>> These slides were presented at SiriusCon Paris 2016, on November 15th by Andreas Jung (European Space Agency) The European Space Agency, together with industry, has lead an analysis into the issues faced by spacecraft software developers now and in the future, considering several aspects as for example raising complexity of the software, shorter development life cycles, etc. The analysis resulted in the development of an On-board Software Reference Architecture (OSRA) founded on the principles of component-based software engineering (CBSE) and strong separation of concerns. A dedicated Domain Specific Language for the component model was developed, called Space Component Model (SCM), to allow the precise definition with clear semantical meaning, in particular considering the domain specific elements like observability and commandability of spacecrafts via Telemetry and Telecommand. The SCM was implemented as a meta-model in ecore. The R&D activity that have developed the OSRA and the SCM have also prototyped a graphical editor to experiment and test the complete approach, from modelling down to code generation for the target. The original prototype of the graphical editor was based on Eclipse and Obeo Designer, which allowed very quick and simple prototyping of a graphical editor. Following the R&D activities, it was clear that an improved version of the editor, in terms of usability, is needed. An improvement activity has been started with Obeo, using now the open source version of Obeo Designer, namely Sirius. The intention was also to push Obeo's technology further to evaluate it for applicability in a commercial tool. This talk will give a brief overview of the challenges of spacecraft software development, the needs for a graphical editor, present the results of the improvement activity, show the benefits of the Eclipse and Sirius frameworks and provide an overall evaluation.

1. ESA UNCLASSIFIED - For Official Use
Modelling Spacecraft On-board
Software with Sirius
Andreas Jung
15/11/2016

2. Andreas Jung | ESTEC | 15/11/2016 | Slide 3ESA UNCLASSIFIED - For Official Use
Outline
1. Characteristics of spacecraft on-board software
2. Development of the On-board Software Reference
Architecture (OSRA) utilizing a component based approach
 Development of a DSL: the “Space Component Model”
3. The needs for a Graphical editor for the Space Component
Model (DSL)
4. Graphical editor improvement activity with Obeo, fully
utilizing the Eclipse and Sirius frameworks
5. Overall evaluation and next steps
Execution Platform
Mission
Management
: Ada
Container Container
Thermal
Management
: C

3. Andreas Jung | ESTEC | 15/11/2016 | Slide 4ESA UNCLASSIFIED - For Official Use
Characteristics of Spacecraft software (= On-board Software)
• Software handles the system behavior and complexity
• Limited processing power and memory: embedded
• Timing constraints: (hard) real-time
• Domain specific elements: e.g. observability and commandability of spacecrafts
via Telemetry and Telecommand (this is the only “window” into the system)
• Software is critical to mission success: stringent standards  ECSS
Current trends in space projects
• Increasing complexity and expectations
• Increasing Software development effort
…competing against
• Cheaper (and smaller) missions
• Shorter development timescales
Spacecraft on-board software
timeSW-SRR SW
requirements
definition
SWRR / SW-PDR
SW V0 for
AIT
SW release
UN-01
UN-07UN-06
schedule for SW development

4. Andreas Jung | ESTEC | 15/11/2016 | Slide 5ESA UNCLASSIFIED - For Official Use
Development of the SAVOIR On-board Software
Reference Architecture (OSRA) and
To cope with the described trends
• ESA, together with industry, has performed an analysis into the issues faced by
spacecraft software developers now and in the future
• Started 2009 within the frame of SAVOIR (= Space Avionics Open
Interface Architecture) and supported by a PhD thesis
• Several R&D studies and harmonization efforts
• Final results in 2015
• The analysis resulted in the development of an “On-board Software Reference
Architecture” (OSRA) founded on the principles of component-based software
engineering and strong separation of concerns.
• This architecture is foreseen to be the guiding reference for future on-board
software developments – following the SAVOIR approach (same as AUTOSAR):
Cooperate on standards, compete on implementation
Execution Platform
Mission
Management
: Ada
Container Container
Thermal
Management
: C

