On-board computer data handling testing experiences
for the second Brazilian data collecting satellite (Scd-2)
Mário
Eugênio Saturno, José Damião
Duarte Alonso, João Carlos
Caliman
saturno@dea.inpe.br
damiao@dea.inpe.br
caliman@dea.inpe.br
National Space Research
Institute (INPE)
São José dos Campos - SP - Brazil
abstract
The On-Board Computer Data Handling (OBCDH) for
the Second Brazilian Data Collecting Satellite (SCD-2) and its Testing System
were developed by INPE. The former was designed according to its logical
hierarchical layers (Hardware, Operating System and Application Programs) and
the latter to perform the OBCDH testing using a methodology based on IEEE
standard. Combined data-driven and logic-driven tests were applied to verify
and validate the OBCDH subsystem and its fault tolerance resources during the
development phases, and integration tests were applied during the acceptance
phase. This paper describes the OBCDH testing experiences and its effect on the
OBCDH hardware and software development.
1.- Introduction
The Second Data Collecting Satellite (SCD-2),
developed by the Brazilian National Space Research Institute (INPE), is a
dedicated satellite to the collection and distribution of environmental data
emitted by Data Collecting Platforms (DCP) distributed over Brazilian
territory.
The SCD-2 is a low earth orbit (700 to 800 Kilometers)
spin stabilized satellite, with mass of 115 Kilograms and power consumption of
48 Watts. Its initial rotation of 120 rpm being imparted by the launcher. The
attitude determination (spin axis orientation and spin velocity) is done using
data of sun and magnetic sensors. The attitude subsystem is also equipped with
a nutation damper and a magnetic torque coil that is used in spin axis
reorientation maneuvers [Jânio 94].
The spacecraft has five subsystems: Structure and
Thermal Control, Power Supply, TTC Transponder, Attitude Control and On-Board
Computer Data Handling, and the payload contains one: the DCP Transponder
Subsystem.
The On-Board Computer Data Handling (OBCDH) Subsystem
is designed to supervise all the on-board subsystems operation and its
functions are: receive direct and time
tagged telecommands (TC) from Ground System, generate On/Off Commands to
on-board subsystems, acquire telemetry (TM) data from other subsystems and send
these data to Ground System into the TM format.
A Testing System was designed to verify and validate
the OBCDH Subsystem operation. This system is a workstation based on IBM-PC
compatible microcomputer with additional hardware adapters.
The Testing System software was specially designed to
test the OBCDH hardware and software. It was used to the verification and
validation of OBCDH hardware and
software during the development phases, and also utilized in the subsystem
acceptance phase during the satellite integration tests.
This paper describes the OBCDH, the Testing System,
and the experiences provided by test application.
2.- On-Board Computer Data
Handling (OBCDH)
The on-board computers for the Brazilian Complete
Space Mission (MECB) are based on a set of basic modules which are combined
according to the tasks to be executed in each satellite to meet the
requirements specified.
The computer for the SCD-2 is composed by the
following modules:
a) Central Processing Module: contains the processing unit (based on the
16-bit microprocessor SBP9989) and its peripherals circuits;
b) Memory Module: contains the 64 Kbytes of RAM and 8 Kbytes of PROM, the
RAM error detection and correction circuit, and the RAM write protection
circuit;
c) Acquisition and Control Module:
contains the telemetry (TM) data acquisition circuits and the On/Off
commands generation circuits;
d) Communication Module: contains the telecommand (TC) reception circuits
and the telemetry video generation circuits;
e) Serial TM Module: contains the
circuits that receives the serial telemetry from the TC Decoder.
The OBCDH subsystem is divided into its logical
hierarchical layers to facilitate the error handling. The fault detection,
error analysis/confinement and recovery
can be accomplished in any of these layers in a independent way
[Martins 84] . This approach is characterized by modularity, easy
adaptation to different satellites architectures, distributed fault tolerance, design independence.
3.- OBCDH SOFTWARE
The software for the MECB on-board computers
are, like the hardware, based on a set of basic modules which are combined
according to the tasks to be executed in each satellite [Alonso 88]. These
programs were implemented in TI-SBP9989 Assembly Language using HP64000
development workstation. The OBCDH software consists of two hierarchical
layers:
a) Operating System: the basic software which controls the Application
Programs execution, provides the interface between Application Programs and
hardware, and the communication and synchronization among Application Programs;
b) Application Programs: the application software which performs the OBCDH
tasks necessary to meet the mission requirements.
