The high computational demand and the modularity of future space applications make the effort of developing multithreading reusable middlewares worthwhile. In this paper, we present a multihreading execution platform and a Software development framework that consists of abstract classes with virtual methods. The presented work is written in C++ following the event-driven programming paradigm and based on the inverse of control programming principle. The platform is portable over different operating systems, e.g., Linux and RTEMS. This platform is supported with a modeling language to automatically generate the code from the given requirements. Our platform has been used in already flying satellites, e.g., Eu:CROPIS. We present in this paper an example that illustrates how to use the proposed platform in designing and implementing an on-board software system.

Fault detection, isolation, and recovery (FDIR) mechanisms in on-board software are essential to guarantee the survival of the satellite in case of a hardware malfunction. E.g., outage of essential attitude control system (ACS) actuators or sensors can lead to mission loss. The on-board software has to handle such situation autonomously by switching to cold redundant devices or by isolation of information from hot redundant devices. The FDIR implementation for the ACS of the spin stabilized small satellite Eu:CROPIS (Euglena Combined Regenerative Organic food Production In Space) is shown in this paper.

Ever increasing demands on the complexity of onboard software has led the European Space Agency to define the Onboard Software Reference Architecture (OSRA) to create a common framework for modeling onboard software for space applications. The first major version was released at the end of 2017 and provides the metamodel with additional documentation and a model editor. It enables the user to create a detailed high-level representation of an onboard software system, but leaves the choice of an execution platform and the generation of actual source code for it to the implementing party. The core philosophy of OSRA is to divide the onboard software into independent components with clearly defined interfaces and separate the functional and non-functional aspects of components. However, OSRA aims to cover a large range of applications and therefore provides a large variety of modeling artifacts for component interaction. While this gives a lot of design freedom to the software architect designing the overall software, it moves the responsibility of supporting all aspects and behavioral requirements correctly to the execution platform and interaction layer. In this study, we analyze the demands of OSRA towards the execution platform and necessary elements which have to be added or generated in order to support the multitude of different inter-component interactions. The results of the analysis are used to implement the first prototypical code-generation framework for OSRA models. The target execution platform for the code generators is the Tasking Framework, a reactive cooperative multitasking framework from DLR. It has successful flight heritage in numerous spacecraft projects and has also been the target of code generation from software models before. Nevertheless, many of the aspects discussed here apply equally to common priority-based preemptive multitasking frameworks. The analysis and the implementation both uncovered several issues where clarification in the OSRA metamodel description was necessary. We will discuss the additional constraints we introduced towards the metamodel in order to deal with these issues, which eases the generation of code skeletons and scheduling primitives. Finally, while this study concentrates on the inter-component interactions, we will also discuss further aspects currently missing from OSRA and which either need to be added by the implementing party or in a future revision.

Developing software for large and complex experiments is a challenging task. It must incorporate many requirements from different domains, all with their own conceptions about the overall systems. An additional level of complexity is added if the experiment is conducted autonomously during a sounding rocket flight. Without a proper software architecture and development techniques, achieving and maintaining a high code quality is a very cumbersome task. This paper describes the architecture and the model-driven development approach we used to implement the control software of the experiments in the MAIUS-1 mission (matter-wave interferometry in microgravity). In this mission, the software had to handle around 150 experiments in six minutes autonomously and adapt to changes in the control flow according to real-time data from the experiment. The MAIUS-1 mission was the first mission to create Bose-Einstein condensates in space and conduct other experiments with ultra-cold gases on a sounding rocket. Besides the scientific goals in the area of quantum-optics, other important objectives of the mission were the miniaturization and further development of laser systems, vacuum components, optical sensors, and other related technologies. To fulfil these goals, new experimental hardware has been created which had to be integrated and tested with the software of the experiment computer. The custom-made hardware and the considerable number of domains involved brought up many challenges for the software engineering. To face all these challenges of developing software with this high complexity, we chose to follow a model-driven software development approach. Several domain-specific languages (DSLs) accompanied with specialized tools were created to allow the physicists and electronic engineers to describe system components and the experiments in a domain-specific way. These descriptions were then automatically transformed in C++ code for the flight software. This way we could actively incorporate all the domains involved in conducting the experiment directly in building the flight software without compromising the software quality. We created a versatile software platform not only for the MAIUS-1 mission but also for upcoming missions with similar experiments and hardware. With our approach we were able to generate around 84% of the source code for the final flight software from the domain-specific models. Besides the improvement of the development process, the code generation made a significant contribution to the overall software quality as almost all manual coding of error-prone boilerplate code could be mitigated.

