High-reliability spaceborne antenna software reconstruction and exception handling method and device

Abstract

The invention relates to a high-reliability spaceborne antenna software reconstruction and exception handling method and device. The method comprises the following steps: receiving a reconstruction frame message sent by a ground station through a satellite-ground link, receiving the reconstruction frame message by a satellite service computer, and forwarding the reconstruction frame message to an antenna controller; the antenna controller receives the reconstructed data message, and carries out firmware uploading on the reconstructed frame message; after firmware uploading is finished, the PS end starts reconstruction, a reconstruction frame message is verified in a preset mode, the reconstruction frame message is written into the reconstruction area, and in the execution process, packet telemetering is conducted on the reconstruction state of the satellite service computer; and the antenna controller receives a code instruction for loading the reconstruction area, skips an execution code of the antenna controller to a code instruction for running the reconstruction area, and sends a telemetering message to the satellite service computer to report the running state of the current reconstruction firmware after the code instruction is started. By adopting the method, software reconstruction can be realized.

Description

Technical Field

[0001] The present application relates to the technical field of software reconstruction, and in particular to a high-reliability satellite antenna software reconstruction and exception handling method and device. Background Art

[0002] Software is an important component of aerospace electronic systems and is also the control carrier and information processing center for realizing spacecraft functions. With the continuous development of aerospace technology, on the one hand, the operating life of spacecraft is constantly extending, and the mission requirements are constantly evolving. On the other hand, the functional complexity of onboard software is getting higher and higher. It is difficult to avoid deep hidden bugs that cannot be discovered during ground testing. In this case, on-orbit reconstruction, upgrading, and updating of onboard software has become one of the essential functions of spacecraft electronic equipment.

[0003] In order to quickly, conveniently and reliably realize the on-orbit reconstruction and upgrade of onboard software, and to ensure the recovery of abnormal situations of onboard software, two problems must be solved first. First, the complexity of onboard software is increasing, and the corresponding software scale is also increasing. In particular, the application of large-scale FPGA is becoming more and more extensive, and its software scale has increased from the initial few Mbits to hundreds of Mbits. In this case, both the communication rate between satellite and ground and the transmission rate between devices inside the spacecraft have put forward higher requirements. Second, traditional software design mostly updates the software in the memory, which has the defects of insufficient content capacity and upgrade loss. In order to support the solidification of reconstruction and upgrade software, reprogrammable memory (NorFlash) needs to be used to realize software storage, and it is necessary to consider the irradiation environment causing the software stored in the memory to be rewritten, and then the failure of the onboard software to start and run normally occurs. Therefore, ensuring the fault-tolerant storage of onboard software is also a key link that needs to be solved. Summary of the invention

[0004] Based on this, it is necessary to provide a high-reliability satellite antenna software reconstruction and exception handling method and device to address the above technical problems.

[0005] A high-reliability satellite antenna software reconstruction and exception handling method is applied to a satellite, wherein the satellite comprises: a satellite service computer, an antenna controller and a storage area, wherein the storage area comprises: an internal eNVM storage area and an externally mounted NorFlash storage area; the eNVM storage area comprises: a factory firmware area and a reconstruction area, wherein the NorFlash storage area comprises: a first NorFlash storage area for storing controller data and reconstruction process data at a PS end and a second NorFlash storage area for storing factory firmware at a PL end; the method comprises:

[0006] The receiving ground station sends a reconstruction frame message through the satellite-to-ground link, the satellite service computer receives the reconstruction frame message, and forwards the reconstruction frame message to the antenna controller;

[0007] The antenna controller receives the reconstructed data message and performs firmware annotation on the reconstructed frame message;

[0008] After the firmware is uploaded, the PS starts the reconstruction, verifies the reconstruction frame message in a preset way, writes the reconstruction frame message into the reconstruction area, and packages and telemeters the reconstruction status to the satellite service computer during the execution process;

[0009] The antenna controller receives the code instruction for loading the reconstruction area, jumps the execution code of the antenna controller to the code instruction for running the reconstruction area, and after the code instruction is started, sends a telemetry message to the satellite service computer to report the current running status of the reconstruction firmware.

[0010] In one of the embodiments, the reconstructed frame message includes: an identification header, a version number, a firmware length, a firmware file, and a CRC check.

[0011] In one of the embodiments, the antenna controller receives a remote control command from the satellite computer, erases the reconstruction area and reports the erasure status, and receives a reconstruction enable command after the erasure is completed to set an enable flag and enter the reconstruction process.

