A satellite embedded software on-orbit re-injection method

Abstract

A satellite embedded software on-orbit re-injection method suitable for BM3803 processor. During the operation of the satellite, the entire software needs to be re-injected to realize the change of embedded software due to functional error correction or modification of partial functions. The present invention performs on-orbit re-injection of the entire program or partial subprograms. The method includes the following steps: sending the software to be injected from the ground to the satellite service computer through the measurement and control channel, and then forwarding it to the subsystem stand-alone software through the communication bus according to the communication protocol by the digital control subsystem. The present invention can eliminate possible space software system failures, realize on-orbit modification and expansion of software functions, extend the service life of the satellite, and improve the flexibility, scalability and reliability of the software.

Description

Technical Field

[0001] The invention relates to an on-orbit re-injection method for satellite embedded software, and in particular to an on-orbit re-injection method for satellite embedded software suitable for a BM3803 processor. Background Art

[0002] With the integration and complexity of satellite power subsystem software, the application system has put forward higher requirements for long-term on-orbit autonomy and reliability of software. Since the changes to the software after the satellite is launched cannot be solidified by soldering between programmers like on the ground, on-orbit software re-injection is particularly important. On-orbit software re-injection mainly targets two situations: (1) Adjustment of some parameters: There are differences between the actual operating environment of the satellite and the ground test environment. After the satellite enters orbit, the program parameters are adjusted due to environmental changes, or some performance indicators change due to time, such as the battery over-discharge threshold voltage will change with the long-term use of the battery in orbit; (2) Adjustment of program functions: During the operation of the satellite, the entire software is re-injected to realize the change of software functions due to functional correction or modification of some functions. On-orbit software re-injection can eliminate possible space software system failures, extend the service life of the satellite, and improve the flexibility and scalability of the software. Summary of the invention

[0003] The technical problem to be solved by the present invention is: to overcome the deficiencies of the prior art, and to provide a satellite embedded software on-orbit re-injection method suitable for the BM3803 processor. During the operation of the satellite, due to functional error correction or modification of some functions, in order to realize the change of embedded software, the whole software needs to be re-injected; the present invention performs on-orbit re-injection of the whole program or part of the subprogram. The method includes the following steps: sending the software to be injected from the ground to the satellite computer through the measurement and control channel, and then forwarding it to the subsystem stand-alone software through the communication bus according to the communication protocol by the digital control subsystem. The present invention can eliminate possible space software system failures, realize on-orbit modification and expansion of software functions, extend the service life of the satellite, and improve the flexibility, scalability and reliability of the software.

[0004] The purpose of the present invention is achieved through the following technical solutions:

[0005] A satellite embedded software on-orbit re-injection method applicable to a BM3803 processor, wherein the BM3803 processor is used as a CPU module of a lower computer of a satellite power subsystem, comprises the following steps:

[0006] When the software of the satellite power subsystem needs to be re-injected on orbit, the ground compiles the software that needs to be re-injected, compares the compiled executable file with the original executable file and adds a checksum. For statement-level code re-injection, the ground sends the base address and offset address of the deleted executable code, the base address and code content of the newly added executable code to the satellite computer via the measurement and control channel; for function-level code re-injection, the ground sends the software to be injected from the ground to the satellite computer via the measurement and control channel;

[0007] The satellite computer will verify the software to be injected and forward it to the satellite power subsystem in packets according to the communication protocol;

[0008] For each program injection package, the lower computer of the satellite power subsystem performs checksum calculation and compares it with the checksum in the program injection package. If the comparison results are inconsistent, the package data is discarded and the injection program is no longer executed; if the comparison results are consistent, the re-injection type is judged; for function-level re-injection, page writing is performed in three areas of E2PROM; for statement-level re-injection, the data in PROM is moved to three areas of E2PROM, and the modified executable code is inserted into the program segment of E2PROM;

[0009] After completing the program injection packet, the satellite power subsystem receives the remote control packet to start executing the program, then takes data from the three areas of E2PROM, performs a two-out-of-three judgment and writes it to the new base address of SRAM; then the satellite power subsystem sends the execution completion telemetry packet, turns off all interrupts and jumps to the new base address of SRAM.

