Small Spacecraft Software Modeling: A Petri Net-Based Approach

Transcription

1 SSC13-VIII-3 Small Spacecraf Sofware Modeling: A Peri Ne-Based Approach Levi, Pasha Missouri Universiy of Science and Technology 400 Wes 13h Sree, Rolla, MO ; lmnn3@ms.edu Faculy Advisor: Hank Pernicka Missouri Universiy of Science and Technology ABSTRACT Sofware design and developmen ofen presens a high-risk elemen during he execuion of engineering projecs due o devaluaion of possible conflics or idenifying defecs during lae sages of developmen. Many defecs idenified during he lae sages of small spacecraf developmen can be avoided by consrucing ineracive, dynamic models. This process is ofen followed for hardware fabricaion/es, bu ofen no o he same exen for sofware. An alernaive process o he ypical sofware developmen is needed ha enables modeling and simulaion feedback a early design sages. Peri nes allow for sofware visualizaion, simulaion and verificaion in a cos-effecive way. An alernaive sofware modeling approach using Peri nes is presened o rapidly design, develop and verify/validae small spacecraf sofware. Using he presened echniques, he Missouri Universiy of Science and Technology Saellie Research Team successfully demonsraed core funcionaliy of heir sofware sysem a he Final Concep Review (FCR) of AFRL s Universiy Nanosa Program s Nanosa-7 Compeiion. INTRODUCTION The key aribues differeniaing hardware and sofware developmen include idenifying defecs, visualizing sofware achiecure, and esing. Idenifying sofware defecs usually occurs during he implemenaion phases of developmen causing large budge and schedule overruns. Defecive hardware designs are prevened and idenified during design phases by evaluaing compaibiliy of inegraed componens and he designer s comprehension of he implicaions of connecing componens. Visualizing sofware archiecure is normally realized by creaing funcional block, iming, class, and numerous oher diagrams. This process aemps o capure he srucure and ineracions of a dynamic sysem hrough saic mehods, analogous o analyzing a hreedimensional srucure CAD model via wo-dimensional prinous. Addiionally, undersanding he meaning of hese diagrams requires previous sofware modeling experience ha is no ypically found in hose individuals wih echnical managemen posiions. Sofware esing is approached by aemping o idenify and es all failure cases, subsequenly recifying found defecs. Hardware esing involves he creaion of virual model simulaions ha are used o idenify design flaws and subsequenly improve designs prior o fabricaion and physical ess. Similar models should be incorporaed in sofware developmen o idenify and remove defecs, provide useful graphical realizaions, and encourage ineracive design. Model-driven sofware engineering mehods in spacecraf applicaions have recenly emerged o solve hese problems. Using his mehodology, sofware models are buil and subsequenly auocoded or ac as a blueprin for manual implemenaion. Mos noably, he SPIN model [1], Simulink [2], and UML Saechars [3] are used in indusry o creae model diagrams and perform model-checking. SPIN models are specified using Promela [4], which naively lacks basic consrucs like floaing-poin daa ypes. Simulink models are nonformal, synchronous represenaions ha canno simulae he nondeerminism inheren in concurren sysems. Saechars creae formal models, bu place resricions on he designs and canno fully represen real sofware concurrency. Addiional ools have been developed o augmen he downsides of he aforemenioned ools, bu involve convering models o differen specificaions, are ool specific, and requires managemen of more arifacs. In his paper, a new mehod for modeling small spacecraf sofware using he expressive power of Peri nes o accuraely design sofware is presened. The diagrams produced during his process provide explici definiions of sofware inerfaces and ineracions, while he formal mahemaic definiion verifies sofware correcness. Moivaion The Missouri Universiy of Science and Technology Saellie Research Team (M-SAT) has paricipaed in 1 27 h Annual AIAA/USU

2 four of he eigh UNP Nanosa compeiions, mos recenly placing second in Nanosa-7. The spacecraf mission proposed and developed consised of one microsaellie and one smaller microsaellie in a maed configuraion, as shown in Figure 1. The larger saellie, MR SAT, possesses wo visual imaging cameras ha provide he capabiliy o perform sereoscopic imaging. In orbi, he maed spacecrafs separae wih he inenion of MR SAT racking he smaller saellie, called MRS SAT. MR SAT uses sereoscopic imaging o deermine he relaive posiion vecor o MRS SAT, and nominally mainains a en meer separaion. Figure 1: Maed (lef) and Deployed (righ) Configuraions The developmen of MR SAT and MRS SAT has required he involvemen of many sudens from diverse academic backgrounds. Inroducing conceps such as sofware archiecure and developmen can prove o be a nonrivial ask, as sudens end