Time and space partitioning security components for spacecraft flight software

Recent improvements in the performance and security architecture of modern microprocessor designs have made the implementation of the Multiple Independent Levels of Security (MILS) software architecture technically feasible and at affordable cost. Reaching this inflexion point has enabled the development of MILS systems on single-core processor architectures comprising applications and data of multiple security classifications hosted concurrently on the same platform. In this paper, the potential requirements for the implementation of a separation kernel to support MILS systems on multicore processor architectures will be considered, and the design challenges associated with its potential implementation on the Freescale QorIQTM P4080 multicore processor will be discussed. Finally, the potential use of a MILS Multicore separation kernel in two use cases will be presented - a Cross-Domain System (CDS) network gateway, and a Multi-Level Secure (MLS) Integrated Modular Avionics (IMA) platform.

The implementation of the Multiple Independent Levels of Security (MILS) software architecture on modern microprocessor architectures has become technically feasible in recent years. This allows MILS-based systems to host applications and data of multiple security classifications concurrently on a uniprocessor platform at affordable cost. In this paper, the potential requirements for the implementation of a separation kernel to support MILS systems on multicore processor architectures will be considered, and the design challenges associated with its potential implementation on the NXP (formerly Freescale) QorIQ™ P4080 multicore processor will be discussed. Finally, the potential use of a MILS Multicore separation kernel in two use cases will be presented - a Cross-Domain System (CDS) network gateway, and a Multi-Level Secure (MLS) Integrated Modular Avionics (IMA) platform.

Security-critical applications at the highest Evaluation Assurance Levels (EAL) require formal proofs of correctness in order to achieve certification. To support secure application development at the highest EALs, we have developed techniques to largely automate the process of producing proofs of correctness of machine code. As part of the Secure, High-Assurance Development Environment program, we have produced in ACL2 an executable formal model of the Rockwell Collins AAMP7G microprocessor at the instruction set level, in order to facilitate proofs of correctness about that processor's machine code. The AAMP7G, currently in use in Rockwell Collins secure system products, supports strict time and space partitioning in hardware, and has received a U.S. National Security Agency (NSA) Multiple Independent Levels of Security (MILS) certificate based in part on a formal proof of correctness of its separation kernel microcode. Proofs of correctness of AAMP7G machine code are accomplished using the method of cutpoints, which requires neither traditional clock functions nor a Verification Condition Generator (VCG). In this paper, we will summarize the AAMP7G architecture, detail our ACL2 model of the processor, and describe our development of the compositional cutpoint method into a robust machine code proof framework.

This paper provides an overview of the activities conducted at the European Space Research and Technology Centre in the domain of GNSS timescales monitoring and assessment, and the related multi-GNSS receivers calibration methodology required to enable this evaluation. The European Space Agency (ESA), as the Galileo System Design Authority (SDA), is responsible for the development and qualification of new Galileo system releases (known as System Builds), and is also contributing, along other Programme stakeholders, to the continuous monitoring of the system navigation and timing performance. A number of tools and resources are being used to fulfil these objectives and to generate performance figures of merit in near real time. This is particularly important to support the prompt diagnose and resolution of potential system anomalies, that might propagate to the timing users community. The Time and Geodetic Validation Facility (TGVF-X), with its core infrastructure hosted and operated at ESTEC, is the main system validation and prototyping testbed currently being used by ESA. TGVF-X is a culmination of a project that dates back to the early 2000s, to the early inception of the Galileo project, encompassing the early experimentations of the Galileo System Time (GST) and of Galileo on-board atomic clocks. The first part of this paper will address a number of timing performance figures of merit generated by TGVF-X, including GNSSs on-board clock stability and UTC timing dissemination accuracy, not only limited to the case of the Galileo system. Results from GPS, GLONASS and Beidou systems will also be presented. The methodology for the UTC time dissemination and GNSS to GNSS Time Offset accuracy will be presented and results from different GNSSs will show that a UTC time dissemination accuracy below 5ns (95%) can be achieved. The second part of this paper will introduce the multi-GNSS receiver calibration activities that are required for the monitoring of GNSS timescales. As reported earlier (e.g. [1, 2]), we have developed and validated methods for the absolute calibration of GNSS receiver chains, including the antenna. Those methods have now been extended to cover all GPS, Galileo, Glonass and Beidou-2 and -3 signals, allowing for a comprehensive and consistent calibration process. Two receivers have been fully calibrated and are operating in our Laboratory. They are connected to UTC(ESTC), our local realisation of UTC, which is used as reference for the monitoring of the GNSS timescales. ESA, as member of the United Nations International Committee on GNSS (ICG), is also contributing to the harmonisation and standardisation of GNSS performance metrics, and also contributing to GNSS timing interoperability discussions. A brief status of these activities will be outlined in this paper. [1]: “Absolute calibration of GNSS timing stations and its applicability to real signals”, E.Garbin et al., Metrologia 56 015010, 2019 [2]: Cross-calibration of multi-GNSS Receiver Chains, P.Waller et al, Joint IFCS-EFTF, Orlando, 2019