5. Andreas Jung | ESTEC | 15/11/2016 | Slide 6ESA UNCLASSIFIED - For Official Use
SAVOIR On-board Software Reference Architecture
OSRA systematizes the Software Architecture
Objectives:
• FASTER – produce quicker
• LATER – modify late
• SOFTER – subcontract easily
• Model-based approach with components
• Automated by SW Factory and associated analysis
• middleware on which applications (components) are deployed
Execution Platform
Mission
Management
: Ada
Container Container
Thermal
Management
: C

6. Andreas Jung | ESTEC | 15/11/2016 | Slide 7ESA UNCLASSIFIED - For Official Use
Space Component Model – a DSL for OSRA
Meta-model
• A dedicated domain specific language (DSL)
for the component model was developed in
ecore, called Space Component Model
(SCM), to precisely define the needs
• On purpose no UML profile or similar was
chosen to allow the precise definition with
clear semantical meaning
• in particular considering the domain
specific elements like observability
and commandability of spacecrafts
via Telemetry and Telecommand.
• The SCM was implemented as a meta-
model in ecore.
MAG_FAILURE_EM
AOCS_MODE_IF
MAG_FAILURE_RC
<<instance>>
Mode_Manager_C
_inst
<<interface>>
AOCS_MODE_IF
previousMode : AOCS_MODE DAT (ro)
currMode : AOCS_MODE DAT (ro)
SetMode(m: in AOCS_MODE)
EnableTransToNOM()
<<interface>>
AOCS_CYCLE_IF
Step()
<<instance>>
AOCS_C_inst
<<NF_desc>>
Step :
<<cyclic>>
Period = 125 ms<<NF_desc>>
MAG_FAILURE_RC_EV_HANDL :
<<protected>>
Get_previousMode :
<<protected>>
Get_currMode :
<<protected>>
SetMode :
<<protected>>
EnableTransToNOM :
<<unprotected>>
<<NF_desc>>
<<instance>>
AOCS_C_inst
AOCS_MODE_IF
<<instance>>
Mode_Manager_C
_inst
AOCS_MODE_IF
MAG_DATA_IF
THR_CMD_IF
<<instance>>
MAG_C_inst
<<instance>>
THR_C_instTHR_CMD_IF
OBT_IF
MAG_DATA_IF
<<instance>>
OBT_C_inst
OBT_T

7. Andreas Jung | ESTEC | 15/11/2016 | Slide 8ESA UNCLASSIFIED - For Official Use
Space Component Model – a DSL for OSRA
Meta-model
• A dedicated domain specific language (DSL)
for the component model was developed in
ecore, called Space Component Model
(SCM), to precisely define the needs
• On purpose no UML profile or similar was
chosen to allow the precise definition with
clear semantical meaning
• in particular considering the domain
specific elements like observability
and commandability of spacecrafts
via Telemetry and Telecommand.
• The SCM was implemented as a meta-
model in ecore.
<<instance>>
AOCS_C_inst
AOCS_MODE_IF
<<instance>>
Mode_Manager_C
_inst
AOCS_MODE_IF
MAG_DATA_IF
THR_CMD_IF
<<instance>>
MAG_C_inst
<<instance>>
THR_C_instTHR_CMD_IF
OBT_IF
MAG_DATA_IF
<<instance>>
OBT_C_inst
OBT_T
MAG_FAILURE_EM
AOCS_MODE_IF
MAG_FAILURE_RC
<<instance>>
Mode_Manager_C
_inst
<<interface>>
AOCS_MODE_IF
previousMode : AOCS_MODE DAT (ro)
currMode : AOCS_MODE DAT (ro)
SetMode(m: in AOCS_MODE)
EnableTransToNOM()
<<interface>>
AOCS_CYCLE_IF
Step()
<<instance>>
AOCS_C_inst
<<NF_desc>>
Step :
<<cyclic>>
Period = 125 ms<<NF_desc>>
MAG_FAILURE_RC_EV_HANDL :
<<protected>>
Get_previousMode :
<<protected>>
Get_currMode :
<<protected>>
SetMode :
<<protected>>
EnableTransToNOM :
<<unprotected>>
<<NF_desc>>

