CN112015584A - Multi-hand fusion satellite-borne receiver single particle resistance method - Google Patents

Multi-hand fusion satellite-borne receiver single particle resistance method Download PDF

Info

Publication number
CN112015584A
CN112015584A CN202011136332.4A CN202011136332A CN112015584A CN 112015584 A CN112015584 A CN 112015584A CN 202011136332 A CN202011136332 A CN 202011136332A CN 112015584 A CN112015584 A CN 112015584A
Authority
CN
China
Prior art keywords
address
satellite
addr
fpga
data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202011136332.4A
Other languages
Chinese (zh)
Other versions
CN112015584B (en
Inventor
鲁祖坤
黄龙
欧钢
刘哲
李柏渝
邱杨
周彦波
周海洋
杨威
郭海玉
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
National University of Defense Technology
Original Assignee
National University of Defense Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by National University of Defense Technology filed Critical National University of Defense Technology
Priority to CN202011136332.4A priority Critical patent/CN112015584B/en
Publication of CN112015584A publication Critical patent/CN112015584A/en
Application granted granted Critical
Publication of CN112015584B publication Critical patent/CN112015584B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/08—Error detection or correction by redundancy in data representation, e.g. by using checking codes
    • G06F11/10—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's
    • G06F11/1008—Adding special bits or symbols to the coded information, e.g. parity check, casting out 9's or 11's in individual solid state devices
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F1/00—Details not covered by groups G06F3/00 - G06F13/00 and G06F21/00
    • G06F1/24—Resetting means
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/004—Error avoidance
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1446—Point-in-time backing up or restoration of persistent data
    • G06F11/1456—Hardware arrangements for backup
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/14—Error detection or correction of the data by redundancy in operation
    • G06F11/1402—Saving, restoring, recovering or retrying
    • G06F11/1446—Point-in-time backing up or restoration of persistent data
    • G06F11/1458—Management of the backup or restore process
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/18—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits
    • G06F11/183—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits by voting, the voting not being performed by the redundant components
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F11/00—Error detection; Error correction; Monitoring
    • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
    • G06F11/16—Error detection or correction of the data by redundancy in hardware
    • G06F11/18—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits
    • G06F11/187—Voting techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F15/00—Digital computers in general; Data processing equipment in general
    • G06F15/76—Architectures of general purpose stored program computers
    • G06F15/78—Architectures of general purpose stored program computers comprising a single central processing unit
    • G06F15/7867—Architectures of general purpose stored program computers comprising a single central processing unit with reconfigurable architecture
    • G06F15/7871—Reconfiguration support, e.g. configuration loading, configuration switching, or hardware OS
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • G06F8/63—Image based installation; Cloning; Build to order
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04B—TRANSMISSION
    • H04B7/00—Radio transmission systems, i.e. using radiation field
    • H04B7/14—Relay systems
    • H04B7/15—Active relay systems
    • H04B7/185—Space-based or airborne stations; Stations for satellite systems
    • H04B7/18502—Airborne stations

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Quality & Reliability (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Astronomy & Astrophysics (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Aviation & Aerospace Engineering (AREA)
  • Logic Circuits (AREA)

Abstract

The invention provides a multi-means fused satellite-borne receiver single particle resisting method, which comprises the following steps: the method comprises a triple-modular redundancy design, a memory cell read-back self-refresh design, an EDAC (electronic design automation control) verification design, an ICAP (independent component analysis) refresh design and an automatic reset design, wherein the automatic reset time is set according to an operation cycle, and the single-machine non-received signal time period is selected to execute the reset of the whole machine. The invention adopts a method of fusing various means, and enhances the capability of the satellite-borne receiver for protecting the single event effect. The invention has good adaptability, is not only used for a satellite-borne receiver of a navigation system, but also suitable for a satellite-borne receiver of a radar and a communication system, is also suitable for a part of satellite-borne transmitters, and can enhance the protection capability of a satellite-borne radio transceiver terminal on the single event effect.

