Nor flash on-orbit management method and device for spacecraft

Abstract

The application relates to a NorFlash on-orbit management method and device for a spacecraft. The method comprises the following steps: dividing a NorFlash storage area into a key area, a state area and a telemetry information area; the key area comprises A program storage areas and B program storage areas, A parameter storage areas and B parameter storage areas; when a NorFlash refreshing instruction is sent by the ground, data in each storage area in the key area is read in sequence according to a set order and a set byte number, and for each read data, the following steps are executed: S1, judging whether the data has a single-bit error or a double-bit error; if not, executing S2; if the data has a single-bit error, executing S3; if the data has a double-bit error, executing S4; S2, reading data of a next preset byte number and returning to execute S1; S3, stopping the refreshing, and using EDAC error correction function of a region where the NorFlash is located to restore correct data; and S4, stopping the refreshing, and using data in a storage area which is mutual backup of a current storage area to repair the data. The application can timely find errors of the NorFlash and repair the errors on-orbit in real time.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a NorFlash on-orbit management method and apparatus for spacecraft. Background Technology

[0002] NorFlash is a non-volatile memory characterized by data retention even when power is lost, fast read speeds, and suitability for storing program code and critical configuration parameters. In spacecraft onboard computers, payload control units, and data processing units, NorFlash is commonly used to store boot programs, operating systems, application programs, critical configuration parameters, and on-orbit update software images. During long-term on-orbit operation, NorFlash is susceptible to damage from space radiation, thermal cycling, device aging, and the limited number of erase / write cycles, potentially leading to single-event upsets, data errors, corrupted program images, or failed software uploads. Therefore, spacecraft typically require reliability maintenance of critical program and parameter areas within the NorFlash memory and protection during on-orbit software updates.

[0003] To address the aforementioned issues, existing technologies primarily employ EDAC-based storage inspection and periodic refresh methods. This method can detect single-bit or double-bit errors during the reading process and transmit the error information via telemetry or status words. However, its main function remains focused on "detection" and "alarms," ​​rather than directly recovering stored content. If ground-based intervention is not timely, errors may continue to accumulate, eventually evolving from correctable to uncorrectable errors, affecting program transfer, parameter reading, or on-orbit mission execution.

[0004] Therefore, there is an urgent need for an on-orbit management method and device for NorFlash in spacecraft to solve the above-mentioned technical problems. Summary of the Invention

[0005] This invention provides a method and apparatus for on-orbit management of NorFlash in spacecraft, which can promptly detect NorFlash errors and repair them on-orbit in real time, reducing the risk of NorFlash storage error accumulation and improving the reliability of NorFlash stored data.

[0006] In a first aspect, embodiments of the present invention provide a NorFlash on-orbit management method for spacecraft, comprising: The NorFlash storage area is divided into a key area, a status area, and a telemetry information area. The key area includes a program storage area A and a program storage area B, which are used to store program images that are backups of each other, and a parameter storage area A and a parameter storage area B, which are used to store configuration data that are backups of each other. The status and telemetry information area is used to record the NorFlash health status, refresh results, error counts, and version status information. In response to the NorFlash refresh command sent from the ground, data from each storage area in the critical region is read sequentially according to a set order and a set number of bytes. For each piece of data read, the following is executed: S1, determine whether a single-bit error or a double-bit error has occurred in the data; if not, proceed to S2; if a single-bit error has occurred, proceed to S3; if a double-bit error has occurred, proceed to S4. S2, read the next preset number of bytes of data, and return to execute S1; S3, stop this refresh, use the EDAC error correction function of the area where NorFlash is located to restore the correct data, and set the NorFlash status flag in the telemetry word to unhealthy; S4, stop this refresh, use the corresponding data in the storage area that is a backup of the current storage area to repair the data, and set the NorFlash status flag in the telemetry word to unhealthy; S1-S4 are executed in a loop. If no single-bit or double-bit error occurs during the entire refresh process, the NorFlash status flag in the telemetry word is set to healthy.