o avoid areas wih which hey are no familiar. Along wih he high-urnover rae of suden researchers, various aspecs of he spacecraf developmen progress more quickly han ohers. This also makes effecive, inerdisciplinary communicaion boh sressful and criically imporan. Specifically regarding sofware, diagrams are much easier o undersand han reading source code, while animaions have proven o be highly effecive communicaion and explanaory ools for ransiioning members ino sofware developmen roles. The aim of he auhors of his aricle is o no only presen a decomposiional mehod of sofware sysem modeling for small spacecraf, bu also o encourage small saellie developers o consider adoping descripive sofware archiecure visualizaion. Advanced graphics and animaions are insrucive and foser inerdisciplinary communicaion, which begins wih he abiliy o presen he maerial. Wih he high-urnover rae of sudens inimaly ied wih universiy research eams, quickly educaing younger eam members is imperaive for success. I is hoped ha his paper will encourage oher small spacecraf developmen eams o consider he use of Peri ne-based sofware models as an inegral role of developmen. SOFTWARE MODELING Decomposing he high-level descripions of small spacecraf sofware funcionaliy should sar during he concepual and requiremen analysis phases. The Concep of Operaions (CONOPS) [5] defines he Modes of Operaion of he sysem, ofen execued in a sequenial order. Each mode is furher divided ino ordered or cyclic execuion of specific asks. The srucural and emporal organizaion of hese asks guaranee objecives are achieved. The organizaional consrains of asks are ypically saed during he design phase where iming and performance requiremens are defined. This leads o a clear separaion of sysem responsibiliies and undersanding of modeled sofware. Peri nes provide an inuiive, graphical represenaion ha enables modeling of complex sysems. Presened below is a simple, bu effecive, modeling archiecure ha was used o creae he core funcionaliy of he Command and Daa Handling (C&DH) sofware implemened in he M-SAT research eam s spacecraf. PETRI NETS Peri nes (PN) are direced sae-ransiion graphs based on radiional auomaa heory. Peri nes are ofen used o verify sysem properies, simulae concurren sysems, and analyze emporal aribues of sysems. Many exensions have been creaed o enhance he expressive modeling capabiliies for use in many engineering problems. Colored Peri nes (CPN) are exensions of Peri nes ha allow he assignmen of daa ypes o nodes of he modeled sysem. CPNs are referred o hroughou his documen as he abiliy o assign daa ypes allows sofware sysems o be realized more effecively. Two ypes of nodes exis: places and ransiions, represened by an oval and recangle respecively. Places denoe he various sofware saes, while ransiions deermine a change of saes. Places and ransiions are conneced hrough arcs (edges), which represen daa ransfer. Places can only connec o ransiions and are he inpu places of hose ransiions. Transiions connec o places and are he oupu places of hose ransiions. Places can conain okens ha represen daa in he sysem. Tokens belong o color ses ha associae daa ypes o okens. Places can only conain okens of a specific ype, denoed by a label locaed o he boom lef of a place, shown in Figure 2 on he following page. The okens in a CPN can represen any daa ype one would use in implemenaion, wheher i be a Boolean value or an objec srucure. The combinaion of okens disribued over he ne s places represen a configuraion of he sof h Annual AIAA/USU

3 ware, called a marking. The iniial marking is defined by he sysem modelers and represens configuring he sysem o a known sae. Transiions opionally conain A Sae A Bool Perform Acion Sae B In B Sae A Bool Perform Acion Sae B In Figure 2: Simple CPN Transiion Firing guards, in he form of predicaes, used o selec okens from inpu places. If a ransiion s guard evaluaes o rue, i is said o be enabled and can fire. When a ransiion is enabled, oken(s) are consumed from is inpu place(s), and okens are deposied o is oupu place(s). The ransiions also conain logic so ha hey can aler consumed okens, or simply creae new okens for heir oupu place(s). A simple Peri ne is shown in Figure 2 o illusrae he behavior of a Boolean oken in Sae A enabling a ransiion. The Perform Acion ransiion fires and oupus a oken o is oupu place, Sae B. Formalism and Benefis The formal definiion of Peri nes is shown in Definiion 1 [6], which relaes he previous descripion o he mahemaical background. Corresponding graphical represenaions are presened on he righ of he definiion. The formal definiion provides he abiliy o simulae and validae CPNs. More imporanly, he developers do no need a srong undersanding in he formal definiion, as he CPN ediors will perform synacical and semanic checking during simulaion/verificaion. This leaves he role of he developers o graphically lay ou he srucural componens, creae declaraions, and