The interdisciplinary process of space systems engineering poses challenges on the development of its on-board software. On-board software integrates components from different domains and organizations and must fulfill requirements, such as robustness, reliability, real-time capability and memory management. Model-based methods do not only help to simplify the system and give a comprehensive overview, but they also improve productivity by allowing artifacts to be generated from the model automatically. However, general-purpose modeling languages, such as Matlab Simulink, SysML, or UML, are not always adequate because of their ambiguity through their generic nature. Furthermore, sensor data handling, analysis, and processing of data in on-board software requires focus on the system’s data flow and event mechanism. To achieve this, we developed the Tasking Modeling Language (TML), a model-driven software development platform, planned to be released open source. TML incorporates a set of textual and graphical domain-specific languages (DSLs), which allow system engineers to model complex event-driven software systems in a simple way and to generate software from it. The textual DSLs in TML provide a strong-typed syntax to define data types and system components, whereas a graphical DSL enables to design the composition and data flow of the system. Type and consistency checks on this formal level help to reduce errors early on in the engineering process. The TML environment facilitates model-driven software development (MDSD) by incorporating a code generator which is capable of generating executable C++ source-code, unit tests, its build configuration and documentation. This way, the model acts as a single point of truth, and changes on the data flow or integration of new components become trivial. By default, the code generator utilizes the Tasking Framework, an open-source C++ software execution platform developed by DLR. This allows software modules to run concurrently in separate tasks, exchange data between them via channels, and to schedule the task-execution based on events, such as input data availability. TML and the Tasking Framework are based on the task channel paradigm, where tasks are bare executors of algorithms whereas channels are data containers. While TML is focused on data-driven systems, its models are designed to be extended and customized to specific mission requirements. It provides three levels of extension mechanism: firstly, new components, channel types, and parameters can be added to the model dynamically. Secondly, the code generator can be customized by extending or implementing new code templates. This enables to support new execution environments or even new programming languages. Lastly, the generated code is designed to be extended by manually written code. This combination of a modeling language, customized to data-flow oriented systems with a highly extensible artifact generation, enables effective support for development of on-board software. This paper describes the architecture of the TML in detail, explains the base technology, the methodology, and the DSLs. It evaluates the design approach of the software via case study and presents the advantages as well as the faced challenges.

The use of Artificial Intelligence (AI) and Machine Learning (ML) in space missions has become a popular approach to make spacecrafts act more autonomously. Increasing autonomy is required since communication bandwidth and the availability of ground stations is limited. It is recognized that increasing autonomy may also yield detection of science opportunities and also increases reliability whereas the operational effort can be reduced. Common applications of AI and ML in space missions relate to anomaly detection, fault detection, isolation and recovery (FDIR), pose estimation and trajectory design, among others.
Many approaches rely on Deep Neural Networks (DNN) due to their achievements in the past years in several application domains that formerly required human intervention. The basic mathematical operation in DNNs is the matrix multiplication. Weight matrices are consecutively applied to the input data, in order to produce a prediction. DNNs may have multiple thousands or even millions of weights, which are adapted within the training phase, such that the model is suitable for its task. Especially the training of DNNs is computationally intensive because the amount of training data required increases with the size of the network. However, computational power and memory space of embedded systems as used in space missions are limited. To circumvent this and in order to verify the trained models as far as possible, ML models are usually trained and validated on ground and deployed to the embedded system afterwards. However, there exists no standardized interface that enables to load ML models on embedded systems on space systems.
Our approach aims to deploy arbitrary ML models including neural networks to space missions using the well-established packet utilization standard (PUS, cf. ECSS-E-ST-70-41C). Therefore, we extended our Open modUlar sofTware PlatfOrm for SpacecrafT (OUTPOST, available as Open Source software) with a custom PUS service for dynamically loading and executing trained and validated ML models generated by TensorFlow Lite. TensorFlow Lite is an extension of the widespread ML platform TensorFlow developed by Google. It enables to deploy TensorFlow models to embedded systems and microcontrollers by encoding and decoding them into a serialized representation of the model. Through our custom PUS service, models can be uploaded to and removed from the space system as well as updated by other versions of the model. Furthermore, the service enables the execution of models in an event-triggered fashion and makes the prediction results accessible for other components of the flight software through the PUS model. These can now make use of our custom PUS service to increase autonomy when handling their tasks. Conceivable tasks range from data-driven monitoring of the system’s health status to autonomously controlling essential parts of the space system in the foreseeable future.

The open-source real-time OS RTEMS has become quite popular in the Space Domain. Particularly with its Symmetric Multi Processing (SMP) option it may provide a very efficient use of multicore processors.

In order to permit its application in more critical space missions, attempts have been made for a qualification according to ECSS standards. As an innovative approach the qualification is organised in form of an open-source approach as well. Funded by ESA a consortium with different contractors is preparing a qualification toolkit that shall be made available to the public. This qualification toolkit will provide tool-chain and test-suite for a mostly automated generation of qualification documents on level C and D, together with a basic set of interfaces for the most common system on chips used in the space domain. A later independent verification and validation is anticipated to obtain a level B qualification. Compared to proprietary software this approach shall lower the required investments and reduce the dependency to sole software providers.

The presentation will provide an overview of the available software resources as well as the test equipment. It will further explain how to use those resources in order to prepare the qualification of a set application software and provide an outlook on expected future extensions and additional resources.

A very special aspect is the open-source approach for qualification. After the initial steps have been supported by ESA, a continuation and extension of the database has to be organised in an open, self-organised process. Such a process will need to be established in order to sustain the use of the qualification toolkit in future environments without extensive re-developments.