Formal Verification of System States for Spacecraft Automatic Maneuvering

Hobbs, Kerianne; Perez, Ivan; Fifarek, Aaron W.; Féron, Éric

doi:10.2514/6.2019-1187

“…"Specification is difficult, unglamorous, and arguably the biggest bottleneck facing verification and validation of aerospace, and other, autonomous systems" [142]. RTA systems and formal specification and analysis have been applied successfully in a variety of applications [50], [53], [56], [87], [96], [97], [143]- [155]. Formal RTA requirements specifications have also been developed and analyzed [156]- [158].…”

Section: Implicit Active Set Invariance For Uncertain Systemsmentioning

confidence: 99%

“…An example predicate is an inequality is evaluated as true or false, such as x+y ≤ c with variables x and y, and constant c. These predicates can be combined in a variety of logics such as first order and temporal logics such as linear temporal logic (LTL), computational tree logic (CTL), timed computational tree logic (TCTL), metric temporal logic (MTL), and signal temporal logic (STL) [141], [164]- [166]. Formal verification of linear temporal logic specifications has been applied to PID attitude control of spacecraft [167], a Simplex RTA system for spacecraft attitude [154], [168], [169], switching logic for automatic maneuvering [155], an LTL specification monitor automaton [57], and many other applications.…”

Section: Implicit Active Set Invariance For Uncertain Systemsmentioning

confidence: 99%

Runtime Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems

Hobbs

¹

,

Mote²,

Abate³

et al. 2023

Self Cite

View full text Add to dashboard Cite

More than three miles above the Arizona desert, an F-16 student pilot experienced a gravityinduced loss of consciousness (GLOC), passing out while turning at nearly 9Gs (nine times the force of gravity) flying over 400 knots (over 460 miles per hour). With its pilot unconscious, the aircraft turn devolved into a dive, dropping from over 17,000 feet to less than 8,000 feet in altitude in less than 10 seconds. An auditory warning in the cockpit called out to the pilot "altitude, altitude" just before he crossed through 11,000 feet, switching to a command to "pull up" around 8,000 feet. Meanwhile, the student's instructor was watching the event unfold from his own aircraft. As the student's aircraft passed through 12,500 feet, the instructor called over the radio "two recover," commanding the student ("two") to end the dive. As the student's aircraft passed through 11,000 feet the instructor's "two recover!" came with increased urgency. At 9,000 feet, and with terror rising in his voice the instructor yelled "TWO RECOVER!" Fortunately, at the same time as the instructor's third panicked radio call, a new Run Time Assurance (RTA) system kicked in to automatically recover the aircraft. The Automatic Ground Collision Avoidance System (Auto GCAS), an RTA system integrated on the jets less than two years earlier in the Fall of 2014, detected that the aircraft was about to collide, commanded a roll to wings level and pull up maneuver, and recovered the aircraft less than 3,000 feet above the

show abstract

“…"Specification is difficult, unglamorous, and arguably the biggest bottleneck facing verification and validation of aerospace, and other, autonomous systems" [142]. RTA systems and formal specification and analysis have been applied successfully in a variety of applications [50], [53], [56], [87], [96], [97], [143]- [155]. Formal RTA requirements specifications have also been developed and analyzed [156]- [158].…”

Section: Implicit Active Set Invariance For Uncertain Systemsmentioning

confidence: 99%

“…An example predicate is an inequality that is evaluated as true or false, such as x+y ≤ c with variables x and y, and constant c. These predicates can be combined in a variety of logics such as first order and temporal logics such as linear temporal logic (LTL), computational tree logic (CTL), timed computational tree logic (TCTL), metric temporal logic (MTL), and signal temporal logic (STL) [141], [164]- [166]. Formal verification of linear temporal logic specifications has been applied to PID attitude control of spacecraft [167], a Simplex RTA system for spacecraft attitude [154], [168], [169], switching logic for automatic maneuvering [155], an LTL specification monitor automaton [57], and many other applications.…”

Section: Implicit Active Set Invariance For Uncertain Systemsmentioning

confidence: 99%

Run Time Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems

Hobbs¹,

Mote²,

Abate³

et al. 2021

Preprint

View full text Add to dashboard Cite

More than three miles above the Arizona desert, an F-16 student pilot experienced a gravityinduced loss of consciousness (GLOC), passing out while turning at nearly 9Gs (nine times the force of gravity) flying over 400 knots (over 460 miles per hour). With its pilot unconscious, the aircraft turn devolved into a dive, dropping from over 17,000 feet to less than 8,000 feet in altitude in less than 10 seconds. An auditory warning in the cockpit called out to the pilot "altitude, altitude" just before he crossed through 11,000 feet, switching to a command to "pull up" around 8,000 feet. Meanwhile, the student's instructor was watching the event unfold from his own aircraft. As the student's aircraft passed through 12,500 feet, the instructor called over the radio "two recover," commanding the student ("two") to end the dive. As the student's aircraft passed through 11,000 feet the instructor's "two recover!" came with increased urgency. At 9,000 feet, and with terror rising in his voice the instructor yelled "TWO RECOVER!" Fortunately, at the same time as the instructor's third panicked radio call, a new Run Time Assurance (RTA) system kicked in to automatically recover the aircraft. The Automatic Ground Collision Avoidance System (Auto GCAS), an RTA system integrated on the jets less than two years earlier in the Fall of 2014, detected that the aircraft was about to collide, commanded a roll to wings level and pull up maneuver, and recovered the aircraft less than 3,000 feet above the

show abstract

“…However, this guidance focuses on radio frequencies for operation, debris removal, launch safety, spacecraft operations, and general development in a rigorous systems engineering process, and none of these sources provide requirements for design of automatic control systems. Aside from the author's previous work [17][18][19], there is no publicly available literature on spacecraft automatic maneuver system requirements. This is in part due to the often proprietary or classified nature of spacecraft programs.…”

Section: Introductionmentioning

confidence: 99%

Risk-Based Formal Requirement Elicitation for Automatic Spacecraft Maneuvering

Hobbs

¹

,

Collins

²

,

Féron

³

2021

AIAA Scitech 2021 Forum

Self Cite

View full text Add to dashboard Cite

As space continues to become more congested, automated techniques for spacecraft maneuvering become increasingly attractive for tasks such as collision avoidance, rendezvous and proximity operations, and station keeping. This work uses hazard analysis to elicit requirements for an autonomous spacecraft controller. Spacecraft maneuvers today are planned by human operators and conducted days to hours in advance. This represents a risk averse climate that is hesitant to rely on automation. In the absence of regulations governing automated maneuvering, a risk-based approach is a promising technique. First, top-down accidents, hazards, and safety constraints are identified. Second, a functional control model for an automatic collision avoidance system on a spacecraft in the context of a theoretical Space Traffic Management system is constructed using System Theoretic Accident Models and Processes (STAMP). Third, unsafe control actions, scenarios, and mitigating requirements are identified using Systems Theoretic Process Analysis (STPA). These requirements form the foundation for the development of automatic control designs for spacecraft. Finally, the safety constraints are formally specified as high level requirements as a path towards formal analysis of the system.

show abstract

Formal Verification of System States for Spacecraft Automatic Maneuvering

Cited by 4 publications

References 19 publications

Runtime Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems

Runtime Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems

Run Time Assurance for Safety-Critical Systems: An Introduction to Safety Filtering Approaches for Complex Control Systems

Risk-Based Formal Requirement Elicitation for Automatic Spacecraft Maneuvering

Contact Info

Product

Resources

About