[0012] In one of the embodiments, it also includes: the antenna controller receives the reconstructed data message, verifies the reconstructed data message, determines the first frame, middle frame and last frame information of the reconstructed data message, and when the reconstructed data message is the first frame, performs firmware annotation; reconstructs status information; the status information includes: frame count, write correct frame count, check error frame count and check error frame sequence number; when the reconstructed data message is the last frame, ends the firmware annotation.

[0013] In one of the embodiments, it also includes: the PS end starts the reconstruction execution according to the flag, compares and verifies the data by using the method of taking two out of three, and then writes it into the reconstruction area in the eNVM; during the execution process, the telemetry package is sent to the satellite service computer for reconstruction status; the content of the telemetry includes the progress of the current writing data and the verification result, so that the computer can obtain the status of the reconstruction process according to the measurement in real time, and the verification result includes whether the data verification passes and whether there is an error frame; if the data is found to be inconsistent during the process of comparing and verifying the data by taking two out of three, the PS end will re-verify and process the inconsistent data to ensure the accuracy of the data written to the reconstruction area. If there is still a problem after multiple verifications, the exception handling process will be triggered to report the abnormal status to the PL end.

[0014] In one of the embodiments, it also includes: after the antenna controller receives the code instruction for loading the reconstruction area, the code instruction is checked for legality; when the code instruction is legal, the antenna controller saves the context information of the currently running execution code; the context information includes the value of the current program counter, the register status and the memory mapping; according to the address information in the loading instruction, the execution code is jumped to the starting address of the reconstruction area, and the code instructions of the reconstruction area are started to be executed; in the process of running the code instructions of the reconstruction area, the execution status of the code is monitored in real time, and if an abnormality occurs, the execution of the reconstruction area code is stopped immediately, the previously saved context information is restored, the execution code is jumped back to the original position, and an abnormality report is sent to the satellite service computer.

[0015] A highly reliable satellite-borne antenna software reconstruction and exception handling device is applied to a satellite. The satellite comprises: a satellite service computer, an antenna controller and a storage area. The storage area comprises: an internal eNVM storage area and an externally mounted NorFlash storage area. The eNVM storage area comprises: a factory firmware area and a reconstruction area. The NorFlash storage area comprises: a first NorFlash storage area for storing controller data and reconstruction process data at the PS end and a second NorFlash storage area for storing factory firmware at the PL end. The device comprises:

[0016] A forwarding module, configured to receive a reconstruction frame message sent by a ground station through a satellite-to-ground link, and a satellite service computer receives the reconstruction frame message and forwards the reconstruction frame message to an antenna controller;

[0017] A firmware injection module is used for the antenna controller to receive the reconstructed data message and to inject firmware into the reconstructed frame message;

[0018] The reconstruction module is used to start the reconstruction at the PS end after the firmware is uploaded, verify the reconstruction frame message in a preset way, write the reconstruction frame message into the reconstruction area, and package and telemeter the reconstruction status to the satellite service computer during the execution process;

[0019] The running module is used for the antenna controller to receive the code instruction for loading the reconstruction area, jump the execution code of the antenna controller to the code instruction for running the reconstruction area, and after the code instruction is started, send a telemetry message to the satellite service computer to report the current running status of the reconstruction firmware.

[0020] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0021] The receiving ground station sends a reconstruction frame message through the satellite-to-ground link, the satellite service computer receives the reconstruction frame message, and forwards the reconstruction frame message to the antenna controller;

[0022] The antenna controller receives the reconstructed data message and performs firmware annotation on the reconstructed frame message;

[0023] After the firmware is uploaded, the PS starts the reconstruction, verifies the reconstruction frame message in a preset manner, writes the reconstruction frame message into the reconstruction area, and during the execution, packages the telemetry to the satellite service computer to send the reconstruction status;

[0024] The antenna controller receives the code instruction for loading the reconstruction area, jumps the execution code of the antenna controller to the code instruction for running the reconstruction area, and after the code instruction is started, sends a telemetry message to the satellite service computer to report the current running status of the reconstruction firmware.