define ne inscripions. The funcional aspecs of sofware modeling are he developer s responsibiliy, while he nonfuncional operaions are managed by he ediing ools. A formal proof is required o demonsrae ha he specificaion of he sysem is 100% correc. Given a CPN wih an iniial marking, every possible sofware sae is enumeraed ino a sae space graph or reachabiliy graph. From an iniial marking, he reachabiliy graph conains every possible sequence of saes in which he sysem can reside. The verificaion of he sysem comes from he reachabiliy graph s properies. Such properies include minimum/maximum amoun of okens on a place, erminaion saes, iming of ransiion firings, and wheher he sysem always erminaes in he same place or no. More complex properies, such as one sae preceding anoher, can be verified hrough model checking wih emporal logic [7]. Togeher, he graphical and mahemaical represenaion of Peri nes assis in inerdisciplinary undersanding. The graphical represenaion provides a clear srucural view of he designed sysem. Viewers can easily see he connecions and ineracions beween various objecs and modules. By coupling his wih he mahemaical definiion, he dynamic ineracion and sae evoluion can be observed. Wih CPN ools [8], he simulaion funcion animaes ransiions firing and movemen of okens hroughou he sysem. Conflics in he design are recognizable; if all ransiions cease firing, hen he sysem is in a haled sae. Showing he consequences of requiremen or design defecs in his manner is a powerful persuasion ool for immediae correcive acions. I should also be noed ha CPNs canno formally verify sysems wih large number of saes, due o sae-space explosion. Various echniques mus be incorporaed o ensure an equivalen sae space can be calculaed. An inuiive mehod is o verify differen secions of he model and hen merge each verified secion ino a single place or ransiions. The represenaive places/ransiions ac as a black box in place of he full subne. Furhermore, he naure of small spacecraf sofware inherenly reduces occurrences of sae space explosion. Smaller spacecraf lead o fewer communicaing modules, leading o fewer saes ha reduces he risk of sae-space explosion. This concep has moivaed using he expressive power of Peri nes o model and verify he correcness of complex small spacecraf sofware. Modeling Tools Many soluions exis for modeling Peri nes, each having heir benefis and downsides. CPN Tools is widely used as i provides graphical modeling, hierarchical srucures, performance-based analysis, simulaion and sae space verificaion mehods [8]. Models can be quickly consruced using he easy-o-use graphical inerface and subsequenly simulaed. Currenly, no packages exis o conver CPN Tools models o procedural languages, such as C or C++, bu sill have he abiliy o ac as a blueprin for sofware consrucion. SNAKES [9] is a Pyhon library ha allows rapid Peri ne prooype consrucion, simulaion, sae space veri h Annual AIAA/USU

4 Definiion 1. A Colored Peri Ne is a nine-uple, CP N = (P, T, A, Σ, V, C, G, E, I), where: (1) P is a finie se of places. Place (2) T is a finie se of ransiions T such ha P T = Transiion. (3) A P T T P is a se of direced arcs. (4) Σ is a finie se of non-empy color ses. colse name = ype; (5) V is a finie se of yped variables such ha var name : colse_name; T ype[v] Σ variables v V. (6) C : P Σ is a color se funcion ha assigns a color se o each place. (7) G : T EXP R V is a guard funcion ha assigns a guard o each ransiion such ha T ype[g()] = Bool. (8) E : A EXP R V is an arc expression funcion ha assigns an arc expression o each arc a such ha T ype[e(a)] = C(p), where p is he place conneced o arc a. (9) I : P EXP R is an iniializaion funcion ha assigns an iniializaion expression o each place p such ha T ype[i(p)] = C(p). Place [guard expr] COLOR_SET Transiion var name Place INIT MARK ficaion mehods, visualizaion hrough GraphViz [10], user-defined exensions and impor/expor capabiliies using he sandard Peri Ne Markup Language (PNML) [11]. Recenly, he power of PNML-formaed Peri nes has been exended hrough he SNAKES-based Neco high-level Peri ne compiler. Neco provides he capabiliy o compile models ino libraries callable from any C-compaible language [12]. The process of compiling sofware models direcly o code is a move oward hardware-like developmen, where schemaics or CAD models are used o creae componens. Removing he implemenaion sep reduces he risk of developers misinerpreaion of design models or defecs inroduced hrough ypographical misakes. Sysem Descripion Figure 3 illusraes an example spacecraf consising of physical subsysems communicaing via a daa bus. The C&DH subsysem can be viewed as he maser of he sysem: delegaing asks and responsible for high-level acions in he sysem. Each subsysem has heir own microprocessor and manages a small number of peripherals. The main funcion of hese subsysems is o inerpre C&DH commands o inerac wih peripherals and respond wih daa. The mehods presened will perain o modeling of he sofware sysem developed for a C&DH sysem. The remaining subsysems sofware are lef as represenaive ransiions in he overall CPN. Table 1 defines he various color ses used hroughou his aricle. Table 2 oulines he funcions used in he examples presened. For breviy, only he color ses and funcions used in examples are presened. ORBIT C&DH PROP THM Daa Bus COMM ADAC Payload POWER Figure 3: Example High-Level Compuaional Srucure 4 27 h Annual AIAA/USU

