Software control and on-orbit reprogramming method and device for satellite payload master control system

Abstract

The application provides a software control and on-orbit reloading method and device for a satellite load master control system. The method comprises the following steps: writing a software on-orbit reloading package into a target Flash memory unit and generating a software power-on loading instruction in response to a software on-orbit reloading instruction; performing software power-on loading based on the software power-on loading instruction; if the programmable logic gate array power-on loading succeeds and the digital signal processor power-on loading fails, resetting the digital signal processor by the programmable logic gate array; if the digital signal processor power-on loading succeeds and the programmable logic gate array power-on loading fails, resetting the programmable logic gate array by the digital signal processor; and if both the power-on loadings fail, restarting the satellite load master control system. The technical scheme makes the DSP and the FPGA work cooperatively, does not need to additionally increase an on-orbit reloading circuit, and improves the stability and reliability of the satellite load master control system in software on-orbit reloading.

Description

[Technical Field]

[0001] This application relates to the field of satellite control technology, and in particular to a software control and on-orbit re-injection method and apparatus for a satellite payload master control system. [Background Technology]

[0002] In recent years, with the rapid development of satellite technology, the demand for software updates and functional upgrades in satellite payload master control systems has been increasing. Traditional software-based on-orbit refueling schemes typically rely on additional on-orbit refueling circuitry. While achieving software-based on-orbit refueling functionality, this increases the circuit complexity and hardware cost of the satellite payload master control system, and also reduces the system's stability and reliability.

[0003] In addition, another approach exists in the existing technology: using an FPGA (Field-Programmable Gate Array) soft core to replace a DSP (Digital Signal Processor) as the satellite payload master control system. This approach simplifies the hardware structure of the satellite payload master control system by utilizing the programmable logic resources of the FPGA and integrating the functions of the DSP into the FPGA soft core. However, this approach still requires additional circuitry to assist the FPGA soft core in implementing software-based on-orbit re-injection functionality, and cannot fundamentally solve the problems of circuit complexity and system reliability.

[0004] Therefore, there is an urgent need for a software-based on-orbit re-injection scheme that does not require additional on-orbit re-injection circuitry, simplifies the circuit structure of the satellite payload master control system, and enhances system stability and reliability, in order to meet the urgent needs of the satellite payload master control system for software updates and functional upgrades. [Summary of the Invention]

[0005] This application provides a software control and on-orbit re-injection method and apparatus for a satellite payload master control system, aiming to solve the technical problems of increased circuit cost and reduced reliability caused by the introduction of additional circuits in the software on-orbit re-injection method of satellite payload master control system in related technologies.

[0006] In a first aspect, embodiments of this application provide a software control and on-orbit re-injection method for a satellite payload master control system, including:

[0007] Obtain software in-orbit re-injection instructions from the satellite management platform;

[0008] In response to the software on-orbit re-injection command, the software on-orbit re-injection package of the satellite management platform is downloaded, and the software on-orbit re-injection package is written into the target Flash storage unit through a programmable gate array, wherein the target Flash storage unit is currently in an idle state;

[0009] In response to the completion of writing the software on-orbit re-injection package, a software power-on loading instruction is generated, wherein the software power-on loading instruction indicates a power-on reload from the target Flash storage unit;

[0010] Based on the aforementioned software power-on loading instruction, the programmable gate array and digital signal processor are software powered on and loaded.

[0011] If the result of the software power-on loading is that the programmable gate array is successfully loaded and the digital signal processor fails to load, the programmable gate array is invoked to reset the digital signal processor.

[0012] If the result of the software power-on loading is that the digital signal processor is successfully loaded and the programmable gate array is unsuccessful, a first reset instruction for the programmable gate array is generated, and based on the first reset instruction, the digital signal processor is invoked to reset the programmable gate array.

[0013] If the result of the software power-on loading is that both the programmable gate array and the digital signal processor fail to load, a second reset instruction is generated, and the satellite payload master control system is restarted based on the second reset instruction.

[0014] In one embodiment of this application, optionally, the step of invoking the programmable gate array to reset the digital signal processor includes:

[0015] By pulling the MP / MC pin of the digital signal processor to MP mode through the programmable gate array, the digital signal processor is reset, enabling it to start the corresponding running program from the external interface provided by the programmable gate array.

[0016] In one embodiment of this application, optionally, upon successful power-on loading of the digital signal processor, a watchdog signal is generated in the digital signal processor at specified time intervals, and the watchdog signal is sent to the programmable gate array; and

[0017] After the programmable gate array is successfully powered on and loaded, monitor whether the programmable gate array has not received the dog feed signal for a specified time interval.

[0018] If the programmable gate array does not receive the dog feed signal for more than the specified time interval, a first reset signal is generated in the programmable gate array.

[0019] Based on the first reset signal, the digital signal processor is reset, so that the digital signal processor is powered on and reloaded.

[0020] In one embodiment of this application, optionally, the step of invoking the digital signal processor to reset the programmable gate array based on the first reset instruction includes:

[0021] Based on the first reset command, the digital signal processor runs a Flash switching program via a magnetic latching relay to switch the first Flash memory unit currently connected to the programmable gate array to a backup second Flash memory unit, where the second Flash memory unit is the target Flash memory unit;

[0022] The digital signal processor sends a second reset signal to the programmable gate array (PGA) via the PROG_B_O pin, causing the PGA to respond to the acquisition of the second reset signal by rereading the bitstream in the second Flash memory unit and starting up.

[0023] Optionally, in one embodiment of this application, determining the result of the power-on loading of the satellite payload master control system software further includes:

[0024] After the digital signal processor is successfully powered on and loaded, the programmable gate array is monitored and timed for startup through the OTP ROM of the digital signal processor.

[0025] If the timing duration of the start monitoring exceeds a predetermined time threshold, it is determined that the programmable gate array has failed to power on.

