A method for on-orbit maintenance of a self-repairable satellite-borne DSP

Abstract

The application relates to an on-orbit maintenance method for a self-repairable satellite-borne DSP, which is realized by an on-orbit maintenance system and is used for maintaining and managing a DSP chip; the on-orbit maintenance method comprises the following steps: S1, powering on the on-orbit maintenance system; S2, performing three-mode redundancy comparison error correction and CRC check word checking to judge whether the checking is passed; S3, mapping the DSP chip to a target chip area address and performing DSP program data loading; S4, judging whether the monitoring function of the DSP chip is normal; and S5, downloading the chip area address of the DSP program data which is not passed in the telemetry and executing satellite platform instructions to repair the DSP program data. The application has simple architecture, low implementation difficulty, can effectively prolong the on-orbit life of a satellite and other space vehicles while keeping low cost.

Description

Technical Field

[0001] This invention relates to the field of on-orbit maintenance of spacecraft, and specifically to an on-orbit maintenance method for a self-repairing spaceborne DSP. Background Technology

[0002] Addressing anomalous flips and program crashes caused by space irradiation, preventing permanent device damage, and effectively improving the reliability of products in the space environment are traditional challenges in the aerospace field, especially for more vulnerable DSP devices. Meanwhile, with the dual increase in application demands and technological capabilities, and given the high cost and long development cycles of spacecraft, the requirements for the expandability and repairability of on-orbit products are also increasing. Therefore, software functions that combine highly autonomous error correction and repair with highly flexible application expansion are becoming increasingly important and urgent for the development of spaceborne products.

[0003] Traditional on-orbit maintenance is typically achieved through on-orbit programming or triple modular redundancy (TMR). However, limitations imposed by spacecraft transit time and transmission methods often make on-orbit programming difficult to implement, and TMR's error correction capabilities are relatively limited, failing to ensure data accuracy. Furthermore, the unique nature of space environment applications places high demands on the hardware selection of on-orbit maintenance systems. To address these issues, this paper proposes a simple and reliable hardware design scheme, combined with software functional design, to achieve an on-orbit maintenance method capable of autonomously handling and recovering from various anomalies such as single-event upsets, memory block corruption, and software program errors. Summary of the Invention

[0004] The purpose of this invention is to provide an on-orbit maintenance method for a self-repairable spaceborne DSP, which can provide an effective solution to problems such as abnormal flipping and program crashes caused by the space environment in embedded software such as DSPs. At the same time, it provides an efficient design approach for changing mission requirements and correcting software design flaws during the on-orbit operation of spaceborne DSP software in the aerospace field.

[0005] To achieve the above objectives, this invention provides an on-orbit maintenance method for a self-repairable spaceborne DSP, implemented using an on-orbit maintenance system for maintaining and managing the DSP chip. The on-orbit maintenance system includes an SRAM-type FPGA chip connected to the DSP chip and an MRAM chip connected to the SRAM-type FPGA chip. The on-orbit maintenance method includes the following steps:

[0006] S1. Power on the on-orbit maintenance system;

[0007] S2. The SRAM-type FPGA chip selects the DSP program data of the target chip address from the MRAM chip, performs three-mode redundancy comparison and error correction, and CRC check word verification, and determines whether the verification passes; if yes, proceed to S3; if no, proceed to S5.

[0008] S3: The DSP chip is mapped to the target chip address and the DSP program data is loaded.

[0009] S4. Determine if the monitoring function of the DSP chip is normal; if yes, continue normal operation; if no, go to S2 to re-verify.

[0010] The S5 and SRAM-type FPGA chips remotely transmit the area address of the DSP program data that failed verification, and execute satellite platform instructions to repair the DSP program data.

[0011] Furthermore, the on-orbit maintenance system also includes: a refresh chip connected to an SRAM-type FPGA chip, and a PROM chip connected to the refresh chip.

[0012] Furthermore, in S1, after the on-orbit maintenance system is powered on, the refresh chip reads the FPGA program data from the PROM chip and loads it into the SRAM-type FPGA chip, and refreshes the FPGA program periodically after the on-orbit maintenance system is running normally.

[0013] Furthermore, the MRAM chip includes at least three regions, each region storing a complete set of DSP programs; each complete set of DSP programs includes multiple sets of DSP program data and multiple CRC checksums added after each set of DSP program data.

