Time Assignment System and Its Performance aboard the Hitomi Satellite

Fast timing capability in X-ray observation of astrophysical objects is one of the key properties for the ASTRO-H (Hitomi) mission. Absolute timing accuracies of 350 micro second or 35 micro second are required to achieve nominal scientific goals or to study fast variabilities of specific sources. The satellite carries a GPS receiver to obtain accurate time information, which is distributed from the central onboard computer through the large and complex SpaceWire network. The details on the time system on the hardware and software design are described. In the distribution of the time information, the propagation delays and jitters affect the timing accuracy. Six other items identified within the timing system will also contribute to absolute time error. These error items have been measured and checked on ground to ensure the time error budgets meet the mission requirements. The overall timing performance in combination with hardware performance, software algorithm, and the orbital determination accuracies, etc, under nominal conditions satisfies the mission requirements of 35 micro second. This work demonstrates key points for space-use instruments in hardware and software designs and calibration measurements for fine timing accuracy on the order of microseconds for mid-sized satellites using the SpaceWire (IEEE1355) network.


Timing Capability for the Hitomi Satellite
The x-ray astronomy mission Hitomi was successfully launched in February 2016 as the sixth in a series of Japanese x-ray observatory satellites. 1 It was an international mission led by the Japan Aerospace Exploration Agency (JAXA) in collaboration with the USA, Canada, and European countries, aiming to observe astrophysical objects in the x-ray band from 0.5 to 600 keV. The satellite carried three x-ray telescopes [soft x-ray spectrometer (SXS), soft x-ray imager (SXI), and hard x-ray imager (HXI)] 2-4 and one soft gamma-ray detector (SGD). 5 One important scientific goal was to understand physical processes under the extreme environments of active and variable astrophysical objects, such as black holes, neutron stars, binary stars, and active galactic nuclei. The most important requirement for the mission was its spectroscopic capabilities, that is, the resolving power of photon energies in the soft energy band below 10 keV achieved by the microcalorimeter SXS 2 and wideband coverage by the HXI 4 and SGD. 5 However, fast timing capability is also a key performance requirement for understanding variable astrophysical objects in the x-ray band. According to typical time scales for variation in various x-ray sources, 6 an absolute timing accuracy of 350 μs covers most (but not all) of the scientific requirements for the Hitomi mission and is achievable with conventional methods, as demonstrated by the previous x-ray mission Suzaku. 7 Therefore, scientific requirements for the Hitomi timing system are defined as an absolute accuracy of 350 μs, a value that should be achieved even following a single-point on-orbit failure. However, much higher timing accuracies may be necessary for some phenomena, such as x-ray emissions from millisecond pulsars, fast oscillations in low-mass x-ray binaries, and so on. This is one reason that Hitomi carried an onboard GPS receiver (GPSR, described in detail in Sec. 2). Hitomi thus had the capability to achieve more accurate timing performance in nominal operations, and we defined best-effort goals as an absolute accuracy of 35 μs, which is an order of magnitude over requirements but may not be achieved following a single-point failure.
Timing requirements are not applied to all mission instruments. SXI is an accumulation-type detector CCD with typical exposures of 4.0 s in the nominal mode, so these requirements and goals (350 and 35 μs) are not valid. Similarly, the active shield detectors of SGD (hereinafter, SGD-SHIELD) are mainly used for anticoincidence measurements for the main camera of SGD and are also used to monitor the full sky in the hard x-ray band to measure light curves of transient astrophysical objects at resolutions of a few tens of microseconds. Note that requirements for the absolute timing accuracy of SGD-SHIELD are the same 350 μs to perform cross correlation with other fullsky monitoring instruments in space, but we do not apply the goal of 35 μs to SGD-SHIELD.
