KR102154245B1 - Software-based reconfiguration unit within the satellite - Google Patents

Abstract

The present invention relates to a reconfiguration unit (RU) in an artificial satellite, and more particularly, to an artificial satellite operating the reconfiguration unit using software and a method of operating the same.
According to the present invention, the reset unit of the satellite operates using a state machine, so that the primary and redundancy reset units can organically perform the module reset. In addition, by designing the reconfiguration unit with software, it is possible to provide an onboard computer in which the time of implementation and the time of design determination are consistent and standardized.

Description

Software-based reconfiguration unit within the satellite}

The present invention relates to a reconfiguration unit (RU) in an artificial satellite, and more particularly, to an artificial satellite operating the reconfiguration unit using software and a method of operating the same.

Satellites are required to be developed to have a high degree of reliability due to the limited situation that they cannot be repaired if they break down after launch. Accordingly, in order to increase reliability, electronic components that have been verified in poor space environments are used in the development of electrical equipment for satellites, and redundancy design and efficient operation methods to cope with failures are proposed.

The satellite reset unit is a unit that performs a role of making the satellite in a safe state by controlling the operation subject to switch from the primary module to the redundancy module when it detects the motion of the satellite that deviates from normal. On the other hand, when implementing the reset unit, the failure management design must be confirmed, whereas the failure management design tends to be confirmed after the middle of satellite development. There is a problem that must be confirmed.

That is, when the reconfiguration unit is designed in hardware as in the related art, the order of implementation time and design confirmation time is reversed, and there is a high probability that a situation in which it is difficult to change the determined fault design to the reconfiguration unit.

In addition, since the failure management design may have a different design concept for each satellite, and the failure management design may be different for each low orbit satellite, geostationary orbit satellite, and planetary exploration satellite, the reset unit must be designed differently according to the characteristics of the satellite. Accordingly, when the reconfiguration unit is implemented in hardware as in the prior art, there has been a problem that it is impossible to design a standardized mounted computer.

The present invention is in accordance with the above-described necessity, and an object to be solved by the present invention is to provide a satellite reconfiguration unit in which a reconfiguration unit is designed in software so that an implementation time and a design confirmation time coincide.

In addition, another problem to be solved by the present invention is to provide a standardized onboard computer by designing a reset unit with software.

An artificial satellite according to an embodiment of the present invention includes a processor for executing software mounted on the satellite; A load input/output by the processor; A load power module for supplying power to the processor; And a reconfiguration unit configured to reset the processor and the load through the load power module. Including, wherein the reset unit includes a primary (Primary) reset unit and a redundant reset unit, and when the processor is not wake-up (Wake-up), any one of the main reset unit and the redundant reset unit When a reset unit of is determined as an NMT master reset unit, a reset unit other than the NMT master reset unit is determined as a slave reset unit, and a preset event occurs in a state in which the processor is not wake-up, The NMT master reset unit transmits a control signal to the load power module together with the slave reset unit to reset the processor and the load, and when the processor wakes up, the main reset unit and the redundant Any one of the reset units is determined as a pulse master reset unit, a reset unit other than the pulse master reset unit among the main reset unit and the redundant reset unit is determined as the slave reset unit, and the processor When the preset event occurs in a wake-up state, the pulse master reset unit changes its role to the NMT master reset unit and then transmits a control signal to the load power module together with the slave reset unit. The processor and load may be reset.

Further, the satellite may include a pulse bus connecting the reset unit and the load power module; And an interlink bus connecting the load power module, the reset unit, and the processor; wherein the NMT master reset unit plays a role of a communication master of the interlink bus and a control role of a communication bus on/off. The pulse bus may perform a communication bus on/off control role, and the pulse master reset unit may perform a communication slave role of the interlink bus and a communication bus on/off control role of the pulse bus.

In addition, the processor includes a primary processor and a redundant processor, and any one of the main processor and the redundant processor executes the software mounted on the satellite, and the reset while executing the software If reset by the unit, a processor executing software among the primary and redundant processors may be changed to another processor.

In addition, the preset event may include at least one of a load power module overcurrent signal, a load power module low voltage signal, a processor heart-beat warning signal, a reset ground command signal, and a separation signal between a satellite and a launch vehicle.

In addition, when it is determined that an error has occurred in the primary reset unit and the redundant reset unit, the reset unit may deactivate the reset unit in which the error has occurred.

