S5p INTENTIONALLY BLANK

Transcription

1

2 S5P.IRD.ASU.SC Page 2 of 106 INTENTIONALLY BLANK

3 S5P.IRD.ASU.SC Page 3 of 106 CONTENTS 1. INTRODUCTION Purpose Acronyms List DOCUMENTS Applicable Documents Reference Documents MILBUS INTERFACE MIL-STD-1553 Options Command Word Data Word Status Word Mode Code Commands Cross-strapping RT Configuration Mil-bus Sub-addresses Received Sub-addresses Transmit sub-addresses DIRECT INTERFACES Direct Interface in DHS Module DHS Direct Commands DHS RSA Interfaces DHS Direct Analogue Interfaces Direct Interface in LCL Modules LCL Direct Commands LCL RSA Interfaces Direct Interface in Battery Module BATT Direct Commands BATT RSA Interfaces BATT Direct Analogue Interfaces OPERATION CONSTRAINTS Parameter List Management Acquisition List Management...46

4 S5P.IRD.ASU.SC Page 4 of EDAC Error Management Single errors in SRAM or EEPROM Double errors in Acquisition buffer (SRAM memory) Double errors in Parameter buffer (EEPROM memory) Sol Operation Deployment Sequence Operation Arming relay operation Selection relays operation Single Fire operation Simultaneous Fire operation Battery level configuration EOC level configuration ICH level configuration...53 FIGURES Figure Command Word Format...8 Figure Data Word Format...8 Figure Status Word Format...8 Figure Mode Commands...9 Figure Cross-strapping...10 Figure RT Configuration...10 Figure RT Address Connector...11 Figure Deployment sequence operation flow chart. Single firing...50 TABLE Table Sub-address legalization in Receive Mode...13 Table S/A#2 Analogue Tm Sample Time Settling...13 Table S/A #3 Write register Definition...14 Table Memory mapping...15 Table Acquisition register...16 Table Write/Read Internal Register...18 Table Subaddress legalization in Transmit Mode...39

5 S5P.IRD.ASU.SC Page 5 of 106 Table DHS Direct commands...42 Table DHS RSA interfaces...42 Table DHS Direct Analogue Interfaces...43 Table LCL Direct Commands...43 Table LCL RSA Interfaces...44 Table BATT Direct Commands...44 Table BATT RSA interfaces...45 Table BATT Direct Analogue Interfaces...45 Table SOL Operation...49 Table Linear calibration curves...56 Table Non-linear calibration curve...57 Table Analogue Parameters...76 Table Digital Parameter Definition...88 Table Digital Status Meaning Table Digital statuses after DHS I/F power-up...105

6 S5P.IRD.ASU.SC Page 6 of INTRODUCTION 1.1 Purpose The purpose of this document is to describe the required format of the Mil-bus commands & responses of the Generic PCDU unit up to the function, data and bit levels, as well as to define any TM/TC discrete interface. All Mil-bus commands/responses will be of fixed data length. The bit numbering system of an N-bit data field applied in this document is the AS250 transfer bit numbering as per AD4: the most significant bit (MSB) has the bit number 0 on the left side and the least significant bit (LSB) has bit number 15 on the right side. The MSB (Bit 0) is the first bit transmitted over the Mil-bus, and the LSB (Bit 15) is the last transmitted bit. 0 MSB 15 LSB FIRST TRANSMITTED OVER THE MIL-BUS LAST TRANSMITTED OVER THE MIL-BUS 1.2 Acronyms List BAT Battery BOL Beginning Of Life CoG Centre of Gravity DET Direct Energy Transfer DEP Deployment DHS Data Handling Subsystem EICD Electrical Interface Control Document EOC End Of Charge EOL End Of Life ICD Interface Control Document I/F Interface EMC Electromagnetic Compatibility EPS Electrical Power System EQM Engineering Qualification Model FCL Fold Back Current Limiter FMECA Failure Mode Effect and Criticality Analysis FSR Full Scale Range HK Housekeeping HTR Heater LCL Latching Current Limiter MICD Mechanical Interface Control Document MEA Main Error Amplifier MoI Moment of Inertia NA Not Applicable PCDU Power Control Distribution Unit PFM Proto-Flight Model PSA Part Stress Analysis PWM Pulse Width Modulator

7 S5P.IRD.ASU.SC Page 7 of 106 SA SAR SAS S/C SG TBC TBD TICD TC TK TM TSW UV WCA Solar Array Solar Array Regulator Solar Array Simulator Spacecraft Solar Generator To Be Confirmed To Be Defined Thermal Interface Control Document Telecommand Thermal knife Telemetry Transistor Switch Under voltage Worst Case Analysis 2. DOCUMENTS 2.1 Applicable Documents Item Doc: number Title AD1 DIV-SP T-ASTR Issue 02, Rev 01 PCDU REQUIREMENT SPECIFICATION AD2 DIV-SP T-ASTR Issue 03, Rev 01 AS250 AVIONICS EQUIPMENT GDIR AD3 DIV-SP T-ASTR Issue 03 PA REQUIREMENTS FOR SUBCONTRACTORS AD4 DIV-SP T-ASTR Issue 01, Rev: 01 MIL-STD-1553 Bus Protocol Specification AD5 MIL-STD-1553B MIL-STD-1553B Digital Time Division Command/Response Multiplex Data-Bus AD6 S5P.SP.ASU.SC Issue 01, Rev: 00 S5p PCDU Jacket Requirement Specification 2.2 Reference Documents Item Doc: number Title RD1 RD2 NOT USED NOT USED RD3 S5P.ICD.ASU.SC Interface Control Document (EICD)

8 S5P.IRD.ASU.SC Page 8 of MILBUS INTERFACE 3.1 MIL-STD-1553 Options Command Word Command Word format as defined in AD5 Bit Time Command Word Sync RT Address T/R Subaddress/ Mode Data Word Count/ Mode Code P Figure Command Word Format Data Word Data Word format as defined in AD5 Bit Time Data Word 16 1 Sync Data P Figure Data Word Format Status Word Status Word format as defined in AD5 Bit Time Status Word Sync RT Address ME IB SR Reserved BCR BSY SF TF P DBCA Figure Status Word Format

