A method and device for recovering and diagnosing the working state of a satellite computer

Abstract

The application discloses a kind of satellite computer working state recovery and fault diagnosis method and device.Method includes: constructing main fault-tolerant circuit and backup fault-tolerant circuit, each fault-tolerant circuit includes mutually communicated fault-tolerant controller and data storage, each fault-tolerant controller is connected with main computer and backup computer communication;Determine the first data required for computer working state recovery and the second data required for fault diagnosis;According to the data amount of first data and second data, determine the storage capacity of each data storage;In response to on-duty computer working normally, first data and second data are stored in powered-on working fault-tolerant circuit respectively;In response to on-duty computer exception, on-duty computer is switched to succeed on-duty computer, and first data and second data are acquired from corresponding fault-tolerant circuit using succeed on-duty computer, to carry out working state recovery based on first data, and carry out fault diagnosis based on second data.The application can improve the functional completeness of computer, and reduce system complexity.

Description

Technical Field

[0001] This invention relates to the field of aerospace technology, and in particular to a method and apparatus for restoring the working status and diagnosing faults of a spaceborne computer. Background Technology

[0002] Satellites face a complex space environment, particularly under the influence of high-energy charged particles and space radiation, leading to frequent equipment malfunctions. Most satellites, except those in geostationary orbit, have a segment of their orbit invisible to ground control stations. If the onboard computer malfunctions in this invisible segment and cannot autonomously recover, it will have catastrophic consequences for the satellite.

[0003] Therefore, to improve equipment reliability, onboard computers typically employ a dual-machine cold backup fault-tolerant architecture. When the on-orbit computer experiences a reset, power failure, restart, or is switched to a backup unit due to a fault, the successor computer needs to acquire historical critical data of the system prior to the fault and restore the system to its state before the fault based on this data.

[0004] However, existing spaceborne computers require at least two lower-level computers with storage media to reliably store and recover important historical data. This results in incomplete single-machine functionality and increases the complexity of the system.

[0005] Therefore, there is an urgent need for a method for restoring the working state of onboard computers and diagnosing faults, which can reduce the functional coupling between individual machines within the system and the complexity of the system. Summary of the Invention

[0006] This invention provides a method and apparatus for restoring the operational status and diagnosing faults of an onboard computer, which can improve the functional completeness of the computer and reduce system complexity. The technical solution is as follows: On the one hand, a method for restoring the operational status and diagnosing faults of an onboard computer is provided, the method comprising: Construct a primary fault-tolerant circuit and a backup fault-tolerant circuit. Each fault-tolerant circuit includes a fault-tolerant controller and a data storage that communicate with each other. Each fault-tolerant controller is communicatively connected to the primary computer and the backup computer. Determine the first data required to restore the computer's working state and the second data required for fault diagnosis; The storage capacity of each data storage device is determined based on the amount of data in the first data and the second data. In response to the normal operation of the on-duty computer, the first data and the second data are stored in the fault-tolerant circuit that is powered on. In response to an abnormality in the on-duty computer, the on-duty computer is switched to a successor on-duty computer, and the successor on-duty computer is used to obtain first data and second data from the corresponding fault-tolerant circuit, so as to restore the working state based on the first data and to perform fault diagnosis based on the second data.

[0007] On the other hand, an apparatus for restoring the operational status and diagnosing faults of a spaceborne computer is provided, the apparatus comprising: The building unit is used to build a primary fault-tolerant circuit and a backup fault-tolerant circuit. Each fault-tolerant circuit includes a fault-tolerant controller and a data storage that communicate with each other. Each fault-tolerant controller is communicatively connected to the primary computer and the backup computer. The first determining unit is used to determine the first data required for restoring the computer's working state and the second data required for fault diagnosis. The second determining unit is used to determine the storage capacity of each data storage device based on the amount of the first data and the second data. A storage unit is used to store the first data and the second data into a power-on fault-tolerant circuit in response to the normal operation of the on-duty computer. The acquisition unit is used to switch the on-duty computer to a successor on-duty computer in response to an abnormality of the on-duty computer, and to acquire first data and second data from the corresponding fault-tolerant circuit using the successor on-duty computer, so as to restore the working state based on the first data and to perform fault diagnosis based on the second data.

