SCADE Suite in Space Applications at EADS Astrium Space - PowerPoint PPT Presentation

SCADE Suite in Space Applications at EADS Astrium Space Transportation Astrium Space Transportation David Lesens – 09/10/2008

Astrium Space Transportation Overview  Introduction  Historical use of SCADE at EADS Astrium ST  Why using SCADE? This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed.  The Automatic Transfer Vehicle (ATV)  M51 and Vega  R&T preparing the future  Model transformation  Assessment of SCADE 6  Points to be improved  Conclusion 29/04/2010 p2

Astrium Space Transportation Astrium: part of EADS, a global leader in aerospace and defence No.1 Commercial Aircraft This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. No.1 Helicopters No.2 Missile Systems Astrium No.3 No . 3 Military Transport Aircraft No.4 Military Air Systems 29/04/2010 p3

Astrium Space Transportation Astrium’s activities are based in three key areas Astrium Space Astrium Astrium Transportation Satellites Services This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. The European A world leader in At the forefront of prime contractor the design and satellite services for civil and manufacture of in the secure military space satellite systems communications, transportation Earth and manned observation and space activities navigation fields 29/04/2010 p4

Astrium Space Transportation An impressive product and capability portfolio  Launchers: Ariane, Soyuz, Rockot, Vega  Ballistic missiles, missile defence This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed.  Future launchers  Orbital systems: Columbus, ATV, Operations, Atmospheric re-entry systems  Propulsion & equipment  System design, system integration & production 29/04/2010 p5

Astrium Space Transportation Overview  Introduction  Historical use of SCADE at EADS Astrium ST  Why using SCADE? This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed.  The Automatic Transfer Vehicle (ATV)  M51 and Vega  R&T preparing the future  Model transformation  Assessment of SCADE 6  Points to be improved  Conclusion 29/04/2010 p6

Astrium Space Transportation The classical V development cycle Late detection of errors Spacecraft GNC Data Qualification studies management This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. Error Error detection Delay for the error detection Validation Specification Integration Design Delay for the error correction Unitary Code tests 29/04/2010 p7

Astrium Space Transportation Reduction of delays and costs Spacecraft GNC Data Qualification studies management Decrease the number of late errors This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. Automatic test generation Test replay Immediate correction Software Validation Early Model validation Unitary & integration  Simulation testing  Proof at model level Automatic Code Code Generation Fusion of specification & design 29/04/2010 p8

Astrium Space Transportation Model Driven Engineering A model shall allow :  The communication between the different teams  System teams (GNC, vehicle, thermal, operations,…) This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed.  Software teams (architect, specification, design, development,…)  And also customers and external reviewers  An early verification via a strong semantic, insuring  Consistency  Completeness “Formal” model, and possibility of proof  Non ambiguity  Model simulation  And automatic code generation 29/04/2010 p9

Astrium Space Transportation Model or programming language ? This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. Scade Simulink Ada Abstraction C++ & semantic Matlab or S_functions C Assembly language Binary code 29/04/2010 p10

Astrium Space Transportation Overview  Introduction  Historical use of SCADE at EADS Astrium ST  Why using SCADE? This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed.  The Automatic Transfer Vehicle (ATV)  M51 and Vega  R&T preparing the future  Model transformation  Assessment of SCADE 6  Points to be improved  Conclusion 29/04/2010 p11

Astrium Space Transportation The Automated Transfer Vehicle (ATV)  It supplies onward the following services to the ISS:  Refuelling  ISS orbit correction, This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed.  Freight delivery,  ISS trash destruction.  The ATV mission in 2008  9 th of March Launch by Ariane 5  3 rd of April Automatic Docking on the ISS  5 th of September Dedocking from the ISS  29 th of September Deorbitation  Safety software specified using SCADE V3 29/04/2010 p12

This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. 29/04/2010 Astrium Space Transportation Static description p13 Description of architecture software types and constants Description of

This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. 29/04/2010 Astrium Space Transportation Behavioural description p14 Description of (very) Simple automaton sequences Description of

This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. 29/04/2010 Astrium Space Transportation Automatic documentation generation p15

Astrium Space Transportation Formal proofs on the ATV safety Software Environment description Logical This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. SCADE Property model LESAR tools True property Exhaustive verification Diagnostic The LESAR tool is developed by the VERIMAG laboratory (the same results has now been reached with Prover) 29/04/2010 p16

Astrium Space Transportation Examples of proved properties  Specification of the environment by “regular expressions”  Use of the “reglo” tool cam_arm( on, arm, cam_cmd, tc, hltc ) = prefix( [-on, -arm, -cam_cmd, -tc, -hltc]*. This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed. [ on, -arm, -cam_cmd, -tc, -hltc]. [-on, -arm, -cam_cmd, -tc, -hltc]*. ~~ ) ; (the same result has now been reached with SCADE 6 automata)  Properties  A “red button” implies eventually a CAM triggering before 4 cycles  Real time property  The two MSU chains can not triggered both a CAM at the same time  Mutual exclusion property 29/04/2010 p17

Astrium Space Transportation SCADE V3 on the ATV: Conclusion  Improvement of the specification quality  Suppression of ambiguity (formal semantics)  Early detection of errors by simulation This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed.  Exhaustive proofs of some critical properties  Formal proof has allowed detecting errors (even if formal proof does not replace tests)  Why shall we go further?  Modelling limited to very simple automata  The ATV code has not been automatically generated 29/04/2010 p18

Astrium Space Transportation Overview  Introduction  Historical use of SCADE at EADS Astrium ST  Why using SCADE? This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed.  The Automatic Transfer Vehicle (ATV)  M51 and Vega  R&T preparing the future  Model transformation  Assessment of SCADE 6  Points to be improved  Conclusion 29/04/2010 p19

Astrium Space Transportation Other uses  SCADE V3 has also been used to formalize the specifications:  Of the M51 software This document is the property of Astrium. It shall not be communicated to third parties without prior written agreement. Its content shall not be disclosed.  Of the Vega software 29/04/2010 p20