Command and Data Handling (CDH)
Subsystem Top Level Requirements
-- The system shall have a processing
unit that will handle all the real time operations of the satellite
-- The system will have sufficient
storage to log data for 45 days before overwriting
-- The system shall provide data
interfaces to all other systems
The system shall be capable of recovering from single event effects
(SEE): single event upsets (SEU) and single event latch-ups (SEL)
Subsystem Functional Requirements
-- The system shall not exceed a mass of
75 grams and a volume of 100 cm^3
The system shall provide at least 16MB of memory for data storage
The system shall provide a data link of at least 120kbps to the Science
The system shall provide a data link of at least 9600bps to the Primary
Communications (PCOMM) subsystem
The system shall provide temperature monitoring of critical locations of
The system shall perform housekeeping tasks such as logging system
activity and monitoring the Power system
The system shall formulate communication packets for the PCOMM system
according to AX.25 communication protocol
The system shall record all sensor data from temperature sensors, as
well as from ADCS and Power
Radiation Analysis and Prevention
A large amount of investigation has been
done as to the effects of the radiation in Low Earth Orbit (LEO) on
flash memories and microprocessors. Check out the
IEEE Radiation Effects Workshop papers for hundreds of papers on
the topic of radiation effects on electronic hardware. Per the CDH
subsystem requirements, the system is designed to be capable of full
recovery from SEE in LEO and is even capable of gathering data about the
number of SEE experienced during the duration of the mission.
Although it is possible to encounter SEE when passing over the Earth's
poles, the majority of SEE occur at the South Atlantic Anomaly, a region
near Brazil with a dip in Earth's magnetic field.
Several measures are employed to protect the system
from SEE, including current sensors to guard against SEL leading to
component burnout, triple redundancy memory with voting software and
frequent vote-rewrite cycles, and in-orbit programmability to allow
verification and reloading of critical software. This functionality will
also allow for software to be sent from the ground should mission goals
Total Ionizing Dose (TID) is not considered to be a
significant factor due to the short mission lifetime. Most flash memory
will lose write functionality after a TID of 6 - 15 krad. Using the free
software created by the Naval Research Laboratory, the expected annual
radiation dose for the planned HERMES orbit is approximately 0.5 krad.
This is well below even the lowest failure levels for flash memory and
therefore is not a significant factor for the mission.
The Command and Data Handling (CDH) subsystem is
built around the PIC24HJ256GP610 microcontroller as the central
processor. This is a 16-bit processor which supports two Serial
Peripheral Interface (SPI) modules, two Inter-Integrated Circuit (I2C)
modules, two Universal Asynchronous Receive and Transmit modules, and
In-Circuit Serial Programming (ICSP).
The PIC development and driver implementation was
completed using the Explorer 16 Development Board.
PIC Internal Watchdog
The PIC microcontroller utilizes an
internal watchdog timer to help prevent radiation induced latch-ups and
other runtime errors. The watchdog is a separate circuit within the PIC
that receives a periodic "ok" signal from the rest of the
microcontroller, approximately every 1/10th of a second. If the watchdog
fails to receive the "ok" signal, it will assume the PIC is in a
"latched" state and will reset the microcontroller.
Real Time Clocks (RTC)
In order to keep an accurate system time, functionality
needed for system scheduling, a RTC is implemented on the satellite. This chip
also has a back-up battery so that it can
maintain accurate timekeeping even when the satellite has a power reset.
The main memory on Hermes is a set of
three-64MB SD Cards. The SD Cards will be responsible for storing all
science and housekeeping data generated throughout the mission. A small
portion of each card will hold identical copies of the program code for
the PIC. In the event that the PIC needs to reprogram its internal flash
memory, it will read all three copies, vote between them, and then
reprogram with the outcome of the vote. This will prevent radiation
damage to critical code space.
Approximately every 10 minutes, the PIC will
perform a cycle of reading, voting, and repairing all triplicate code.
This will help prevent two bit flips from occurring on the same piece of
data, which would nullify the voting accuracy.