[0008] On the other hand, a computer device is provided, the computer device including a memory and a processor, the memory for storing computer programs, and the processor for executing the computer programs stored in the memory to implement the steps of the above-described method for restoring the working state and diagnosing faults of a spaceborne computer.

[0009] On the other hand, a computer-readable storage medium is provided, wherein a computer program is stored therein, and when the computer program is executed by a processor, it implements the steps of the above-described method for restoring the working state of a spaceborne computer and diagnosing faults.

[0010] On the other hand, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the above-described method for restoring the working state of a spaceborne computer and diagnosing faults.

[0011] This invention provides a method for restoring the operational status and diagnosing faults of an onboard computer. By setting up a fault-tolerant circuit and incorporating a data storage device within it, historical important data of the system prior to a fault can be stored in this data storage device. Similarly, when recovery is required, data can be retrieved from the corresponding data storage device. In other words, in this application, the onboard computer itself can independently complete the protection and recovery of important data, improving the computer's functional completeness. Simultaneously, since no lower-level machine is required to participate in the protection and recovery of important data, the coupling between system devices' functions and designs can be reduced, thus reducing system complexity. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a flowchart of a method for restoring the working state and diagnosing faults of a spaceborne computer according to an embodiment of the present invention; Figure 2 This is a structural diagram of a device for restoring the working state and diagnosing faults of a spaceborne computer according to an embodiment of the present invention; Figure 3 This is a hardware architecture diagram of a computer device provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of a fault-tolerant circuit architecture provided in an embodiment of the present invention; Figure 5 This is a schematic diagram of the functional partitioning of a data storage device according to an embodiment of the present invention; Figure 6 This is a schematic diagram of the communication protocol frame structure provided in an embodiment of the present invention. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0015] The specific implementation of the method in this application is described in detail below.

[0016] Please refer to Figure 1The present invention provides a method for restoring the working state and diagnosing faults of a spaceborne computer, the method comprising: Step 100: Construct the primary fault-tolerant circuit and the backup fault-tolerant circuit. Each fault-tolerant circuit includes a fault-tolerant controller and a data storage that communicate with each other. Each fault-tolerant controller is communicatively connected to the primary computer and the backup computer. Step 102: Determine the first data required for restoring the computer's working state and the second data required for fault diagnosis; Step 104: Determine the storage capacity of each data storage device based on the data volume of the first data and the second data; Step 106: In response to the normal operation of the on-duty computer, store the first data and the second data into the fault-tolerant circuit that is powered on. Step 108: In response to the abnormality of the on-duty computer, the on-duty computer is switched to the successor on-duty computer, and the successor on-duty computer is used to obtain first data and second data from the corresponding fault-tolerant circuit, so as to restore the working state based on the first data and perform fault diagnosis based on the second data.

[0017] In this embodiment, by setting up a fault-tolerant circuit and incorporating a data storage device within it, historical important data of the system prior to the failure can be stored in this data storage device. Similarly, when recovery is required, data can be retrieved from the corresponding data storage device. In other words, in this application, the onboard computer itself can independently complete the protection and recovery of important data, improving the computer's functional completeness. Simultaneously, since no lower-level machine is required to participate in the protection and recovery of important data, the coupling between system devices' functions and designs can be reduced, thus lowering system complexity.

[0018] The following description Figure 1 The execution method for each step is shown.

[0019] First, for step 100: construct the primary fault-tolerant circuit and the backup fault-tolerant circuit. Each fault-tolerant circuit includes a fault-tolerant controller and a data storage that communicate with each other. Each fault-tolerant controller is communicatively connected to the primary computer and the backup computer.

[0020] like Figure 4 The diagram shows a fault-tolerant circuit architecture. As can be seen, there are two fault-tolerant circuits and two computers, each serving as a backup for the other. Under normal circumstances, the computer operates in a cold backup mode, while the fault-tolerant circuit can operate in either a cold backup mode or a hot backup mode.

