CN110941506A

CN110941506A - SEU-resistant configuration file storage system and storage method thereof

Info

Publication number: CN110941506A
Application number: CN201911031878.0A
Authority: CN
Inventors: 陈元春; 顾晶
Original assignee: Nanjing University of Science and Technology
Current assignee: Nanjing University of Science and Technology
Priority date: 2019-10-28
Filing date: 2019-10-28
Publication date: 2020-03-31

Abstract

The invention discloses an SEU-resistant configuration file storage system and a storage method thereof, wherein the SEU-resistant configuration file storage system comprises three high-capacity FLASH memories, an antifuse FPGA and an SRAM-based FPGA; storing configuration programs of an SRAM type FPGA by three high-capacity FLASH memories, wherein each FLASH stores the same program according to the same mode, correcting error bits after comparing bits in the three FLASH memories according to the bit comparison according to a minority obeying majority principle, namely reading the configuration programs from the same addresses in the three FLASH memories respectively, then carrying out bit comparison, and if a bit in one FLASH is inconsistent with the bits at the same positions in the other two FLASH memories, judging that the error occurs, and correcting the bit with the error; the anti-fuse FPGA finishes reading the configuration programs in the three FLASH chips and anti-SEU correction, and the power-on initial configuration of all the configuration programs of the SRAM type FPGA and the timing write-in partial configuration program operation of the dynamic refreshing process. The invention can overcome the problem of single event upset of the configuration program stored in the FLASH.

Description

SEU-resistant configuration file storage system and storage method thereof

Technical Field

The invention belongs to the radiation hardening technology of a satellite-borne electronic system, and particularly relates to an SEU-resistant configuration file storage system and an SEU-resistant configuration file storage method.

Background

The SRAM type FPGA has the characteristics of rich resources, excellent performance and repeated programming, and is widely used in satellite-borne electronic equipment. The configuration storage area in the SRAM type FPGA is greatly influenced by space radiation, and single event upset is easy to occur in a space environment, so that an on-track dynamic refreshing technology such as PROM, antifuse FPGA, triple modular redundancy and timing refreshing is frequently adopted in on-track application. Since the satellite-borne system generally needs to process a large amount of work, a large-scale SRAM type FPGA is often used, while the on-orbit dynamic refresh method generally requires to store all configuration programs and a part of configuration programs for dynamic refresh at the same time, and the storage resource overhead becomes more considerable. Particularly, with the increase of the complexity of the system, the scale of the SRAM type FPGA device and the size of the configuration program are also increasing continuously, which brings great pressure on satellite storage, and if a low-capacity PROM is continuously used, the complexity of the circuit, the area of the circuit, and the cost are inevitably increased greatly. The invention provides a low-cost and high-reliability storage method for an on-orbit configuration program of an SRAM (static random access memory) type FPGA (field programmable gate array) of a satellite-borne single machine, which can be used for the on-orbit dynamic refreshing and single-event-upset resistance functions of the satellite-borne single machine represented by deep space exploration, namely the satellite-borne single machine with the requirements of small weight and power consumption and high reliability is required.

CN109783434A in "Low-cost high-reliability on-orbit dynamic refresh System and method for satellite-borne Single-chip SRAM type FPGA", proposes a method for storing FPGA configuration programs by FLASH, which adopts modules with EDAC encoding and EDAC checking to detect and correct a small number of errors, and combines the method of re-injecting configuration programs on the ground to achieve the SEU-resistant function of FLASH.

The method has the following defects: (1) the scheme needs a ground system to participate in SEU resistance, and has no feasibility for deep space exploration; (2) for the non-geostationary orbit satellite, ground participation resistance to SEU is required, and the ground station is required to be established in the world, so that the cost is high.

Disclosure of Invention

The invention aims to provide an SEU-resistant configuration file storage system and a storage method thereof, which are used for storing a configuration program of a large-scale SRAM type FPGA and can independently and effectively overcome the problem of single event upset of the configuration program stored in FLASH on a satellite.