3.1.- OBCDH Operating System
The Operating System routines, named
Primitives, are executed in mutual exclusion, i.e. when a Primitive is running
it cannot be interrupted by another one.
The OBCDH Operating System Primitives provides
the following services:
a) Process Management: allows a process to stop the execution of a
determined process (including itself) or start the execution of another
one;
b) Process Scheduling: transfers the execution control to the appropriate
process (Application Program);
c) Process Communication and Synchronization: allows message exchange
between two processes;
d) Time Management: delays the calling process for a specified period of
time;
e) Device Management: handles the hardware signals related to the OBCDH
modules;
f) Error Handling: services the error detection interrupts (Watch Dog
Timer, RAM Error, Write Protected Area);
3.2.- OBCDH Application
Programs
The functions specified for the OBCDH subsystem
are distributed into the following Application Programs:
a) TC Analysis Program: receives telecommand frames from Ground Subsystems,
analyzes them and distributes them to the other OBCDH Application Programs;
b) TM Format Generation Program: takes data from several data areas,
formats them and sends them to the Ground Subsystems;
c) TM Data Acquisition Program: acquires data from on-board subsystems and
stores them to later transmission;
d) Serial TM Acquisition Program: receives the serial TM data from the TC
Decoder and store them to later transmission;
e) On/Off Command Generation Program: receives command messages from other
Application Programs and sends the command to the appropriate on-board
subsystems;
f) Time Tagged Command Generation Program: receives Time Tagged
telecommands from the TC Analysis Program, stores them, and send them to the
On/Off Command Generation Program at the proper time;
g) Housekeeping Program: receives event or error reports from the on-board
process and store them to later transmission;
h) Diagnosis Program: performs the diagnosis of the OBCDH modules and sends
the results to Housekeeping Program.
4.- Testing System Hardware
The Testing System hardware provides all the necessary
interfaces to test the On Board Computer Data Handling at unit levels, as well
as performs the integrated test in satellite. The Testing System hardware is
comprised by two equipments:
a) OBCDH Test Equipment, responsible by testing OBCDH subsystem during
development phases;
b) Check-out System, responsible by testing OBCDH subsystem during
acceptance phase.
4.1.- Test Equipment
The Test Equipment, shown in Figure 1, is composed of
a set of IBM-PC compatible boards that contains the following interfaces:
a) Digital Test Interface generates up to 32 actuation digital signals, in
order to stimulate the circuit under test, and receives up to 24 acquisition
digital signals to monitor its response;
b) Serial Telemetry Interface sends 16-bit serial telemetry word to OBCDH;
c) Video Telemetry Interface is responsible for receiving the telemetry;
d) Telecommand Interface sends all types of telecommand.
Fig. 1: OBCDH Test
Equipment Diagram
4.2.- Check-out System Hardware
The Check-out System, shown in Figure 2, is composed
of a set of IBM-PC compatible boards that contains the following interfaces:
a) Video Telecommand Interface: sends telecommand to satellite;
b) Video Telemetry Interface: receives telemetry frames.
Fig. 2: Check-out
System Diagram
5.- Testing System Software
The Testing System Software is composed of a set of
programs that performed both the unit tests and integrated tests, which are:
Test Equipment Software, Checkout System Software, Telemetry Analyzer Software,
Telecommand Generator Software. These programs were implemented in the Borland
Turbo Pascal 5.0 language and run in the Microsoft's DOS 3.0 or higher
operating system.
5.1. Test Equipment Software
The Test Equipment software performs the following
functions:
a) Receive TM frames from video TM Interface, verify header and check word
(CRC), store them in a file, display them on the screen (hexadecimal or
engineering values);
b) Get TC frames from a file and send them to TC Interface;
c) Send signal to Digital Test Interface in order to simulate the Sun sensor and test if the OBCDH turn on/off the
spin torque coil;
d) Send hexadecimal words to TM Serial Interface.
5.2.- Check-out System Software
The Check-out System software was designed so that
several features can be defined or
changed easily without recompilation. These features include the telemetry
calibration curves, graphic or text type screens, the parameters shown in each
screen, the telecommand sequences, the software operation mode. It performs the
following tasks:
a) Store Real Time Telemetry in a file (automatically use the date to open
a different one each day);
b) Display TM Screens in one of the three modes: text, bar chart, or
graphic;
c) Show out-of-limits TM data on the screen with or without a sound alarm;
d) Transmit telecommand sequences stored in files;
e) Make a log of the telecommand sent.
