SCADE Suite in Space Applications

Transcription

1 SCADE Suite in Space Applications at EADS David Lesens 09/10/2008

2 Overview Introduction Historical use of SCADE at EADS Astrium ST Why using SCADE? The Automatic Transfer Vehicle (ATV) M51 and Vega R&T preparing the future Model transformation Assessment of SCADE 6 Points to be improved Conclusion 29/04/2010 p2

3 Astrium: part of EADS, a global leader in aerospace and defence Commercial Aircraft No.1 Helicopters No.1 Missile Systems No.2 Astrium No.3 Military Transport Aircraft No.3 Military Air Systems No.4 29/04/2010 p3

4 Astrium s activities are based in three key areas Astrium Space Transportation The European prime contractor for civil and military space transportation and manned space activities Astrium Satellites A world leader in the design and manufacture of satellite systems Astrium Services At the forefront of satellite services in the secure communications, Earth observation and navigation fields 29/04/2010 p4

5 An impressive product and capability portfolio Launchers: Ariane, Soyuz, Rockot, Vega Ballistic missiles, missile defence Future launchers Orbital systems: Columbus, ATV, Operations, Atmospheric re-entry systems Propulsion & equipment System design, system integration & production 29/04/2010 p5

7 The classical V development cycle Late detection of errors GNC studies Data Spacecraft management Qualification Error Error detection Delay for the error detection Specification Validation Design Code Integration Unitary tests Delay for the error correction 29/04/2010 p7

8 Reduction of delays and costs GNC studies Data Spacecraft management Qualification Decrease the number of late errors Immediate correction Automatic test generation Test replay Early validation Simulation Proof Software Model Validation Unitary & integration testing at model level Automatic Code Generation Code Fusion of specification & design 29/04/2010 p8

9 Model Driven Engineering A model shall allow : The communication between the different teams System teams (GNC, vehicle, thermal, operations, ) Software teams (architect, specification, design, development, ) And also customers and external reviewers An early verification via a strong semantic, insuring Consistency Completeness Formal model, and possibility of proof Non ambiguity Model simulation And automatic code generation 29/04/2010 p9

10 Model or programming language? Abstraction & semantic Scade Ada C++ C Simulink Matlab or S_functions Assembly language Binary code 29/04/2010 p10

12 The Automated Transfer Vehicle (ATV) It supplies onward the following services to the ISS: Refuelling ISS orbit correction, Freight delivery, ISS trash destruction. The ATV mission in th of March Launch by Ariane 5 3 rd of April Automatic Docking on the ISS 5 th of September Dedocking from the ISS 29 th of September Deorbitation Safety software specified using SCADE V3 29/04/2010 p12

13 Static description Description of software architecture Description of types and constants 29/04/2010 p13

14 Behavioural description Description of (very) Simple automaton Description of sequences 29/04/2010 p14

15 Automatic documentation generation 29/04/2010 p15

16 Formal proofs on the ATV safety Software SCADE model Environment description LESAR tools Logical Property Exhaustive verification True property Diagnostic The LESAR tool is developed by the VERIMAG laboratory (the same results has now been reached with Prover) 29/04/2010 p16

17 Examples of proved properties Specification of the environment by regular expressions Use of the reglo tool cam_arm( on, arm, cam_cmd, tc, hltc ) = prefix( Properties [-on, -arm, -cam_cmd, -tc, -hltc]*. [ on, -arm, -cam_cmd, -tc, -hltc]. [-on, -arm, -cam_cmd, -tc, -hltc]*. ~~ ) ; (the same result has now been reached with SCADE 6 automata) A red button implies eventually a CAM triggering before 4 cycles Real time property The two MSU chains can not triggered both a CAM at the same time Mutual exclusion property 29/04/2010 p17

18 SCADE V3 on the ATV: Conclusion Improvement of the specification quality Suppression of ambiguity (formal semantics) Early detection of errors by simulation Exhaustive proofs of some critical properties Formal proof has allowed detecting errors (even if formal proof does not replace tests) Why shall we go further? Modelling limited to very simple automata The ATV code has not been automatically generated 29/04/2010 p18

20 Other uses SCADE V3 has also been used to formalize the specifications: Of the M51 software Of the Vega software 29/04/2010 p20