The technical solution for realizing the purpose of the invention is as follows: an SEU-resistant configuration file storage system comprises a first FLASH, a second FLASH, a third FLASH, an antifuse FPGA, an SRAM (static random access memory) type FPGA and a power module, wherein the first FLASH, the second FLASH and the third FLASH are respectively connected with the antifuse FPGA through SPI (serial peripheral interface), the SRAM type FPGA is connected with the antifuse FPGA through a SelectMAP interface, and the power module is respectively connected with the first FLASH, the second FLASH, the third FLASH, the antifuse FPGA and the SRAM type FPGA to supply power to the first FLASH, the second FLASH, the third FLASH, the antifuse FPGA and the SRAM type FPGA.

The anti-fuse FPGA comprises a FLASH read-write control-correction module and a dynamic refreshing module which are connected, wherein the FLASH read-write control-correction module is respectively connected with a first FLASH, a second FLASH and a third FLASH, and the dynamic refreshing module is connected with the SRAM type FPGA.

A storage method of a configuration file storage system based on SEU resistance comprises the following steps:

step 1, powering on a system, supplying power to a first FLASH, a second FLASH, a third FLASH, an antifuse FPGA and an SRAM type FPGA, and turning to step 2;

step 2, initializing FLASH read-write addresses, wherein the addresses are read-write common addresses of three FLASH chips, and turning to step 3;

step 3, reading out continuous 256 byte unit configuration program from three FLASH chips respectively by using the FLASH read-write address of the last step as an initial value, and turning to step 4

Step 4, inputting the read unit configuration program into an antifuse FPGA for a few majority-obeying comparison processing, namely respectively comparing the unit configuration programs read from the three FLASH chips according to bits, judging the bit larger than or equal to 2 as a correct unit configuration program and outputting the unit configuration program, and turning to step 5;

step 5, storing the unit configuration program output in the step 4 into a storage area of the antifuse FPGA, covering the original unit configuration program in the storage area, outputting the unit configuration program and the address information corresponding to the unit configuration program to the step 6 in one direction, and outputting the unit configuration program and the address information to the dynamic refreshing module in the other direction, namely outputting the unit configuration program and the address information to the step 9;

step 6, respectively writing back the unit configuration program in the step 5 to corresponding areas in the three FLASH chips according to the original address path read in the step 3, and turning to the step 7;

step 7, judging whether the unit configuration program written by the FLASH read-write address in the step 6 reaches the last group of 256-byte unit configuration programs of the three-piece FLASH storage area, if so, returning to the step 2, and if not, turning to the step 8;

step 8, adding 256 to the FLASH read-write address on the basis of the last value (in a FLASH memory, one address corresponds to 1 byte), and then returning to the step 3;

step 9, judging whether the address of the unit configuration program transmitted from the FLASH read-write control-correction module is the address of all the configuration programs stored in the FLASH, if so, jumping to step 10, and if not, jumping to step 12;

step 10, judging whether the configuration of the SRAM type FPGA is firstly carried out after power-on, if so, jumping to step 11, and if not, jumping to step 9;

step 11, writing all configuration programs into the SRAM type FPGA through the SelectMAP interface, wherein the unit configuration program transmitted from the FLASH read-write control-correction module each time takes 256 bytes as a unit, so that multiple cycles are needed for writing all the complete configuration programs into the SRAM type FPGA, and the total cycle time is the time for writing all the complete configuration programs into the SRAM type FPGA, and the step 9 is skipped to enter the cycle;

step 12, judging whether the configuration of all the configuration programs of the SRAM type FPGA is finished, if so, jumping to step 13, and if not, jumping to step 9;

step 13, judging whether the address of the unit configuration program transmitted from the FLASH read-write control-correction module is the address of a storage part configuration program in the FLASH, if so, jumping to step 14, otherwise, jumping to step 9 because dynamic refreshing needs to write part configuration program into the SRAM type FPGA;

and step 14, writing a part of configuration programs into the SRAM type FPGA through the SelectMAP interface, wherein the unit configuration program transmitted from the FLASH read-write control-correction module each time takes 256 bytes as a unit, so that the whole part of configuration programs are written into the SRAM type FPGA for multiple cycles, the total time of the cycles is the time for writing the whole part of configuration programs into the SRAM type FPGA, the step is called dynamic refreshing, and the step 9 is skipped to enter the cycles.