[0010] A satellite embedded software on-orbit re-injection system suitable for the BM3803 processor, including a ground subsystem, a measurement and control channel, a satellite computer, and a satellite power subsystem;

[0011] Ground subsystem: When the software of the satellite power subsystem needs to be re-injected on-orbit, the software that needs to be re-injected is compiled, and the compiled executable file is compared with the original executable file and a checksum is added. For statement-level code re-injection, the base address and offset address of the deleted executable code, and the base address and code content of the newly added executable code are sent to the satellite computer via the measurement and control channel; for function-level code re-injection, the ground sends the software to be injected from the ground to the satellite computer via the measurement and control channel;

[0012] The satellite computer will verify the software to be injected and forward it to the satellite power subsystem in packets according to the communication protocol;

[0013] For each program injection package, the lower computer of the satellite power subsystem performs checksum calculation and compares it with the checksum in the program injection package. If the comparison results are inconsistent, the package data is discarded and the injection program is no longer executed; if the comparison results are consistent, the re-injection type is judged; for function-level re-injection, pages are written in the three areas of E2PROM; for statement-level re-injection, the data in PROM is moved to the three areas of E2PROM, and the modified executable code is inserted into the program segment of E2PROM; after completing the sending of the program injection package, the satellite power subsystem receives the remote control package for starting to execute the program, and then takes data from the three areas of E2PROM, performs a three-out-of-two judgment and writes it to the new base address of SRAM; then the satellite power subsystem sends an execution completion telemetry package, turns off all interrupts and jumps to the new base address of SRAM.

[0014] Compared with the prior art, the present invention has the following beneficial effects:

[0015] (1) The present invention can use an incremental update method for programs that are updated in small quantities, thereby reducing the waste of satellite channel resources.

[0016] (2) The present invention can reuse the historical version of the program file after the re-injection fails.

[0017] (3) The method of the present invention is correct and effective, and can realize the modification and expansion of software functions, thereby improving the flexibility and scalability of power supply software.

[0018] (4) The method of the present invention increases the on-orbit reliability of satellite power supply and has a wide range of practical engineering application value.

[0019] (5) The method of the present invention can eliminate possible space software system failures and extend the service life of the satellite.

[0020] (6) The present invention solves the problem of on-orbit fault repair of satellite power subsystem lower computer software. The method proposed by the present invention has been effectively verified in a certain model of power subsystem lower computer. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a hardware structure diagram of the lower computer of the satellite power subsystem of the present invention.

[0022] Figure 2 This is the internal structure diagram of the BM3803 used in the lower computer CPU module of the present invention.

[0023] Figure 3 This is a schematic diagram of memory address allocation for the lower computer of the power subsystem of the present invention.

[0024] Figure 4 This is a flow chart of the on-orbit re-injection of the lower computer of the power subsystem of the present invention.

[0025] Figure 5 This is an example of the on-orbit software re-injection code of the present invention. DETAILED DESCRIPTION

[0026] To make the objectives, technical solutions and advantages of the present invention more clear, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

[0027] Embodiment 1:

[0028] A satellite embedded software on-orbit re-injection method applicable to a BM3803 processor, wherein the BM3803 processor is used as a CPU module of a lower computer of a satellite power subsystem, comprises the following steps:

[0029] When the software of the satellite power subsystem needs to be re-injected on orbit, the ground compiles the software that needs to be re-injected, compares the compiled executable file with the original executable file and adds a checksum. For statement-level code re-injection, the ground sends the base address and offset address of the deleted executable code, the base address and code content of the newly added executable code to the satellite computer via the measurement and control channel; for function-level code re-injection, the ground sends the software to be injected from the ground to the satellite computer via the measurement and control channel;

[0030] The satellite computer will verify the software to be injected and forward it to the satellite power subsystem in packets according to the communication protocol;

[0031] For each program injection package, the lower computer of the satellite power subsystem performs checksum calculation and compares it with the checksum in the program injection package. If the comparison results are inconsistent, the package data is discarded and the injection program is no longer executed; if the comparison results are consistent, the re-injection type is judged; for function-level re-injection, page writing is performed in three areas of E2PROM; for statement-level re-injection, the data in PROM is moved to three areas of E2PROM, and the modified executable code is inserted into the program segment of E2PROM;

[0032] After completing the program injection packet, the satellite power subsystem receives the remote control packet to start executing the program, then takes data from the three areas of E2PROM, performs a two-out-of-three judgment and writes it to the new base address of SRAM; then the satellite power subsystem sends the execution completion telemetry packet, turns off all interrupts and jumps to the new base address of SRAM.