Description

Multi-hand fusion satellite-borne receiver single particle resistance method
Technical Field
The invention belongs to the technical field of satellite-borne receivers, and particularly relates to a multi-means fused satellite-borne receiver single particle resisting method.
Background
With the continuous acceleration of human beings on the steps of sky exploration, the knowledge of the space is gradually deepened, and more scientific technologies are applied to the space. Satellites are important carriers for human exploration and utilization of space resources, and for example, satellites of the earth form different satellite orbit systems of high orbit, medium orbit and low orbit. The radio receiver is a key device for communication between satellites and between the satellites and the ground, and is an important means for keeping the satellites controlled and available, and various types of radio receivers such as communication, navigation, radar and the like are applied to the satellites at present.
The biggest difference between a satellite-borne radio receiver and a ground receiver is the complex electromagnetic environment facing the space, and the single event effect is the biggest problem facing the satellite-borne receiver. The radiation sources causing the single event effect include high-energy protons in space, heavy ions, and high-energy neutrons and thermal neutrons in the atmosphere. The single space high energy charged particle hits sensitive part during micro-electronic period, and the ionization generates extra charge to make the logic state of the device change, function interfere or fail. The types of the single event effect mainly comprise single event upset, single event locking, single event burnout, single event gate breakdown and the like. The single event upset is that a single high-energy particle acts on a semiconductor device to cause the logic state of the device to change abnormally, and further cause the operation of recent software to be abnormal, which is also the most common single event effect, and the effect cannot cause the damage of the semiconductor device. Single event locking, single event burnout, single event gate breakdown can cause unrecoverable damage to hardware. Therefore, the single event upset protection performance of the device can only be improved through software protection. Because the existing satellite is increasingly complex, high-performance microelectronic devices are widely applied to a satellite system, the single event effect is seriously harmful, and when the single event effect causes logic disorder of a satellite-borne radio receiver, disastrous results can be caused.
The published chinese patent CN102567243A discloses a refresh processing method for a memory device and a memory device, and discloses a method for using multiple refreshes for a memory to keep the content of the memory correct.
The published Chinese patent CN104035828A discloses a space irradiation comprehensive protection method and a device of FPGA, and proposes various radiation-resistant protection measures, wherein the measures comprise memory timing refreshing, partial variables adopting triple modular redundancy design and design timing resetting to overcome the interference of radiation to space equipment; the patent disclosure focuses on a conceptual description of the upper level. The description of the actual design method is rather vague.
Published chinese patents CN111552500A and CN111650992A disclose specific circuit structures related to the design of triple modular redundancy. However, no specific object is described.
Human beings have been exploring space for decades, have had a deeper understanding on the single event effect, and have had various methods for its protection, mainly three methods: triple modular redundancy design, system reset, and logic refresh. Triple modular redundancy is the most common fault-tolerant design technology, three modules execute the same operation at the same time, most of the same outputs are used as the correct outputs of a voting system, and as long as two modules in the three modules do not have errors, the wrong outputs can be masked, the correct outputs of the system can be ensured, the credibility of the system can be greatly improved, but the triple modular processing of the whole system cannot be realized due to the limited resources of microelectronic devices. The system reset can solve the problem of software operation, and the normal working state of the software can be achieved by reloading the software or rewriting the software. Logic refreshing is usually a self-contained function during space-navigation-level microelectronics, and can realize refreshing of logic circuits inside a device, but cannot realize refreshing of registers.
Disclosure of Invention
In order to solve the technical problems, the invention provides a multi-means fusion-based satellite borne receiver single particle resistant method aiming at the risk of single particle overturn of a satellite borne receiver digital signal processor. The method comprehensively uses the methods of triple modular redundancy design, memory cell read-back self-refresh, EDAC (Error Detection And Correction) verification design, ICAP (Internal Configuration Access Port) refresh design, self-reset And the like, And can effectively enhance the single particle protection problem of the digital signal processor of the satellite-borne receiver.
The invention provides a multi-hand fused satellite-borne receiver anti-single particle method, wherein a digital signal processing part of the satellite-borne receiver comprises an analog-to-digital converter (ADC) sampling module, a digital down converter, an anti-interference module, a secondary quantization module, a capturing module, a tracking module, a memory and a decoding module which are sequentially connected, and an interface part of the satellite-borne receiver comprises a serial port, a 1553B interface and interfaces among chips; the method comprises the following steps
Step one, triple modular redundancy design, namely selecting a common module, each interface module and a fixed memory of a receiver to carry out triple modular redundancy processing according to the importance degree of each module to the receiver and the resource consumption required by the triple modular redundancy design of the modules;
step two, the memory cell is read back for self-refresh, when the memory cell is designed to read the current value, a plurality of related data values associated with the current read address are read through the FPGA, and then the plurality of related data values are written into the memory cell again by the original address;
step three, EDAC verification design, during data writing, generating a verification code according to the written data, storing the verification code together with corresponding data, and during data reading, reading out the verification code and judging;
step four, ICAP refreshing design, refreshing is carried out through the cooperation of the DSP and the storage chip, the executable file of the FPGA is stored in the storage chip, and the DSP continuously writes the executable file in the storage chip into the FPGA through an interface of the FPGA so as to achieve refreshing;
and step five, an automatic reset design is adopted, wherein the automatic reset time is set according to the operation period, and the single-machine non-received signal time period is selected to execute the reset of the whole machine. Further, in the first step, a common module, each interface module, and a fixed memory of the receiver are selected to perform triple modular redundancy processing.