Compared with the prior art, the invention has the following advantages:

(1) a large-capacity FLASH replaces a PROM, and all configuration programs of a large-scale SRAM type FPGA can be stored only by a single FLASH.

(2) According to a few principles which obey most, a design method of triple modular redundancy is adopted, three FLASH are used for storing completely same configuration programs of SRAM type FPGA according to the same mode, the same mode refers to the situation that bits at the same position in two FLASH are flipped simultaneously between the configuration programs stored in the three FLASH, the refresh algorithm is feasible as long as the situation that bits at the same position in the two FLASH are flipped simultaneously does not occur simultaneously, the probability of single event upset generated at the same time for certain two same bits in the three FLASH within a certain time is extremely low, so that the single event upset problem of the configuration programs in the FLASH can be overcome as long as the reading and refreshing speed of the configuration programs stored in the FLASH is increased, the single event upset frequency of a satellite on different orbits of the earth can be known according to statistical data, the read-back and refreshing frequency of the FLASH can be set, the preset refreshing speed of the invention is more than ten times of the single event upset frequency of the satellite on the working orbit.

(3) The complexity of the system is simplified, and the reliability of the system is improved. On one hand, three pieces of high-capacity FLASH are adopted to replace a low-capacity PROM, so that the hardware complexity is simplified; on the other hand, the anti-fuse FPGA realizes the functions of reading and writing back the refresh configuration program while writing back the three FLASH through the SPI interface, and simultaneously realizes the functions of power-on initial configuration and dynamic refresh of the SRAM type FPGA through the SelectMAP interface, thereby realizing the function of single event upset resistance of the whole system and improving the reliability of the system.

Drawings

FIG. 1 is a block diagram of the SEU-resistant configuration file storage system of the present invention.

FIG. 2 is a block diagram of the internal detail implementation of the system of the present invention.

Fig. 3 is a functional flow diagram implemented by the antifuse FPGA of the system of the present invention, in which the 1 st functional region is above the dotted line and corresponds to the FLASH read-write control-correction module in fig. 2, and the 2 nd functional region is below the dotted line and corresponds to the dynamic refresh module in fig. 2.

Detailed Description

The invention is described in further detail below with reference to the following figures and specific examples:

with reference to fig. 1, the present invention is an SEU-resistant configuration file storage system, which includes a first FLASH, a second FLASH, a third FLASH, an antifuse FPGA, an SRAM-type FPGA, and a power module, where the first FLASH, the second FLASH, and the third FLASH are respectively connected to the antifuse FPGA through SPI interfaces, the SRAM-type FPGA is connected to the antifuse FPGA through a SelectMAP interface, and the power module is respectively connected to the first FLASH, the second FLASH, the third FLASH, the antifuse FPGA, and the SRAM-type FPGA to supply power to them.

With reference to fig. 2, the antifuse FPGA includes a FLASH read-write control-correction module and a dynamic refresh module, which are connected to each other, wherein the FLASH read-write control-correction module is respectively connected to a first FLASH, a second FLASH, and a third FLASH, and the dynamic refresh module is connected to the SRAM FPGA.

The first FLASH, the second FLASH and the third FLASH realize the following functions:

and storing a configuration program of the SRAM type FPGA, wherein the configuration program of the SRAM type FPGA comprises a whole configuration program and a part of configuration program, the whole configuration program is used for configuring the SRAM type FPGA at the initial power-on time, and after the whole configuration program completes the configuration of the SRAM type FPGA, the dynamic refreshing of the SRAM type FPGA is started, namely, the part of configuration program is used for configuring the SRAM type FPGA during the dynamic refreshing. All configuration programs and part of configuration programs can be stored in a single FLASH after being packaged, the capacity of the FLASH is more than or equal to the sum of the sizes of all the configuration programs and part of the configuration programs, the first FLASH, the second FLASH and the third FLASH respectively store three pieces of configuration data of the SRAM type FPGA, namely all the configuration programs and part of the configuration programs after being packaged, and the configuration program data corresponding to the same address between the three FLASH pieces are completely the same.

