A method for verifying structured startup modules of onboard software

Abstract

This invention relates to a method for verifying a structured startup module for spaceborne software, belonging to the field of space technology. The invention verifies the structured startup module of spaceborne software, checking whether the software's operating state is consistent with the design under conditions such as initial power-on, reset, system disconnection, and power-off, whether it can transition to the normal operating process, and whether it can guarantee the normal operation of the spacecraft. This invention verifies, on the one hand, the rationality of the software design and whether it can achieve the expected results; on the other hand, it verifies the correctness of the software logic, verifying the operating logic of the computer upon initial power-on, as well as the correctness of fault logic and process jumps, ensuring the stable operation of the spacecraft in orbit.

Description

Technical Field

[0001] This invention relates to a method for verifying a structured startup module for spaceborne software, belonging to the field of space technology. Background Technology

[0002] The spacecraft satellite management unit is a core component of the spacecraft's electronic system, primarily using the onboard computer to perform satellite management tasks. Typical spacecraft satellite management tasks include telemetry, remote control, power, thermal control, bus management, and time management. The default software startup process assumes normal operation, meaning the computer powers on and runs its various functional modules without considering abnormal operating conditions.

[0003] During the operation of spacecraft in orbit, due to factors such as the complexity of the space environment, the long on-orbit operation period, and the influence of single-ion effects on semiconductor memory, computers may experience active or passive reset, shutdown, or even satellite power failure.

[0004] When onboard software malfunctions, the traditional approach is for flight control personnel to manually resolve the fault based on the telemetry and control (TT&C) arc segment. However, because the visible TT&C arc segment is small, real-time manual interpretation and fault handling are impossible. This can lead to uncontrollable spacecraft actions during the unvisible TT&C arc segment, potentially resulting in serious and unpredictable consequences. Summary of the Invention

[0005] The technical problem solved by this invention is to overcome the shortcomings of the prior art and provide a method for verifying the structured startup module of spaceborne software, thereby solving the problem of verifying the functionality of the startup module during the integrated ground testing phase of a spacecraft.

[0006] The technical solution of this invention is: a method for verifying a structured startup module for onboard software, comprising:

[0007] The startup module is designed with entry and exit conditions; the entry conditions include whether the 1553B communication link is successfully established, whether the preset data is successfully restored, and whether the FLASH data parsing is effective.

[0008] Based on the software status requirements of different output ports, the software status is set to be the opposite of the default status. The process entry conditions are constructed through test cases to trigger the startup module to work and determine whether the process exit meets the design requirements. The software status includes thermal control software status enabled / disabled, energy software enabled / disabled, energy mode, remote control open / closed status, and main / backup FLASH enabled / disabled status.

[0009] Based on different output port flags, set flags that are inconsistent with the output flags, construct process entry conditions through test cases, trigger the startup module to work, and determine whether the software program call status meets the design requirements; the working conditions of the output include ground test process, reset and switch process, whole satellite power failure process, and whole satellite power failure and FLASH data invalidation process.

[0010] Furthermore, the entry condition of the startup module is judged; if the 1553B communication link construction fails, the ground test process is entered; if the 1553B communication link construction is successful, it is judged whether the preset data has been successfully restored; if the restoration is successful, the reset and switching process is entered; if the restoration fails, it is judged whether the FLASH data parsing is valid; if valid, the whole satellite power-off process is entered; if invalid, the whole satellite power-off and FLASH data invalidation process is entered.

[0011] Furthermore, the successful establishment of the 1553B communication link is defined as correct interaction between the host computer and the slave computer at the 1553B bus link layer, including correct response to messages sent by the BC end and correct status word return from the RT end. After power-on, the host computer establishes 1553B bus link information with each slave computer through polling. The criteria for successfully establishing a 1553B communication link include: successful communication among any slave computer. The criteria for unsuccessfully establishing a 1553B communication link include: failure of communication between the host computer and all slave computers on the main and backup 1553B bus.