[0021] Each computer and each fault-tolerant controller interact via a communication bus. The computer can send storage and read commands to the fault-tolerant controller, and the fault-tolerant controller can detect the status of the computer. In addition, magnetoresistive random access memory (MRAM) is used for data storage. Because it uses non-volatile memory that can be randomly read and written an unlimited number of times after power failure to store important data, it is possible to restore important data and operating status of the computer in the fault mode of power failure of the entire satellite or subsystem.

[0022] Regarding step 102: The first data is the system's on-site data before the failure occurred. This first data allows the succeeding computer to restore its status. The second data consists of the real-time operating information of the computer itself before the failure, as well as the most recently received and sent instruction sequences monitored by third-party circuitry. After the succeeding computer restores its status, the second data can be used to analyze and locate the cause of the failure, making the onboard computer's functions and performance more complete.

[0023] In addition, the data content, data format, data frame format, and communication protocol of the first and second data are determined based on the requirements of continuous operation, fault analysis, and location of the subsystem.

[0024] like Figure 6 The image shows a preferred data frame format, which includes a 2-byte frame header (0xEB90), a 4-byte timestamp (the time corresponding to the data packet), a 2-byte total frame count (i.e., the number of data frames contained in a complete data packet), a 2-byte frame count, a 2-byte number of valid data bytes per frame, N bytes of valid data, and a 4-byte checksum at the end of the frame. The 4-byte checksum is the sum of all bytes except the frame header and checksum. Of course, users can choose other data frame formats as needed.

[0025] It should also be noted that the first data and the second data are sent in the form of data frames. The first data and the second data at a certain moment form a data packet. Each data packet can be decomposed into several data frames, and each data frame is set with the same timestamp information.

[0026] Regarding step 104, when the amount of data in the first and second data is large, a larger capacity data storage device needs to be selected; otherwise, a smaller capacity data storage device should be selected.

[0027] For step 106, storing the first and second data into a power-on fault-tolerant circuit includes: The storage frequency of the first and second data is determined based on the maximum recovery interval of the first and second data. Based on the power status of the primary fault-tolerant circuit and the backup fault-tolerant circuit read by the on-duty computer, the fault-tolerant circuit currently in operation can be determined based on the power status. According to the storage frequency, the data packet consisting of the first data and the second data is transmitted to the fault-tolerant controller of the power-on fault-tolerant circuit via the communication bus. The fault-tolerant controller performs communication protocol parsing and data verification on each received data packet, and writes the data packets that pass the verification into the corresponding data storage.

[0028] In this step, the maximum recovery interval refers to the maximum time interval at which the computer can restore its state based on historical data. For example, if the maximum recovery interval is 20ms, then data must be stored at least once every 10ms; otherwise, the computer's state cannot be restored. This is because data packets are divided into odd-numbered and even-numbered data packets. For instance, data packets with the current storage frequency are stored as odd-numbered data packets, and data packets with the next storage frequency are stored as even-numbered data packets. When fault recovery is required, only one of these can be selected for recovery. Therefore, the storage frequency is no greater than half the maximum recovery interval. Furthermore, the storage frequencies of the first and second data can be the same or different; this application does not impose specific limitations.

[0029] Furthermore, the communication bus and communication rate between the computer and the fault-tolerant controller are also determined based on the data volume, storage frequency, and communication protocol of the first and second data.

[0030] In some implementations, such as Figure 5 As shown, each data storage device includes two storage areas; The fault-tolerant controller performs communication protocol parsing and data verification on each received data packet, and writes the verified data packets into the corresponding data storage, including: The received data packets are divided into odd-numbered data packets and even-numbered data packets according to the timestamps in the data packets. The odd-numbered data packets are stored in one storage area and the even-numbered data packets are stored in the other storage area. Multiple bytes are reserved at the beginning of each data storage area for storing timestamps and data packet integrity stamps; For each data packet, when the fault-tolerant controller receives the first data frame of the data packet, it extracts the timestamp from the data frame and writes it into the reserved timestamp position in the header of the data storage area. At the same time, it writes the first flag into the data packet integrity stamp position. It counts each received data frame. When the total frame number field in the received data frame is equal to the frame count field, it writes the second flag into the data packet integrity stamp position. The first flag indicates that the data packet is not yet complete, and the second flag indicates that the data packet is complete.

