the three is taken to obtain the environmental impact weight. The stable operating baseline range is determined based on historical environmental data during the normal operation phase of the onboard storage chip. It reads historical space radiation intensity, historical temperature status, and historical power supply status during periods when no storage verification anomalies occurred; it sorts the historical environmental data of the same type according to their numerical values, takes the 5th percentile as the lower limit, and takes the 95th percentile as the upper limit to obtain the stable operating baseline range for the corresponding environmental data.

[0060] Further, the repair calculation syndrome in the repair verification result is read, and the repair calculation syndrome is compared bit by bit with the all-zero syndrome to obtain the number of residual syndrome bits; the number of residual syndrome bits is divided by the total number of bits in the repair calculation syndrome to obtain the residual syndrome ratio; the value obtained by subtracting the residual syndrome ratio from 1 is determined as the verification pass result. Subsequently, the verification pass result, the task integrity weight, and the environmental impact weight are multiplied by their respective integrity calculation weights and then added together to obtain the integrity value.

[0061] It is worth noting that the integrity calculation weight includes verification weight, task weight, and environmental weight, and the sum of the three is 1. The integrity calculation weight is determined during the ground testing phase. Specifically, this embodiment constructs a verification anomaly test group, a task impact test group, and an environmental deviation test group; wherein, the verification anomaly test group keeps the task data and environmental data unchanged, and sets candidate repair bit sequences with different residual syndrome bits. When the readback verification result corresponding to the candidate repair bit sequence fails, it is recorded as a verification anomaly trigger; the task impact test group keeps the repair verification result and environmental data unchanged, and sets task data with different task priority values. When the task playback result and the no-anomaly task playback result have at least one different bit value corresponding to the same bit sequence number under the same data block identifier, it is recorded as a task impact trigger; the environmental deviation test group keeps the repair verification result and task data unchanged, and sets different space radiation intensity, temperature state, and power supply state. When the readback verification result fails or the storage state does not meet the preset reliability conditions, it is recorded as an environmental deviation trigger. The number of verification anomaly triggers in the verification anomaly test group, the number of task impact triggers in the task impact test group, and the number of environment deviation triggers in the environment deviation test group are counted separately. The total number of triggers for each of these three types is then summed. The verification anomaly trigger count is divided by the total number of triggers to obtain the verification weight; the task impact trigger count is divided by the total number of triggers to obtain the task weight; and the environment deviation trigger count is divided by the total number of triggers to obtain the environment weight. If the total number of triggers is 0, then 1 is divided by the number of integrity calculation factors to obtain the integrity calculation weight for each factor.

[0062] In step S17, if the integrity value is not less than a preset task integrity threshold, risk sub-blocks are extracted from the repair sequence, and a second anomaly scan is performed on the risk sub-blocks to obtain stable sub-blocks, including: A preset task integrity threshold is determined based on the task data. If the integrity value is not less than the preset task integrity threshold, the key task data segment in the repair sequence is determined based on the task data. According to the data block identifier and task instruction type corresponding to the key task data segment, extract the corresponding data bit range from the repair bit sequence to obtain candidate sub-blocks; Calculate the risk association value based on the task constraint score, number of abnormal bits, and number of difference bits corresponding to the candidate sub-block; Candidate sub-blocks whose risk association values ​​are greater than a preset risk threshold are identified as the risk sub-blocks; A secondary verification scan is performed on each data bit in the risk sub-block to obtain the secondary verification result; Based on the results of the secondary verification, the data bits that still have abnormality are extracted to obtain the residual abnormal bits; The stable sub-block is obtained by removing the data bit range corresponding to the residual abnormal bit from the risk sub-block.

[0063] It should be noted that the data block identifier and task instruction type are read from the task data, and based on these identifiers, the safety mode trigger identifier, attitude and orbit control association identifier, payload control association identifier, communication link association identifier, data retransmission identifier, and task execution time limit are read from the task configuration file. When a task failure triggers a satellite safety mode, the task data belongs to attitude and orbit control data, the task data belongs to payload control data, the task data belongs to communication link control data, the task data cannot be recovered via backup link or ground retransmission, or the task execution time limit is not greater than the storage check cycle of the onboard storage chip, the corresponding identifier is set to 1; otherwise, the corresponding identifier is set to 0. The identifiers are then summed to obtain the task constraint score.