Preferably, according to the redundancy of the receiver resource, selecting to execute triple modular redundancy processing on at least one of the secondary quantization module, the capture module, the tracking module and the decoding module; and/or performing triple modular redundancy processing on fixed memory associated with the selected module; and/or performing triple modular redundancy processing on the serial port module.
Performing tri-modular redundancy processing on all fixed memory associated with the receiver may include the steps of: s101, storing all application programs of the satellite-borne receiver in three parts, wherein the storage space of the application programs is divided into a main partition, a redundant partition 1 and a redundant partition 2; the address space of a FLASH memory accessed by the DSP chip is 32 sectors, each sector can store 64KB programs, the main programs of a user do not exceed 640KB, the first main program is sequentially cured from sector 0 to sector 9, the second main program is sequentially cured from sector 10 to sector 19, and the third main program is sequentially cured from sector 20 to sector 29;
s102, when each application program of the main partition, the redundant partition 1 and the redundant partition 2 is stored, three identical check codes are generated for the application program, and the generated check codes are written into a check code file of the application program;
s103, in the running process of the satellite-borne application program, periodically comparing and refreshing three check codes of each application program in the main partition, the redundant partition 1 or the redundant partition 2 by taking two from three; according to the scale of the current DSP user program and the integration level of the FLASH chip, three identical user main programs can be solidified in two FLASH chips, FLASH1 and FLASH2 are backups of each other, and three user main programs are solidified respectively. The monitoring program is solidified in the PROM, after the product is powered on, the monitoring program is used as a secondary starting program to complete DSP initialization, then an on-track programming register in the FPGA is read, and according to the value of the register being 0001H, a three-out-of-two loading main program is entered, and if the value of the register is F13H, an on-track programming state is entered.
Further, the second step comprises the following substeps:
when the numerical control oscillator reads the phase value of the current address, the phase value of n adjacent addresses is obtained through the FPGA, and then the read phase value of the n adjacent addresses is written into the original address of the storage unit again, wherein n is a positive number.
Further, the second step comprises the following substeps: the self-refresh read accumulator module reads an address value of current read data output by a digital signal processor, adds 1 to n numerical values to the address value, wherein n is a positive number and is less than or equal to the data bit width of a data memory, then outputs an address signal of the current read data and 1 to n-bit multi-bit address signals associated with the address signal, simultaneously reads the current read data and the data of the 1 to n-bit multi-bit addresses associated with the current read data from a storage unit through an FPGA, and writes the data into an original address position of the storage unit again.
Further, the third step includes the following substeps:
the check code is read while the data is read, the judgment is carried out,
if the data error of a few bits occurs, automatic error correction is executed, and a correct result is output;
if a plurality of bits of data errors occur, an interrupt report is generated, and the receiver carries out exception handling.
Further, in the fifth step, the signal of the ground station is received in China, and the reset of the whole machine is executed at the time outside the China.
Preferably, the whole machine resetting step comprises resetting of the FPGA and the DSP.
Furthermore, in the fourth step, circuits inside the FPGA are designed to correspond to the programming files one to one, and by analyzing data frames of the programming files, the DSP intermittently and continuously injects original data frames of the programming files into the FPGA through the ICAP interface to perform circuit refreshing inside the FPGA.
Furthermore, in the third step, the DSP is connected to an external SRAM chip through the FPGA, the FPGA performs a transfer function of data interaction between the DSP and the SRAM, and performs error detection and correction on transferred data inside the FPGA. DSP passes through FPGA and is connected with outside SRAM chip, and FPGA carries out DSP and SRAM data interaction's transfer effect, carries out error detection and correction to the data of transfer in FPGA is inside, includes the following step: s301: detecting whether the frame address of the configuration data is a frame address which does not need ECC check; if the configuration data frame address meets the shielding rule, judging that the configuration data frame address is a frame address which does not need ECC (error correction code) verification; if the configuration data frame address does not accord with the shielding rule, judging that the configuration data frame address is a frame address needing ECC (error correction code) check; step S302: if the configuration data frame address is a frame address which does not need ECC check, the configuration data frame corresponding to the configuration data frame address is not subjected to ECC check; step S303: and if the configuration data frame address is not the frame address which does not need ECC (error correction code) verification, carrying out ECC verification on the configuration data frame corresponding to the configuration data frame address to generate a non-verification mark signal. Further, a user configured masking rule is received, the masking rule includes a masking identification bit, and the number of bits of the masking identification bit is 1 bit or more.
The invention has the beneficial effects that: the method of fusing multiple means is adopted, and the capability of the satellite-borne receiver for protecting the single event effect is enhanced. The invention has good adaptability, is not only used for a satellite-borne receiver of a navigation system, but also suitable for a satellite-borne receiver of a radar and a communication system, is also suitable for a part of satellite-borne transmitters, and can enhance the protection capability of a satellite-borne radio transceiver terminal on the single event effect.
Drawings
FIG. 1 is a block diagram of multi-hand fusion anti-single particle.
Fig. 2 is an autonomous reset flow chart.
Fig. 3 is an ICAP refresh processing flow chart.
Fig. 4 EDAC verification process flow diagram.
FIG. 5 is a schematic diagram of a triple mode voter.
Detailed Description
The technical scheme of the invention adopting different technical means for solving the technical problems is as follows:
(1) and (4) triple modular redundancy design. The Digital signal processing part of the satellite-borne receiver sequentially comprises modules of ADC (Analog to Digital Converter) sampling, Digital down-conversion, anti-interference, secondary quantization, capturing, tracking, decoding and the like, and the interface part comprises a serial port, a 1553B interface and an interface among chips. Under the condition that FPGA resources allow, all modules should be subjected to three-mode processing, and the satellite-borne receiver has high reliability. However, the resource of the satellite-borne FPGA is limited, and the full three-mode processing cannot be realized. Therefore, the module should be processed in three modes according to the importance of the module and the resource consumption of the module, and the common part, the interface and the fixed memory should be processed in three modes preferentially.