[0014] Furthermore, step S2 specifically includes the following steps:

[0015] S21. The FPGA program reads the three sets of target DSP program data stored in the target address of different areas in the MRAM chip byte by byte.

[0016] S22. The FPGA program will perform three-mode redundancy comparison and error correction on a byte-by-byte basis on the three sets of target DSP program data read.

[0017] When the three sets of target DSP program data are all the same, error correction is performed by comparing and correcting the three-mode redundancy, and then S23 continues;

[0018] When two sets of target DSP program data are the same, they are considered to be correct data. Different target DSP program data are considered to be incorrect data. The correct data is written back to the storage address of the incorrect data in the MRAM chip, and error correction is performed by three-mode redundancy comparison. Then, S23 continues.

[0019] When the three sets of target DSP program data are all different, the error correction is not passed by the three-mode redundancy comparison, and S5 continues;

[0020] S23. The FPGA program performs a CRC check on the CRC checksum of the target DSP program data in any of the three areas; if it passes, continue to S3; if it fails, continue to S5.

[0021] Furthermore, in S3, when the S2 verification passes, the read address of the DSP program data sent by the DSP chip is mapped to the target chip address along with the chip select signal of the MRAM chip. Then, a reset operation is performed on the DSP chip to automatically load the target DSP program.

[0022] Furthermore, in S4, after the DSP program of the DSP chip runs normally, it periodically sends pulse signals to the SRAM-type FPGA chip. When no pulse signal is received within a limited time, the SRAM-type FPGA chip determines that the DSP program is in an abnormal state and executes S2 to S3 again to complete the reloading of the DSP program.

[0023] Furthermore, in step S5, when the S2 verification fails, the following steps are specifically included:

[0024] S6, FPGA program executes block repair instructions;

[0025] S7: The FPGA program executes the program version switching instruction, switches to another target chip address of the MRAM chip, and returns to execute the S2 operation to reload the DSP program;

[0026] S8, FPGA program executes global on-orbit programming instructions.

[0027] Furthermore, in S6, when the FPGA program receives the block repair instruction, the ground will separately annotate the data frame containing the erroneous data and mark the frame sequence information. The SRAM-type FPGA chip will calculate the starting address for writing and start the verification and writing operation, thereby performing fast and reliable block repair of the MRAM chip through partial annotation.

[0028] Furthermore, step S8 specifically includes the following steps:

[0029] S81. Receive and verify on-orbit programming data;

[0030] S82. Return the verified bitmap table to the ground and determine whether the bitmap table is valid; if yes, go to S83; if no, go to S84.

[0031] S83 and bitmap table passed;

[0032] S84, bitmap table not all passed.

[0033] Furthermore, in S81, the bitmap table verification criteria are as follows: according to the data frame structure, after the data is judged by the frame header, the identifier to the program file content is checked and accumulated; the calculated checksum is compared with the received checksum, and the locally counted frame sequence number is compared with the received frame sequence number. If both pass, the corresponding bit in the bitmap table is set to 1; otherwise, it is set to 0.

[0034] Furthermore, in S83, when the bitmap table is passed, the FPGA program waits for the on-orbit programming confirmation instruction. After receiving the on-orbit programming confirmation instruction, it writes the on-orbit programming data to the target address segments of the three areas of the MRAM chip, completes the on-orbit programming operation, and returns a successful telemetry result.

[0035] Furthermore, in S84, when the bitmap table is not completely passed, the FPGA program waits for the erroneous frames to be re-uploaded, executes S81 again, performs reception verification on the re-uploaded frames until the data is completely correct, and then executes S82 to S83 to complete the on-orbit programming operation.

[0036] In summary, the self-repairable on-orbit maintenance method for spaceborne DSPs provided by this invention is implemented using an on-orbit maintenance system. It has a simple architecture and is not difficult to implement. It can effectively extend the on-orbit life of spacecraft such as satellites while maintaining low cost. At the same time, it can provide an effective solution to problems such as abnormal flips and program crashes caused by the space environment for embedded software such as DSPs. Attached Figure Description

[0037] Figure 1 This is a schematic diagram of the overall structure of an on-orbit maintenance system for a self-repairing spaceborne DSP according to the present invention.

[0038] Figure 2 This is a diagram of the MRAM storage structure of an on-orbit maintenance method for a self-repairable spaceborne DSP according to the present invention.

[0039] Figure 3 This invention provides an on-orbit programming data frame structure for an on-orbit maintenance method for a self-repairable spaceborne DSP.