[0025] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0026] The receiving ground station sends a reconstruction frame message through the satellite-to-ground link, the satellite service computer receives the reconstruction frame message, and forwards the reconstruction frame message to the antenna controller;

[0027] The antenna controller receives the reconstructed data message and performs firmware annotation on the reconstructed frame message;

[0028] After the firmware is uploaded, the PS starts the reconstruction, verifies the reconstruction frame message in a preset manner, writes the reconstruction frame message into the reconstruction area, and during the execution, packages the telemetry to the satellite service computer to send the reconstruction status;

[0029] The antenna controller receives the code instruction for loading the reconstruction area, jumps the execution code of the antenna controller to the code instruction for running the reconstruction area, and after the code instruction is started, sends a telemetry message to the satellite service computer to report the current running status of the reconstruction firmware.

[0030] The above-mentioned high-reliability satellite-borne antenna software reconstruction and exception handling method and device, the high-reliability satellite-borne antenna software reconstruction method has significant advantages. Through carefully designed storage area division and multiple verification mechanisms, such as eNVM partition storage, NorFlash multiple copies and three-mode verification, as well as firmware header identification and CRC verification, it effectively guarantees the security and accuracy of firmware data, greatly improves the reliability of software reconstruction, and effectively avoids reconstruction failures caused by storage or firmware errors. At the same time, the reconstruction process is divided into multiple stages and equipped with a complete exception handling mechanism, which can timely discover and handle problems at each stage, and can quickly restore to the factory state when an exception occurs, ensuring the stable operation of the antenna software. In addition, detailed telemetry status information is provided to the satellite computer at each stage of reconstruction, including erase status, frame count, reconstruction status, firmware running status, etc., which not only enables ground personnel to grasp the reconstruction process in real time, but also provides rich data support for system maintenance and management, enhances the maintainability and manageability of the system, and escorts the efficient and reliable operation of the satellite-borne antenna software. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a flowchart of a high-reliability satellite-borne antenna software reconstruction and exception handling method in one embodiment;

[0032] Figure 2 Reconstruct the overall block diagram for one embodiment;

[0033] Figure 3 A schematic diagram of a reconstructed storage area in one embodiment;

[0034] Figure 4 is a schematic diagram of reconstructing firmware in one embodiment;

[0035] Figure 5 A schematic diagram of a preparation stage in an embodiment;

[0036] Figure 6 A schematic diagram of the firmware injection stage in an embodiment;

[0037] Figure 7 A schematic diagram of a PS-side timing report in an embodiment;

[0038] Figure 8 is a flowchart of exception handling in one embodiment;

[0039] Fig. 9 The structure block diagram of a high-reliability satellite-borne antenna software reconstruction and exception handling device in one embodiment. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0041] In one embodiment, Figure 1 As shown in the figure, a high-reliability satellite antenna software reconstruction and exception handling method is provided. The method is applied to Figure 2 In the satellite in the invention, the satellite comprises: a satellite service computer, an antenna controller and a storage area, the storage area comprises: an internal eNVM storage area and an externally mounted NorFlash storage area; the eNVM storage area comprises: a factory firmware area and a reconstruction area, the NorFlash storage area comprises: a first NorFlash storage area for storing controller data and reconstruction process data on the PS side and a second NorFlash storage area for storing factory firmware on the PL side, comprising the following steps:

[0042] Step 102: The ground station sends a reconstruction frame message through the satellite-to-ground link, and the satellite service computer receives the reconstruction frame message and forwards the reconstruction frame message to the antenna controller.

[0043] Specifically, the ground station sends a reconstruction frame message to the satellite through the satellite-to-ground link. After receiving the reconstruction frame, the satellite service computer forwards the reconstruction frame to the antenna controller. The antenna controller parses the reconstruction frame message, starts firmware storage, and responds to the ground station according to the protocol frame status received for each frame.

[0044] Step 104: The antenna controller receives the reconstructed data message and performs firmware annotation on the reconstructed frame message.

[0045] Step 106, after the firmware is uploaded, the PS starts reconstruction, verifies the reconstructed frame message in a preset manner, writes the reconstructed frame message into the reconstruction area, and during the execution, packages the telemetry to the satellite service computer for reconstruction status.

[0046] Step 108, the antenna controller receives the code instruction for loading the reconstruction area, jumps the execution code of the antenna controller to the code instruction for running the reconstruction area, and after the code instruction is started, sends a telemetry message to the satellite service computer to report the current running status of the reconstruction firmware.

