CN117573426A - Three-module redundant computer fault autonomous recovery strategy verification method - Google Patents
Three-module redundant computer fault autonomous recovery strategy verification method Download PDFInfo
- Publication number
- CN117573426A CN117573426A CN202311403419.7A CN202311403419A CN117573426A CN 117573426 A CN117573426 A CN 117573426A CN 202311403419 A CN202311403419 A CN 202311403419A CN 117573426 A CN117573426 A CN 117573426A
- Authority
- CN
- China
- Prior art keywords
- machine
- computer
- fault
- autonomous
- duty
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000011084 recovery Methods 0.000 title claims abstract description 76
- 238000012795 verification Methods 0.000 title claims abstract description 43
- 238000000034 method Methods 0.000 title claims abstract description 23
- 230000005764 inhibitory process Effects 0.000 claims description 7
- 238000010200 validation analysis Methods 0.000 claims description 3
- 238000004088 simulation Methods 0.000 claims description 2
- 238000012360 testing method Methods 0.000 abstract description 24
- 230000006870 function Effects 0.000 description 11
- 238000013461 design Methods 0.000 description 6
- 238000011161 development Methods 0.000 description 5
- 238000005516 engineering process Methods 0.000 description 3
- 230000003993 interaction Effects 0.000 description 3
- 210000004556 brain Anatomy 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 238000002347 injection Methods 0.000 description 2
- 239000007924 injection Substances 0.000 description 2
- 230000001960 triggered effect Effects 0.000 description 2
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000002401 inhibitory effect Effects 0.000 description 1
- 230000015654 memory Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/14—Error detection or correction of the data by redundancy in operation
- G06F11/1402—Saving, restoring, recovering or retrying
- G06F11/1415—Saving, restoring, recovering or retrying at system level
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/16—Error detection or correction of the data by redundancy in hardware
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Hardware Redundancy (AREA)
Abstract
The invention provides a failure autonomous recovery strategy verification method of a triple-modular redundant computer, which sequentially completes test verification on three contents of a failure working condition of an airliner, a failure working condition of a non-duty machine and a failure autonomous reconstruction/prohibition function by skillfully designing test cases and test sequences, and the satellite-borne computer is restored to an initial working state after the test is finished, so that the designed strategy can be comprehensively verified in one-time test of an aircraft system level, and the verification method is simple to implement, safe and reliable and strong in operability.
Description
Technical Field
The invention belongs to the technical field of computer design, and relates to a method for verifying an autonomous recovery strategy of a triple modular redundancy computer fault.
Background
As a brain for spacecraft operation management, a space-borne computer mostly adopts a multimode redundancy design method to improve the reliability. The triple modular redundancy (Triple Modular Redundancy, TMR) technology is a common redundancy design technology, that is, three identical CPU modules are adopted to simultaneously receive external signals, and three modules (three machines) keep the three machines to run at the same beat through precise time synchronization. However, only one on-duty machine is responsible for externally completing the data interaction function, the other two CPU modules are in a hot standby working state, and the system control right is taken over according to a pre-designed voting strategy under the condition that the on-duty machine fails. Because the possibility of simultaneously making mistakes in two of the three machines is extremely low, the triple-modular redundancy technology can effectively eliminate single-point faults and is widely applied to fault-tolerant designs of the on-board computer system.
In a triple modular redundant computer system, data interaction is performed among three machines through a high-speed serial port. When faults such as synchronization failure occur among three machines, the on-duty machine is considered to have faults, and the satellite-borne computer is reduced to double-machine operation; and automatically completing the reconstruction recovery of the fault machine in the idle time of the running of the computer software, so that the state of the fault machine is recovered to be normal again.