[0007] Secondly, embodiments of the present invention also provide a NorFlash on-orbit management device for spacecraft, comprising: The partitioning unit is used to divide the NorFlash storage area into a key area, a status area, and a telemetry information area. The key area includes a program storage area A and a program storage area B, which are used to store program images that are backups of each other, and a parameter storage area A and a parameter storage area B, which are used to store configuration data that are backups of each other. The status and telemetry information area is used to record the NorFlash health status, refresh results, error counts, and version status information. The error correction unit is used to read data from each storage area in the critical region sequentially according to a set order and a set number of bytes when a NorFlash refresh command is sent from the ground. For each piece of data read, S1-S4 are executed cyclically until all data has been traversed. If no single-bit or double-bit error occurs during the entire refresh process, the NorFlash status flag in the telemetry word is set to healthy. S1, determine whether a single-bit error or a double-bit error has occurred in the data; if not, proceed to S2; if a single-bit error has occurred, proceed to S3; if a double-bit error has occurred, proceed to S4. S2, read the next preset number of bytes of data, and return to execute S1; S3, stop this refresh, use the EDAC error correction function of the area where NorFlash is located to restore the correct data, and set the NorFlash status flag in the telemetry word to unhealthy; S4, stop this refresh, use the corresponding data in the storage area that is a backup of the current storage area to repair the data, and set the NorFlash status flag in the telemetry word to unhealthy.

[0008] Thirdly, embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the method described in any embodiment of this specification.

[0009] Fourthly, embodiments of the present invention also provide a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods described in any embodiment of this specification.

[0010] Fifthly, embodiments of the present invention also provide a computer program product, including a computer program that, when executed by a processor, implements the steps of the method described above.

[0011] This invention provides a method and apparatus for on-orbit management of NorFlash in spacecraft. By dividing the NorFlash storage area into two parts, A and B, program images that serve as backups can be stored. Similarly, by dividing it into two parts, A and B, configuration data that serves as backups can be stored. Thus, when refreshing critical program and parameter storage areas in NorFlash, if a double-bit error occurs in one storage area, the correct data can be read from its backup storage area, thereby safely repairing the double-bit error. In summary, this application can promptly detect NorFlash errors and repair them in real-time on-orbit, preventing the long-term accumulation of on-orbit errors from evolving from a correctable state to an uncorrectable state, ensuring the safe operation of the spacecraft. Attached Figure Description

[0012] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0013] Figure 1 This is a schematic diagram of the NorFlash on-orbit management method for spacecraft provided in an embodiment of the present invention; Figure 2 This is a schematic diagram of the Norflash on-orbit management interface process provided in an embodiment of the present invention; Figure 3This is a hardware architecture diagram of an electronic device provided in an embodiment of the present invention; Figure 4 This is a structural diagram of a NorFlash on-orbit management device for spacecraft provided in an embodiment of the present invention. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0015] Please refer to Figure 1 This invention provides an on-orbit management method for NorFlash in spacecraft, the method comprising: Step 100: Divide the NorFlash storage area into a critical area, a status area, and a telemetry information area. The critical area includes a program storage area A and a program storage area B, which are used to store program images that are backups of each other, and a parameter storage area A and a parameter storage area B, which are used to store configuration data that are backups of each other. The status and telemetry information area is used to record the NorFlash health status, refresh results, error count, and version status information. Step 102: When the ground sends a NorFlash refresh command, read the data of each storage area in the key region sequentially according to the set order and set number of bytes. For each piece of data read, execute S1-S4 in a loop until all data has been traversed. If no single-bit or double-bit error occurs during the entire refresh process, set the NorFlash status flag in the telemetry word to healthy. S1, determine whether a single-bit error or a double-bit error has occurred in the data; if not, proceed to S2; if a single-bit error has occurred, proceed to S3; if a double-bit error has occurred, proceed to S4. S2, read the next preset number of bytes of data, and return to execute S1; S3, stop this refresh, use the EDAC error correction function of the area where NorFlash is located to restore the correct data, and set the NorFlash status flag in the telemetry word to unhealthy; S4, stop this refresh, use the corresponding data in the storage area that is a backup of the current storage area to repair the data, and set the NorFlash status flag in the telemetry word to unhealthy.

