System-level modes of operations of the GRBAlpha payload. After the cold start, the microcontroller unit enters bootloader mode, but is still able to fully access and control the data acquisition FPGA. Once booted, regular measurements can instantly be started; however, FPGA configuration is still possible at the same time if needed. This setup allows the on-the-fly upgrade of both the MCU software and the FPGA bitstream in a safe manner; both binary images can be uploaded to the staging areas during routine operations. In the diagram, black arrows are state transitions, red arrows denote state changes, while green arrows imply state queries. Neither of the state transitions on the MCU side nor the assertion of FPGA reset state is done automatically by the system; it is only possible by telecommands. Therefore, boot loops are not possible in this setup. If an invalid binary image is uploaded to the MCU, a watchdog reset and/or power cycling will start it again in bootloader mode, allowing the detailed examination of the situation. In the case of a failure in the FPGA bitstream upgrade, the FPGA enters to invalid mode, continuously driving its “configuration done” output low. This is detected by the MCU which can then put it back into reset state for recovery.