Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate...

23
Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/2009 1 Establishing IV&V Properties

Transcript of Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate...

Page 1: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Establishing IV&V Properties

Steve Raque, NASA IV&V FacilityDr. Doron Drusinsky, Naval

Postgraduate School

9/4/2009 1Establishing IV&V Properties

Page 2: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Outline• IV&V Objectives for establishing properties• Concepts refresher

– Assertion Statecharts– Uses for Assertion Statecharts in IV&V

• Discovering critical Properties (with examples)– Reentrance– Order & Precedence– Bounded Eventualities– Loops– Invariants

• Integrating with other parts of the SRM

9/4/2009 2Establishing IV&V Properties

•Not mutually exclusive categories•Not all-inclusive

Page 3: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

IV&V Objectives for Establishing Properties

• Common understanding of the system– Precise understanding asserted– Acceptable/unacceptable scenarios

• Provide specific requirements to be found in the developer’s specifications

• Provide specific scenarios and test objectives to be found in the developer’s test program

• Provide scenarios and test objectives for independent testing

• Provide test oracle for verifying the implementation– i.e a mechanism to evaluate the actual results of a test as pass

or no-pass [Binder]• Provide a source for automated verification test generation

9/4/2009 Establishing IV&V Properties 3

Page 4: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Statechart Assertions• Each Statechart Assertion is a formal specification of a “single”

requirement.– It is a requirement, not an implementation of the requirement– Easily represents sequential/temporal logic aspects– It specifies what behavior must be observed, not how it must be implemented– It is compatible with any implementation that produces the specified behavior– One-to-one correspondence of requirements to statechart assertions

improves understanding, allows testing for complex interactions among requirements, and improves reuse.

• StateRover makes them executable by generating JAVA code• Assertion statecharts are Turing equivalent (can perform any computation)

• A statechart assertion is fundamentally a monitoring device that observes system behavior and determines whether that behavior is valid• Dynamic approach - based on runtime state of system during (simulated or

real) execution• Observed behavior is valid when it matches the behavior specification

coded into the assertion, and invalid when it violates the specification• An assertion is run against observable behavior, typically supplied by

some executable artifact running under a test scenario

4

Page 5: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Requirements that come from analysis of the SRM

IV&V Understanding

ofRequirement

IV&V Understanding

ofRequirement

NaturalLanguage

Requirement

Represented By

StatechartAssertion

Formalized By

Validation Test Suite

Validated By

Good and BadScenariosFormalized By

5

SRM UML and Use Case Artifacts

Analysis Creates

Generated fromUML

Page 6: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

DISCOVERING CRITICAL PROPERTIES

9/4/2009 Establishing IV&V Properties 6

Page 7: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

The GRAIL context

9/4/2009 Establishing IV&V Properties 7

Page 8: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Reentrance

9/4/2009 Establishing IV&V Properties 8

Once this sequence (or any main engine burn sequence) begins, we don’t want another burn sequence starting.

Page 9: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Reentrance

9/4/2009 Establishing IV&V Properties 9

At most one propulsion burn sequence (per orbiter) can be active at any given time.

Page 10: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Order and Precedence

9/4/2009 Establishing IV&V Properties 10

Order is important. There is some minimal time for warm-up.

Order is important. There is some maximum time (for efficiency).

Page 11: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Order and Precedence

9/4/2009 Establishing IV&V Properties 11

Page 12: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Bounded Eventualities

9/4/2009 Establishing IV&V Properties 12

It is critical that the main engine burn will happen within some tolerance of the prescribed time.

It is also critical that the constant pitch rate maneuver begins very close to the beginning of the burn and ends very close to the end of the burn

Page 13: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Bounded Eventualities(2)

9/4/2009 Establishing IV&V Properties 13

Once LOI sequence is uploaded, the orbiter will, within the time prescribed by the command sequence parameters (± Δt1), perform a burn for the duration prescribed in the command sequence parameters (± Δt2)

Page 14: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Bounded Eventualities

9/4/2009 Establishing IV&V Properties 14

openFuelValve is mapped to pstartConstantPitchManeuver is mapped to q

closeFuelValve is mapped to pstopConstantPitchManeuver is mapped to q

An alternative that scales to n concurrent events is in the backupAn alternative that scales to n concurrent events is in the backup

Page 15: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Loops

9/4/2009 Establishing IV&V Properties 15

Analysis of the Attitude Control states during the LOI scenario yields loops and transitions that we want to specify out of the system.

• No direct transition• There is likely some prudent dwell time in InertialHold• There is some limit to the overall cycling between SlewAbsolute and a burn state during a period of time

Page 16: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Loops

9/4/2009 Establishing IV&V Properties 16

The Attitude Control subsystem cannot change modes from Slew to LOIDeltaV or visa-versa without being in the InertialHold mode for at least TBD seconds.

Page 17: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Loops

9/4/2009 Establishing IV&V Properties 17

The Attitude Control subsystem can toggle between Slew and LOIDeltaV modes at most TBD times per TBD minutes.