The rest of this paper is organized as follows. We summarize the system design for time assignments to mission data in hardware and software in Secs. 2 and 3, respectively. In Sec. 4, we list items that affect timing accuracy and their error budgets. Finally, we describe prelaunch characterization of the Hitomi timing system in Sec. 5 and summarize the timing performance in Sec. 6. 2 Hardware Design of the Timing System

Design Concept
Basic concepts for timing systems in Japanese x-ray astronomy satellites were established in The Advanced Satellite for Cosmology and Astrophysics (ASCA) 8 and Suzaku satellites. All payload instrument timings are synchronized to a single onboard clock, the clock values appear in the telemetry, and mission data times are assigned based on telemetry values in offline analyses on the ground. A monotonically increasing counter that tallies the single onboard clock is called the "time indicator" (TI). Since the data handling system onboard Hitomi is well designed to achieve reliable communications with ground stations, 1 we decided to apply the basic concept of the timing system to the onboard telemetry-and-command system. Hitomi has sufficient redundancy, so no timing-specific component is introduced except for the GPSR. To achieve 350-μs absolute timing accuracy even when the GPSR fails, the system can apply the same time assignment methods as Suzaku as a fallback, in which TI is calibrated by an on-ground atomic clock during communication between the spacecraft and the ground station.

Distribution of Onboard Timing Information
In the Hitomi timing system, the TI has a 38-bit length, covering time ranges from 15.625 ms (1∕64 s) to about 136 years (2 38 ∕64 s) in increments of 1∕64 s and is generated by a central onboard computer called the "Satellite Management Unit (SMU)," 9 which is normally synchronized with the International Atomic Time (TAI), provided by the GPSR. Figure 1 shows a schematic of the logical topology of communication lines, and TI is distributed from SMU to payload instruments (SXS-DE, HXI-DE, etc., in the figure) through these communication lines. Instruments receive TI from SMU every second, and the lower 32 bits of TI (hereinafter, L32TI) are latched and stored in a telemetry "space packet" to be sent to the data recorder. The time in TAI when the space packet was generated can be reconstructed from the L32TI value in the space packet in offline analysis. The left side of Fig. 2 shows a schematic view of timing synchronization from TAI to the Hitomi system.

Timing Accuracy of Synchronization between Onboard Instruments
Onboard telemetry and command communications between instruments are implemented by "SpaceWire," which is a standard network protocol based on IEEE 1355-1995. 10 The SpaceWire protocol itself defines only communication methodologies in the physical and data-link layers, so the Hitomi mission adopts the remote memory access protocol (RMAP) 11 as a session layer protocol. To guarantee quality-of-service of the data transfer, the Hitomi system adopts the SpaceWire-D protocol, 12 in which communication time is sliced into 1∕64-s intervals by the highest-priority code in SpaceWire, which is called the "TIME_CODE." 13 For its logical topology, the Hitomi SpaceWire network has a tree structure ( Fig. 1) with its root node linked via one or more SpaceWire Routers to payload instruments, such as HXI-DE and SGD-DE, which are called "user nodes." The root node in the Hitomi network is the SMU (see Sec. 2.1), which generates "TIME_CODE" with well-controlled timing. The zeroth TIME_CODE is always synchronized to time zero (values below the second are all zeros) of TAI. In other words, TIME_CODE is used for synchronization of all user nodes at an exact 64 Hz. As described in Sec. 2.2, SMU distributes TI information to all user nodes. The upper 32 bits of TI (covering above 1 s; hereinafter, U32TI) are distributed rather slowly (but within subsecond) from SMU to user nodes via the RMAP protocol, which is the same procedure as used in other telemetry-and-command transmission. In contrast, the finer part of TI covering <1 s (6 bits) is quickly broadcasted within the SpaceWire network using the same high-priority code as is used for SpaceWire-D, that is, the TIME_CODE, which carries 6-bit information. The Hitomi satellite carries a large number of SpaceWire nodes (up to 120) and has main-and-redundant network paths making the SpaceWire system large and complex. Therefore, an understanding of the propagation delay and jitter of the SpaceWire TIME_CODE is key to estimating the timing accuracy. As an example, the link rate of the Hitomi SpaceWire network at 50 or 20 MHz results in delay and jitter on the order of

Assignment of Photons at Fine Timing Resolutions
