Nicolas Rouquette

Spacecraft Autonomy Flight Experience: The DS1 Remote Agent Experiment

In May 1999 state-of-the-art autonomy technology was allowed to assume command and control of the Deep Space One spacecraft during the Remote Agent Experiment. This experiment demonstrated numerous autonomy concepts ranging from high-level goaloriented commanding to on-board planning to robust plan execution to model-based fault protection. Many lessons of value to future enhancements of spacecraft autonomy were learned in preparing for and executing this experiment. This paper describes those lessons and suggests directions of future work in this field.

Using empirical testbeds to accelerate technology maturity and transition: the SCRover experience

This paper is an experience report on a first attempt to develop and apply a new form of software: a full-service empirical testbed designed to evaluate alternative software dependability technologies, and to accelerate their maturation and transition into project use. The SCRover testbed includes not only the specifications, code, and hardware of a public safety robot, but also the package of instrumentation, scenario drivers, seeded defects, experimentation guidelines, and comparative effort and defect data needed to facilitate technology evaluation experiments. The SCRover testbeds initial operational capability has been recently applied to empirically evaluate two architecture definition languages (ADLs) and toolsets, Mae and AcmeStudio. The testbed evaluation showed (1) that the ADL-based toolsets were complementary and cost-effective to apply to mission-critical systems; (2) that the testbed was cost-effective to use by researchers; and (3) that collaboration in testbed use by researchers and the Jet Propulsion Laboratory (JPL) project users resulted in actions to accelerate technology maturity and transition into project use. The evaluation also identified a number of lessons learned for improving the SCRover testbed, and for development and application of future technology evaluation testbeds.

An ontology for State Analysis: Formalizing the mapping to SysML

State Analysis is a methodology developed over the last decade for architecting, designing and documenting complex control systems. Although it was originally conceived for designing robotic spacecraft, recent applications include the design of control systems for large ground-based telescopes. The European Southern Observatory (ESO) began a project to design the European Extremely Large Telescope (E-ELT), which will require coordinated control of over a thousand articulated mirror segments. The designers are using State Analysis as a methodology and the Systems Modeling Language (SysML) as a modeling and documentation language in this task. To effectively apply the State Analysis methodology in this context it became necessary to provide ontological definitions of the concepts and relations in State Analysis and greater flexibility through a mapping of State Analysis into a practical extension of SysML. The ontology provides the formal basis for verifying compliance with State Analysis semantics including architectural constraints. The SysML extension provides the practical basis for applying the State Analysis methodology with SysML tools. This paper will discuss the method used to develop these formalisms (the ontology), the formalisms themselves, the mapping to SysML and approach to using these formalisms to specify a control system and enforce architectural constraints in a SysML model.

The 13/sup th/ technology of Deep Space One

This paper describes an innovative approach to spacecraft fault protection based on automatic code-generation techniques.

Ontology and modeling patterns for state-based behavior representation

This paper provides an approach to capture state-based behavior of elements, that is, the specification of their state evolution in time, and the interactions amongst them. Elements can be components (e.g., sensors, actuators) or environments, and are characterized by state variables that vary with time. The behaviors of these elements, as well as interactions among them are represented through constraints on state variables. This paper discusses the concepts and relationships introduced in this behavior ontology, and the modeling patterns associated with it. Two example cases are provided to illustrate their usage, as well as to demonstrate the flexibility and scalability of the behavior ontology: a simple flashlight electrical model and a more complex spacecraft model involving instruments, power and data behaviors. Finally, an implementation in a SysML profile is provided.

Verification and semantic parallelization of goal-driven autonomous software

Future space missions such as the Mars Science Laboratory demand the engineering of some of the most complex man-rated autonomous software systems. According to some recent estimates, the certification cost for mission-critical software exceeds its development cost. The current process-oriented methodologies do not reach the level of detail of providing guidelines for the development and validation of concurrent software. Time and concurrency are the most critical notions in an autonomous space system. In this work we present the design and implementation of a first concurrency and time centered framework for verification and semantic parallelization of real-time C++ within the JPL Mission Data System Framework (MDS). The end goal of the industrial project that motivated our work is to provide certification artifacts and accelerated testing of the complex software interactions in autonomous flight systems. As a case study we demonstrate the verification and semantic parallelization of the MDS Goal Networks.