[0033] Preferably, the CPU module includes a PROM. After the lower computer of the satellite power subsystem is started, it will start execution from the initial address 0x0 of the PROM. The PROM stores the BOOT boot program and the initial program.

[0034] Preferably, the re-injection software completes data reception via the 1553B bus. According to the communication protocol, the 1553B communication chip is set to single message mode, and a single injection takes 1 data packet as the minimum injection unit, and reads the frame header, packet sequence number, software version, number of bytes of injected program code, injected program code, deleted program segment code address, and number of bytes of deleted program segment code from the fixed sub-address N.

[0035] Preferably, after receiving the program injection package, the application program solidified in the E2PROM is loaded by sending the corresponding software version selection remote control package.

[0036] Preferably, the satellite power subsystem lower computer also includes a memory module, a bus communication module, a remote control module, a telemetry module, a reference control module and a cutting module;

[0037] The memory module provides the necessary storage units for the CPU to complete calculations and save telemetry information, including SRAM, EEP2ROM, PROM and NAND FLASH; the bus communication module is divided into 1553B bus communication module and RS422 bus synchronization interface module; the remote control module is used for OC command control, and the driving current is greater than 200mA; the telemetry module is used for input analog switching and acquisition; the reference control module outputs chip select signals and switches different channels to achieve control of different charging curves of the battery; the cut-off module is used to power on and off the ±12V and 5V of the power supply lower computer module.

[0038] Embodiment 2:

[0039] A satellite embedded software on-orbit re-injection system suitable for the BM3803 processor, including a ground subsystem, a measurement and control channel, a satellite computer, and a satellite power subsystem;

[0040] Ground subsystem: When the software of the satellite power subsystem needs to be re-injected on-orbit, the software that needs to be re-injected is compiled, and the compiled executable file is compared with the original executable file and a checksum is added. For statement-level code re-injection, the base address and offset address of the deleted executable code, and the base address and code content of the newly added executable code are sent to the satellite computer via the measurement and control channel; for function-level code re-injection, the ground sends the software to be injected from the ground to the satellite computer via the measurement and control channel;

[0041] The satellite computer will verify the software to be injected and forward it to the satellite power subsystem in packets according to the communication protocol;

[0042] For each program injection package, the lower computer of the satellite power subsystem performs checksum calculation and compares it with the checksum in the program injection package. If the comparison results are inconsistent, the package data is discarded and the injection program is no longer executed; if the comparison results are consistent, the re-injection type is judged; for function-level re-injection, pages are written in the three areas of E2PROM; for statement-level re-injection, the data in PROM is moved to the three areas of E2PROM, and the modified executable code is inserted into the program segment of E2PROM; after completing the sending of the program injection package, the satellite power subsystem receives the remote control package for starting to execute the program, and then takes data from the three areas of E2PROM, performs a three-out-of-two judgment and writes it to the new base address of SRAM; then the satellite power subsystem sends an execution completion telemetry package, turns off all interrupts and jumps to the new base address of SRAM.

[0043] Preferably, the CPU module of the satellite power subsystem includes a PROM. After the lower computer of the satellite power subsystem is started, it will start execution from the initial address 0x0 of the PROM. The PROM stores the BOOT boot program and the initial program.

[0044] Preferably, the re-injection software completes data reception via the 1553B bus. According to the communication protocol, the 1553B communication chip is set to single message mode, and a single injection takes 1 data packet as the minimum injection unit, and reads the frame header, packet sequence number, software version, number of bytes of injected program code, injected program code, deleted program segment code address, and number of bytes of deleted program segment code from the fixed sub-address N.