5 Table 1: Model Color Ses Name Definiion Descripion BOOL bool Boolean daa ype ha can be eiher rue or false. BYTE in wih Defines a single bye daa ype. JOB ID wih deumble mission_mode_one mission_mode_n; record jobid:job_ids * askid: TASK_ID * prioriy:int; Enumeraion of unique Job IDs defined by he model. A srucure conaining he s owner Job ID, he s ID, and prioriy. TASK ID wih ask_a ask_b; Enumeraion of unique IDs defined by he model. record jobid:job_ids * askid: A srucure conaining he s owner Job ID, he TASK_ID * prioriy:int; s ID, and prioriy. BusCmd BusResp record owner: * addr:byte * daa: BYTE; record owner: * from:byte * daa: BYTE; Srucure used for sending daa o subsysems. Idenifies he owner, recipien address and daa o ransfer. Srucure used for receiving daa o subsysems. Idenifies he owner, sender address and daa received Table 2: Model Funcions Name Definiion Descripion bus guard fun bus_guard( ask:, graned_ask: ) = if (#jobid graned_ask)=(#jobid ask_rec) andalso (#askid graned_ask)=(#askid ask_rec) hen rue else false Ensures ask and graned ask are equivalen by comparing heir owner Job IDs and IDs. bus resp guard fun _guard( :BusCmd, : BusResp ) = if (#owner )=(#owner ) andalso (#addr )=(#from ) hen rue else false Evaluaes o rue if and only if he bus cmd and bus resp owner s are equivalen and recipien address maches he received address. prioriy sor fun prioriy_sor(:, 2:) = (#prioriy ) < (#prioriy 2); Used as a funcion handle for he sor funcion in CPN Tools. prioriy sor is used o deermine how precedence should deermined h Annual AIAA/USU

6 METHODS Mission Lifecycle Represenaion Modeling he high level sofware saes coincides wih consrucion of he CONOPS. Concepualizing a spacecraf mission usually sars as a series of bulle poins in a noepad. Afer deliberaions and ieraions, he firs level bulle poins represen mission modes. The order of he mission modes may no be defined ye, bu can be represened as a place named respecively. Adding ransiions beween he places idenifies he precedence of mission modes. Figure 4 displays how he sequence of operaion modes are conneced in CPN Tools. The double-ouline recangles are known as subsiuion ransiions, which are fundamenal hierarchical blocks or absracions. Essenially, every subsiuion ransiion is represened by anoher Peri subne, ha is separae from he curren ne, as shown in Figure 5. Subnes defined as subsiuion ransiions have a single enry poin, called he inpu socke, where he okens from conneced places are deposied. Similarly, hey conain a place denoed as he oupu socke, which acs as he single poin of exi from ha subne. Inernally, he subsiuion ransiions represen anoher CPN ha conains he operaions performed. An imporan characerisic of hese ypes of ransiions is ha hey are insances. They can be reused in oher pars of he CPN and independenly behave in he exac same manner. In rue on Power On BOOL Mission Mode N Iniialize Iniialize ExecueMMN ExecueMMN ExecueMM1 ExecueMM1 Deumble End-of-Life Mission Mode One performdeumble performdeumble Figure 4: C&DH Sofware Lifecycle Peri Ne Power On rue BOOL Iniialize Ou Deumble Figure 5: Defaul Iniialize Subsiuion Transiion Using CPN Tools o simulae he diagram in Figure 4 would sar wih a single Boolean-ype oken locaed in he Power On place. This is idenified by he rue label locaed above Power On; his is he iniial marking. The place-ype of Power On mus mach he ype of he iniial marking, oherwise an error occurs and a message is displayed. Iniialize is immediaely enabled and fires, placing a oken on he inpu socke place of he Iniialize subne. By defaul, he subpage represening he subsiuion ransiion is simply he inpu and oupu socke conneced by a ransiion. Simulaion coninues by firing enabled ransiions in Iniialize. Once a oken is placed ono he oupu socke place of Iniialize, he oken is placed on Deumble. Simulaion coninues following he above process unil here are no enabled ransiions, which is when ExecueMMN finishes and a oken is locaed on End-of-Life. Mission Mode Operaions as Jobs The subsiuion ransiions connecing mission modes are defined as Jobs. Jobs represen a complex organizaion of compuaions composed from smaller, indivisible unis. The organizaion of hese unis make he Job unique and define is operaional behavior. The basic building-block unis are defined as s. s are analagous o inegraed circuis; hey are used in a sysem design o achieve a specific purpose wih clearly defined inpus and