A Controller Area Network-Based Telemetry and Command System for Small Space Experiments F. Charles Dumont, Joseph J. Suter, and Paul D. Schwartz Controller area networks (CANs) have been used since the mid-1980s to connect microcontrollers and allow them to exchange data in an error-resistant manner. Until recently, their use has been limited to industrial and automotive applications. The Polymer Battery Experiment (PBEX) is a small spaceflight system developed at APL that will use a CAN to interface its telemetry and command system to the spacecraft computer. This type of network is attractive for space applications because of its built- in error detection and because it is a two-wire network, which helps to reduce spacecraft weight. This article describes the PBEX CAN and discusses the implementation issues that were encountered during the design of the experiment. (Keywords: Controller area network, Spacecraft systems, Telemetry.) I- U INTRODUCTION (cid:127) (cid:127)D A telemetry and command system on an instrument The two main advantages of placing these functions . "( or experiment serves a dual purpose: it gathers and within each experiment are that the processing power rr 'E formats output data and it executes uplinked command of the spacecraft computer is freed for more demanding _ - messages. Telemetry must be converted to digital form, applications, such as attitude determination and auto- 3D and formatted for transmittal and/or storage. Coin- navigation, and that the size of the spacecraft electrical IL_ C mands must be checked for validity, decoded, and im- harness is significantly reduced. In a centralized system, o 0.2 plemented. Verification of command execution may at least one wire is required in the harness for each "- . also be required. In the past, these functions were often telemetry item and for each command. In a complex ".9 centralized within the spacecraft computer. Now, how- spacecraft, this can make for a very large and heavy S0.- ever, it is more common to see spacecraft in which each harness. When the control is distributed, these wires cc L.CL experiment performs its own command and telemetry typically become traces on a printed circuit board, ,ICL handling while the central computer acts as a scheduler which is a much more compact medium than a cable and coordinator. This has been made possible by ad- harness. The interconnection between the spacecraft vances in electronics miniaturization and the advent of computer and the experiments can now be reduced to small and powerful microprocessors. a few control and data lines. This simplicity does come 214 JOHNS HOPKINS APL TECHNICAL DIGEST, VOLUME 20, NUMBER 2 (1999) DTOQUALITy INWpED 4 c)-~l at a price, however. The experiments must become OVERVIEW OF THE CONTROLLER more complex, and protocols must be developed to communicate with the spacecraft computer. The differ- AREA NETWORK PROTOCOL ences between the two architectures are made apparent CANs are composed of a number of nodes connect- in Figs. la and b. ed together in a daisy-chain fashion by a pair of shielded One protocol for data communications is the con- or twisted wires. Logic levels are derived from these two troller area network (CAN) developed by the German wires differentially. That is, logic 1 is represented by a company Robert Bosch' in the mid-1980s and updated positive voltage difference between the signals on the by Philips Semiconductor.' This protocol is a two-wire two wires, while logic 0 is given by a negative voltage serial data communications specification that allows difference. CAN messages are transmitted serially over microcontrollers distributed throughout a system to the bus from one node to all other nodes. Each message exchange data over cable lengths of up to 40 m contains a header with an identifier that specifies the with a maximum transmission speed of approximately contents of the message (e.g., input voltage, state of on/ 1 Mbit/s.' Longer lengths are attainable by decreasing off switch, switch batteries to "on," etc.). Using this the data rate. The protocol was originally designed for identifier, a node will filter out all messages except microcontrollers and smart sensors within automobiles those that are intended for it. The way a node filters to communicate with each other, but it has since be- out messages depends on the type of CAN protocol come widely used in industrial control applications, implemented. Two different types exist: basic CAN and A small spaceflight experiment developed at APL, full CAN. the Polymer Battery Experiment (PBEX),3 is using a In basic CAN, a node is interrupted every time it CAN to communicate with the spacecraft computer. receives a message. It must then examine the message The experiment will test the performance of advanced identifier to determine if the message is relevant to the rechargeable polymer batteries in the space environ- node. In a full CAN implementation, hardware filters ment and will be launched onboard the PicoSat space- all messages at the front end of each node screen and craft being built at Surrey Satellite Technology, Ltd., in only interrupts