High-reliability satellite service software solidification, verification and loading method and system

Abstract

The invention discloses a high-reliability satellite service software solidification, verification and loading method and system, and belongs to the technical field of satellite service software, bootloader guide software and on-orbit single particle protection. The problems that satellite service software in an on-orbit program storage area is overturned, the ground does not perceive, and autonomous recovery cannot be achieved after overturning are solved. The method comprises a processing and checking strategy of a satellite service software program, a starting strategy of guiding software and a processing strategy after a program storage area is overturned. The method specifically comprises the following steps of: after a satellite service source program is processed, reading program files of three storage areas in sequence, judging the program of each area through a calculation checksum mode, and if all the programs cannot run, taking out a complete program in a bitwise two-out-of-three mode to run; after the satellite service software is reset, the overturned condition is repaired through verification and moving operation; and when the satellite service program runs, repairing is completed through an overturning detection mechanism. The method is suitable for curing, checking and loading the satellite service software of the high-orbit satellite in a more complex space environment.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of satellite software, bootloader boot software and on-orbit single particle protection, and particularly relates to a high-reliability satellite software solidification, verification and loading method. BACKGROUND

[0002] The traditional satellite software solidification mode is to store three satellite programs in norflash by bootloader boot software, and the bootloader boot software is used to guide and load the first satellite program to run after the comprehensive electronic power-on, and then the second program and the third program are loaded in turn to run after the running fails. Although this mode makes backup storage for the software version, for high-orbit satellites, the space environment is more complex, the single particle radiation is more, and the memory data bits are more likely to be flipped, so it is also not impossible that the three programs are flipped. SUMMARY

[0003] The application is designed to solve the problems that the satellite software in the on-orbit program storage area is flipped, the ground is not aware, and the flipped program cannot be automatically recovered, and a high-reliability satellite software solidification, verification and loading method is designed.

[0004] To achieve the above-mentioned purpose, the application provides the following technical scheme. In a first aspect, the application provides a high-reliability satellite software solidification, verification and loading method, which comprises the following steps: Step 1: processing the satellite source program and solidifying it into the program storage area in three modes to generate a solidification program file; Step 2: the bootloader boot software reads the solidification program files in the three storage areas in order, and judges whether the program in each area is executable through the calculation of the checksum, if the program files in the three areas are not executable, a complete program is extracted from the three areas in the bit three-to-two mode and is verified, if the verification is passed, the program is directly run, and the verified program is written back to the three program storage areas, otherwise the comprehensive electronic machine is controlled to be turned off, and the satellite program start area is recorded; Step 3: when the satellite software is reset, it is judged whether the program in the storage area is flipped according to the recorded satellite program start area, if yes, the program is repaired through the checksum and moving operation; Step 4: when the satellite program storage area is running, the three satellite program storage areas are read and verified through the flip detection mechanism, if the verification fails, the ground can be notified through telemetry to dispose and recover, or the program after the verification is correct can be written back to the program storage area with verification failure in the bit three-to-two mode.

[0005] Further, the above-mentioned satellite software should have the functions of satellite program verification, moving and bit three-to-two.

[0006] Furthermore, the aforementioned star service source procedure processing is specifically as follows: Add a four-byte synchronization header 1ACFFC1D to the Star Service source program and pad the end of the program with 0xAA to ensure that the program length is a multiple of 4 bytes. Calculate the four-byte checksum and pad it after the padding bit, and add the program file length after the synchronization header 1ACFFC1D; The bootloader software is used to solidify the processed program data into the program storage area, generating a solidified program file.

[0007] Furthermore, in addition to the function of embedding application software, the aforementioned bootloader also has functions such as reading, verifying, loading, and bitwise selection of two out of three for embedded programs.

[0008] Furthermore, step 2 above specifically includes: The bootloader first reads the program in the first zone and calculates the checksum. If the checksum is 0, the space service program is moved to SRAM and run. If the checksum is not 0, the second zone program is read and checked, and so on. If the checksum of the three zones is not 0, a complete program is taken from the three zones in a bitwise 2-out-of-3 manner and checked. If the checksum passes, the program is run directly; otherwise, the integrated electronic cutter is controlled. Record the launch area of ​​the satellite and telemetry data to the ground.