[0012] By setting the 1553B slave device to power on and the communication status table to be correct, a normal communication condition for the 1553B is constructed; by setting the 1553B slave device to power off or power on but with an error in the communication status table, an abnormal communication condition for the 1553B is constructed.

[0013] Furthermore, determining whether the preset data was successfully recovered includes: during the preset data recovery process, data is first recovered from one lower-level machine. If the preset data recovery is successful, the preset data recovery stops. If the preset data recovery fails, the preset data is recovered from another lower-level machine. If that lower-level machine recovers the data successfully, the preset data recovery stops. The indication of successful preset data recovery is that the preset data is successfully recovered from either of the two lower-level machines. The indication of failed preset data recovery is that the preset data is failed to be recovered from both lower-level machines.

[0014] By setting the lower-level machine with preset data save and restore function to power on, ensuring the communication status table is correct and the power-on time exceeds the preset data save time requirement, a working condition is constructed where 1553B communication is normal and preset data storage and restore are successful. By setting the lower-level machine with preset data save and restore function to not power on, and other lower-level machines to power on and ensure the communication status table is correct, a working condition is constructed where 1553B communication is normal but preset data storage and restore are unsuccessful.

[0015] Furthermore, whether the FLASH data parsing is effective includes: the recovery process of preset important data in FLASH. The order of using the preset important data in FLASH is as follows: first use the remote master FLASH data. If the data is effective after parsing, then use the master FLASH data. If the data is invalid after parsing, then use the remote backup FLASH data. If it is effective, then use the backup FLASH data. If the data is invalid after parsing, then the FLASH data recovery is considered to have failed.

[0016] By performing a FLASH write operation, data representing the true meaning is written to the corresponding address in the FLASH, thus constructing a valid FLASH data parsing condition; by performing a FLASH write operation, erroneous data is written to the corresponding address in the FLASH, thus constructing an invalid FLASH data condition; the specific data written includes satellite time, flight stage, satellite-rocket separation status, internal bus communication status, and 1553B lower-level machine communication status.

[0017] Furthermore, the ground testing process includes: whether the internal bus communication status table and the lower-level machine communication status table are in master status, and whether other software parameter values ​​are consistent with the preset status of the ground testing process.

[0018] Furthermore, the reset and switching process includes: whether all data stored in the lower-level PCDU has been successfully restored, whether the satellite time is continuous, whether it is SRAM satellite time, and whether other software parameter values ​​are consistent with the preset state of the ground test process.

[0019] Furthermore, the entire satellite power-off process includes: whether all data stored in FLASH has been successfully restored, including the internal bus communication status table, the lower-level machine communication status table, whether the satellite time is the FLASH stored satellite time, whether the satellite time flag is the FLASH satellite time, and whether other software parameters are the initial software binding values.

[0020] Furthermore, the process of the entire satellite losing power and FLASH data becoming invalid includes: whether the satellite time is the default satellite time, whether the communication status with the lower-level machine's 1553B bus and the internal module's communication status are backup, and whether the orbit marker is a transfer orbit; the communication status table selection rule is: executed according to the link establishment result, if two copies are connected, the primary copy is selected by default, and if two copies are not connected, the backup copy is selected by default; whether the software is the initial binding parameter value.

[0021] A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the onboard software structured startup module verification method.

[0022] The advantages of this invention compared to the prior art are:

[0023] (1) The present invention can complete the verification of the structured startup module of the on-board software, and verify whether the software running status is consistent with the design under the working conditions of initial power-on, reset, switch-off, power-off, etc., whether it can flow to the normal working process, and whether it can ensure the normal operation of the spacecraft.

[0024] (2) This invention modifies the FLASH content through instruction uploading, simulating valid and invalid FLASH data conditions to determine whether the behavior of the onboard software meets design expectations. Common soft errors caused by single-ion effects include single-event upsets, single-event transients, and single-event interruptions. These require relatively low energy thresholds, resulting in a high probability of soft errors in the equipment. However, the logic circuits are not permanently damaged and can be restored to normal operation by rewriting data or restarting the device. Rewriting data is a common operation in spacecraft design. This invention provides a simple operational method to verify the correctness of FLASH read / write operations, applicable to system-level verification of single-machine systems containing FLASH memory.