9 S5P.IRD.ASU.SC Page 9 of 106 Only the following bits of the status word are managed by the PCDU Remote Terminal: ME: Message Error bit BCR: Broadcast Command Received bit The following bits are not to be used in the PCDU: IB: Instrumentation Bit. Not used. Always set to 0. BSY: Busy. Not used. Always set to 0 (subsystem always available) DBCA: Dynamic Bus Control Acceptance Bit. Not used. Always set to 0. SR: Service Request Bit. Not used. Always set to 0. SF: Subsystem Flag bit. Not used. Always set to 0. TF: Terminal Flag bit. Always set to 0. The Reserved bits are fixed to Message error bit (ME) management The message error bit (ME) is set to logic 1 to indicate that one or more of the data words associated to the preceding message failed to pass the message validity test, as defined in of MILBUS standard. When a non legalized SA is received the status word with the message error bit set is sent Broadcast Command Received bit (BCR) management The Broadcast Command Received bit (BCR) is set to logic 1 when the preceding valid command word was a broadcast command (RT address 31). The Broadcast Command Received bit is reset when the next valid command is received by the PCDU, unless the next valid command is Transmit status word or Transmit last command mode codes Mode Code Commands Only the following Mode codes shall be processed by the PCDU Remote Terminal: Mode Code Nr Description Comment 1 Synchronize 2 Transmit status word 4 Transmitter shutdown (SD) 5 Override Transmitter shutdown 8 Reset Remote Terminal 17 Synchronize with data word Only legalised at broadcast address. 18 Transmit last command Figure Mode Commands Cross-strapping PCDU will compose of two sections, each implementing an independent RT. Each RT receives two 1553 buses (bus A and bus B) through dedicated interfaces. Therefore both sections of the PCDU have access

10 S5P.IRD.ASU.SC Page 10 of 106 to both buses from the platform. The following figure shows the cross-strapping concept of the PCDU unit. Figure Cross-strapping RT Configuration The PCDU will be connected to the main bus following the long stub configuration (transformer coupling). Figure RT Configuration

11 S5P.IRD.ASU.SC Page 11 of 106 The RT address of each MILBUS remote terminal can be configured by means of an external connector. This external connector shall be performed using a dedicated Canon 9P according to the following pinout: Pin 1: Remote Terminal Address bit 4 (MSB) Pin 2: Remote Terminal Address bit 3 Pin 3: Remote Terminal Address bit 2 Pin 4: Remote Terminal Address bit 1 Pin 5: Remote Terminal Address bit 0 (LSB) Pin 6: Remote Terminal Address parity bit Pin 7: PCDU secondary 0V Pin 8: PCDU secondary 0V Pin 9: Not connected A logical 1 level shall be obtained by floating the corresponding pin. A logical 0 level shall be obtained by connecting that pin to the secondary 0V pin at harness level (pins 7 or 8). The type of parity is odd. The next figure shows an example of the external connection to be performed in the RT Address connector. Address Connector 5V Remote Terminal MSB Pin 1 Pin 2 Pin 3 Pin 4 FPGA LSB Parity Pin 5 Pin 6 Pin 7 Pin 8 Pin 9 DGND RT Add. = 13dec Figure RT Address Connector

12 S5P.IRD.ASU.SC Page 12 of Mil-bus Sub-addresses Received Sub-addresses Sub-addresses Table in Reception mode (BC to RT) The sub-addresses managed by PCDU in reception interchanges (BC to RT) are shown in the next table. S/A# CONTENT DATA WORD# 0 Mode codes - 1 Not Used (illegalized) - 2 Sampling time 1 3 Write register 2 4 Not Used (illegalized) - 5 Write parameter list Not Used (illegalized) - 7 Write acquisition list LCL command in Lx Modules 1 9 LCL command in Hx Modules 1 10 Heater command in Hx Modulex LCL command in DEPx Modules Heater command in DEPx Modules Deployment Arm/Disarm 1 14 Deployment selection 1 15 Reset fire status 1 16 Not Used (illegalized) - Firing command 17 (legal when launch strap disconnected, and illegal when launch strap connected) 1 18 Not Used (illegalized) - 19 Not Used (illegalized) -

13 S5P.IRD.ASU.SC Page 13 of 106 S/A# CONTENT DATA WORD# 20 EoC Value programming - 21 Ich Value programming - 22 Not Used (illegalized) - 23 Battery Level setting 1 24 Battery Relays command 1 25 Reset SOL status 1 26 Not Used (illegalized) - 27 Not Used (illegalized) - 28 Read request register 1 29 Synchronize Wrap around Mode codes - Table Sub-address legalization in Receive Mode S/A#2: Sampling time setting for analogue telemetries This is the sampling rate for analogue channels acquisition which can be programmed. The default value per telemetry is assumed to be 240us (200us of settling time and 40us for ADC conversion), which is the minimum sampling time to ensure the required accuracy.[r G1] S/A #2 Sampling time setting for telemetries acquisition 1 Word#0 Bits 0..5: Not used. Set to 0 Bits 6..15: Sampling time setting (per analogue telemetry) (default) b = 240us for each TM b = 241us for each TM b = 242us for each TM b = 1263us for each TM Table S/A#2 Analogue Tm Sample Time Settling

