Boot and Recovery Subsystem
Boot_Recovery_Firmware_Subsystem
Triple-redundant non-volatile boot firmware storage with voting loader, safe-mode fallback images, and multi-stage boot sequence management for processor initialization and recovery from faults.
Purpose
Guarantee that every processor module can reliably boot into operational software regardless of the cause of reset (power-on, watchdog timeout, commanded reset, or SEL recovery). Maintains multiple firmware images including a golden safe-mode image that cannot be overwritten, ensuring recovery is always possible.
Context
Boot reliability is essential for 100-year autonomous operation. The boot subsystem stores firmware in triple-redundant radiation-hardened PROM/EEPROM with voting on readout. A multi-stage boot sequence first runs POST, then loads a minimal safe-mode kernel, and finally transitions to full flight software. If any stage fails, the system falls back to the previous safe stage. The golden image is mask-programmed and physically write-protected.
Principles
- ▸Triple-redundant boot PROM with majority-voted readout for radiation protection
- ▸Golden safe-mode image in write-protected one-time-programmable (OTP) memory
- ▸Multi-stage boot: POST -> safe-mode kernel -> full flight software
- ▸Boot image integrity verification via CRC-32 and SHA-256 hash checking
- ▸Updateable secondary boot images for software patches uploaded from Earth
Typical implementations
- ▸3D-Plus radiation-hardened EEPROM modules (1 Mbit, 300 krad TID)
- ▸Microchip RTProASIC3 FPGA-based boot sequencer
- ▸One-time-programmable anti-fuse PROM for golden image (permanent, radiation immune)
- ▸MRAM-based boot configuration registers for fast non-volatile state preservation
Lunar considerations
- ▸Boot sequence must complete within 30 seconds to minimize system downtime after reset
- ▸EEPROM charge retention over 100 years requires periodic refresh writes
- ▸Golden image must survive all credible failure scenarios including total EEPROM corruption
- ▸Boot telemetry logging to independent non-volatile memory for post-mortem analysis
Specifications
Functional
| primary function | Store boot firmware, manage multi-stage boot sequence, and provide guaranteed recovery to safe-mode operation |
| inputs | Reset signal from L3-CDH-PROC-WDT or power-on reset circuit, Reset cause indication (power-on, watchdog, commanded, SEL recovery), Updated firmware images from L2-CDH-SW via L2-CDH-STOR, Boot configuration parameters from MRAM registers |
| outputs | Boot firmware code stream to L3-CDH-PROC-CPU, POST results (pass/fail with diagnostic codes), Boot stage completion signals, Boot telemetry and error logs to L2-CDH-STOR |
| boot time total s | 30 |
| post duration s | 5 |
| firmware image count | 4 |
| golden image size mb | 4 |
| full image size mb | 16 |
| hash verification time s | 2 |
Physical
| mass kg | 1.0 |
| dimensions | 0.10m x 0.08m x 0.02m per boot module (3 redundant copies) |
| materials | Radiation-hardened EEPROM and OTP PROM in ceramic packages, Anti-fuse PROM for golden image (physically write-protected), MRAM modules for boot configuration registers, Hermetic module enclosure with EMI shielding |
| operating temp c | -40 to +85 |
| survival temp c | -55 to +125 |
| radiation tolerance krad | 300 |
| data retention years | 100 |
| vacuum compatible | True |
Operational
| power consumption w | 2 |
| thermal range c | -40, 85 |
| lifetime years | 100 |
| mtbf hours | 500000 |
Interfaces
Provides
- Voted boot code delivered to processor instruction memory for initialization sequence execution.
- Boot completion status, POST diagnostic results, and firmware version information.
Requires
- Reset type indication to select appropriate boot path (cold start, warm restart, or safe-mode fallback).
- New flight software images uploaded from Earth for installation into updateable boot slots.
- Early-available power rail that stabilizes before main processor power, enabling boot sequencing.
Cite this entry
Lunar Ark Codex. "Boot and Recovery Subsystem" (L3-CDH-PROC-BOOT). Retrieved 10 September 2026, from https://lunarark.com/entry/L3-CDH-PROC-BOOT
Licensed CC-BY-SA 4.0. You may reuse and adapt this entry with attribution, under the same licence.