[0009] Furthermore, the above-mentioned overturning situation is repaired by moving the successfully verified program from the storage area back to the program storage area that failed the verification.

[0010] Furthermore, ground-based telemetry can continuously monitor the overturned state of the satellite mission program storage area.

[0011] Secondly, the highly reliable satellite software solidification, verification, and loading method described in this invention can be entirely implemented using computer software. Therefore, correspondingly, this invention also provides a highly reliable satellite software solidification, verification, and loading system.

[0012] Thirdly, the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, performs the highly reliable method for solidifying, verifying, and loading spacecraft software as described in any of the above-mentioned claims.

[0013] Fourthly, the present invention provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the processor runs the computer program stored in the memory, the processor executes a highly reliable method for solidifying, verifying, and loading spacecraft software as described in any of the above-mentioned claims.

[0014] The beneficial effects of this invention are as follows: This invention provides a highly reliable method for solidifying, verifying, and loading spaceborne operational software. Through processing and verification strategies of the spaceborne source program, the system enables autonomous verification of the source program onboard, and also allows verification in response to ground commands (verification is considered successful if the checksum is 0, and unsuccessful if the checksum is not 0). A bootloader startup strategy is also designed so that when the spaceborne source program fails verification due to a single event event (SEE), the next storage area's spaceborne program can be loaded sequentially. When all three storage areas are overturned, a bitwise 2-out-of-3 approach is taken from the three storage areas, and the program is verified and then loaded for execution. A handling strategy for program storage area flips is also designed, enabling recovery even during operation of the spaceborne program storage area, thus solving the problem that the system cannot autonomously recover after a flip due to the inability to detect the flipped program during runtime.

[0015] Furthermore, this invention also designs a method in which the satellite service software reads and verifies the three satellite service program storage areas in low-priority tasks. If any verification fails, the satellite will notify the ground via telemetry, and the ground will handle and restore the situation. Alternatively, the satellite can autonomously perform a bitwise 2-out-of-3 check, and if the verification is correct, write back the program storage area that failed the verification to ensure the correctness of the program. At the same time, the handling record is retained and sent to the ground in log form, solving the problem of ground non-awareness in the existing technology.

[0016] Furthermore, the present invention also has the following advantages: (1) The storage area satellite service program supports verification; (2) If the bootloader fails to verify the first three regions, it can extract a complete program by taking two out of three bits and load and run it. (3) The storage area's satellite service program can be automatically rewritten after it is overturned; (4) Ground telemetry can continuously monitor the overturned state of the satellite mission program storage area.

[0017] This invention is applicable to the solidification of satellite service software and the verification and loading of bootloader software for high-orbit satellites in more complex space environments. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the specific embodiments of the present invention or the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating the processing of the space service software program as described in this embodiment of the invention; Figure 2 This is a flowchart illustrating the bootloader startup strategy described in this embodiment of the invention. Figure 3 This is a flowchart illustrating the handling strategy after the program storage area is flipped, as described in this embodiment of the invention. Detailed Implementation The specific implementation details (such as experimental apparatus, operation procedures, data processing steps, and example parameters) of "a highly reliable method for solidifying, verifying, and loading spacecraft software" provided in this specification are primarily intended for illustrative purposes rather than limiting definitions, aiming to help those skilled in the art thoroughly understand the principles and implementation of the invention. However, those skilled in the art should understand that these details represent only one feasible embodiment, and the core concept of the invention can be fully realized through other technical means or alternative solutions not described in detail, without departing from its spirit and essence. Furthermore, the omission of details of conventional experimental methods and apparatus known in the art in the specification is to avoid redundant information interfering with the understanding of the innovation points. This does not mean that these known technologies are not required during implementation, and those skilled in the art should be able to supplement and apply them based on their professional knowledge.

[0020] The specific embodiments of the present invention will be further described in detail below with reference to the accompanying drawings. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention.

