Reliable Embedded Systems for Spaceflight

• Reliability: perform function under given condition and time [1]
• Expensive (9-figures launch [2])
• Real-time: bounded latency required
• Largely autonomous: too fast, too deadly for humans

• Example: New Glenn static fire [3]

• [1] I. Chechile, Space Technology A Short Introduction
• [2] ars Technica, Oops—It looks like the Ariane 6 rocket may not offer Europe any launch savings
• [3] Spaceflight now, New Glenn Anomaly

Part 1: Automatic Firmware Generation for Spaceflight Hardware based on Schematics

• github.com/DLR-RY/kicad_firmware_generation
• Group components to Groups → firmware interested in inter-Group connections
• Implemented for KiCad v9
• Applied in PCDU development process
• Found electrical design fault: swapped pins in PCDU

• 120 test cases
• Made with KiCad Open-Hardware projects
• Automatically add synthetic annotations to schematics
• Test runtime of kicad_firmware_generation
• Result: negligible runtime

• Inject faults into PCDU schematics:
  swap labels, delete cables
• 8885 unique faults
• Over a week on CES server
• Manual sample (300 cases) for fault classification
• Result: detected 75% of otherwise not found Group Pin swaps

Part 2:
TSN for Spacecraft

UDP

• Unreliable service
  (e.g., packets might be dropped)
• Simple (3 pages in RFC 768)

TCP

• Reliable service using
  Automatic Repeat Request (ARQ)
• Complex (98 pages in RFC 9293)

• Single Failure Criterion redundancy: "carrying out its mission in spite of the failure of any single component" (US Nuclear Regulatory Commission 1977)
• Goal: Validate TSN for use in spacecraft
• Goal: Build a demonstrator

• Single Failure Criterion redundancy: "carrying out its mission in spite of the failure of any single component" (US Nuclear Regulatory Commission 1977)
• Goal: Validate TSN for use in spacecraft
• Goal: Build a demonstrator

For TSN Endpoints

• IEEE 802.1AS: gPTP (based on IEEE 1588: PTP)
• IEEE 802.1Qav: credit-based traffic shaper

TSN Switching

• In-hardware switch
• IEEE 802.1Qci: Per-Stream Filtering and Policing
• Switchdev driver

ST

• STM32 MCU: no MMU → no Linux
• STM32MP1: no TSN
• STM32MP2 (like STM32MP257F): closed source drivers for switch (no switchdev implementation)

NXP

• i.MX 8DXL + SJA1105Q: expensive
• NXP Layerscape 1028A: expensive

Texas Instruments

• SK-AM64B
• TMDS64EVM: expansion connector with RMII for other PHYs

Intel

• i226-it: PCIe card; not embedded; no switch

Software Requirements

• Open-source networking stack
• Embedded
• Real-time

OS Options

• Linux with PREEMPT_RT
• Zephyr

Part 3:
Zephyr on Casio

Casio A199W, launched in 1989

• Few features

Ollee Watch, launched in 2025

• Replaces Casio A199W PCB
• Many features
  a small smartwatch with Bluetooth and app
• STM32WB55RG
• Closed-source firmware and app

Morse Watch, my Project

• Using Casio case/LCD and Ollee PCB
• Open-source firmware
• Using Zephyr
• Super low-power
  battery life target: 1 year