[0064] It is worth noting that in this embodiment, the task constraint score is multiplied by the threshold increment, and the multiplication result is added to the baseline integrity threshold to obtain the preset task integrity threshold. The baseline integrity threshold and the threshold increment are determined based on ground mission replay test data. Specifically, in this embodiment, during the ground mission replay test phase, the same task configuration file, error correction and verification configuration table, and task field mapping table as the onboard storage chip are read, and replay test samples are generated according to the task instruction type, data block identifier, and task constraint score in the task configuration file. For each task instruction type and each task constraint score appearing in the task configuration file, at least one corresponding repair sequence sample without task execution errors is generated, and its integrity value is calculated to obtain a set of integrity values ​​for error-free samples. Subsequently, the minimum integrity value in the set of integrity values ​​for error-free samples is read, and the minimum integrity value is determined as the baseline integrity threshold. Furthermore, repair sequence samples of mission execution errors occurring during ground mission replay tests are read and grouped according to mission constraint scores. The average difference between the integrity values ​​of mission execution error samples under adjacent mission constraint scores is calculated, and this average difference is determined as the threshold increment. When there are no repair sequence samples of mission execution errors, the difference between 1 and the baseline integrity threshold is divided by the number of constraint identifiers involved in the calculation in the mission configuration file to obtain the threshold increment. When the calculated preset mission integrity threshold is greater than 1, the preset mission integrity threshold is set to 1.

[0065] In one implementation, this embodiment compares the integrity value with the preset task integrity threshold; when the integrity value is not less than the preset task integrity threshold, the repair order is determined to enter the risk sub-block extraction process; when the integrity value is less than the preset task integrity threshold, the repair order is marked as a re-voting order.

[0066] Further, the data block identifier and task instruction type are read, and the data block range is determined in the repair sequence according to the data block identifier; the task field mapping table is queried according to the task instruction type to obtain at least one of the operation code field position, control parameter field position, status return field position and verification constraint field position, and the data bit intervals in the data block range that fall into the above field positions are determined as key task data segments.

[0067] It should be noted that the task field mapping table is generated from the task instruction format file during the task software loading stage. In this embodiment, the field name, field start bit number, and field end bit number corresponding to each task instruction type are read, and the positions of the fields whose names are opcode field, control parameter field, status return field, and verification constraint field are marked as key field positions to obtain the task field mapping table.

[0068] In one implementation, the target data block in the repair sequence is located according to the data block identifier corresponding to the critical task data segment; then, a continuous data bit interval is extracted from the target data block according to the start bit sequence number and end bit sequence number corresponding to the critical task data segment to obtain candidate sub-blocks. When there are multiple critical task data segments, multiple candidate sub-blocks are extracted respectively, and each candidate sub-block is associated with the corresponding data block identifier, task instruction type, and task constraint score.

[0069] Further, the task constraint score corresponding to the candidate sub-block is read; the number of data bits falling into the candidate sub-block in the abnormal bit set obtained in step S13 is read to obtain the number of abnormal bits; the number of data bits falling into the candidate sub-block in the difference bit set obtained in step S15 is read to obtain the number of difference bits. The task constraint score is divided by the maximum task constraint score to obtain the normalized task constraint value; the number of abnormal bits is divided by the maximum number of abnormal bits in all candidate sub-blocks to obtain the normalized number of abnormal bits; the number of difference bits is divided by the maximum number of difference bits in all candidate sub-blocks to obtain the normalized number of difference bits; the normalized task constraint value, the number of normalized abnormal bits, and the number of normalized difference bits are added together to obtain the risk association value. Wherein, the maximum task constraint score is the number of constraint identifiers involved in the calculation in the task configuration file; if the maximum number of abnormal bits is 0, the number of normalized abnormal bits is determined to be 0; if the maximum number of difference bits is 0, the number of normalized difference bits is determined to be 0.