The arrival times of x-ray photons from astronomical objects are determined at user nodes connecting to x-ray sensors, such as SXS, HXI, and SGD. The time resolution of TI (15.625 ms, see Sec. 2.1) is insufficient for the timing goal of 35 μs (Sec. 1), although the timing accuracy of TI distribution is sufficient on the order of about 1 μs (see Sec. 2.3). Therefore, clocks with finer timing called "LOCAL_TIME" are installed into each user node to refine resolutions to 5, 61.0, 25.6, and 25:6 μs for SXS, SXI, HXI, and SGD, respectively, but with shorter time coverage than TI, as summarized in Table 1. These time resolution values are within the requirement for 350 μs accuracy for SXS, HXI, and SGD, and for a resolution of a few tens of milliseconds for SGD-SHIELD (see Sec. 1). The time resolution for SXS is also sufficient for the best-effort goal of 35-μs accuracy. The time resolutions of the HXI and the SGD (25.6 μs) may seem to be a comparably larger fraction of the timing goal (35 μs). However, according to numerical studies of realistic scientific cases for determining the coherent periods of periodic x-ray signals from neutron-star pulsars, these instruments have sufficient performance to determine the period of ∼100 ms at about <2-μs errors even from dimmer neutron stars below 1∕1000 of the x-ray flux of the Crab pulsar. Since a phase-locked loop to the TI counter requires the hardware resources at each user node, the LOCAL_TIME counters on Hitomi user node, except for the SXI, are implemented with free-run clocks to reduce the hardware resources. In other words, LOCAL_TIMEs are not synchronized to TI and thus should be calibrated by TI with offline software (for details, see Sec. 3). Note that the LOCAL_TIME for the SXI is synchronized to L32TI on every arrival of a TIME_CODE at SXI-DE within 10-μs accuracy, so such offline calculations are not required for SXI. Therefore, SXS, HXI, and SGD user nodes periodically (every 1 or 4 s) latch LOCAL_TIME and U32TI values simultaneously at TIME_CODE = 0 (i.e., U32TI time zero) to generate a lookup table between LOCAL_TIME and TI. This lookup table for each user node is periodically stored in a housekeeping space packet, with which the offline software recognizes the relation between user node LOCAL_TIMEs and TI.
When a user node acquires an x-ray event, the LOCAL_ TIME at detection is latched and stored in a telemetry message. Such information is gathered for multiple events into a space packet with a corresponding TI value. In summary, the time evolution of the relation between the LOCAL_TIME and the TI is stored in housekeeping telemetry, and the LOCAL_TIME at x-ray detection and the TI value when a space packet containing the detection is generated are stored in the event telemetry. These three pieces of information in the telemetry are used in calculations of the photon-arrival time by the offline software.  Table 2 and calibration items are shown as stars and arrows, respectively. 3 Software Design of Offline Time Assignment

Process Flow
When all observation telemetry is ready on the ground, an automatic pipeline process starts converting from raw telemetry data into the flexible image transport system (FITS) format, a standard format for astrophysical use. 14 The process then calculates calibrated physical values, such as time, pulse height invariant (photon energy), and coordinates from the raw telemetry values using the calibration database, and writes them to FITS output files. Since Hitomi is a "public observatory," the availability of such analysis software and calibration information for payload instruments is very important. Thus, all Hitomi software and calibration databases are published in the "HEAsoft" package and "CALDB" database, respectively, which are released to the public via NASA GSFC. Time assignment tasks are applied to raw telemetry in a pipeline process after conversion to the FITS format. Time calculations are performed one-by-one for all FITS housekeeping and science event files. The basic design concept for software time assignment tasks is common across all instruments. Information from individual payload instruments is stored in the CALDB files. Figure 3 shows an overall flow of the timing process as a universal modeling language (UML) chart.
The main process of the time assignment flow (Fig. 3) is provided by the main timing task "ahtime," which calculates times for both housekeeping and science event files. The algorithm for time assignment varies by file type (housekeeping or science event), by instrument, and by their operational mode, which can be recognized by FITS header keywords for timing tasks. Individual information for ahtime is categorized as hardware configuration or propagation delay time from GPSR to SpaceWire nodes and is stored in the two CALDB files shown as black boxes in Fig. 3. The algorithm is described in detail in Sec. 3.2. The resulting time in TAI is converted into the terrestrial time (TT) values, whose origin is 2014-01-01 00:00:00 UTC, and stored into the TIME column in the FITS file by ahtime.
Preprocessing of the time assignment flow (Fig. 3), which is performed before the main process described above, is performed to handle the GPSR failure mode. GPS information can be commonly treated among all telemetry and affects only the relation between Hitomi TI and the corresponding TAI value. This relation is discontinuously measured during communications between the spacecraft and the ground station (as described in Sec. 2.1) and is stored in the FITS file, called the TIM file as shown in Fig. 3. Process by the "ahmktim" tool provides a continuous relation between the TI and TAI regarding the GPS receiving status. A table refined by ahmktim is stored in the TIM-fine file, which is used for individual time assignment by ahtime in the main process. The detailed algorithm of ahmktim is described later in Sec. 3.3 and utilizes properties of the quartz clock onboard SMU. A temperature dependence of a clock frequency of this quartz is stored in CALDB (quartz), indicated by the black box in Fig. 3, and is scheduled for monthly onboard calibrations by another preprocess (the "ahtrendtemp" tool).
The barycentric dynamical time (TDB; the photon-arrival time converted from the celestial sky position for light-travel times between the spacecraft and the center of the gravity of the solar system) is required for further astrophysical uses, for example, when matching the arrival time of photons in x-ray and radio observations. 15 A barycentric correction tool ("barycen") is provided as an analysis tool, which is not applied in the pipeline process, because target positions for calculation must be set by users. The tool barycen is developed to be a mission-independent tool in the HEAsoft package, which relies on the data formats containing specific information in a standard way, expecting that the time precomputed is stored in the TIME column with standard FITS keywords to identify the time system. Similarly, it is expected that the orbit is written in a file with well-defined quantities (position and velocity) written in standard column names and units. Historically, the barycentric correction tools were individually developed for previous missions, including ASCA and Suzaku, 7 mainly because the orbital information required by the tool is stored in a different format. The engine of the calculation of the barycentric correction in barycen is a well-trained algorithm derived as a standard routine for Rossi X-Ray Timing Explorer (RXTE) satellite and afterwards used by Chandra, Swift, Suzaku, Nuclear Spectroscopic Telescope Array (NuSTAR), and Fermi missions. The calculation is performed in the two steps, following the same procedure used for the Suzaku satellite: (1) conversion from the TT value into the TDB value, considering the movement of the Earth under the gravitational potential of the Sun, and (2) correction of the time delay of the light-travel time between the spacecraft and the solar system barycenter, where the geometrical position of the spacecraft is identified by the orbital elements in the orbit file, considering the general relativity effects by the Sun and planets. The tool supports the solar system ephemerides of JPL-DE200. After the conversion, the FITS header keyword TIMEREF is changed from "LOCAL" to "SOLARSYSTEM." The largest shifts (about 8 min maximum) occur in step 2, but this calculation is well established.
The largest systematic error arises in step 1, from positional accuracy for the orbital element of the spacecraft. Such systematic errors are discussed in Sec. 4.

Algorithm for the Time Assignment Process Ahtime
Calculations at the main processing stage using ahtime are simple. In calculating times for the housekeeping FITS files, the TAI system time is calculated from the input of L32TI, which is one value per one row in the FITS file using the TIM file (i.e., the relation between L32TI and TAI, as defined in Sec. 3.1). The ahtime process takes from the TIM file two points before and two after the input L32TI and linearly interpolates them to calculate the corresponding TAI value. Since the TIME column in the Hitomi FITS file is defined as the number of seconds from 2014-01-01 00:00:00 UTC, whereas the origin for TAI is 1980-01-06 00:00:19 UTC, the calculated TAI is converted to the ASTRO-H time system by subtracting the offset of the two origins, i.e., the ASTRO-H time in TT is TI − 1;072;569;616 s, where the origin of TI is TAI − 19 s. When calculating the TIME of science event FITS files from payload instruments using ahtime, LOCAL_TIME counters, described in Sec. 2.4, are also considered. Since LOCAL_TIME represents a finer timing when a photon is detected by the instrument, the TIME in the science event FITS file is defined at the event detection timing at finer time resolutions. The calculation contains the two lookup processes described above. The first lookup process uses the relation between LOCAL_TIME and U32TI monitored in the housekeeping file of the instrument to calculate the L32TI corresponding to the input LOCAL_TIME. The second lookup process is the same procedure as that in the housekeeping data, from L32TI to TAI using the TIM file. Since the propagation delay of TAI information from GPSR to the instrument's SpaceWire node is not negligible as compared with the time resolution (see Sec. 2.3), the final step in time assignment for science event files by ahtime is to add the propagation delay to the TAI value obtained above. As a result, the ahtime calculation retrieves the time in TAI with finer resolution than TI at the x-ray detection timing by each event, which can be converted to the ASTRO-H time system as was done for the housekeeping data.