[0047] Among the above-mentioned high-reliability satellite-borne antenna software reconstruction and exception handling methods, the high-reliability satellite-borne antenna software reconstruction method has significant advantages. Through carefully designed storage area division and multiple verification mechanisms, such as eNVM partition storage, NorFlash multiple copies and three-mode verification, as well as firmware header identification and CRC verification, it effectively guarantees the security and accuracy of firmware data, greatly improves the reliability of software reconstruction, and effectively avoids reconstruction failures caused by storage or firmware errors. At the same time, the reconstruction process is divided into multiple stages and equipped with a complete exception handling mechanism, which can timely discover and handle problems at each stage, and can quickly restore to the factory state when an exception occurs, ensuring the stable operation of the antenna software. In addition, detailed telemetry status information is provided to the satellite computer at each stage of reconstruction, including erase status, frame count, reconstruction status, firmware running status, etc., which not only enables ground personnel to grasp the reconstruction process in real time, but also provides rich data support for system maintenance and management, enhances the maintainability and manageability of the system, and escorts the efficient and reliable operation of the satellite-borne antenna software.

[0048] Specifically, for the storage area division, such as Figure 3 As shown, the eNVM of M2S090 is divided into two areas, eNVM0 as the factory firmware area, and eNVM1 as the reconstruction area. Two NorFlash are mounted externally, one for the PS side to store the controller number and reconstruction process data, and the other for the PL side to store the factory firmware. The PL side external memory stores four factory firmware copies, and each copy uses three TMRs as three-mode verification. The firmware copy is when the factory firmware is abnormal, the PL side software moves the firmware copy to the factory firmware area; the reconstruction area loads the reconstruction firmware version according to the reconstruction firmware uploaded by the ground station.

[0049] In one of the embodiments, the reconstructed frame message includes: an identification header, a version number, a firmware length, a firmware file, and a CRC check.

[0050] Specifically, Figure 4 As shown in the figure, considering that the message frame may be misaligned or the transmission processing may be wrong during the transmission process, although each frame message is correct, the firmware received in the end is still wrong. When designing the reconstruction firmware, consider adding an identification header, version number, and firmware length to the firmware header, and add a 2-bit CRC check at the end of the file. After all message frames are received, the firmware needs to be CRC checked. If the check is passed, it is determined that the firmware received this time is correct. Only after confirmation can the in-orbit reconstruction be performed. The content of the reconstructed frame message is shown in Table 1.

[0051] Table 1 Reconstructed firmware format

[0052]

[0053] In one embodiment, if Figure 5 As shown, before the firmware is loaded, the antenna controller receives the remote control command from the satellite computer, erases the reconstruction area and reports the erasure status. After the erasure is completed, it receives the reconstruction enable command to set the enable flag and enter the reconstruction process.

[0054] In another embodiment, the antenna controller receives a reconstructed data message, verifies the reconstructed data message, determines the first frame, middle frame and last frame information of the reconstructed data message, and when the reconstructed data message is the first frame, performs firmware annotation; reconstructs status information; the status information includes: frame count, write correct frame count, check error frame count and check error frame sequence number; when the reconstructed data message is the last frame, ends the firmware annotation.

[0055] Specifically, Figure 6 As shown in the figure, the reconstruction process of the antenna controller in the firmware injection stage mainly includes the following aspects:

[0056] 1) Receiving antenna reconstructs data message

[0057] Receive the data message frame and check the frame to determine the first frame, middle frame, and last frame information. If it is the first frame, start writing to the reconstructed data storage, otherwise do not process it.

[0058] 2) Reconstruct state information

[0059] Receive frame count, write correct frame count, check error frame count, check error frame sequence number and other information.

[0060] 3) Determine whether it is the last frame

[0061] If it is the last frame, then reconstruct the reception.

[0062] If it is not the last frame, continue to wait for receiving the message;

[0063] 4) Exception handling

[0064] If an abnormal condition such as timeout or CRC error occurs, the telemetry satellite service computer will resend the reconstruction message.

[0065] In one of the embodiments, the PS end starts the reconstruction execution according to the flag, compares and verifies the data by using a two-out-of-three method, and then writes it into the reconstruction area in the eNVM; during the execution process, the package telemetry is sent to the satellite computer to indicate the reconstruction status; the telemetry content includes the progress of the current data writing and the verification result, so that the computer can obtain the status of the reconstruction process in real time according to the measurement, and the verification result includes whether the data verification passes and whether there is an error frame; if data inconsistency is found during the two-out-of-three comparison and verification data, the PS end will re-verify and process the inconsistent data to ensure the accuracy of the data written into the reconstruction area. If there is still a problem after multiple verifications, the exception handling process will be triggered to report the abnormal status to the PL end.