[0045] Preferably, after the satellite power subsystem receives the program injection package, it loads the application program solidified in the E2PROM by sending the corresponding software version selection remote control package.

[0046] Preferably, the satellite power subsystem lower computer also includes a memory module, a bus communication module, a remote control module, a telemetry module, a reference control module and a cutting module;

[0047] The memory module provides the necessary storage units for the CPU to complete calculations and save telemetry information, including SRAM, EEP2ROM, PROM and NAND FLASH; the bus communication module is divided into 1553B bus communication module and RS422 bus synchronization interface module; the remote control module is used for OC command control, and the driving current is greater than 200mA; the telemetry module is used for input analog switching and acquisition; the reference control module outputs chip select signals and switches different channels to achieve control of different charging curves of the battery; the cut-off module is used to power on and off the ±12V and 5V of the power supply lower computer module.

[0048] Embodiment 3:

[0049] As attached Figure 1 As shown in the figure, the hardware part of the satellite power subsystem lower computer is divided into a CPU module based on the BM3803 chip, a memory module, a bus communication module, a remote control module, a telemetry module, a reference control module and a switch module. It can realize 1553B communication with integrated electronics, RS422 communication with the balance manager, telemetry acquisition, command control, reference switching, large-capacity telemetry data storage, master-slave switching and other functions.

[0050] The CPU module uses BM3803 as the core processor chip, which provides the main computing resources and information processing functions and controls access to I / O devices. The internal modules are as follows Figure 2 As shown. The memory module provides the necessary storage units for the CPU to complete calculations and save telemetry information, including SRAM, EEP2ROM, PROM and NAND FLASH. The bus communication module is mainly divided into 1553B bus communication module and RS422 bus synchronization interface module. The remote control module mainly implements OC command control, and the driving current is greater than 200mA. The telemetry module mainly implements input analog switching and acquisition. The reference control module switches different channels by outputting chip select signals to control different charging curves of the battery. The cut-off module mainly realizes the power on and off of the ±12V and 5V power supply of the lower computer module.

[0051] As attached Figure 3 The following table shows the memory allocation table of the power subsystem. After the lower computer module is started, it will start to execute from the initial address 0x0 of the PROM. The PROM stores the BOOT boot program and the initial program. Since the PROM uses an anti-fuse memory with strong radiation resistance, it is used to store the initial program. If the upper program is affected by a single particle, it can be executed from the initial program. Through the BOOT boot, the .text segment, .data segment, and .bss segment are moved into the SRAM and jumped to the base address of the SRAM for execution.

[0052] As attached Figure 4 As shown, the on-orbit software re-injection process of the satellite power subsystem is as follows.

[0053] Step 1: When the satellite power subsystem software has an on-orbit re-injection requirement, the integrated electronics will send the injection software sub-packet via the 1553B bus. After each injection data packet is received, the lower computer software calculates the checksum and compares it with the received checksum. If they are inconsistent, the packet is discarded and the injection procedure is no longer executed.

[0054] Step 2: After comparison and consistency, determine the software re-injection type.

[0055] Step 3: When it is determined that the whole code is re-annotated, the three areas corresponding to the E2PROM are page-written, and four versions of the re-annotated program space are reserved in the E2PROM.

[0056] Step 4: When it is determined that part of the code is re-injected, the base address of the code to be deleted plus the address of the number of bytes of the code to be deleted is offset forward by the address of the number of bytes of the code to be deleted; the code after the base address of the newly added code is offset backward by the address of the number of bytes of the newly added code, and the newly added code is moved to after the base address of the newly added code.

[0057] Step 5: After the data management subsystem completes the transmission, it will send a remote control packet to start executing the program. After receiving the remote control packet, the power subsystem takes data from the three address areas corresponding to the E2PROM, performs a two-out-of-three judgment, and writes it to the new base address of the SRAM.

[0058] Step 6: Send execution completion telemetry packet, disable all interrupts and jump to the new base address of SRAM.