[0031] In this step, by setting up two storage areas, it can be ensured that even if a failure occurs during the data storage process (power outage or system shutdown) resulting in incomplete data packets in the current storage area, the data packets in the other storage area will remain intact, thus improving system reliability. Furthermore, the first flag can be 0x00, and the second flag can be 0xFF, which can be determined by the user as needed.

[0032] For step 108, the first and second data are obtained from the corresponding fault-tolerant circuit using the successor computer, including: The power status of the primary fault-tolerant circuit and the backup fault-tolerant circuit is read using the successor computer to determine the fault-tolerant circuit currently powered on based on the power status. For each storage area in the data memory of the fault-tolerant circuit that is powered on, the integrity of the data packet is determined based on the complete stamp of the data packet in that storage area; If only one storage area has a complete data packet, then retrieve the data packet from that area; If the data packets in both storage areas are complete, then retrieve the data packet whose timestamp is closest to the current time.

[0033] In this step, errors may occur during the storage of the first and second data packets, resulting in incomplete data. Therefore, during reading, the integrity of the data packets needs to be determined based on the complete timestamp, and only complete data packets are extracted. When the data packets in both storage areas are complete, for example, if one storage area has a timestamp of 14:00 and the other storage area has a timestamp of 14:01, then the data packet corresponding to the timestamp of 14:01 is extracted to ensure that the extracted data is the latest data.

[0034] In some implementations, each data packet is stored three times in the corresponding storage area; When the fault-tolerant controller retrieves data packets from the corresponding storage area, it reads them bit by bit based on a 3-out-of-2 operation.

[0035] In this embodiment, by storing the data packet three times and using a 2-out-of-3 operation, errors caused by single-event flips in space can be prevented.

[0036] like Figure 2 , Figure 3 As shown, this invention provides a device for restoring the operational status and diagnosing faults of an onboard computer. The device can be implemented in software, hardware, or a combination of both. From a hardware perspective, as... Figure 2 The diagram shown is a hardware architecture diagram of a computing device for restoring the working state and diagnosing faults of a spaceborne computer, as provided in an embodiment of the present invention. Except for... Figure 2In addition to the processor, memory, network interface, and non-volatile memory shown, the computing device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, such as... Figure 3 As shown, a device in a logical sense is formed by the CPU of the computing device in which it is located reading the corresponding computer program from the non-volatile memory into the memory for execution.

[0037] Please refer to Figure 3 This invention provides an apparatus for restoring the working state and diagnosing faults of a spaceborne computer, the apparatus comprising: The building unit 300 is used to build a primary fault-tolerant circuit and a backup fault-tolerant circuit. Each fault-tolerant circuit includes a fault-tolerant controller and a data storage that communicate with each other. Each fault-tolerant controller is communicatively connected to the primary computer and the backup computer. The first determining unit 302 is used to determine the first data required for the computer's working state to be restored and the second data required for fault diagnosis. The second determining unit 304 is used to determine the storage capacity of each data storage device based on the amount of data in the first data and the second data. Storage unit 306 is used to store the first data and the second data into the power-on fault-tolerant circuit in response to the normal operation of the on-duty computer. The acquisition unit 308 is used to switch the on-duty computer to a successor on-duty computer in response to an abnormality of the on-duty computer, and to acquire first data and second data from the corresponding fault-tolerant circuit using the successor on-duty computer, so as to restore the working state based on the first data and perform fault diagnosis based on the second data.

[0038] In some implementations, the data content, data format, data frame format, and communication protocol of the first and second data are determined based on the requirements of continuous operation of the subsystem and fault analysis and location.

[0039] In some implementations, the storage unit 306 is used to perform the following operations: The storage frequency of the first and second data is determined based on the maximum recovery interval of the first and second data. Based on the power status of the primary fault-tolerant circuit and the backup fault-tolerant circuit read by the on-duty computer, the fault-tolerant circuit currently in operation can be determined based on the power status. According to the storage frequency, the data packet consisting of the first data and the second data is transmitted to the fault-tolerant controller of the power-on fault-tolerant circuit via the communication bus. The fault-tolerant controller performs communication protocol parsing and data verification on each received data packet, and writes the data packets that pass the verification into the corresponding data storage.