[0016] In this embodiment, by dividing the NorFlash storage area into two program storage areas, A and B, program images that serve as backups can be stored. Similarly, by dividing it into two parameter storage areas, A and B, configuration data that serves as backups can be stored. Thus, when refreshing critical program and parameter storage areas in the NorFlash, if a double-bit error occurs in one storage area, the correct data can be read from its backup storage area, thereby safely repairing the double-bit error. In summary, this application can promptly detect NorFlash errors and repair them in real-time on-orbit, preventing the long-term accumulation of on-orbit errors from evolving from a correctable state to an uncorrectable state, ensuring the safe operation of the spacecraft.

[0017] The following description Figure 1 The execution method for each step is shown.

[0018] First, regarding step 100, program storage area A and program storage area B serve as backups for each other, as do parameter storage area A and parameter storage area B. If data in one storage area is corrupted, recovery can be performed based on the corresponding data in the other storage area, improving timeliness.

[0019] Regarding step 102, periodic NorFlash refresh is used to address the accumulation of bit errors caused by single-event flips in the on-orbit radiation environment. High-energy particles in space may cause bit flips in the NorFlash storage, initially manifesting as single-bit errors. If left unaddressed, these errors may accumulate and form multi-bit errors, eventually exceeding the error correction capability. This step involves sending a remote control command from the ground to enable the NorFlash refresh command word. The system software performs the refresh operation during idle tasks to avoid impacting the operation of primary business operations. The refresh targets include critical areas in the NorFlash that affect the spacecraft's functional operation, such as the A / B copies of the program storage area and the A / B copies of the parameter storage area.

[0020] During refresh, the refresh order for each storage area is first determined, such as reading program storage area A, program storage area B, parameter storage area A, and parameter storage area B in a predefined order. After determining the refresh order, the number of bytes read each time is determined, such as reading four bytes each time. Of course, the order and the number of bytes can be set according to user needs, and are not specifically limited here.

[0021] Once the refresh order and the number of bytes read each time are determined, and the NorFlash is in an idle state, data from each storage area in the critical region can be read sequentially according to the set order and the set number of bytes. For each piece of data read, the following steps are executed: S1: Determine if a single-bit error or a double-bit error has occurred in the data. If not, proceed to S2; if a single-bit error has occurred, proceed to S3; if a double-bit error has occurred, proceed to S4. This process is based on the fact that the NorFlash used in orbit has the capability of "correcting one and detecting two," meaning that single-bit errors can be corrected and written back after correction; double-bit errors can be detected but not corrected. Therefore, step S4 is required to prioritize reading the correct content from the redundant backup area, reconstruct the corresponding data, and then write it back.

[0022] S2, read the next preset number of bytes of data, and return to execute S1; S3. Stop this refresh, restore the correct data using the EDAC error correction function of the NorFlash region, and set the NorFlash status flag in the telemetry word to unhealthy. This repair process is a common technique in this field and will not be described in detail here.

[0023] S4. Stop this refresh, repair the data using the corresponding data in the backup storage area, and set the NorFlash status flag in the telemetry word to unhealthy. It should be noted that NorFlash status repair is done in blocks; therefore, the specific repair process is as follows: Get the block pointer of the NorFlash located at the address where the data is located; Based on the block pointer, obtain the block information of the erroneous block where the data is located. The block information includes the size of the NorFlash logical block, the size of the data block, and the starting address of the block. Based on the storage area and block information of the faulty block, determine the backup storage area of ​​the storage area where the faulty block is located, as well as the corresponding backup block and block information of the backup block within the backup storage area; The erroneous data within the faulty block is repaired based on the block information of the backup block, specifically as follows: Enable EDAC error correction for faulty blocks and backup blocks; Read the data in the error block sequentially according to the set number of bytes; For each piece of data read, the system uses EDAC error correction to determine if a double-bit error has occurred. If not, the data is stored in the NorFlash data recovery buffer. If so, the system obtains the offset of the data's address and calculates the recovery address corresponding to the backup block based on the offset, the error block, and the backup block's block information. The data at the recovery address is then stored in the NorFlash data recovery buffer. This process continues until all data in the error block has been traversed. The data in the NorFlash data recovery buffer is written into the error block to complete the data repair.