[0070] In one implementation, the preset risk threshold is determined based on historical repair records. Specifically, historical candidate sub-blocks that experienced secondary anomalies are read from the historical repair records, and the historical risk correlation value corresponding to each historical candidate sub-block is calculated according to the aforementioned risk correlation value calculation method. All historical risk correlation values ​​are arranged in ascending order. When the number of historical risk correlation values ​​is odd, the historical risk correlation value in the middle position after sorting is determined as the preset risk threshold. When the number of historical risk correlation values ​​is even, the arithmetic mean of the historical risk correlation values ​​in the two middle positions after sorting is determined as the preset risk threshold. When there are no historical candidate sub-blocks that experienced secondary anomalies, all candidate sub-blocks extracted in the current repair sequence are read, and the current risk correlation value corresponding to each candidate sub-block is calculated according to the aforementioned risk correlation value calculation method. All current risk correlation values ​​are arranged in ascending order, and the median of the current risk correlation value is obtained according to the aforementioned median calculation method. The median of the current risk correlation value is determined as the temporary risk threshold. After candidate sub-blocks that subsequently exhibit secondary anomalies are formed, the risk correlation value corresponding to the candidate sub-block is written into the historical repair record, and the preset risk threshold is updated again according to the median calculation method of historical risk correlation values. Candidate sub-blocks with risk correlation values ​​greater than the preset risk threshold or the temporary risk threshold are identified as risk sub-blocks.

[0071] In one implementation, this embodiment performs a secondary verification scan on the risky sub-block. Specifically, the data block identifier, perturbation address, and bit sequence number corresponding to the risky sub-block are read, and the verification calculation of the data block containing the risky sub-block is performed according to the verification matrix in step S12 to obtain the secondary calculation syndrome. When the secondary calculation syndrome is all 0s, the residual abnormal bits are determined to be an empty set. When the secondary calculation syndrome is not all 0s, the corresponding bit sequence number is queried according to the syndrome position mapping table in step S12, and the data bit corresponding to the queried bit sequence number is determined as the residual abnormal bit.

[0072] In one implementation, all data bits in the risky sub-block are read, and data bits with the same perturbation address and bit sequence number as the residual abnormal bits are deleted; the remaining data bits are arranged according to the perturbation address and bit sequence number to obtain a stable data bit set; the stable data bit set is associated with the corresponding data block identifier, perturbation address, and bit sequence number to obtain the stable sub-block. If the residual abnormal bits are an empty set, the entire risky sub-block is determined as a stable sub-block.

[0073] In step S18, the corresponding data in the onboard storage chip is replaced with the stable sub-block to obtain the storage state, and error detection is performed on the storage state to obtain a reliable unit, including: Read the data block identifier, disturbance address, and bit sequence number corresponding to the stable sub-block to determine the target replacement region; The original stored data corresponding to the target replacement region is read from the onboard storage chip, and the stable sub-block is written into the target replacement region to obtain the replacement data block; The replaced data block is read back for verification to obtain the readback data; The readback data is compared with the stable sub-block to obtain the write consistency result; Based on the verification data, error detection is performed on the readback data to obtain the number of verification errors, bit error rate, and verification pass identifier; The storage state is generated based on the write consistency result, the number of check errors, the bit error rate, and the check pass identifier; If the storage state meets the preset reliability conditions, the storage unit corresponding to the target replacement area is determined as the reliable unit.

[0074] It should be noted that in this embodiment, the data block identifier, perturbation address, and bit sequence number in the stable sub-block are read, and the storage location corresponding to the perturbation address and bit sequence number under the same data block identifier is determined as the target replacement area; when there are multiple bits to be replaced, they are arranged in order of perturbation address and bit sequence number.

[0075] In one implementation, this embodiment reads the original storage data corresponding to the target replacement area and saves it in association to obtain backup data before replacement; then, according to the perturbation address and bit sequence number corresponding to the stable data bit, the bit to be replaced in the target replacement area is located, and the original data bit of the bit to be replaced is replaced with the corresponding stable data bit to obtain a data block to be written; the data block to be written is written to the corresponding data block position in the onboard storage chip to obtain a replacement data block.