oupus. Knowing he inernal srucure of he is no necessary for is use in a sysem, as long as here exiss a clear inerface and an expeced operaion. Figure 6 depics a simple Job subne where wo s are sequenially execued. More inricae schemes can be represened, like requesing muliple execuion simulaneously, by adding addiional places on he Job ne conneced o Inpu Acions and Oupu Acion. Funcional Requiremens as s The primary design principle behind a is ha here should only exis one funcional C&DH requiremen raced o a. This significanly reduces he complexiy of a given and increases reuse. s should be considered as he fundamenals unis, where some configuraion of hem creaes a composie srucure. When verifying composie srucures, he process can be broken by verifying each consiuen. Upon a consiuen uni passing, a represenaive srucure replaces i in he composed CPN. Once all unis are verified, hen he overall CPN wih represenaive uni nes can be verified hrough sae space analysis. This is a powerful opimizaion echnique for verifying a sysem represened by a large number of saes. Jobs conrol when s should execue, based on sysem parameers and he global sysem sae. To iniiae his sequence, Jobs place oken(s) on Sar enabling Add Informaion where supplemenary informaion, such as resources needed, is added. Figure 7 displays a generic srucure used as a modeling 6 27 h Annual AIAA/USU

7 Mission Mode In Sar B _b Ou [#jobid 2=#jobId, #askid 2=#askId ] Exi Mission Mode 2 [#jobid 2=#jobId, #askid 2=#askId ] Inpu Acions 2 Sar A _a 2 inpu (); oupu (2); acion (#jobid 2=mission_mode_one; Inpu #askid 2=ask_a Requesed #prioriy 2=1); 2 Complee 2 Finished 2 Oupu Acions 2 Oupu Requesed 2 Exi MM inpu (); oupu (2); acion (#jobid 2=mission_mode_one; #askid 2=ask_b #prioriy 2=1); Inpu Complee JOB Oupu Complee JOB Figure 6: Basic Job Subne emplae. Every mus conain he Microkernel inerface as ha module conrols execuion and resource managemen. The colored boxes on he lef means ha he marking of a place is shared beween all places in a fusion se. Concepually, his capabiliy can be hough of as any global eniy whose sae mus be known hroughou he sysem. Commonly his includes daa buffers, singleon modules, module inerfaces, and daa buses hroughou he sysem. To clarify, singleon modules are any module resriced o one insance in he sysem. A Microkernel is referred o as a singleon, because only one Microkernel is allowed o schedule and execue s. Noe ha s are no required o use he communicaion bus, bu any global module or resource inerface can exis here. The only requiremen is ha if a is using a global module or resource, i mus explicily reques hose resources from he Microkernel. Once a is allowed o execue, graned_ask conains he informaion of he ha is able o execue. The Microkernel passes his informaion hrough Graned Execuion. If maches graned_ask, hen Send Bus Cmd is enabled and fires. The brackeenclosed saemen above Send Bus Cmd is he guard ha enforces his rule. Comparing he okens is necessary since all s conneced o he Microkernel will receive he oken, bu only a specific should execue. Once Send Bus Cmd fires, a oken is placed on bus send, which enables he firs ransiion wihin he Bus Handler, shown in Figure 8. Wihin he Bus Handler, bus send passes he Sar _n Add Informaion Wai for Exec. Reques Execuion Reques [#addr =PWR_ADDR] [#addr =ADAC_ADDR] Send o Power Send o ADAC bus_send bus_send Bus Inerface bus_re Reurn [bus_guard(, graned_ask] BusCmd BusResp [_guard(,resp)] resp Send Bus Cmd Waiing on response Acion wih Daa graned_ask Gran inpu (); oupu (,); acion (send_askx_()); Microkernel Gran Execuion Inerface Complee Complee bus_send bus_send BusCmd [#addr =COMM_ADDR] Send o Comm. [#addr =THM_ADDR] [#addr =PAYLOAD_ADDR] [#addr =PROP_ADDR] [#addr =ORBIT_ADDR] Send o Thermal Send o Payload Send o Prop. Send o Orbi Reurn bus_reurn BusResp Figure 7: Generic Srucure and righ sides represen inerfaces o he daa bus and Microkernel, respecively. Inerface places belong o a fusion se, denoed by he purple fusion se ag labels. The name on he fusion se ag indicaes which fusion se a place belongs o. Fundamenally, fusion ses conain any number of places ha ac as a single sae. This Figure 8: Generic Bus Handler oken o all conneced subsysems. For illusraive purposes, represenaive ransiions are conneced o bus send ha can be replaced by subsiuion ransiions for a complee model. In his example, here is an assumpion ha he bus communicaion proocol requires conneced componens o be uniquely addressed followed by he daa. Each subsysem corresponding 7 27 h Annual AIAA/USU

