Formal verification of spacecraft control programs (experience report)

Abstract

Verification of functional correctness of control programs is an essential task for the development of space electronics; it is difficult and time-consuming and typically outweighs design and programming tasks in terms of development hours. We present a verification approach designed to help spacecraft engineers reduce the effort required for formal verification of low-level control programs executed on custom hardware. The approach uses a metalanguage to describe the semantics of a program as a state transformer, which can be compiled to multiple targets for testing, formal verification, and code generation. The metalanguage itself is embedded in a strongly-typed host language (Haskell), providing a way to prove program properties at the type level, which can shorten the feedback loop and further increase the productivity of engineers.The verification approach is demonstrated on an industrial case study. We present REDFIN, a processing core used in space missions, and its formal semantics expressed using the proposed metalanguage, followed by a detailed example of verification of a simple control program.

Efficient Static Analysis of Marlowe Contracts

“…Work in [14] documents a similar effort to ensure correctness of control software in Haskell using the SBV library; the authors also discuss performance of the analysis and apply this approach to non-functional requirements.…”

Formal Verification of Spacecraft Control Programs

“…This paper is an extended version of an earlier conference paper [15]. The key changes compared to the earlier version are: (i) §3 has been expanded to describe the branching mode of symbolic simulation within the presented verification framework; (ii) an entirely new section §5 addresses verification of programs with unbounded loops on an example of a stepper motor control program; (iii) the discussion section has also been updated.…”