Modular space vehicle boards, control software, reprogramming, and failure recovery

Patent metadata

Field	Value
Publication number	US-9760382-B2
Application number	US-201514745941-A
Country	US
Kind code	B2
Filing date	Jun 22, 2015
Priority date	Jun 24, 2014
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

A space vehicle may have a modular board configuration that commonly uses some or all components and a common operating system for at least some of the boards. Each modular board may have its own dedicated processing, and processing loads may be distributed. The space vehicle may be reprogrammable, and may be launched without code that enables all functionality and/or components. Code errors may be detected and the space vehicle may be reset to a working code version to prevent system failure.

First claim

The invention claimed is:

1. A computer-implemented method, comprising:
uploading a new code file, via a microprocessor of a space vehicle, to a local flash drive in a different file than an at-launch code file;
storing a location of the new code file, by the microprocessor, in a register of a flash-based field programmable gate array (FPGA); and
reading the register and loading the file code, by the microprocessor, into a static random access memory (SRAM)-based FPGA.

2. The computer-implemented method of claim 1 , further comprising:
reading a register of the flash-based FPGA, by the microprocessor;
jumping, by the microprocessor, to a current flash bank to use; and
running the new code file, by the microprocessor, via a boot loader.

3. The computer-implemented method of claim 1 , wherein the at-launch code file is protected in one flash bank and is not changed.

4. The computer-implemented method of claim 1 , further comprising:
checking, by the microprocessor, whether a short watchdog interrupt has been received;
when the short watchdog interrupt has been received, checking, by the microprocessor, whether an error is detected; and
when the error is detected, resetting the space vehicle, by the microprocessor, to a most recently uploaded code state.

5. The computer-implemented method of claim 4 , wherein the error comprises a processor lockup or an infinite loop.

6. The computer-implemented method of claim 4 , further comprising:
checking, by the microprocessor, whether a number of resets has reached a maximum number of resets; and
when the maximum number of resets is reached, resetting the space vehicle, by the microprocessor, to an at-launch code state.

7. The computer-implemented method of claim 1 , further comprising:
checking, by the microprocessor, whether a long watchdog interrupt has been received;
when the long watchdog interrupt has been received, checking, by the microprocessor, whether an error is detected; and
when the error is detected, resetting the space vehicle, by the microprocessor, to an at-launch code state.

8. The computer-implemented method of claim 7 , wherein the error comprises an inability of the space vehicle to communicate with a ground station.

9. The computer-implemented method of claim 1 , further comprising:
checking, by the microprocessor, whether a long watchdog interrupt has been received; and
when the long watchdog interrupt has been received, resetting the space vehicle, by the microprocessor, to an original safe mode launch code state.

10. The computer-implemented method of claim 1 , wherein the at-launch code file does not enable all components and/or functionality of the space vehicle.

11. The computer-implemented method of claim 1 , wherein the at-launch code file only includes core software required to enable operation of the space vehicle at launch.

12. The computer-implemented method of claim 11 , wherein the core software enables turning on and deploying space vehicle deployables, communication with a ground station, and reprogramming of the space vehicle.

13. The computer-implemented method of claim 1 , wherein the new code file and the at-launch code file are configured to implement a modified ATM protocol.

14. A computer program embodied on a non-transitory machine-readable medium, the program configured to cause a microprocessor to:
store one or more uploaded code files in a flash bank of a space vehicle;
store a current flash bank to use in a register of a flash-based field programmable gate array (FPGA) of the space vehicle;
read the register of the flash-based FPGA;
jump to the current flash bank to use; and
run the one or more uploaded code files via a boot loader.

15. The computer program of claim 14 , wherein at-launch code of the space vehicle is protected in one flash bank and is not changed.

16. The computer program of claim 14 , wherein at-launch code of the space vehicle does not enable all components and/or functionality of the space vehicle.

17. The computer program of claim 16 , wherein the at-launch code only includes core software required to enable operation of the space vehicle at launch.

18. A space vehicle, comprising:
memory storing computer program code; and
at least one microcontroller configured to execute the stored computer program code, the at least one microcontroller configured to:
check whether a short watchdog interrupt has been received,
when the short watchdog interrupt has been received, check whether a first error is detected,
when the first error is detected, check whether a number of resets has reached a maximum number of resets,
when the maximum number of resets has been reached, reset the space vehicle to an at-launch code state,
when the maximum number of resets has not been reached, reset the space vehicle to a most recently uploaded code state,
check whether a long watchdog interrupt has been received,
when the long watchdog interrupt has been received, check whether a second error is detected, and
when the second error is detected, reset the space vehicle to an at-launch code state.

19. The space vehicle of claim 18 , wherein the first error comprises a processor lockup or an infinite loop, and the second error comprises an inability of the space vehicle to communicate with a ground station.

20. The space vehicle of claim 18 , wherein the at-launch code does not enable all components and/or functionality of the space vehicle.

Assignees

• Los Alamos Nat Security Llc

Inventors

• Judd Stephen
• Dallmann Nicholas
• Mccabe Kevin
• Delapp Jerry
• Prichard Dean
• Proicou Michael
• Seitz Daniel
• Stein Paul
• Michel John
• Tripp Justin
• Palmer Joseph
• Storms Steven

Classifications

• G06F11/0739

  in a data processing system embedded in automotive or aircraft systems · CPC title

• G06F9/44505 Primary

  Configuring for program initiating, e.g. using registry, configuration files · CPC title

• G06F11/0757

  by exceeding a time limit, i.e. time-out, e.g. watchdogs · CPC title

• G06F11/1417 Primary

  Boot up procedures · CPC title

• G06F11/1433

  during software upgrading · CPC title