14 S5P.IRD.ASU.SC Page 14 of 106 This time can be programmed through a 10 bits counter, with a minimum time of 240us and a maximum of 1263us per analogue channel. The accuracy given for telemetries is not dependant on the time values; therefore a higher settling time will not achieve a better accuracy. It should be noted than the higher the sampling time per channel is set, the higher the total time required for one acquisition list. Sampling time for analogue telemetries can only be modified while the PCDU is not acquiring one parameter list. If the PCDU receives this 1553 command while performing an acquisition, the new sampling time command will be rejected S/A#3: Write register S/A #3 Write registers 2 Word #0 Bit 0..15: Identification address for the register Word #1 Bit 0..15: Content of the 16 bits register to be written Table S/A #3 Write register Definition Through this command several registers can be written in the FPGA (Table 3.2-6) and they can be classified into 5 groups: List Pointers Its function is to access addresses in both memories (EEPROM and SRAM). The size and the addresses of the lists inside the memories are fixed. PCDU offers the possibility to configure two 16-bit pointers for managing the write and read operations in the EEPROM and the SRAM (one dedicated to the SRAM, SRAM_POINTER and one for the EEPROM, EEPROM_POINTER). Next table shows the SRAM and EEPROM memory mapping:

15 S5P.IRD.ASU.SC Page 15 of 106 Pointer Parameter Buffer Acquisition Buffer List Number Address (EEPROM) (SRAM) 0x0000 Parameter 1 (*) Acquisition 1 (*) 0x0001 Parameter 2 Acquisition 2 0x0002 LIST 1 Parameter 3 Acquisition 3,,,,,,,,, 0x00FF Parameter 256 Acquisition 256 0x0100 Parameter 1 (*) Acquisition 1 (*) 0x0101 Parameter 2 Acquisition 2 0x0102 LIST 2 Parameter 3 Acquisition 3,,,,,,,,, 0x01FF Parameter 256 Acquisition 256 0x0200 Parameter 1 (*) Acquisition 1 (*) 0x0201 Parameter 2 Acquisition 2 0x0202 LIST 3 Parameter 3 Acquisition 3,,,,,,,,, 0x02FF Parameter 256 Acquisition 256 0x0300 Parameter 1 (*) Acquisition 1 (*) 0x0301 Parameter 2 Acquisition 2 0x0302 LIST 4 Parameter 3 Acquisition 3,,,,,,,,, 0x03FF Parameter 256 Acquisition 256 0x0400 Parameter 1 (*) Acquisition 1 (*) 0x0401 Parameter 2 Acquisition 2 0x0402 LIST 5 Parameter 3 Acquisition 3,,,,,,,,, 0x04FF Parameter 256 Acquisition 256 0x0500 Parameter 1 (*) Acquisition 1 (*) 0x0501 Parameter 2 Acquisition 2 0x0502 LIST 6 Parameter 3 Acquisition 3,,,,,,,,, 0x05FF Parameter 256 Acquisition 256 0x0600 Parameter 1 (*) Acquisition 1 (*) 0x0601 Parameter 2 Acquisition 2 0x0602 LIST 7 Parameter 3 Acquisition 3,,,,,,,,, 0x06FF Parameter 256 Acquisition 256 0x0700 Parameter 1 (*) Acquisition 1 (*) 0x0701 Parameter 2 Acquisition 2 0x0702 Parameter 3 Acquisition 3,,,,,,,,, 0x07E0 Acquisition 225 Parameter 225 LIST 8 Data Wrap 0 0x07E1 Parameter 226 Acquisition 226 Data Wrap 1,,,,,,,,, 0x07FF Parameter 256 Acquisition 256 Data Wrap 31 (*) Parameter 1 and Acquisition 1 must be the Acquisition counter for each List Table Memory mapping

16 S5P.IRD.ASU.SC Page 16 of Flag register In this 16-bit register there are two kinds of flags: A flag (one bit per parameter list) indicates when the FPGA has tried to write outside the list (after the end of the list). These flags are named ERROR_FLAG_LIST1 up to LIST8. Each flag is set to 1 when the FPGA tries to write outside the list and it will remain at high level until these flags are reset. A flag which indicates the end of the acquisition of a list (END_ACQ_FLAG register). This flag is reset (to 0 ) when the acquisition starts and is set again to 1 when it ends. This flag is common for all lists, and it can not be externally reset. These flags can be reset by OBC writing 0000 h in this register address EEPROM Enable/Disable Register In order to protect the writing in the EEPROM, the capability of enabling or disabling the writing in the EEPROM is to be provided. OBC must send a received command to this register (named EEPROM_EN_DIS register) and enable or disable the access to the EEPROM. By default, after FPGA power-up, the access to the EEPROM is disabled. To enable EEPROM writing is required to write 0001 h in this register. Writing 0000 h disables EEPROM. This register can also be read to know the EEPROM status Acquisition register OBC can launch list acquisition using this internal FPGA register, named ACQUIRE_LIST register (possible register content is shown in Table 3.2-5). OBC must send a received command to this register and write the address of the list to be acquired. List Number List 1 List 2 List 3 List 4 List 5 List 6 List 7 List 8 Base Address h'0000 h'0100 h'0200 h'0300 h'0400 h'0500 h'0600 h'0700 Table Acquisition register If this register is modified while other acquisition is in progress, the new acquisition command will be ignored.

17 S5P.IRD.ASU.SC Page 17 of Counters Counters for each acquisition list Each acquisition lists contains a 16-bit counter (internal FPGA register), so there are a total amount of 8 counters (ACQ_COUNTER_LIST1 up to LIST8). These counters are managed in the same way as the rest of parameters, through an identifier Acquisition counter parameter should be placed in first place on each parameter list. Since the Acquisition Counters are not stored in the FPGA but in the SRAM, it is necessary to know in which address these counters are stored to be able to reset their values. The Acquisition Counter registers point to the address where the acquisition counters are stored. When PCDU is acquiring a list, the acquisition counter will be read from SRAM, incremented by one and stored again in then first position of the list. These counters can be reset by OBC writing 0000 h in the associated register. Counters for error detected in EDAC One 16-bit register is used for the counters of detected errors in EDAC. The structure of the register is as follows: SINGLE_ERROR_EEPROM_COUNTER: 4-bits counter for single errors detected in EEPROM (which are automatically corrected) DOUBLE_ERROR_EEPROM_COUNTER:4-bits counter for double errors detected in EEPROM SINGLE_ERROR_SRAM_COUNTER: 4-bits counter for single errors detected in SRAM (which are automatically corrected) DOUBLE_ERROR_SRAM_COUNTER: 4-bits counter for double errors detected in SRAM The register containing the counters can be sent inside the acquisition buffer and they are managed through a specific parameter. OBC should take care that errors detected in these counters only affects to the previous data words written to or read from the buffer. Therefore as a recommendation OBC should write the EDAC counters parameter at the end of the parameter buffer, in order to detect all the errors of a list. These counters can be reset by OBC writing 0000 h in this register.