[0040] Figure 4 This is the bitmap table structure of the self-repairable on-orbit maintenance method for spaceborne DSP of the present invention;

[0041] Figure 5 This is a flowchart of an on-orbit maintenance method for a self-repairable spaceborne DSP according to the present invention;

[0042] Figure 6 This is an on-orbit programming flowchart of an on-orbit maintenance method for a self-repairable spaceborne DSP according to the present invention. Detailed Implementation

[0043] The following is in conjunction with the appendix Figure 1 To be continued Figure 6 The present invention will be further illustrated by describing a preferred embodiment in detail.

[0044] like Figure 1 As shown, an on-orbit maintenance system for a self-repairing spaceborne DSP (Digital Signal Processing) chip 5 is used to maintain and manage the DSP program. This on-orbit maintenance system includes: a single-chip SRAM (Static Random-Access Memory) type FPGA (Field Programmable Gate Array) chip 1 connected to the DSP chip 5; a single-chip refresh chip 2 connected to the SRAM type FPGA chip 1, responsible for periodically refreshing the FPGA program; a single-chip PROM (Programmable Red-Only Memory) chip 3 connected to the refresh chip 2, responsible for loading the FPGA program; and a single-chip MRAM (Magnetic Random Access Memory) chip 4 connected to the SRAM type FPGA chip 1, responsible for storing the DSP program.

[0045] Among them, the SRAM-type FPGA chip 1 is the core processing device of the entire on-orbit maintenance system.

[0046] The control line, clock line, and data line of the refresh chip 2 are respectively connected to the corresponding ports on the PROM chip 3. When the FPGA program is loaded, the refresh chip 2 provides a read enable signal and a clock signal to the PROM chip 3 through the control line and clock line, and reads the program data of the FPGA program from the data line. Furthermore, the load configuration signal line of the refresh chip 2 is connected to the SRAM-type FPGA chip 1, which is responsible for loading the on-orbit maintenance system after power-on and for periodically refreshing it during operation to reduce single-event accumulation effects.

[0047] The PROM chip 3 has good single-event immunity and is used to store program data for the FPGA program. Furthermore, the PROM chip 3 has good radiation immunity. Using the PROM chip 3 as the storage chip for the FPGA program in the circuit design can ensure the reliability of the entire on-orbit maintenance system.

[0048] The DSP chip 5 is the device being maintained in the on-orbit maintenance system of this invention. It is connected to the SRAM-type FPGA chip 1 through the EMIF interface (External Memory Interface) and GPIO (General-Purpose Input / Output) pins. The EMIF interface is used to load the program after power-on, and the GPIO pins are used to implement the chip monitoring function.

[0049] The MRAM chip 4 is responsible for storing DSP program data. Its data lines, address lines, chip select signal and read / write signal lines are all connected to the SRAM-type FPGA chip 1. The MRAM chip 4 is a non-volatile magnetoresistive device that is powered off. It has a fast read / write speed, can be read and written by chip area and address, and is not sensitive to single-event events, so it has extremely high system efficiency and reliability.

[0050] Furthermore, the MRAM chip 4 utilizes the magnetic structure of electron spin to store information, possessing non-volatility and high-speed read / write capabilities. For example... Figure 2 As shown, the four memory areas inside the MRAM chip 4 have independent control signals and shared address and data lines. Therefore, based on the characteristic that each area can be enabled independently, the MRAM memory chip is defined as four memory areas: CE0, CE1, CE2, and CE3. Each memory area has a capacity of 2M×8bit, and the total capacity is 8M×8bit. In this invention, CE3 is used as a spare area, while CE0, CE1, and CE2 are used as program tri-mode storage areas. CE0 is the main area for the DSP program, and CE1 and CE2 are backup areas. Each area stores a complete set of DSP programs. In addition, because the on-orbit maintenance system in this invention adds a reliability reinforcement design of check word comparison in addition to tri-mode redundancy verification, an extra 4-byte CRC check word is added after the DSP program data. The data length recognized by the DSP chip bootloader is not modified, so it will not affect the loading of DSP software. Taking the CE0 memory area as an example, each CE0 memory area contains: N sets of DSP program data and N 4-byte check words added after each set of DSP program data for CRC verification.