8 ransiion conains a [#addr =SUBSYSTEM_ADDR ] guard ha evaluaes wheher he desinaion of is equivalen o a pre-defined consan. If i does no mach, hen he subsysem does no respond o he sen message. For example, if a oken addressed o he Power subsysem, only Send o Power would be enabled. Upon he firing of Send o... ransiions, he oken is placed on Reurn and enables he corresponding s ransiion Acion wih Daa. Here he is allowed o modify he reurned daa. A common acion here is o sore he received daa in a global buffer, which requires he o have he buffer in is resource lis. Once a has compleed modifying and soring daa, is placed on Complee. This noifies he Microkernel ha he has compleed and can allow anoher o execue. The oken is passed o he Microkernel so i can subsequenly noify he paren Job ha one of is s has compleed. Global Resources Modeling global resources is very similar o he above echniques and is necessary for accurae sofware represenaions. Figure 9 shows a very simple Microkernel ha insers s ino a prioriy queue and execues he head of queue. Examples of preempive, resourcemanaging Microkernels can be found in [13]. Reques Queue mainains a prioriized queue of s o execue and is iniialized o an empy lis. When a is placed on Reques, he curren queue req_q and are provided as inpus o he Inser ransiion funcion. is appended o he fron of req_q, hen sored based on prioriy. The resul of hese acions are sored ino a new reques queue, new_req_q, and placed on Reques Queue. Once a has been placed ino he reques queue, Selec fires and he execues. The guard, [req_q<>[]], of Selec compares he req_q o an empy lis and evaluaes o rue if he req_q is no empy. The second componen ha enables Selec is an available oken on Processor Idle. A single UNIT oken is iniially placed on Processor Idle, denoing ha here is a single processor available in he sysem. Addiional iniial okens may be placed here o indicae muli-core sysems. Selec will say enabled as long as here are s in req_q and processors available. If he sysem is modeled his way, simulaion coninues by he nondeerminisic firing of enabled ransiions. There are ways o enforce ransiion firing precedence, bu is ou of he scope of his aricle. The head of req_q is chosen o execue, which subsequenly produces a oken on Gran Execuion. The seleced is noified by he use of he Gran fusion se and he oken is renamed as graned_ask inside of he subne. The model simulaion pro- inpu (req_q,); oupu (new_req_q); acion (::req_q); req_q Lis Inser Reques Queue sor prioriy_sor new_req_q [] [req_q<>[]] req_q Selec Ready Reques Reques hd(req_q) proc Execue Exernal Inerface () Processor Idle Noify Job Job Free Processor Execuing Complee Complee Gran Execuion Gran Figure 9: Simplified Prioriy-based, Non-Preempive Microkernel gresses along he seps described wih Figure 7. Care should be aken when naming variables locaed on arcs conneced o fusion ses. If he fusion ses are used as module inerfaces, he variables used o ransfer daa among hem are in he scope of all conneced modules. Renaming variables on one side of he inerface, as in Figure 7, ensures ha variables do no bind o new okens and corrup he needed daa. Global daa buffers are represened as a single place wihin a ne. For an accurae realizaion, a buffer needs a name, unique ype, and iniial marking. The name uniquely idenifies he buffer, he ype describes he daa fields, and he iniial marking iniializes he buffer o a known saring sae. Figure 10 shows an example global daa buffer conneced o he Acion wih Daa ransiion in Figure 7. The Aiude Deerminaion and Conrol (ADAC) subsysem global daa buffer is represened as he place ADAC Buffer. Iniial Marking 1'{ magepoch=0, muepoch=0, saus=0, orque_coil1_curren=0, orque_coil2_curren=0, orque_coil3_curren=0, mag_z=0, mag_y=0, mag_x=0, imu_z=0, imu_y=0, imu_x=0, imu_angle_z=0, imu_angle_y=0, imu_angle_x=0} curren_values ADAC_BUF ADAC Buffer Acion wih Daa AdacBuffer new_values Color Se Definiion colse AdacBuffer = record magepoch:int * imuepoch:int * saus:byte* orque_coil1_curren:byte* orque_coil2_curren:byte* orque_coil3_curren:byte* mag_z:int* mag_y:int* mag_x:int* imu_z:int* imu_y:int* imu_x:int* imu_angle_z:int* imu_angle_y:int* imu_angle_x:int; Figure 10: Global ADAC Buffer The ADAC subsysem consiss of a microconroller conneced o an inerial measuremen uni (IMU), hree h Annual AIAA/USU

9 axis magneomeer, and hree separae orque coils. Updae requess wih he ADAC subsysem provides measuremen epochs, a saus regiser, all hree orque coil currens, magneomeer-measured magneic field vecor, IMU-measured magneic field vecor, and IMU-provided angle raes. Each field is represened as an enry in a record color se, shown on he righ side of Figure 10. Aaching ADAC Buffer o Acion wih Daa requires ha oken mus be iniially placed on ADAC Buffer. If a designer forges o place an iniial marking on a daa buffer, CPN Tools would show a dead marking when a places a oken on he place conneced o Acion wih Daa. To enable a ransiion, all inpu places mus have a necessary amoun of okens. Because ADAC Buffer is an inpu place o Acion wih Daa, i mus always conain a oken. When Acion wih Daa is enabled, curren_values conains he values of he mos recenly deposied oken. In he case of he firs firing, curren_values would have every record field se o zero; as deermined