1. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 1 Christian Fidi Product Manager Advantages cFS and Time-Triggered Ethernet October 26 th, 2015

2. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 2 Overview and Motivation IMA Considerations in Networking Requires network capable of accommodating traffic from multiple highly diverse systems (e.g. critical vs. non-critical) – potentially all from one shared computer platform. Must prevent cascading faults b/w systems of differing criticalities connected to the same physical network. Most avionic system failures result from ineffective fault containment and the resulting domino effect. Some network technologies are better suited for certain tasks. Applying the same technology everywhere traditionally results in undue expense and limited performance. Results in hybrid architectures with multiple technologies (e.g. NASA’s LRO has MIL-STD-1553, SpaceWire, LVDS).

3. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 3 Overview and Motivation Ethernet is promising Inexpensive, widespread, and high speed = highly flexible. Commonality promotes interchangeability between components. Can augment with QoS enhancements for critical applications. The A&S project considers Ethernet fundamental in the design of future manned spacecraft. Integrated Power, Avionics, and Software (IPAS) Flexible evaluation environment for hardware and software in simulated mission scenarios. Realistic framework of vehicle subsystems connected via Ethernet backbone. AIAA 2015 Conference presentaion of Andrew Loveless

4. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 4 Ethernet in Space Programs

5. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 5 Asynchronous Communication  Transmission points in time are not predictable  Transmission latency and jitter accumulate  Number of hops has a significant impact Ethernet = Unsynchronized Communication

6. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 6 Time-Triggered Ethernet TTEthernet = combination on the same physical network of SAE AS6802 fully synchronous gloabl time-base very small jitter < 1  s defined known latency redundancy MGMT SAE AS6802 fully synchronous gloabl time-base very small jitter < 1  s defined known latency redundancy MGMT Rate-Constraint ARINC664p7 asynchronous jitter < 500  s latency typical 1-10 ms redundancy MGMT Rate-Constraint ARINC664p7 asynchronous jitter < 500  s latency typical 1-10 ms redundancy MGMT IEEE802.3 asynchronous best effort Ethernet no performance guarantee high flexibility IEEE802.3 asynchronous best effort Ethernet no performance guarantee high flexibility

7. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 7 FT Synchronized Global Time Fault-tolerant synchronization services are needed for establishing a robust global time base in the sub-microsecond area

8. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 8 Master Clock Configuration Single Master Clock Configuration

9. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 9 Time-triggered Traffic Timing Full control of timings in the system Defined latency and sub-microsecond jitter Minimum memory needs Fault-containment regions I’ll transmit M at 10:45 I’ll accept M only between 10:40 and 10:50 I’ll forward M at 11:00 I’ll accept M only between 10:55 and 11:05 I’ll forward M at 11:10 Let’s see if I can receive M …a switch I’ll expect M between 11:05 and 11:15 MMMM

10. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 10 Ascent Abort 2 (AA-2) Simulation What is the Ascent Abort 2 Flight Test? Launch Abort System (LAS) carries CM away from ascent booster. Goal is to stress the capabilities of synchronized redundant control loop. Conducted AA-2 flight test demo in May ‘15 Integrated Test at JSC. Redundant Flight Computer Architecture Three identical redundant flight computers (pc-linux). Failover logic built into core Flight Software System (cFS). Synchronization over TTEthernet network (200Hz). cFS included several genuine Orion fsw components: Absolute Navigation (AbsNav) for Exploration Mission EM-1. Service module abort, stochastic/optical navigation, and propellant balancing. ANTARES simulation integrated into Tricksim. Official NASA Orion spacecraft assessment tool used by JSC’s GNC branch. AIAA 2015 Conference presentation of Andrew Loveless

11. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 11 Combines the concept of scheduling the execution of cFS apps with scheduling of the TTE network. Drives FSW execution (i.e. minor frame transitions) off cluster cycle interrupts. Payoff: Highly accurate scheduler despite nondeterministic platform/OS.  Important for sync/failover b/w FCs! 1 2 Network-based cFS Scheduler AIAA 2015 Conference presentation of Andrew Loveless

12. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 12 Flight Computer Synchronization Master/Slave – only one FC drives the sim at a time. Each computer runs identical cFS w/ different config. files. Master FC (highest priority)  Executes cFS according to TTE time base.  Instructs other machines to move b/w slots. Failover Capability FCs monitor health of peers. Failover to consecutive slot guaranteed. Future Work Network-based sync without state messages (i.e. Altair). Message-based synchronization used in AA-2 demo Network-based cFS Scheduler AIAA 2015 Conference presentation of Andrew Loveless

13. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 13 Conducted in iPAS facility (B29/131). A TTE network switch was failed. The primary flight computer was failed. The backup computer(s) continued flying without a loss of performance. Final setup for AA-2 demo (A&S IT1 5/2015) Engineering DOUG Graphics for Exploration (EDGE) displays simulated flight test progress IPv4 and UDP layers used for flight control loop 40Hz communication rate between FCs and sim AA-2 test setup in EV2 lab B44/132 A&S Integrated Test 1 (5/2015) AIAA 2015 Conference presentation of Andrew Loveless

14. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 14 Industry Trend: Partitioning Multiple SW APPs are executed in Time and Space Partitions on A high performance, low cost HW (SoCs) OS1 APP LinuxOS3 APP Hypervisor / TSP OS SoC (CPU, FPGA, MEM, …)

15. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 15 Distributed IMA

16. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 16 Distributed IMA

17. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 17 Conclusion No virtualization was used for the AA-2 iPAS demo The OS was synchronized to the network via IRQs Automatic scheduling tools integrating cFS task/message schedule and Network schedule would be needed for more complex schedules Would this hardware partitioning provide advantages for task in a federated OS or for partitions of an IMA OS Extend user base of TTEthernet by support projects like iPAS, Chrec, …

18. www.tttech.com Ensuring Reliable Networks Copyright © TTTech Computertechnik AG. All rights reserved.Page 18 Any Questions? Thank You!