(2) The memory cells are read back self-refreshed. Taking a carrier NCO (Numerically Controlled oscillator) in a digital signal processor of a satellite-borne receiver as an example, a phase and an amplitude of a sine wave of a predetermined period are sampled in advance and stored in the digital signal processor. During self-refreshing, the phase value and the amplitude of the sine wave stored by different storage addresses are obtained by reading the different storage addresses of the digital signal processor, only one phase value and one amplitude are taken in one clock cycle, the condition that a plurality of values are taken at one time does not exist, and the next address is predictable under the condition that the current address is known. The method may be applied to other stored contents, such as a local storage code, and the like.
(3) The EDAC verifies the design. The digital signal processor of the satellite-borne receiver is usually completed by an FPGA and a DSP together. According to the error detection and correction principle, a check code is generated according to written data and stored together with corresponding data when the data are written, and the check code is read out and judged when the data are read. If a few bits of data errors occur, automatic error correction can be carried out, correct results are output, if a plurality of bits of data errors occur, an interrupt report is generated, and the receiver carries out exception handling. Through the design of EDAC verification, the anti-interference capability of the system can be improved, and the reliability of the system is improved.
(4) ICAP refresh design. ICAP refreshing is the function of the Xilinx company under the flag of FPGA, refreshing is carried out through the cooperation of the DSP and the storage chip, the executable file of the FPGA is stored in the storage chip, and the DSP continuously writes the executable file in the storage chip into the FPGA through an interface of the FPGA so as to achieve the refreshing purpose. And the interface of the FPGA has a self-checking function, and if the interface is found to have single event upset, the interface can not be refreshed, and the problem can be solved only by carrying out resetting of the whole machine by selecting the machine. ICAP refreshing has a good effect on improving the single-particle protection capability of the internal logic circuit of the microelectronic device.
(5) And (4) designing the self-reset. The reset of the FPGA is an important method for solving the influence of the single event effect, but the signal interruption can be caused in the reset process. Taking the uplink receiving single machine of the space section of the Beidou satellite navigation system as an example, the single machine only needs to normally receive signals of a ground station in China, and does not need to receive signals abroad, so that the reset of the whole machine (including the reset of an FPGA and a DSP) can be carried out by using the time abroad, and the effect of preventing the single event effect can be achieved. Since the period of the satellite's movement around the earth is fixed, the time for autonomous reset can be set according to the movement period.
The following detailed description of embodiments of the invention refers to the accompanying drawings.
In order to make the objects, technical solutions and advantages of the present invention more clearly apparent, the present invention is further described with reference to the accompanying drawings.
FIG. 1 is a system block diagram of the present invention. As shown, the method comprises the following steps:
the first step is as follows: the design of the autonomous reset thoroughly solves the influence caused by the single event effect from the top layer, and the time and the period of the autonomous reset are determined according to the actual condition of the satellite-borne receiver. In a satellite stand-alone, the receiving terminal receives signals only in a limited time every day, so that the DSP can initiate the autonomous reset of the stand-alone under the condition of not receiving signals, and the reset flow is shown in FIG. 2. After the software loading/initialization is finished, whether a signal is received or not is judged, if the signal is received, signal service processing is carried out, the signal is continuously received after the processing is finished, if the signal is not received, the counter counts down when counting is carried out, if the time reaches a time threshold value, the DSP whole machine is reset, and the signal is received again after the resetting is finished.
The second step is that: the ICAP refresh design solves the problem of single particle protection of logic circuits from the perspective of microelectronic devices. The circuits in the FPGA correspond to the programming files one by one, and the DSP injects the original data frames of the programming files into the FPGA through the ICAP interface intermittently and ceaselessly by analyzing the data frames of the programming files, so that the problem of refreshing the circuits in the FPGA is solved, and the processing flow is shown in FIG. 3.
The third step: the EDAC verification design mainly solves the problem of single particle protection when a DSP program runs outside a chip. The DSP is connected with an external SRAM chip through the FPGA, the FPGA plays a role in transferring data interaction between the DSP and the SRAM, error detection and correction are carried out on transferred data inside the FPGA, and the processing flow is shown in FIG. 4. The error detection and correction of data in the FPGA specifically can adopt the following steps: s301: it is detected whether the configuration data frame address is a frame address that does not require ECC checking. In some possible implementations, frame addresses that do not require ECC checking may be detected by configuring whether the data frame addresses comply with the masking rules. Specifically, the step S301 may include: detecting whether the address of the configuration data frame meets a shielding rule; if the configuration data frame address meets the shielding rule, judging that the configuration data frame address is a frame address which does not need ECC (error correction code) verification; and if the configuration data frame address does not accord with the shielding rule, judging that the configuration data frame address is the frame address needing ECC check. Step S302: and if the configuration data frame address is a frame address which does not need ECC (error correction code) verification, not performing ECC verification on the configuration data frame corresponding to the configuration data frame address. Step S303: and if the configuration data frame address is not the frame address which does not need ECC check, performing ECC check on the configuration data frame corresponding to the configuration data frame address. In the SEU error correction process, a user can configure a frame address which does not need ECC check, for example, a frame address which is easy to generate false alarm can be configured as a frame address which does not need ECC check, and for the frame address which does not need to check, data read-back and ECC check are not performed, so