[0051] Furthermore, the on-orbit maintenance method for a self-repairing spaceborne DSP designed in this invention supports packet-based retransmission and partial uploading during on-orbit programming operations. Therefore, the current frame number needs to be explicitly specified in the on-orbit programming data packet. The specific data frame structure is as follows: Figure 3As shown, it includes a frame header, identifier, frame sequence number, frame length, valid data length, software file content, and identifier-software file content sum, all connected in sequence. The frame header and identifier are key bytes for identifying frame data; the frame sequence number is used to calculate the starting address of the valid data in the current frame within the MRAM chip 4; the frame length represents the total length from the frame header to the sum; the valid byte data length characterizes the length of the valid data in this frame; the software file content is the valid data within this frame, which is the DSP program data content; and the identifier-software file content sum is the sum from the identifier to the software file content. It should be noted that... Figure 3 This is only the necessary information.

[0052] Furthermore, the self-repairing on-orbit maintenance method for spaceborne DSP designed in this invention supports packet-based retransmission and partial uploading during on-orbit programming operations. Therefore, it is necessary to transmit the verification information of each frame to the ground telemetry system in the form of a bitmap table. The verification criterion is defined as follows: if the checksum and frame sequence number of each frame match, set the result to 1; otherwise, set it to 0. The verification result is then updated in the bitmap table, with each frame representing 1 bit in the table, updated from the most significant bit to the least significant bit. The specific bitmap table structure is as follows: Figure 4 As shown in the figure, the first row represents the first byte of the frame returned by the bitmap, which is the verification result of the first 8 frames. The verification is performed sequentially from Bit7 to Bit0, verifying all the data in each frame. After the verification is completed, the data is transmitted to the ground telemetry byte by byte.

[0053] Furthermore, the operation and maintenance flowchart of the self-repairing on-orbit DSP maintenance method is as follows: Figure 5 As shown, the implementation steps of this process include:

[0054] S1. Power on the on-orbit maintenance system.

[0055] After the on-orbit maintenance system is powered on, the refresh chip 2 reads the FPGA program data from the PROM chip 3 and loads it into the SRAM-type FPGA chip 1, and refreshes the FPGA program periodically after the on-orbit maintenance system is running normally.

[0056] S2. The SRAM-type FPGA chip selects the DSP program data of the target chip address from the MRAM chip for tri-modal redundancy comparison and error correction, as well as CRC checksum verification, to determine whether the verification passes. If yes, proceed to S3; otherwise, proceed to S5. Specific implementation steps include:

[0057] S21. Read the target DSP program data stored in the target address of different areas in the MRAM chip 4 byte by byte. In this embodiment, the DSP program data of groups A_1, A_2 and A_3 are read respectively, and the three groups of byte data read are recorded as data_tmr1, data_tmr2 and data_tmr3 respectively.

[0058] S22. Compare the three sets of byte data read byte by byte. If all three sets of byte data are the same, the three-modulus redundancy check is considered to have passed, and continue to S23. If two sets of byte data are the same, the two sets of byte data are considered to be correct data, and the different sets of byte data are considered to be incorrect data. Write the correct byte data back to the storage address of the incorrect byte data in MRAM chip 4, and continue to S23. If all three sets of byte data are different, the three-modulus redundancy check error correction has not passed, and continue to S5.

[0059] S23. After the three-mode redundancy comparison and error correction of the target DSP program data is completed, the content of the target DSP program data stored in each area is exactly the same. Therefore, select any area of ​​the target DSP program data to perform CRC check on its CRC check word to realize multiple checks of the program data; if it passes, continue to S3; if it fails, continue to S5.

[0060] S3 and DSP chip 5 are mapped to the target area address and DSP program data is loaded.

[0061] When the three-mode redundancy comparison and error correction of the target DSP program data in S2 is completed and the CRC check word verification is passed, the read address of the DSP program data sent by the EMIF interface of the DSP chip 5 and the chip select signal of the MRAM chip 4 are mapped to the target chip address. Then, a reset operation is performed on the DSP chip 5, and the bootloader is waited for the target DSP program to be automatically loaded.

[0062] S4. Determine if the monitoring function of DSP chip 5 is normal; if yes, continue normal operation; if no, go to S2 for re-verification.

[0063] After the DSP program of DSP chip 5 runs normally, it periodically sends pulse signals to SRAM-type FPGA chip 1 through GPIO pins. If no pulse signal is received within a limited time, SRAM-type FPGA chip 1 determines that the DSP program is in an abnormal state and executes S2-S3 operations again to reload the DSP program. After the DSP program runs normally, when MRAM chip 4 is idle, SRAM-type FPGA chip 1 performs tri-modal redundancy comparison error correction and CRC check word verification on the remaining DSP program data stored in its internal chip area, and then performs telemetry verification.