The antifuse FPGA is used as a device in the system and realizes the following two functions:

with reference to fig. 2 and 3, the 1 st function, the single event upset resistance function of the FLASH, is completed by the FLASH read-write control-correction module in fig. 3 (part above the dotted line); the 2 nd function, the dynamic refresh configuration of the power-on initial configuration and the single event upset resistant function of the SRAM type FPGA, is completed by the dynamic refresh module in fig. 3 (the part below the dotted line), the above two functions are executed in parallel, and the two functions are associated together through the "storage region of the antifuse FPGA" mentioned below, so in the following, the two functions are described in separate words first, and then are explained in a unified manner according to the flow chart of fig. 3.

Since the configuration programs stored in the three pieces of FLASH are the same, the configuration programs in the FLASH mentioned below are all the configuration programs in the single piece of FLASH, and do not refer to a certain piece of FLASH.

The 1 st function, because the system is applied to the satellite equipment, the configuration program in the FLASH is easily influenced by the space high-energy charged particles to generate single-particle upset, and in order to avoid errors caused by the influence, the configuration program stored in the FLASH needs to be corrected, the system adopts an antifuse FPGA to realize the function of resisting the single-particle upset of the FLASH, and the realization method is as follows:

when the system is powered on, the anti-fuse FPGA firstly reads the configuration programs with the same address in the first FLASH, the second FLASH and the third FLASH, then the read configuration programs are compared according to bits, and the bits occupying most are judged as the correct configuration programs according to the principle that a few bits obey most. According to the reading and judging method, the configuration programs in the three FLASH chips are read out for 256 continuous bytes each time (the size of 256 bytes is not limited to the value, and actually, the range does not exceed the resource limit of the selected antifuse FPGA), so that the configuration programs are called unit configuration programs (the unit configuration data shown here belong to all the configuration programs or part of the configuration programs of the SRAM type FPGA stored in the FLASH), the unit configuration programs judged to be correct are stored in the storage area of the antifuse FPGA after being subjected to a few majority judgment processes (note that the storage area of the antifuse FPGA is a bridge for associating the 1 st function and the 2 nd function), and finally, the unit configuration programs in the antifuse FPGA storage area are respectively written back into the three FLASH chips according to the original addresses. And performing the same operation on the configuration programs of the continuous 256-byte units of the next group of addresses in the FLASH according to the mode until the configuration programs in the three FLASH are all refreshed once, and then repeating the operation flow at regular time, wherein the timing time (set as T) between two operations is less than one tenth of the single-event upset period of the satellite on the orbit.

The 2 nd function, because this system is applied to the satellite equipment too, therefore the configuration procedure in SRAM type FPGA is apt to be influenced by space high-energy charged particle and take place the single particle to overturn too, in order to avoid the function abnormality of FPGA that this influence causes, carry on the configuration of all configuration procedures of power-on initial and adopt the method of dynamic refreshing to write into some configuration procedures regularly (time is T mentioned above) to SRAM type FPGA, this system adopts the FPGA of the anti-fuse to carry on the procedure and realize the power-on initial configuration and anti-single particle of SRAM type FPGA and overturn the dynamic refreshing of the function, the implement method is as follows:

as can be seen from the function 1, during the operation of the FLASH read-write control-correction module, the new 256-byte unit configuration program is continuously refreshed on the storage region of the antifuse FPGA (the "storage region of the antifuse FPGA" corresponds to the above description), where the unit configuration program is essentially the configuration program (including all the configuration programs or part of the configuration programs) of the SRAM FPGA, and during the operation of the FLASH read-write control-correction module, the 256-byte unit configuration program in the storage region of the antifuse FPGA traverses all the configuration programs stored in the FLASH, that is, traverses all the configuration programs and part of the configuration programs of the SRAM FPGA with 256 bytes as a unit.