[0025] (3) The host computer periodically stores important data that needs to be saved into the memory of a specific slave computer. When a reset or machine switch occurs, the host computer reads the important data from the slave computer via the 1553B bus to restore the normal operation of the system. This invention provides a simple method to verify the correctness of the slave computer's important data saving and recovery function, thereby verifying the correctness of the communication protocol. Attached Figure Description

[0026] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings:

[0027] Figure 1 This is a flowchart illustrating the design of the startup module of this invention.

[0028] Figure 2 This is a flowchart of the startup module verification process of the present invention. Detailed Implementation

[0029] To better understand the above technical solutions, the technical solutions of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solutions of the present invention, rather than limitations on the technical solutions of the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0030] The following description, in conjunction with the accompanying drawings, provides a more detailed explanation of the method for verifying a structured startup module for onboard software provided by an embodiment of the present invention. Figure 1Specific implementation methods may include: decomposing and analyzing the module's input and output ports by analyzing the requirements of the structured startup module.

[0031] There are three options for designing the module's entry point operating condition:

[0032] 1) “Successfully established 1553B bus communication link” means that the host computer and the slave computer interact correctly at the 1553B bus link layer (the status word returned by the RT end is correct for the message sent by the BC end). After the host computer is powered on, it establishes 1553B bus link information with each slave computer through polling.

[0033] The criterion for successfully establishing a 1553B communication link is: if any communication in the lower-level machine is successful, the communication link is considered to be successfully established.

[0034] The criterion for failing to establish a 1553B communication link is: if the communication between the host computer and all slave computers fails to communicate via the main backup 1553B bus, then the communication link is considered to have failed to be established.

[0035] By setting the 1553B slave device to power on and the communication status table to be correct, a normal communication condition for the 1553B is constructed; by setting the 1553B slave device to power off or power on but with an error in the communication status table, an abnormal communication condition for the 1553B is constructed.

[0036] 2) "Successful recovery of important data" means that during the important data recovery process, recovery is first performed on one lower-level machine. If the important data is successfully recovered, the recovery process stops. If the important data recovery fails, the important data is recovered from the other lower-level machine. If the recovery from that lower-level machine is successful, the recovery process stops. The sign of successful important data recovery is that the important data is recovered successfully on either of the two lower-level machines. The sign of failed important data recovery is that the important data recovery fails on both lower-level machines.

[0037] By setting the lower-level machine with important data saving and recovery functions to power on, ensuring the communication status table is correct and the power-on time exceeds the important data saving time requirement, a working condition is constructed where the 1553B communication is normal and the important data storage and recovery is successful. By setting the lower-level machine with important data saving and recovery functions to not power on, while other lower-level machines are powered on and their communication status tables are correct, a working condition is constructed where the 1553B communication is normal but the important data storage and recovery is unsuccessful.

[0038] 3) "FLASH data parsing is valid" refers to the recovery process of important data in FLASH. The order of using important data in FLASH is as follows: first use the remote master FLASH data. If the data is valid after parsing, then use the master FLASH data. If the data is invalid after parsing, then use the remote backup FLASH data. If the data is valid, then use the backup FLASH data. If the data is invalid after parsing, then the FLASH data recovery is considered to have failed.

[0039] By performing a FLASH write operation, data representing the true meaning is written to the corresponding address in the FLASH, thus constructing a valid FLASH data parsing condition; by performing a FLASH write operation, erroneous data is written to the corresponding address in the FLASH, thus constructing an invalid FLASH data condition; the specific data written includes parameters such as satellite time, flight stage, satellite-rocket separation status, internal bus communication status, and 1553B lower-level machine communication status.