The three-machine asynchronous fault working conditions of the spaceborne computer are various, the three-machine synchronous interaction parameters are likely to trigger faults, and the fault autonomous recovery strategy is specifically realized depending on the spaceborne computer, so that the fault mode is very complex and the verification is difficult under the condition that the real fault occurs. In the equipment development stage, a development party can simulate faults through software in a fault injection mode, simulate all fault modes causing three-machine faults and perform strategy verification. After the equipment is delivered and participates in the spacecraft system level test, since the spaceborne computer is the brain of the whole spacecraft, the safety of the system is considered for all test modes of the spaceborne computer, other systems cannot be caused to generate unexpected faults, and if the verification mode of the equipment development stage is used, the problems of complex operation and easy software error are existed, and the safety risk is possibly caused for the whole spacecraft.
Therefore, aiming at the problems that the failure autonomous recovery strategy of the triple-modular redundancy computer has a plurality of failure modes, failure cannot be truly simulated, verification difficulty is high and the like, how to reasonably design the test case strategy to effectively verify is a problem to be solved in actual development of the satellite-borne computer.
Disclosure of Invention
The purpose of the application is to provide a verification method for the failure autonomous recovery strategy of the triple-modular redundant computer, which can realize comprehensive verification of the failure autonomous recovery strategy of the triple-modular computer under the minimum system cost by reasonably designing a test case strategy.
The technical scheme for realizing the invention is as follows:
a failure autonomous recovery strategy verification method of a triple-modular redundancy computer comprises the following steps:
and (3) verifying an autonomous recovery strategy of the computer under the working condition of the flight failure: the method comprises the steps that an on-duty power-off simulation on-duty failure is carried out, a computer with a normal switching state is switched to be the on-duty based on an autonomous recovery strategy, the failure machine is powered on to be restored, and if the failure machine is restored, a three-machine hot standby working state is re-entered;
when each spaceborne computer is used as the spaceborne computer under the fault working condition of the non-shift aircraft after the shift aircraft passes the strategy verification, the autonomous recovery strategy verification of the spaceborne computer is carried out;
and verifying an autonomous recovery strategy of the satellite-borne computer under the fault condition of the off-duty machine: the method comprises the steps that an instruction is sent to simulate a fault when the off-duty machine is disconnected, a satellite-borne computer with a normal state is switched on based on an autonomous recovery strategy, the fault machine is powered on and recovered, and if the off-duty machine is recovered to be normal, the system is recovered to be in a three-stage hot standby working state;
when each non-duty machine passes the strategy verification, the three machines restore the hot standby working state and enter the fault autonomous reconfiguration/inhibition function verification;
the fault autonomous reconfiguration/inhibition function verification: transmitting an automatic reconfiguration prohibition instruction of the three-machine fault, transmitting a shift-on power-off instruction to simulate the shift-on fault, and switching a normal satellite-borne computer based on an automatic recovery strategy to be the shift-on machine, wherein the system satellite-borne computer degrades the double-machine hot standby working state;
and finishing the verification of the autonomous recovery strategy.
Further, in the invention, when the fault autonomous recovery strategy is verified, the initial state of the triple-modular redundancy computer is as follows: the satellite-borne computer is powered on and is in a three-machine hot standby working state by default, the A machine is on duty, the B machine and the C machine are not on duty, but are consistent with the three-machine state, and the three-machine computer is in a fault autonomous reconstruction enabling state.
Further, the invention enters into the system state recovery after completing the verification of the autonomous recovery strategy:
(1) sending a three-machine fault autonomous reconfiguration enabling instruction, and according to a fault autonomous reconfiguration recovery strategy, enabling a computer in a normal state to power on a fault machine autonomously and recover the fault, and recovering the system to a three-machine hot standby working state after the fault machine is recovered to a normal state;
(2) and sending a three-machine reset instruction, and recovering the satellite-borne computer to an initial working state of the A-machine on duty and the three-machine hot standby work.
Further, the autonomous recovery strategy of the present invention is:
when the on-duty machine fails, the computer with normal switching state is on-duty machine, when the on-duty machine is powered on to recover the failed machine, if the recovery is successful, the three-machine hot standby working mode is entered, otherwise, the two-machine hot standby mode is dropped;
when the non-working machine fails, the working machine is powered on to recover when the working machine fails, if the recovery is successful, the working machine enters a three-machine hot backup working mode, and otherwise, the working machine is reduced to a two-machine hot backup mode.