[0021] Example 1: This example addresses the problem of spacecraft software in the on-orbit program storage area being overturned, resulting in no ground detection and the inability to recover autonomously after overturning. It provides a highly reliable method for solidifying, verifying, and loading spacecraft software, comprising the following steps: Step 1: Process the Star Service source program and solidify it to the program storage area in three modes to generate a solidified program file; Step 2: The bootloader software reads the solidified program files in the three storage areas in sequence and determines whether the program in each area is runnable by calculating the checksum. If the program files in all three areas are not runnable, a complete program is taken out from the three areas in a bitwise 2-out-of-3 manner and verified. If the verification passes, it is run directly and the verified program is written back to the three program storage areas. Otherwise, the integrated electronic switch is controlled and the star service program startup area is recorded. Step 3: After the space service software is reset, check whether the program in the storage area has been overturned based on the recorded space service program startup area. If so, repair it through verification and relocation operations. Step 4: When the satellite program storage area is running, the three satellite program storage areas are read and verified through the flip detection mechanism. If the verification fails, the ground can be notified by telemetry and the ground can handle and restore it. Alternatively, the satellite can autonomously write the program that has been verified back to the program storage area that failed the verification in a bitwise 2 out of 3 manner.

[0022] This embodiment provides a highly reliable method for solidifying, verifying, and loading spaceborne operational software. Through processing and verification strategies for the spaceborne operational source program, the system enables autonomous verification of the source program onboard, and also allows verification in response to ground commands (verification is considered successful if the checksum is 0, and unsuccessful if the checksum is not 0). A bootloader startup strategy is also designed so that when the spaceborne operational source program fails verification due to a single event event (SEE), the next storage area's spaceborne operational program can be loaded sequentially. When all three storage areas are overturned, a bitwise 2-out-of-3 approach is taken from the three storage areas, and after verification, one program is loaded and run. A handling strategy for program storage area flips is also designed, enabling recovery even if the spaceborne operational program storage area is in operation, thus solving the problem that the system cannot autonomously recover after a flip due to the inability to detect the flipped program during runtime.

[0023] Example 2, Combination Figures 1 to 3 This embodiment describes in detail each step of the highly reliable space service software solidification, verification, and loading method described in Embodiment 1 above; Step 1: Process the Star Service source program and solidify it to the program storage area in three modes to generate a solidified program file; Specifically: A four-byte synchronization header 1ACFFC1D is added to the Star Service source program, and 0xAA is padded at the end of the program to ensure that the program length is an integer multiple of 4 bytes, which is used for 4-byte verification. Calculate a four-byte parity bit and pad it after the padding bit to ensure that the sum of the four bytes after padding is 0; at the same time, add the program file length after the synchronization header 1ACFFC1D. The file length includes the synchronization header and the parity bit, which is used for on-board verification calculation of the program. After completing the above processing, the bootloader software is used to solidify the processed program data into the program storage area, generating a solidified program file; the solidified program file is generated as follows. Figure 1 As shown.

[0024] Step 2: The bootloader software reads the solidified program files in the three storage areas in sequence and determines whether the program in each area is runnable by calculating the checksum. If the program files in all three areas are not runnable, a complete program is taken out from the three areas in a bitwise 2-out-of-3 manner and verified. If the verification passes, it is run directly and the verified program is written back to the three program storage areas. Otherwise, the integrated electronic switch is controlled and the star service program startup area is recorded. Specifically: In addition to the function of embedding application software, the bootloader also has functions such as reading, verifying, loading, and bitwise selection of two out of three for embedded programs.

[0025] After the integrated electronics are powered on, the bootloader software first reads the first zone program and calculates the checksum. If the checksum is 0, the space service program is moved to SRAM for execution. If the checksum is not 0, the second zone program is read and checked, and so on. If the checksum of the three regions is not 0, a complete program is taken from the three regions in a bitwise 2-out-of-3 manner and checked. If the checksum passes, the program is run directly; otherwise, the FPGA will control the integrated electronic cutter. When loading the space mission program, the bootloader software records the space mission program's startup area in a fixed free area of ​​memory. After the space mission software starts, it accesses this address space and telemetryally transmits the startup area to the ground, allowing ground control personnel to know from which area the space mission program was loaded and started. The specific process is as follows: Figure 2 As shown.