[0024] This step repairs double-bit errors on a block-by-block basis. During the repair process, by re-judging the double-bit errors in the data within the erroneous block, the accuracy of the judgment results can be improved, and misjudgments can be prevented.

[0025] S1-S4 are executed in a loop. If no single-bit or double-bit error occurs during the entire refresh process, the NorFlash status flag in the telemetry word is set to healthy.

[0026] This step utilizes a redundant A / B storage structure and an SRAM temporary cache to move the correct backup data to the faulty block, enabling recovery of the faulty block. Thus, when an error occurs in a program area of ​​NorFlash, instead of simply setting a fault flag, recovery can be performed using another error-free program area, improving the continuous availability of the program image. For example, if a two-bit error occurs in program storage area A, the corresponding content in program storage area B is read; if a two-bit error occurs in program storage area B, the corresponding content in program storage area A is read. Furthermore, this process does not wait until program startup fails or parameter reading anomalies occur before addressing NorFlash issues; instead, it proactively maintains critical storage areas during on-orbit operation, identifying potential errors in advance and reducing the risk of long-term error accumulation leading to uncorrectable problems.

[0027] In summary, this step has the following advantages: (1) It reduces the risk of NorFlash storage error accumulation. Through regular refresh and secure repair loop, it reduces the possibility of errors evolving into uncorrectable errors after long-term accumulation. (2) It improves the availability and long-term reliability of the program area and critical parameter area. Through primary backup fault recovery, it avoids the lag caused by relying solely on fault flags and manual ground handling, giving NorFlash stronger on-orbit self-maintenance capabilities. Furthermore, the inventors discovered during their work that due to the rapid iteration of spacecraft flight software versions, frequent software updates and updates are required. Traditional updates suffer from low automation, insufficient rollback capability, and limitations in manual maintenance; therefore, improvements to the updates method are necessary. Based on this, this application proposes an on-orbit programming updates method, as follows: The NorFlash storage area is divided into a factory version area and an on-orbit version area; the factory version area is used to store the basic software version that has been fully verified on the ground; the on-orbit version area is used to store the new version of software that is on-orbited from the ground; the method also includes: In response to the ground generating the injection version to be injected and sending the on-orbit injection remote control command, execute: S11: Receive the betting version and determine if the betting version is abnormal. If it is, determine that the betting has failed and execute S12; otherwise, write the betting version into the SRAM buffer and execute S13. S12, move the factory version in the factory version area as the current running version, and report the current running version and betting status; S13, when the current NorFlash operation state is idle, write the above version to A copies of the program storage area and execute S14; S14. When the current NorFlash operation state is idle, compare and verify the data written to the program storage area in S13 with the data in the SRAM buffer. If the verification is successful, proceed to S15; otherwise, proceed to S12. S15, when the current NorFlash operation state is idle, write the above version into the B program storage area and execute S16; S16: When the current NorFlash operation state is idle, compare and verify the data written to the program storage area in S15 with the data in the SRAM buffer. If the verification is successful, the betting is determined to be successful, the bet version is taken as the current running version, and the current running version and betting status are reported; otherwise, execute S12.

[0028] This step automates the uploading process by differentiating between the "factory version area" and the "uploaded version area" in the storage layout and employing a primary / backup redundancy strategy. It links the writing, verification, version determination, and anomaly rollback processes into a single automated workflow, reducing manual intervention. Even if an uploaded version encounters an anomaly, it will not directly affect the spacecraft's basic operational capabilities. Instead, it allows for a rapid revert to the factory version or a reliable backup version, enabling quick rollback in case of upload anomalies and mitigating the impact of software update failures on spacecraft mission continuity.