Further, the triple modular redundancy computer of the present invention is defined as computer a, computer B and computer C, and the shift right when the flight is cyclically handed over in the order of computer a, computer B, computer C and then to computer a.
Further, in the autonomous recovery strategy of the present invention, the power-on reconstruction recovery of the failed machine is performed by the on-duty machine.
The beneficial effects are that:
firstly, the invention sequentially completes test verification of three contents of the failure working condition of the airliner, the failure working condition of the non-duty machine and the autonomous reconfiguration/inhibition function of the failure by skillfully designing the test cases and the test sequences, and the spaceborne computer is restored to the initial working state after the test is finished, thereby realizing the comprehensive verification of the designed strategy in one-time test of the spacecraft system level, the verification method is simple to implement, safe and reliable, has strong operability,
secondly, by simulating faults such as three-machine synchronization failure and the like on the tested computer in a power-off mode, the satellite-borne computer is triggered to implement the fault autonomous reconstruction and recovery function, the designed strategy can be comprehensively verified in the aircraft system level primary test under the minimum system cost, and a good application effect is achieved.
Thirdly, the invention triggers the satellite-borne computer to implement the functions of autonomous fault reconstruction and recovery by simulating faults such as three-machine synchronization failure and the like on the tested power failure, so as to realize test and verification of design strategies, effectively solve the problems of multiple fault modes, incapability of truly simulating faults, high verification implementation difficulty and the like in the verification of the autonomous fault recovery strategies of the three-mode redundant computer, and realize the comprehensive verification of the autonomous fault recovery strategies of the three-mode computer at the minimum system cost.
Drawings
FIG. 1 is a three-mode computer system architecture;
FIG. 2 is a three-mode computer failure autonomous recovery strategy;
FIG. 3 is a three-mode computer failure autonomous recovery policy validation flow.
Detailed Description
The present invention will be described in detail with reference to the accompanying drawings and detailed description.
As shown in fig. 1, in the system architecture of the triple-modular redundant spaceborne computer suitable for the embodiment, the computer includes three modules, namely a CPU module A, CPU module B and a CPU module C, each module uses a CPU as a core, and forms a minimum computer system with peripheral FPGAs, memories, 1553B bus communication interfaces and the like. The FPGA among the three modules is connected through a high-speed serial bus to realize three-machine data exchange and state synchronization; internal bus communication is realized through a 1553B interface and is connected with an external 1553B bus.
As shown in fig. 2, the fault autonomous recovery strategy of the current triple-modular redundant spaceborne computer in this embodiment is:
the satellite-borne computer works in a three-machine hot standby state by default, and in normal working, the three machines all receive external input signals, and the CPU module A is used for working and outputting data. The failure autonomous recovery strategy of the spaceborne computer is as follows:
1) When a certain CPU module fails, the normal on-duty CPU module (on-duty machine) cuts off the power of the failed module (on-duty machine), so that the system is degraded into a double-machine hot standby working mode, and when the on-duty right of the airliner is handed over according to the sequence value ring of A, B, C, A;
2) When the airliner powers on the fault machine, the fault machine sends a fault reconstruction recovery request to the on-duty machine;
3) When the airliners recognize the reconstruction request of the fault machine, key data of the normal machine are sent to the fault machine through a high-speed serial port to restore the data;
4) If the fault reconstruction and recovery of the fault machine are successful, the satellite-borne computer reenters a three-machine hot standby working mode;
5) If the fault reconstruction is still unsuccessful after repeated k times (generally taken 3 times), the fault machine is powered off by the on-duty machine, and the satellite-borne computer is permanently degraded into a double-machine hot standby working mode.
The autonomous recovery strategy of the faults of the spaceborne computer can be triggered only under the fault conditions of three-machine synchronization failure and the like, and the strategy verification can be carried out through software simulation faults in a fault injection mode in the equipment development stage, but during the spacecraft system level test, if the test is carried out through the software simulation fault mode, the problems of complex operation and easy software error are caused, and the safety risk can be caused to the whole spacecraft.