[0026] Step 3: After the space service software is reset, check whether the program in the storage area has been overturned based on the recorded space service program startup area. If so, repair it through verification and relocation operations. Specifically: When telemetry detects that the satellite mission program start area is not 1, it indicates that the program verification of the first area of ​​the satellite mission program storage area has failed. Ground control needs to issue instructions to intervene and restore the overturned program area. This requires the satellite mission software to have the following functions: (1) Verification function of the satellite service program. According to the ground instruction, the program in the specified satellite service program storage area can be verified. The verification rule is that the sum of the program data read from the program storage area is 0; (2) The Star Service Program needs to have a relocation function. When the verification of individual program areas fails, the program in the storage area that has been successfully verified can be moved back to the storage area of ​​the program that failed verification. (2) The Star Service software needs to have the function of taking two out of three bits. If the verification of the three programs in the Star Service program storage area fails, two out of three bits can be taken out from the three programs to retrieve a complete program and verify it. After passing the verification, it is written back to the three program storage areas.

[0027] Step 4: When the satellite program storage area is running, the three satellite program storage areas are read and verified through the flip detection mechanism. If the verification fails, the ground can be notified by telemetry and the ground can handle and restore it. Alternatively, the satellite can autonomously write the program that has been verified back to the program storage area that failed the verification in a bitwise 2 out of 3 manner.

[0028] Specifically: After the satellite is reset, telemetry based on the satellite program startup area recorded by the bootloader can detect whether the onboard program storage area has been overturned. If overturning has occurred, it can be repaired by verifying and relocating the satellite program in the storage area. If the satellite program storage area is overturned during operation, it will not be detected unless the satellite program is reset and rebooted. This requires the satellite to have an autonomous storage area program overturning detection mechanism. This embodiment is designed so that every 24 hours (time can be injected), the satellite software reads and verifies the three satellite program storage areas in a low-priority task. If the verification fails, the satellite will notify the ground via telemetry, and the ground will handle the recovery. Alternatively, the satellite can autonomously perform a bitwise 2-out-of-3 check, and if the verification is correct, write back the program storage area that failed the verification to ensure the correctness of the program. At the same time, the handling record is retained and sent to the ground in log form. The specific process is as follows. Figure 3 As shown.

[0029] Example 3, Combination Figures 1 to 3 This embodiment provides a specific implementation method to comprehensively explain the entire method of solidifying, verifying, and loading the space service software.

[0030] First, the satellite-based source program is processed using ground-based tools. A four-byte synchronization header (1ACFFC1D) is added to the source program, and 0xAA is padded to the end to ensure the program length is a multiple of four bytes for 4-byte verification. Simultaneously, a four-byte checksum is calculated and padded after the padded bit to ensure that the sum of the four bytes in the padded program is zero. Additionally, the program file length, including the synchronization header and checksum, is added after the synchronization header (1ACFFC1D) for onboard verification calculations. After these steps, the bootloader software is used to permanently store the processed program data in the program storage area. The method for generating the permanently stored program file is as follows. Figure 1 As shown.

[0031] Secondly, besides the function of embedding application software, the bootloader software also has functions such as reading, verifying, loading, and bitwise 2-out-of-3 operations of the embedded program. After the integrated electronics are powered on, the bootloader software first reads the program in the first region and calculates the checksum. If the checksum is 0, the space service program is moved to SRAM for execution. If the checksum is not 0, it continues to read and verify the program in the second region, and so on. If the checksums of all three regions are not 0, the bitwise 2-out-of-3 operation function is activated. A complete program is retrieved from the three regions of the embedded space service program and verified. If the verification passes, it runs directly; otherwise, the FPGA controls the integrated electronics to switch the machine. When loading the space service program, the bootloader software records the space service program startup area in a fixed free area in memory. After the space service software starts, it accesses this address space and telemetryally transmits the startup area to the ground, allowing ground control personnel to know which region the space service program was loaded and started from. The specific process is as follows: Figure 2 As shown.

[0032] Finally, when telemetry detects that the satellite mission program startup area is not 1, it indicates that the program verification of the first area of ​​the satellite mission program storage area has failed. Ground control needs to issue instructions to intervene and restore the overturned program area. This requires the satellite mission software to have the following functions: (1) Verification function of the satellite service program: According to the ground instructions, the program in the specified satellite service program storage area can be verified. The verification rule is that the sum of the program data read from the program storage area is 0.

[0033] (2) The Star Service Program needs to have a relocation function: when the verification of individual program areas fails, the program in the storage area that has been successfully verified can be moved back to the storage area of ​​the program that failed verification.