The Cassini-Huygens mission is a joint NASA and European Space Agency (ESA) mission to collect scientific data of the Saturnian system and is managed by the Jet Propulsion Laboratory (JPL). After having arrived in Saturn orbit and releasing the ESA's Huygens probe for a highly successful descent and landing mission on Saturn's moon Titan, the Cassini orbiter continues on its tour of Saturn, its satellites, and the Saturnian environment. JPL's Cassini Integrated Test laboratory (ITL) is a dedicated high fidelity test bed that verifies and validates command sequences and flight software before upload to the Cassini spacecraft. The ITL provides artificial stimuli that allow a highly accurate hardware-in-the-loop test bed model that tests the operation of the Cassini spacecraft on the ground. This enables accurate prediction and recreation of mission events and flight software and hardware behavior. As we discovered more about the Saturnian environment, a combination of creative test methods and simulation changes were necessary to simulate the harmful effect that the optical and physical environment has on the pointing performance of Cassini. This paper presents the challenges experienced and overcome in that endeavor to simulate and test the post Saturn Orbit Insertion (SOI) and Probe Relay tour phase of the Cassini mission.

In 1996, ARINC 653 Part 1 (653p1) was published, which defines a standard Real-Time Operating System (RTOS) API called the APplication EXecutive (APEX). APEX defines mandatory RTOS services including the notions of time and space partitioning, and is targeted at large, complex Integrated Modular Avionics (IMA) systems. In 2012, ARINC 653 Part 4 (653p4) was developed, which defines a subset of 653p1 capabilities intended to address systems that do not require the size, complexity, or features of IMA systems. As such, 653p4 brings the benefit of 653p1-style standards compliance to more devices on aircraft, such as the majority of the Line Replaceable Units (LRUs) on next-generation aircraft. In this paper, we discuss ARINC 653p4 in contrast with 653p1.

The Automated Transfer Vehicle (ATV) uses Relative Global Positioning System (RGPS) to navigate towards the International Space Station (ISS) while performing initial rendezvous manoeuvers. The RGPS solution includes a Global Positioning System (GPS) receiver in the ISS Zvezda module, whose observations are transmitted to, and applied by, the approaching ATV. The characterization of the GPS reception environment of the ISS is, therefore, a key element when planning rendezvous operations. The reception environment of the ISS is time-variant due to the relative motion between the ISS and the GPS satellites and to the sun-tracking orientation of the ISS Solar Array (SA) panels. In order to predict, for a given configuration, the most critical multipath and masking events, a Ray-Tracing (RT) tool has been developed at the European Space Research and Technology Centre (ESTEC) of the European Space Agency (ESA). The tool is based on Geometrical Optics (GO) and evaluates, for each multipath event, the associated effects on the pseudo-range error. The tool was validated using Flight Data Measurements (FDM) collected during two measurements campaigns which took place in 2010 and 2011, respectively. In particular, the validation activities show that the tool is able to timely predict the majority of the most critical multipath events. This paper presents the RT tool, the underlying validation activities and the prediction results which were prepared to support the rendezvous operations for the Albert Einstein ATV mission (June 2013). For this mission, three candidate configurations for the ISS were analyzed with the RT tool. Based on the prediction results, the configuration which minimizes the occurrence of the most critical events was also identified.

Angiogenesis, the formation of blood vessels from pre-existing ones, is a key event in pathology, including cancer progression, but also in homeostasis and regeneration. As the phenotype of endothelial cells (ECs) is continuously regulated by local biomechanical forces, studying endothelial behaviour in altered gravity might contribute to new insights towards angiogenesis modulation. This study aimed at characterizing EC behaviour after hypergravity exposure (more than 1g), with special focus on cytoskeleton architecture and capillary-like structure formation. Herein, human umbilical vein ECs (HUVECs) were cultured under two-dimensional and three-dimensional conditions at 3g and 10g for 4 and 16 h inside the large diameter centrifuge at the European Space Research and Technology Centre (ESTEC) of the European Space Agency. Although no significant tendency regarding cytoskeleton organization was observed for cells exposed to high g's, a slight loss of the perinuclear localization of β-tubulin was observed for cells exposed to 3g with less pronounced peripheral bodies of actin when compared with 1g control cells. Additionally, hypergravity exposure decreased the assembly of HUVECs into capillary-like structures, with a 10g level significantly reducing their organization capacity. In conclusion, short-term hypergravity seems to affect EC phenotype and their angiogenic potential in a time and g-level-dependent manner.

Autonomous multicopters often feature federated architectures, which incur relatively high communication costs between separate hardware components. These costs limit the ability to react quickly to new mission objectives. Additionally, federated architectures are not easily upgraded without introducing new hardware that impacts size, weight, power and cost (SWaP-C) constraints. In turn, such constraints restrict the use of redundant hardware to handle faults. In response to these challenges, we propose FlyOS, an Integrated Modular Avionics (IMA) approach to consolidate mixed-criticality flight functions in software on heterogeneous multicore aerial platforms. FlyOS is based on a separation kernel that statically partitions resources among virtualized sandboxed OSes. We present a dual-sandbox prototype configuration, where timing-and safety-critical flight control tasks execute in a real-time OS alongside mission-critical vision-based navigation tasks in a Linux sandbox. Low latency shared memory communication allows flight commands and data to be relayed in real-time between sandboxes. A hypervisor-based fault-tolerance mechanism is also deployed to ensure failover flight control in case of critical function or timing failures. We validate FlyOS’s performance and showcase its benefits when compared against traditional architectures in terms of predictable, extensible and efficient flight control.

Separation kernels are key components in embedded applications. Their small size and widespread use in high-integrity environments make them good targets for formal modelling and verification. We summarise results from the mechanisation of a separation kernel scheduler using the Z/Eves theorem prover. We concentrate on key data structures to model scheduler operations. The results are part of an experiment in a Grand Challenge in software verification, as part of a pilot project in verified OS kernels. The project aims at creating a mechanised formal model of kernel components that gets refined to code. This provides a set of reusable components, proof strategies, and general lemmas. Important findings about properties and requirements are also discussed.

During the commissioning of the Sentinel-3B satellite, a single lunar observation was performed to assess the possible use of the moon for characterization and validation of onboard instruments. The observation was carried out in stable orientation after a roll maneuver, allowing the moon to be imaged by the Earth view of instruments. Data acquired by the Ocean Land Color Instrument (OLCI) allowed inflight verification of stray-light correction (SLC) performed by the Mission Performance Centre (MPC), and assessment of radiometric behavior of instrument in comparison with lunar irradiance models performed in cooperation between European Space Research and Technology Centre (ESTEC) and European Organisation for the Exploitation of Meteorological Satellites (EUMETSAT). This paper describes the results of those activities along with the proposed update of stray-light correction developed with the use of lunar data.

Application of the Monte Carlo method to the calibration of detectors for gamma-ray astronomy

This paper introduces a new antenna, payload and satellite testing facility, called HERTZ 2.0, currently under construction at the European Space Research and Technology Centre (ESTEC) in Noordwijk, The Netherlands. An overview of the building configuration, testing schemes capabilities and applications are provided.

A use of case-based reasoning technique in building expert systems

Dynamic deployment of context-aware access control policies for constrained security devices