Daniel L. Dvorak

Software architecture themes in JPL's Mission Data System

The rising frequency of NASA mission launches has highlighted the need for improvements leading to faster delivery of mission software without sacrificing reliability. In April 1998 Jet Propulsion Laboratory (JPL) initiated the Mission Data System (MDS) project to rethink the mission software lifecycle-from early mission design to mission operation-and make changes to improve software architecture and software development processes. As a result, MDS has defined a unified flight, ground, and test data system architecture for space missions based on object-oriented design, component architecture, and specific frameworks. This paper describes architectural themes shaping the MDS design and how they help meet objectives for faster, better, cheaper mission software.

Project Golden Gate: towards real-time Java in space missions

Planetary science missions, such as those that explore Mars and Saturn, employ a variety of spacecraft such as arbiters, landers, probes, and rovers. Each of these kinds of spacecraft depends on embedded real-time control systems - systems that are increasingly being asked to do more as challenging new mission concepts are proposed. For both systems engineers and software engineers the large challenges are in analysis, design and verification of complex control systems that run on relatively limited processors. Project Golden Gate - a collaboration among NASAs Jet Propulsion Laboratory, Sun Microsystems Laboratory, and Carnegie Mellon University - is exploring those challenges in the context of real-time Java applied to space mission software. This paper describes the problem domain and our experimentation with the first commercial implementation of the real time specification for Java. The two main issues explored in this report are: (I) the effect of RTSJs nonheap memory on the programming model, and (2) performance benchmarking of RTSJ/Linux relative to C++/VxWorks

Programming with non-heap memory in the real time specification for Java

The Real-Time Specification for Java (RTSJ) provides facilities for deterministic, real-time execution in a language that is otherwise subject to variable latencies in memory allocation and garbage collection. A major consequence of these facilities is that the normal Java practice of passing around references to objects in heap memory cannot be used in hard real-time activities. Instead, designers must think carefully about what type of non-heap memory to use and how to transfer data between components without violating RTSJs memory-area assignment rules. This report explores the issues of programming with non-heap memory from a practitioners view in designing and programming real-time control loops using a commercially available implementation of the RTSJ.

Software architecture themes in JPL's mission data system

Hardware

Update - concept of operations for Integrated Model-Centric Engineering at JPL

The increasingly ambitious requirements levied on JPLs space science missions, and the development pace of such missions, challenge our current engineering practices. 12All the engineering disciplines face this growth in complexity to some degree, but the challenges are greatest in systems engineering where numerous competing interests must be reconciled and where complex system-level interactions must be identified and managed. Undesired system-level interactions are increasingly a major risk factor that cannot be reliably exposed by testing, and natural-language single-viewpoint specifications are inadequate to capture and expose system level interactions and characteristics. Systems engineering practices must improve to meet these challenges, and the most promising approach today is the movement toward a more integrated and model-centric approach to mission conception, design, implementation and operations. This approach elevates engineering models to a principal role in systems engineering, gradually replacing traditional document-centric engineering practices.

A Combinatorial Test Suite Generator for Gray-Box Testing

In black-box testing, the system being tested is typically characterized as a number of inputs, where each input can take one of a number of values. Thus each test is a vector of input settings, and the set of possible tests is an N dimensional space, where N is the number of inputs. For example, an instance of a simulation of a crew exploration vehicles (CEV) launch pad abort scenario can have 76 floating-point inputs. Unfortunately, for such a large number of inputs only a small percentage of the test space can be actually tested. This paper characterizes levels of partial test space coverage and presents Testgen, a tool for generating a suite of tests that guarantees a level of test space coverage, which a user can adapt to take advantage of knowledge of system internals. This ability to adapt coverage makes Testgen a gray-box testing tool.

An Architectural Pattern for Goal-Based Control

Time-based command sequencing is the traditional paradigm for control of spacecraft and rovers in NASAs robotic missions, but this paradigm has been increasingly strained to accommodate todays missions. Goal-based control is a new paradigm that supports time-driven and event-driven operation in a more natural way and permits a melding of sequencing and fault protection into a single control paradigm. This paper describes one approach to goal-based control as an architectural pattern in terms of purpose, motivation, structure, applicability, and consequences. This paper is intended to help flight and ground software engineers understand the new paradigm and how it compares to time-based sequencing.

Analytic verification of flight software

To provide rigorous validation and verification of autonomous flight software for space vehicles, the authors apply two analytic verification approaches: design-time model checking and run-time behavior auditing.

Ontology and modeling patterns for state-based behavior representation

This paper provides an approach to capture state-based behavior of elements, that is, the specification of their state evolution in time, and the interactions amongst them. Elements can be components (e.g., sensors, actuators) or environments, and are characterized by state variables that vary with time. The behaviors of these elements, as well as interactions among them are represented through constraints on state variables. This paper discusses the concepts and relationships introduced in this behavior ontology, and the modeling patterns associated with it. Two example cases are provided to illustrate their usage, as well as to demonstrate the flexibility and scalability of the behavior ontology: a simple flashlight electrical model and a more complex spacecraft model involving instruments, power and data behaviors. Finally, an implementation in a SysML profile is provided.

A unifying framework for systems modeling, control systems design, and system operation

Current engineering practice in the analysis and design of large-scale multi-disciplinary control systems is typified by some form of decomposition - whether functional or physical or discipline-based - that enables multiple teams to work in parallel and in relative isolation. Too often, the resulting system after integration is an awkward marriage of different control and data mechanisms with poor end-to-end accountability. System of systems engineering, which faces this problem on a large scale, cries out for a unifying framework to guide analysis, design, and operation. This paper describes such a framework for semi-autonomous control systems that guides analysis and modeling, shapes control system software design, and directly specifies operational intent. This paper illustrates the key concepts in the context of a large-scale, concurrent, globally distributed system of systems: NASAs proposed array-based Deep Space Network.