5.3.- Telemetry Analyzer Software (TMAS) and Telecommand Generator Software
(TCGS).
The Telemetry Analyzer Software (TMAS) and the Telecommand Generator Software (TCGS) are interactive softwares and works showing its functions through menus, requiring its inputs from data fields, and displaying on screens its outputs. The TMAS functions are the following:
a)
Compare the OBCDH memory contents, which are received from the Memory
Dump TMs, and also to display the memory addresses that are not matching;
b)
Generate a OBCDH Reference Memory from OBCDH Memory Load TCs;
c)
Show analogs, digitals and termistors data which was stored by the
OBCDH, ordered by acquisition time and converted in engineering data;
d) Show housekeeping
data stored by OBCDH, ordered by occurrence time and decodified into its
significance;
e)
Show operating system status data, ordered by acquisition time;
f)
Show Serial TM data ordered by occurrence
g)
Show the results from the received TMs analysis
h) Generate printing
pages from the informations displayed in the screen;
The TCGS functions are the following:
a)
Display the menu of all TC types accepted by the OBCDH;
b)
Show the data fields to be filled for the selected TC type;
c)
Generate the final TC format by adding the TC sequence number and the
calculated checksum;
6.- Testing Experiences
The On Board Software team is divided into programming
team and testing team. The first team was responsible to implement OBCDH
software and the second to develop testing program an perform integrated test.
Initially, program testing was viewed as to show that
the program performs its specified functions. The tests performed in SCD-1
software shows that it was in accordance to the specification, but when in
orbit some errors occurred, like the loss of process communication messages
causing OBCDH reset after one month. This kind of error was due to the test was
not long enough to detect it. The SCD-2 software was tested during several
months to increase the test coverage for long term latent errors.
Although exhaustive input testing (Black Box) is
superior to logic-driven (White-Box) testing, neither prove to be useful
strategies because both are infeasible.
Then, only a combination of both ways can derive a reasonable testing strategy,
which was named Gray-Box. The Test Plan was made verifying the specified
functions and considering the internal structure of the software.
The tests performed on the OBCDH [Liwschitz 88] are
the following:
a) Turn OBCDH on and verify the telemetry.
b) Load the On Board Operational Program.
c) Perform a memory dump to check if the Operational Program was loaded
correctly.
d) Turn sensors on and off and check the results verifying Real Time TM and Stored TM.
e) Modify the OBCDH clock contents and verify the effects by analyzing the
Stored TM.
f) Turn sensor on and off, in a delayed way, and check results analyzing
the Stored TM and verify if the OBCDH turn spin torque coil on/off.
g) Change sensor input physical conditions and check the results verifying
Real Time TM and Stored TM.
h) Verify the OBCDH operating conditions examining the correspondent fields
in the Stored TM and comparing with the foreseen operating conditions.
During the tests, the OBCDH event and error reports
were used to accomplish the error traceability, i.e., from the error effects
find the fault (at any subsystem layer: hardware, operating system, or
application program).
7.- conclusions
The lessons learned from testing experiences taught
that is necessary more formalism, more detailed tests, and long term testing.
The use of Gray-Box software testing strategy was the
suitable approach to uncover errors for on-board embedded application.
It is very important to have different teams to
develop and to test software, this is essential to guarantee an independent
verification and validation.
bibliography
[Alonso 88] J.D.D.
Alonso, A.R. De Paula, J.C. Caliman, R. Arias: "The On-Board Computer
Software for the First Brasilian Satellite", VI Japan-Brazil Symposium on
Science and Technology", 7-9
August 1988, São José dos Campos, SP, Brazil.
[Martins 84] R.C.O.
Martins, A.R. De Paula: "Fault Tolerant Aspects of the On-Board
Supervision Standard", IV Japan-Brazil Symposium on Science and
Technology", 7-9 August 1984, São
José dos Campos, SP, Brazil.
[Liwschitz 88] S.L.
Liwschitz, M.E. Saturno: "The On-Board Computer Software Funtional
Testing", VI Japan-Brazil Symposium on Science and Technology", 7-9 August 1988, São José dos Campos, SP,
Brazil.
[Kono 94] J.
Kono, C.E. Santana: "SCD1: One Year In Orbit", Proceedings of
International Symposium on Spacecraft Ground Control and Flight Dynamics, 7-11
February 1994, São José dos Campos, Brazil