Mining Requirements Knowledge from Operational Experience

This chapter reports results from two recent studies of how operational experience with mission-critical product lines can enhance knowledge management for use with their future products. The challenge was how to propagate new requirements knowledge forward in a product line in ways that projects will use. In the first product line, the concern was capture and retention of requirements knowledge exposed by defects that occurred during operations. This led to two mechanisms not traditionally associated with requirements management – feature models extended with assumption specifications (formal) and structured anecdotes of paradigmatic product-line defects (informal). In the second product line, the traditional notion of binding time in a product line did not accurately reflect the timing of project decisions. This led to a definition of product-line binding times that better accommodates the varying requirements of the different missions using the product line. It appears that the practical techniques reported here to build requirements knowledge into software product lines in the spacecraft domain also are useful in other product-line developments.

Integrating analytical models with descriptive system models: implementation of the OMG SyML standard for the tool-specific case of MapleSim and MagicDraw

Abstract The Jet Propulsion Laboratory (JPL) is investing heavily in the development of an infrastructure for building system models using the Systems Modeling Language (SysML). An essential component is a transformation apparatus that permits diverse models to be integrated independently of their nature (e.g. declarative, analytical and statistical). This paper presents one useful case: the integration of analytical models expressed using the Modelica language. Modelica is an open standard, declarative, multi-domain modeling language that allows for complex dynamic systems to be modeled. Maplesofts MapleSim is one software tool that supports the Modelica language. The tool-neutral specification for the transformation between the languages Modelica and SysML is defined in the SysML-Modelica transformation specification (SyML) standard published by the Object Management Group (OMG). As part of the development efforts, said specification has been implemented using the Query-View- Transformation Operational (QVTO) language. During the process, several critical changes to the current SyML standard were proposed. Furthermore, a number of current limitations related to MapleSim were identified. Despite these issues, a proof-of- concept transformation was successfully implemented. In conclusion, the integration of complex simulation models conforming to the Modelica language with SysML-based system models has shown great promise and is a highly useful tool to support the decision making process in design.

Semantically Enhanced Containers for Concurrent Real-Time Systems

Future space missions, such as Mars Science Laboratory, are built upon computing platforms providing a high degree of autonomy and diverse functionality. The increased sophistication of robotic spacecraft has skyrocketed the complexity and cost of its software development and validation. The engineering of autonomous spacecraft software relies on the availability and application of advanced methods and tools that deliver safe concurrent synchronization as well as enable the validation of domain-specific semantic invariants. The software design and certification methodologies applied at NASA do not reach the level of detail of providing guidelines for the development of reliable concurrent software. To achieve effective and safe concurrent interactions as well as guarantee critical domain-specific properties in code, we introduce the notion of a Semantically Enhanced Container (SEC). A SEC is a data structure engineered to deliver the flexibility and usability of the popular ISO C++ Standard Template Library containers, while at the same time it is hand-crafted to guarantee domain-specific policies. We demonstrate the SEC proof-of-concept by presenting a shared nonblocking SEC vector. To eliminate the hazards of the ABA problem (a fundamental problem in lock-free programming), we introduce an innovative library for querying C++ semantic information. Our SEC design aims at providing an effective model for shared data access within the JPLs Mission Data System. Our test results show that the SEC vector delivers significant performance gains (a factor of 3 or more) in contrast to the application of nonblocking synchronization amended with the traditional ABA avoidance scheme.

Using Defect Reports to Build Requirements Knowledge in Product Lines

In a recent study of a product line, we found that the defect reports both (1) captured new requirements information and (2) implicated undocumented, tacit requirements information in the occurrence of the defects. We report four types of requirements knowledge revealed by software defect reports from integration and system testing for two products in this highdependability product line. We argue that storeandretrievebased requirements management is insufficient to avoid recurrence of these types of defects on upcoming members of the product line. We then propose the use of two mechanisms not traditionally associated with requirements management, one formal and one informal, to improve communication of these types of requirements knowledge to developers of future products in the product line. We show how the two proposed mechanisms, namely feature models extended with assumption specifications (formal) and structured anecdotes of paradigmatic productline defects (informal), can together improve propagation of the requirements knowledge exposed by these defects to future products in the product line.