Meanwhile, according to an embodiment of the present invention, a computer-readable medium in which a program for executing the satellite reconfiguration method as described above is recorded may be included.

Other aspects, features, and advantages other than those described above will become apparent from the following drawings, claims, and detailed description of the invention.

According to the present invention, the reset unit of the satellite operates using a state machine, so that the primary and redundancy reset units can organically perform the module reset.

In addition, according to the present invention, by designing the reconfiguration unit in software, it is possible to provide a mounted computer in which the implementation time and the design confirmation time are consistent and standardized.

1 is a simple block diagram for explaining a reconfiguration unit (RU) in a satellite according to an embodiment of the present invention.
2 is a block diagram illustrating an intra-satellite system in which a reset unit resets a module according to an embodiment of the present invention.
FIG. 3 is a diagram illustrating a state machine implemented in software in order to reset a module in a satellite by a reconfiguration unit according to an embodiment of the present disclosure.

Hereinafter, various embodiments of the present document will be described with reference to the accompanying drawings. However, this is not intended to limit the techniques described in this document to specific embodiments, and it should be understood to include various modifications, equivalents, and/or alternatives of the embodiments of this document. In connection with the description of the drawings, similar reference numerals may be used for similar elements.

Some component (eg, a first component) is "(functionally or communicatively) coupled with/to)" to another component (eg, a second component) or " When referred to as "connected to", it should be understood that the certain component may be directly connected to the other component, or may be connected through another component (eg, a third component). On the other hand, when a component (eg, a first component) is referred to as being “directly connected” or “directly connected” to another component (eg, a second component), the component and the It may be understood that no other component (eg, a third component) exists between the different components.

Terms used in this document are only used to describe a specific embodiment, and may not be intended to limit the scope of other embodiments. Singular expressions may include plural expressions unless the context clearly indicates otherwise. Terms used herein, including technical or scientific terms, may have the same meaning as commonly understood by one of ordinary skill in the technical field described in this document. Among the terms used in this document, terms defined in a general dictionary may be interpreted as having the same or similar meanings as those in the context of the related technology, and unless explicitly defined in this document, an ideal or excessively formal meaning Is not interpreted as. In some cases, even terms defined in this document cannot be interpreted to exclude embodiments of the present document.

Hereinafter, various embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a simple block diagram for explaining a reconfiguration unit (RU) in a satellite according to an embodiment of the present invention.

The reconfiguration unit (RU) is a configuration that enables the satellite to operate in a safe state by activating a surplus module when it is detected that a module in the satellite such as a processor is performing an abnormal operation such as an error.

The reconfiguration unit (RU) 100 according to the present invention may be implemented as a state machine through software, unlike a conventional reconfiguration FPGA (Field Unit is a Programmable Gate Array).

Referring to FIG. 1, the reset unit 100 may include a primary reset unit 110 and a redundant reset unit 120. When the reconfiguration unit 100 of the present invention detects that the primary reconfiguration module is deactivated, a redundancy reconfiguration unit may perform a task on its behalf through a state machine.

That is, the redundancy reset unit 120 may operate in hot redundancy by waiting in a hot standby state to which power is applied. Specifically, basically, the reset is performed by the main reset unit 110 and the sub-reset unit 120 together, but if necessary, the slave reset unit is organically switched to perform the role of the NMT master or pulse master reset unit. can do.

Meanwhile, when a preset event occurs, the reconfiguration unit (RU) may determine that a module in the satellite needs reconfiguration. In this case, the preset event may include a load power module overcurrent signal, a load power module low voltage signal, a processor heart-beat warning signal, a reset ground command signal, and a separation signal between a satellite and a launch vehicle, but is not limited thereto.

2 is a block diagram illustrating an intra-satellite system in which a reset unit resets a module according to an embodiment of the present invention.

2, the satellite is a reset unit 100, a load power module 200, a processor 300, a load module 400 and an interlink bus 210, a pulse bus 220, IO bus 230 May contain. Each of the reset units 100, the load power module 200, the processor 300, and the load module 400 may each include a primary (P) module and a redundant (R) module. However, this is only an exemplary embodiment, and the satellite may include additional configurations for resetting and various configurations to be reconfigured. Hereinafter, the main module and the redundant module will be expressed as P/R for convenience of description.