[0034] (3) The Star Service software needs to have the function of taking two out of three bits: if the verification of the three programs in the Star Service program storage area fails, two out of three bits can be taken out from the three programs, a complete program can be retrieved and verified, and after passing the verification, it can be written back to the three program storage areas.

[0035] Using the above methods, after the satellite is reset, telemetry of the satellite program startup area recorded by the bootloader can detect whether the onboard program storage area has been overturned. If overturning has occurred, it can be repaired by verifying and relocating the satellite program in the storage area. If the satellite program storage area is overturned during operation, it will not be detected unless the satellite program is reset and rebooted. This requires the satellite to have an autonomous storage area program overturning detection mechanism. This embodiment is designed so that every 24 hours (time can be injected), the satellite software reads and verifies the three satellite program storage areas in a low-priority task. If the verification fails, the satellite will notify the ground via telemetry, and the ground will handle the recovery. Alternatively, the satellite can autonomously perform a bitwise 2-out-of-3 check, and if the verification is correct, write back the program storage area that failed the verification to ensure the correctness of the program. At the same time, the handling record is retained and sent to the ground in log form. The specific process is as follows. Figure 3 As shown.

[0036] As can be seen, the highly reliable method for solidifying, verifying, and loading spaceborne software provided by this invention, through processing and verification strategies of the spaceborne source program, enables the satellite to autonomously verify the spaceborne source program, and can also respond to ground commands to verify the spaceborne source program (verification is considered successful when the checksum is 0, and failed when the checksum is not 0). A bootloader startup strategy is also designed so that when the spaceborne source program fails verification due to a single particle impact, the spaceborne program in the next storage area can be loaded sequentially. When all three storage areas are overturned, two out of three spaceborne source programs can be retrieved, verified, and then loaded for execution. A disposal strategy after the program storage area is overturned is also designed so that even if the spaceborne program storage area is in operation, it can be disposed of and restored, solving the problem that the spaceborne program cannot be detected during operation, thus preventing autonomous recovery after overturning.

[0037] Furthermore, this invention also designs a method where the satellite service software reads and verifies the three satellite service program storage areas in low-priority tasks. If any verification fails, the satellite will notify the ground via telemetry for handling and recovery. Alternatively, the satellite can autonomously perform a bitwise 2-out-of-3 selection, and if the verification is correct, write back the program storage area that failed the verification to ensure program correctness. At the same time, the handling record is retained and sent to the ground in log form, solving the problem of ground non-awareness in the prior art. Furthermore, this invention also has the following advantages: (1) the satellite service program in the storage area supports verification; (2) after the verification of the first three areas fails, the bootloader can retrieve a complete program by bitwise 2-out-of-3 selection and load it for operation; (3) the satellite service program in the storage area can be automatically rewritten after being overturned; (4) the ground telemetry can continuously monitor the overturned status of the satellite service program storage area. This makes this invention applicable to the solidification of satellite service software and the verification and loading of bootloader software for high-orbit satellites in more complex space environments.

[0038] Example 4: The highly reliable space service software solidification, verification, and loading method described in any of the above examples can be entirely implemented using computer software. Therefore, this example provides a highly reliable space service software solidification, verification, and loading system.

[0039] Example 5: This example provides a computer-readable storage medium storing a computer program. When the computer program is run by a processor, it executes a highly reliable method for solidifying, verifying, and loading spacecraft software as described in any of the above examples.

[0040] Example 6: This example provides a computer device, which includes a memory and a processor. The memory stores a computer program. When the processor runs the computer program stored in the memory, the processor executes a highly reliable method for solidifying, verifying, and loading spacecraft software as described in any of the above examples.

[0041] This embodiment provides a computer device. The hardware device in this part is a general model and is not shown in the figure. The system includes a processor and a memory. The processor and the memory can be connected by a bus or other means. The memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs and modules, as well as corresponding program instructions / modules. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions and modules stored in the memory, so as to realize a highly reliable method and steps for solidifying, verifying and loading spacecraft software in the above method embodiment.

[0042] The memory may include a program storage area and a data storage area, wherein the program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, mobile communication networks, and combinations thereof.