To perform the above process, individual instrument information is stored in the CALDB files (black boxes in Fig. 3) and is used by ahtime. The stored information is (1) the CALDB hardware configuration, which describes hardware configuration parameters for LOCAL_TIME as summarized in Table 1 and the attribute names in the telemetries of instrument timing counters and (2) the CALDB propagation delay, which describes the propagation delay time of TAI information from GPSR to the SpaceWire user node via SMU and the SpaceWire network (Sec. 2.3).

Treatment of GPS Lock-Off Data, Ahmktim and Ahtrendtemp
As described in Sec. 3.1, preprocessing of the time assignment flow in Fig. 3 checks the GPSR status to calculate the relation between TI and TAI, to support the fallback case in the event of GPSR failure as required in Sec. 1.
The GPSR onboard Hitomi is designed to always capture several GPS satellites on orbit (hereinafter, we call this GPS-ON mode), so cases where GPSR detects no GPS carry signal (hereinafter, GPS-OFF mode) should be rare. In the design policy for the Hitomi spacecraft, the data acquisition system should be robust for any single-point failure, such as a completely GPS-OFF mode. At the same time, the SpaceWire-D protocol used in the Hitomi data acquisition system (see Sec. 2.3) requires that the TIME_CODE should not jump and that the time interval among TIME_CODEs (time slot in SpaceWire-D; 16 ms) should be stable to within a few hundred microseconds. The SMU is thus designed to follow the above requirements. The TI is always synchronized to the TAI provided by the GPSR in GPS-ON mode and, even in GPS-OFF mode, the SMU keeps generating the TI using the free-run clock onboard SMU and keeps distributing TIME_CODEs. When the GPS-OFF mode switches to GPS-ON mode, the SMU starts synchronization of TI to TAI, which takes a few to few tens of seconds as a transition mode, and then the TI is synchronized to TAI again in GPS-ON mode. The transition mode normally happens at the beginning of operations (such as initial on-orbit operations), but it never happens when GPS-OFF mode continues forever.
As briefly described in Sec. 3.1, the ahmktim process refines the TIM file, which describes the continuous relation between the TI and TAI, considering the GPSR status. This relation is simple in normal GPS-ON mode, because the TI is synchronized to TAI. On the other hand, the calculation during GPS-OFF mode has two-step corrections of GPS-OFF data as schematically shown in Fig. 4 when the GPSR status changes from GPS-ON to GPS-OFF, and then back to GPS-ON mode. The raw data obtained during GPS-ON and GPS-OFF modes are shown in red and magenta, respectively, and a wavy trend can be seen during the GPS-OFF mode from TAI ¼ ðxÞ to (y). Such fluctuations in TI are generated by a free-run clock on the SMU whose frequency shifts with temperature drift. As the first step of GPS-OFF data correction, such short-term trends are corrected by the temperature of the SMU quartz, as monitored in the housekeeping data using the CALDB (quartz) file defined in Sec. 3.1, shown as black points in Fig. 4. In the second correction step for GPS-OFF data, the red points during GPS-ON mode are used as anchor points where the TI is synchronized to TAI and to adjust the beginning point (x) and the end point (y) of the GPS-OFF data to the two anchor points. In the case of Fig. 4, the beginning point (x) is already connected to the last point of the former GPS-ON data, but a tentative jump between black and red points can be seen at (y), which is then corrected as a long-term correction. Finally, a more stable trend than the original data (magenta) is obtained as the blue points in Fig. 4. The red and blue points are the output from ahmktim. Note that if no anchor points exist during the observation, such as in the case of complete GPS-OFF mode under permanent GPSR failure, ahmktim searches for other anchor points from the original TIM file, which describes the relation between TI and TAI as discontinuously measured during ground contacts. This function provides a fallback plan that successfully worked for Suzaku.
Another preprocessing of time assignments in Fig. 3 records the temperature dependence of the SMU quartz clock in the CALDB (quartz) file as measured on orbit. Information obtained on orbit is limited, so detailed measurements of the temperature dependence of the SMU quartz are performed on the ground, the results of which are described in Sec. 5.1. The SMU measures the frequency of the onboard quartz clock, referring to the GPS signals from GPSR. This function can be activated by an operation command during GPS-ON mode, but note that the measurement does not work during GPS-OFF mode. Such operations are scheduled once per month on orbit. Therefore, preprocessing by ahtrendtemp is scheduled to be triggered monthly. The ahtrendtemp process picks up temperature and self-measured frequency information of the SMU quartz from housekeeping telemetry and generates the relation between temperature and frequency. In this process, the same temperature may appear many times, and thus the ahtrendtemp process calculates the average of the frequency values within the defined temperature bins. After the averaging operation, the results are stored in an extension of the CALDB file for the quartz frequency.

Items on Timing Uncertainties
Under the hardware and software designs for the timing system (see Secs. 2 and 3), timing performance should meet the requirements for the timing system, namely, 350 or 35 μs in absolute time as a basic requirement or a mission goal, respectively (see Sec. 1). To more precisely control overall uncertainty in the timing system, seven items are identified as those which may reduce timing accuracy. These items are indicated by stars in the timing chart of the Hitomi timing system, shown in Fig. 2. Table 2 gives a summary of these items.
Under propagation of TAI timing information to SpaceWire user nodes (Fig. 2), timing delays are stored in the CALDB (delay) file and corrected by the offline timing tool ahtime (see Sec. 3.2), but jitter is treated as timing uncertainty items A, B, C, and D. In the first step, GPSR tries to synchronize the timing output signal (1 PPS; pulse per second) to the timing origin of TAI under GPS-ON mode (see Sec. 3.3). Item A is timing jitter between TAI and the timing output of GPSR. Next, the SMU generates TI (Sec. 2) using the timing signal from GPSR or the SMU quartz while in GPS-ON or GPS-OFF mode, respectively (see Sec. 3.3), and sends the TIME_CODE as the lower 6 bits of the TI to the SpaceWire network. Item B is the timing jitter between the input and output of the SMU, that is, the timing signal from GPSR and the TIME_CODE, respectively. Third, the TIME_CODE is distributed via the SpaceWire network, and user nodes reconstruct the TI from TIME_CODE and the upper 32 bits of the TI obtained via RMAP (see Sec. 2). Item C is the jitter of the timing of TIME_CODE between, before, and after propagation via the SpaceWire network, and item D is the jitter in synchronization of TIME_CODE to the TI reconstructed on the user node.
Item E is the systematic error in the interpolation of TIs by the timing task ahtime (see Sec. 3.2), and item F is the time resolution of instruments as summarized in Table 1. Item G, which is accuracy of the orbital determination of the spacecraft, is provided for users who require barycentric time in their analyses. The barycentric time is calculated by the tool barycen (see Sec. 3.1), which requires the target position and the orbital elements of the spacecraft.

Error Budget for Timing Uncertainties
To control and maintain overall timing uncertainties, the error budgets for all items identified in Sec. 4.1 are defined as in Table 2. As defined in Sec. 1, the requirements and goals for SXS, HXI, and SGD are 350 and 35 μs, and item F is defined in Table 1 (5 μs for SXS and 25.6 μs for HXI and SGD). Therefore, the remaining 324 and 9 μs are distributed to other items in GPS-OFF and GPS-ON modes, respectively. Such GPS modes affect only items A and B; the error budget of item A is valid only in GPS-ON mode, and that of item B is defined by the GPS mode. Item G (the orbital determination accuracy) becomes worse in GPS-OFF mode than that in GPS-ON mode, but the budget includes both modes.
The error budgets for items A and D come from hardware design specification sheets of the GPSR and the SpaceWire user node [digital electronics (DE)], respectively. The budget for item B in GPS-ON mode also comes from the hardware design and that for GPS-OFF mode is defined as 270 μs from the actual best-case performance of the Suzaku satellite. 7 The budget for item G is the minimum requirement for the orbital determination group of the spacecraft operation. The remaining items C and E are defined as 2.0 and 1.0 μs at maximum from a rough estimation from the system design and the software algorithm, respectively.

Ground Measurement of Temperature Dependence on Quartz Frequency
As described in Sec. 3.3, temperature dependence of the quartz clock onboard SMU is described in the CALDB (quartz) and is used by ahmktim for time calculations in GPS-OFF mode. The SMU has a function for self-measurement of this calibration item, but the operations are limited on orbit. Therefore, (a) detailed measurements of temperature dependence of the clock frequency and (b) functional tests of self-measurement in the flight configuration are performed on the ground before launch. Detailed measurements of temperature dependence of the frequency of the quartz onboard the SMU (item a) were performed in October 2014, before boarding to the payload. Since the SMU has fully redundant components, two flight units (SMU-A and SMU-B) were used for the measurement. The SMU was put in a vacuum heat bath and subjected to eight temperature cycles from −10°C to þ73°C at a rate of 1°C∕ min to 2°C∕ min. The quartz temperature was measured by a platinum temperature sensor at the electric board of the quartz. The clock from the SMU quartz is available as a 1-M PPS signal from the SMU, and the frequency of this signal was measured by a frequency counter, which was well calibrated to 0.5-ppm accuracy. The frequency measurement was performed every 0.5 min. The relation between raw values for temperature and frequency shows a small hysteresis between upward and downward progression of the temperature sweep at a 0.9% level, so the measured points are averaged within a 1.0-Hz range when more than three points exist in that range. Figure 5 shows the results for SMU-A and SMU-B in green and magenta, respectively. This table is recorded in the CALDB (quartz) file for use by ahmktim (Fig. 3).
A functional test of self-measurement of the temperature dependence of the SMU quartz (item b) was performed in a spacecraft thermal vacuum test from June to July 2015, when the spacecraft was in its flight configuration. During spacecraft thermal vacuum testing, hot and cold temperature environments were prepared for functional testing of onboard instruments. The self-measurement function of the temperature dependence of the SMU-A quartz was activated 30 times (for 16 s each) in GPS-ON mode during transition from hot to cold mode. The same function for SMU-B was also checked 9 times during cold mode. Figure 5 shows the results for SMU-A and SMU-B in blue and red, respectively. These results are consistent with the detailed measurement described above to within a 0.5-ppm level, which is sufficient for correction by ahmktim.
In addition to items a and b above, the temperature dependence can be roughly verified in the transition mode between the GPS-OFF to GPS-ON modes (see Sec. 3.3). This transition happened once on the ground during spacecraft thermal vacuum testing in July 2015 and once on orbit in February 2016. On the ground, the GPSR mode changed from GPS-ON to GPS-OFF, then to GPS-ON again. The duration of GPS-OFF mode was 14,912 s and the temperature of the SMU-A was    Fig. 5, and thus about a 15.11-s shift is expected at this frequency over about 938 ks. Therefore, the temperature dependence of the frequency of SMU-A quartz was also verified at about a 2% level here.

Ground Measurement of Item B: Delay from GPSR to SMU
The measurement of item B in the error budget ( Table 2) was performed during the first integration test in October 2013 when the GPSR, SMU, SpaceWire network, and SpaceWire user nodes were in their flight configuration. The goal was to measure the timing delay and jitter between the input and output of SMU, which are the GPSR 1-PPS signal and the TIME_CODE. The former signal can be easily seen with an oscilloscope, but the latter is difficult to handle because the SpaceWire line is also used for communication of many commands and telemetries. Therefore, a simple converter from the SpaceWire TIME_CODE to a single digital pulse that is detectable by an oscilloscope was prepared for this measurement. Here, we call this converter the "TIME_CODE handler." Before main measurements in the flight configuration, the timing delay and jitter of the TIME_CODE handler were measured using a commercial GPSR. Measurements were performed over 25,169 trials under a SpaceWire link rate of 48 MHz at the same rate as the actual SMU SpaceWire port. The results showed that the time delay becomes 387 AE 6.4 ns with 1-sigma error. Note that, among this value, 219 ns were spent in recognizing the full signal length of TIME_CODE by the TIME_CODE handler, there was about a 2-ns delay due to SpaceWire cables, and that jitter by this GPSR is negligible (within 1 ns).
In main measurements of item B, the 1-PPS signal from the GPSR was picked up from the communication line between SMU and GPSR, and the TIME_CODE from the SMU was captured by the TIME_CODE handler, premeasured above, from the communication line between the SMU and the SpaceWire router in the network. These two signals were detected by an oscilloscope, and the time delay and jitter between the two were measured. The measurement is performed in two modes, when the SpaceWire network is unoccupied and when it is nearly fully occupied by communications between the components (hereinafter, these states are called "idle" and "busy," respectively). In total, 1910 and 1619 measurements were performed in the idle and busy states, respectively. Figure 6 shows the results. In that figure, the horizontal axis includes the delay of the TIME_CODE handler, 387 ns. Numerically, the results were 914 AE 46 ns and 920 AE 47 ns in the idle and busy states, respectively, with 1-sigma errors. In summary, after subtracting the timing properties of the TIME_CODE handler, the timing delay at SMU becomes 530 AE 46 ns. The delay value of 530 ns is included in the CALDB (delay) file (see Fig. 3), which is used by the offline process with ahtime. Since the jitter value for the error budget is defined as the 3-sigma, item B becomes about 137 ns, which satisfies the error budget (0.5 μs) in Table 2.

Ground Measurement of Items C and D:
Propagation Time of TIME_CODE . Such delay and jitter values can be measured by probing many points in the SpaceWire network tree, but the number of points is limited in on-ground tests in the full satellite flight configuration due to the tight schedule before launch. Therefore, delay and jitter values of each element in the SpaceWire network were first measured as summarized in Table 3, and the overall delay and jitter were estimated by a simple propagation simulator of TIME_CODE under the SpaceWire network configuration (i.e., routing and the link rate) using premeasured values of elements. The overall delay time is just a linear sum of each delay (Table 3) in the routing path of the instruments listed in Table 4,  but jitter is estimated by Monte Carlo simulation of the propagation of TIME_CODE hops at each node. Table 4 shows the results of estimations of delay and jitter values.
To verify the delay and jitter values estimated in Table 4, two paths from SMU to SGD-1 DE were selected and measured during the first integration test in October 2013. Table 5 lists the probe points, which are located at the point just after the SMU and before the CPU node or field-programmable gate array (FPGA) node of the SGD-1 instrument, which are assigned IDs of i and ii, respectively. The propagation times for i and ii are estimated to be 1529 AE 315 and 3252 AE 444 ns, respectively, as listed in the table. The SpaceWire MSR tester measured propagation times for TIME_CODE in the idle and busy states 38,418 and 38,340 times, respectively. Figure 7 shows distributions of the propagation time in the two states. The results show that network congestion does not affect propagation delay of the first-priority code TIME_CODE at a 0.2% level, and estimations of delay and jitter are consistent with actual measurements at less than a 10% level. The difference between estimated and measured values corresponds to item E, which turned out to be <10% of the estimated delay time. Numerically, it corresponds to 0.6 μs at maximum, which is within the error budget item E, 1 μs.
The two trials for delay and jitter values by the propagation simulator were well verified, establishing the estimations in Table 4. The delay values in that table were thus stored in the CALDB (delay) file and used by ahtime, and the jitter values in that table are all within the error budget item C, 2 μs.
6 Summary of the Timing Performance Table 6 summarizes the performance of the Hitomi timing system, including the hardware and software designs for the seven items listed in Table 2. Items B, C, and D were measured on the ground, as described in Secs. 5.2 and 5.3, and item F is the time resolution of LOCAL_TIME as shown in Table 1. Items A and E were designed following the specifications sheet. Item G was estimated by the orbital determination group at JAXA after launch using the actual date on orbit. The position uncertainties determined by the GPSR are <1.7 m on orbit and a few centimeters by the offline determination process on the ground under the GPS-ON mode. The accuracy becomes worse in the GPS-OFF mode when the orbital elements are determined by measurements of the position and velocity of the spacecraft from the ground station via ranging operations, but it is about 150 m. Therefore, item G is negligible for the timing system both in GPS-ON and -OFF modes. In summary, all seven items satisfy the error budget in Table 2.
Yukikatsu Terada is an associate professor at Saitama University. He received his BS and MS degrees in physics and his PhD in science from the University of Tokyo in 1997, 1999, and 2002, respectively.
Biographies for the other authors are not available.   Table 2.