that the flexibility of ECC check is increased, and data false alarm possibly caused by noise is avoided. Wherein the masking rule in S301 can be configured by the user, for example, the masking rule configured by the user is received, the masking rule includes a masking identification bit, and the number of bits of the masking identification bit is 1 bit or more. The user can set 1-bit or multi-bit shielding identification position by himself, and the situation that a single shielding identification position is interfered and fails to work, so that a judgment error situation is caused is avoided. The shielding identification bits can be adjacent to each other or separated from each other in physical positions, and the separation scheme can reduce the probability of multi-bit error of the shielding identification bits and improve the reliability. The mask identification bits can be letters, numbers, special symbols or other forms, and when the number of bits of the mask identification bits is greater than 1 bit, the plurality of mask identification bits can be continuous or discontinuous. The mask flag is, for example, a, and the configuration data frame corresponding to the configuration data frame address is not checked as long as a appears in the configuration data frame address; the mask identification bit is, for example, abc, and the abc continuously appears, and if the continuous abc appears in the configuration data frame address, the configuration data frame corresponding to the configuration data frame address is not checked; the mask flag is, for example, abc that does not limit whether the mask flag is continuous or not and does not limit the occurrence order, and if a, b, and c occur in the configuration data frame address, the configuration data frame corresponding to the configuration data frame address is not checked.
The fourth step: the triple-modular redundancy and memory cell read-back self-refresh design improves the reliability of software operation from the aspect of software coding, and needs to be designed by overall consideration according to the actual functions of the satellite-borne receiver and the resource conditions of the microelectronic devices, and the schematic diagram of the triple-modular voter is shown in fig. 5.
The triple modular redundancy design is designed by adopting an FPGA (field programmable gate array) to design three identical circuit modules U0, U1 and U2 aiming at one functional block of a digital circuit, the circuit functions of all the modules are completely identical, and when the same signal is input and is not interfered by external single particles, all the modules should output the same signal. The output of the individual module is abnormal due to the single event interference, and the output of the rest modules still generates normal output signals due to the undisturbed output, so that the voter inevitably discards abnormal signals according to the majority validity principle, and the output of the voter still generates normal output signals. But this redundant design consumes more than three times as many circuit cells as it did. It is not economical to use triple modular redundancy design in the entire digital circuit portion. Generally, the three-mode processing is preferentially performed on the common circuit part, the circuit interface part and the fixed memory according to the comprehensive balance of the importance degree of each module of the digital circuit part and the total resource amount of the modules. When the program in the satellite-borne receiver is executed, the method can comprise the following steps: s101, storing all application programs of the satellite-borne receiver in three parts, wherein the storage space of the application programs is divided into a main partition, a redundant partition 1 and a redundant partition 2; the address space of a memory FLASH accessed by the DSP chip is 32 sectors, each sector can store 64KB programs, the main program of a user does not exceed 640KB, the first main program is sequentially cured from sector 0 to sector 9, the second main program is sequentially cured from sector 10 to sector 19, and the third main program is sequentially cured from sector 20 to sector 29.
S102, when each application program of the main partition, the redundant partition 1 and the redundant partition 2 is stored, three identical check codes are generated for the application program, and the generated check codes are written into a check code file of the application program;
s103, in the running process of the satellite-borne application program, periodically comparing and refreshing three check codes of each application program in the main partition, the redundant partition 1 or the redundant partition 2 by taking two from three; according to the scale of the current DSP user program and the integration level of the FLASH chip, three identical user main programs can be solidified in two FLASH chips, FLASH1 and FLASH2 are backups of each other, and three user main programs are solidified respectively. And solidifying the monitoring program in the PROM, taking the monitoring program as a secondary starting program to finish DSP initialization after the product is electrified, reading an on-track programming register PROG _ REG in the FPGA, and entering a three-out-of-two loading main program according to the value of the register being 0001H, or entering an on-track programming state if the value of the register is F13H. The probability of single event upset occurring at the same time at the same offset address of the three user programs is extremely low. By switching the two FLASH chips, lower single event upset failure rate can be obtained. And in the extreme case of single event upset, the on-track programming is supported, the ground injection program can be received through the FPGA, the new program is simultaneously written into the two FLASH chips, and the triple modular redundancy is realized, so that the single event upset resistance of the DSP secondary startup is greatly improved.
Then, according to the sequence of the main partition, the redundant partition 1 and the redundant partition 2, if the check code of the application program in the main partition, the redundant partition 1 or the redundant partition 2 is correct, starting the application program of the corresponding partition; and if the check codes of the main partition, the redundant partition 1 and the redundant partition 2 are not consistent with the check codes of the corresponding application programs, taking out a correct application program from 3 application programs in the main partition, the redundant partition 1 and the redundant partition 2 for execution.
The common circuit of the digital signal processing part of the satellite-borne receiver comprises modules of digital down-conversion, anti-interference, secondary quantization, capturing, tracking, decoding and the like, and at least the secondary quantization, capturing, tracking and decoding module parts are provided with memories directly connected with functional modules, and the interface part of the satellite-borne receiver comprises a serial port, a 1553B interface and interfaces among chips. In general, the satellite-borne equipment can provide a receiver circuit with limited volume, the allowed power consumption of elements on a chip is limited, and therefore, the triple-modular redundancy processing of all modules is difficult to bear.