the node's microcontroller when the Great Britain. This article discusses the hardware and identifier matches one of those to which the node software design issues that were involved in implement- responds. This implementation of the protocol is much ing the experiment's telemetry and command interface, preferred over basic CAN because it simplifies software programming for the nodes. Most commercially avail- able CAN microcontrollers now support full CAN. The identifier also helps eliminate bus contention, which occurs when two nodes try to transmit data over (a) the bus simultaneously. In a standard serial bus, this can Seeecause damage to electronic components. With a CAN system, though, the message with the lowest identifier has the highest priority. Therefore, if two nodes try to transmit a message at the same time, the message with Sthe lowest identifier will take control of the bus and prevent the other message from being transmitted. m Another advantage of CAN is that error detection is built into the protocol. There are four types of error flagging. Cyclic redundancy codes are computed for each message and transmitted as part of the message. The receiving node also computes this code and detects (b) an error if there is a mismatch. Additionally, formatting ...........(cid:127) .... .... bits within the message must have certain values or the .... message will be discarded as erroneous. Stuffing bits are also inserted after any five consecutive bits having the T -same value. Therefore, an error will be raised if a re- ceiver detects six or more identical bits in a row. Finally, a send-and-acknowledge scheme performs further error checking. WVhen a node receives a message, it must acknowledge its successful receipt by driving the bus Figure 1. Spacecraft telemetry and command system architec- low for a specified amount of time. The transmitting tures: (a) centralized, (b) distributed, node will continue to transmit the message until it JOHNS HOPKINS APL TECHNICAL DIGEST, VOLUME 20, NUMBER 2 (1999) 215 F.,C. DUMONT, J. J. SUTER, AND P. D. SCHWARTZ receives this acknowledgment or until a specified Hardware Description amount of time has passed. If a message is found to be At the heart of the PBEX telemetry and command in error, instead of acknowledging it, the node that interface is a 16-bit microcontroller, the Siemens flagged the error will send an error message to all other SABC167CR. This microcontroller has an integrated nodes, including the original transmitter. This will 1 module that is configured to transmit abort transmission of the message and will alert all of CA prtcg tahb eo rntohtdnee osd teh ast stiho et hthmaete smsaegses aiigsse e rroonnee ous.. TTlh e ddaalttaa aannod d daacta i atv 1b0 e5d3 .2t5 7r ktb ps.sD, whaisc h nti s ori ghrtth at CthA e limb uit oaf e achievable data rates. Data sent over the CAN bus are formatting fields of a standard CAN message frame are received by this module, checked for errors, and shown in Fig. 2. checked for a matching identifier. This is done entirely in hardware. If no errors are found and the message POLYMER BATTERY EXPERIMENT identifier is valid for PBEX, an interrupt is generated TELEMETRY AND COMMAND SYSTEM to alert the microcontroller that a new message has arrived. The CAN module has 15 message buffers that Controller Area Network Implementation can be configured as either receive or transmit buffers. Because all messages sent to PBEX will have the same PBEX implements the full version of the CAN pro- ietfeol n eev ufri nbe.Ascn tocol. However, the identifier of a message has a slightly identifier, only one receive buffer is enabled. A second message buffer is configured as a transmit buffer for different defifentmeaniniCn tA h e speficati. Insteaworft hauni responding to all messages sent by the spacecraft com- defined in the CAN specification. Instead of a unique puter. Figure 3 shows a functional block diagram of the identifier being assigned to each of the possible mues- PBEX telemetry and command interface. sages in the system, in the PicoSat implementation, the The spacecraft requests eight analog telemetry items identifier represents the node, or experiment, for which and one digital item from PBEX every 10 s. Since each the message is intended. PBEX is just one of the nodes telemetry item is 16 bits wide, this translates to a data on the network. Further formatting within the data rate of 152 KB per day. Another option would have field of the message describes the source, type, and been to let PBEX transmit these data without the need content of the message. As would be expected, the for a request, which would further decrease the load on message type specifier identifies whether the message the spacecraft processor. Although this was allowed, it contains a command or a telemetry item. For each would have required synchronizing the PBEX clock message that is transmitted over the CAN bus, a with the spacecraft clock and the added complexity was matching return message is sent in the opposite direc- undesirable. The analog data items represent the volt- tion to either acknowledge the message or