[0029] Furthermore, different NorFlash models may differ in command words, erase granularity, page size, write timing, and status register definitions. If the system software directly implements the refresh, repair, and loading processes for a specific chip, then significant modifications to the upper-level management logic are required when changing the NorFlash model.

[0030] To address this issue, this application employs a three-tier software middleware adaptation architecture, such as... Figure 2 As shown, it includes an abstract interface layer, a glue management layer, and a chip driver layer; among which, the abstract interface layer is located at the top layer of the architecture and is used to provide a unified calling interface for upper-layer on-orbit programming tasks, periodic refresh tasks, and security repair tasks; the interface includes at least the NorFlash refresh interface, the NorFlash maintenance interface, and the NorFlash injection interface; The glue management layer connects the abstract interface layer and the chip driver layer, and includes at least NorFlash read operations, NorFlash write operations and NorFlash erase operations. The glue management layer is responsible for parsing upper-layer instructions and dynamically adjusting the operation timing window and block address mapping strategy according to the physical device attributes currently mapped. The chip driver layer is located at the bottom layer of the architecture and contains driver instances for various heterogeneous NorFlash chips, such as JFM29GL256RH driver, JFM29LV641RH driver, and 29LV160 driver.

[0031] By adopting the aforementioned architecture, this application allows upper-layer software to perform periodic refreshes, security repairs, and on-orbit programming by simply calling a unified interface, without needing to concern itself with the specific NorFlash chip model. The underlying driver handles command transmission, status reading, erase / write waiting, and error return based on the actual chip. In this way, the upper-layer refresh, repair, and uploading processes do not require significant modifications based on chip model changes, facilitating reuse across different spacecraft models and NorFlash devices. This enables smooth migration between different NorFlash models, reducing redundant development and verification work.

[0032] Through the above scheme, this application forms a complete closed loop for NorFlash on-orbit management: periodic refresh for problem prevention and detection, secure repair for restoring stored content, on-orbit programming for supporting reliable software updates, and middleware adaptation for improving engineering reusability. This method can better meet the needs of long-term on-orbit operation of spacecraft, high-reliability storage maintenance, and high-frequency software uploading.

[0033] like Figure 3 , Figure 4 As shown, this embodiment of the invention provides a NorFlash on-orbit management device for spacecraft. The device embodiment can be implemented through software, hardware, or a combination of both. From a hardware perspective, as... Figure 3 The diagram shown is a hardware architecture diagram of an electronic device for NorFlash on-orbit management of a spacecraft, provided by an embodiment of the present invention. (Except for...) Figure 3 In addition to the processor, memory, network interface, and non-volatile memory shown, the electronic device in the embodiment may also include other hardware, such as a forwarding chip responsible for processing packets. Taking software implementation as an example, such as... Figure 4 As shown, a device in a logical sense is formed by the CPU of the electronic device in which it is located reading the corresponding computer program from the non-volatile memory into the memory for execution.

[0034] This embodiment provides a NorFlash on-orbit management device for spacecraft, comprising: The partitioning unit 400 is used to divide the NorFlash storage area into a critical area, a status area, and a telemetry information area. The critical area includes a program storage area A and a program storage area B, which are used to store program images that are backups of each other, and a parameter storage area A and a parameter storage area B, which are used to store configuration data that are backups of each other. The status and telemetry information area is used to record the NorFlash health status, refresh results, error counts, and version status information. Error correction unit 402 is used to read data from each storage area in the critical region sequentially according to a set order and a set number of bytes when a NorFlash refresh command is sent from the ground. For each piece of data read, S1-S4 are executed in a loop until all data has been traversed. If no single-bit or double-bit error occurs during the entire refresh process, the NorFlash status flag in the telemetry word is set to healthy. S1, determine whether a single-bit error or a double-bit error has occurred in the data; if not, proceed to S2; if a single-bit error has occurred, proceed to S3; if a double-bit error has occurred, proceed to S4. S2, read the next preset number of bytes of data, and return to execute S1; S3, stop this refresh, use the EDAC error correction function of the area where NorFlash is located to restore the correct data, and set the NorFlash status flag in the telemetry word to unhealthy; S4, stop this refresh, use the corresponding data in the storage area that is a backup of the current storage area to repair the data, and set the NorFlash status flag in the telemetry word to unhealthy.