The digital signal processing part of the satellite-borne receiver sequentially comprises modules of an analog-to-digital converter (ADC) for sampling, digital down-conversion, anti-interference, secondary quantization, capturing, tracking, decoding and the like, and the interface part comprises a serial port, a 1553B interface and interfaces among chips. And the full three-mode processing can not be realized due to the limitation of FPGA resources. Therefore, the module should be processed in three modes according to the importance of the module and the resource consumption of the module, and the common part, the interface and the fixed memory should be processed in three modes preferentially. In the invention, the applicant determines that only one of the secondary quantization module, the capture module, the tracking module and the decoding module is subjected to triple modular redundancy processing by analyzing the influence degree, the reality and the test result of each circuit module on the received signal, and the anti-interference requirement of the satellite-borne receiver can be better met. With the continuous progress of chip technology, resources on the FPGA chip with the same size and power consumption are increased day by day, so that a designer is provided with greater design flexibility, under the condition of resource quantity permission, the fixed memory directly related to the secondary quantization module, the capture module, the tracking module and the decoding module is continuously subjected to triple-modular redundancy processing, and meanwhile, triple-modular redundancy processing is performed on a serial port part, so that the performance of resisting single-particle interference is further improved.
The memory cell read-back self-refresh design of the invention is to design a self-refresh read accumulator module aiming at each memory module, and the self-refresh read accumulator module reads in the address value of the current read data output by a digital signal processor. Simultaneously reading the current numberAccording to the address value addrcrAdding value i as associated address start value addrcor =addrcrAnd + i, i is a random number generated by a random generator or a certain number which is sequentially increased, for example, the initial value of i is 1, i is automatically added with 1 every time i is refreshed, and when i is larger than the certain number, i is reset to 1. And taking k addresses beginning from the initial value of the associated address, wherein k is more than or equal to 1. And modulo the k associated addresses with the maximum address of the digital signal processor memory: addrk1=(addrk) mod Addrmax，addrk1Indicating the associated address, addr, after modulokIndicating the associated address before modulo, addrk =addrcor +j，j=0...k-1，AddrmaxIndicating the maximum address of the DSP memory if addr is associated with the addressk <Maximum storage address Addr of data memorymaxThe modulo address is not changed, i.e. addrk1=addrkIf address addr is associatedk>Maximum storage address Addr of data memorymaxIf the address after modulus is the maximum address of the associated address-memory, addrk1=addrk - Addrmax. Then outputs the current address value addrcrStored data and k addresses addr associated with the current addressk1The stored k data are read from the storage unit through the FPGA simultaneously, the current read data and the data stored by the k addresses associated with the current read data are written into the original address position of the storage unit again, namely the current address value addr is written intocrAnd k addresses addr associated with the current addressk1. And realizing the memory cell read-back self-refreshing. The data of the plurality of addresses associated with the current read data is also generated from the accumulator module in a plurality of ways, such as using a predictable next address of the current address as an address output of the read-back signal; the method may be applied to other stored contents, such as a local storage code, and the like.
The satellite-borne receiver processed by the method can effectively overcome single-particle interference in a ground simulation test. The error rate is lower than the ministry standard.
Finally, it should be noted that the above embodiments are only used for illustrating the technical solutions of the embodiments of the present invention and not for limiting, and although the embodiments of the present invention are described in detail with reference to the above preferred embodiments, it should be understood by those skilled in the art that modifications or equivalent substitutions can be made on the technical solutions of the embodiments of the present invention without departing from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. A multi-hand fusion satellite-borne receiver anti-single particle method is disclosed, wherein a digital signal processing part of the satellite-borne receiver comprises an analog-to-digital converter (ADC) sampling module, a digital down converter, an anti-interference module, a secondary quantization module, a capture module, a tracking module, a memory and a decoding module which are sequentially connected, and an interface part of the satellite-borne receiver comprises a serial port, a 1553B interface and interfaces among chips; characterized in that the method comprises the following steps
Step one, triple modular redundancy design, namely selecting a common module, each interface module and a fixed memory of a receiver to carry out triple modular redundancy processing according to the importance degree of each module to the receiver and the resource consumption required by the triple modular redundancy design of the modules;
step two, the memory cell is read back for self-refresh, when the memory cell is designed to read the current value, a plurality of related data values associated with the current read address are read through the FPGA, and then the plurality of related data values are written into the memory cell again by the original address;
step three, EDAC verification design, during data writing, generating a verification code according to the written data, storing the verification code together with corresponding data, and during data reading, reading out the verification code and judging;
step four, ICAP refreshing design, refreshing is carried out through the cooperation of the DSP and the storage chip, the executable file of the FPGA is stored in the storage chip, and the DSP continuously writes the executable file in the storage chip into the FPGA through an interface of the FPGA so as to achieve refreshing;
and step five, an automatic reset design is adopted, wherein the automatic reset time is set according to the operation period, and the single-machine non-received signal time period is selected to execute the reset of the whole machine.
2. The single event immunity method of the satellite-borne receiver according to claim 1, wherein in the first step, according to the redundancy of the receiver resource, at least one of the secondary quantization module, the capture module, the tracking module and the decoding module is selected to execute triple modular redundancy processing; and/or performing triple modular redundancy processing on fixed memory associated with the selected module; and/or performing triple modular redundancy processing on the serial port module.
3. The single particle immunity method of the satellite-borne receiver according to claim 2, characterized in that: performing triple modular redundancy processing on all fixed memories associated with the receiver, wherein the execution of the program in the satellite-borne receiver may comprise the steps of: s101, storing all application programs of the satellite-borne receiver in three parts, wherein the storage space of the application programs is divided into a main partition, a redundant partition 1 and a redundant partition 2; the address space of a FLASH memory accessed by the DSP chip is 32 sectors, each sector can store 64KB programs, the main programs of a user do not exceed 640KB, the first main program is sequentially cured from sector 0 to sector 9, the second main program is sequentially cured from sector 10 to sector 19, and the third main program is sequentially cured from sector 20 to sector 29;