by he iniial marking. Acion wih Daa can use curren_values in calculaions and subsequenly saves he new values by binding values o new_values. The oken bound o new_values is deposied ino ADAC Buffer, which saves he values for fuure use. FORMAL VERIFICATION Conducing a formal analysis of he modeled sysem is he inegral par of using CPNs as a sofware modeling soluion. CPN Tools conains an opion for calculaing he sae space of a CPN and generaing a repor deailing saisics, liveness, boundness, and fairness properies. Table 3 shows he Saisic and Liveness propery secions of a generaed repor from he modeled C&DH subsysem shown a Nanosa-7 FCR. The dead marking of sae required furher invesigaion o deermine he deails of is occurrence. Expanding he sae space revealed ha his marking represened he sae where End-of-Life conained a single oken. This was he desired oucome of he modeling process as here should be no enabled ransiions a End-of-Life and denoes he end of he mission. The number of possible C&DH sofware saes oaled 60, 850, which furher demonsraes he feasibiliy of implemening he proposed modeling procedures. CPN Tools is capable of calculaing sae spaces wih hundreds of housands of nodes; i is only limied by he memory of he compuer. If he number of nodes in he sae space graph become increasingly large (sae space explosion), CPN Tools will only calculae parial sae spaces. Repeaing he process will obain more nodes in he sae space graph. Formally verifying sysem correcness a his poin is no feasible, bu useful characerisics can Table 3: Sae Space Analysis Resuls Saisics Sae Space Nodes: Arcs: Secs: 111 Saus: Full Scc Graph Nodes: Arcs: Secs: Liveness Properies Dead Markings [60850] sill be derived. Once a (parial) sae space is calculaed, users can make queries o answer specific quesions abou sysem funcionaliy. Some properies ha can be idenified from queries include minimum/maximum okens in a sae, recurring cycles, reachable markings, repor dead markings, and fairness properies [6]. CONTRIBUTIONS The presened process decomposes complex sofware sysems ino manageable porions which faciliae sofware designers abiliy o effecively concepualize and diagram concurren, disribued sysems. The aricle provides readers wih he deails and benefis of incorporaing Peri ne sofware modeling o heir respecive sysems. Addiionally, i was suggesed ha readers could develop more inricae sysems hrough he use of absracions and modeling oher sofware sysems wihin a spacecraf. Curren sofware modeling echniques ofen eiher lack absracion or lack formal mahemaical definiions. Proprieary or applicaion specific ools have been consruced o creae a beneficial synergy beween various ools. Peri nes inegrae he usefulness of absracions and formal mahemaics, which is apparen in CPN Tools. The simplified examples provided were aken from he acual model of he C&DH subsysem of MR SAT. From 9 27 h Annual AIAA/USU

10 hese examples, small spacecraf missions are provided a framework for sofware modeling, formal verificaion, and consrucing insrucional, dynamic sofware archiecure visualizaions. These aribues benefi he sofware developmen process by removing ambiguiy hrough explici declaraions of nes, insananeous feedback hrough simulaions, undersandable diagrams, pariioned sysem models/diagrams, and assurance hrough formal verificaion. The only ool involved for compleing modeling was CPN Tools, which is an open-source, freely-available ool. This sudy demonsraed he applicabiliy of CPN Tools o accomplish asks of equivalen commercial sofware, bu wihou he high coss involved when using commercial sofware. ADVANTAGES Absracion Composing larger CPNs from smaller subnes allows for diagram segmenaion, subne reuse, definiion of global resources, explicily defined exernal inerfaces, and plug-and-play esing of modeled sofware componens. For example, o see he effecs of a differen scheduling scheme, a differen Microkernel wih he same exernal inerface can replace an exising one by modifying fusion ses. Visualizaion The graphical differences beween places and ransiions allow viewers o easily see how he sofware saes change. Srucural dependencies and ineracions are clearly defined hrough arcs ha define he flow of daa. The use of subpages allow large diagrams o be separaed ino equivalen subnes, ha reain he inegriy of he model, in an inuiive way. Simulaion The abiliy o simulae a models execuion allows for insan feedback o designers ha removes ambiguiy. Proposed design changes are modeled and affeced funcionaliy is visually shown. Formal Verificaion Formally verifying sofware sysems increases he confidence of sofware design. Small spacecraf sofware naurally has fewer possible saes han larger spacecraf which reduces he risk of sae space explosion. Wihou he resricions of similar sofware modeling mehods, CPNs allow designers o creaively model sofware wihou worrying abou work-arounds during model developmen. Scalable While larger spacecraf