OBC-NG is the abbreviation for on-board-computer next generation – a project founded and made by the German Aerospace Center (DLR). The project goal is to provide the basis for future on-board computer (OBC) for space-missions. This document summarizes the conducted work, made in the DLR-project OBC-NG and its predecessor project “Software and Hardware Architecture for Re-configurable Computers”.

Emerging applications for space missions require increasing processing performance from the onboard computers. DLR's project "Onboard Computer - Next Generation" (OBC-NG) develops a distributed, reconfigurable computer architecture to provide increased performance while maintaining the high reliability of classical spacecraft computer architectures. Growing system complexity requires an advanced onboard middleware, handling distributed (real-time) applications and error mitigation by reconfiguration. The OBC-NG middleware follows the Component-Based Software Engineering (CBSE) approach. Using composite components, applications and management tasks can easily be distributed and relocated on the processing nodes of the network. Additionally, reuse of components for future missions is facilitated. This paper presents the flexible middleware architecture, the composite component framework, the middleware services and the model-driven Application Programming Interface (API) design of OBC-NG. Tests are conducted to validate the middleware concept and to investigate the reconfiguration efficiency as well as the reliability of the system. A relevant use case shows the advantages of CBSE for the development of distributed reconfigurable onboard software.

The base of the Eu:CROPIS (Euglena Combined Regenerative Organic food Production In Space) Attitude and Orbit Control System (AOCS) is the three layer AOCS software architecture of the TET-1 satellite (Technology demonstrator). Because of different AOCS requirements between TET-1 and Eu:CROPIS, a software reuse is only possible for software components in the interface layer. In the other two architecture layers, the software components have to be replaced by new implementations to fulfil the changed requirements of the Eu:CROPIS mission. In contrast to the former software evolution from BIRD (Bispectral Infra-Red Detection) to the TET-1 AOCS, the software evolution is forced in Eu:CROPIS by the reuse of software design principals applied in TET-1. Without software reuse we are able to change the underlying scheduling mechanisms from a fixed time approach to a more reactive software system presented in this paper.

The base of the Eu:CROPIS (Euglena Combined Regenerative Organic food Production In Space) Attitude and Orbit Control System (AOCS) is the three layer AOCS software architecture of the TET-1 satellite (Technology demonstrator). Because of different AOCS requirements between TET-1 and Eu:CROPIS, a software reuse is only possible for software components in the interface layer. In the other two architecture layers, the software components have to be replaced by new implementations to fulfil the changed requirements of the Eu:CROPIS mission. In contrast to the former software evolution from BIRD (Bispectral Infra-Red Detection) to the TET-1 AOCS, the software evolution is forced in Eu:CROPIS by the reuse of software design principals applied in TET1. Without software reuse we are able to change the underlying scheduling mechanisms from a fixed time approach to a more reactive software system presented in this paper.

The Eu:CROPIS (Euglena Combined Regenerative Organic food Production In Space) satellite, scheduled for launch in 2016, is the next mission to be launched as part of the German Aerospace Center's (DLR)compact satellite program. The mission is currently in Phase C and is being developed by several institutes within DLR. The mission's focus is to test several biological experiments at different levels of gravity. The payload modules are provided by some DLR institutes, the University of Erlangen (GER) and NASA-AMES. The satellite itself has a mass of about 220 kg and includes several subsystems which directly interfere with the attitude control system (e.g. deployable solar panels, liquid pumps and venting devices). This paper provides a detailed overview of the Eu:CROPIS Attitude and Orbit Control System (AOCS). It starts by presenting the design driving requirements and explains how the required g-Levels are achieved purely by a magnetic spin stabilization concept. Following this is a presentation of the ACOS modes and a discussion of the chosen sensors and actuators. The attitude determination and attitude control algorithms are described in detail including their design and verifcation. Finally, an outlook is given for further verifcation and integration steps of the Eu:CROPIS satellite.