[0043] One or more modules are stored in the memory. When the processor executes, it performs the method steps in the embodiments. In this way, the invention objective can be achieved through the method, apparatus and process of the present invention. The specific details of the computer device described above can be understood by referring to the relevant descriptions and effects in the embodiments, and will not be repeated here.

[0044] Those skilled in the art will understand that implementing all or part of the processes in the above embodiments can be accomplished by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk drive (HDD), or solid-state drive (SSD), etc.; the storage medium can also include combinations of the above types of memory.

[0045] In the above description, it should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0046] The above description of the technical solution provided by the present invention through several specific embodiments is intended to highlight the advantages and benefits of the technical solution provided by the present invention. However, the above-described specific embodiments are not intended to limit the present invention. Any reasonable modifications and improvements to the present invention, reasonable combinations and equivalent substitutions of the embodiments based on the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A highly reliable method for solidifying, verifying, and loading space service software, characterized in that, The methods include: Step 1: Process the Star Service source program and solidify it to the program storage area in three modes to generate a solidified program file; Step 2: The bootloader software reads the solidified program files in the three storage areas in sequence and determines whether the program in each area is runnable by calculating the checksum. If the program files in all three areas are not runnable, a complete program is taken out from the three areas in a bitwise 2-out-of-3 manner and verified. If the verification passes, it is run directly and the verified program is written back to the three program storage areas. Otherwise, the integrated electronic switch is controlled and the star service program startup area is recorded. Step 3: After the space service software is reset, check whether the program in the storage area has been overturned based on the recorded space service program startup area. If so, repair it through verification and relocation operations. Step 4: When the satellite program storage area is running, the three satellite program storage areas are read and verified through the flip detection mechanism. If the verification fails, the ground can be notified by telemetry and the ground can handle and restore it. Alternatively, the satellite can autonomously write the program that has been verified back to the program storage area that failed the verification in a bitwise 2 out of 3 manner.

2. The highly reliable method for solidifying, verifying, and loading space service software according to claim 1, characterized in that, The satellite management software has the functions of verifying, relocating, and performing bitwise take-two operations on satellite management programs.

3. The highly reliable method for solidifying, verifying, and loading space service software according to claim 1, characterized in that, The specific processing of the Star Service source code is as follows: Add a four-byte synchronization header 1ACFFC1D to the Star Service source program and pad the end of the program with 0xAA to ensure that the program length is a multiple of 4 bytes. Calculate the four-byte checksum and pad it after the padding bit, and add the program file length after the synchronization header 1ACFFC1D; The bootloader software is used to solidify the processed program data into the program storage area, generating a solidified program file.

4. The highly reliable method for solidifying, verifying, and loading space service software according to claim 3, characterized in that, The bootloader software has the functions of embedding application software, reading, verifying, loading, and bitwise selection of two out of three.

5. The highly reliable method for solidifying, verifying, and loading space service software according to claim 4, characterized in that, Step 2 is as follows: The bootloader first reads the program in the first zone and calculates the checksum. If the checksum is 0, the space service program is moved to SRAM and run. If the checksum is not 0, the second zone program is read and checked, and so on. If the checksum of the three zones is not 0, a complete program is taken from the three zones in a bitwise 2-out-of-3 manner and checked. If the checksum passes, the program is run directly; otherwise, the integrated electronic cutter is controlled. Record the launch area of ​​the satellite and telemetry data to the ground.

6. The highly reliable method for solidifying, verifying, and loading space service software according to claim 1, characterized in that, The overturned situation is repaired by moving the successfully verified program from the storage area back to the program storage area that failed the verification.

7. The highly reliable method for solidifying, verifying, and loading space service software according to claim 1, characterized in that, Ground-based telemetry can continuously monitor the overturned state of the satellite mission program storage area.

8. A highly reliable system for fixing, verifying, and loading spacecraft software, characterized in that, The system is implemented based on a highly reliable method for solidifying, verifying, and loading spacecraft software as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, performs a highly reliable method for solidifying, verifying, and loading spacecraft software as described in any one of claims 1-7.

10. A computer device, characterized in that, The device includes a memory and a processor. The memory stores a computer program. When the processor runs the computer program stored in the memory, the processor executes a highly reliable method for solidifying, verifying, and loading spacecraft software as described in any one of claims 1-7.

Images