[0059] As attached Figure 5 The figure shows an example of the on-orbit software re-injection code of the present invention. The re-injection software completes data reception through the 1553B bus. According to the communication protocol, the 1553B communication chip is set to single message mode. A single injection takes 1 data packet as the minimum injection unit. The frame header, packet sequence number, software version, number of injected program code bytes and injected program code are read from the fixed sub-address N. After receiving the program injection package, the application program solidified in the E2PROM can be loaded by sending the corresponding software version selection remote control package.

[0060] Furthermore, the steps for loading and running the on-orbit re-injection software of the power subsystem lower computer are as follows.

[0061] Step 1: Generate on-orbit reconfiguration software on the ground. The main tasks are to design and test new codes, compile and link the codes, generate data files that can be injected into on-orbit devices when the entire code is re-injected, and calculate the base address and offset address of the executable code to be deleted, the base address and code content of the newly added executable code when part of the code is re-injected, and perform impact domain analysis and security analysis on the changed code.

[0062] Step 2: The ground injection part implements the formatting of the updated software, adds checksums and frames, and is sent from the ground according to the prescribed protocol.

[0063] Step 3: Communication link, through which information is transmitted between the satellite and the ground, and the updated software is injected into the onboard computer.

[0064] Step 4: Reconfigure the software to receive, implement the satellite-ground protocol parsing function, check the correctness of the data frame, collect complete data, perform on-orbit processing, and start the new software.

[0065] The contents not described in detail in the specification of the present invention belong to the common knowledge of those skilled in the art.

[0066] Although the present invention has been disclosed as above in the form of a preferred embodiment, it is not intended to limit the present invention. Any person skilled in the art may make possible changes and modifications to the technical solution of the present invention by using the methods and technical contents disclosed above without departing from the spirit and scope of the present invention. Therefore, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention shall fall within the protection scope of the technical solution of the present invention.

Claims

1. A satellite embedded software on-orbit re-injection method suitable for BM3803 processor, BM3803 processor as the CPU module of the satellite power subsystem lower computer, characterized in that: The steps include: When the software of the satellite power subsystem needs to be re-injected on orbit, the ground compiles the software that needs to be re-injected, compares the compiled executable file with the original executable file and adds a checksum. For statement-level code re-injection, the ground sends the base address and offset address of the deleted executable code, the base address and code content of the newly added executable code to the satellite computer via the measurement and control channel; for function-level code re-injection, the ground sends the software to be injected from the ground to the satellite computer via the measurement and control channel; The satellite computer will verify the software to be injected and forward it to the satellite power subsystem in packets according to the communication protocol; For each program injection package, the lower computer of the satellite power subsystem performs checksum calculation and compares it with the checksum in the program injection package. If the comparison results are inconsistent, the program injection package is discarded and the injection program is no longer executed; if the comparison results are consistent, the re-injection type is judged; for function-level re-injection, page writing is performed in three areas of E2PROM; for statement-level re-injection, the data in PROM is moved to three areas of E2PROM, and the modified executable code is inserted into the program segment of E2PROM; After the program injection packet is sent, the satellite power subsystem receives the remote control packet to start executing the program, then fetches data from the three areas of the E2PROM, performs a two-out-of-three judgment and writes it into the new base address of the SRAM; The satellite power subsystem then sends an execution completion telemetry packet, disables all interrupts and jumps to the new base address of the SRAM.

2. The satellite embedded software on-orbit re-injection method applicable to the BM3803 processor according to claim 1 is characterized in that: The CPU module includes PROM. After the lower computer of the satellite power subsystem is started, it will start execution from the initial address 0x0 of PROM. The PROM stores the BOOT boot program and the initial program.

3. The satellite embedded software on-orbit re-injection method applicable to the BM3803 processor according to claim 1 is characterized in that: The re-injection software completes data reception through the 1553B bus; according to the communication protocol, the 1553B communication chip is set to single message mode, and a single injection takes one data packet as the minimum injection unit. The frame header, packet sequence number, software version, number of injected program code bytes, injected program code, deleted program segment code address, and number of deleted program segment code bytes are read from the fixed sub-address N.

4. The satellite embedded software on-orbit re-injection method applicable to the BM3803 processor according to claim 1, characterized in that: After receiving the program injection package, the application program solidified in the E2PROM is loaded by sending the corresponding software version selection remote control package.