8. Andreas Jung | ESTEC | 15/11/2016 | Slide 9ESA UNCLASSIFIED - For Official Use
Space Component Model – a DSL for OSRA
Meta-model
• A dedicated domain specific language (DSL)
for the component model was developed in
ecore, called Space Component Model
(SCM), to precisely define the needs
• On purpose no UML profile or similar was
chosen to allow the precise definition with
clear semantical meaning
• in particular considering the domain
specific elements like observability
and commandability of spacecrafts
via Telemetry and Telecommand.
• The SCM was implemented as a meta-
model in ecore.
MAG_FAILURE_EM
AOCS_MODE_IF
MAG_FAILURE_RC
<<instance>>
Mode_Manager_C
_inst
<<interface>>
AOCS_MODE_IF
previousMode : AOCS_MODE DAT (ro)
currMode : AOCS_MODE DAT (ro)
SetMode(m: in AOCS_MODE)
EnableTransToNOM()
<<interface>>
AOCS_CYCLE_IF
Step()
<<instance>>
AOCS_C_inst
<<NF_desc>>
Step :
<<cyclic>>
Period = 125 ms<<NF_desc>>
MAG_FAILURE_RC_EV_HANDL :
<<protected>>
Get_previousMode :
<<protected>>
Get_currMode :
<<protected>>
SetMode :
<<protected>>
EnableTransToNOM :
<<unprotected>>
<<NF_desc>>
<<instance>>
AOCS_C_inst
AOCS_MODE_IF
<<instance>>
Mode_Manager_C
_inst
AOCS_MODE_IF
MAG_DATA_IF
THR_CMD_IF
<<instance>>
MAG_C_inst
<<instance>>
THR_C_instTHR_CMD_IF
OBT_IF
MAG_DATA_IF
<<instance>>
OBT_C_inst
OBT_T

9. Andreas Jung | ESTEC | 15/11/2016 | Slide 10ESA UNCLASSIFIED - For Official Use
The needs for a Graphical editor for the
Space Component Model
Graphical editor prototype:
• To experiment the SCM meta-model a graphical editor was needed.
• R&D activity also prototyped a graphical editor to experiment and test the
complete approach.
• Original prototype of the graphical editor was based on Eclipse and
Obeo Designer, which allowed a quick and simple prototyping of a
graphical editor.
 Developed by a PhD student.
• Use of Obeo Designer / Sirius was more a coincident, since it fitted well with
DSL in ecore and was available for universities free of charge
• Alternative would have been to develop a dedicated, custom made tool
Conclusion:
• Sirius was good for prototyping and fitted with
meta-model developed in ecore

10. Andreas Jung | ESTEC | 15/11/2016 | Slide 11ESA UNCLASSIFIED - For Official Use
Graphical editor improvement activity with Obeo,
fully utilizing the Eclipse and Sirius frameworks
Following the R&D activities, it was clear that an improved version of the editor, in
terms of usability, is needed.
• Prototype was not user-friendly:
• 12 diagrams with 19 tables
• a lot of steps to create an initial model
• related information (tables/diagrams)
were not visible at the same time
• …
…but it was never the intention of the prototype to be user friendly – the
objective was to experiment and validate the meta-model.
• Hence, an improvement activity has been started with Obeo, using now Sirius.
The intention was also to experiment Obeo's and Eclipse technology further to
evaluate it for applicability and use in an industrial and production context.