[0040] There are two options for designing the module's output operating conditions:

[0041] 1) Based on the software status requirements of different output ports, set the software status to be the opposite of the default. Construct the process entry conditions through test cases to trigger the startup module and determine whether the process exit meets the design requirements. Specific software statuses include thermal control software status enabled / disabled, energy software enabled / disabled, energy mode, remote control open / closed status, and main / backup FLASH enabled / disabled status, etc.

[0042] 2) Based on different output port flags, set flags that are inconsistent with the output flags. Construct process entry conditions through test cases to trigger the startup module to work and determine whether the software program call status meets the design requirements. Specifically, the startup module process is divided into four output processes: ground test process (process A), reset and warning process (process B), satellite power failure process (process C), and satellite power failure and FLASH data invalidation process (process D).

[0043] In the solutions provided in the embodiments of the present invention, such as Figure 2 The steps are as follows:

[0044] 1. Preparation of ground testing equipment.

[0045] Turn on the central control equipment, remote telemetry and control ground equipment, and ground power supply equipment to confirm that all ground equipment and testing systems are working properly.

[0046] 2. Power on the satellite.

[0047] The satellite was confirmed to be powered on normally, the bus voltage was stable, and the telemetry and remote control channels were functioning correctly.

[0048] 3. Power on and start up the onboard equipment of the satellite management and telemetry unit.

[0049] According to the test configuration requirements, power on all modules within the Satellite Management and Telemetry Unit (STMU) and configure the correct internal bus communication mode. Specifically, these include: CPU module (CM module), remote control and fault tolerance module (TC module), acquisition and discrete command module (CB module), matrix command and matrix telemetry module (MA module), and power distribution module (PW module).

[0050] 4. Confirm that the STMU lower-level machine is in a state of no power-on.

[0051] As the BC terminal of the 1553B bus, the STMU has several individual units on the RT terminal, including the Power Control and Distribution Unit (PCDU), the Integrated Battery Management Unit (UMU), and the Attitude and Orbit Control Unit (AOCU). According to the 1553B bus communication protocol, the driver software communicates with the lower-level machines primarily based on the communication status table. Information is exchanged with each individual unit on its shift each cycle. Specifically, telemetry data from the lower-level machines is collected once every 448ms, and remote control commands are randomly sent to each lower-level machine. If all lower-level machines are powered off, communication will fail. Therefore, it is necessary to configure all RT-end lower-level machines to be powered off, and all source packets containing the RT-end lower-level machines to have no data transmission.

[0052] 5. Reset the Star Service CPU.

[0053] Send a CPU master / backup module reset command, determine whether the software exit process flag is process A, whether the internal bus communication status table and the lower-level machine communication status table are in master status, and whether other software parameter values ​​are consistent with the design status of process A.

[0054] 6. Power on the lower-level PCDU.

[0055] According to the 1553B protocol, the STMU periodically (64S) saves important software data to the PCDU and UMU, but does not have the function of saving important data to other lower-level machines.

[0056] Send the PCDU primary / backup power-on command to confirm that the PCDU is powered on. Set the PCDU primary / backup A / B channels to start working. After confirming that the PCDU's 1553B source package is updated, start timing and wait for more than two data storage cycles. Set the wait time to 3 minutes and confirm that important data has been saved successfully.

[0057] 7. Star Service CPU switchover.

[0058] Send CPU main power-off and backup power-on commands, confirm CPU backup power-on, determine whether the software exit process flag is process B, whether all important data stored in the lower-level PCDU has been successfully restored, whether the star time is continuous, whether it is SRAM star time, and whether other software parameter values ​​are consistent with the design state of process A.

[0059] 8. B process status restored.

[0060] Send a PCDU power-off recovery command to confirm PCDU shutdown; source package data will not be updated. Restore the relevant software status to the software binding default value.

[0061] 9. Power on the lower-level AOCU.

[0062] Send the AOCU primary / backup power-on command to confirm that the AOCU is powered on. Configure the AOCU primary / backup A / B channels to operate on a shift basis. After confirming that the AOCU's 1553B source package is updated, start timing and wait for at least two data storage cycles.

