Euclid ICU Boot Software

Academic Embedded Flight-Software Implementation

This repository contains an academic embedded-C implementation of boot-software concepts associated with an Instrument Control Unit (ICU), developed in the context of the NISP instrument aboard ESA's Euclid mission. The implementation models a small bare-metal command-processing path with simulated telecommand reception, packet acceptance, RAM loading, integrity checking, and integration tests.

Euclid spacecraft.

Academic project This repository contains an educational implementation of embedded boot-software concepts developed in the context of the Euclid/NISP ICU architecture. It is not operational Euclid flight software and is not affiliated with ESA or the Euclid Consortium.

Mission Context

Euclid is an ESA space mission studying the dark Universe. Its scientific payload includes the VIS visible-light instrument and NISP, the Near-Infrared Spectrometer and Photometer. This academic project focuses on software concepts associated with the instrument-control layer, specifically boot-software behavior around telecommand reception, validation, and execution.

The mission context, academic reference architecture, and this repository are distinct:

• ESA Euclid / NISP mission: the real spacecraft and scientific instruments.
• Reference ICU boot-software architecture: the academic architecture studied for boot-time command handling and memory operations.
• This repository: a local educational implementation and test harness for selected embedded-software concepts.

                  ESA Euclid Mission
                         |
                         v
                 Euclid Spacecraft
                         |
               +---------+---------+
               |                   |
               v                   v
              VIS                 NISP
                                    |
                                    v
                           Instrument Control Unit
                                    |
                                    v
                              Boot Software
                                    |
                                    v
                            This repository

Euclid spacecraft and instrument context.

NISP instrument components.

Implemented Software Architecture

The code is written in embedded C and follows a bare-metal structure. It does not use an RTOS. The main() function configures SysTick, then runs an infinite command loop that extracts queued telecommands, checks acceptance conditions, and executes accepted commands.

              Ground / simulated MIL bus
                         |
                         v
                 SysTick interrupt
                    Sync Task
                         |
                         v
                    TC Queue
                         |
                         v
                    Main Task
                  Command Loop
                         |
                         v
                  TC acceptance
                         |
                         v
                    TC(6,2)
                  Load Memory
                         |
                         v
                   ISO checksum

The current implementation contains a TC(6,2) Load Memory path. The source tree does not implement a TC(6,9) Check Memory executor in the active acceptance/execution flow.

Runtime Flow

Area	Implementation
Startup and main loop	Source/main.c configures SysTick with a reload value of 400000 CPU clock cycles and enables the counter, interrupt, and internal clock source. The main loop repeatedly calls telecommand extraction, acceptance, and execution functions.
Periodic interrupt	Source/systick.c implements SysTick_Handler(). The handler updates comm_frame_cnt from 0 to 49 and increments major_frame_cnt on wraparound.
Sync Task	The SysTick handler receives simulated MIL bus messages and inserts them into the telecommand queue while space is available. Integration-test hooks are also called from this handler when INTEGRATION_TESTS is defined.
Main Task	The foreground loop extracts one queued telecommand when available, validates it, and executes it only if acceptance succeeds.
MIL bus simulation	Source/milbus.c provides a 16-message circular simulation buffer using send_msg_to_milbus() and receive_msg_from_milbus().
Hardware map	Source/hw_map.h defines the local PROM base, RAM range, and SysTick register addresses used by this development target.

The academic reference architecture and the development/simulation target differ in processor configuration, memory map, and timing constants. Hardware-specific values in this repository correspond to the environment used to exercise the implementation rather than representing the operational Euclid ICU hardware configuration.

Telecommand Handling

TC(6,2) Load Memory

The implemented packet format is defined by indexes and constants in Source/tc_acceptance.h:

Field	Size	Notes
Service type	1 byte	Must be 6.
Service subtype	1 byte	Must be 2.
Number of bytes	2 bytes	Big-endian load size.
RAM start address	4 bytes	Big-endian destination address.
Data	Variable	Bytes copied into RAM on execution.
ISO checksum	2 bytes	Checked over the packet excluding the final checksum field.

Source/tc_acceptance.c accepts a telecommand only when all implemented checks pass:

• the ISO checksum matches the final two bytes of the packet;
• service type is 6;
• service subtype is 2;
• load size is from 1 to 992 bytes;
• destination address is in the accepted RAM range 0x1FFF0000 through 0x2002FFFF;
• the complete destination range remains inside that RAM interval.