[0064] The S5 and SRAM-type FPGA chips transmit the area address of the DSP program data that failed the verification through telemetry and execute satellite platform instructions to repair the DSP program data.

[0065] When a single error occurs in the FPGA program data of SRAM-type FPGA chip 1 in S2, the error data is corrected and written back according to the result of the three-mode redundancy comparison error correction, and the storage area of ​​the DSP program data is self-repaired. Then, the DSP program data after the three-mode redundancy comparison error correction is judged by CRC check word. Program data that fails the check word is not accepted.

[0066] When all three sets of DSP program data in the target area fail to pass verification (e.g., the three sets of byte data are different), an error message is reported, and the address of the DSP program data with the verification error is telemetry-transmitted. The satellite platform then selects to perform error block repair, program version switching, or global on-orbit programming operation.

[0067] S6. Execute the block repair command.

[0068] When the FPGA program receives the block repair instruction, the ground will separately annotate the data frame containing the erroneous data and mark the frame sequence information. The SRAM-type FPGA chip 1 will calculate the starting address for writing and start the verification and writing operation, thereby performing fast and reliable block repair of the MRAM chip 4 through partial annotation.

[0069] S7, execute the program version switching command.

[0070] When the FPGA program receives a program version switching instruction, it switches to another target chip address of MRAM chip 4 and returns to execute the S2 operation to reload the DSP software.

[0071] S8. Execute global on-orbit programming instructions.

[0072] When the FPGA program receives a global on-orbit programming instruction, it needs to perform a global on-orbit programming operation, the flowchart of which is as follows. Figure 6 As shown, the specific implementation steps include:

[0073] S81, Receive and verify on-orbit programming data.

[0074] The system receives and verifies on-orbit programming data via an external interface. Based on the data frame structure, after the data is judged through the frame header, a checksum is performed and accumulated from the identifier to the program file content. The calculated checksum is compared with the received checksum, and the locally counted frame sequence number is compared with the received frame sequence number. If both match, the corresponding bit in the bitmap table is set to 1; otherwise, it is set to 0.

[0075] S82. Return the verified bitmap table to the ground and determine whether the bitmap table is valid; if yes, go to S83; if no, go to S84.

[0076] S83, bitmap table passed.

[0077] When the bitmap table is passed, the FPGA program waits for the on-orbit programming confirmation instruction. Upon receiving the on-orbit programming confirmation instruction, it writes the on-orbit programming data to the target address segments of the CE0, CE1 and CE2 areas of the MRAM chip 4, completes the on-orbit programming operation, and returns a successful telemetry result.

[0078] S84, bitmap table not all passed.

[0079] When the bitmap table is not completely passed, the FPGA program waits for the erroneous M and N frames to be re-uploaded, and then executes S81 again to perform reception verification on the re-uploaded M and N frames until the data is completely correct. Then, it executes S82 to S83 to complete the on-orbit programming operation.

[0080] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A self-repairable on-orbit maintenance method for a spaceborne DSP, implemented using an on-orbit maintenance system for maintaining and managing the DSP chip; the on-orbit maintenance system comprises: an SRAM-type FPGA chip connected to the DSP chip, and an MRAM chip connected to the SRAM-type FPGA chip, characterized in that, The on-orbit maintenance method includes the following steps: S1. Power on the on-orbit maintenance system; S2. The SRAM-type FPGA chip selects the DSP program data of the target chip address from the MRAM chip, performs three-mode redundancy comparison and error correction, and CRC check word verification, and determines whether the verification passes; if yes, proceed to S3. No, switch to S5; S3: The DSP chip is mapped to the target chip address and the DSP program data is loaded. S4. Determine if the monitoring function of the DSP chip is normal; if yes, continue normal operation; if no, go to S2 to re-verify. The S5 and SRAM-type FPGA chips remotely transmit the area address of the DSP program data that failed verification and execute satellite platform instructions to repair the DSP program data. The MRAM chip contains at least three regions, each region storing a complete set of DSP programs; each complete set of DSP programs contains multiple sets of DSP program data and multiple CRC checksums appended to each set of DSP program data. S2 specifically includes the following steps: S21. The FPGA program reads the three sets of target DSP program data stored in the target address of different areas in the MRAM chip byte by byte. S22. The FPGA program will perform three-mode redundancy comparison and error correction on a byte-by-byte basis on the three sets of target DSP program data read. When the three sets of target DSP program data are all the same, error correction is performed by comparing and correcting the three-mode redundancy, and then S23 continues; When two sets of target DSP program data are the same, they are considered to be correct data. Different target DSP program data are considered to be incorrect data. The correct data is written back to the storage address of the incorrect data in the MRAM chip, and error correction is performed by three-mode redundancy comparison. Then, S23 continues. When the three sets of target DSP program data are all different, the error correction is not passed by the three-mode redundancy comparison, and S5 continues; S23. The FPGA program performs a CRC check on the CRC checksum of the target DSP program data in any of the three areas; if it passes, continue to S3; if it fails, continue to S5.