18 S5P.IRD.ASU.SC Page 18 of 106 REGISTER ADDRESS BIT POSITION REGISTER NAME DESCRIPTION h2000 h2001 h2002 h2003 h2004 h Not used. Set to EEPROM_POINTER 0..4 Not used. Set to SRAM_POINTER 0..3 DOUBLE_ERROR_EEPROM_COUNTER 4..7 SINGLE_ERROR_EEPROM_COUNTER Value for EEPROM write/read pointer. From h'000' to h'7ff' Value for SRAM write/read pointer. From h'000' to h'7ff' EDAC counter for double errors in EEPROM EDAC counter for single errors in EEPROM DOUBLE_ERROR_SRAM_COUNTER EDAC counter for double errors in SRAM SINGLE_ERROR_SRAM_COUNTER EDAC counter for single errors in SRAM 0..6 Not used. Set to END_ACQ_FLAG ERROR_FLAG_LIST8 ERROR_FLAG_LIST7 ERROR_FLAG_LIST6 ERROR_FLAG_LIST5 ERROR_FLAG_LIST4 ERROR_FLAG_LIST3 ERROR_FLAG_LIST2 ERROR_FLAG_LIST1 End of acquisition Flag. '0' - Acquisition in process '1' - Acquisition finished Paramater List 8 Error Flag. '0' - No error '1' -Error (Writing outside the list) Paramater List 7 Error Flag. '0' - No error '1' -Error (Writing outside the list) Paramater List 6 Error Flag. '0' - No error '1' -Error (Writing outside the list) Paramater List 5 Error Flag. '0' - No error '1' -Error (Writing outside the list) Paramater List 4 Error Flag. '0' - No error '1' -Error (Writing outside the list) Paramater List 3 Error Flag. '0' - No error '1' -Error (Writing outside the list) Paramater List 2 Error Flag. '0' - No error '1' -Error (Writing outside the list) Paramater List 1 Error Flag. '0' - No error '1' -Error (Writing outside the list) Not used. Set to 0 15 EEPROM_EN_DIS Enable/Disable EEEPROM Writting capability '1' - Enable '0' - Disable 0..4 Not used. Set to ACQUIRE_LIST Value of the parameter list to be acquired h ACQ_COUNTER_LIST1 Acquisition Counter for List 1 h ACQ_COUNTER_LIST2 Acquisition Counter for List 2 h3a ACQ_COUNTER_LIST3 Acquisition Counter for List 3 h3b ACQ_COUNTER_LIST4 Acquisition Counter for List 4 h3c ACQ_COUNTER_LIST5 Acquisition Counter for List 5 h3d ACQ_COUNTER_LIST6 Acquisition Counter for List 6 h3e ACQ_COUNTER_LIST7 Acquisition Counter for List 7 h3f ACQ_COUNTER_LIST8 Acquisition Counter for List 8 Table Write/Read Internal Register

19 Page 19 of S/A#5: Write Buffer Parameter List (EEPROM) In the PCDU it shall be possible to create 8 parameter lists on each DHS interface, with up to a maximum of 256 parameters ( & ) per list. S/A #5 Write buffer Parameter List (EEPROM) N (1..32) Word #0 Bit 0..15: Code of the first acquisition parameter Word #1 Bit 0..15: Code of the second acquisition parameter Word #2 Bit 0..15: Code of the third acquisition parameter Word #N-1 Bit 0..15: Code of the N acquisition parameter The procedure to create a parameter list is as follows: Firstly, a received command to S/A#3 (Write EEPROM_EN_DIS register) to enable the writing of a parameter list in the EEPROM, if it is not previously enabled. Next, a received command to S/A#3 (Write EEPROM_POINTER register) shall be sent to set the list pointer associated to the first address of the Parameter Buffer to be written in the EEPROM. The write operation will be done from the first address to the last one of the list. Finally, a received command to this subaddress (Write Buffer Parameter List), with a maximum of 32 data words per MILBUS command. The parameters to be written are shown in & ) and their meanings, in Table 5.6-5). The last word of the list to be sent by OBC must be End of List identifier ( FFFF h). The content of the data words are parameters, which identifies an analogue telemetry or a set of digital statuses. Each parameter list has a maximum allocation capability of 256 parameters, but as it is required to include one End of List identifier one each created list, the real number of maximum parameters (telemetry identifiers) per list is S/A#7: Write Buffer Acquisition (in SRAM) S/A #7 Write Buffer Acquisition (SRAM) N (1..32) Word #0 Bit 0..15: First data word to be written Word #1 Bit 0..15: Second data word to be written Word #2

20 Page 20 of 106 Bit 0..15: Third data word to be written Word #N-1 Bit 0..15: N data word to be written The functionality of the Acquisition Buffer is to read the results of an acquisition list, and not to write on it. In a nominal operation the acquisition buffer should not be written. This functionality is only provided to allow fully write/read access to any PCDU memory and for EDAC testing. The procedure for writing in the acquisition buffer is identical to the creation of a parameter list: First, a received command to S/A#3 (Write SRAM_POINTER register) shall be sent to set in the list pointer associated to the Acquisition Buffer one address for the SRAM memory (SRAM_POINTER register). It is needed to send a received command to this sub-address (Write Buffer Acquisition List), with a maximum of 32 data words per MILBUS command. For each data written in the list, the list pointer is automatically incremented; therefore next commands to this sub-address will continue the writing of the list. The maximum number of data is limited by the size of the list. When the end of one list is reached and OBC is trying to write more data words, these additional data will not be written as they will be ignored by FPGA.