[0066] In another embodiment, after receiving the code instruction to load the reconstruction area, the antenna controller performs a legality check on the code instruction;

[0067] When the code instruction is legal, the antenna controller saves the context information of the currently running execution code; the context information includes the current value of the program counter, the register status and the memory mapping; according to the address information in the load instruction, the execution code jumps to the starting address of the reconstruction area and starts to run the code instructions in the reconstruction area; in the process of running the code instructions in the reconstruction area, the execution status of the code is monitored in real time. If an exception occurs, the execution of the reconstruction area code is stopped immediately, the previously saved context information is restored, the execution code jumps back to the original position, and an exception report is sent to the satellite service computer.

[0068] In exception handling, such as Figure 7 As shown, the PS end periodically reports to the PL end during operation. The main updates in the reporting process are two states: the current health monitoring register is accumulated, and the firmware area flag of the current firmware is marked; if the periodic reporting timeout exceeds five minutes, it is judged as an abnormal state.

[0069] After determining the abnormality, perform abnormal recovery, such as Figure 8 As shown, the PL side determines the timeout period of the scheduled reporting message and the message content to determine whether the exception is triggered. After the exception is triggered, the PL side moves the firmware copy in Norflash, overwrites the factory firmware area, and then restarts the PS side software.

[0070] It should be understood that although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, Figure 1At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0071] In one embodiment, Fig. 9 As shown, a high-reliability satellite-borne antenna software reconstruction and exception handling device is provided, which is applied to a satellite. The satellite includes: a satellite computer, an antenna controller and a storage area, the storage area includes: an internal eNVM storage area and an externally mounted NorFlash storage area; the eNVM storage area includes: a factory firmware area and a reconstruction area, the NorFlash storage area includes: a first NorFlash storage area for storing controller data and reconstruction process data on the PS side and a second NorFlash storage area for storing factory firmware on the PL side; including: a forwarding module 902, a firmware injection module 904, a reconstruction module 906 and an operation module 908, wherein:

[0072] The forwarding module 902 is used to receive the reconstruction frame message sent by the ground station through the satellite-to-ground link, the satellite service computer receives the reconstruction frame message, and forwards the reconstruction frame message to the antenna controller;

[0073] The firmware annotation module 904 is used for the antenna controller to receive the reconstructed data message and perform firmware annotation on the reconstructed frame message;

[0074] The reconstruction module 906 is used to start the reconstruction at the PS end after the firmware is uploaded, verify the reconstruction frame message in a preset way, write the reconstruction frame message into the reconstruction area, and package and telemeter the reconstruction status to the satellite service computer during the execution process;

[0075] The running module 908 is used for the antenna controller to receive the code instruction for loading the reconstruction area, jump the execution code of the antenna controller to the code instruction for running the reconstruction area, and after the code instruction is started, send a telemetry message to the satellite service computer to report the current running status of the reconstruction firmware.

[0076] For the specific definition of the high-reliability satellite antenna software reconstruction and exception handling device, please refer to the definition of the high-reliability satellite antenna software reconstruction and exception handling method above, which will not be repeated here. Each module in the above-mentioned high-reliability satellite antenna software reconstruction and exception handling device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0077] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method in the above embodiment when executing the computer program.

[0078] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method in the above embodiment are implemented.

[0079] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0080] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0081] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A high-reliability satellite antenna software reconstruction and exception handling method, characterized in that: Applied in a satellite, the satellite comprises: a satellite service computer, an antenna controller and a storage area, the storage area comprises: an internal eNVM storage area and an externally mounted NorFlash storage area; the eNVM storage area comprises: a factory firmware area and a reconstruction area, the NorFlash storage area comprises: a first NorFlash storage area for storing controller data and reconstruction process data on the PS side and a second NorFlash storage area for storing factory firmware on the PL side; the method comprises: The receiving ground station sends a reconstruction frame message through the satellite-to-ground link, the satellite service computer receives the reconstruction frame message, and forwards the reconstruction frame message to the antenna controller; The antenna controller receives the reconstructed data message and performs firmware annotation on the reconstructed frame message; After the firmware is uploaded, the PS starts the reconstruction, verifies the reconstruction frame message in a preset way, writes the reconstruction frame message into the reconstruction area, and packages and telemeters the reconstruction status to the satellite service computer during the execution process; The antenna controller receives the code instruction for loading the reconstruction area, jumps the execution code of the antenna controller to the code instruction for running the reconstruction area, and after the code instruction is started, sends a telemetry message to the satellite service computer to report the current running status of the reconstruction firmware.