to indicate that it is invalid. Thus, six types of messages are defined ages, currents, and temperatures of the two batteries for PBEX: located within the experiment. The digital item is made up of the status bits (on/off) for six relays. Analog "* Telemetry request telemetry items are converted to digital data by the "* Telemetry request acknowledgment microcontroller's integrated 10-bit analog-to-digital "* Telemetry request error converter. Commands can be either relay commands or "* Command internal state commands. Relay commands cause the "* Command acknowledgment microcontroller to produce pulses, which are amplified "* Command error to switch the state of electromechanical latching relays. Message Frame Arbitration Control Bus idle -C-5field field Data field CRCfield ACK EOF Int Bus idle . rt Delimiter Slot Delimiter Figure 2. Controller area network standard message frame. (SOF = start of frame, RTR = remote transmission request bit, DLC = data length code, CRC = cyclic redundancy code, ACK = acknowledge bit, EOF = end of frame,' Int = interval, and ro, rl = reserved bits for future use.) 216 JOHNS HOPKINS APL TECHNICAL DIGEST, VOLUME 20, NUMBER 2 (1999) CAN-BASED TELEMETRY AND COMMAND SYSTEM 8 analog 6 digital known. It is not dependent on channels channels what interrupts have occurred in the system. This type of software Pulsed architecture is relatively insensi- 16-bit address commands tive to changes in the system clock comnsspeed. The only change that would be required for a different clock /0'> .would be the hexadecimal reload .value of the 100-ms timer. Figure 4 .- ::-...- / Serial data illustrates the structure of the .7 PBEX main loop. S...Only two types of tiers exist in 8-bit data .this structure: Check Mailbox and Battery Safing. Check Mailbox Figure 3. Polymer Battery Experiment telemetry and command interface, does just that; it checks to see if a new message has arrived on the CAN bus. This will be indicated by a flag set by the CAN interrupt. Internal state commands change the value of variables The interrupt service routine for the CAN module in the experiment's software. These variables are pa- merely sets this flag and moves the message to a buffer. rameters used in the experiment as part of its auton- It does not process the message. Up to three messages omous battery charging algorithms. A total of 31 dif- can be waiting to be processed in the buffer. Any ad- ferent commands are defined for PBEX. ditional messages will be ignored. If a message is waiting, As mentioned earlier, a CAN-based telemetry and it is decoded to determine if it is a telemetry request or command system reduces the size of the electrical a command. Depending on the message type and con- harness between the spacecraft computer and the ex- tent, an analog-to-digital conversion may be started, a periments. If a centralized approach had been used relay may be pulsed, or some other action will occur. instead, PBEX alone would have required 14 individual The appropriate response will then be sent back to the wires for its telemetry and 31 wires to receive com- spacecraft computer over the CAN bus, and the tier will mands. The two wires required in a CAN implemen- wait until the 100 ms are up. tation represent a 96% savings in harness weight. The last tier in the main loop, Battery Safing, per- Given that PBEX is the simplest of the subsystems on forms an analog-to-digital conversion on either the PicoSat, the overall weight reduction is even greater. voltage or current for the battery being exercised. This Software Description The PBEX flight software is built around a main loop that repeats indefinitely. This loop is structured in a deterministic fashion to ensure that central processing unit re- Mail%:E: > sources will always be available for the current task. To do this, the loop is divided into 10 tiers of equal length. Each tier is guaranteed to last 100 ms by starting a timer upon entering the tier. If the task finishes cc before the timer expires, the tier waits until the time is up before passing control to the next tier. With 10 tiers, the main loop is guaranteed to repeat every second. This makes software debugging and timing analysis much simpler be- cause the particular task being per- formed at a certain time is always Figure 4. Deterministic software loop for the Polymer Battery Experiment. JOHNS HOPKINS APL TECHNICAL DIGEST, VOLUME 20, NUMBER 2 (1999) 217 F..C. DUMONT, J. J. SUTER, AND P. D. SCHWARTZ value is compared against a limit that has been set for error detection capabilities and because of the large each battery to determine if it is time to switch from degree of flexibility they offer for configuring a space- charge to discharge mode or vice versa. The tier also craft's telemetry and command system. However, the checks the battery temperature to ensure that it does one drawback to using them is that the available mi- not exceed a safe limit. If it does, the tier disconnects crocontrollers that incorporate a CAN protocol mod- the battery from its circuit. All of the limits for the ule are all commercial components. Their susceptibility batteries can