[0035] In some implementations, the data is repaired using corresponding data in a storage area that serves as a backup of the current storage area, including: Get the block pointer of the NorFlash located at the address where the data is located; Based on the block pointer, obtain the block information of the erroneous block where the data is located. The block information includes the size of the NorFlash logical block, the size of the data block, and the starting address of the block. Based on the storage area and block information of the faulty block, determine the backup storage area of ​​the storage area where the faulty block is located, as well as the corresponding backup block and block information of the backup block within the backup storage area; Repair erroneous data within the faulty block based on the block information of the backup block.

[0036] In some implementations, erroneous data within the faulty block is repaired based on block information from the backup block, including: Enable EDAC error correction for faulty blocks and backup blocks; Read the data in the error block sequentially according to the set number of bytes; For each piece of data read, the system uses EDAC error correction to determine if a double-bit error has occurred. If not, the data is stored in the NorFlash data recovery buffer. If so, the system obtains the offset of the data's address and calculates the recovery address corresponding to the backup block based on the offset, the error block, and the backup block's block information. The data at the recovery address is then stored in the NorFlash data recovery buffer. This process continues until all data in the error block has been traversed. The data in the NorFlash data recovery buffer is written into the error block to complete the data repair.

[0037] In some implementations, the method further includes: dividing the NorFlash storage area into a factory version area and an on-orbit version area; the factory version area is used to store the basic software version that has been fully verified on the ground; the on-orbit version area is used to store the new version of software that is on-orbited from the ground; the method further includes: In response to the ground generating the injection version to be injected and sending the on-orbit injection remote control command, execute: S11: Receive the betting version and determine if the betting version is abnormal. If it is, determine that the betting has failed and execute S12; otherwise, write the betting version into the SRAM buffer and execute S13. S12, move the factory version in the factory version area as the current running version, and report the current running version and betting status; S13, when the current NorFlash operation state is idle, write the above version to A copies of the program storage area and execute S14; S14. When the current NorFlash operation state is idle, compare and verify the data written to the program storage area in S13 with the data in the SRAM buffer. If the verification is successful, proceed to S15; otherwise, proceed to S12. S15, when the current NorFlash operation state is idle, write the above version into the B program storage area and execute S16; S16: When the current NorFlash operation state is idle, compare and verify the data written to the program storage area in S15 with the data in the SRAM buffer. If the verification is successful, the betting is determined to be successful, the bet version is taken as the current running version, and the current running version and betting status are reported; otherwise, execute S12.

[0038] In some implementations, it also includes: A three-layer software middleware adaptation architecture is adopted, including an abstract interface layer, a glue management layer, and a chip driver layer. The abstract interface layer is located at the top layer of the architecture and is used to provide a unified calling interface for upper-layer on-orbit programming tasks, periodic refresh tasks, and security repair tasks. The interface includes at least a NorFlash refresh interface, a NorFlash maintenance interface, and a NorFlash injection interface. The glue management layer connects the abstract interface layer and the chip driver layer, and includes at least NorFlash read operations, NorFlash write operations and NorFlash erase operations. The glue management layer is responsible for parsing upper-layer instructions and dynamically adjusting the operation timing window and block address mapping strategy according to the physical device attributes currently mapped. The chip driver layer is located at the bottom layer of the architecture and contains driver instances for various heterogeneous NorFlash chips.

[0039] In some implementations, the number of bytes is set to 4 bytes.