[0076] Furthermore, in this embodiment, after the replacement data block is written, the stored data in the onboard storage chip is reread according to the data block identifier, perturbation address, and bit sequence number corresponding to the target replacement area to obtain the readback data. Subsequently, the readback data bits and stable data bits under the same perturbation address and the same bit sequence number are read, and the number of consistent bits is counted; the number of consistent bits is divided by the total number of target replacement bits to obtain the write consistency rate, and the write consistency rate is determined as the write consistency result.

[0077] In one implementation, this embodiment performs error detection on the readback data based on the verification data. Specifically, the checksum and check bits in the verification data are read, and the verification matrix determined in step S12 is read according to the checksum; the readback data is XORed according to the verification calculation method in step S12 to obtain the readback calculation syndrome; the readback calculation syndrome is compared bit by bit with the all-zero syndrome, and the number of non-zero syndrome bits is counted to obtain the number of verification errors. The number of verification errors is divided by the total number of bits in the readback data to obtain the bit error rate; when the number of verification errors is 0, the verification pass flag is determined as passed; when the number of verification errors is greater than 0, the verification pass flag is determined as failed.

[0078] Furthermore, the write consistency rate, number of check errors, bit error rate, and check pass identifier are mapped to the same data block identifier and perturbation address to obtain the storage state.

[0079] It should be noted that the preset reliability conditions are determined based on the write consistency and readback verification results. Specifically, in this embodiment, the write consistency rate threshold is set to 1, the number of verification errors threshold is set to 0, the bit error rate threshold is set to 0, and the verification pass flag requirement is set to pass; the write consistency rate threshold, the number of verification errors threshold, the bit error rate threshold, and the verification pass flag requirement are collectively determined as the preset reliability conditions. When the storage state meets the preset reliability conditions, the storage unit corresponding to the target replacement area is determined as a reliable unit; when the storage state does not meet the preset reliability conditions, the backup data before replacement is read, and the target replacement area is marked as an area to be repaired.

[0080] In summary, this invention discloses a dynamic voting repair method for spaceborne storage chips. By combining radiation data, verification data, backup data, mission data, and environmental data, it performs dynamic voting repair on abnormal bits that exceed the conventional error correction range, thereby achieving reliable recovery of abnormal data from spaceborne storage chips and improving data integrity and storage reliability during on-orbit operation.

[0081] Reference Figure 2 The second embodiment of the present invention provides a dynamic voting repair system for a spaceborne memory chip, comprising: The data acquisition module is used to acquire radiation data, determine the disturbance address based on the radiation data, acquire readout data, verification data, backup data and task data based on the disturbance address, and acquire environmental data related to the disturbance time period corresponding to the disturbance address. The preliminary verification module is used to extract the original bit sequence from the read data, perform preliminary verification on the original bit sequence according to the verification data, and obtain the abnormal bit set. An anomaly identification module is used to determine the distribution characteristics of the anomaly bits based on the anomaly bit set, and when the distribution characteristics exceed a preset error correction range, to perform anomaly pattern identification on the anomaly bit set to obtain the anomaly pattern type. The reference extraction module is used to extract reference bit groups from the verification data, the backup data and the task data according to the anomaly mode type, and to perform multi-level verification on the reference bit groups to obtain candidate bit groups. The dynamic voting module is used to determine the voting weight based on the candidate position group, and to perform dynamic voting based on the voting weight to obtain the verification position group. The verification position group is then compared with the original position order to obtain the difference position set. The repair evaluation module is used to repair the original bit sequence based on the difference bit set to obtain the repaired bit sequence, and to determine the integrity value based on the repaired bit sequence, the task data, and the environment data. The secondary scanning module is used to extract risky sub-blocks from the repair sequence and perform a secondary anomaly scan on the risky sub-blocks to obtain stable sub-blocks, provided that the integrity value is not less than a preset task integrity threshold. The storage confirmation module is used to replace the corresponding data in the onboard storage chip with the stable sub-block to obtain the storage status, and to perform error detection on the storage status to obtain a reliable unit.

[0082] It should be noted that the dynamic voting repair system for spaceborne memory chips provided in this embodiment of the invention is used to execute all the process steps of the dynamic voting repair method for spaceborne memory chips in the above embodiments. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0083] It should be noted that the device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Furthermore, in the accompanying drawings of the device embodiments provided by this invention, the connection relationships between modules indicate that they have communication connections, which can be specifically implemented as one or more communication buses or signal lines. Those skilled in the art can understand and implement this without any creative effort.