[0026] Secondly, embodiments of this application provide a software control and on-orbit re-injection device for a satellite payload master control system, comprising:

[0027] The software on-orbit re-injection instruction acquisition unit is used to acquire software on-orbit re-injection instructions from the satellite management platform;

[0028] The on-orbit re-injection package writing unit is used to respond to the software on-orbit re-injection command, download the software on-orbit re-injection package of the satellite management platform, and write the software on-orbit re-injection package into the target Flash storage unit through a programmable gate array, wherein the target Flash storage unit is currently in an idle state.

[0029] A power-on loading instruction generation unit is used to generate a software power-on loading instruction in response to the completion of writing the software on-orbit re-injection package, wherein the software power-on loading instruction indicates a re-power-on loading from the target Flash storage unit;

[0030] The power-on loading execution unit performs software power-on loading on the programmable gate array and digital signal processor based on the software power-on loading instruction;

[0031] The first execution unit is configured to, if the result of the software power-on loading is that the programmable gate array is successfully loaded and the digital signal processor fails to be loaded, call the programmable gate array to reset the digital signal processor.

[0032] The second execution unit is configured to generate a first reset instruction for the programmable gate array if the result of the software power-on loading is that the digital signal processor is successfully loaded and the programmable gate array fails to be loaded, and to call the digital signal processor to reset the programmable gate array based on the first reset instruction.

[0033] The third execution unit is configured to generate a second reset instruction if the result of the software power-on loading is that both the programmable gate array and the digital signal processor fail to load upon power-on, and to restart the satellite payload master control system based on the second reset instruction.

[0034] In one embodiment of this application, optionally, the first execution unit is used to:

[0035] By pulling the MP / MC pin of the digital signal processor to MP mode through the programmable gate array, the digital signal processor is reset, enabling it to start the corresponding running program from the external interface provided by the programmable gate array.

[0036] Optionally, in one embodiment of this application, the device further includes:

[0037] A watchdog signal reporting unit is configured to, upon successful power-on loading of the digital signal processor, generate a watchdog signal in the digital signal processor at specified time intervals and send the watchdog signal to the programmable gate array; and

[0038] The monitoring unit is used to monitor whether the programmable gate array has not received the dog-feed signal for a specified time interval after the programmable gate array is successfully powered on and loaded.

[0039] The fourth execution unit is configured to generate a first reset signal in the programmable gate array if the programmable gate array does not receive the dog feed signal for a specified time interval, and reset the digital signal processor based on the first reset signal, so that the digital signal processor is powered on and reloaded.

[0040] Optionally, in one embodiment of this application, the second execution unit includes:

[0041] The Flash switching unit is used to switch the first Flash storage unit currently connected to the programmable gate array to a backup second Flash storage unit by running a Flash switching program through the digital signal processor via a magnetic latching relay based on the first reset instruction. The second Flash storage unit is the target Flash storage unit.

[0042] The restart execution unit is used to send a second reset signal to the programmable logic gate array (PLG) via the PROG_B_O pin of the PLG, so that the PLG responds to the acquisition of the second reset signal by rereading the bit stream in the second Flash storage unit and starting up.

[0043] Optionally, in one embodiment of this application, the loading result determination unit includes:

[0044] The timing monitoring unit is used to perform startup monitoring timing of the programmable gate array through the OTP ROM of the digital signal processor after the digital signal processor is successfully powered on and loaded.

[0045] The timing judgment unit is used to determine that the power-on loading of the programmable gate array has failed if the timing duration of the start monitoring timing exceeds a predetermined time threshold.

[0046] Thirdly, embodiments of this application provide a satellite payload master control system, which applies the software control and on-orbit re-injection method for a satellite payload master control system described in any one of the first aspects above, including:

[0047] The digital signal processor uses an external interface to run its own startup program, which is used to perform signal processing tasks for the satellite payload master control system;

[0048] A programmable gate array is used to load and execute programs for the satellite payload master control system and to provide the external interface for the digital signal processor.

[0049] The first Flash storage unit and the second Flash storage unit are respectively connected to the programmable gate array. Both the first Flash storage unit and the second Flash storage unit are used to store the code stream data of the programmable gate array and the boot program and application program of the digital signal processor.

[0050] A magnetic latching relay is connected to the first Flash memory unit and the second Flash memory unit respectively, and is connected to the digital signal processor. It is configured to run a Flash switching program based on the instructions of the digital signal processor to switch the current Flash memory unit of the programmable gate array between the first Flash memory unit and the second Flash memory unit.

[0051] The programmable gate array and the digital signal processor are configured to reload the software based on a software power-on loading instruction. The software power-on loading instruction is generated in response to the action of the programmable gate array writing the software on-orbit reloading package from the satellite management platform to the target Flash storage unit during the on-orbit reloading process of the satellite payload master control system software. The target Flash storage unit is an idle unit between the first Flash storage unit and the second Flash storage unit.

[0052] The programmable gate array is configured to, upon successful power-on loading, pull the MP / MC pin of the digital signal processor (DSP) that failed to load upon power-on to MP mode, thereby resetting the DSP and causing it to restart the corresponding running program from the external interface.

[0053] The digital signal processor is configured to, upon successful power-on loading, run the Flash switching program via a magnetic latching relay and then control the programmable gate array (PLG) via its PROG_B_O pin to reread the bitstream from the current Flash memory unit after switching and start up.

[0054] The satellite payload master control system is configured to perform its own restart operation if both the programmable gate array and the digital signal processor fail to load upon power-up.

[0055] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions for performing the method described in the first aspect above.

[0056] The above technical solutions address the technical problems of increased circuit costs and reduced reliability caused by the introduction of additional circuitry in the software-based on-orbit re-injection method of satellite payload master control systems in related technologies. The software control and on-orbit re-injection method for satellite payload master control systems proposed in this application, when the satellite payload master control system needs on-orbit re-injection, downloads the software on-orbit re-injection package to an idle Flash storage unit. Then, the existing DSP and FPGA in the satellite payload master control system work collaboratively, mutually controlling each other to reset, thereby switching the current Flash storage unit to the idle Flash storage unit and achieving successful on-orbit re-injection of the satellite payload master control system. Specifically, this solution realizes the on-orbit software on-orbit re-injection function of the satellite payload control system through a mechanism of mutual monitoring and reset between the DSP and FPGA, avoiding the problem of relying on additional on-orbit re-injection circuitry in traditional solutions. When the FPGA powers on and loads successfully while the DSP fails to load, the FPGA can actively reset the DSP, causing it to restart from an external interface; conversely, if the DSP loads successfully while the FPGA fails to load, the DSP resets the FPGA through a Flash switching program, causing it to reload the bitstream from a spare Flash storage unit. Furthermore, if both loading fail, the system will automatically perform a restart to ensure it can resume normal operation. This improves the stability of the satellite payload control system's software during on-orbit re-injection startup without requiring additional circuitry, avoiding extra costs and ensuring the reliability of the satellite payload control system.

[0057] In summary, this application enables successful on-orbit re-injection of satellite payload master control system through the collaborative work of DSP and FPGA, without the need for additional on-orbit re-injection circuitry. This not only simplifies hardware design but also significantly improves system stability and reliability, meeting the urgent needs of satellite payload master control system for software updates and functional upgrades. [Attached Image Description]

[0058] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0059] Figure 1 A flowchart of a software control and on-orbit re-injection method for a satellite payload master control system according to an embodiment of this application is shown;

[0060] Figure 2 A schematic diagram of a satellite payload master control system according to an embodiment of this application is shown.

Detailed Implementation Methods

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] Figure 1 A flowchart of a software control and on-orbit re-injection method for a satellite payload master control system according to an embodiment of this application is shown.

[0063] The satellite payload main control system includes programmable gate arrays and digital signal processors, such as... Figure 1 As shown, a software control and on-orbit re-injection method for a satellite payload master control system according to an embodiment of this application includes:

[0064] Step 102: Obtain the software in-orbit re-injection instruction from the satellite management platform.

[0065] The satellite payload master control system is one of the core components of a satellite, responsible for controlling and managing the operation of satellite payloads (such as communication, remote sensing, and navigation equipment). Its main functions include data acquisition, signal processing, mission scheduling, fault diagnosis and recovery, etc. The performance of the satellite payload master control system directly affects the satellite's mission execution capability and reliability. The satellite management platform is the ground control provider for the satellite payload master control system. When on-orbit re-injection of the satellite payload master control system's software is required, the satellite management platform sends a software on-orbit re-injection command to the satellite payload master control system, requesting the system to implement the software on-orbit re-injection based on the command.

[0066] Step 104: In response to the software on-orbit re-injection command, download the software on-orbit re-injection package of the satellite management platform, and write the software on-orbit re-injection package into the target Flash storage unit through a programmable gate array, wherein the target Flash storage unit is currently in an idle state.

[0067] When the software on-orbit re-injection package is read, the satellite payload master control system can be re-injected in orbit. The function of writing the software on-orbit re-injection package into the target Flash storage unit is mainly reflected in the following aspects.

[0068] First, software updates and feature upgrades. The target Flash storage unit, serving as idle storage space, is used to store the latest on-orbit software re-injection package from the satellite management platform. By writing the on-orbit software re-injection package into the target Flash storage unit, software updates and feature upgrades of the satellite payload master control system can be achieved, ensuring that the system can run the latest program version and meet mission requirements.

[0069] Second, system redundancy and reliability are improved. Satellite payload master control systems typically employ a dual-Flash storage unit design (such as a first Flash storage unit and a second Flash storage unit), with one serving as the currently operating unit and the other as a backup unit. After the software on-orbit re-injection package is written to an idle target Flash storage unit, the system can switch to that unit when needed, thereby achieving seamless software updates and avoiding system interruptions or failures due to software updates. This design improves system redundancy and reliability.

[0070] Third, it enables seamless switching during on-orbit software re-injection. By writing the on-orbit software re-injection package to the target Flash storage unit, the system can generate a software power-on loading command after the writing is complete, instructing a restart from the target Flash storage unit. This mechanism ensures that the system can smoothly switch to the new software version during on-orbit software re-injection without affecting the normal operation of the system.

[0071] Fourth, it supports on-orbit software updates. During satellite operation, software updates may be needed to fix vulnerabilities, optimize performance, or add new features. By writing the on-orbit software re-injection package to the target Flash storage unit, the system can complete the software update without interrupting the mission, significantly improving the maintainability and flexibility of satellite operation in orbit.

[0072] Fifth, ensuring system continuity. During on-orbit software re-injection, the system can still operate normally from the currently running Flash storage unit. After the on-orbit re-injection package is written to the target Flash storage unit, the system can switch to the new version of the software at an appropriate time. This design avoids system interruptions or functional failures that may occur during software updates, ensuring system continuity.

[0073] Sixth, it supports recovery from abnormal situations. If an anomaly occurs during the on-orbit re-injection of the software (such as loading failure), the system can recover by switching to the new version of the software in the target Flash storage unit, or by restarting. This mechanism enhances the system's fault tolerance and stability.

[0074] In summary, writing the software on-orbit re-injection package into the target Flash storage unit serves to enable software updates, improve system reliability, support on-orbit updates, ensure system continuity, and enhance system fault tolerance. It is a key step in the software control and on-orbit re-injection method of the satellite payload master control system.

[0075] Step 106: In response to the completion of writing the software on-orbit re-injection package, a software power-on loading instruction is generated, wherein the software power-on loading instruction indicates a power-on reload from the target Flash storage unit.

[0076] After the software on-orbit re-injection package is written, it indicates that the satellite payload master control system now has the basic conditions to implement software on-orbit re-injection. At this time, a software power-on loading command can be generated, requiring the satellite payload master control system to switch to the target Flash storage unit when powering on again, so as to obtain the software on-orbit re-injection package and thus successfully complete the software on-orbit re-injection.

[0077] Step 108: Based on the software power-on loading instruction, perform software power-on loading on the programmable gate array and the digital signal processor.

[0078] Specifically, programmable gate arrays (PGAs) are used to implement hardware logic functions for the satellite payload master control system, supporting parallel processing and high-speed data flow control. Their inherent flexibility allows them to adapt to various mission requirements. Digital signal processors (DSPs) are responsible for high-speed digital signal processing tasks for the satellite payload master control system, such as data compression, filtering, modulation, and demodulation. DSPs possess powerful mathematical computation capabilities, making them suitable for handling complex algorithms.

[0079] In general, the process of powering back on the satellite payload master control system mainly includes the steps of powering back on the programmable gate array and the digital signal processor.

[0080] However, both programmable gate arrays (GGAs) and digital signal processors (DSPs) carry the risk of power-on failure upon reloading.

[0081] First, hardware failures may occur. For example, unstable or excessively fluctuating power supply voltage may prevent the DSP or FPGA from starting normally, or a faulty power module may fail to provide sufficient current or voltage. Damaged or lost Flash memory units may prevent the DSP or FPGA from reading the correct boot program or configuration stream, or poor contact or damage to the Flash memory interface may cause data transmission failure. Damage to the DSP or FPGA chip due to radiation, temperature changes, or mechanical stress may prevent it from functioning properly. Broken or short-circuited traces on the PCB (printed circuit board) may cause signal transmission failure, or poor soldering or aging components may affect the normal operation of the circuit.

[0082] Second, software or configuration issues. For example, logical errors in the DSP or FPGA startup program or application may cause crashes during loading, or the program code may be incompatible with the hardware and unable to run correctly; the FPGA's configuration bitstream may be corrupted or incomplete, preventing the FPGA from loading correctly, or the configuration bitstream may be incompatible with the current hardware version, leading to loading failure; the DSP or FPGA firmware version may be too old or contain vulnerabilities, causing loading failure.

[0083] Third, environmental factors. For example, high-energy particle radiation in space may cause single-event upsets (SEUs) in the internal registers or memory of DSPs or FPGAs, thus affecting the loading process; extreme temperatures (too high or too low) may cause chip performance to degrade or fail, thus affecting power-on loading; and severe vibrations or shocks during launch may cause hardware connections to become loose or damaged, affecting the loading process.

[0084] Fourth, system design issues. For example, an unreasonable startup timing design of the DSP or FPGA can lead to signal synchronization failure during loading; failure of the reset signal to trigger correctly can prevent the DSP or FPGA from completing initialization; and a malfunction in the communication interface between the DSP and FPGA (such as SPI, I2C, etc.) can cause data transmission failure during loading.

[0085] Fifth, external interference issues. Electromagnetic interference, whether inside or outside the satellite, may cause signal transmission errors, affecting the loading process; excessive power supply noise may interfere with the normal operation of the DSP or FPGA, leading to loading failure.

[0086] Sixth, human error. For example, the ground station may send incorrect commands or configuration parameters, causing the DSP or FPGA to fail to load; or during on-orbit software updates, the new software version may have defects or be incompatible with the hardware, leading to loading failure.

[0087] Due to the various potential problems mentioned above, the power-on loading result of the satellite payload master control system may fall into one of the following categories: the programmable gate array (PGA) in the satellite payload master control system powers on successfully; the digital signal processor (DSP) powers on successfully, but the PGA fails to powers on; or both the PGA and the DSP fail to powers on. To ensure the stability of the satellite payload master control system in the face of these possible failure scenarios, corresponding reset mechanisms can be set for different failure conditions.

[0088] Step 110: If the result of the software power-on loading is that the programmable gate array in the satellite payload master control system is successfully loaded, and the digital signal processor in the satellite payload master control system fails to load, the programmable gate array is invoked to reset the digital signal processor.

[0089] In other words, a programmable gate array (PGA) is used as the controller to reset the digital signal processor (DSP). Specifically, the PGA pulls the DSP's MP / MC pin to MP mode, resetting the DSP and causing it to start the corresponding program from the external interface provided by the PGA. That is, if the FPGA detects a DSP loading failure, it resets the DSP by controlling its MP / MC pin, causing it to restart from the external interface.

[0090] Step 112: If the result of the software power-on loading is that the digital signal processor is successfully loaded and the programmable gate array is unsuccessful, a first reset instruction for the programmable gate array is generated, and based on the first reset instruction, the digital signal processor is invoked to reset the programmable gate array.

[0091] This means that a digital signal processor (DSP) is used as the controller to reset the programmable gate array (FPGA). Specifically, based on the first reset command, the DSP runs a Flash switching program via a magnetic latching relay to switch the currently connected first Flash memory unit of the FPGA to a backup second Flash memory unit, which is the target Flash memory unit. The DSP then sends a second reset signal to the FPGA via the PROG_B_O pin, causing the FPGA to respond to the second reset signal by reloading the bitstream from the second Flash memory unit and starting up. In other words, the DSP switches the FPGA's Flash memory unit via the magnetic latching relay and sends a reset signal, causing the FPGA to reload the bitstream from the backup memory unit.

[0092] It should be added that the method for determining the power-on loading failure of the programmable gate array includes: after the digital signal processor is successfully powered on, the programmable gate array is started and monitored by the OTP ROM of the digital signal processor; if the duration of the start monitoring time exceeds a predetermined time threshold, the power-on loading failure of the programmable gate array is determined.

[0093] Specifically, by timing and monitoring the FPGA startup process through the DSP's OTP ROM (One-Time Programmable Read-Only Memory), the FPGA's loading status can be detected in real time. If the FPGA fails to start up within a predetermined time, the system can immediately determine that the FPGA loading has failed. In essence, this is a mechanism for monitoring and timing the startup of the programmable gate array (FPGA) through the OTP ROM of the digital signal processor (DSP). This mechanism avoids the problems of relying on manual intervention or complex hardware circuits for status detection in traditional methods, improving the system's automation and response speed. By setting a predetermined time threshold, the system can quickly make a judgment when the FPGA loading is abnormal, preventing the entire system from falling into an uncontrollable state due to FPGA loading failure. This proactive monitoring mechanism significantly improves the system's fault tolerance, ensuring that the system can take timely recovery measures when a component (such as the FPGA) in the satellite payload master control system fails, thereby improving overall reliability. Furthermore, using the DSP's OTP ROM for timing monitoring eliminates the need for additional hardware circuits or complex logic designs to detect the FPGA loading status, simplifying the hardware structure of the satellite payload master control system, reducing system complexity and cost, and decreasing the possibility of hardware failure.

[0094] Furthermore, once an FPGA loading failure is detected, the system can immediately trigger the corresponding recovery mechanism (such as resetting the FPGA or switching to a backup storage unit), thereby shortening the fault recovery time. For example, in the space environment, the FPGA may fail to load due to factors such as radiation and temperature changes. Through a timing monitoring mechanism, the system can quickly identify and respond to these anomalies. This rapid response mechanism ensures that the system can quickly resume normal operation when a fault occurs, reducing mission downtime and improving the system's adaptability to extreme environments. It also ensures that the satellite can still operate stably in complex space environments, making it particularly suitable for satellite payload master control systems with high real-time requirements. Simultaneously, the automatic monitoring and judgment of the FPGA loading status is achieved through the DSP's OTP ROM, reducing reliance on ground station commands and enhancing the system's autonomous operation capability. During satellite operation in orbit, ground station intervention may be affected by communication delays or interruptions, but this autonomous monitoring mechanism ensures that the system operates normally without human intervention. Ultimately, through automatic monitoring and fault detection, the system can detect and resolve problems early, preventing further deterioration of faults and reducing the need for on-orbit maintenance.

[0095] In summary, using the DSP's OTP ROM to monitor and time the FPGA's startup simplifies hardware design and improves the system's automation, reliability, and fault recovery capabilities. This approach is particularly suitable for satellite payload master control systems with extremely high real-time and stability requirements. While reducing system complexity and cost, this design significantly enhances the system's adaptability and autonomous operation capabilities in complex environments.

[0096] Step 114: If the result of the software power-on loading is that both the programmable gate array and the digital signal processor fail to load, a second reset instruction is generated, and the satellite payload master control system is restarted based on the second reset instruction.

[0097] In this way, the system automatically performs a restart operation to attempt to resume normal operation. Through this mutual monitoring and reset mechanism, this application effectively solves the problem of DSP and FPGA power-on loading failure, improving the reliability and stability of the satellite payload main control system.

[0098] Through the above technical solutions

[0099] When the satellite payload master control system needs on-orbit re-injection, after downloading the on-orbit re-injection software package to an idle Flash storage unit, the existing DSP and FPGA in the satellite payload master control system work together, mutually controlling each other to reset, thereby switching the current Flash storage unit to the idle Flash storage unit and achieving successful on-orbit re-injection of the satellite payload master control system. Specifically, this scheme realizes the on-orbit software re-injection function of the satellite payload control system through the mutual monitoring and reset mechanism of the DSP and FPGA, avoiding the problem of relying on additional on-orbit re-injection circuits in traditional schemes. When the FPGA powers on and loads successfully but the DSP fails to load, the FPGA can actively reset the DSP, causing it to restart from the external interface; conversely, if the DSP loads successfully but the FPGA fails to load, the DSP resets the FPGA through the Flash switching program, causing it to reload the bitstream from the spare Flash storage unit. In addition, when both fail to load, the system will automatically perform a restart operation to ensure that the system can resume normal operation. In this way, while improving the stability of the satellite payload control system's software during on-orbit re-injection startup, no additional circuit structure is required, avoiding extra cost and ensuring the reliability of the satellite payload control system.

[0100] In summary, this application enables successful on-orbit re-injection of satellite payload master control system through the collaborative work of DSP and FPGA, without the need for additional on-orbit re-injection circuitry. This not only simplifies hardware design but also significantly improves system stability and reliability, meeting the urgent needs of satellite payload master control system for software updates and functional upgrades.

[0101] It should be added that, when the digital signal processor (DSP) is successfully powered on and loaded, a watchdog signal is generated in the DSP at specified time intervals and sent to the programmable gate array (PGA); and after the PGA is successfully powered on and loaded, the PGA is monitored to see if it has not received the watchdog signal for the specified time interval; if the PGA has not received the watchdog signal for the specified time interval, a first reset signal is generated in the PGA; based on the first reset signal, the DSP is reset, so that the DSP is powered on and loaded again.

[0102] Specifically, during normal operation, the DSP periodically generates a watchdog signal and sends it to the FPGA. This mechanism monitors the DSP's operating status in real time, ensuring its proper functioning. If the FPGA does not receive the watchdog signal within a specified time interval, it determines that the DSP is malfunctioning and generates a reset signal to reset the DSP, causing it to power on again. This mechanism can quickly detect and recover from DSP faults, preventing the system from being in an abnormal state for extended periods. Through the watchdog signal mechanism, the system can take timely measures when the DSP malfunctions, preventing fault propagation or system crashes, significantly improving system reliability and stability. This mechanism requires no external intervention; the FPGA autonomously monitors and executes the reset operation, enhancing the system's autonomous operation capability, making it particularly suitable for scenarios where manual intervention is difficult, such as on-orbit satellites. The software-implemented watchdog signal mechanism eliminates the need for additional hardware circuitry, simplifying system design and reducing cost and complexity. In extreme environments such as space, the DSP may malfunction due to factors such as radiation and temperature changes. The watchdog signal mechanism effectively addresses these situations, ensuring stable system operation in complex environments. In summary, this mechanism enables real-time monitoring of the DSP's operating status and rapid fault recovery through the dog-feed signal, improving the system's reliability, autonomy, and environmental adaptability, while simplifying hardware design and reducing costs.

[0103] Figure 2 A schematic diagram of a satellite payload master control system according to an embodiment of this application is shown.

[0104] like Figure 2 As shown, this application provides a satellite payload master control system, which applies... Figure 1 The software control and on-orbit re-injection method for the satellite payload master control system includes: a digital signal processor, a programmable gate array, a first Flash memory unit and a second Flash memory unit, and a magnetic latching relay.

[0105] The digital signal processor uses an external interface to run its own startup program, which is used to perform signal processing tasks for the satellite payload master control system.

[0106] The programmable gate array is used to load and execute programs for the satellite payload master control system and to provide the external interface for the digital signal processor.

[0107] The first Flash storage unit and the second Flash storage unit are respectively connected to the programmable gate array, and both are used to store the code stream data of the programmable gate array and the boot program and application program of the digital signal processor.

[0108] The magnetic latching relay is connected to the first Flash memory unit and the second Flash memory unit respectively, and is connected to the digital signal processor. It is configured to run a Flash switching program based on the instructions of the digital signal processor to switch the current Flash memory unit of the programmable gate array between the first Flash memory unit and the second Flash memory unit.

[0109] The programmable gate array and the digital signal processor are configured to reload the software based on a software power-on loading instruction. The software power-on loading instruction is generated in response to the action of the programmable gate array writing the software on-orbit re-injection package from the satellite management platform to the target Flash storage unit during the on-orbit re-injection process of the satellite payload master control system software. The target Flash storage unit is an idle unit between the first Flash storage unit and the second Flash storage unit.

[0110] The programmable gate array (PGA) is configured to, upon successful power-on loading, pull the MP / MC pin of the digital signal processor (DSP) that failed to power-on loading to MP mode, thereby resetting the DSP and causing it to restart its corresponding running program from the external interface. The DSP is configured to, upon successful power-on loading, run a Flash switching program via a magnetic latching relay and then control the PGA via the PGA's PROG_B_O pin to reread the bitstream from the current Flash memory unit after the switch and start up. The satellite payload master control system is configured to perform a self-restart operation if both the PGA and the DSP fail to power-on loading.

[0111] like Figure 2As shown, during normal startup, the FPGA reads the program code stream from the Flash memory cell (Flash1 or Flash2) selected by the magnetic latching relay. After the FPGA program runs successfully, the DSP's MP / MC pin is pulled up to MP mode, and the DSP is hard reset, causing it to start running the program from the external interface (XINTF) implemented by the FPGA.

[0112] In one possible design, the host computer sends a hard reset command to the FPGA, and the DSP performs a hard reset on the FPGA by controlling the PROG_B_O pin of the FPGA, thus restarting the main control system.

[0113] In another possible design, after power-on, the DSP defaults to MC state startup (pin pull-down) and is started by the DSP's internal OTP ROM. The program in the OTP ROM executes simple timing logic. If the FPGA still does not start normally after a certain time, the DSP will switch the Flash chip select and perform a hard reset on the FPGA, causing the system to restart.

[0114] If the FPGA fails to start, the DSP runs the FPGA Flash switching program from its internal OTP ROM. After a certain delay, it switches the FPGA's Flash chip select via a magnetic latching relay and resets the FPGA.

[0115] When a Flash memory switch is required, the DSP controls the Flash chip select signal via a magnetic latching relay to switch to the corresponding Flash memory cell. The DSP then performs a hard reset on the FPGA via the FPGA's PROG_B_O pin. The FPGA then rereads the bitstream from the switched Flash memory and starts up. The DSP's FPGA reset process includes: the host computer sending a hard reset command to the DSP; the DSP sending a hard reset signal to the FPGA; and the FPGA executing the corresponding logic to reset the DSP.

[0116] In another possible design, if the DSP program malfunctions and fails to periodically send a dog feed signal to the FPGA, the FPGA will passively execute the DSP hard reset logic to reset the DSP.

[0117] The above describes the complete process of guidance and startup, program execution, slicing function, reset logic, and on-orbit re-injection logic within the satellite payload master control system. Through the collaborative work of DSP and FPGA, the system can achieve automatic reset and on-orbit re-injection under different fault scenarios, ensuring the high reliability and stability of the satellite payload master control system.

[0118] Optionally, the FPGA uses the XC7K325T chip. The XC7K325T chip supports high-speed signal processing and complex algorithm implementation, making it suitable for high-performance applications such as communication, radar, and image processing. Utilizing 28nm process technology, it has low power consumption, making it suitable for power-sensitive applications. Furthermore, the XC7K325T chip has abundant programmable logic resources, supports user-defined functions, adapts to various application requirements, and is suitable for high-reliability fields such as aerospace. It also supports radiation-hardened design and fault-tolerant mechanisms. In this invention, the XC7K325T, as one of the core components, works in conjunction with the DSP to achieve efficient guidance, operation, and fault recovery functions for the satellite payload master control system, significantly improving the system's reliability and flexibility.

[0119] Optionally, the DSP uses the F2812 chip, a 32-bit fixed-point digital signal processor with a 150MHz clock frequency and 32-bit fixed-point arithmetic capability. It is suitable for complex control algorithms and signal processing tasks, supports high-precision data acquisition and motor control, and is applicable to industrial environments and aerospace fields. It also supports anti-interference design and fault-tolerant mechanisms. In this invention, the F2812, as one of the core components, works in conjunction with the FPGA to achieve efficient guidance, operation, and fault recovery functions for the satellite payload master control system, significantly improving the system's reliability and flexibility.

[0120] This application provides a software control and on-orbit re-injection device for a satellite payload master control system, including:

[0121] The software on-orbit re-injection instruction acquisition unit is used to acquire software on-orbit re-injection instructions from the satellite management platform;

[0122] The on-orbit re-injection package writing unit is used to respond to the software on-orbit re-injection command, download the software on-orbit re-injection package of the satellite management platform, and write the software on-orbit re-injection package into the target Flash storage unit through a programmable gate array, wherein the target Flash storage unit is currently in an idle state.

[0123] A power-on loading instruction generation unit is used to generate a software power-on loading instruction in response to the completion of writing the software on-orbit re-injection package, wherein the software power-on loading instruction indicates a re-power-on loading from the target Flash storage unit;

[0124] The power-on loading execution unit performs software power-on loading on the programmable gate array and digital signal processor based on the software power-on loading instruction;

[0125] The first execution unit is configured to, if the result of the software power-on loading is that the programmable gate array is successfully loaded and the digital signal processor fails to be loaded, call the programmable gate array to reset the digital signal processor.

[0126] The second execution unit is configured to generate a first reset instruction for the programmable gate array if the result of the software power-on loading is that the digital signal processor is successfully loaded and the programmable gate array fails to be loaded, and to call the digital signal processor to reset the programmable gate array based on the first reset instruction.

[0127] The third execution unit is configured to generate a second reset instruction if the result of the software power-on loading is that both the programmable gate array and the digital signal processor fail to load upon power-on, and to restart the satellite payload master control system based on the second reset instruction.

[0128] In one embodiment of this application, optionally, the first execution unit is used to:

[0129] By pulling the MP / MC pin of the digital signal processor to MP mode through the programmable gate array, the digital signal processor is reset, enabling it to start the corresponding running program from the external interface provided by the programmable gate array.

[0130] Optionally, in one embodiment of this application, the device further includes:

[0131] A watchdog signal reporting unit is configured to, upon successful power-on loading of the digital signal processor, generate a watchdog signal in the digital signal processor at specified time intervals and send the watchdog signal to the programmable gate array; and

[0132] The monitoring unit is used to monitor whether the programmable gate array has not received the dog-feed signal for a specified time interval after the programmable gate array is successfully powered on and loaded.

[0133] The fourth execution unit is configured to generate a first reset signal in the programmable gate array if the programmable gate array does not receive the dog feed signal for a specified time interval, and reset the digital signal processor based on the first reset signal, so that the digital signal processor is powered on and reloaded.

[0134] Optionally, in one embodiment of this application, the second execution unit includes:

[0135] The Flash switching unit is used to switch the first Flash storage unit currently connected to the programmable gate array to a backup second Flash storage unit by running a Flash switching program through the digital signal processor via a magnetic latching relay based on the first reset instruction. The second Flash storage unit is the target Flash storage unit.

[0136] The restart execution unit is used to send a second reset signal to the programmable logic gate array (PLG) via the PROG_B_O pin of the PLG, so that the PLG responds to the acquisition of the second reset signal by rereading the bit stream in the second Flash storage unit and starting up.

[0137] Optionally, in one embodiment of this application, the loading result determination unit includes:

[0138] The timing monitoring unit is used to perform startup monitoring timing of the programmable gate array through the OTP ROM of the digital signal processor after the digital signal processor is successfully powered on and loaded.

[0139] The timing judgment unit is used to determine that the power-on loading of the programmable gate array has failed if the timing duration of the start monitoring timing exceeds a predetermined time threshold.

[0140] The device uses the solution described in any one of the above embodiments, and therefore has all the above-mentioned technical effects, which will not be repeated here.

[0141] Additionally, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which are used to perform the following steps:

[0142] Obtain software in-orbit re-injection instructions from the satellite management platform;

[0143] In response to the software on-orbit re-injection command, the software on-orbit re-injection package of the satellite management platform is downloaded, and the software on-orbit re-injection package is written into the target Flash storage unit through a programmable gate array, wherein the target Flash storage unit is currently in an idle state;

[0144] In response to the completion of writing the software on-orbit re-injection package, a software power-on loading instruction is generated, wherein the software power-on loading instruction indicates a power-on reload from the target Flash storage unit;

[0145] Based on the aforementioned software power-on loading instruction, the programmable gate array and digital signal processor are software powered on and loaded.

[0146] If the result of the software power-on loading is that the programmable gate array is successfully loaded and the digital signal processor fails to load, the programmable gate array is invoked to reset the digital signal processor.

[0147] If the result of the software power-on loading is that the digital signal processor is successfully loaded and the programmable gate array is unsuccessful, a first reset instruction for the programmable gate array is generated, and based on the first reset instruction, the digital signal processor is invoked to reset the programmable gate array.

[0148] If the result of the software power-on loading is that both the programmable gate array and the digital signal processor fail to load, a second reset instruction is generated, and the satellite payload master control system is restarted based on the second reset instruction.

[0149] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or computer device described above can be referred to the relevant descriptions in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0150] The technical solution of this application has been described in detail above with reference to the accompanying drawings. When the satellite payload master control system needs on-orbit re-injection, the technical solution downloads the on-orbit re-injection software package to an idle Flash storage unit. Then, the existing DSP and FPGA in the satellite payload master control system work collaboratively, mutually controlling each other to reset, thereby switching the current Flash storage unit to the idle Flash storage unit and achieving successful on-orbit re-injection of the satellite payload master control system. Simultaneously, no additional on-orbit re-injection circuit is required, which not only simplifies the hardware design but also significantly improves the stability and reliability of the system, meeting the urgent needs of the satellite payload master control system for software updates and functional upgrades.

[0151] It should be understood that although the terms "first," "second," etc., may be used to refer to reset signals in the embodiments of this application, these reset signals should not be limited to these terms. These terms are only used to distinguish reset signals from each other. For example, without departing from the scope of the embodiments of this application, a first reset signal may also be referred to as a second reset signal, and similarly, a second reset signal may also be referred to as a first reset signal.

[0152] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0153] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0154] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0155] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0156] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0157] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A software control and on-orbit re-injection method for a satellite payload master control system, wherein the satellite payload master control system includes a programmable gate array and a digital signal processor, characterized in that, include: Obtain software in-orbit re-injection instructions from the satellite management platform; In response to the software on-orbit re-injection command, the software on-orbit re-injection package of the satellite management platform is downloaded, and the software on-orbit re-injection package is written into the target Flash storage unit through a programmable gate array, wherein the target Flash storage unit is currently in an idle state; In response to the completion of writing the software on-orbit re-injection package, a software power-on loading instruction is generated, wherein the software power-on loading instruction indicates a power-on reload from the target Flash storage unit; Based on the aforementioned software power-on loading instruction, the programmable gate array and digital signal processor are software powered on and loaded. If the result of the software power-on loading is that the programmable gate array is successfully loaded and the digital signal processor fails to load, the programmable gate array is invoked to reset the digital signal processor. If the result of the software power-on loading is that the digital signal processor is successfully loaded and the programmable gate array is unsuccessful, a first reset instruction for the programmable gate array is generated, and based on the first reset instruction, the digital signal processor is invoked to reset the programmable gate array. If the result of the software power-on loading is that both the programmable gate array and the digital signal processor fail to load, a second reset instruction is generated, and the satellite payload master control system is restarted based on the second reset instruction.

