A symbolic model checking approach to verifying satellite onboard software

Abstract

This paper discusses the use of symbolic model checking technology to verify the design of an embedded satellite software control system called attitude and orbit control system (AOCS). This system is mission-critical because it is responsible for maintaining the attitude of the satellite and for performing fault detection, isolation, and recovery decisions of the satellite. An executable AOCS implementation by Space Systems Finland has been provided to us in Ada source code form. In order to use symbolic model checking methods, the Ada implementation of the system was modeled at a quite detailed implementation level using the input language of the symbolic model checker NuSMV 2. We describe the modeling techniques and abstractions used to alleviate the state explosion problem due to handling of timers and the large number of system components controlled by AOCS. The specification of the required system behavior was also provided to us in a form of extended state machine diagrams with prioritized transitions. These diagrams have been translated to a set of temporal logic properties, allowing the piecewise checking of the system behavior one extended state machine transition at a time. We also report on the scalability of symbolic model checking tools for the case study at hand as well as discuss potential topics for future work.

Formal Framework for Safety, Security, and Availability of Aircraft Communication Networks

“…We use the symbolic model-checking tool: New e(X)tensible Model Verifier ( X ) [39] for our experiments because it is well-documented [40][41][42], freely available , and frequently used in industry [26,31,38,[43][44][45][46][47][48][49][50][51][52]. However,…”

How reliable is satellite navigation for aviation? Checking availability properties with probabilistic verification

“…A small aircraft transportation system by considering a number of approaching aircrafts has been formally modelled and its safety properties have been analysed in [28] using the interactive theorem prover PVS. Based on the Ada source code form, a mission critical satellite software control system is modelled using the input language of the symbolic model checker NuSMV 2, and its required behaviours has been specified as temporal logic properties [29]. In a series of work reported in [30], authors have developed the COMPASS toolset that utilises both qualitative and probabilistic model checking techniques.…”

Formal Specification and Quantitative Analysis of a Constellation of Navigation Satellites

“…This stated that the thrust of the pulse–width modulation, which controls the thrust of the descent engines, should always be above a certain altitude. In the study of Gan et al , the model checker NuSMV is used to model and verify the implementation of a mission and safety critical embedded satellite software control system. The control system is responsible for maintaining the altitude of the satellite and for performing fault detection, isolation and recovery decisions, at a detailed level.…”