[0084] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A dynamic voting repair method for spaceborne memory chips, characterized in that, include: Obtain radiation data, determine the disturbance address based on the radiation data, obtain readout data, verification data, backup data and task data based on the disturbance address, and obtain environmental data related to the disturbance time period corresponding to the disturbance address; The original bit sequence is extracted from the read data, and the original bit sequence is initially verified according to the verification data to obtain the abnormal bit set. The distribution characteristics of abnormal bits are determined based on the abnormal bit set, and when the distribution characteristics exceed the preset error correction range, abnormal pattern recognition is performed on the abnormal bit set to obtain the abnormal pattern type. Reference bit groups are extracted from the verification data, backup data, and task data according to the anomaly mode type, and the reference bit groups are subjected to multi-level verification to obtain candidate bit groups. The voting weights are determined based on the candidate position groups, and dynamic voting is performed based on the voting weights to obtain the verification position groups. The verification position groups are then compared with the original position order to obtain the difference position set. The original bit sequence is repaired based on the difference bit set to obtain the repaired bit sequence, and an integrity value is determined based on the repaired bit sequence, the task data, and the environment data. If the integrity value is not less than the preset task integrity threshold, risk sub-blocks are extracted from the repair sequence, and the risk sub-blocks are subjected to a second anomaly scan to obtain stable sub-blocks. The corresponding data in the onboard storage chip is replaced with the stable sub-block to obtain the storage state, and error detection is performed on the storage state to obtain a reliable unit.

2. The dynamic voting repair method for spaceborne memory chips according to claim 1, characterized in that, The process involves acquiring radiation data, determining the disturbance address based on the radiation data, acquiring readout data, verification data, backup data, and task data based on the disturbance address, and acquiring environmental data related to the disturbance time period corresponding to the disturbance address, including: The radiation data is obtained by reading the radiation particle count, radiation dose rate, radiation pulse amplitude, monitoring unit number, and radiation acquisition timestamp output by the radiation monitoring unit during the operation of the on-board storage chip. The disturbance period is determined based on the radiation pulse amplitude, radiation dose rate, and radiation acquisition timestamp in the radiation data, and the disturbance address corresponding to the disturbance period is determined by reading the preset address mapping table based on the monitoring unit number. Based on the disturbance address, the onboard storage chip's storage readout value, storage address, and data readout timestamp during the disturbance period are read to obtain the readout data; The corresponding checksum, check bit, and error correction syndrome are read from the perturbation address to obtain the check data; The backup data is obtained by reading the corresponding data bit in the redundant storage area or historical backup area according to the disturbance address; The task data is obtained by reading the corresponding data block identifier, task instruction type, and task priority based on the disturbance address; The environmental data is obtained by reading the space radiation intensity, temperature status, and power supply status of the satellite during its on-orbit operation during the disturbance period.

3. The dynamic voting repair method for spaceborne memory chips according to claim 1, characterized in that, The step of extracting the original bit sequence from the read data, performing a preliminary check on the original bit sequence based on the check data, and obtaining an abnormal bit set includes: Read the stored read value, storage address, and data read timestamp from the read data; The stored read values ​​are sorted according to the storage address and the data read timestamp to obtain the original bit order; Read the check code, check bit, and error correction syndrome from the check data, and perform check calculation on the original bit sequence based on the check code and the check bit to obtain the check result; The verification results are matched with the error correction syndrome to obtain the location of the verification anomaly; Based on the location of the verification anomaly, the abnormal data bits are extracted from the original bit sequence, and the bit sequence number of the abnormal data bits, the corresponding perturbation address, and the data reading timestamp are associated to obtain the abnormal bit set.