[0063] 10. Satellite power outage.

[0064] Disconnecting the satellite power supply path indicates that satellite frame counting has stopped.

[0065] 11. Power on the satellite.

[0066] Provide satellite power supply path, determine if satellite frame counting is normal, check if the software exit process flag is C process, check if all important data stored in FLASH has been successfully restored, including internal bus communication status table, lower-level machine communication status table, whether the satellite time is the FLASH stored satellite time, whether the satellite time flag is the FLASH satellite time, and whether other software parameters are the initial software binding values.

[0067] 12. C process status restoration.

[0068] Send commands to restore the hardware and software states related to the C process, ensuring that only the AOCU is powered on in the lower-level machine, while all other lower-level machines are powered off. Pay special attention to restoring the battery pack's power supply status, ensuring that the battery pack is disconnected from the satellite power supply.

[0069] 13. Write FLASH error messages.

[0070] Write the error content to the FLASH memory according to the instruction format required in Appendix 1. For example, if the valid data for data 1 is AAAA or 0000, then you can write the error data BBBB in the write instruction. Ensure that the instruction format is correct and can be recognized by the software, but the data is invalid. Confirm that the error data has been written by checking the telemetry data of the source packet where the FLASH memory is located.

[0071] Table 1. Command Format for Writing FLASH Data Area

[0072]

[0073] 14. Satellite power outage.

[0074] Disconnecting the satellite power supply path indicates that satellite frame counting has stopped.

[0075] 15. Power on the satellite.

[0076] Provide satellite power supply path, determine if satellite frame count is normal, check if the software exit process flag is D process, if the satellite time is the default satellite time, check if the communication status with the lower-level machine's 1553B bus and the internal module communication status is backup, and check if the orbit flag is transfer orbit; the communication status table selection rule is: execute according to the link establishment result, if two copies are connected, the primary copy is selected by default, if two copies are not connected, the backup copy is selected by default; check if the software is the initial binding parameter value.

[0077] 16. Status restored.

[0078] After the test, restore the status of each system, shut down all lower-level machines, and power off the entire satellite.

[0079] This invention provides a computer-readable storage medium storing computer instructions that, when executed on a computer, cause the computer to perform... Figure 1 The method described.

[0080] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.

[0081] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1A device that provides the functions specified in one or more boxes.

[0082] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0083] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0084] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

[0085] The contents not described in detail in this specification are common knowledge to those skilled in the art.

Claims

1. A method for verifying a structured startup module for spaceborne software, characterized in that, include: Design the ingress and egress conditions of the startup module; The entry conditions include whether the 1553B communication link is successfully established, whether the preset data is successfully restored, and whether the FLASH data parsing is effective. Based on the software status requirements of different output ports, the software status is set to be the opposite of the default status. The process entry conditions are constructed through test cases to trigger the startup module to work and determine whether the process exit meets the design requirements. The software status includes thermal control software status enabled / disabled, energy software enabled / disabled, energy mode, remote control open / closed status, and main / backup FLASH enabled / disabled status. Based on different exit condition flags, set flags that are inconsistent with the exit condition flags, construct process entry conditions through test cases, trigger the start-up module to work, and determine whether the software program call status meets the design requirements; the exit conditions include ground test process, reset and switch process, whole satellite power failure process, and whole satellite power failure and FLASH data invalidation process.

2. The method for verifying a structured startup module for onboard software according to claim 1, characterized in that, The entry condition of the startup module is determined; If the 1553B communication link cannot be established, the ground testing process will begin. If the 1553B communication link is successfully established, then determine whether the preset data has been successfully restored. If the recovery is successful, proceed to the reset and switching process; If recovery fails, check if the FLASH data parsing is valid; if valid, proceed to the whole satellite power-off process; if invalid, proceed to the whole satellite power-off and FLASH data invalidation process.