be changed by command from the ground. to ionizing radiation may be a problem. PBEX will Although these functions are relatively simple, it is determine how much of a problem this is for the easy to see that they would consume valuable spacecraft Siemens SABC167CR microcontroller. Unfortunately, processing time if they had to be performed by the chip manufacturers will not invest in radiation harden- spacecraft computer. The advantages of a distributed ing of their components until there is a proven market telemetry and command system are evident. The reduc- for them. And this market will not be established unless tion of the spacecraft computer's load offered by a the gains realized from using a CAN network are made distributed system is difficult to quantify since, for apparent to spacecraft developers. It is our hope that example, the process of getting a telemetry item is the success of PBEX will demonstrate those gains. shared between PBEX and the spacecraft computer. But if we consider just the Battery Safing tier, with a cen- REFERENCES tralized system the spacecraft computer would have to tralzend systems othospe erye craftondpcher thavel mto '1Robert Bosch GmbH, CAN Specification, Version 2.0, Stuttgart, Germany spend 100 ms out of every second checking the limits (1991). for the batteries and acting accordingly. This alone is 2Philips Semiconductors, CAN Specification, Version 2.0, Publication 5452, a 10% savings in processing time. If it had to perform Sunnyvale, CA (1992). 33Dumont, F. C., Suter, J. J., Lew, A. L., Schwartz, P. D., Le, B. Q., et al., the same sort of tasks for the three other experiments "Polymer Battery Experiment: Novel Power System for Space Applications," on PicoSat, a 40% savings would be realized by a dis- in Proc. AIAA Defemse and Civil Space Programs Conference and Exhibit, tributed system. Huntsville,. AL (Oct 1998). ACKNOWLEDGMENTS: We would like to thank the engineers at Surrey CONCLUSION Satellite Technology, Ltd., for their invaluable assistance with the development of the PBEX CAN interface. Their patience and perseverance in helping us to CANs are an attractive method to connect the understand the CAN protocol played a large role in the successful outcome of the PBEX project. We also gratefully acknowledge the contributions to PBEX from experiments on a spacecraft because of their inherent Rome Laboratory in Rome, New York. .......... ........ . ........-.........-........... ..-.-.............-...-.-.- ..-.-.-.-.-.-..-.-.-.-.-.-.- ........................ :.::.::..: .::.::.:::: :.:................... .(cid:127).................[.:CiiA RL 2 E1~ 8 t fi4US TO~~~ s~J t O ~~~Hx9ae N~ aS~:r ~:eiH~rf.O c..P: K(cid:127):vIN: S- :ssA tP: Liu es inrnhe;i .S:ct; eDn Di a sa~reiuiea z..n.........e.....s........e.~..........i..r.t... ....w ...............i ..i..s.....st. .... ..e.......... . ........... .... .(cid:127)........................ .....te.r 4~~~~fllus~~~.... o a ~t se ss~e s~oee ~sai edrM &cge~us esM roxeraea ........ ............~ ........t.~.~hiea~~g.hu~.s u. ~ T. .e a~ sii~lta adae~ s riorgm ~tpi hez.. s .~i. s.x..~ . .o..~.. h..gii.. ... ...ea. _.dit' t.oiemh ý- i ~ 218~~~~~~~ JOHN HOPKINS APL TEHNCA .I.E0S.VNOMUEE R2199 CAN-BASED TELEMETRY AND COMMAND SYSTEM 3O.I¶JSUE ao.adaESd.tei pyic ndiahe..sfom h V nwrsyo.pAh~s~e~r~~a~ ~ ~~~T ~sewN~s e hee ln9dO~f r1 mtni.ii.f.. h.taan .U~Mw t~w M~ ~ eetgeefo.. theU m m wanr ............. ...3.in.ei.m..a .W. a....4. p.n. .a P.h. . e~ n .~ ~ ~ ..t~e a e. E.~ES .P1 C.aa.at ar..e .n H... ........ .. of a. a. aem.ral ..... r.... ec.l..c.......niste .t.~... ashe ftv r & telns a p.....u..n..o. x.... ..& t .. I s ..t. .....e... .... .. e.....d.. ...n. .ma TC....d.....t .A..e.x.. .~....eP...s...l...e... ... .a..........a.sr.d.. . t.e.Rt. dsmraeostxW ei nmjs ~e aTh sct~Res kCoy h nk ~Dpat~ vUa wae tse P..... .A~R T ... t $ thna rd Me g.d sa ... e....tConllU.esrt eim.n'is h A I 5ae earao 1973hkaMS hhrw eaer z thelead esig engneerfor he dvelpeto .w.a..pae.a.sthyses tdrs heA.l..nmndSstm. COEMonnts Mngesen seml, n teMS at anln Swaa.M.$harzwa k rwwredsinesgkerfa heNA .c...eCo mndT...y is eine owrco.tana.e.trnc .... e.s.tnntn.entieldn.te..ie..P)an ieUyse A ................ d teesta nier~i h aelg eto ... a...e...lesiae Isaradades s~idahara~uaf d JOHNSHOVPOKUNMS E 0,.ANPU BETRE..C(1N9I9C).A21LDIGET, INTERNET DOCUMENT INFORMATION FORM A. Report Title: A Controller Area Network-Based Telemetry and Command System for Small Space Experiments B. DATE Report Downloaded From the Internet: 07/12/99 C. Report's Point of Contact: (Name, Organization, Address, Office Symbol, & Ph #): AFRLIPA 1864 4th St., Suite 1 Wright-Patterson AFB, OH 45433-7131 D. Currently Applicable Classification Level: Unclassified E. Distribution Statement A: Approved for Public Release F. The foregoing information was compiled and provided by: DTIC-OCA, Initials: __VM Preparation Date 07/12/99 The foregoing information should exactly correspond to the Title, Report Number, and the Date on the accompanying report document. If there are mismatches, or other questions, contact the above OCA Representative for resolution. 19990712 088