# Reconfiguration of microcontroller payload driver

Romain Boyer, Frédéric Camps

► To cite this version:

Romain Boyer, Frédéric Camps. Reconfiguration of microcontroller payload driver. Cubesat Symposium 2023, Dec 2023, Louvain, Belgium. hal-04330624

HAL Id: hal-04330624

https://hal.science/hal-04330624v1

Submitted on 8 Dec 2023

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC0 1.0 - Universal - International License
# Reconfiguration of microcontroller payload driver

LAAS-CNRS, Université de Toulouse, CNRS, Toulouse, France
Romain Boyer, Cyril Campanella, Frédéric Camps

**Keywords:** reconfiguration, embedded systems, space, bootloader, microcontroller, resilience, versatility, memory, payload, communication.

Embedded systems in space are subjected to various phenomena that may disrupt system operations and damage memory components such as radiations, wear and tear of electronics components, degradation of electronic cards due to severe temperature cycling.

This abstract highlights the necessity and presents an approach to reprogram a nanosatellite payload driver aiming to enhance its resilience against degradation.

The nanosatellite, NIMPH (Nanosatellite to Investigate Microwave Photonic Hardware), incorporates an EDMON (Erbium-Doped Monitoring) payload powered by the ATmegaS128 microcontroller.

To mitigate potential memory damage and prevent program failure, ATmegaS128 must include a specific program to modify FLASH memory (128kB) and so reload a new mission software (MSW). The key challenge here involves empowering the microcontroller to read and write in its own memory while using a program prewritten into the same memory termed 'bootloader'. A critical point is to keep bootloader program intact to guarantee reconfiguration of mission software avoiding overwriting this program.

The bootloader program is written within a specific section of the FLASH memory, known as the BOOT section (8kB), and is so structured to avoid writing in this section. Meanwhile, application programs are stored in the APPLICATION section (120kB).

This section is divided into six slots of 20kB each in this reconfiguration specifications to enable backup programs stored in memory, as launch mission software. In the case of communication failure between on-board computer and microcontroller, it will be able to reload backup mission software.

The first slot is the active block, hosting the currently running application. Due to interrupt vectors, only this one can run mission software. Slots two through five serve as backup slots. Slot five is supposed to keep the launch program version to reload in case of communication failure. Slot six is the configuration slot, containing pertinent parameters about each slot, including ID, version, CRC, page count and information about configuration itself as size of each parameter. Fault detection is essential to avoid starting a corrupted program and is based on CRC algorithm ESA ECSS-E-ST-70-41C standard. Crucial communication data as packet number and slot number are protected by double check and bit reversing in reconfiguration algorithms.

Following a microcontroller reset initiated by on-board computer, and by setting microcontroller fuses, the program counter is set to the beginning of BOOT section. Consequently, bootloader program is run first. To save data between two resets, EEPROM memory in microcontroller is used. Specifically, flags are set to count number of reset without UART communication, and in case of count overflow, launch mission software application is reloaded in slot number one. It prevents an UART failure with on-board computer while application failure.

The on-board computer can drive bootloader with four basic instructions. It can ask for a simple start of current mission software by jumping program counter to address 0x00000 of FLASH memory (slot number one). Moreover, it can send comprehensive binary program through UART serial
communication, and order to store it in a specific slot. In addition, it can call for a copy of a backup program in slot number one to run it. Finally, it can request the configuration of memory.

Through reconfiguration algorithm and strategy, the EDMON payload can run multiple programs throughout its mission, enhancing its versatility and resilience.

<figure><img src="image_2.png" /><figcaption>Figure 1 Configuration of Flash Section</figcaption></figure>