[0040] It is understood that the structures illustrated in the embodiments of the present invention do not constitute a specific limitation on a NorFlash on-orbit management device for spacecraft. In other embodiments of the present invention, a NorFlash on-orbit management device for spacecraft may include more or fewer components than illustrated, or combine some components, or split some components, or have different component arrangements. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

[0041] The information interaction and execution process between the modules in the above-mentioned device are based on the same concept as the method embodiment of the present invention, and the specific details can be found in the description of the method embodiment of the present invention, and will not be repeated here.

[0042] This invention also provides an electronic device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements a NorFlash on-orbit management method for spacecraft according to any embodiment of this invention.

[0043] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program causes the processor to perform a NorFlash on-orbit management method for spacecraft according to any embodiment of this invention.

[0044] Specifically, a system or apparatus equipped with a storage medium may be provided, on which software program code implementing the functions of any of the embodiments described above is stored, and the computer (or CPU or MPU) of the system or apparatus may read and execute the program code stored in the storage medium.

[0045] In this case, the program code read from the storage medium can itself implement the function of any of the above embodiments, and therefore the program code and the storage medium storing the program code constitute part of the present invention.

[0046] Storage media embodiments for providing program code include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, program code can be downloaded from a server computer via a communication network.

[0047] Furthermore, it should be clear that not only can the program code read by the computer be executed, but also the operating system or other components operating on the computer can be instructed based on the program code to perform some or all of the actual operations, thereby realizing the function of any of the embodiments described above.

[0048] Furthermore, it is understood that the program code read from the storage medium is written to the memory set in the expansion board inserted into the computer or to the memory set in the expansion module connected to the computer. Then, based on the instructions of the program code, the CPU or other components installed on the expansion board or expansion module execute some and all of the actual operations, thereby realizing the function of any of the above embodiments.

[0049] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for on-orbit management of NorFlash for spacecraft, characterized in that, include: The NorFlash storage area is divided into a critical area, a status area, and a telemetry information area. The key areas include a program storage area A and a program storage area B, which are used to store program images that are backups of each other, and a parameter storage area A and a parameter storage area B, which are used to store configuration data that are backups of each other. The status and telemetry information area is used to record NorFlash health status, refresh results, error counts, and version status information; In response to the NorFlash refresh command sent from the ground, data from each storage area in the critical region is read sequentially according to a set order and a set number of bytes. For each piece of data read, the following is executed: S1, determine whether a single-bit error or a double-bit error has occurred in the data; if not, proceed to S2; if a single-bit error has occurred, proceed to S3; if a double-bit error has occurred, proceed to S4. S2, read the next preset number of bytes of data, and return to execute S1; S3, stop this refresh, use the EDAC error correction function of the area where NorFlash is located to restore the correct data, and set the NorFlash status flag in the telemetry word to unhealthy; S4, stop this refresh, use the corresponding data in the storage area that is a backup of the current storage area to repair the data, and set the NorFlash status flag in the telemetry word to unhealthy; S1-S4 are executed in a loop. If no single-bit or double-bit error occurs during the entire refresh process, the NorFlash status flag in the telemetry word is set to healthy.

2. The method according to claim 1, characterized in that, The step of repairing the data using corresponding data in a storage area that serves as a backup of the current storage area includes: Get the block pointer of the NorFlash located at the address where the data is located; Based on the block pointer, obtain the block information of the erroneous block where the data is located. The block information includes the NorFlash logical block size, the data block size, and the starting address of the block. Based on the storage area and block information where the erroneous block is located, determine the backup storage area of ​​the storage area where the erroneous block is located, as well as the corresponding backup block and block information of the backup block within the backup storage area; The erroneous data within the erroneous block is repaired based on the block information of the backup block.

3. The method according to claim 2, characterized in that, The step of repairing erroneous data within the erroneous block based on the block information of the backup block includes: Enable the EDAC error correction function for the faulty block and the backup block; Read the data in the error block sequentially according to the set number of bytes; For each piece of data read, based on the EDAC error correction function, it is determined whether the data has a double-bit error; if not, the data is stored in the NorFlash data recovery buffer; if so, the offset of the data's address is obtained, and based on the offset, the block information of the erroneous block and the backup block, the recovery address corresponding to the backup block is calculated, and the data in the recovery address is stored in the NorFlash data recovery buffer; this process continues until each piece of data in the erroneous block has been traversed. The data in the NorFlash data recovery buffer is written into the error block to complete the data repair.