5. The satellite embedded software on-orbit re-injection method applicable to the BM3803 processor according to any one of claims 1 to 4, characterized in that: The satellite power subsystem lower computer also includes a memory module, a bus communication module, a remote control module, a telemetry module, a reference control module and a cut-off module; The memory module provides the necessary storage units for the CPU to complete calculations and save telemetry information, including SRAM, E2PROM, PROM and NAND FLASH; the bus communication module is divided into 1553B bus communication module and RS422 bus synchronization interface module; The remote control module is used for OC command control, and the driving current is greater than 200mA; the telemetry module is used for input analog switching and acquisition; the reference control module outputs chip select signals and switches different channels to achieve control of different charging curves of the battery; the cut-off module is used to power on and off the ±12V and 5V of the power supply lower computer module.

6. A satellite embedded software on-orbit re-injection system suitable for BM3803 processor, characterized in that: Including ground subsystem, measurement and control channel, satellite computer, and satellite power subsystem; Ground subsystem: When the software of the satellite power subsystem needs to be re-injected on-orbit, the software that needs to be re-injected is compiled, and the compiled executable file is compared with the original executable file and a checksum is added. For statement-level code re-injection, the base address and offset address of the deleted executable code, and the base address and code content of the newly added executable code are sent to the satellite computer via the measurement and control channel; for function-level code re-injection, the ground sends the software to be injected from the ground to the satellite computer via the measurement and control channel; The satellite computer will verify the software to be injected and forward it to the satellite power subsystem in packets according to the communication protocol; For each program injection package, the lower computer of the satellite power subsystem performs checksum calculation and compares it with the checksum in the program injection package. If the comparison results are inconsistent, the program injection package is discarded and the injection program is no longer executed; if the comparison results are consistent, the re-injection type is judged; for function-level re-injection, page writing is performed in three areas of E2PROM; for statement-level re-injection, the data in PROM is moved to three areas of E2PROM, and the modified executable code is inserted into the program segment of E2PROM; After the program injection packet is sent, the satellite power subsystem receives the remote control packet to start executing the program, then fetches data from the three areas of the E2PROM, performs a two-out-of-three judgment and writes it into the new base address of the SRAM; The satellite power subsystem then sends an execution completion telemetry packet, disables all interrupts and jumps to the new base address of the SRAM.

7. The satellite embedded software on-orbit re-injection system suitable for the BM3803 processor according to claim 6, characterized in that: The CPU module of the satellite power subsystem includes a PROM. After the lower computer of the satellite power subsystem is started, it will start execution from the initial address 0x0 of the PROM. The PROM stores the BOOT boot program and the initial program.

8. The satellite embedded software on-orbit re-injection system suitable for the BM3803 processor according to claim 6, characterized in that: The re-injection software completes data reception through the 1553B bus; according to the communication protocol, the 1553B communication chip is set to single message mode, and a single injection takes one data packet as the minimum injection unit. The frame header, packet sequence number, software version, number of injected program code bytes, injected program code, deleted program segment code address, and number of deleted program segment code bytes are read from the fixed sub-address N.

9. The satellite embedded software on-orbit re-injection system suitable for the BM3803 processor according to claim 6, characterized in that: After the satellite power subsystem receives the program injection package, it loads the application program solidified in the E2PROM by sending the corresponding software version selection remote control package.

10. The satellite embedded software on-orbit re-injection system suitable for BM3803 processor according to any one of claims 6 to 9, characterized in that: The satellite power subsystem lower computer also includes a memory module, a bus communication module, a remote control module, a telemetry module, a reference control module and a cut-off module; The memory module provides the necessary storage units for the CPU to complete calculations and save telemetry information, including SRAM, E2PROM, PROM and NAND FLASH; the bus communication module is divided into 1553B bus communication module and RS422 bus synchronization interface module; The remote control module is used for OC command control, and the driving current is greater than 200mA; the telemetry module is used for input analog switching and acquisition; the reference control module outputs chip select signals and switches different channels to achieve control of different charging curves of the battery; the cut-off module is used to power on and off the ±12V and 5V of the power supply lower computer module.

Images