[0040] In some implementations, the communication rate of the communication bus is determined based on the amount of first data and second data, the storage frequency, and the communication protocol.

[0041] In some implementations, each data storage unit includes two storage areas; the fault-tolerant controller performs communication protocol parsing and data verification on each received data packet, and writes the verified data packets into the corresponding data storage unit, including: The received data packets are divided into odd-numbered data packets and even-numbered data packets according to the timestamps in the data packets. The odd-numbered data packets are stored in one storage area and the even-numbered data packets are stored in the other storage area. Multiple bytes are reserved at the beginning of each data storage area for storing timestamps and data packet integrity stamps; For each data packet, when the fault-tolerant controller receives the first data frame of the data packet, it extracts the timestamp from the data frame and writes it into the reserved timestamp position in the header of the data storage area. At the same time, it writes the first flag into the data packet integrity stamp position. It counts each received data frame. When the total frame number field in the received data frame is equal to the frame count field, it writes the second flag into the data packet integrity stamp position. The first flag indicates that the data packet is not yet complete, and the second flag indicates that the data packet is complete.

[0042] In some implementations, when the acquisition unit 308 acquires the first data and the second data from the corresponding fault-tolerant circuit using the successor on-duty computer, it performs the following operations: The power status of the primary fault-tolerant circuit and the backup fault-tolerant circuit is read using the successor computer to determine the fault-tolerant circuit currently powered on based on the power status. For each storage area in the data memory of the fault-tolerant circuit that is powered on, the integrity of the data packet is determined based on the complete stamp of the data packet in that storage area; If only one storage area has a complete data packet, then retrieve the data packet from that area; If the data packets in both storage areas are complete, then retrieve the data packet whose timestamp is closest to the current time.

[0043] In some implementations, each data packet is stored three times in the corresponding storage area; When the fault-tolerant controller retrieves data packets from the corresponding storage area, it reads them bit by bit based on a 3-out-of-2 operation.

[0044] It should be noted that the apparatus for restoring the working state and diagnosing faults of a spaceborne computer provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the apparatus can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus for restoring the working state and diagnosing faults of a spaceborne computer provided in the above embodiments belongs to the same concept as the method embodiments for restoring the working state and diagnosing faults of a spaceborne computer. The specific implementation process is detailed in the method embodiments and will not be repeated here.

[0045] Embodiments of this application also provide a computer device, please refer to... Figure 3 The computer device includes a processor and a memory, the memory storing at least one instruction, at least one program, code set or instruction set, the at least one instruction, at least one program, code set or instruction set being loaded and executed by the processor to implement the methods for restoring the working state and diagnosing faults of the onboard computer provided in the above-described method embodiments.

[0046] Embodiments of this application also provide a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, at least one program, code set, or instruction set is loaded and executed by a processor to implement the methods for restoring the working state and diagnosing faults of the onboard computer provided in the above-described method embodiments.

[0047] Embodiments of this application also provide a computer program product, which includes a computer program. A processor of a computer device reads the computer program from a computer-readable storage medium and executes the computer program, causing the computer device to perform the method for restoring the working state of a spaceborne computer and diagnosing faults as described in any of the above embodiments.

[0048] For ease of description, the above systems or devices are described separately as various modules or units based on their functions. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware components.

[0049] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0050] Finally, it should be noted that in this document, relational terms such as first, second, third, and fourth are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0051] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for restoring the working state and diagnosing faults of a spaceborne computer, characterized in that, Construct a primary fault-tolerant circuit and a backup fault-tolerant circuit. Each fault-tolerant circuit includes a fault-tolerant controller and a data storage that communicate with each other. Each fault-tolerant controller is communicatively connected to the primary computer and the backup computer. Determine the first data required to restore the computer's working state and the second data required for fault diagnosis; The storage capacity of each data storage device is determined based on the amount of data in the first data and the second data. In response to the normal operation of the on-duty computer, the first data and the second data are stored in the fault-tolerant circuit that is powered on. In response to an abnormality in the on-duty computer, the on-duty computer is switched to a successor on-duty computer, and the successor on-duty computer is used to obtain first data and second data from the corresponding fault-tolerant circuit, so as to restore the working state based on the first data and to perform fault diagnosis based on the second data.