The bus (BUS) of the present invention is a communication system for transmitting data between modules in a satellite. Such a bus may be implemented through hardware such as wire or optical fiber, but is not limited thereto, and may be implemented by software including a communication protocol.

The interlink bus 210 is a communication device for connecting the reset unit 100, the load power module 200, and the processor 300. In the interlink bus 210 of the present invention, the processor 300 or the reconfiguration unit 100 may each become a communication master depending on the environment.

Specifically, when the processor 300 wakes up, the processor 300 may become a communication master of the interlink bus 210 and the reset unit 100 may become a communication slave.

Before the processor 300 wakes up, one of the reset units 100 P/R becomes a communication master and can communicate with modules connected through the interlink bus 210. . At this time, the reconfiguration unit 100 may downlink the telemetry without intervening the processor, if necessary. In particular, when the processor 300 is a communication master, a command received from the ground may be transmitted to the reset unit 100, and the telemetry of the reset unit may be transmitted to the ground.

The interlink bus 210 may include an interlink bus A and an interlink bus B, and a module that has become a communication master among the reset units P/R (110, 120) or the processor 300 turns on/off the interlink buses A and B. Can be controlled.

The pulse bus 220 is a component for connecting the reset unit 100 and the load power module 220. Power generated from the load power module 220 through the pulse bus 220 may be selectively supplied to the reconfigurable module P/R in the satellite, such as the processor 300 and the load module 400.

Specifically, the reset unit 100 may transmit a module reset signal to the load power module 200 through the pulse bus 220. In this case, the load power module 200 may switch power to reset the P/R of the processor 300 and the load module 400 in response to a module reset signal through the pulse bus 220.

The pulse bus 220 may include a pulse bus A and a pulse bus B, and one of the reset units P/R (110, 120) may control the on/off of the pulse bus A and the pulse bus B. have. At this time, the reset unit that controls the on/off of the pulse bus 220 may be a pulse master RU.

The IO bus 230 is a component for connecting the processor 300 and the load module 400.

The load power module 200 is a component for supplying power to various modules in the satellite, such as the processor 300 and the load module 400. The load power module 200 may switch power to reset P/R of the processor 300 and the load module 400 in response to a module reset signal through the pulse bus 220 as described above.

The processor 300 is a component for performing the overall process of the satellite of the present invention. As described above, the processor 300 may include a P/R processor.

Typically, the processor 300 performs a task through a primary processor, but when a preset event occurs in the primary processor, the reset unit 100 performs the task through a redundant processor. Can be reset. In this case, the preset event may include a processor heart-beat warning signal, a reset ground command signal, and a separation signal between the satellite and the launch vehicle, but is not limited thereto.

The processor 300 may mean, for example, a data processing device embedded in hardware having a circuit physically structured to perform a function represented by a code or command included in a program. As an example of such a data processing device built into the hardware, a microprocessor, a central processing unit (CPU), a processor core, a multiprocessor, and an ASIC (Application-Specific Integrated) Circuit) and processing devices such as a Field Programmable Gate Array (FPGA) may be covered, but the scope of the present invention is not limited thereto.

For example, the processor 300 may include RAM, ROM, and a system bus. Here, the ROM is a configuration in which the instruction set for booting the system is stored, and the CPU copies the operating system stored in the memory (not shown) to RAM according to the instruction stored in the ROM, and executes O/S to boot the system. When booting is complete, the CPU can perform various operations by copying various applications stored in the memory to RAM and executing them.

In the above, it has been described that the processor 300 includes only one CPU, but when implemented, it may be implemented with a plurality of CPUs (or DSP, SoC, etc.).

As described above, when the reconfiguration unit (RU) detects that a module in the satellite, such as a processor, performs an abnormal operation such as an error, it activates the surplus module so that the satellite operates in a safe state. It is a configuration that allows. For this, descriptions overlapping with those described in FIG. 1 will be omitted.

The reset unit 100 serves as an NMT master reset unit (RU, Reconfiguration Unit, Slave) reset unit (RU, Reconfiguration Unit), and pulse master reset unit (RU) according to the reset system environment. It is classified and the detailed roles are as follows.

Any one of the main reset unit 110 and the redundant reset unit 120 may be determined as an NMT master reconfiguration unit (RU) before the processor 300 wakes up. In this case, another remaining reconfiguration unit may be determined as a slave reconfiguration unit (RU), but this will be described in detail later.