4. The dynamic voting repair method for spaceborne memory chips according to claim 1, characterized in that, The step of determining the distribution characteristics of abnormal bits based on the abnormal bit set, and performing abnormal pattern recognition on the abnormal bit set when the distribution characteristics exceed a preset error correction range to obtain the abnormal pattern type, includes: Read the bit sequence number, disturbance address and data reading timestamp corresponding to each abnormal data bit in the abnormal bit set; Based on the address distribution statistics of each of the disturbance addresses, the number of abnormal addresses, the span of abnormal addresses, and the interval between adjacent abnormal addresses are obtained; Based on the timestamps of the data read, time distribution statistics are performed to obtain the duration of the anomaly and the number of anomalies per unit time. Based on the bit sequence number, perform bit distribution statistics to obtain the number of abnormal bits and the consecutive length of abnormal bits; The distribution characteristics are obtained by combining the number of abnormal addresses, the span of abnormal addresses, the interval between adjacent abnormal addresses, the duration of the abnormality, the number of abnormalities per unit time, the number of abnormal bits, and the continuous length of abnormal bits. The distribution feature is compared with the corresponding range item in the preset error correction range. If at least one feature value in the distribution feature exceeds the corresponding range item, it is determined that the distribution feature exceeds the preset error correction range. If the distribution features exceed the preset error correction range, an abnormal pattern feature vector is generated based on the distribution features, and pattern matching is performed on the abnormal pattern feature vector to obtain the abnormal pattern type.

5. The dynamic voting repair method for a spaceborne memory chip according to claim 1, characterized in that, The step of extracting reference bit groups from the verification data, the backup data, and the task data according to the anomaly mode type, and performing multi-level verification on the reference bit groups to obtain candidate bit groups includes: Determine the target abnormal address range and target bit range based on the abnormal mode type; Based on the target abnormal address range and the target bit range, extract the corresponding check bits and error correction syndrome from the check data to obtain the check reference bits; Based on the target abnormal address range and the target bit range, extract the data bits corresponding to the address from the backup data to obtain the backup reference bits; Based on the target abnormal address range, extract the corresponding data block identifier, task instruction type and task priority from the task data, and determine the task association reference bit based on the data block identifier, the task instruction type and the task priority; The verification reference bit, the backup reference bit, and the task association reference bit are associated according to their corresponding perturbation addresses and bit numbers to obtain the reference bit group; The reference bit group is subjected to verification consistency, backup consistency, and task correlation verification respectively to obtain the verification results, backup verification results, and task verification results. The reference bit group whose verification result, backup verification result, and task verification result all satisfy the corresponding verification conditions is determined as the candidate bit group.

6. The dynamic voting repair method for a spaceborne memory chip according to claim 5, characterized in that, The process of determining voting weights based on the candidate position groups, performing dynamic voting based on the voting weights to obtain a verification position group, and comparing the verification position group with the original position order to obtain a set of differences includes: The verification credibility is determined based on the verification results, the backup matching degree is determined based on the backup verification results, and the task relevance is determined based on the task verification results. The verification credibility, backup matching degree, and task relevance are weighted and normalized to obtain the verification voting weight, backup voting weight, and task voting weight; wherein, the voting weight includes the verification voting weight, backup voting weight, and task voting weight. The check reference bit, backup reference bit and task association reference bit corresponding to the same perturbation address and the same bit sequence number are weighted and calculated with the corresponding voting weights to obtain the bit voting value; The verification bit value corresponding to the bit sequence number is determined based on the bit voting value, and the verification bit values ​​are arranged according to the perturbation address and bit sequence number to obtain the verification bit group; The verification bit value in the verification bit group is compared bit by bit with the original bit value of the corresponding bit number in the original bit sequence to obtain the bit number that has a difference. The difference bit set is obtained by associating the differing bit sequence number, the corresponding perturbation address, the original bit value, and the verification bit value.

7. The dynamic voting repair method for a spaceborne memory chip according to claim 1, characterized in that, The step of repairing the original bit sequence based on the difference bit set to obtain the repaired bit sequence, and determining the integrity value based on the repaired bit sequence, the task data, and the environment data, includes: Based on the difference bit set, locate the corresponding bit to be repaired in the original bit sequence; The original bit value of the bit to be repaired is replaced with the corresponding verification bit value to obtain the candidate repair bit order; The candidate repair order is verified and calculated based on the verification data to obtain the repair verification result. If the repair verification result meets the verification consistency condition, the candidate repair order will be determined as the repair order. Based on the task data, determine the data block identifier, task instruction type, and task priority corresponding to the repair sequence, and determine the task integrity weight based on the data block identifier, the task instruction type, and the task priority; Based on the environmental data, determine the spatial radiation intensity, temperature status, and power supply status corresponding to the disturbance period, and determine the environmental impact weight based on the spatial radiation intensity, temperature status, and power supply status; The integrity value is obtained by weighting the results of the verification of the repair order, the task integrity weight, and the environmental impact weight.