11. Andreas Jung | ESTEC | 15/11/2016 | Slide 12ESA UNCLASSIFIED - For Official Use
Improved OSRA SCM Model Editor – overview
The following major changes were implemented:
• Overall usability improvement
• Dedicated OSRA Perspectives (Basic and Expert)
• Project creation wizards
• Provision of an Activity Explorer (central starting point)
• Provision of a Context browser (Amalgam project)
• Provision of a dedicated OSRA Properties View (EEF)
• Merging of diagrams: 12 diagrams + 19 tables to
4 diagrams and pop-up windows with tables
• Dedicated floating pop-ups as an intuitive alternative
to Sirius tables and some diagrams
• Better handling of validation through the Problems View
NB: Improvements were also inspired by Capella
(System engineering modelling tool also based on Sirius).

12. Andreas Jung | ESTEC | 15/11/2016 | Slide 13ESA UNCLASSIFIED - For Official Use
Improved OSRA SCM Model Editor in more detail
• Overall usability improvement
• Dedicated OSRA Perspectives (Basic and Expert)
 allows a simple and clean GUI without need for an RCP app (keeping full
integration with other Eclipse plugins)
• Project creation wizards
• Provision of an Activity Explorer (central starting point)

13. Andreas Jung | ESTEC | 15/11/2016 | Slide 14ESA UNCLASSIFIED - For Official Use
Improved OSRA SCM Model Editor in more detail
• All diagrams implemented in Sirius

14. Andreas Jung | ESTEC | 15/11/2016 | Slide 15ESA UNCLASSIFIED - For Official Use
Improved OSRA SCM Model Editor in more detail
• Context explorer (Amalgam project):
• OSRA properties (EEF):

15. Andreas Jung | ESTEC | 15/11/2016 | Slide 16ESA UNCLASSIFIED - For Official Use
OSRA SCM Model Editor in more detail
• Dedicated floating pop-up windows with tables
• Floating in-front of diagrams (still allowing to switch between diagrams)
• Pop-up windows well integrated with Sirius
 Suggestion for Sirius to support their tables also in pop-up windows.
From different diagram

16. Andreas Jung | ESTEC | 15/11/2016 | Slide 17ESA UNCLASSIFIED - For Official Use
OSRA SCM Model Editor in more detail
• Dedicated floating pop-up windows with tables
• Floating in-front of diagrams (still allowing to switch between diagrams)
• Pop-up windows well integrated with Sirius
 Suggestion for Sirius to support their tables also in pop-up windows.
Several tabs in
deployment pop-up

17. Andreas Jung | ESTEC | 15/11/2016 | Slide 18ESA UNCLASSIFIED - For Official Use
Overall evaluation of Sirius and Eclipse framework
Sirius evaluation
+ Robust framework, focused mainly on graphically modelling
+ Potential of integration with other EMF related plugins
Recommendations:
• Allow pop-up windows with tables (and diagrams?) to float in-front of diagrams
• Complex modelling tools will most likely mix graphical and text based modelling
Eclipse evaluation
+ Many plugins have been developed on which new tools can build
+ High extensibility and integration
– However, if more is needed than what the plugin provides, expert knowledge is needed!
– Performance issues experienced (from a user perspective)
Comments on development and maintainability of Eclipse based tools:
• Basic modifications/improvements can be done by non-experts (thanks to model based approach
even for configuration of some plugins, e.g. EEF config in Sirius)
• Expert knowledge needed to extend the tool (detailed knowledge needed on how the complete
framework works together, which can be complex…)

18. Andreas Jung | ESTEC | 15/11/2016 | Slide 19ESA UNCLASSIFIED - For Official Use
Next steps
SCM Model Editor tool has been improved in terms of Usability and Functionality.
Now considered to be ready for distribution to European space industry for
- Training purposes and understanding the practical implication of the OSRA
approach
- Evaluation of the tool itself in an industrial context. Among others the Scalability
of the modelling approach to be evaluated.
- Collection of user needs for a modelling tool for the OSRA
For the further evolution of the tool, it would be interesting to
- Investigate support for concurrent modelling in the context of the OSRA
- Model migration in case of meta-model changes
- Performance improvement