4. The method according to claim 1, characterized in that, Also includes: The NorFlash storage area is divided into a factory version area and an updated version area; the factory version area is used to store the basic software version that has been fully verified on the ground. The injection version area is used to store new versions of the software for on-orbit injection from the ground; the method also includes: In response to the ground generating the injection version to be injected and sending the on-orbit injection remote control command, execute: S11: Receive the betting version and determine whether the betting version is abnormal. If it is, determine that the betting has failed and execute S12; otherwise, write the betting version into the SRAM buffer and execute S13. S12, move the factory version in the factory version area as the current running version, and report the current running version and the upload status; S13, when the current NorFlash operation state is idle, write the above version into A copies of the program storage area and execute S14; S14. When the current NorFlash operation state is idle, compare and verify the data written to the program storage area in S13 with the data in the SRAM buffer. If the verification is successful, proceed to S15; otherwise, proceed to S12. S15, when the current NorFlash operation state is idle, write the above version into B copies of the program storage area and execute S16; S16, when the current NorFlash operation state is idle, compare and verify the data written to the program storage area in S15 with the data in the SRAM buffer. If the verification is successful, the betting is determined to be successful, the betting version is taken as the current running version, and the current running version and betting status are reported; otherwise, execute S12.

5. The method according to claim 1, characterized in that, Also includes: A three-layer software middleware adaptation architecture is adopted, including an abstract interface layer, a glue management layer, and a chip driver layer. The abstract interface layer is located at the top layer of the architecture and is used to provide a unified calling interface for upper-layer on-orbit programming tasks, periodic refresh tasks, and security repair tasks. The interface includes at least a NorFlash refresh interface, a NorFlash maintenance interface, and a NorFlash injection interface. The glue management layer connects the abstract interface layer and the chip driver layer, and includes at least NorFlash read operation, NorFlash write operation and NorFlash erase operation. The glue management layer is responsible for parsing upper-layer instructions and dynamically adjusting the operation timing window and block address mapping strategy according to the physical device attributes currently mapped. The chip driver layer is located at the bottom layer of the architecture and contains driver instances for various heterogeneous NorFlash chips.

6. The method according to claim 1, characterized in that, The specified number of bytes is 4 bytes.

7. A NorFlash on-orbit management device for spacecraft, characterized in that, include: The partitioning unit is used to divide the NorFlash storage area into critical areas, status areas, and telemetry information areas. The key areas include a program storage area A and a program storage area B, which are used to store program images that are backups of each other, and a parameter storage area A and a parameter storage area B, which are used to store configuration data that are backups of each other. The status and telemetry information area is used to record NorFlash health status, refresh results, error counts, and version status information; The error correction unit is used to read data from each storage area in the critical region sequentially according to a set order and a set number of bytes when a NorFlash refresh command is sent from the ground. For each piece of data read, S1-S4 are executed cyclically until all data has been traversed. If no single-bit or double-bit error occurs during the entire refresh process, the NorFlash status flag in the telemetry word is set to healthy. S1, determine whether a single-bit error or a double-bit error has occurred in the data; if not, proceed to S2; if a single-bit error has occurred, proceed to S3; if a double-bit error has occurred, proceed to S4. S2, read the next preset number of bytes of data, and return to execute S1; S3, stop this refresh, use the EDAC error correction function of the area where NorFlash is located to restore the correct data, and set the NorFlash status flag in the telemetry word to unhealthy; S4, stop this refresh, use the corresponding data in the storage area that is a backup of the current storage area to repair the data, and set the NorFlash status flag in the telemetry word to unhealthy.

8. A computing device comprising a memory and a processor, wherein the memory stores a computer program, and the processor, when executing the computer program, implements the method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program, which, when executed by a processor, implements the steps of the method according to any one of claims 1-6.

Images