The computational demands on spacecraft are rapidly increasing. Current on-board computing components and architectures cannot keep up with the growing requirements. Only a small selection of space-qualified processors and FPGAs are available and current architectures stick with the inflexible cold-redundant structure. The objective of the ongoing project OBC-NG (On-board Computer - Next Generation) is to find new concepts for on-board-computer to fulfill future requirements. The concept presented in this paper is based on a distributed reconfigurable system, consisting of different nodes for processing, management and interface operations. OBC-NG will exploit the high performance of commercial off-the-shelf (COTS) hardware parts. To compensate the shortcomings of COTS parts the OBC-NG redundancy approach differs from the classic way and error mitigation techniques will work mainly on software level. This paper discusses the hardware and software architecture of the system as well as the redundancy and reconfiguration concept. Our ideas will be proven in an OBC-NG prototype, planned for the next year.

Today's software for aerospace systems typically is very complex. This is due to the increasing number of features as well as the high demand for safety, reliability, and quality. This complexity also leads to significant higher software development costs. To handle the software complexity, a structured development process is necessary. Additionally, compliance with relevant standards for quality assurance is a mandatory concern. To assure high software quality, techniques for verification are necessary. Besides traditional techniques like testing, automated verification techniques like model checking become more popular. The latter examine the whole state space and, consequently, result in a full test coverage. Nevertheless, despite the obvious advantages, this technique is rarely yet used for the development of aerospace systems. In this paper, we propose a tool-supported methodology for the development and formal verification of safety-critical software in the aerospace domain. The methodology relies on the V-Model and defines a comprehensive work flow for model-based software development as well as automated verification in compliance to the European standard series ECSS-E-ST-40C. Furthermore, our methodology supports the generation and deployment of code. For tool support we use the tool SCADE Suite (Esterel Technology), an integrated design environment that covers all the requirements for our methodology. The SCADE Suite is well established in avionics and defense, rail transportation, energy and heavy equipment industries. For evaluation purposes, we apply our approach to an up-to-date case study of the TET-1 satellite bus. In particular, the attitude and orbit control software is considered. The behavioral models for the subsystem are developed, formally verified, and optimized.

For the next generation of onboard computer in space application a high demand on processing power exists. Currently used onboard system didn't provide the necessary computing power. The in the paper describe tasking frame work is the core processing model for the OBC-NG (On Board Computer - Next Generation) operating system with an reactive computing model.

Spacecraft are complex systems. Changing one of its design parameter can have implications on the overall design and might become a crucial factor to mission success. In the early phases of spacecraft design, parameters as well as the mission goals are likely to change. These changes have to be applied carefully and need to be analyzed in respect to the whole system and the intended mission. The software Virtual Satellite supports this analysis by using an abstract model where the engineers can enter design data of their components. It allows describing operational phases of the spacecraft by defining modes such as Recharge or Science. These operational modes can be referenced by parameters to define individual values for them. Together with their respective mode durations, it can be determined for example how much energy is consumed in a specific mode or how much is produced. But this does not consider the influence of the parameter with respect to the overall mission goals. For example having a mission life time of 20 years and a spacecraft which spends too much of that time to maintain its power state, it remains unclear if the remaining time is long enough to gather enough scientific data as demanded by the mission requirements. This paper shows an approach to such problems based on formal verification. The data of the early phase model is used to create a state model of the spacecraft. Both, the model and the formalized requirements will be given to a model checker that automatically verifies on formal basis that the spacecraft complies with its specification. This method enables engineers to quickly check the design with respect to the mission requirements once they applied changes to it or to the requirements.

The paper present the software reuse case of the BIRD ACS as TET-1 AOCS. The reuse was succesful and the paper present the necessary adaptions and the software design concepts for the software reuse case.

The chapter presents the design of the attitude and orbit control system (AOCS) of the small satellite TET-1 (Technology verification career) as an example of a cost effective but still robust and reliable AOCS for small satellites. The AOCS of TET-1 is fully three-axis stabilized. Particular attention is paid to the implementation of robust and fault tolerant design of the AOCS. The redundancy management concept and robust control algorithms are presented. Furthermore the fault detection, isolation and recovery (FDIR) mechanism, which are implemented in various functional levels, are shown. Finally the chapter presents the test strategy for verifying the proposed fault tolerant design.