sofware models will need o make use of absracions, CPNs are sill applicable. Subnes can be individually verified, hen represened by simple places or ransiions in he overall CPN. The overall CPN is hen formally verified wih he absraced subnes. This significanly reduces he number of saes in he sae space, while mainaining equivalen formal proof resuls. Adapable Changing requiremens is an ineviable realiy ha all spacecraf projecs face. Formal models are quicker and more cos effecive o change han implemened source files. Nondeerminism When a CPN has muliple ransiions enabled as a given simulaion sep, hey are fired in a nondeerminisic order. This effecively and accuraely represens rue concurren, muli-cored sysems. CONCLUSION Modeling small spacecraf sofware using Peri nes has been shown o be a viable mehod, as small spacecraf inherenly reduce he occurence of sae space explosion. Peri nes allow advanced absracions, diagram pariioning, formal verificaion, simulaion, inuiive represenaions of sofware. A simple mehod for decomposing small spacecraf missions ino manageable CPNs was presened. Addionally, i was shown how he modeled archiecure exends o incorporae sofware execuing on disribued hardware subsysems. The same mehod was used o model and subsequenly implemen he core funcionaliy of he C&DH sofware sysem onboard MR SAT. The process was me wih success and demonsraed a Nanosa-7 FCR. The procedure can be summarized as he following sequence: 1. Creae he CPN o represen he sofware lifecycle 1.1 Populae wih mission modes realized as places 1.2 Deermine mission mode ordering using ransiions 2. Conver lifecycle ransiions ino subsiuion ransiions, called Jobs 3. Deermine all necessary sysem funcionaliy 3.1 Creae a or global resource for each 3.2 Using fusion ses, creae exernal inerfaces for all componens 4. Srucurally arrange s wihin Jobs o achieve complex objecives By incorporaing simulaion and verificaion along he way, errors are surfaced by feedback hrough CPN Tools. Defecive designs resul in a failure o simulae or deadlocked saes during verificaion. Modifying he model as h Annual AIAA/USU

11 defecs are encounered reduces he risk of errors propagaing ino he implemenaion phase, hus reducing he risk of budge and scheduling overruns. ACKNOWLEDGEMENTS The auhors would like o hank heir faculy advisor, Dr. Hank Pernicka, for he encouragemen o pursue his research and advice hroughou. The M-SAT eam has been an inegral par of compleing and implemening his projec. M-SAT has provided an unmached educaional experience no ofen found a he universiy level. REFERENCES [1] Klaus Havelund, Mike Lowry, and John Penix. Formal Analysis of a Spacecraf Conroller using SPIN. Sofware Engineering, IEEE Transacions on, 27(8): , [2] K. Gundy-Burle. V&V for Model-Based Sofware Developmen. Presened a he annual Workshop on Spacecraf Fligh Sofware hosed by he Je Propulsion Laboraory, [3] E. Benowiz. UML Saechar Auocoding for he Mars Science Lab (MSL) Mission. Presened a he annual Workshop on Spacecraf Fligh Sofware hosed by he Je Propulsion Laboraory, inernaional conference on Simulaion ools and echniques for communicaions, neworks and sysems & workshops, Simuools 08, pages 17:1 17:10, ICST, Brussels, Belgium, Belgium, ICST (Insiue for Compuer Sciences, Social- Informaics and Telecommunicaions Engineering). [10] J. Ellson, E.R. Gansner, E. Kousofios, S.C. Norh, and G. Woodhull. Graphviz and Dynagraph Saic and Dynamic Graph Drawing Tools. In M. Junger and P. Muzel, ediors, Graph Drawing Sofware, pages Springer-Verlag, [11] Michael Weber and Ekkar Kindler. The Peri Ne Markup Language. Peri Ne Technology for Communicaion-Based Sysems: Advances in Peri Nes, 2472:124, [12] L. Fronc and F. Pommereau. Opimising he Compilaion of Peri Ne Models. In Proc. of he second Inernaional Workshop on Scalable and Usable Model Checking for Peri Ne and oher models of Concurrency (SUMO 2011), volume 626, [13] M. Naedele. Peri Ne Models for Single Processor Real-Time Scheduling. TIK-Repor No. 61, November [4] R. Iosif. The Promela Language. Available: hp:// dai-arc/manual/ools/jca/main/ node168.hml, April [Online; accessed 04-April-2013]. [5] IEEE Guide for Informaion Technology - Sysem Definiion - Concep of Operaions (ConOps) Documen. IEEE Sd , page i, [6] Kur Jensen and L.M. Krisensen. Coloured Peri Nes: Modelling and Validaion of Concurren Sysesms. Springer Berlin Heidelberg, [7] E. Allen Emerson. Temporal and Modal Logic. In HANDBOOK OF THEORETICAL COMPUTER SCIENCE, pages Elsevier, [8] Wells L. Lassen H.M. Laursen M. Qvorrup J.F. Sissing M.S. Wesergaard M. Chrisensen S. Razer, A.V and K. Jensen. Cpn ools for ediing, simulaing, and analysing coloured peri nes. In Proceedings of he 24h inernaional conference on Applicaions and heory of Peri nes, ICATPN 03, pages , Berlin, Heidelberg, Springer-Verlag. [9] F. Pommereau. Quickly Prooyping Peri Nes Tools wih SNAKES. In Proceedings of he 1s h Annual AIAA/USU