Modular space vehicle boards, control software, reprogramming, and failure recovery

• US 9,760,382 B2
• Filed: 06/22/2015
• Issued: 09/12/2017
• Est. Priority Date: 06/24/2014
• Status: Active Grant

• Current Assignee: TRIAD National Security, LLC
• Original Assignee: Los Alamos National Security LLC (Government of the United States of America)
• Inventors: Judd, Stephen, Dallmann, Nicholas, McCabe, Kevin, Delapp, Jerry, Prichard, Dean, Proicou, Michael, Seitz, Daniel, Stein, Paul, Michel, John, Tripp, Justin, Palmer, Joseph, Storms, Steven
• Primary Examiner(s): Iqbal, Nadeem
• Application Number:
  US14/745,941
• Publication Number:
  US 20150370579A1
• Time in Patent Office: 813 Days
• CPC Class Codes: G06F 11/0739 in a data processing system embedded in automotive or aircraft systems
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/1417 Boot up procedures
• CPC Class Codes: G06F 11/1433 during software upgrading
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files

Abstract

A space vehicle may have a modular board configuration that commonly uses some or all components and a common operating system for at least some of the boards. Each modular board may have its own dedicated processing, and processing loads may be distributed. The space vehicle may be reprogrammable, and may be launched without code that enables all functionality and/or components. Code errors may be detected and the space vehicle may be reset to a working code version to prevent system failure.

Claims

1. A computer-implemented method, comprising:

uploading a new code file, via a microprocessor of a space vehicle, to a local flash drive in a different file than an at-launch code file;

storing a location of the new code file, by the microprocessor, in a register of a flash-based field programmable gate array (FPGA); and

reading the register and loading the file code, by the microprocessor, into a static random access memory (SRAM)-based FPGA.

2. The computer-implemented method of claim 1, further comprising:

reading a register of the flash-based FPGA, by the microprocessor;

jumping, by the microprocessor, to a current flash bank to use; and

running the new code file, by the microprocessor, via a boot loader.

3. The computer-implemented method of claim 1, wherein the at-launch code file is protected in one flash bank and is not changed.

4. The computer-implemented method of claim 1, further comprising:

checking, by the microprocessor, whether a short watchdog interrupt has been received;

when the short watchdog interrupt has been received, checking, by the microprocessor, whether an error is detected; and

when the error is detected, resetting the space vehicle, by the microprocessor, to a most recently uploaded code state.

5. The computer-implemented method of claim 4, wherein the error comprises a processor lockup or an infinite loop.

6. The computer-implemented method of claim 4, further comprising:

checking, by the microprocessor, whether a number of resets has reached a maximum number of resets; and

when the maximum number of resets is reached, resetting the space vehicle, by the microprocessor, to an at-launch code state.

7. The computer-implemented method of claim 1, further comprising:

checking, by the microprocessor, whether a long watchdog interrupt has been received;

when the long watchdog interrupt has been received, checking, by the microprocessor, whether an error is detected; and

when the error is detected, resetting the space vehicle, by the microprocessor, to an at-launch code state.

8. The computer-implemented method of claim 7, wherein the error comprises an inability of the space vehicle to communicate with a ground station.

9. The computer-implemented method of claim 1, further comprising:

checking, by the microprocessor, whether a long watchdog interrupt has been received; and

when the long watchdog interrupt has been received, resetting the space vehicle, by the microprocessor, to an original safe mode launch code state.

10. The computer-implemented method of claim 1, wherein the at-launch code file does not enable all components and/or functionality of the space vehicle.

11. The computer-implemented method of claim 1, wherein the at-launch code file only includes core software required to enable operation of the space vehicle at launch.

12. The computer-implemented method of claim 11, wherein the core software enables turning on and deploying space vehicle deployables, communication with a ground station, and reprogramming of the space vehicle.

13. The computer-implemented method of claim 1, wherein the new code file and the at-launch code file are configured to implement a modified ATM protocol.

14. A computer program embodied on a non-transitory machine-readable medium, the program configured to cause a microprocessor to:

store one or more uploaded code files in a flash bank of a space vehicle;

store a current flash bank to use in a register of a flash-based field programmable gate array (FPGA) of the space vehicle;

read the register of the flash-based FPGA;

jump to the current flash bank to use; and

run the one or more uploaded code files via a boot loader.

15. The computer program of claim 14, wherein at-launch code of the space vehicle is protected in one flash bank and is not changed.

16. The computer program of claim 14, wherein at-launch code of the space vehicle does not enable all components and/or functionality of the space vehicle.

17. The computer program of claim 16, wherein the at-launch code only includes core software required to enable operation of the space vehicle at launch.

18. A space vehicle, comprising:

memory storing computer program code; and

at least one microcontroller configured to execute the stored computer program code, the at least one microcontroller configured to;

check whether a short watchdog interrupt has been received,

when the short watchdog interrupt has been received, check whether a first error is detected,

when the first error is detected, check whether a number of resets has reached a maximum number of resets,

when the maximum number of resets has been reached, reset the space vehicle to an at-launch code state,

when the maximum number of resets has not been reached, reset the space vehicle to a most recently uploaded code state,

check whether a long watchdog interrupt has been received,

when the long watchdog interrupt has been received, check whether a second error is detected, and

when the second error is detected, reset the space vehicle to an at-launch code state.

19. The space vehicle of claim 18, wherein the first error comprises a processor lockup or an infinite loop, and the second error comprises an inability of the space vehicle to communicate with a ground station.

20. The space vehicle of claim 18, wherein the at-launch code does not enable all components and/or functionality of the space vehicle.