As shown in fig. 3, in the method for verifying the fault autonomous recovery strategy in this embodiment, a mode of powering off a tested CPU module to simulate faults such as synchronization failure of three machines is adopted to trigger a satellite-borne computer to perform fault autonomous recovery, test verification on three contents of an airliner fault condition, a non-shift machine fault condition and a fault autonomous recovery/prohibition function is sequentially completed by skillfully designing a test case and a test sequence, the satellite-borne computer is restored to an initial working state after the test is finished, and the purpose that the designed strategy can be comprehensively verified in one-time test of an aerospace vehicle system level is achieved.
The verification steps are as follows:
1) Initial state: the satellite-borne computer is powered on and is in a three-machine hot standby working state by default, the machine A is on duty, the machine B and the machine C are off duty, but the satellite-borne computer is consistent with the three-machine state, and the three-machine computer is in a fault autonomous reconstruction enabling state;
2) On-board computer autonomous recovery strategy verification under working condition of on-duty machine fault
(1) Sending an instruction to power off the on-flight A machine to simulate the failure of the on-flight A machine, enabling the on-flight A machine to be switched into the on-flight B machine by a computer independently, powering on the on-flight A machine by two B, C machines in a normal state and carrying out reconfiguration recovery according to an automatic failure reconfiguration recovery strategy, and restoring the system to a three-machine hot standby working state after the on-flight A machine is restored to the normal state;
(2) the method comprises the steps that an instruction is sent to simulate the failure of a B machine when the B machine of the airliner is powered off, the computer autonomously switches the B machine into the C machine, according to an autonomous fault reconstruction recovery strategy, the B machine is powered on by two A, C machines in a normal state and is subjected to reconstruction recovery, and after the B machine is recovered to a normal state, the system is recovered to a three-machine hot standby working state;
(3) sending an instruction to power off the on-flight C machine to simulate the failure of the C machine, enabling the on-flight C machine to be switched into the A machine by the computer independently, powering up the C machine by the A, B machine with normal state according to an automatic failure reconfiguration recovery strategy, carrying out reconfiguration recovery, and restoring the system to the three-machine hot standby working state after the C machine is restored to the normal state;
the autonomous recovery strategy of the spaceborne computer under the working condition of the on-duty machine fault is completely verified, the spaceborne computer is restored to the initial on-duty and three-machine hot standby working state of the A machine, and the autonomous recovery strategy verification of the spaceborne computer under the working condition of the non-on-duty machine fault can be continuously carried out under the working condition.
3) On-board computer autonomous recovery strategy verification under fault condition of non-duty machine
(1) The method comprises the steps that an instruction is sent to power off a non-on-duty machine B to simulate a B machine fault, at the moment, a computer system is still an A machine when the on-duty machine is still the on-duty machine, according to a fault autonomous reconfiguration recovery strategy, the B machine is powered on by two machines in a normal state and is subjected to reconfiguration recovery, and after the B machine is recovered to a normal state, the system is recovered to a three-machine hot standby working state;
(2) and (3) sending an instruction to power off the off-duty machine C to simulate the failure of the machine C, wherein the computer is still the machine A when the machine is on duty, powering up the machine C by two machines in A, B with normal states according to an autonomous failure reconstruction recovery strategy, recovering the failure, and recovering the system to the three-machine hot standby working state after the machine C is recovered to the normal state.
The autonomous recovery strategy of the spaceborne computer under the fault working condition of the non-duty machine is completely verified, the spaceborne computer is restored to the initial A-machine duty and three-machine hot standby working state, and the fault autonomous reconstruction/inhibition function verification can be continuously carried out.