21 Page 21 of S/A#8: LCL ON/OFF Command S/A #8 LCL on/off command 1 Word#0 Bits 0..3: Selection of LCL Module 0001 b = L1 Module 0010 b = L2 Module 0100 b = L3 Module 1000 b = L4 Module Bits 4..6: Not used. Set to 0 Bits 7..11: Selection of LCL inside a Module. 10 h = LCL#1 01 h = LCL#2 If a commanded module is not mounted inside PCDU (or one LCL within a mounted module) equipment, the command will be executed but without any effect within PCDU, as associated electronics is not mounted 02 h = LCL#3 13 h = LCL#4 04 h = LCL#5 15 h = LCL#6 16 h = LCL#7 07 h = LCL#8 08 h = LCL#9 19 h = LCL#10 1A h = LCL#11 0B h = LCL#12 1C h = LCL#13 0D h = LCL#14 0E h = LCL#15 1F h = LCL#16 Bits : Not used. Set to 0 Bits : Type of command. 01 b = off 10 b = on The coding of the only data word for the ON/OFF command for the LCL boards is as follows:

22 Page 22 of 106 One field is used to select the LCL board (PCDU has a capability to allocate 4 LCL modules) A second field to select one of the 16 LCLs inside the selected module. This 8-bit field is divided in three groups: o The first 3-bits are set to 0 o The fourth bit is a parity bit (odd parity). The parity is computed with the 16 bits of the data word. o The last four bits are used to decode the LCL within the module A last field to select between ON or OFF command. The LCL control is managed through a switching topology, so the output status and the command status will be automatically checked by FPGA before a command is executed. An ON command is accepted only when the LCL is switched-off or latched. An OFF command is only accepted when the LCL is switched-on. The execution of the command will take 200us as maximum. For external monitoring, the LCL command status will change within the previous range but the output status could change slower, depending on the external load (mainly when LCL switches from ON to OFF) S/A#9: Heater group LCL ON/OFF Command S/A #9 Heater group LCL on/off command 1 Word#0 Bits 0..3: Selection of HTR Module 0001 b = H1 Module 0010 b = H2 Module 0100 b = H3 Module 1000 b = H4 Module Bits 4..6: Not used. Set to 0 If a commanded LCL is not mounted inside PCDU equipment (or one Hx Module is not mounted), the command will be executed but without any effect. Bits 7..11: Selection of heater group LCL inside a Module. 10 h = LCL#1 of heater group 01 h = LCL#2 of heater group 02 h = LCL#3 of heater group 13 h = LCL#4 of heater group 04 h = LCL#5 of heater group 15 h = LCL#6 of heater group Bits : Not used. Set to 0 Bits : Type of command. 01 b = off 10 b = on

23 Page 23 of 106 The coding of the only data word for the ON/OFF command for the LCL inside the Heater modules is as follows: One field is used to select the HTR board (PCDU has a capability to allocate 4 HTR modules) A second field to select one of the 6 LCLs of heater groups inside the selected module. This 8-bit field is divided in three groups: o The first 3-bits are set to 0 o The fourth bit is a parity bit (odd parity). The parity is computed with the 16 bits of the data word. o The last four bits are used to decode the LCL within the module A last field to select between ON or OFF command. The LCL control is managed through a switching topology, so the output status and the command status will be checked automatically by FPGA before a command is executed. An ON command is accepted only when the LCL is switched-off or latched. An OFF command is only accepted when the LCL is switched-on. The same timing constraints as explained in are applicable S/A#10: Heater ON/OFF Command S/A #10 Heater on/off command 1 Word#0 Bits 0..3: Selection of HTR Module 0001 b = H1 Module 0010 b = H2 Module 0100 b = H3 Module 1000 b = H4 Module If a commanded HTR is not mounted inside PCDU equipment (or one Hx module), the command will be executed but without any effect. Bit 4: Not used. Set to 0. Bits 5..7: Selection of heater group inside a Module. 0 h = heater group 1 1 h = heater group 2 2 h = heater group 3 3 h = heater group 4 4 h = heater group 5 5 h = heater group 6 Bit 8: Not used. Set to 0. Bits 9..11: Selection of heater inside a group. 0 h = heater 1 1 h = heater 2

24 Page 24 of h = heater 3 3 h = heater 4 4 h = heater 5 (groups 1,2,3 only) 5 h = heater 6 (groups 1,2,3 only) 6 h = heater 7 (groups 1,2,3 only) 7 h = heater 8 (groups 1,2,3 only) Bits : Not used. Set to 0 Bits : Type of command. 01 b = off 10 b = on The codification of the only data word for the ON/OFF command for the heaters inside the HTR modules is as follows: One field is used to select the HTR board (PCDU has a capability to allocate 4 HTR modules) A second field to select one of the 6 heater groups (3 groups of 8 heaters and 3 groups of 4 heaters) inside the selected module. A third field to select one heater in the selected group. A last field to select between ON or OFF command. The HTR control is managed through a switching topology, so the output status and the command status will be automatically checked by FPGA before a command is executed. An ON command is accepted only when the HTR is switched-off. An OFF command is only accepted when the HTR is switched-on. The execution of the heater command will take less than 20us. For external monitoring, the heater command status will change within the previous time range but the output status could change slower, depending on the external load (mainly when heater switches from ON to OFF) S/A#11: LCL ON/OFF Command in DEP/PYRO Modules The codification of the only data word for the ON/OFF command for the LCLs inside the DEP modules is as follows: One field is used to select the DEP/PYRO board (PCDU has a capability to allocate 2 DEP/PYRO modules) A second field to select one of the 4 LCLs (3 LCLs for heater groups and another LCL spare) inside the selected module. This 8-bit field is divided in three groups: o The first 3-bits are set to 0 o The fourth bit is a parity bit (odd parity). The parity is computed with the 16 bits of the data word. o The last four bits are used to decode the LCL within the module

