Formalizing space shuttle software requirements

Abstract

This article describes four case studies in which requirements for new flight software subsystems on NASA's Space Shuttle were analyzed using mechanically supported formal methods. Three of the studies used standard formal specification and verification techniques, and the fourth used state exploration. These applications illustrate two theses: (1) formal methods complement conventional requirements analysis processes effectively and (2) formal methods confer benefits even when only selectively adopted and applied. The studies also illustrate the interplay of application maturity level and formal methods strategy, especially in areas such as technology transfer, legacy applications, and rapid formalization, and they raise interesting issues in problem domain modeling and in tailoring formal techniques to applications.dating from the late 1970s and early 1980s. As a result, these analysis and assurance activities remain largely manual exercises lacking well-defined methods or techniques. At the same time, Shuttle flight software is life-critical and increasingly complex, and software upgrades are continually introduced. Upgrades accommodate new missions such as the recent MIR docking; provide new capabilities such as Global Positioning System (GPS) navigation; enhance existing capabilities such as the crew displays for Heading Alignment Cylinder (HAC) initiation; and improve algorithms such as the newly automated three-engine-out contingency abort maneuvers (3E/O), and the recent optimization of Reaction Control System Jet Selection (JS). These upgrades underscore the need recognized in the NASA community and in a recent assessment of Shuttle flight software development for "state-of-the-art technology" and "leading-edge methodologies" to meet the demands of software development for increasingly large and complex systems [NRCC 1993, p. 91]. 1 The work described in this article had three main goals: first, to explore and document the feasibility and utility of formalizing critical Shuttle software requirements representing a spectrum of maturity levels; second, to develop reusable formal methods strategies for representative classes of Shuttle software; and third, to identify and assess key factors in the transfer of this technology to the aerospace community.The Shuttle subsystems selected for the project directly reflect the first two goals. GPS, JS, HAC, and 3E/O are all part of critical on-board flight software. The JS requirements are mature and stable; the 3E/O requirements are somewhat newer, having only recently stabilized after a series of iterations; and the GPS and HAC requirements are relatively new. GPS, JS, and HAC belong to a class of Shuttle software that is readily formalized using a functional model of computation-basically a control function augmented with state variables-and effectively analyzed using standard theorem-proving techniques. By contrast, 3E/O represents a class of modesequencing software that can be quite naturally modeled as a finite-state system and effectively analyzed using st...

The Natural History of Bugs: Using Formal Methods to Analyse Software Related Failures in Space Missions

“…This can be thought of as a form of jet-pack [17]. Other projects have looked at the Shuttle's contingency guidance system [3]. In Europe, the Picgal project has used VDM to analyze ground-based software for launch vehicles similar to Ariane 5 [4].…”

On Software Certification: We Need Product-Focused Approaches

“…There have been some notable industrial and military applications of tool supported formal methods, especially for the analysis of software systems requirements (e.g., [11,12,13,14]). Unfortunately, the formal methods advocates concerned, typically were not given the opportunity to fully integrate their techniques with the overall software engineering process.…”

Abstract Testing: Connecting Source Code Verification with Requirements

“…Noticeable demonstrations of this technique are given by Dutertre and Stavridou [13] in the area of avionics using non-automatic theorem provers. Crow and Di Vito [12] present a summary of four case studies in space craft industry using non-automatic proof systems. An automata based approach that is more closely related to the model checking technique we presented was proposed by Heitmeyer et al [17].…”

“…The techniques available in formal verification range from precise interactive theorem proving on abstract models of the software [12], [20], over fast abstract interpretation procedures [10], [11], [26] (which often, however, possess the drawback of producing many false alarms), to methods based on source code model checking (like counterexample-guided abstraction refinement [5], [18], [19], [28], or bounded model checking [7]). As of today, these techniques are mainly employed in safety-critical areas like the avionics and automotive industry, where high quality standards are vital (besides being required by legal regulations).…”