22 R&T: SCADE 6 for future projects Suborbital flight? ATV Evolution? 29/04/2010 p22

24 Astrium process GNC (*) prototype Matlab/Simulink Need of refinement GNC (*) System requirement capture Mission management KCG UML/SysML Rhapsody Need of refinement SCADE and Ada or C++ (*) Guidance, Navigation, Control 29/04/2010 p24

25 From SysML or AADL to SCADE AADL SCADE model automatically generated SCADE 29/04/2010 p25

26 From Simulink to SCADE Simulink SCADE model automatically generated SCADE 29/04/2010 p26

27 Conclusion: Will we use automatic model transformation? The tools work correctly but our process of use is today not clear! The software model (in SCADE) needs more details than the system model (in SysML/AADL/) Numerical protections Telemetry / Telecommand Real time aspects The software and system architectures are often different The use of automatic model transformation tools is not foreseen today (we remain today in a manual refinement process) 29/04/2010 p27

29 Assessment of SCADE V6 on a case study Ada ATV main software SGS Our objectives Solar Generation System redeveloped in SCADE V6 (automata & data flows) Automatic code generation with KCG Test of the whole software on validation platform 29/04/2010 p29

30 Modelling of data flow architecture The initial architecture in SART The new architecture in SCADE V6 29/04/2010 p30

31 Modelling of Finite State Machine Initial representation of FSM Use of powerful hierarchical automata 29/04/2010 p31

32 Modelling of activation condition Specification of activation condition in SART (Process Activation Table) Formalization of activation condition by SCADE 6 automata 29/04/2010 p32

33 Modelling of simple mathematical equation Specification of simple monitoring Modelling of monitoring in SCADE V6 29/04/2010 p33

34 Assessment of SCADE 6: Conclusion A complete functionalities of the ATV has been redeveloped in SCADE V6 Architecture and data flows Complex hierarchical automata and sequences Verified by simulation (coverage checked by MTC) Remaining work for 2008 Test on validation platform Integration to our Software Development Environment (SDE) Configuration management, traceability Windows / Unix We will be ready to start an operational development in SCADE 6 in /04/2010 p34

36 SCADE 6 has very powerful automata 29/04/2010 p36

37 but not very intuitive for reviewers (*)! <SM1> (*) Non SCADE users State1 1 Strong without history State4 true 1 1 true State2 Weak without history true Synchronized without history 29/04/2010 p37 Weak with history State5 true State7 * * 1 1 true 1 true * State3 State6 Strong with history Synchronized with history

38 Graphical or textual? Some times a textual description is better than a graphical one z = (a * x) + (b * y) + c; But operators +, -, *, / can not be overloaded Equations with vectors and matrixes are not naturally written 29/04/2010 p38

39 The textual editor can be improved! The layout is modified after saving 29/04/2010 p39

40 SCADE generates today only C A textual description/programming language is needed SCADE and C are not enough Automatic Ada code generation would be a solution ACCELERATION POSITION Adapted to embedded software Would improve the typing? VELOCITY Name ACCELERATION POSITION VELOCITY Type T_ ACCELERATION T_POSITION T_ VELOCITY KCG for Ada is in the Esterel Technologies roadmap 29/04/2010 p40

41 Basic data types are missing! A library is supplied for integer 8, 16, 32 bits But the user shall developed its own library for simple and double float precisions 29/04/2010 p41

42 Use of clock activate MODE MODE1 A1 2 Y1 MODE MODE2 Input1 A2 2 Y2 MODE Output1 The generated code is very good 29/04/2010 p42 MODE A3 MODE3 2 Y3 Too much variables shall be defined switch (MODE) { case MODE2 : Output1 = A2(Input1); break; case MODE1 : Output1 = A1(Input1); break; case MODE3 : Output1 = A3(Input1); break;

43 Frequency 10Hz No multithreading code generation A Rate Monotonic Scheduling is compatible with the synchronous approach and would be useful Frequency 20Hz Thread end Frequency 100 Hz Thread end Thread Thread end end Thread end Thread end Thread end 10 ms RDV 50 ms 29/04/2010 p43

45 Conclusion SCADE V3 has been successfully used in the past On a limited scope A full SCADE V6 development is foreseen for future projects Editor, Simulator Model Test Coverage (MTC) Design Verifier Qualified Code Generator (KCG) with the hope of some improvements / additional features in future versions! Especially Ada qualified code generator 29/04/2010 p45

46 Thank you for your attention Any question? 29/04/2010 p46