25 Page 25 of 106 A second field to select one of the 4 LCLs (3 LCLs for heater groups and another LCL spare) inside the selected module. A last field to select between ON or OFF command. The LCL control is managed through a switching topology, so the output status and the command status will be automatically checked by FPGA before a command is executed. An ON command is accepted only when the LCL is switched-off or latched. An OFF command is only accepted when the LCL is switched-on. S/A #11 LCL on/off command in DEP Modules 1 Word#0 Bits 0..3: Selection of DEP/PYRO Module 0001 b = DEP1 Module 0010 b = DEP2 Module Bits 4..6: Not used. Set to 0. Bits 7..11: Selection of heater group LCL inside a Module. If a commanded LCL is not mounted inside PCDU equipment, the command will be executed but without any effect. 10 h = LCL#1 of heater group 01 h = LCL#2 of heater group 02 h = LCL#3 of heater group 13 h = LCL#4 spare Bits : Not used. Set to 0 Bits : Type of command. 01 b = off 10 b = on The same time constraints explained for LCLs are also applicable S/A#12: Heater ON/OFF Command in DEP/PYRO Modules The codification of the only data word for the ON/OFF command for the heaters inside the DEP modules is as follows: One field is used to select the DEP board (PCDU has a capability to allocate 2 DEP/PYRO modules) A second field to select one of the 3 heater groups (2 groups of 8 heaters and 1 group of 4 heaters) inside the selected module. A third field to select one heater in the selected group. A last field to select between ON or OFF command. The HTR control is managed through a switching topology, so the output status and the command status will be checked automatically by FPGA before a command is executed. An ON command is accepted only when the HTR is switched-off. An OFF command is only accepted when the HTR is switched-on.

26 Page 26 of 106 S/A #12 Heater on/off command in DEP Modules 1 Word#0 Bits 0..3: Selection of DEP/PYRO Module 0001 b = DEP1 Module 0010 b = DEP2 Module Bits 4..5: Not used. Set to 0. Bits 6..7: Selection of heater group LCL inside a Module. If a commanded HTR is not mounted inside PCDU equipment, the command will be executed but without any effect. 0 h = heater group 1 (8 heaters) 1 h = heater group 2 (8 heaters) 2 h = heater group 3 (4 heaters) Bit 8: Not used. Set to 0. Bits 9..11: Selection of heater inside a group. 0 h = heater 1 1 h = heater 2 2 h = heater 3 3 h = heater 4 4 h = heater 5 (groups 1,2 only) 5 h = heater 6 (groups 1,2 only) 6 h = heater 7 (groups 1,2 only) 7 h = heater 8 (groups 1,2 only) Bits : Not used. Set to 0 Bits : Type of command. 01 b = off 10 b = on The same time constraints explained before for Heaters are also applicable.

27 Page 27 of S/A#13: DEP/PYRO Modules Arm/Disarm command This sub-address controls the arming relay for DEP/PYRO modules. S/A #13 DEP Modules Arm/Disarm command 1 Word#0 Bits 0..3: Selection of DEP/PYRO Module 0001 b = DEP1 Module 0010 b = DEP2 Module Bits 4..13: Not used. Set to 0 Bits :Arm/Disarm command. 01 b = Arming 10 b = Disarming The codification of the only data word for the relays arm/disarm is: One field is used to select the DEP board (PCDU has a capability to allocate 2 DEP/PYRO modules) A second field to select the arming (contact close) or disarming (contact open) of the relay. At hardware level, the arming relay is latching type. OBC must send a received command to this subaddress to arm or disarm the chain. The time required to arm this relay is 50 ms, so, any other received command to SA13R, SA14R, SA15R and SA17R (the same FPGA functional block) will be ignored by FPGA during this time. In addition, if the OBC desires to acquire the regarding status, it must wait until the FPGA finishes the arming task (50 ms) just to assure that the relay is well-armed After a successful firing of a deployment element the arming relay will not be disarmed, this action should be done by means another MILBUS disarm command. In addition if an error is detected during the firing sequence the deployment chain will also remain armed. Therefore in nominal operation it will be necessary the disarming command after a deployment sequence (successful or not), if required by OBC S/A#14: DEP/PYRO Modules Selection command This sub-address controls the selection relays for DEP/PYRO modules. S/A #14 DEP Module Selection command 1 Word#0 Bits 0..3: Selection of DEP/PYRO Module 0001 b = DEP1 Module 0010 b = DEP2 Module Bits 4..9: Not used. Set to 0 Bits : Selection of DEP device 0000 b =Relay#1 selection If a selection relay which is not mounted in commanded, the command will be executed but without any effect, as associated electronics is not mounted 0001 b =Relay#2 selection 0010 b =Relay#3 selection

28 Page 28 of b =Relay#15 selection 1111 b =Relay#16 selection Bits : sel/desel relay 01 b = relay selection 10 b = relay deselection 11 b = entire deselection The codification of the only data word for the selection relays is: One field is used to select the DEP board (PCDU has a capability to allocate 2 DEP/PYRO modules) A second field to select one of the 16 selection relays. A third field to specify which action is going to be performed: selection, de-selection or entire de-selection (in this last case, the second field should also be 0000 b). At hardware level selection relays are latching type. OBC must send a received command to this subaddress to select or deselect any of these relays. The time required to select or deselect one relay is 101 ms so any other received commands to SA13R, SA14R, SA15R and SA17R (the same FPGA functional block) will be ignored by FPGA during this time. In addition, if the OBC desires to acquire the regarding status, it must wait until the FPGA finishes the selection/de-selection task (101 ms) just to assure that the relay is well-selected or -deselected. Any selection relay can be selected or unselected in an individual way, so that more than one relay could be selected at the same time. Therefore it is a matter of the OBC to assure that only one relay has been selected before a firing execution. The time required for an entire de-selection is 16 x 100 ms = 1,6s, so any other commands to SA13R, SA14R, SA15R and SA17R will be ignored by FPGA during this time. In addition, if the OBC desires to acquire the regarding status, it must wait until the FPGA finishes the entire de-selection task (1,6 s) just to assure that the relays are well-deselected S/A#15: Reset status firing When a pyro device has been fired, a peak current detection status (named Fire status) is activated. There is one status per DEP module. Due to the short pyro firing duration, the current status has been latched, to allow a rear reading via MILBUS after the firing of one deployment device. As the status is latched, it is required other 1553 command to reset this status for the next firing sequence. S/A #15 Reset Status Firing 1 Word#0 Bits 0..3: Selection of DEP/PYRO Module 0001 b = DEP1 Module