Note how this is a pattern that is applicable to several mode transitions (i.e. not just during LOI)

Page 18: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

More Loops

9/4/2009 Establishing IV&V Properties 18

There is a limit to the number of times we should let the Kalman Filter reset before taking a different action.

Page 19: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

More Loops

9/4/2009 Establishing IV&V Properties 19

Whenever the Kalman filter is reset more than TBD times in a TBD minute interval, then Safe Mode should be entered within TBD seconds afterward

Page 20: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Properties from Hazard Analysis

9/4/2009 Establishing IV&V Properties 20

The DPR instrument shall remain powered OFF from launch until termination of FTS (flight termination system) control.

In the GPM Mission, if the DPR instrument is powered, it causes RF interference with the range safety destruct receiver.

Page 21: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Observations• It is easier to discover critical properties

where humans are not making the critical decisions, the system/software is.

• Knowing the right categories of questions to ask and having a skeptical attitude leads to discovering many potential properties.

• Access to knowledge of the subject area is important to deciding which properties are worth capturing.

9/4/2009 Establishing IV&V Properties 21

Page 22: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

BACKUP

9/4/2009 Establishing IV&V Properties 22

Page 23: Establishing IV&V Properties Steve Raque, NASA IV&V Facility Dr. Doron Drusinsky, Naval Postgraduate School 9/4/20091Establishing IV&V Properties.

Alternative Concurrent Timing

9/4/2009 Establishing IV&V Properties 23

With n>2 events, this approach results in n threads. The previous approach results in n! sequences to draw.


(v)identifythepropertiesofthecomponentsofamixture; · oxide,thereactionofSO2withalkalis.Trioxosulphate(IV) ... (IV),Tetraoxosulphate(VI)acid:Commercialpreparation ... uses. ...

(v)identifythepropertiesofthecomponentsofamixture; · oxide,thereactionofSO2withalkalis.Trioxosulphate(IV) ... (IV),Tetraoxosulphate(VI)acid:Commercialpreparation ... uses. ...

ddec iii iv v class

ddec iii iv v class

Volume: V Issue: IV

Volume: V Issue: IV

VOLUME V RES NANCE SALWAN PUBLIC SCHOOL, GHAZIABAD ... Vol 5.pdf · VIDHI NAGAR IV C AVANTIKA IV B NAMISH V A BHAVIYA V B 80 M HURDLE RACE ADITYA IV C I HARSH V B KRISH BAISOYA IV

VOLUME V RES NANCE SALWAN PUBLIC SCHOOL, GHAZIABAD ... Vol 5.pdf · VIDHI NAGAR IV C AVANTIKA IV B NAMISH V A BHAVIYA V B 80 M HURDLE RACE ADITYA IV C I HARSH V B KRISH BAISOYA IV

Election Parts IV and V

Election Parts IV and V

V Inspire Part IV

V Inspire Part IV

NASA IV&V Facility Software Independent Verification and Validation (IV&V) NASA IV&V Facility Fairmont, West Virginia Judith N. Bruner Acting Director.

NASA IV&V Facility Software Independent Verification and Validation (IV&V) NASA IV&V Facility Fairmont, West Virginia Judith N. Bruner Acting Director.

Plan 1 000 - Rostock · lpb v lpb vi lpb vi lpb v lpb iv lpb iv lpb v lpb vi lpb v lpb v lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv

Plan 1 000 - Rostock · lpb v lpb vi lpb vi lpb v lpb iv lpb iv lpb v lpb vi lpb v lpb v lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv lpb iv

IV&V Robotics

IV&V Robotics

Robotics IV&V

Robotics IV&V

Chapter IV and Chapter V

Chapter IV and Chapter V

Pre Reading IV and V

Pre Reading IV and V

Volume IV Issue V

Volume IV Issue V

IV&V Program How NASA’s Independent Verification and ... · IV&V Program Acknowledgements † Kristin Wortman for inviting the NASA IV&V Program to participate in this workshop

IV&V Program How NASA’s Independent Verification and ... · IV&V Program Acknowledgements † Kristin Wortman for inviting the NASA IV&V Program to participate in this workshop

Mis chapter iv, v

Mis chapter iv, v

III, IV, V Fases Estimulacion

III, IV, V Fases Estimulacion

IV&V Facility 26SEP071 Validation Workshop Dr. Butch Caffall Director, NASA IV&V Facility 26SEP07.

IV&V Facility 26SEP071 Validation Workshop Dr. Butch Caffall Director, NASA IV&V Facility 26SEP07.

IV&V RFP

IV&V RFP

[XLS] · Web viewBALOCHI (PREV) I. II. III. IV. V. I. II. III. IV. V. (PREVIOUS) I. II. III. IV. V. VI. I. II. III. IV. V. VI. VII. VIII. IX. X. I. II. III. IV. V. VI. VII. VIII. IX.

[XLS] · Web viewBALOCHI (PREV) I. II. III. IV. V. I. II. III. IV. V. (PREVIOUS) I. II. III. IV. V. VI. I. II. III. IV. V. VI. VII. VIII. IX. X. I. II. III. IV. V. VI. VII. VIII. IX.

Spinoza’s Ethics IV V

Spinoza’s Ethics IV V