Accepted TC(6,2) packets increment accepted_tc_cnt. Rejected packets increment rejected_tc_cnt. During execution, the data field is copied byte-by-byte to the requested RAM address and executed_tc_cnt is incremented. The implementation does not claim demonstrated hard real-time performance.

TC Queue

Source/tc_queue.c and Source/tc_queue.h implement a bounded circular telecommand queue with static storage.

Property	Value
Logical capacity	NUM_ITEMS = 5 telecommands
Backing buffer	BUFFER_SIZE = NUM_ITEMS + 1 slots
Maximum element size	ELEMENT_SIZE = 1040 bytes
Indexes	Separate insert_index and extract_index
Full/empty detection	One slot is left unused to distinguish full from empty

Insertion copies the incoming message into the current insert slot and advances the insert index with wraparound. Extraction copies the next queued message into a caller-provided buffer, returns its size, and advances the extract index with wraparound. All queue storage is statically allocated.

ISO Checksum

Source/isocheck.c implements a 16-bit ISO-style checksum used by the telecommand path for packet integrity validation. It is not a CRC.

At a high level, the function maintains two 8-bit accumulators over the input octets:

C0 = (C0 + byte) mod 255
C1 = (C1 + C0)   mod 255
CK1 = bitwise_not((C0 + C1) mod 255)
CK2 = C1
checksum = (CK1 << 8) | CK2

If either checksum byte evaluates to zero, the implementation substitutes 0xFF. The resulting 16-bit value is compared with the checksum field appended to telecommand packets.

Integration Tests

Source/it_tcmd_test.c contains integration scenarios driven from the SysTick handler. The tests use the Unity Test Framework; Unity itself is third-party software, not authored project functionality.

The implemented scenarios cover:

• valid TC(6,2) RAM loads at 0x20010000, 0x20010400, and 0x20010803;
• rejected load sizes of 993 bytes and 0 bytes;
• invalid low RAM address 0x1FFEFFFC;
• invalid destination range crossing beyond the accepted RAM end;
• invalid ISO checksum;
• unsupported service/subtype examples such as TC(6,5) and TC(17,1);
• final memory-content checks for accepted loads;
• final counter checks expecting 3 accepted, 7 rejected, and 3 executed telecommands.

Unity files included in this repository:

• Source/unity.c
• Source/unity.h
• Source/unity_internals.h

Unity is distributed under the MIT License. See THIRD_PARTY_NOTICES.md for the third-party software notice.

Source Overview

.
|-- Images/
|   |-- Euclid_s_anatomy.png
|   |-- Euclid_spacecraft.jpg
|   `-- NISP_components.jpg
|-- Source/
|   |-- hw_map.h
|   |-- isocheck.c/.h
|   |-- it_tcmd_test.c/.h
|   |-- main.c
|   |-- milbus.c/.h
|   |-- systick.c/.h
|   |-- tc_acceptance.c/.h
|   |-- tc_queue.c/.h
|   |-- unity.*
|   `-- user_types.h
|-- .gitignore
|-- README.md
`-- THIRD_PARTY_NOTICES.md

Module Summary

Module	Role
main.c	Configures SysTick and runs the foreground command-processing loop.
systick.c/.h	Provides SysTick register configuration and the interrupt handler used as the Sync Task.
tc_queue.c/.h	Implements fixed-size circular buffering for received telecommands.
tc_acceptance.c/.h	Implements TC(6,2) packet validation and load-memory execution.
isocheck.c/.h	Implements the 16-bit ISO checksum used for telecommand integrity checks.
milbus.c/.h	Simulates message send/receive behavior for the MIL bus interface.
it_tcmd_test.c/.h	Defines Unity-based integration scenarios for accepted, rejected, and executed telecommands.
hw_map.h	Defines local memory and SysTick register constants for the development target.
user_types.h	Provides fixed-width project typedefs and a project-local Boolean type.
unity.*	Third-party Unity Test Framework source files.

Engineering Characteristics

• Bare-metal embedded C structure without an RTOS.
• Deterministic foreground command loop with interrupt-driven message intake.
• Static, fixed-size memory structures.
• Bounded circular telecommand queue.
• Separation of telecommand reception, queueing, acceptance, execution, and integrity checking.
• Explicit hardware-register access for SysTick configuration.
• Integration testing of valid and invalid telecommand paths.

Academic Context

This project was developed as part of the Aerospace Engineering degree at Universidad Rey Juan Carlos in an aerospace-programming and embedded-software academic context.