2. The on-orbit maintenance method for a self-repairing spaceborne DSP as described in claim 1, characterized in that, The on-orbit maintenance system also includes: a refresh chip connected to an SRAM-type FPGA chip, and a PROM chip connected to the refresh chip; In S1, after the on-orbit maintenance system is powered on, the refresh chip reads the FPGA program data from the PROM chip and loads it into the SRAM-type FPGA chip, and refreshes the FPGA program periodically after the on-orbit maintenance system is running normally.

3. The on-orbit maintenance method for a self-repairing spaceborne DSP as described in claim 1, characterized in that, In S3, when the S2 verification passes, the read address of the DSP program data sent by the DSP chip is mapped to the target chip address along with the chip select signal of the MRAM chip. Then, a reset operation is performed on the DSP chip to automatically load the target DSP program.

4. The on-orbit maintenance method for a self-repairable spaceborne DSP as described in claim 1, characterized in that, In S4, after the DSP program of the DSP chip runs normally, it periodically sends pulse signals to the SRAM-type FPGA chip. When no pulse signal is received within a limited time, the SRAM-type FPGA chip determines that the DSP program is in an abnormal state and executes S2~S3 again to complete the reloading of the DSP program.

5. The on-orbit maintenance method for a self-repairable spaceborne DSP as described in claim 1, characterized in that, In S5, when the S2 check fails, the following steps are specifically included: S6, FPGA program executes block repair instructions; S7: The FPGA program executes the program version switching instruction, switches to another target chip address of the MRAM chip, and returns to execute the S2 operation to reload the DSP program; S8, FPGA program executes global on-orbit programming instructions.

6. The on-orbit maintenance method for a self-repairing spaceborne DSP as described in claim 5, characterized in that, In S6, when the FPGA program receives the block repair instruction, the ground will separately annotate the data frame containing the erroneous data and mark the frame sequence information. The SRAM-type FPGA chip will calculate the starting address for writing and start the verification and writing operation, thereby performing fast and reliable block repair of the MRAM chip through partial annotation.

7. A self-repairable on-orbit maintenance method for a spaceborne DSP as described in claim 5, characterized in that, S8 specifically includes the following steps: S81. Receive and verify on-orbit programming data; S82. Return the verified bitmap table to the ground and determine whether the bitmap table passes; if yes, proceed to S83. No, proceed to S84; S83 and bitmap table passed; S84, bitmap table not all passed.

8. A self-repairable on-orbit maintenance method for a spaceborne DSP as described in claim 7, characterized in that, In S81, the bitmap table verification criteria are as follows: according to the data frame structure, after the data is judged by the frame header, the checksum from the identifier to the program file content is checked and accumulated; the calculated checksum is compared with the received checksum, and the frame sequence number of the local count is compared with the received frame sequence number. If both pass, the corresponding bit in the bitmap table is set to 1; otherwise, it is set to 0.

9. A self-repairable on-orbit maintenance method for a spaceborne DSP as described in claim 7, characterized in that, In S83, when the bitmap table passes, the FPGA program waits for the on-orbit programming confirmation instruction. Upon receiving the on-orbit programming confirmation instruction, it writes the on-orbit programming data to the target address segments of the three areas of the MRAM chip, completes the on-orbit programming operation, and returns a successful telemetry result. In S84, when the bitmap table does not pass completely, the FPGA program waits to re-upload the erroneous frames, executes S81 again, verifies the received re-uploaded frames until the data is completely correct, and then executes S82~S83 to complete the on-orbit programming operation.

Images