In combination with the above-mentioned "storage region of the antifuse FPGA" as a bridge for associating the 1 st function with the 2 nd function, it can be known that the unit configuration program (256 bytes are transmitted each time) sent out from the storage region of the antifuse FPGA is used for the dynamic refresh module to realize its function, that is, the unit configuration program configures the SRAM FPGA through the SelectMAP interface (full configuration program configuration or partial configuration program configuration), when the system is powered on initially, the dynamic refresh module is in a mode of configuring the full configuration program for the SRAM FPGA, detects whether the address in the FLASH corresponding to the unit configuration program of the storage region of the antifuse FPGA is the full configuration program for the SRAM FPGA, if so, writes the full configuration program for the SRAM FPGA, after completing the configuration of the full configuration program for the SRAM FPGA, the dynamic refresh module enters a mode of writing the partial configuration program for the SRAM FPGA (time is T mentioned above), and detecting whether the address in the FLASH corresponding to the unit configuration program of the storage area of the antifuse FPGA is a partial configuration program of the SRAM type FPGA, and if so, writing a partial configuration program into the SRAM type FPGA, namely, performing dynamic refresh operation.

Combining the 1 st function and the 2 nd function together with fig. 3 (the above dotted line is the 1 st function area, corresponding to the FLASH read-write control-correction module in fig. 2, and the below dotted line is the 2 nd function area, corresponding to the dynamic refresh module in fig. 2), the storage method of the SEU resistant configuration file storage system includes the following steps:

step 1, powering on a system, and supplying power to a first FLASH, a second FLASH, a third FLASH, an antifuse FPGA and an SRAM type FPGA;

step 2, initializing FLASH read-write addresses, wherein the addresses are read-write common addresses of three FLASH chips;

step 3, reading out continuous 256-byte unit configuration programs from three FLASH chips respectively by taking the FLASH read-write addresses of the last step as initial values (the unit configuration programs belong to all configuration programs or a continuous small part of a part of configuration programs, namely 256 bytes, of the SRAM type FPGA stored in the FLASH);

step 4, inputting the read unit configuration program into an antifuse FPGA to perform minority-compliant majority comparison processing, namely, comparing the unit configuration programs read from the three FLASH chips according to bits respectively, and outputting the unit configuration program with majority bits (majority means more than or equal to 2) determined to be correct;

step 5, storing the unit configuration program output in the step 4 into a storage area of the antifuse FPGA, covering the original unit configuration program in the storage area, outputting the unit configuration program and the address information corresponding to the unit configuration program to the step 6 in one direction, and outputting the unit configuration program and the address information to the dynamic refreshing module in the other direction, namely outputting the unit configuration program and the address information to the step 9, wherein the step 6 and the step 9 are executed in parallel, and fig. 3 shows the process;

step 6, respectively writing back the unit configuration program in the step 5 to corresponding areas in the three FLASH chips according to the original address path read in the step 3;

and 8, adding 256 to the FLASH read-write address on the basis of the last value (in a FLASH memory, one address corresponds to 1 byte), and then returning to the step 3.

step 10, judging whether the configuration of the SRAM type FPGA is firstly carried out after power-on, if so, jumping to step 11, and if not, jumping to step 9 because the SRAM type FPGA only writes all configuration programs when power-on is started and only writes once;

step 11, writing all configuration programs into the SRAM type FPGA through the SelectMAP interface shown in fig. 2, wherein the unit configuration program transmitted from the FLASH read-write control-correction module each time takes 256 bytes as a unit, so that multiple cycles (generally, the size of the configuration program of the FPGA is much larger than 256 bytes) are required to be performed to write all the complete configuration programs into the SRAM type FPGA, and the total cycle time is the time for writing all the complete configuration programs into the SRAM type FPGA, so that the next step jumps to step 9 to enter the cycle;

step 13, judging whether the address of the unit configuration program transmitted from the FLASH read-write control-correction module is the address of the storage part configuration program in the FLASH, if so, jumping to step 14, and if not, jumping to step 9 because dynamic refreshing needs to write part configuration program into the SRAM type FPGA;