4) Failure autonomous reconfiguration/inhibition function verification
And sending a three-machine fault autonomous reconfiguration prohibition instruction, and sending a power-off instruction of the on-board A again to simulate the A machine fault, wherein the on-board A is automatically switched into the B machine by the system computer according to the fault autonomous reconfiguration recovery strategy because the three-machine fault autonomous reconfiguration prohibition is carried out at the moment, but the fault reconfiguration is not carried out, and the system satellite-borne computer is in a hot standby working state of the A machine, namely the B machine and the C machine, when the A machine is powered off and is degraded. The test verifies the correctness of the three-machine fault autonomous reconfiguration inhibiting function, and the steps 2) and 3) verify the correctness of the three-machine fault autonomous reconfiguration enabling function.
5) System state recovery
(1) Sending a three-machine fault autonomous reconfiguration enabling instruction, wherein in the step 4), the spaceborne computer is in a working state when the airliner is powered off for the B machine and the A machine, and according to a fault autonomous reconfiguration recovery strategy, the B machine and the C machine which are normal in the state power on the A machine autonomously and perform fault recovery, and after the A machine is recovered to be in a normal state, the system is recovered to be in a three-machine hot standby working state;
(2) and sending a CPU three-machine reset instruction, and recovering the satellite-borne computer to an initial working state of the A-machine on duty and three-machine hot standby work.
Table 1 three-mode computer fault autonomous recovery verification method
The foregoing is merely illustrative of the present invention, and the present invention is not limited thereto, and any changes or substitutions easily contemplated by those skilled in the art within the scope of the present invention should be included in the present invention. Therefore, the protection scope of the invention is subject to the protection scope of the claims.
Claims (6)
1. A failure autonomous recovery strategy verification method of a triple-modular redundancy computer is characterized by comprising the following steps:
and (3) strategy verification under the working condition of flight failure: the method comprises the steps that an on-duty power-off simulation on-duty failure is carried out, a computer with a normal state is switched to be the on-duty based on an autonomous recovery strategy, the failure machine is powered on to be restored, and if the failure machine is restored, a three-machine hot standby working state is re-entered;
when each satellite-borne computer is used as the current flight to carry out policy verification, entering into policy verification under the fault condition of the non-current flight;
and verifying the strategy under the fault condition of the non-working machine: the method comprises the steps that an instruction is sent to simulate a fault when the off-duty machine is disconnected, a satellite-borne computer with a normal state is switched on based on an autonomous recovery strategy, the fault machine is powered on and recovered, and if the off-duty machine is recovered to be normal, the system is recovered to be in a three-stage hot standby working state;
when each non-duty machine passes the strategy verification, the three machines restore the hot standby working state and enter the fault autonomous reconfiguration/inhibition function verification;
the fault autonomous reconfiguration/inhibition function verification: transmitting an automatic reconfiguration prohibition instruction of the three-machine fault, transmitting a shift-on power-off instruction to simulate the shift-on fault, and switching a satellite-borne computer with a normal state based on an automatic recovery strategy to be a shift-on machine, wherein the satellite-borne computer of the system degrades a double-machine hot standby working state;
and executing the process to finish the verification of the autonomous recovery strategy.
2. The method for verifying the failure autonomous recovery policy of a triple-modular redundant computer according to claim 1, wherein the initial state of the triple-modular redundant computer is: the satellite-borne computer is powered on and is in a three-machine hot standby working state by default, the A machine is on duty, the B machine and the C machine are not on duty, but are consistent with the three-machine state, and the three-machine computer is in a fault autonomous reconstruction enabling state.
3. The failure autonomous recovery policy validation method of a triple modular redundancy computer of claim 1 or 2, wherein after the autonomous recovery policy validation is completed, system state recovery is entered:
(1) sending a three-machine fault autonomous reconfiguration enabling instruction, and according to a fault autonomous reconfiguration recovery strategy, enabling a computer in a normal state to power on a fault machine autonomously and recover the fault, and recovering the system to a three-machine hot standby working state after the fault machine is recovered to a normal state;
(2) and sending a three-machine reset instruction, and recovering the satellite-borne computer to an initial working state of the A-machine on duty and the three-machine hot standby work.
