# Robust and Reconfigurable On-Board Processing for a Hyperspectral Imaging Small Satellite
## 3 On-Board Processing Unit Design
### Software Design
#### 3.3.1 Booting Procedure and Operating System  
Following the power-on event, the OPU boots the embedded Linux Operating System (OS). After booting, the SD-Card and eMMC are mounted, the camera drivers are loaded, time is synchronized between the OPU and satellite bus, and lastly, the main application is executed which is responsible for command and data handling. One essential feature in the design of the HYPSO-1 OPU is that the payload is expected to be powered-off most of the time, and is only powered-on for operations specifically involving communication with the OPU payload subsystem such as image acquisition or data buffering [32]. This conserves energy and the chance for single-event upsets is reduced. Two software components are involved in booting: the bootloader and the Operating System (OS) image. The bootloader consists of a First Stage Bootloader (FSBL) and a Second Stage Bootloader (SSBL). The OS is a customized embedded Linux distribution that is built and packaged into a boot image using the Petalinux toolchain provided by the designer of the Zynq XC/Z030-1 SoC AMD Xilinx. A booting procedure with integrity and redundancy in mind is designed as shown in Figure 4, by using the scripting capabilities of the U-boot SSBL [65]. Both the FSBL and the SSBL are stored thrice in sequence on the Quad Serial Peripheral Interface (QSPI) Flash. The detection of potential data corruption in the SSBL is ensured by md5 checksum. If verification by checksum fails, booting will restart using the next copy of the SSBL on the QSPI Flash. Figure 4: Flow chart of the boot sequence on the OPU which highlights the sequence of integrity checks and use of backups during the booting. Nominal booting without any integrity errors is indicated by the green dashed arrows. If the _reboot_ node is reached, the OPU is unrecoverable. The OS image file in Flattened Image Tree (FIT) format contains all components needed for booting Linux. There are two FIT boot image files on HYPSO-1. The primary image stored on the SD-Card, and the backup image, also named the golden image, stored on the embedded Multi Media Card (eMMC). The image on the SD-Card is the active configuration that is booted during fault-free operations. See Section 3.5 for a description about updates to the on-board software. The SSBL verifies data integrity of the boot image file using a hash and creates a root file system in volatile Dynamic Random Access Memory (DRAM). This has the advantage that no critical system files are stored outside of the hash verified image. All files to be kept between power cycles are stored on the SD card or eMMC outside the boot image file. These are non-system critical files like HSI data. There is no persistent OS state that can be corrupted permanently without being detected. If the data integrity verification fails, the SSBL attempts to boot the golden image on the eMMC. Once the golden image is booted, the corrupted boot image file can be replaced with the golden image file or an uplink of a non-corrupted image file can be performed. The SSBL is configured to increment a counter at the start of its execution that is also stored on the QSPI Flash. This counter, named boot counter, is reset on successful boot of a boot image file. If a bug in the SD Card image causes the boot process to not finish, the boot counter is not reset. After the counter reaches the value 5, the SSBL boots the golden image instead, without checking the primary image on the SD Card. In addition, using the boot counter, booting of the golden image can be forced in cases where booting is successful, but due to a software bug no communication can be established. This is done by power cycling the OPU five times before booting is completed and the counter is being reset. The faulty boot image file can then be corrected from the golden image. In addition to basic system files, the boot image file also contains the main application software as well as the libraries and drivers that it requires.