2. The method according to claim 1, characterized in that The reconstructed frame message includes: an identification header, a version number, a firmware length, a firmware file, and a CRC check.

3. The method according to claim 1, characterized in that Before the firmware is uploaded, the method further includes: The antenna controller receives the remote control command from the satellite computer, erases the reconstruction area and reports the erasure status. After the erasure is completed, it receives the reconstruction enable command to set the enable flag and enter the reconstruction process.

4. The method according to claim 1, characterized in that The antenna controller receives the reconstructed data message and performs firmware annotation on the reconstructed frame message, including: The antenna controller receives the reconstructed data message, verifies the reconstructed data message, determines the first frame, middle frame and last frame information of the reconstructed data message, and performs firmware annotation when the reconstructed data message is the first frame; Reconstructing state information; the state information includes: frame count, write-correct frame count, check error frame count and check error frame sequence number; When the reconstructed data message is the last frame, the firmware injection is terminated.

5. The method according to claim 1, characterized in that After the firmware is uploaded, the PS starts the reconstruction, verifies the reconstruction frame message in a preset manner, writes the reconstruction frame message into the reconstruction area, and packages the telemetry to the satellite service computer for the reconstruction status during the execution, including: The PS starts the reconstruction execution according to the flag, compares and verifies the data by taking two out of three, and then writes it into the reconstruction area in the eNVM; During the execution process, the telemetry package is used to reconstruct the status of the satellite service computer; the content of the telemetry includes the progress of the current data writing and the verification result, so that the computer can obtain the status of the reconstruction process in real time according to the measurement, and the verification result includes whether the data verification is passed and whether there is an error frame; If data inconsistency is found during the two-out-of-three comparison and verification process, the PS side will re-check and process the inconsistent data to ensure the accuracy of the data written to the reconstruction area. If problems still exist after multiple verifications, the exception handling process will be triggered to report the abnormal status to the PL side.

6. The method according to claim 1, characterized in that The antenna controller receives a code instruction for loading the reconstruction area, and jumps the execution code of the antenna controller to the code instruction for running the reconstruction area, including: After receiving the code instruction for loading the reconstruction area, the antenna controller performs a legality check on the code instruction; When the code instruction is legal, the antenna controller saves the context information of the currently running execution code; the context information includes the current program counter value, register status and memory mapping; According to the address information in the load instruction, the execution code is jumped to the starting address of the reconstruction area, and the code instructions in the reconstruction area are started to run; During the execution of the reconstruction area code instructions, the execution status of the code is monitored in real time. If an exception occurs, the execution of the reconstruction area code is stopped immediately, the previously saved context information is restored, the execution code is jumped back to the original position, and an exception report is sent to the satellite service computer.

7. A highly reliable satellite antenna software reconstruction and exception handling device, characterized in that: Applied in a satellite, the satellite comprises: a satellite service computer, an antenna controller and a storage area, the storage area comprises: an internal eNVM storage area and an externally mounted NorFlash storage area; the eNVM storage area comprises: a factory firmware area and a reconstruction area, the NorFlash storage area comprises: a first NorFlash storage area for storing controller data and reconstruction process data at the PS end and a second NorFlash storage area for storing factory firmware at the PL end; the device comprises: A forwarding module, configured to receive a reconstruction frame message sent by a ground station through a satellite-to-ground link, and a satellite service computer receives the reconstruction frame message and forwards the reconstruction frame message to an antenna controller; A firmware injection module is used for the antenna controller to receive the reconstructed data message and to inject firmware into the reconstructed frame message; The reconstruction module is used to start the reconstruction at the PS end after the firmware is uploaded, verify the reconstruction frame message in a preset way, write the reconstruction frame message into the reconstruction area, and package and telemeter the reconstruction status to the satellite service computer during the execution process; The running module is used for the antenna controller to receive the code instruction for loading the reconstruction area, jump the execution code of the antenna controller to the code instruction for running the reconstruction area, and after the code instruction is started, send a telemetry message to the satellite service computer to report the current running status of the reconstruction firmware.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images