The NMT master reconfiguration unit (RU) serves as a communication master in the interlink bus 210. That is, the NMT master reconfiguration unit (RU) may control the communication bus on/off of the interlink bus 210. In addition, the NMT master RU (Reconfiguration Unit) may control the communication bus on/off of the pulse bus 220.

Further, the NMT master RU (Reconfiguration Unit) may perform reconfiguration of various modules in the satellite through the pulse bus 220.

Any one of the main reset unit 110 and the redundant reset unit 120 may be determined as a pulse master RU (Reconfiguration Unit) when the processor 300 wakes up. In this case, another remaining reconfiguration unit may be determined as a slave reconfiguration unit (RU), but this will be described in detail later.

The pulse master RU (Reconfiguration Unit) does not turn on/off the communication bus of the interlink bus 210. That is, the pulse master RU (Reconfiguration Unit) serves as a communication slave in the interlink bus 210.

However, the pulse master RU (Reconfiguration Unit) may control the communication bus on/off of the pulse bus 220. That is, the pulse master RU (Reconfiguration Unit) serves as a communication master in the pulse bus 220.

In addition, the pulse master RU (Reconfiguration Unit) may perform reconfiguration of various modules in the satellite through the pulse bus 220. Specifically, the pulse master RU (Reconfiguration Unit) may perform reconfiguration after changing its role to an NMT master RU in order to perform a reconfiguration operation. Since the pulse bus 220 is connected to the load power module 200 but not connected to other reset target modules such as the processor 300, information reception through the interlink bus 210 is required to check whether the reset has been normally performed. Because it is necessary.

The slave reconfiguration unit (RU) may serve as a communication slave in the interlink bus 210. That is, when the reconfiguration unit 100 is determined as a slave reconfiguration unit (RU), the interlink bus 210 does not perform bus on/off control. Similarly, when the reconfiguration unit 100 is determined as a slave reconfiguration unit (RU), the pulse bus 220 does not perform bus on/off control.

However, the slave reconfiguration unit (RU) may perform reconfiguration of various modules in the satellite through the pulse bus 220.

Meanwhile, the satellite of the present invention has a function of deactivating the reset unit in consideration of an error situation of the reset unit 100. When the reconfiguration unit 100 is deactivated and is determined to be an inactive reconfiguration unit (RU), it can perform the same role as a slave RU (reconfiguration unit), but unlike the slave RU, reconfiguration cannot be performed.

FIG. 3 is a diagram illustrating a state machine implemented in software in order to reset a module in a satellite by a reconfiguration unit according to an embodiment of the present disclosure.

Referring to FIG. 3, the reset unit 100 implemented through a state machine may be in states from S0 to S7.

Specifically, INIT(S0) is a state starting from address 0 of the processor 300, and is a state in which peripheral hardware is initialized. After initializing the hardware, the reset unit 100 may transition to the Determ (S1) step to determine which role to perform (T1). Meanwhile, when the reset unit 100 is deactivated in the INIT (S0) state, it may transition to the Deact (S7) (T12).

Determ (S1) is a state for determining which of the NMT master RU, pulse master RU, and slave RU to perform. When it is determined as the NMT master RU, the reset unit 100 may transition to the NMT_MST(S2) state (T2). Meanwhile, when the reset unit 100 is deactivated in the Determ (S1) state, it may transition to the Deact (S7) (T16).

NMT_MST(S2) is a state in which the reconfiguration unit 100 performs the role of the NMT master RU. When detecting a preset event, for example, a reset signal, the reset unit 100 may transition to MST_RECONFIG (S3) to reset a module corresponding to the reset signal (T5). Thereafter, when the reset unit 100 is deactivated in the MST_RECONFIG (S3) state, it may transition to the Deact (S7) (T13).

MST_RECONFIG(S3) is a state in which the reset unit 100 performs a reset as an NMT master RU. When the reconfiguration of the module is finished, the reset unit 100 may transition to NMT_MST(S2) to wait for booting of the processor 300 (T6). Thereafter, when the reset unit 100 is deactivated in the NMT_MST (S2) state, it may transition to Deact (S7) (T14).

Meanwhile, when the reset unit 100 is determined to be the pulse master RU in the Determ (S1), the reset unit 100 may transition to the PLS_MST (S4) state (T3).