29 Page 29 of b = DEP2 Module Bits 4..13: Not used. Set to 0..0 b Bits : Reset status. 11 b = Reset Fire status The structure of the command is: One field is used to select the DEP/PYRO board (there is one firing status per DEP/PYRO module) A second field is a fixed code. At hardware level this 1553 command set at high level an internal signal, which is in charge of the status circuit reset. The time required for the internal command execution is 1ms, so any other commands to SA13R, SA14R, SA15R and SA17R will be ignored by FPGA during this time S/A#17: DEP/PYRO Modules Firing command This sub-address allows the firing and limit current selection of a deployment element. S/A #17 DEP Modules Firing command 1 Word#0 Bits 0..1: Selection of DEP Module 01 b = DEP1 Module 10 b = DEP2 Module 11 b = Simultaneous Firing in both DEP1 & DEP2 Modules Bit 2: Not used. Set to 0. Bits 3..4: Selection of deployment device (for mixed mode operation) 01 b = TK deployment (2A limitation) 10 b = PYRO deployment (6A limitation) Bits 5..15: Firing duration for DEP deployments 000 h = invalid data 001 h = 1 second 002 h = 2 seconds... 0FF h = 255 seconds

30 Page 30 of 106 7FF h = 2047 seconds (maximum value) The structure of the command is: The first field belongs to the operation mode: single board firing in DEP1 module (01 b), single board firing in DEP2 module (10 b) and simultaneous firing (11 b) The second field is the kind of element to be fired. This field is only required in the case PCDU FPGA is configured in mixed mode. If FPGA is configured in PYRO or TK mode this field shoul be set to 00. When operating in mixed mode this 2-bit field must be set to: o 01 Thermal Knife: the current limit is set to 2A at hardware level and the time duration is programmed by the third field. o 10 Pyro: the current limit is set to 5A at hardware level and the time duration is fixed to 42 ms. The third field is the firing time when a TK device is selected. The minimum time is 1 s (h 001) and the maximum time is 2047 s (h 7FF). The hex. code h 000 is considered to be invalid data. PCDU can operate in three different modes, configurable at hardware level by means of jumpers: 1) Only thermal knives: The limitation current is set to 2A while the firing time is programmable via S/A#17R. If the programmed time is 000 h the firing pulse will not be executed as it is an invalid value. 2) Only pyro devices: The limitation current is set to 6A and the firing pulse duration is fixed to 42 ms. 3) Mixed mode The selection of the next deployment to be fired is set inside the data word of S/A#17R. Besides, there are two different ways of performing a firing sequence, single firing of one deployment or a simultaneous firing of two different deployments located in Nominal and Redundant modules (DEP1 and DEP2). In accordance with S/A17R data word codification, the simultaneous firing will generate the firing pulse in both DEP1 and DEP2 modules, with the duration programmed. Therefore both deployments must be identical, either pyros or thermal knives, although they can be in different positions inside each module. In addition both firing pulses are generated in parallel with the same duration (42ms for pyros and the programmed value for thermal knives).

31 Page 31 of 106 PCDU implements the additional launch strap protection. When launch strap is connected this subaddress 17R is illegal, to avoid an undesired deployment. When launch strap is disconnected subaddress 17R becomes legal. During the firing pulse sequence (50ms for pyro devices and the programmed time for thermal knives) any other commands to SA13R, SA14R, SA15R and SA17R (same FPGA function) will be ignored by FPGA. Monitoring for the firing sequence will depend on the deployment device to be fired: In the case of a pyro device the only way to check the firing sequence was successful is the read out of the Fire status (current peak status), to assure the firing current was above 5A. In the case of thermal knife the firing status will never be activated, as the nominal current is much lower. The OBC can monitor the DCDC converter output voltage status and the input current analogue telemetry of the DCDC. Status of the current limitation circuitry, and the statuses of the firing LCL are used for FPGA control. FPGA does not perform any checking before executing the firing pulse. Therefore the OBC must assure that the DEP module to be fired has been armed and that only one relay has been selected.

32 Page 32 of S/A#20: Programmable Battery EOC Voltage level For safety reasons the setting of a new EOC level for the battery must be performed in a two-steps sequence. The first step is the programming command (SA#20R), which load a new value to be programmed in the FPGA, but the new level is not set at hardware level. The reason of this first step is to provide the capability of reading via MILBUS the programmed value, before the execution. The second step is a second MILBUS command (S/A#23R) which allows loading the new value at hardware level. There is no specific timing constraint between these two steps, only the timing constraints specified by the MILBUS protocol S/A #20 Programmable Battery EOC Voltage Level 1 Word#0 Bits 0..10: Not used. Set to 000 h EOC Values 1 to 16 are defined in RD5 Bits : Battery EOC voltage level stored in FPGA power b = EOC Value1 (Default value after recovery) b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = EOC Value b = Invalid Value (Default value stored inside the FPGA)

33 Page 33 of 106 The codification of the only data word is very simple, a four bits code will program a different value of EOC voltage (see table). There is an invalid code (which is the default value for the FPGA, after powerup), this code is a safety code, to avoid that no value would be charged at hardware level without receiving a previous valid EOC programming command to this sub-address. The safety command can be programmed at any time if it would be necessary or recommended at system level. The EOC value stored inside the FPGA can be read at any moment by means the parameter identifier h S/A#21: Programmable Battery Charge current level For safety reasons the setting of a new charge current level for the battery must be performed in a twosteps sequence. The first step is the programming command (SA#21R), which load a new value to be programmed in the FPGA, but the new level is not set at hardware level. The reason of this first step is to provide the capability of reading via MILBUS the programmed value, before the execution. The second step is a second MILBUS command (S/A#23R) which allows loading the new value at hardware level. There is no specific timing constraint between these two steps, only the timing constraints specified by the MILBUS protocol S/A #21 Programmable Battery Charge Current Level 1 Word#0 Bits 0..10: Not used. Set to 000 h ICH Values 1 to 8 are defined in RD5 Bits : Battery charge current level stored in FPGA power b = ICH Value 1 (Default value after recovery) b = Not used b = Not used b = Not used b = Not used b = Not used b = Not used b = Not used b = Not used b = ICH Value 2

34 Page 34 of b = ICH Value b = ICH Value b = ICH Value b = ICH Value b = ICH Value b = ICH Value b = Invalid value (Default value stored inside the FPGA) The codification of the only data word is very simple, a four bits code will program a different value of charge current (see table). There is an invalid code (which is the default value for the FPGA, after powerup), this code is a safety code, to avoid that no value would be charged at hardware level without receiving a previous valid charge current programming command to this sub-address. The safety command can be programmed at any time if it would be necessary or recommended at system level. The ICH value stored inside the FPGA can be read at any moment by means the parameter identifier h S/A#23: Battery level setting A command to this sub-address allows the load at hardware level of the new value stored in the FPGA, as explained in previous chapters. This command is the second step for a new EoC or Icharge level setting. S/A #23 Battery Level Setting 1 Word#0 Bits 0..12: Not used. Set to 0000 h Bits : Battery Level Setting 001 b = EOCV Setting 010 b = Charge Current Setting 100 b = Not used in AS250 If the value stored in the FPGA is an invalid one (default value), the command will not be executed and no error will be reported. The only configurable field (bits13..15) in the data word is which level is set at hardware level: EOC (001 b) or ICH (010 b). The EOC or ICH values stored inside the FPGA can be read at any moment by means the parameter identifier h8066, but the real value stored at hardware level is provided through parameter identifiers h8058 (EOC and ICH values for the first branch of the majority voting), h805a (for the second majority

35 Page 35 of 106 voting branch) and h805c (for the third branch). Within those three identifiers there are additional statuses (feedback of the data bus on each majority voting branch) which are only used by the FPGA during the command execution to avoid a failure propagation in the DHS interface majority voting stage. The real values can be read through a 4-bit status (16 different values is the maximum capability in PCDU for EOC and ICH), but the value stored in the FPGA is read through a 5-bit status, this additional bit is the enable/disable bit, which can allow or not the FPGA value loading at hardware level. This command execution takes less than 20us; therefore there is not any time constraint at MILBUS level S/A#24: Battery relay command This command is used to close the battery relays. S/A #24 Battery Relay ON command 1 Word#0 Bits 0 11: Not used. Set to 000 h Bits : Selection of relay to be closed 0001 b =Relay#1 selection 0010 b =Relay#2 selection 0100 b =Relay#3 selection 1000 b =Relay#4 selection OBC must send a received command to this subaddres to close the Battery relay. The FPGA will last 600 ms to perform task. This means that any other received command to this sub-address or another subaddres of the same FPGA functional block (SA20R, SA21R, and SA23R) will be ignored. In addition, if OBC wants to acquire the regarding status, it must wait until the FPGA finishes the relay closure, just to assure that the regarding status is settled S/A#25: Reset Central Switch-off status This command is used to reset the FPGA internal SOL status. When a SOL is detected, this status is latched internally in the FPGA. To detect a new one, it is mandatory to reset this status. S/A #25 Reset SOL Status 1 Word#0 Bits 0..1: Not used. Set to 0. Bits 2..3: Reset SOL status 11 b = Reset SOL_OUT status Bits 4..15: Not used. Set to 000 h

36 Page 36 of 106 When a SOL command is received by PCDU, FPGA generates a pulsed command in the SOL line in order to switch-off a set of LCLs (programmable at hardware level). To be sure the pulsed command has been generated by the FPGA; PCDU provides a digital status of this output line. As the SOL pulse duration is too short to be read in real time through MILBUS, FPGA latches this status. In this way OBC can read this status at any time, however it is required a high-level command in order to reset it. This additional MILBUS command (Reset SOL status) will be executed setting bits 2-3 at 11, while the rest of data word bits must be set at 0. There is not any time constraint at MILBUS level. The effect of the command can be monitored just after the reception of the reset SOL status command S/A#28: Read request for register This command is used to fix the address of the register to be read later, through a next transmitted command to sub-address (see Table 3-6). S/A #28 Read request for register 1 Word #0 Bit 0..15: Identification address for the register When a received command to Sub-address 28 (Read request register) has a non-declared register address, the data word associated to the consecutive transmitted command to Sub-address 28 (Read register) will be h FFFF S/A#29: Synchronize S/A #29 Synchronize with Data Word N (1 32) This S/A will be legalised, but FPGA will reject any incoming command This Sub-address is legalised in AS250, any command to this sub-address will be ignored. The FPGA will not do any action in response S/A#30: Data wrap around test This command is required by MIL-1553 standard. The functionality of this command is to write 32 data words in one page of the SRAM memory, placed in the last SRAM memory positions (at the end of the acquisition list 8). The address of the indexed page is fixed. S/A #30 Data wrap around test 32 Word#0: Wrap around data#0 (16 bits data).. Data to be stored in SRAM