s102, when each application program of the main partition, the redundant partition 1 and the redundant partition 2 is stored, three identical check codes are generated for the application program, and the generated check codes are written into a check code file of the application program;
s103, in the running process of the satellite-borne application program, periodically comparing and refreshing three check codes of each application program in the main partition, the redundant partition 1 or the redundant partition 2 by taking two from three; according to the scale of the current DSP user program and the integration level of the FLASH chip, three identical user main programs can be solidified in two FLASH chips, FLASH1 and FLASH2 are backups of each other, and three user main programs are solidified; the monitoring program is solidified in the PROM, after the product is powered on, the monitoring program is used as a secondary starting program to complete DSP initialization, then an on-track programming register in the FPGA is read, and according to the value of the register being 0001H, a three-out-of-two loading main program is entered, and if the value of the register is F13H, an on-track programming state is entered.
4. The single event immunity method of the satellite-borne receiver according to claim 1, characterized in that the second step comprises the following substeps:
when the numerical control oscillator reads the phase value and the amplitude of the current address, the phase value and the amplitude of the k associated addresses are obtained through the FPGA, then the phase value and the amplitude of the current address and the k associated addresses are written into the original address of the storage unit again, and k is larger than or equal to 0.
5. The single event immunity method of the satellite-borne receiver according to claim 1, characterized in that the second step comprises the following substeps: comprises a self-refresh read accumulator module which reads in the address value of the current read data output by the digital signal processor and simultaneously reads the address value addr of the current read datacrAdding value i as associated address start value addrcor =addrcrAnd + i, i is a random number generated by a random generator or a certain number which is sequentially increased, for example, the initial value of i is 1, i is automatically added with 1 every time i is refreshed, i is reset to 1 after i is more than a certain number, k addresses starting from the initial value of the associated address are taken, k is more than or equal to 1, and the k associated addresses are modulo the maximum address of the memory of the digital signal processor: addrk1=(addrk) mod Addrmax，addrk1Indicating the associated address, addr, after modulokIndicating the associated address before modulo, addrk=addrcor +j，j=0...k-1，AddrmaxIndicating the maximum address of the DSP memory if addr is associated with the addressk<Maximum storage address Addr of data memorymaxThe modulo address is not changed, i.e. addrk1=addrkIf address addr is associatedk>Maximum storage address Addr of data memorymaxThen the address after modulus isAssociative address-maximum address of memory, addrk1=addrk - AddrmaxThen outputs the current address value addrcrStored data and k addresses addr associated with the current addressk1The stored k data are read from the storage unit through the FPGA simultaneously, the current read data and the data stored by the k addresses associated with the current read data are written into the original address position of the storage unit again, namely the current address value addr is written intocrAnd k addresses addr associated with the current addressk1And realizing the read-back self-refreshing of the storage unit.
6. The anti-single particle method of the satellite-borne receiver according to claim 1, wherein the third step comprises the following sub-steps:
the check code is read while the data is read, the judgment is carried out,
if the data error of a few bits occurs, automatic error correction is executed, and a correct result is output;
if a plurality of bits of data errors occur, an interrupt report is generated, and the receiver carries out exception handling.
7. The single particle resisting method of the satellite-borne receiver according to claim 1, wherein in the fifth step, a signal of a ground station is received in China, and the reset of the whole satellite receiver is executed in the time outside the China, wherein the reset step of the whole satellite receiver comprises the reset of an FPGA and a DSP.
8. The single particle resisting method of the satellite-borne receiver according to claim 1, wherein in the fourth step, circuits inside the FPGA are designed to correspond to the programming files one by one, and by analyzing data frames of the programming files, the DSP intermittently injects original data frames of the programming files into the FPGA through an ICAP interface, and performs refreshing of the circuits inside the FPGA.
9. The single particle resisting method of the satellite-borne receiver according to claim 1, wherein in the third step, the DSP is connected with an external SRAM chip through the FPGA, the FPGA performs a transfer function of data interaction between the DSP and the SRAM, and performs error detection and correction on transferred data inside the FPGA, comprising the steps of: s301: detecting whether the frame address of the configuration data is a frame address which does not need ECC check; if the configuration data frame address meets the shielding rule, judging that the configuration data frame address is a frame address which does not need ECC (error correction code) verification; if the configuration data frame address does not accord with the shielding rule, judging that the configuration data frame address is a frame address needing ECC (error correction code) check; step S302: if the configuration data frame address is a frame address which does not need ECC check, the configuration data frame corresponding to the configuration data frame address is not subjected to ECC check; step S303: and if the configuration data frame address is not the frame address which does not need ECC check, performing ECC check on the configuration data frame corresponding to the configuration data frame address to generate a non-check mark signal.
10. The single particle immunity method of the satellite-borne receiver according to claim 9, characterized in that: the method comprises the steps of receiving a shielding rule configured by a user, wherein the shielding rule comprises shielding identification bits, and the number of bits of the shielding identification bits is 1 bit or more.
CN202011136332.4A 2020-10-22 2020-10-22 Multi-hand fusion satellite-borne receiver single particle resistance method Active CN112015584B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202011136332.4A CN112015584B (en) 2020-10-22 2020-10-22 Multi-hand fusion satellite-borne receiver single particle resistance method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202011136332.4A CN112015584B (en) 2020-10-22 2020-10-22 Multi-hand fusion satellite-borne receiver single particle resistance method

