Formal Validation of Realtime Middleware

The near infrared camera and multi-object spectrometer (NICMOS) and the space telescope imaging spectrograph (STIS) are next-generation orbital replacement instruments for the Hubble Space Telescope (HST). Ball Aerospace Systems Group is currently designing and building these instruments for the National Aeronautics and Space Administration. Substantial components of the flight software for these two instruments are being designed in common in order to save development costs and to make in-orbit commanding and maintenance of the flight software easier. The majority of the flight software (FSW) for both NICMOS and STIS is embedded within the electronics of the instruments. This paper begins with an overview of the HST-environment in which the embedded FSW for both STIS and NICMOS executes. The paper then describes: (1) the common electronics environment in which the FSW executes, (2) the FSW development environment, (3) the FSW real-time environment, (4) the method for in-orbit commanding of instrument operations via macros, (5) the method for gathering analog hardware engineering data, (6) the method for commanding the STIS CCD detectors and the NICMOS detectors, (7) the structure and management of the science data buffer, (8) fault management, (9) the collection of diagnostic data, (10) the capabilities for uplinking new FSW code and data once the instruments are in orbit, and (11) instrument-specific software executing in the NASA Standard Spacecraft Computer (NSSC-1), external to STIS and NICMOS.© (1995) COPYRIGHT SPIE--The International Society for Optical Engineering. Downloading of the abstract is permitted for personal use only.

This paper describes the overview of the COMS (communication ocean meteorological satellite) telecommand (TC) processing. On-board command function receives, verifies and executes commands from ground, which are addressed to the flight software. In order to process the commands using the unique format, command messages (CMs) are generated by the flight software from received telecommand sent by the ground or from other software functions. Device TCs of hardware type CM are dispatched to the 1553 system bus, DTC or MRE depending on the device types. Time-tagged (TT) telecommand is sent to time-tag buffer and stored. TT telecommand is chronologically scheduled and executed on specified on-board time by the master schedule function. The immediate telecommand are executed through the appropriate software interface.

The life cycle application of intelligent software modeling for the First Materials Science Research Rack

This paper presents research funded by European Space Agency (ESA) / European Space Research and Technology Engineering Centre (ESTEC) into the development of technology to incorporate security functions into spacecraft flight software. The security functions are derived from the time and space partitioning mechanism within the Integrated Modular Avionics (IMA) concept. ESA is establishing a software reference architecture for future avionics that consists of a layered architecture with defined interfaces and functionality, and abstraction levels per layer. The lower level layers handle the computer issues and each progressively higher layer adds increasing functionality and services up to the implementation of the flight software applications. This approach is complementary to the Multiple Independent Levels of Security (MILS) concept. The security components are added at the lowest layer in the form of a separation kernel which is responsible for enforcing the time and space partitioning of the flight software. The security components complement the safely critical elements of a separation kernel with measures to enforce the confidentiality, integrity and availability of data. The research study used the EBIOS method to establish a set of security objectives and functional requirements for flight software. Two separation kernels were selected, one commercial and the other open-source, and successfully ported to the LEON3 spacecraft processor. An attempt was then made to verify the kernels against the security functional requirements. The verification was incomplete because the kernels did not support all of the security mechanisms specified in the requirements. However the technology has been established and can be upgraded to fully provide the security functions for future flight software.

VML (Virtual Machine Language) has been used as the sequencing flight software on over a dozen JPL deep-space missions, most recently flying on GRAIL and JUNO. In conjunction with the NASA SBIR entitled Reactive Rendezvous and Docking Sequencer, VML version 3.0 has been enhanced to include object-oriented element organization, built-in queuing operations, and sophisticated matrix / vector operations. These improvements allow VML scripts to easily perform much of the work that formerly would have required a great deal of expensive flight software development to realize. Autonomous turning and tracking makes considerable use of new VML features. Profiles generated by flight software are managed using object-oriented VML data constructs executed in discrete time by the VML flight software. VML vector and matrix operations provide the ability to calculate and supply quaternions to the attitude controller flight software which produces torque requests. Using VML-based attitude planning components eliminates flight software development effort, and reduces corresponding costs. In addition, the direct management of the quaternions allows turning and tracking to be tied in with sophisticated high-level VML state machines. These state machines provide autonomous management of spacecraft operations during critical tasks like a hypothetic Mars sample return rendezvous and docking. State machines created for autonomous science observations can also use this sort of attitude planning system, allowing heightened autonomy levels to reduce operations costs. VML state machines cannot be considered merely sequences - they are reactive logic constructs capable of autonomous decision making within a well-defined domain. The state machine approach enabled by VML 3.0 is progressing toward flight capability with a wide array of applicable mission activities.

Flight control software has higher requirements on reliability, as well as real-time performance. What's more, the fault of flight control software not only contains traditional functional fault, but also contains real-time fault. Thus, fault localization and removing for Flight Control software is a huge challenge for relative engineers. To locate and remove those faults effectively, this paper adopts Sober algorithm as the functional fault-localization algorithm for flight control software. Meanwhile, this paper proposes the module-level and function- level real-time fault-localization algorithms inspired by Sober algorithm. The experimental results indicate that all algorithms have obtained acceptable localization results. For further goals on increasing the automation level and the efficiency of software fault-localization process, we develop a fault-localization and visualization (FL&V) tool for flight control software at last.

The growing complexity of flight control software of unmanned aerial vehicle led up to more and more difficulty in testing such systems.B is a formal method which enables the automatic generation of an executable code through s succession of refinements from an abstract specification.UML specifications can be formally verified by analyzing the corresponding B specification.Integration of UML specifications and B method can overcomes the drawback of UML. We adopt the tool Statemate which support the virtual prototype technology.The detailed description of flight control software behaviors is presented based on statecharts. Then we adopt the B method to translate the statecharts into B specification of flight control software. According to software testing criteria MC/DC, we are easy to obtain the test cases based on StateChart and B method.

When combining several modules into a flight control software system, it is non-trivial to determine, prior to deployment, performance and reliability values of the software system. Moreover, once the system is deployed, it is often the case that during operation it fails to meet its performance and reliability requirement and one needs to detect what has gone wrong (i. e., performance/reliability bottlenecks). To study these issues, a Semi-Markov Process (SMP) formulation is proposed in this work for the reliability and performance of flight control software systems. By explicitly including failure states into the SMP representation of a module, we can compute both its performance and reliability using a single SMP. We can also detect its performance and reliability bottlenecks by applying the formal sensitivity analysis technique. We demonstrate our approach by choosing a representative flight control software system that is validated using experiments on real flight control computer.

The Mars 2020 (M2020) Perseverance Rover is NASA's most advanced planetary rover mission to date. It includes a novel Sample Caching Subsystem (SCS) which will collect rock cores for possible future return to Earth, as well as an improved mobility system with enhanced autonomous navigation which will enable it to traverse faster and farther than prior rovers. The development of both systems required extensive flight software and flight hardware testing. To support this testing, we developed the Surface System Development Environment (SSDEV) and used it for a wide variety of testing. SSDEV is a bundled subset of M2020 Flight Software which runs on commercially available Linux computers and can be combined with multiple backend options for simulation and hardware control. The SSDEV architecture enabled our teams to perform much more testing of flight software and flight hardware than would have otherwise been possible. As a secondary benefit, the SSDEV-based test campaigns also helped our teams enter the operations phase of the mission with greater readiness of operations products and tools. In this paper, we summarize the motivation for SSDEV, provide an overview of the SSDEV architecture, list several examples of how SSDEV was used, and summarize lessons learned. SSDEV is not a substitute for integrated testing with flight-like avionics, but it enabled substantially more testing than would have otherwise been possible and also provided some unique benefits. We recommend architectures like SSDEV to future projects that need to perform extensive hardware and software testing using a limited set of flight-like avionics.

The use of rapid development techniques allows building high quality systems in short timeframes while reducing project costs and adding flexibility to the development process so it can be easily adapted to meet customer needs in a volatile market. In order to obtain the benefits of implementing rapid development methods, the development organization and the processes utilized need to be congruent with rapid development methodologies and techniques. A problem encountered by product development organizations is how to identify which projects are suitable for the rapid development approach. An extensive academic research about the implementation of rapid development techniques in Systems Development Life Cycle (SDLC) processes resulted in the identification of selection criteria for the determination of project suitability for rapid development methods. The selection criteria identified by this research are essential elements that must be present in every rapid development environment in order to obtain the benefits of implementing rapid development techniques.

In this paper, we present a new hierarchical scheduling framework for periodic tasks in symmetric multiprocessor (SMP) platforms. Partitioned and global scheduling are the two main approaches used by SMP based systems where global scheduling is recommended for overall performance and partitioned scheduling is recommended for hard real-time performance. Our approach combines both the global and partitioned approaches of traditional SMP-based schedulers to provide hard real-time performance guarantees for critical tasks and improved response times for soft real-time tasks. Implemented as part of VxWorks, the results are confirmed using a real-time benchmark application, where response times were improved for soft real-time tasks while still providing hard real-time performance.

Critical systems that integrate software components (e.g., from third-parties) need to address the risk of residual software defects in these components. Software fault injection is an experimental solution to gauge such risk. Many error models have been proposed for emulating faulty components, such as by injecting error codes and exceptions, or by corrupting data with bit-flips, boundary values, and random values. Even if these error models have been able to find breaches in fragile systems, it is unclear whether these errors are in fact representative of software faults. To pursue this open question, we propose a methodology to analyze how software faults in C/C++ software components turn into errors at components' interfaces (interface error propagation), and present an experimental analysis on what, where, and when to inject interface errors. The results point out that the traditional error models, as used so far, do not accurately emulate software faults, but that richer interface errors need to be injected, by: injecting both fail-stop behaviors and data corruptions; targeting larger amounts of corrupted data structures; emulating silent data corruptions not signaled by the component; combining bit-flips, boundary values, and data perturbations.

The current generation of guidance, navigation, and control (GN&C) flight software for human spaceflight vehicles has two major drawbacks that increase program cost and reduce safety margins. First, current flight software relies heavily on pre -launch configuration and processing. This processing takes time and requires an extensive, human-centered infrastructure for parameter design and configuration control. Second, the lack of onboard reconfiguration capability forces the vehicle to remain inside generic, pre-defined envelopes instead of utilizing real-time capabilities. This constraint limits abort availability to the pre-launch predicted boundaries instead of the realtime abort capability. The Spacecraft Mission Assessment and Replanning Tool (SMART) is NASA’s concept for a viable autonomous flight management (AFM) system that uses advanced GN&C algorithms and intelligent systems to provide critical decisionmaking capability and real-time vehicle performance assessments for the next generation of human spaceflight vehicles. The intent of the SMART project is to develop a cost-effective AFM system that reduces the reliance on pre -launch mission design, increases vehicle performance, and improves safety. In order to achieve these objectives, the appropriate level of autonomy for the vehicle must be defined. The level of autonomy is defined by finding the proper balance of costs and benefits between both human vs. computer and ground vs. onboard authority. Another goal for

The title of this paper provides an answer to the question posed by Larry King in his panel paper titled "Do formal methods really belong in the toolbox of the practicing engineer?" Yes, formal methods do indeed belong to the toolbox of the practicing engineer. The capabilities of today's computers are truly impressive and as a result have opened door to the design and development of increasingly ambitious systems. An almost unavoidable by-product of these systems is the growing consequences associated with their failure. Another attribute shared by most of these systems is that their complexity is of an unprecedented nature. Thus, these systems live in the cross section (or shall I say cross-hairs) of high consequence and high complexity. For these reasons, attaining and developing the ability to construct highly reliable software is be coming a significant concern. Furthermore, software manufacturers as well as consumers are getting more and more fed-up with missed deadlines, bugs crashing and freezing hardware, and in the worst case, causing havoc to organizations, as bugs/incompleteness lead to allowing trojan horses for hackers through viruses and attacks. This is leading to attempts to replace ad hoc techniques in system design by more systematic methods. What is the role that formal methods, as a field of study, can play in addressing these issues? If by formal methods, one is exclusively referring to formal verification methods for software, such tools will probably not be part of a practicing engineer's tool in the near future. King's note reflects the prevailing confusion about formal methods, what can be achieved using them, and what cannot be achieved using them, and their overall role in system design and development.

The real-time performance of control network between process control system(PCS) in a nuclear power plant is an important factor to ensure safety and reliability of power plant. Ethernet network is widely adopted in modern PCS even though it does not guarantee hard real-time performance in the non-safety region of a nuclear power plant. To achieve better real-time performance and QoS(Quality of Service), PCS usually uses switched Ethernet with the priority feature, which is based on the IEEE 802.1Q/p protocol. However, the IEEE 802.1Q/p protocol also has a priority inversion problem when transmission of a higher-priority frame is requested during transmission of a lower-priority frame. To resolve this problem, this paper proposes Preemptive Switched Ethernet(PSE) that is based on the IEEE 802.1Q/p protocol with a preemption mechanism. This paper shows that PSE provides better real-time performance than the standard IEEE 802.1Q/p protocol especially when non-real-time and real-time traffics are mixed together. This paper also implements PSE controller using the FPGA (Virtex-4) and MicroBlaze processor. From the implementation results, PSE controller shows an improved latency and jitters of transmission period compare to the normal Ethernet controller. Experiment result shows that the jitter of real-time packet is 50% less than the standard 802.1Q/p protocol.