3. The method for verifying a structured startup module for onboard software according to claim 2, characterized in that, The successful establishment of the 1553B communication link means that the host computer and the slave computer interact correctly at the 1553B bus link layer, including the correct return of messages sent by the BC end and the status word returned by the RT end. After the host computer is powered on, it establishes 1553B bus link information with each slave computer through polling. The criteria for successfully establishing a 1553B communication link include: successful communication in any one of the lower-level machines; the criteria for unsuccessfully establishing a 1553B communication link include: failure of communication between the upper-level machine and all lower-level machine main and backup 1553B buses. By setting the 1553B slave device to power on and the communication status table to be correct, a normal communication condition for the 1553B is constructed; by setting the 1553B slave device to power off or power on but with an error in the communication status table, an abnormal communication condition for the 1553B is constructed.

4. The method for verifying a structured startup module for onboard software according to claim 2, characterized in that, Whether the preset data is successfully recovered includes: during the preset data recovery process, recovery is first performed from one lower-level machine. If the preset data recovery is successful, the preset data recovery stops. If the preset data recovery fails, the preset data is recovered from another lower-level machine. If the recovery from that lower-level machine is successful, the preset data recovery stops. The sign of successful preset data recovery is that the preset data is successfully recovered from either of the two lower-level machines. The sign of failed preset data recovery is that the preset data is failed to be recovered from both lower-level machines. By setting the lower-level machine with preset data save and restore function to power on, ensuring the communication status table is correct and the power-on time exceeds the preset data save time requirement, a working condition is constructed where 1553B communication is normal and preset data storage and restore are successful. By setting the lower-level machine with preset data save and restore function to not power on, and other lower-level machines to power on and ensure the communication status table is correct, a working condition is constructed where 1553B communication is normal but preset data storage and restore are unsuccessful.

5. The method for verifying a structured startup module for onboard software according to claim 2, characterized in that, Whether the FLASH data parsing is effective includes: the recovery process of preset important data in FLASH. The order of using the preset important data in FLASH is as follows: first use the remote master FLASH data. If the data is effective after parsing, then use the master FLASH data. If the data is invalid after parsing, then use the remote backup FLASH data. If it is effective, then use the backup FLASH data. If the data is invalid after parsing, then the FLASH data recovery is considered to have failed. By performing a FLASH write operation, data representing the true meaning is written to the corresponding address in the FLASH, thus constructing a valid FLASH data parsing condition; by performing a FLASH write operation, erroneous data is written to the corresponding address in the FLASH, thus constructing an invalid FLASH data condition; the specific data written includes satellite time, flight stage, satellite-rocket separation status, internal bus communication status, and 1553B lower-level machine communication status.

6. The method for verifying a structured startup module for onboard software according to claim 1, characterized in that, The ground testing process includes: whether the internal bus communication status table and the lower-level machine communication status table are in master status, and whether other software parameter values ​​are consistent with the preset status of the ground testing process.

7. The method for verifying a structured startup module for onboard software according to claim 1, characterized in that, The reset and switching process includes: whether all data stored in the lower-level PCDU has been successfully restored, whether the satellite time is continuous, whether it is SRAM satellite time, and whether other software parameter values ​​are consistent with the preset state of the ground test process.

8. The method for verifying a structured startup module for onboard software according to claim 1, characterized in that, The entire satellite power-off process includes: whether all data stored in FLASH has been successfully restored, including the internal bus communication status table, the lower-level machine communication status table, whether the satellite time is the FLASH stored satellite time, whether the satellite time flag is the FLASH satellite time, and whether other software parameters are the initial software binding values.

9. The method for verifying a structured startup module for onboard software according to claim 1, characterized in that, The process of the entire satellite losing power and FLASH data becoming invalid includes: whether the satellite time is the default satellite time, whether the communication status with the lower-level machine's 1553B bus and the internal module's communication status are backup, and whether the orbit marker is a transfer orbit; the communication status table selection rule is: executed according to the link establishment result, if two copies are connected, the primary copy is selected by default, and if two copies are not connected, the backup copy is selected by default; whether the software is the initial binding parameter value.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 9.

Images