The PLS_MST(S4) may be in a state in which the reset unit 100 serves as a pulse master RU. When detecting a reset signal for a module, the reset unit 100 may transition to NMT_MST(S2) for reset (T7). The reset unit 100 may transition from the NMT_MST(S2) state to the MST_RECONFIG(S3) to reset the module corresponding to the reset signal (T5). Likewise, when the reset unit 100 finishes resetting the module, it may transition to NMT_MST(S2) to wait for the booting of the processor 300 (T6), and when the booting of the processor 300 is confirmed, PLS_MST(S4) again. Can transition to the state (T8). Thereafter, when the reset unit 100 is deactivated in the PLS_MST (S4) state, it may transition to the Deact (S7) (T15).

Meanwhile, when the reset unit 100 is determined as the slave RU in the Determ (S1), it may transition to the SLV (S5) state (T4). Thereafter, when detecting the reset signal, the reset unit 100 may transition to the SLV_RECONFIG (S6) state for module reset (T9). Meanwhile, when the reset unit 100 is deactivated in the SLV_RECONFIG (S6) state, it may transition to Deact (S7) (T18). Thereafter, the reset unit 100 may transition to the SLV (S5) state again when the module reset is finished (T10). Likewise, when the resetting unit 100 is deactivated in the SLV (S5) state, it may transition to the Deact (S7) (T17).

On the other hand, the reset unit 100 is the RU serving as the NMT master RU or the pulse master RU is deactivated and transitions to the Deact (S7) state, or when the RU serving as a slave is turned off (OFF), the RU serving as a slave is the NMT master RU or In order to perform the RU role, it can transition to the Determ (S0) state (T11).

Meanwhile, when the deactivated reset unit 100 is activated again, it may transition from the Deact (S7) state to the Determ (S1) state again in order to determine which role to perform (T19).

As described above, the reconfiguration unit 100 of the present invention has the effect of being able to organically convert into one module by operating the P/R reconfiguration unit using a state machine based on software.

Meanwhile, the methods according to various embodiments of the present invention described above may be implemented in the form of an application that can be installed on an existing satellite.

In addition, the above-described methods according to various embodiments of the present invention may be implemented only by software upgrade or hardware upgrade of an existing satellite.

In addition, various embodiments of the present invention described above may be performed through an embedded server provided in the satellite or an external server of the satellite.

Meanwhile, according to a temporary example of the present invention, various embodiments described above include a computer that can be read by a computer or a similar device using software, hardware, or a combination thereof. It can be implemented with software including commands stored in a readable recording medium). In some cases, the embodiments described herein may be implemented by the processor itself. According to software implementation, embodiments such as procedures and functions described herein may be implemented as separate software modules. Each of the software modules may perform one or more functions and operations described herein.

Meanwhile, a computer or a similar device mounted on a satellite is a device capable of calling a command stored in a storage medium and operating according to the called command, and may include a device according to the disclosed embodiments. When the command is executed by a processor, the processor may perform a function corresponding to the command directly or by using other components under the control of the processor. Instructions may include code generated or executed by a compiler or interpreter.

A recording medium that can be read by a device may be provided in the form of a non-transitory computer readable recording medium. Here,'non-transient' means that the storage medium does not contain a signal and is tangible, but does not distinguish between semi-permanent or temporary storage of data in the storage medium. In this case, the non-transitory computer-readable medium refers to a medium that stores data semi-permanently and can be read by a device, rather than a medium that stores data for a short moment, such as a register, cache, and memory. Specific examples of non-transitory computer-readable media may include CD, DVD, hard disk, Blu-ray disk, USB, memory card, ROM, and the like.

In addition, although the preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above, and the technical field to which the present invention belongs without departing from the gist of the present invention claimed in the claims. In addition, various modifications are possible by those of ordinary skill in the art, and these modifications should not be individually understood from the technical spirit or prospect of the present invention.

Therefore, the spirit of the present invention should not be limited to the embodiments described above, and not only the claims to be described later, but also all ranges equivalent to or equivalently changed from the scope of the present invention. It will be said to belong to the category.