Publications (2)

Publication Number Publication Date
CN112015584A true CN112015584A (en) 2020-12-01
CN112015584B CN112015584B (en) 2021-01-15

Family

ID=73528016

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202011136332.4A Active CN112015584B (en) 2020-10-22 2020-10-22 Multi-hand fusion satellite-borne receiver single particle resistance method

Country Status (1)

Country Link
CN (1) CN112015584B (en)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113031032A (en) * 2021-05-24 2021-06-25 中国人民解放军国防科技大学 Zero-value signal self-closed loop processing method of satellite navigation equipment
CN113254252A (en) * 2021-07-01 2021-08-13 中国人民解放军国防科技大学 Satellite load FPGA with BRAM and use method thereof
CN113254288A (en) * 2021-06-02 2021-08-13 中国人民解放军国防科技大学 FPGA single event upset fault injection method in satellite-borne equipment
CN113326163A (en) * 2021-08-02 2021-08-31 中国人民解放军国防科技大学 Multi-level data fusion method and system based on maximum ratio combination
CN115379020A (en) * 2022-08-08 2022-11-22 南京信息工程大学 Embedded-based multi-machine communication protocol design method

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109491821A (en) * 2018-11-06 2019-03-19 上海航天计算机技术研究所 Primary particle inversion resistant hardened system and method
CN111190772A (en) * 2020-01-02 2020-05-22 上海航天测控通信研究所 DSP secondary starting system and method for resisting space single event upset

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109491821A (en) * 2018-11-06 2019-03-19 上海航天计算机技术研究所 Primary particle inversion resistant hardened system and method
CN111190772A (en) * 2020-01-02 2020-05-22 上海航天测控通信研究所 DSP secondary starting system and method for resisting space single event upset

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
丁朋程: "基于SRAM型FPGA的抗单粒子效应容错技术的研究", 《中国优秀硕士学位论文全文数据库》 *

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113031032A (en) * 2021-05-24 2021-06-25 中国人民解放军国防科技大学 Zero-value signal self-closed loop processing method of satellite navigation equipment
CN113254288A (en) * 2021-06-02 2021-08-13 中国人民解放军国防科技大学 FPGA single event upset fault injection method in satellite-borne equipment
CN113254288B (en) * 2021-06-02 2021-09-21 中国人民解放军国防科技大学 FPGA single event upset fault injection method in satellite-borne equipment
CN113254252A (en) * 2021-07-01 2021-08-13 中国人民解放军国防科技大学 Satellite load FPGA with BRAM and use method thereof
CN113326163A (en) * 2021-08-02 2021-08-31 中国人民解放军国防科技大学 Multi-level data fusion method and system based on maximum ratio combination
CN115379020A (en) * 2022-08-08 2022-11-22 南京信息工程大学 Embedded-based multi-machine communication protocol design method
CN115379020B (en) * 2022-08-08 2023-06-09 南京信息工程大学 Embedded multi-machine communication protocol design method

Also Published As

Publication number Publication date
CN112015584B (en) 2021-01-15

Similar Documents

Publication Publication Date Title
CN112015584B (en) Multi-hand fusion satellite-borne receiver single particle resistance method
Stoddard et al. A hybrid approach to FPGA configuration scrubbing
KR102658847B1 (en) High data integrity processing system
CN103971732A (en) Method and system for monitoring single event upset effect of FPGA (field programmable gate array) and correcting reloading
CN111338840B (en) Space data protection method, storage medium, computer program, system and terminal
US20070094569A1 (en) Determining hard errors vs. soft errors in memory
US11586496B2 (en) Electronic circuit with integrated SEU monitor
Chen et al. Design of SRAM-based low-cost SEU monitor for self-adaptive multiprocessing systems
KR101667400B1 (en) Apparatus and method for generating and detecting single event upset
CN113608720B (en) Single event upset resistant satellite-borne data processing system and method
Nazar et al. Accelerated FPGA repair through shifted scrubbing
Sharma et al. An HVD based error detection and correction of soft errors in semiconductor memories used for space applications
Yang et al. Reliability analysis of ensemble fault tolerance for soft error mitigation against complex radiation effect
Lanuzza et al. A self-hosting configuration management system to mitigate the impact of Radiation-Induced Multi-Bit Upsets in SRAM-based FPGAs
CN111597073B (en) FPGA single event upset error correction method and circuit
CN113254252B (en) Satellite load FPGA with BRAM and use method thereof
CN104866387A (en) Storage method and system based on stored data anti-jamming of ERC32 processor
Bridgford et al. Correcting single-event upsets in virtex-ii platform fpga configuration memory
Bentoutou Program memories error detection and correction on-board earth observation satellites
He et al. SEU readback interval strategy of SRAM-based FPGA for space application
CN211124024U (en) Radiation-resistant reinforced memory
Vera et al. Fast local scrubbing for field-programmable gate array's configuration memory
Reviriego et al. Reliability analysis of memories protected with BICS and a per-word parity bit
Martin-Ortega et al. Radiation hardening of FPGA-based SoCs through self-reconfiguration and XTMR techniques
Arbat et al. Non volatile memory for FPGA booting in space

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant