Integrating Runtime Verification into a Sounding Rocket Control System

Abstract

An actuation fault in the aerobraking control system (ACS) took down Iowa State's Nova Somnium rocket during the 2019 Spaceport America Cup competition, prematurely ending the team's participation. The ACS engaged incorrectly before motor burnout, altering the rocket's trajectory and leading to a dangerous crash. The ability to detect this fault in real time on-board the ACS's Arduino microcontroller would have prevented an uncontrolled landing and rapid unscheduled disassembly, which posed a major safety threat and ended a year's worth of effort by the 50-student team. Runtime verification (RV) specializes in efficiently catching this type of scenario; the R2U2 RV engine uniquely fits in the project's resource constraints. We design specifications to detect ACS faults and trigger the appropriate mitigations. We discuss specification development, validation, coverage, and robustness against false positives. Experimental evaluation on the real, recorded flight data demonstrates that running R2U2 on the Nova Somnium ACS would have prevented this accident from occurring. We generalize our results and outline our plans for integrating runtime verification into future sounding rockets.

R2U2 Version 3.0: Re-Imagining a Toolchain for Specification, Resource Estimation, and Optimized Observer Generation for Runtime Verification in Hardware and Software

“…JAXA is running R2U2 on a 2021 autonomous satellite mission with a requirement for a provable memory bound of 200KB [30]. R2U2 recently verified a CubeSat communications system [24], an open-source UAS [16], a sounding rocket [15], and a high-altitude balloon [23]. The CySat-I satellite uses R2U2 for autonomous fault recovery [2].…”

Introducing formal methodologies to monitor small aerospace system telemetry

“…The sounding rocket, called Nova Somnium, that we utilized for our study was developed by the Cyclone Rocketry team at ISU and is described in greater detail in Hertz et al (2021). It was intended for the ACS to slow the rocket, whose motor was sized to overshoot the target, in order to hit a 30,000 ft apogee as precisely as possible.…”

“…Ultimately, the rocket crashed in the nearby desert where it was tracked down and deemed a total vehicle loss Hertz et al (2021).…”

“…For this reason, we require a specification logic like Linear Temporal Logic (LTL) to provide finite-bounded reasoning for each system. With unique mission profiles for each system, coupled with data reception issues like that described in Hertz et al (2021), we need to encode the system requirements generically with integer-bounded time steps that provide ease of mapping to real mission data. Mission-time Linear Temporal Logic (MLTL) was explicitly designed for this purpose, providing optional integer bounds on temporal operators .…”

“…We examine four aerospace systems developed by different research teams: a high-altitude balloon, a sounding rocket, a UAS, and a cube satellite. Two of these systems -the UAS and the sounding rocket -were investigated in previous studies ; Hertz et al (2021).…”