8. The dynamic voting repair method for a spaceborne memory chip according to claim 1, characterized in that, When the integrity value is not less than a preset task integrity threshold, risk sub-blocks are extracted from the repair sequence, and a second anomaly scan is performed on the risk sub-blocks to obtain stable sub-blocks, including: A preset task integrity threshold is determined based on the task data. If the integrity value is not less than the preset task integrity threshold, the key task data segment in the repair sequence is determined based on the task data. According to the data block identifier and task instruction type corresponding to the key task data segment, extract the corresponding data bit range from the repair bit sequence to obtain candidate sub-blocks; Calculate the risk association value based on the task constraint score, number of abnormal bits, and number of difference bits corresponding to the candidate sub-block; Candidate sub-blocks whose risk association values ​​are greater than a preset risk threshold are identified as the risk sub-blocks; A secondary verification scan is performed on each data bit in the risk sub-block to obtain the secondary verification result; Based on the results of the secondary verification, the data bits that still have abnormality are extracted to obtain the residual abnormal bits; The stable sub-block is obtained by removing the data bit range corresponding to the residual abnormal bit from the risk sub-block.

9. A dynamic voting repair method for a spaceborne memory chip according to claim 1, characterized in that, The process of replacing the corresponding data in the onboard storage chip with the stable sub-block to obtain the storage state, and performing error detection on the storage state to obtain a reliable unit, includes: Read the data block identifier, disturbance address, and bit sequence number corresponding to the stable sub-block to determine the target replacement region; The original stored data corresponding to the target replacement region is read from the onboard storage chip, and the stable sub-block is written into the target replacement region to obtain the replacement data block; The replaced data block is read back for verification to obtain the readback data; The readback data is compared with the stable sub-block to obtain the write consistency result; Based on the verification data, error detection is performed on the readback data to obtain the number of verification errors, bit error rate, and verification pass identifier; The storage state is generated based on the write consistency result, the number of check errors, the bit error rate, and the check pass identifier; If the storage state meets the preset reliability conditions, the storage unit corresponding to the target replacement area is determined as the reliable unit.

10. A dynamic voting repair system for spaceborne memory chips, characterized in that, include: The data acquisition module is used to acquire radiation data, determine the disturbance address based on the radiation data, acquire readout data, verification data, backup data and task data based on the disturbance address, and acquire environmental data related to the disturbance time period corresponding to the disturbance address. The preliminary verification module is used to extract the original bit sequence from the read data, perform preliminary verification on the original bit sequence according to the verification data, and obtain the abnormal bit set. An anomaly identification module is used to determine the distribution characteristics of the anomaly bits based on the anomaly bit set, and when the distribution characteristics exceed a preset error correction range, to perform anomaly pattern identification on the anomaly bit set to obtain the anomaly pattern type. The reference extraction module is used to extract reference bit groups from the verification data, the backup data and the task data according to the anomaly mode type, and to perform multi-level verification on the reference bit groups to obtain candidate bit groups. The dynamic voting module is used to determine the voting weight based on the candidate position group, and to perform dynamic voting based on the voting weight to obtain the verification position group. The verification position group is then compared with the original position order to obtain the difference position set. The repair evaluation module is used to repair the original bit sequence based on the difference bit set to obtain the repaired bit sequence, and to determine the integrity value based on the repaired bit sequence, the task data, and the environment data. The secondary scanning module is used to extract risky sub-blocks from the repair sequence and perform a secondary anomaly scan on the risky sub-blocks to obtain stable sub-blocks, provided that the integrity value is not less than a preset task integrity threshold. The storage confirmation module is used to replace the corresponding data in the onboard storage chip with the stable sub-block to obtain the storage status, and to perform error detection on the storage status to obtain a reliable unit.

Images