## 3 Hardware/Software Description of the Developed Workbench  
The selected COTS are based on the STM32H7 family from ST microelectronics manufacturer (Geneva, Switzerland) [15]. From a hardware point of view, the HIL hardware is the so-called mockup. It has a large number of I/O peripherals, including analog I/O, PWM I/O, digital I/O, quadrature encoder inputs, and several communication protocols (RS-232, RS-422/485, Ethernet, SPI, I2C, USB, and CAN2.0B). Accordingly, all these interfaces are protected against reverse polarity, overcurrent, and overvoltage. The in-house software for MATLAB/Simulink integrates the target setup, input/output peripherals, MISRA C code generation, the C compiler, debugger environment, and real-time monitoring functions via specially developed dynamic link libraries. This enables an agile working methodology, as described in Figure 3.  
The working methodology uses MATLAB/Simulink as the development and simulation environment and the STM32H7-based system as the HIL-enabled target. Since the hardware board operates autonomously, the scheme in Figure 1 includes additional integration stages, such as compilation, deployment, execution, and data retrieval. If the hardware support block is set for this HIL mockup, it enables us to obtain experimental results and compare them with the simulated results. In addition, the implemented Simulink models do not wait for the response from the computer to start executing, unless the user has precisely set this function via graphical programming (or the text-based MATLAB code within a MATLAB function block). Intentionally, for further development, deployment, and technology transfer purposes, the generated MISRA C qualified code and safety-programmed (SIL3-/SIL 4-oriented) low-level hardware drivers remain accessible to the user. On the other hand, this HIL mockup differs from [16] and most of the HILs systems at [17] because the purpose is to use the presented COTS HIL test bench hardware for verification, simulation, and deployment purposes, as discussed in [9]. Figure 2 illustrates the use of the HIL mockup software. In accordance, it shows as the first required item a Simulink model. In this example, an attitude and trajectory control algorithm receives inputs from the space simulator. This model can be easily integrated into the HIL mockup by adding the target setup block (as shown in Figure 4) and a communication block, such as a USB channel, to retrieve and visualize information about the Simulink model on the hardware target. Figure 3: Testbench software and hardware environment. However, the automatic compilation and execution processes can be disabled since full automation may introduce excessive abstraction that is unsuitable for certain training stages. The source code generated from the Simulink model is shown as item 3 in Figure 4.  
The trainees use the integrated development environment (IDE) provided by STM32 (point 4 in Figure 4) to compile and load the binary program. Subsequently, the whole process is illustrated, from the development of algorithms/programs in a high-level abstraction language to the visualization and guided inspection of the resulting source code. Furthermore, it is interesting to illustrate the differences and relevance between non-normalized C programming and the source code that follows the usual MISRA C guidelines. As a result, developers and students can understand that implementing a Simulink model on target hardware relies on pre-existing, reconfigurable, low-level drivers for the target, and this process can be seamlessly integrated with traditional debugging using the IDE. To demonstrate this last point, the block set includes an intentionally broken hardware driver block to provide practical knowledge on how to locate the point of failure using IDE and the debugger. This can be interesting as some developers and students are not familiar with debugging sessions.