No abstract

Overview of Technologies BenchmarkedThe experiment tested tools representing three technologies: static analysis, model checking, and runtime analysis; and compared them to conventional methods. The static analysis tool was the commercial PolySpace C-verifier [5]. This tool analyzes a C program without executing it; it focuses on finding errors that lead to run-time faults such as underflow/overflow, non-initialized variables, null pointer de-referencing, and array bound checking. The model checking tool was Java PathFinder (JPF) [6], which is an explicit-state model checker that works directly on Java code. JPF specializes in finding deadlocks, verifying assertions, and checking temporal logic specifications. J P F explores all possible interleavings in multi-threaded programs. The runtime analysis tools were Java Path Explorer (JPaX) [4] and DBRover [3]. JPaX can infer potential concurrency errors in a multi-threaded program by examination of a single execution trace. Amongst the errors detectable are deadlocks and data races. DBRover supports conformance check of an execution trace against a specification written in metric temporal logic.

Abstract. This report documents an application of the nite state model checker Spin to formally verify a multi threaded plan execution programming language. The plan execution language is one component o f NASA's New Millennium Remote Agent, an arti cial intelligence based spacecraft control system architecture that is scheduled to launch i n D ecember of 1998 as part of the Deep Space 1 mission to Mars. The language is concretely named Esl Executive Support Language and is basically a language designed to support the construction of reactive control mechanisms for autonomous robots and space crafts. It o ers advanced control constructs for managing interacting parallel goal-andevent driven processes, and is currently implemented as an extension to a m ulti-threaded Common Lisp. A total of 5 errors were in fact identi ed, 4 of which w ere important. This is regarded as a very successful result. According to the Remote Agent programming team the e ort has had a major impact, locating errors that would probably not have been located otherwise and identifying a major design aw not yet resolved at the time of writing.

QC 20160103

This paper presents some of the unique verification, validation, and certification challenges that must be addressed during the development of adaptive system software for use in safety-critical aerospace applications. The paper first discusses the challenges imposed by the current regulatory guidelines for aviation software. Next, a number of individual technologies being researched by NASA and others are discussed that focus on various aspects of the software challenges. These technologies include the formal methods of model checking, compositional verification, static analysis, program synthesis, and runtime analysis. Then the paper presents some validation challenges for adaptive control, including proving convergence over long durations, guaranteeing controller stability, using new tools to compute statistical error bounds, identifying problems in fault-tolerant software, and testing in the presence of adaptation. These specific challenges are presented in the context of a software validation effort in testing the Integrated Flight Control System (IFCS) neural control software at the Dryden Flight Research Center. Lastly, the challenges to develop technologies to help prevent aircraft system failures, detect and identify failures that do occur, and provide enhanced guidance and control capability to prevent and recover from vehicle loss of control are briefly cited in connection with ongoing work at the NASA Langley Research Center.