100: reset unit
110: Primary reset unit
120: Redundant reset unit
200: load power module
210: Interlink bus
220: pulse bus
230: IO bus
300: processor
400: load module

Claims (13)

A processor for executing software mounted on the satellite;
A load module input/output to and from the processor;
A load power module for supplying power to the processor; And
Including; a reconfiguration unit for controlling the load power module and resetting the processor and the load module,
The reset unit includes a primary reset unit and a redundant reset unit,
When the processor does not wake-up, any one of the main reset unit and the redundant reset unit is determined as the NMT master reset unit, and the reset unit other than the NMT master reset unit is a slave reset unit. Is determined as,
When a preset event occurs while the processor is not wake-up, the NMT master reset unit transmits a control signal to the load power module together with the slave reset unit to reset the processor and the load module. And
When the processor wakes up, any one of the main reset unit and the redundant reset unit is determined as a pulse master reset unit, and a reset unit other than the pulse master reset unit is the It is determined by the slave reset unit,
When the preset event occurs while the processor is awakened, the pulse master reset unit changes its role to the NMT master reset unit and controls the load power module together with the slave reset unit. An artificial satellite that transmits a signal to reset the processor and load module. The method of claim 1,
The satellite comprises: a pulse bus connecting the reset unit and the load power module; And
An interlink bus connecting the load power module, the reset unit, and the processor; further comprising,
The NMT master reset unit performs a communication master role of the interlink bus and communication on/off control of the interlink bus, and the pulse master reset unit performs communication on/off control of the pulse bus. The method of claim 1,
The processor includes a primary processor and a redundant processor, and any one of the main processor and the redundant processor executes software mounted on the satellite,
A satellite that changes a processor executing software from among the primary and redundant processors to another processor when the software is being executed and reset by the reset unit. The method of claim 1,
The predetermined event includes at least one of a load power module overcurrent signal, a load power module low voltage signal, a processor heart-beat warning signal, a reset ground command signal, and a separation signal between the satellite and the launch vehicle. The method of claim 1,
The load module includes a primary load module and a redundant load module, and any one of the main load module and the redundant load module performs a function of the satellite,
An artificial satellite that changes a load module performing a function from among the primary and redundant load modules to another load module if reset by the reset unit while performing the function. The method of claim 1,
When it is determined that an error has occurred in the primary and redundant reset units, the reset unit deactivates the reset unit in which the error has occurred. When the processor is not awakened by a reconfiguration unit for resetting a processor that executes software mounted on the satellite, any one of the main reset unit and the redundant reset unit is reset. Determining an NMT master reset unit and determining a reset unit other than the NMT master reset unit as a slave reset unit;
When a preset event occurs while the processor is not wake-up by the reset unit, the NMT master reset unit transmits a control signal to the load power module together with the slave reset unit to the processor And performing reconfiguration of the load module.
When the processor is awakened by the reset unit, one of the main reset unit and the redundant reset unit is determined as a pulse master reset unit, and the pulse master reset unit Determining a non-reset unit as the slave reset unit; And
When the preset event occurs while the processor is awakened by the reset unit, the pulse master reset unit changes its role to the NMT master reset unit, and then together with the slave reset unit. Transmitting a control signal to the load power module to reset the processor and the load module; Satellite reset method comprising a. The method of claim 7,
The NMT master reset unit serves as a communication master of a load power module, an interlink bus connecting the reset unit, and the processor, and performs communication on/off control of the interlink bus, and the pulse master reset unit includes the reset unit and the processor. A satellite reset method that performs bus on/off control of the communication of the pulse bus connecting the load power module. The method of claim 7,
The step of performing the resetting of the processor is to change a processor executing the software from among a primary processor and a redundant processor to another processor if the processor is reset by the reset unit while executing software. Satellite reset method. The method of claim 7,
The preset event includes at least one of a load power module overcurrent signal, a load power module low voltage signal, a processor heart-beat warning signal, a reset ground command signal, and a separation signal between the satellite and the launch vehicle. Way. The method of claim 7,
The resetting of the load module is a load that performs the one function among a primary load module and a redundant load module when the load module is reset by the reset unit while performing a function of the satellite. Satellite reset method by changing the module to another load module. The method of claim 7,
The reconfiguration method further comprises, when it is determined that an error has occurred in the primary and redundant reconfiguration units, deactivating the reconfiguration unit in which the error has occurred. A computer-readable recording medium in which a program for executing the satellite reset method of any one of claims 7 to 12 is recorded.

Images