4. The method of claim 1, wherein the autonomous recovery policy is:
when the on-duty machine fails, the computer with normal switching state is on-duty machine, when the on-duty machine is powered on to recover the failed machine, if the recovery is successful, the three-machine hot standby working mode is entered, otherwise, the two-machine hot standby mode is dropped;
when the non-working machine fails, the working machine is powered on to recover when the working machine fails, if the recovery is successful, the working machine enters a three-machine hot backup working mode, and otherwise, the working machine is reduced to a two-machine hot backup mode.
5. The method for verifying the failure autonomous recovery policy of a triple-modular redundancy computer according to claim 4, wherein the triple-modular redundancy computer is defined as a computer a, a computer B, and a computer C, and the shift right of the flight is cyclically handed over in the order of the computer a, the computer B, the computer C, and then to the computer a.
6. The method for verifying the failure autonomous recovery policy of a triple-modular redundancy computer according to claim 4, wherein in the autonomous recovery policy, power-on reconstruction recovery of a failed machine is performed by an on-duty machine.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311403419.7A CN117573426A (en) | 2023-10-27 | 2023-10-27 | Three-module redundant computer fault autonomous recovery strategy verification method |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311403419.7A CN117573426A (en) | 2023-10-27 | 2023-10-27 | Three-module redundant computer fault autonomous recovery strategy verification method |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN117573426A true CN117573426A (en) | 2024-02-20 |
Family
ID=89894438
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311403419.7A Pending CN117573426A (en) | 2023-10-27 | 2023-10-27 | Three-module redundant computer fault autonomous recovery strategy verification method |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117573426A (en) |
-
2023
- 2023-10-27 CN CN202311403419.7A patent/CN117573426A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US7877627B1 (en) | Multiple redundant computer system combining fault diagnostics and majority voting with dissimilar redundancy technology | |
| CN107347018B (en) | Three-redundancy 1553B bus dynamic switching method | |
| CN106933094B (en) | Dual-redundancy airborne flight control computer | |
| CN102331786B (en) | Dual-computer cold-standby system of attitude and orbit control computer | |
| CN109189600A (en) | A kind of computer system and design method based on multi-mode redundant embedded software | |
| US6550018B1 (en) | Hybrid multiple redundant computer system | |
| CN102799104B (en) | Safety control redundant system and method for fully-intelligent master control system | |
| US10571914B2 (en) | Fault coverage for multiple failures in redundant systems | |
| CN110376876B (en) | Double-system synchronous safety computer platform | |
| CN111352338A (en) | Dual-redundancy flight control computer and redundancy management method | |
| CN103870353A (en) | Multicore-oriented reconfigurable fault tolerance system and multicore-oriented reconfigurable fault tolerance method | |
| US9952579B2 (en) | Control device | |
| CN110995478A (en) | Method for implementing redundant backup of board card in OpenVPX equipment | |
| CN101441586B (en) | Seamless reconstruction method of three-module redundant fault tolerant computer based on micro-packet protocol | |
| CN115168114A (en) | Satellite-borne integrated electronic system based on COTS device | |
| CN117573426A (en) | Three-module redundant computer fault autonomous recovery strategy verification method | |
| CN110196550B (en) | Circuit arrangement | |
| CN114706324B (en) | Distributed controller rapid prototype and simulation verification method based on time triggering | |
| CN108009047B (en) | Dual-computer hot standby model and implementation method | |
| CN104299301A (en) | Nonporous electronic control security door fault-tolerant control system | |
| CN113312094B (en) | Multi-core processor application system and method for improving reliability thereof | |
| CN102176202B (en) | Redundant network design circuit of satellite commercial devices | |
| CN115328706A (en) | Comprehensive control method and system for dual-CPU redundant architecture | |
| CN110162432B (en) | Multistage fault-tolerant spaceborne computer system based on ARM | |
| CN206272637U (en) | A kind of DCS redundancy control units based on Double Data synchronous bus |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |