An on-orbit reconfiguration method for embedded system software of spaceborne equipment and the embedded system of spaceborne equipment

Abstract

This invention discloses an on-orbit reconfiguration method for embedded system software of spaceborne equipment and an embedded system for spaceborne equipment. The method includes: partitioning the FLASH memory of the microcontroller of the spaceborne equipment into a BootLoader area and an application storage area; pre-firing an independent BootLoader in the BootLoader area; receiving program file packets from the spacecraft computer during on-orbit operation; receiving the program file using a two-stage reliable transmission protocol including sequential reception and packet replacement reception, wherein the sequential reception stage receives and dynamically records erroneous packets, and the packet replacement reception stage selectively retransmits only erroneous packets; verifying the received complete program file according to the instructions of the spacecraft computer, and writing it into the application storage area to complete the update after passing the verification, jumping from the BootLoader to the updated application, and completing the on-orbit reconfiguration.

Description

Technical Field

[0001] This invention relates to the field of embedded software for spaceborne equipment, and more particularly to an on-orbit reconfiguration method for embedded system software of spaceborne equipment and an embedded system for spaceborne equipment. Background Technology

[0002] In the context of the rapid development of aerospace technology, the on-orbit maintenance and functional upgrade capabilities of spaceborne equipment software systems play a crucial role in the long-term reliable operation and functional expansion of satellites. As satellite application scenarios become increasingly complex, traditional on-board update methods are often limited by issues such as high system coupling and significant security risks associated with program file reception, making it difficult to quickly respond to changes in the space environment and the needs of mission updates. Therefore, developing spaceborne software systems with on-orbit autonomous reconfiguration capabilities has become an important technological direction for improving the intelligence level and mission adaptability of spaceborne equipment.

[0003] The core objective of onboard software reconfiguration is to update the software system without altering the satellite's original hardware design and existing software architecture. This process must ensure a high degree of decoupling between the reconfiguration function and the operational system. The reconfiguration mechanism itself must not interfere with the execution of routine onboard tasks, nor should it depend on the specific implementation of the modified software modules. This decoupling not only improves the flexibility of updates but also significantly reduces the risk of system failures introduced by reconfiguration. Achieving this capability faces multiple technical challenges. On the one hand, the onboard software needs to complete the storage, writing, and jump functions of program files in a resource-constrained embedded hardware environment. On the other hand, a secure and reliable reconfiguration protocol needs to be built, including receive verification, data caching, and packet processing, to prevent system crashes or functional abnormalities during the update process.

[0004] Therefore, there is an urgent need for a method to support the reconfiguration of onboard equipment software in the on-orbit operating environment. This method should enable software updates without modifying the original hardware and software design, and the reconfiguration function should be decoupled from the business system to improve the satellite's on-orbit mission expansion capabilities. This will provide important support for building a more intelligent and flexible next-generation aerospace software system. Summary of the Invention

[0005] To address the technical challenges of unreliable program file transmission, inconvenient interface exposure, and the need to modify existing software and hardware designs in on-orbit updates of existing spaceborne payload software, this invention aims to overcome the deficiencies of the prior art and proposes an on-orbit reconstruction method for embedded system software of spaceborne equipment. This invention also discloses an embedded system for spaceborne equipment.

[0006] In view of this, the present invention proposes an on-orbit reconfiguration method for embedded system software of spaceborne equipment, comprising: The FLASH memory of the microcontroller of the spaceborne equipment is partitioned into a BootLoader area and an application storage area to achieve a high degree of decoupling; A separate BootLoader is pre-installed in the BootLoader area; When in orbit, it receives program file packets from the spacecraft computer via the CAN bus; A two-stage reliable transmission protocol, including sequential reception and packet retransmission, is used to reliably receive program files. In the sequential reception stage, erroneous and missing packets are received and dynamically recorded. In the packet retransmission stage, erroneous and missing packets are selectively retransmitted only. According to the instructions of the spacecraft computer, the received complete program file is verified. If it passes the verification, it is written to the application storage area to complete the update. The bootloader jumps to the updated application program to complete the on-orbit reconstruction of the embedded system software.

[0007] As an improvement to the above method, the BootLoader area is located in the starting sector of the FLASH memory, and the application storage area is located in the subsequent sectors. During compilation, the application performs interrupt vector table remapping at the beginning of the main function to ensure that interrupts can be responded to correctly.

[0008] As an improvement to the above method, the BootLoader is used to communicate with the spacecraft computer via the CAN bus, including instruction parsing, telemetry return, and file reception, thereby decoupling the software reconfiguration function from the business system; the BootLoader is completely isolated from the upper-layer application in terms of storage space and running logic.

[0009] As an improvement to the above method, the sequential receiving phase includes: The BootLoader receives data packets in sequence according to their packet numbers and performs real-time verification and continuity checks. The sequence numbers of incorrect or missing packets are recorded in a dynamically maintained list of incorrect or missing packets until the last packet is received. The packet re-reception phase includes: The smallest error packet number in the error packet list is reported to the satellite computer via telemetry parameters, and then retransmission is awaited. When a retransmitted data packet is received, the corresponding sequence number is removed from the list of missing or corrupted packets and the telemetry parameters are updated until the list is empty, at which point the program file has been received completely.

[0010] As an improvement to the above method, the program file reception uses a static two-dimensional array to directly store data by packet number index, achieving efficient data caching and the simplest concatenation of the final file, avoiding complex dynamic memory allocation.

[0011] As an improvement to the above method, the method further includes: the BootLoader reporting status information to the spacecraft computer via telemetry parameters.

[0012] As an improvement to the above method, the step of writing to the application storage area to complete the update and jumping from the BootLoader to the updated application includes: Unlock the FLASH memory area, erase the target sector, program word by word, and relock the FLASH memory area; All interrupts are disabled, core peripherals are reset, and the validity of the application stack top address is verified. The function pointer is used to jump to the application reset interrupt service routine, thereby completing the on-orbit reconfiguration of the embedded system software.

[0013] On the other hand, the present invention provides an embedded system for spaceborne equipment, comprising: The microcontroller includes a partitioned FLASH memory, divided into a BootLoader storage area and an application storage area; An independent BootLoader program, pre-installed in the BootLoader storage area, is used to implement the method described in any one of claims 1-7; CAN bus interface for communication with the spaceborne computer; The static cache area is used to cache the program file packages received from the space agency computer.

[0014] As an improvement to the above system, the microcontroller adopts the STM32F40 series, with the BootLoader storage area being the first 32KB and the application storage area being the subsequent 480KB.

[0015] Compared with the prior art, the advantages of the present invention are: 1. Highly reliable on-orbit software reconfiguration and system decoupling were achieved. This invention introduces an independent BootLoader program based on IAP technology, completely separating the refactoring function from the business application in terms of storage space and runtime logic, ensuring a high degree of decoupling between the bootloader and the application. This effect means that software updates during satellite-in-orbit do not affect the normal functionality of the application. This is because the BootLoader, as an independent low-level management program, interacts with the satellite platform only through a standard communication interface, without requiring any modification to the application's code or hardware design. This creates a secure and isolated update environment, greatly improving the robustness and mission continuity of the entire onboard software system.

[0016] 2. Improved success rate of large file transfers over unreliable channels. The two-stage reliable transmission protocol designed in this invention significantly improves the success rate and integrity of program file transmission in complex space communication environments. This protocol effectively solves the problem of incomplete data caused by CAN bus errors and packet loss through a collaborative mechanism of "sequential reception" and "replacement reception." Its technical advantages are reflected in its ability to achieve precise control and fault-tolerant recovery of the transmission process under limited onboard resources and bandwidth, ensuring that the ultimately received program file is complete and error-free. Its success stems from the fact that this protocol abandons the traditional, inefficient global retransmission strategy and instead adopts intelligent selective retransmission, performing targeted repair only for actual erroneous or missing packets. This ensures data accuracy while maximizing the conservation of valuable space-to-ground communication resources and time costs.

[0017] 3. Ensured the security and stability of the update process in resource-constrained environments. This invention provides a high level of security and stability assurance for on-orbit software reconfiguration through full-process status monitoring and multiple security verification mechanisms. The technical effect is that every critical step in the entire update process, from command reception and file transfer to program burning and final jump, is monitored, verifiable, and controllable, effectively preventing and mitigating system risks caused by transmission errors, command anomalies, or illegal program files. This is because the solution designs a defense-in-depth system including single-packet verification, packet sequence number continuity checks, application stack top address verification, and reset address validity judgment, combined with real-time telemetry feedback, forming a closed-loop security management logic that ensures the absolute reliability of update operations in resource-constrained embedded systems.

[0018] 4. Enhanced the versatility of the technical solution and the system's adaptability. The software-based on-orbit reconfiguration scheme proposed in this invention possesses excellent versatility and platform adaptability, enabling its widespread application to various types of spaceborne equipment. Its technical advantage lies in its modular and standardized design, which eliminates dependence on specific payload hardware platforms or software architectures. The BootLoader's programming follows a generalized process, requiring only simple memory address configuration to adapt to different microcontroller models. This broad adaptability stems from the fact that the core of this scheme is the construction of a software update logic and communication protocol independent of specific hardware details, making it a reusable and universal technical path. This significantly expands the invention's application scope and lays a solid foundation for building a standardized and intelligent next-generation aerospace software system. Attached Figure Description

[0019] Figure 1 It is a Flash storage partition; Figure 2 It is a hybrid programming model; Figure 3It is the write jump timing logic; Figure 4 It is a state transition process; Figure 5 It refers to the data stream and technical characteristics of the transmission protocol; Figure 6 This is an advantage of the transmission protocol design; Figure 7 It is a file packet receiving state machine; Figure 8 It is the process of packet loss and replacement; Figure 9 It is a packet caching structure; Figure 10 This is the complete betting process. Detailed Implementation

[0020] This invention aims to design an independent BootLoader program based on IAP technology and construct a reliable transmission protocol for receiving program files via a CAN bus. To address the issues of packet errors and omissions in space communication, this invention employs a two-stage transmission strategy of sequential reception and packet replacement reception, effectively ensuring the integrity and correctness of program file transmission. This allows the solution to achieve reliable on-orbit reconfiguration and functional upgrades of payload software under stringent conditions without adding new hardware or altering the original design, meeting the urgent needs of modern space missions for on-orbit satellite maintenance, functional expansion, and lifespan extension.

[0021] (1) Method composition and architecture The core components of this technical solution include: A standalone BootLoader: As the core management module of the system, this program is pre-installed on the spacecraft before launch, based on IAP technology. It is responsible for all communication with the spaceborne computer via the CAN bus, including receiving remote control commands, returning telemetry data, and receiving and processing application file packages. It is completely isolated from the application programs in terms of storage and functionality.

[0022] Partitioned FLASH memory: such as Figure 1 As shown, the FLASH memory of the microcontroller (in one embodiment, an STM32F407) is partitioned. A fixed-size sector at the front (sectors 0-1 in one embodiment) is dedicated to storing the BootLoader program; the remaining large-capacity sectors at the back (sectors 2-7 in one embodiment) are used to store the application program. This partitioning ensures the independence and security of the bootloader and the application program.

[0023] Two-phase transport protocol layer: A software protocol specifically designed for unreliable channels is implemented within the BootLoader. This layer is responsible for handling packet reception, verification, buffering, and reassembly of program files. Its core is a two-phase mechanism of "sequential reception" and "replenishment reception," such as... Figure 2 As shown.

[0024] Application Update and Jump: Responsible for writing successfully received and verified program data to the application storage area, and after confirming all processes are error-free, safely disabling system interrupts, resetting peripheral states, and executing a jump from the BootLoader to the new application, such as... Figure 3 As shown.

[0025] (2) Working principle of software refactoring This technical solution works based on IAP technology and a custom reliable transmission protocol, enabling complete on-orbit software reconfiguration. Its core process is as follows: Initialization and Waiting: After the device is powered on, the BootLoader is run first and then enters a short waiting period. If no update command is received, it will automatically jump to the existing application for execution; if an update command is received, it will enter the file receiving state.

[0026] Two-stage reliable file transfer: Sequential Reception Phase: The BootLoader receives data packets forwarded by the satellite service in sequence according to their sequence numbers. During this phase, the system synchronously performs single packet verification and sequence number continuity checks, and dynamically records the sequence numbers of detected erroneous and missing packets into an error / missing packet list, without interrupting the main reception process.

[0027] Packet Retrieval Phase: Upon receiving the tail packet indicating the end of transmission, the system switches to packet retrieval mode. At this time, the BootLoader reports the smallest packet sequence number from the list of missing / erroneous packets via the telemetry channel and requests the satellite service to retransmit the specified single data packet. Each successfully retrieved packet is removed from the list, and the requested sequence number is updated until the list is empty, ensuring file integrity.

[0028] Program Update and Secure Jump: After the file is received completely, under the control of the mission instructions, the BootLoader writes the complete program file from the cache to the designated application FLASH area. After writing is complete, a strict pre-jump check is performed, the system state is cleared, and the jump to the new program is completed.

[0029] (3) System reliability and stability assurance To ensure the safety and stability of the reconstruction process in complex spatial environments, this solution integrates multiple safeguard mechanisms: The entire process is observable: By defining and returning telemetry parameters such as "software re-injection status flag" and "software reconstruction error frames" in real time, ground personnel can clearly grasp the status of each step of the reconstruction process and achieve full monitoring.

[0030] Multiple security checks: The system has single packet verification and global packet sequence number verification at the transmission level; at the file level, it will perform format and executability checks on the received program files, such as stack top address checks; and it will perform final confirmation before jumping, forming a defense-in-depth system.

[0031] Resource determinism and robustness: A statically allocated two-dimensional array is used as a data cache, eliminating the uncertainty brought about by dynamic memory management. The entire process is designed as a state machine-driven system with rigorous logic, effectively handling unexpected situations such as transmission interruptions and instruction exceptions.

[0032] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and embodiments.

[0033] Example 1 Embodiment 1 of the present invention proposes an on-orbit reconfiguration method for embedded system software of spaceborne equipment, specifically including: 1. Method Composition and Deployment Independent BootLoader: This part is the control core. In the specific implementation, STMicroelectronics' STM32F407VET6 is selected as the main control microcontroller. Before payload launch, the self-developed BootLoader program is burned into the starting sector of the FLASH memory, starting at address 0x08000000, using ICP programming, such as connecting a J-Link programmer. This program is independently responsible for all communication with the spaceborne computer via the CAN bus, including command parsing, telemetry return, and file reception, and is completely isolated from upper-layer applications.

[0034] Partitioned FLASH memory: During implementation, the chip's built-in 512KB FLASH memory needs to be physically partitioned. The BootLoader memory area occupies the first 32KB (sectors 0-1). The application memory area is set to the subsequent 480KB space (sectors 2-7, starting address 0x08008000). During application compilation, interrupt vector table remapping is performed at the beginning of the main function (e.g., SCB->VTOR = FLASH_BASE | 0x8000;) to ensure that interrupts can be responded to correctly.

[0035] Two-stage file transfer protocol: This part is implemented in software within the BootLoader. It defines and parses the multiframe structure on the CAN bus, including packet sequence number, service subtype, checksum, etc., and drives the two-stage state machine of "sequential reception" and "replenishment reception". In the specific implementation, a statically allocated two-dimensional array is used as a data buffer, whose row index directly corresponds to the transmission packet sequence number, so as to achieve efficient data management without dynamic allocation.

[0036] Program Update and Safe Jump: The complete program file in the cache is written to the application storage area. The process includes: unlocking the FLASH, erasing the target sector, programming word by word, and relocking the FLASH. Before the jump, critical system preparations must be performed: disabling all interrupts, resetting core peripherals, and verifying the validity of the application stack top address. Finally, a function pointer is used to jump to the application's reset interrupt service routine.

[0037] 2. Software Refactoring Workflow like Figure 4 As shown: System Startup and Waiting: After the device is powered on, the BootLoader program runs first. The program enters a 15-second waiting state and reports the status flag "01H". If no instruction is received, it will automatically jump to the original application after the timeout; if the instruction "Enter file waiting to receive state" is received, it will enter state "02H" to prepare to receive files.

[0038] Reliable file transfer: such as Figure 5 As shown.

[0039] Sequential Reception Phase (Status "03H"): The BootLoader receives data packets in sequence according to their sequence numbers, and performs real-time verification and continuity checks. The sequence numbers of all incorrect or missing packets are recorded in a dynamically maintained list. This phase continues until the last packet is received.

[0040] Packet Retrieval Phase (Status "04H"): The system reports the smallest missing packet sequence number in the list via the telemetry parameter "Software Reconstruction of Missing Frames" and waits for the satellite crew to retransmit the specific packet. Each successfully retrieved packet is removed from the list and the telemetry is updated until the list is empty, at which point the status changes to "05H", indicating that the file reception is complete.

[0041] like Figure 6 The diagram illustrates the advantages of the transport protocol design, such as... Figure 7 The diagram shows the file packet receiving state machine; as shown... Figure 8 The diagram shows the packet loss and repackaging process.

[0042] Program update and verification execution: The Starship computer issues a "Enter file update state" command. The BootLoader verifies the received complete program file and writes it to the application storage area starting at address 0x08008000.

[0043] After the update was completed, the status flag changed to "07H". The space agency finally issued the "switch to normal operation" command, the BootLoader executed the safe jump procedure, the system began running the new application, and the entire on-orbit reconfiguration was completed.

[0044] like Figure 9 The diagram shows the packet caching structure; Figure 10 This is the complete betting process.

[0045] 3. Implementation of reliability assurance mechanisms The entire process is under monitoring: A series of telemetry parameters, such as software re-injection status flags and error / missing frame numbers, are designed to enable ground personnel to accurately grasp every step of the reconstruction process, achieving transparent operation and fault diagnosis.

[0046] Multiple verification and security mechanisms: At the transmission layer, single packet verification and global packet sequence number continuity verification are implemented; at the file layer, program file format and executability verification are performed; and before the jump, a final hardware status security check is conducted. This constitutes a deep, multi-layered defense system.

[0047] Deterministic resource design: Static memory allocation is employed to avoid the uncertainties of dynamic management. The protocol logic is driven by a deterministic state machine, ensuring absolute stability and high reliability in resource-constrained embedded environments.

[0048] 4. Experimental verification A test system was built on the actual STM32F407 hardware platform and integrated with the satellite mission simulation environment to conduct a complete functional and performance verification of this solution. Experimental results show that this solution can stably and reliably complete the reception, verification, and updating of large-capacity application files using the existing CAN bus communication interface without adding any hardware. The entire process is clearly defined, telemetry data is accurate, and the updated application runs normally, fully meeting the engineering application requirements for on-orbit software reconfiguration of spaceborne equipment.

[0049] Example 2 Embodiment 2 of the present invention provides an embedded system for spaceborne equipment, comprising: The microcontroller uses the STM32F40 series and includes partitioned FLASH memory, divided into a BootLoader storage area and an application storage area. An independent BootLoader is pre-installed in the BootLoader storage area to implement the method of Example 1; the BootLoader storage area occupies the first 32KB (sectors 0-1), and the application storage area is set to the subsequent 480KB space (sectors 2-7, starting address 0x08008000).

[0050] CAN bus interface for communication with the spaceborne computer; The static cache area is used to cache the program file packages received from the space agency computer.

[0051] Innovation points: 1. Decoupled Hardware and Software Design Based on Independent BootLoader: Traditional onboard software updates often require modifications to the application program or reliance on dedicated hardware interfaces, resulting in high coupling and significant risks. This invention innovatively utilizes IAP technology to design an independent BootLoader program completely isolated from the application program. This bootloader is factory-installed and communicates only through the existing CAN bus, achieving complete decoupling between software reconfiguration functions and the business system. This approach requires no modification to the original hardware and software design; the application program only needs to be developed conventionally and the interrupt vector table offset set, greatly reducing the impact and potential risks of on-orbit updates on normal system operation.

[0052] 2. Two-Phase Reliable Transmission Protocol to Address Unreliable Channel Challenges: Addressing the issues of packet errors and omissions that frequently occur in space communication, and the limitation of spaceborne systems lacking data splicing capabilities, this invention designs an innovative two-phase transmission protocol. This protocol clearly divides the transmission process into two phases: "sequential reception" and "replenishment reception." The sequential phase efficiently receives data and dynamically records errors and omissions; after the tail packet triggers a state transition, the replenishment phase selectively retransmits only the erroneous or missing packets. This mechanism ensures data integrity while avoiding the efficiency bottleneck of traditional global retransmission, significantly improving the success rate of large-capacity file transmission under unreliable channels.

[0053] 3. Static caching and lightweight management enable efficient operation in resource-constrained environments: To adapt to the stringent conditions of resource-constrained spaceborne embedded systems, this invention employs a static two-dimensional array for direct packet number indexing in data storage and management. This achieves efficient data caching and the simplest concatenation of the final file, avoiding complex dynamic memory allocation. The entire protocol's state machine and error packet list maintenance are implemented in a lightweight manner, with a small memory footprint, ensuring stable and reliable system operation even on conventional microcontrollers.

[0054] 4. Full-process status monitoring and multiple security checks ensure reconstruction reliability: This invention constructs a complete closed-loop reconstruction process from startup, reception, update to jump, and monitors each key status in real time through telemetry parameters. Multiple security checks are embedded in the process to effectively prevent system failures caused by abnormal commands, transmission errors, or illegal files, ensuring the safety, controllability, and high reliability of the entire on-orbit reconstruction process.

[0055] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to the embodiments, those skilled in the art should understand that modifications or equivalent substitutions to the technical solutions of the present invention do not depart from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for on-orbit reconfiguration of embedded system software for spaceborne equipment, comprising: The FLASH memory of the microcontroller of the spaceborne equipment is partitioned into a BootLoader area and an application storage area to achieve a high degree of decoupling; A separate BootLoader is pre-installed in the BootLoader area; When in orbit, it receives program file packets from the spacecraft computer via the CAN bus; A two-stage reliable transmission protocol, including sequential reception and packet retransmission, is used to reliably receive program files. In the sequential reception stage, erroneous and missing packets are received and dynamically recorded. In the packet retransmission stage, erroneous and missing packets are selectively retransmitted only. According to the instructions of the spacecraft computer, the received complete program file is verified. If it passes the verification, it is written to the application storage area to complete the update. The bootloader jumps to the updated application to complete the on-orbit reconstruction of the embedded system software. The sequential reception phase includes: The BootLoader receives data packets in sequence according to their packet numbers and performs real-time verification and continuity checks. The sequence numbers of incorrect or missing packets are recorded in a dynamically maintained list of incorrect or missing packets until the last packet is received. The packet re-reception phase includes: The smallest error packet number in the error packet list is reported to the satellite computer via telemetry parameters, and then retransmission is awaited. When a retransmitted data packet is received, the corresponding sequence number is removed from the list of missing and corrupted packets and the telemetry parameters are updated until the list is empty and the program file is fully received. The program file reception process uses a static two-dimensional array to directly store data by packet number index, achieving efficient data caching and the simplest concatenation of the final file, avoiding complex dynamic memory allocation. The process of writing to the application storage area to complete the update and jumping from the BootLoader to the updated application includes: Unlock the FLASH memory area, erase the target sector, program word by word, and relock the FLASH memory area; All interrupts are disabled, core peripherals are reset, and the validity of the application stack top address is verified. The function pointer is used to jump to the application reset interrupt service routine, thereby completing the on-orbit reconfiguration of the embedded system software.

2. The on-orbit reconfiguration method for embedded system software of spaceborne equipment according to claim 1, characterized in that, The BootLoader area is located in the first sector of the FLASH memory, and the application storage area is located in the subsequent sectors. During compilation, the application performs interrupt vector table remapping at the beginning of the main function to ensure that interrupts can be responded to correctly.

3. The on-orbit reconfiguration method for embedded system software of spaceborne equipment according to claim 1, characterized in that, The BootLoader is used to communicate with the spacecraft computer via the CAN bus, including command parsing, telemetry return, and file reception, thereby decoupling the software reconfiguration function from the business system. The BootLoader is completely isolated from the upper-layer application in terms of storage space and running logic.

4. The on-orbit reconfiguration method for embedded system software of spaceborne equipment according to claim 1, characterized in that, The method also includes: the BootLoader reporting status information to the spacecraft computer via telemetry parameters.

5. An embedded system for spaceborne equipment, characterized in that, include: The microcontroller includes a partitioned FLASH memory, divided into a BootLoader storage area and an application storage area. An independent BootLoader is pre-installed in the BootLoader area to implement the method described in any of claims 1-4; CAN bus interface for communication with the spaceborne computer; and The static cache area is used to cache the program file packages received from the space agency computer.

6. The embedded system for spaceborne equipment according to claim 5, characterized in that, The microcontroller uses the STM32F4 series, with the BootLoader area being the first 32KB and the application storage area being the subsequent 480KB.

Images