step 14, writing a partial configuration program into the SRAM-type FPGA through the SelectMAP interface shown in fig. 2, and in a similar manner to step 11, the unit configuration program transmitted from the FLASH read-write control-correction module each time takes 256 bytes as a unit, so that multiple cycles are required to be performed for writing the complete partial configuration program into the SRAM-type FPGA, the total time of the cycles is the time for writing the complete partial configuration program into the SRAM-type FPGA, and the step is called dynamic refresh, so that the next step jumps to step 9 to enter the cycles;

in the above-mentioned work flow, the time (set as T above) from the first 256-byte processing to the last 256-byte processing in the three-chip FLASH is less than one tenth of the single event upset period of the satellite on the orbit.

Finally, aiming at the defect that the prior art can not independently correct single-particle upset errors in FLASH on the satellite, the invention can solve the problem that three FLASH pieces are adopted to store three same configuration programs of the SRAM type FPGA, an anti-fuse FPGA is used for carrying an error correction program, an anti-single-particle-upset refresh correction algorithm for the FLASH is written according to the principle that a small number of the configuration programs obey most, the configuration of all the configuration programs for the first time of electrifying the SRAM type FPGA and the configuration of a dynamic refresh part of the configuration programs for the later are realized through a SelectMAP interface, so that the single-particle upset errors in the FLASH can be independently corrected on the satellite, the configuration programs are not needed to be reinjected on the ground, the anti-single-particle-upset function of the SRAM type FPGA can be realized, and the stable and reliable work of the whole system on the satellite.

Claims

1. An SEU resistant profile storage system, characterized by: the anti-fuse FPGA-based power supply comprises a first FLASH, a second FLASH, a third FLASH, an anti-fuse FPGA, an SRAM (static random access memory) type FPGA and a power supply module, wherein the first FLASH, the second FLASH and the third FLASH are respectively connected with the anti-fuse FPGA through SPI (serial peripheral interface), the SRAM type FPGA is connected with the anti-fuse FPGA through a SelectMAP (selectable map) interface, and the power supply module is respectively connected with the first FLASH, the second FLASH, the third FLASH, the anti-fuse FPGA and the SRAM type FPGA to supply power to the first FLASH, the second FLASH, the third;

2. The SEU resistant profile storage system of claim 1, wherein: the first FLASH, the second FLASH and the third FLASH store configuration programs of the SRAM type FPGA, the configuration programs of the SRAM type FPGA comprise all configuration programs and partial configuration programs, the all configuration programs are used for configuring the SRAM type FPGA at the initial power-on time, and after the all configuration programs complete the configuration of the SRAM type FPGA, dynamic refreshing of the SRAM type FPGA is started, namely the partial configuration programs are programs for configuring the SRAM type FPGA during dynamic refreshing; all configuration programs and part of the configuration programs are packaged and stored in a single FLASH, the capacity of the FLASH is larger than or equal to the sum of the sizes of all the configuration programs and part of the configuration programs, the first FLASH, the second FLASH and the third FLASH respectively store three pieces of configuration data of the SRAM type FPGA, namely all the configuration programs and part of the configuration programs after packaging, and the configuration program data corresponding to the same address between the three FLASH pieces are completely the same.

3. The SEU resistant profile storage system of claim 1, wherein the antifuse FPGA performs the following two functions:

the 1 st function, the single event upset resistance function of FLASH; and 2, the power-on initial configuration of the SRAM type FPGA and the dynamic refreshing configuration of the single event upset resisting function are executed in parallel.

4. A method for storing an SEU resistant profile storage system according to any of claims 1-3, comprising the steps of:

5. The SEU-resistant configuration file storage system storage method of claim 4, wherein: the unit configuration program in step 3 belongs to 256 bytes in the whole configuration program or part of the configuration program of the SRAM type FPGA stored in the FLASH.

6. The SEU-resistant configuration file storage system storage method of claim 4, wherein: in the steps 1 to 14, the time from the first group of 256 bytes processing to the last group of 256 bytes processing in the three FLASH chips is less than one tenth of the single event upset period of the satellite on the orbit.