2. The method according to claim 1, characterized in that, The data content, data format, data frame format, and communication protocol of the first data and the second data are determined according to the requirements of continuous operation, fault analysis, and location of the subsystem.

3. The method according to claim 1, characterized in that, The step of storing the first data and the second data into a power-on fault-tolerant circuit includes: The storage frequency of the first data and the second data is determined based on the maximum recovery interval of the first data and the second data; Based on the power status of the primary fault-tolerant circuit and the backup fault-tolerant circuit read by the on-duty computer, the fault-tolerant circuit currently in operation is determined based on the power status. According to the storage frequency, the data packet consisting of the first data and the second data is transmitted to the fault-tolerant controller of the power-on fault-tolerant circuit via the communication bus. The fault-tolerant controller performs communication protocol parsing and data verification on each received data packet, and writes the data packets that pass the verification into the corresponding data storage.

4. The method according to claim 3, characterized in that, The communication rate of the communication bus is determined based on the data volume, storage frequency, and communication protocol of the first and second data.

5. The method according to claim 3, characterized in that, Each of the data storage devices includes two storage areas; The fault-tolerant controller performs communication protocol parsing and data verification on each received data packet, and writes the verified data packets into the corresponding data storage, including: The received data packets are divided into odd-numbered data packets and even-numbered data packets according to the timestamps in the data packets. The odd-numbered data packets are stored in one storage area and the even-numbered data packets are stored in the other storage area. Multiple bytes are reserved at the beginning of each data storage area for storing timestamps and data packet integrity stamps; For each data packet, when the fault-tolerant controller receives the first data frame of the data packet, it extracts the timestamp from the data frame and writes it into the reserved timestamp position in the header of the data storage area. At the same time, it writes a first flag into the data packet complete stamp position. It counts each received data frame. When the total frame number field in the received data frame is equal to the frame count field, it writes a second flag into the data packet complete stamp position. The first flag indicates that the data packet is not yet complete, and the second flag indicates that the data packet is complete.

6. The method according to claim 5, characterized in that, The step of using the successor computer to obtain the first and second data from the corresponding fault-tolerant circuits includes: The power status of the primary fault-tolerant circuit and the backup fault-tolerant circuit is read using the successor computer to determine the fault-tolerant circuit currently powered on based on the power status. For each storage area in the data memory of the fault-tolerant circuit that is powered on, the integrity of the data packet is determined based on the complete stamp of the data packet in that storage area; If only one storage area has a complete data packet, then retrieve the data packet from that area; If the data packets in both storage areas are complete, then retrieve the data packet whose timestamp is closest to the current time.

7. The method according to claim 6, characterized in that, Each data packet is stored three times in the corresponding storage area; When the fault-tolerant controller retrieves data packets from the corresponding storage area, it reads them bit by bit based on a 3-out-of-2 operation.

8. A device for restoring the working state and diagnosing faults of a spaceborne computer, characterized in that, The building unit is used to build a primary fault-tolerant circuit and a backup fault-tolerant circuit. Each fault-tolerant circuit includes a fault-tolerant controller and a data storage that communicate with each other. Each fault-tolerant controller is communicatively connected to the primary computer and the backup computer. The first determining unit is used to determine the first data required for restoring the computer's working state and the second data required for fault diagnosis. The second determining unit is used to determine the storage capacity of each data storage device based on the amount of the first data and the second data. A storage unit is used to store the first data and the second data into a power-on fault-tolerant circuit in response to the normal operation of the on-duty computer. The acquisition unit is used to switch the on-duty computer to a successor on-duty computer in response to an abnormality of the on-duty computer, and to acquire first data and second data from the corresponding fault-tolerant circuit using the successor on-duty computer, so as to restore the working state based on the first data and to perform fault diagnosis based on the second data.

9. A computer device, characterized in that, The computer device includes a memory and a processor. The memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the steps of the method according to any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-7.

Images