2. The method according to claim 1, characterized in that, The step of resetting the digital signal processor by invoking the programmable gate array includes: By pulling the MP / MC pin of the digital signal processor to MP mode through the programmable gate array, the digital signal processor is reset, enabling it to start the corresponding running program from the external interface provided by the programmable gate array.

3. The method according to claim 2, characterized in that, Also includes: When the digital signal processor is successfully powered on and loaded, a watchdog signal is generated in the digital signal processor at specified time intervals, and the watchdog signal is sent to the programmable logic gate array. as well as After the programmable gate array is successfully powered on and loaded, monitor whether the programmable gate array has not received the dog feed signal for a specified time interval. If the programmable gate array does not receive the dog feed signal for more than the specified time interval, a first reset signal is generated in the programmable gate array. Based on the first reset signal, the digital signal processor is reset, so that the digital signal processor is powered on and reloaded.

4. The method according to any one of claims 1 to 3, characterized in that, The step of invoking the digital signal processor to reset the programmable gate array based on the first reset instruction includes: Based on the first reset command, the digital signal processor runs a Flash switching program via a magnetic latching relay to switch the first Flash memory unit currently connected to the programmable gate array to a backup second Flash memory unit, where the second Flash memory unit is the target Flash memory unit; The digital signal processor sends a second reset signal to the programmable gate array (PGA) via the PROG_B_O pin, causing the PGA to respond to the acquisition of the second reset signal by rereading the bitstream in the second Flash memory unit and starting up.

5. The method according to claim 4, characterized in that, The determination of the software power-on loading result of the satellite payload master control system also includes: After the digital signal processor is successfully powered on and loaded, the programmable gate array is monitored and timed for startup through the OTP ROM of the digital signal processor. If the timing duration of the start monitoring exceeds a predetermined time threshold, it is determined that the programmable gate array has failed to power on.

6. A software control and on-orbit refueling device for a satellite payload master control system, characterized in that, include: The software on-orbit re-injection instruction acquisition unit is used to acquire software on-orbit re-injection instructions from the satellite management platform; The on-orbit re-injection package writing unit is used to respond to the software on-orbit re-injection command, download the software on-orbit re-injection package of the satellite management platform, and write the software on-orbit re-injection package into the target Flash storage unit through a programmable gate array, wherein the target Flash storage unit is currently in an idle state. A power-on loading instruction generation unit is used to generate a software power-on loading instruction in response to the completion of writing the software on-orbit re-injection package, wherein the software power-on loading instruction indicates a re-power-on loading from the target Flash storage unit; The power-on loading execution unit performs software power-on loading on the programmable gate array and digital signal processor based on the software power-on loading instruction; The first execution unit is configured to, if the result of the software power-on loading is that the programmable gate array is successfully loaded and the digital signal processor fails to be loaded, call the programmable gate array to reset the digital signal processor. The second execution unit is configured to generate a first reset instruction for the programmable gate array if the result of the software power-on loading is that the digital signal processor is successfully loaded and the programmable gate array fails to be loaded, and to call the digital signal processor to reset the programmable gate array based on the first reset instruction. The third execution unit is configured to generate a second reset instruction if the result of the software power-on loading is that both the programmable gate array and the digital signal processor fail to load upon power-on, and to restart the satellite payload master control system based on the second reset instruction.

7. The apparatus according to claim 6, characterized in that, The first execution unit is used for: By pulling the MP / MC pin of the digital signal processor to MP mode through the programmable gate array, the digital signal processor is reset, enabling it to start the corresponding running program from the external interface provided by the programmable gate array.

8. The apparatus according to claim 7, characterized in that, The device also includes: A watchdog signal reporting unit is configured to, upon successful power-on loading of the digital signal processor, generate a watchdog signal in the digital signal processor at specified time intervals and send the watchdog signal to the programmable gate array; and The monitoring unit is used to monitor whether the programmable gate array has not received the dog-feed signal for a specified time interval after the programmable gate array is successfully powered on and loaded. The fourth execution unit is configured to generate a first reset signal in the programmable gate array if the programmable gate array does not receive the dog feed signal for a specified time interval, and reset the digital signal processor based on the first reset signal, so that the digital signal processor is powered on and reloaded.

9. A satellite payload master control system, characterized in that, The software control and on-orbit re-injection method for a satellite payload master control system according to any one of claims 1 to 5 includes: The digital signal processor uses an external interface to run its own startup program, which is used to perform signal processing tasks for the satellite payload master control system; A programmable gate array is used to load and execute programs for the satellite payload master control system and to provide the external interface for the digital signal processor. The first Flash storage unit and the second Flash storage unit are respectively connected to the programmable gate array. Both the first Flash storage unit and the second Flash storage unit are used to store the code stream data of the programmable gate array and the boot program and application program of the digital signal processor. A magnetic latching relay is connected to the first Flash memory unit and the second Flash memory unit respectively, and is connected to the digital signal processor. It is configured to run a Flash switching program based on the instructions of the digital signal processor to switch the current Flash memory unit of the programmable gate array between the first Flash memory unit and the second Flash memory unit. The programmable gate array and the digital signal processor are configured to reload the software based on a software power-on loading instruction. The software power-on loading instruction is generated in response to the action of the programmable gate array writing the software on-orbit reloading package from the satellite management platform to the target Flash storage unit during the on-orbit reloading process of the satellite payload master control system software. The target Flash storage unit is an idle unit between the first Flash storage unit and the second Flash storage unit. The programmable gate array is configured to, upon successful power-on loading, pull the MP / MC pin of the digital signal processor (DSP) that failed to load upon power-on to MP mode, thereby resetting the DSP and causing it to restart the corresponding running program from the external interface. The digital signal processor is configured to, upon successful power-on loading, run the Flash switching program via a magnetic latching relay and then control the programmable gate array (PLG) via its PROG_B_O pin to reread the bitstream from the current Flash memory unit after switching and start up. The satellite payload master control system is configured to perform its own restart operation if both the programmable gate array and the digital signal processor fail to load upon power-up.

10. A computer-readable storage medium, characterized in that, The device stores computer-executable instructions configured to perform the method as described in any one of claims 1 to 5.

Images