NASA Formal Methods

Since its dramatic landing on Mars on the night of Aug 5, 2012, the Curiosity Rover has been busy exploring Gale crater, looking for evidence of past habitable environments. To accomplish its ambitious scientific goal, Curosity is armed with a suite of sophisticated instruments, including cameras capable of 720p high definition stereo video, a gigawatt laser, a radiation detector, a weather monitoring station, and a sample delivery system that can drill into rocks and deliver the resulting powder to instruments that can determine its chemical composition. As a result, Curiosity is a rover capable of gathering large amounts of both scientific data (with results of experiments commanded by the science team) and engineering data (with critical information about rover health). This data volume is too large to be sent directly to Earth via Curiosity’s high-gain antenna (whose bandwidth is measured in hundreds of bits per second). Instead, most of the data acquired by the rover must be relayed to Earth via two orbiting spacecraft. Curiosity achieves this by autonomously engaging in “communication windows” with the orbiters, often by waking itself up in the middle of the night to avail itself of a passing overflight. The asynchronous nature of relay communications necessitates on-board software for reliably storing data captured by multiple scientific experiments, for processing requests from Earth to reprioritize, retransmit and delete data, and for autonomously selecting, retrieving and packaging data for orbiters in time for communication windows. These functions are implemented in rover flight software by a collection of modules called the data management subsystem, which includes filesystems for volatile (RAM) and non-volatile (flash) memory, an on-the-fly compression engine, and a mini-database for cataloging and retrieving data. In this talk, we describe the challenges involved in designing and implementing Curiosity’s data management subsystem, and the important role played by formal methods in the design and testing of this software. We also discuss ongoing work on building tools based on formal methods for analyzing spacecraft telemetry for early anomaly detection during mission operations. Certification Challenges When Using Formal Methods, Including Needs and Issues