Earth's Moon: Software-in-the-Loop

Our software-in-the-loop lab now runs end to end. In software in the loop, real flight software runs on the ground against a simulated spacecraft and space link. The lab tests the flight software for our planned orbiter together with a ground system and the Semaphore digital twin. Its latest run took three images on a pass over Tranquility Base.

What the run showed

The flight software is the stack our orbiter uses. It is NASA’s Core Flight System (cFS), with our own camera application. The ground turned a plan of three images into a timed command sequence and sent it up. cFS loaded the sequence and ran each capture at its planned time, with no failed commands. (NASA on GitHub)

cFS then sent each image home with the File Delivery Protocol (CFDP), a standard of the Consultative Committee for Space Data Systems (CCSDS). We use its acknowledged class, which resends lost data. Each image reached the ground about 10 seconds after capture. The link holds every message for the 1.2 seconds light takes between Earth and the Moon, so each acknowledgment waits as in flight. The ground also set the flight clock, and cFS reported it valid. (CCSDS on files)

The twin was tested from both sides. The ground published the orbiter’s predicted path to it as CCSDS Orbit Ephemeris Messages, through the same software interfaces other operators use. The twin’s console then showed the orbiter on that path at the simulated time of the pass. In our checks, the twin placed the orbiter within a millimeter of where our own software put it. In the other direction, the twin served the Sun’s position and the NASA photo that the lab’s camera simulator used for each image. (CCSDS on orbits; NASA PDS)

The lab runs the same way every time. One command runs a pass at any simulated time, so we can test a pass weeks before it happens. Our camera application, ground front end, and camera simulator each have requirements in the format of NASA’s cFS applications, with tests that check them. The flight software builds and runs in containers made from the ones NASA’s own automated tests use. (NASA’s file app requirements; NASA’s cFS tests)

The run at three times speed. On the left, the ground's operations console shows each image as it arrives. On the right, the twin's console follows the orbiter.

Why we build on flight heritage

On board, only the camera application is ours. The rest of the flight software is NASA’s, and the links between orbiter, ground, and twin follow open standards. That lowers our risk and shortens our schedule, so our time goes to the twin and the models it trains.

The flight software makes the case best. NASA’s Goddard Space Flight Center built cFS so missions could reuse flight software and save the cost and time of writing it again. A 2014 briefing from NASA’s Johnson Space Center calls cFS a technology readiness level (TRL) 9 framework. TRL 9 is the top of NASA’s scale, for technology proven in a successful mission. Johnson’s teams also found that the mature code cut the verification their projects needed. Today cFS has run more than 40 NASA missions. Its test framework produces records that support certification to Class A, NASA’s class for human spaceflight software. (NASA on cFS; NASA Johnson on cFS; NASA on TRL; NASA Goddard)

Much of that record is at the Moon. NASA’s Lunar Reconnaissance Orbiter (LRO) has run cFS in lunar orbit since 2009. NASA’s Ames Research Center built the flight software of the Lunar Atmosphere and Dust Environment Explorer on cFS, on budget and on schedule. Odysseus, the Intuitive Machines lander that reached the Moon’s surface, also ran cFS. NASA credits cFS with helping that team recover from a system reboot and fix problems with software updates during the mission. (NASA on LRO; NASA Johnson on cFS; NASA Goddard on Odysseus)

The standards matter too, because both ends of a link must agree. NASA’s interoperability standards require lunar systems to move files with CFDP, so our downlink already uses the protocol they name. The twin reads predicted paths as Orbit Ephemeris Messages, the CCSDS format that space agencies use to exchange orbit data. (NASA Johnson on standards; CCSDS on orbits)

The orbit and the light time come from ANISE, an open-source library for time, reference frames, and orbits. It was used throughout the operations of Firefly Aerospace’s Blue Ghost lander, from launch until its landing on the Moon. On that record, its developers rate it TRL 9. (Nyx Space)

What comes next

The lab grows with the orbiter. The stack that captured these images is the stack our orbiter runs. Flight hardware joins the loop next, under the same runs and checks. Starting in 2028, we plan to launch our own orbital and surface assets, and the twin takes in what they observe. Operators, analysts, and their software build on that same twin to make lunar operations safer and lunar development faster.