Run-Time Assurance and Formal Methods Analysis Nonlinear System Applied to Nonlinear System Control

Gross, Kevin C.; Hoffman, Jonathan; Swenson, Eric D.; Fifarek, Aaron W.

doi:10.2514/1.i010471

Cited by 16 publications

(10 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The spacecraft attitude dynamics are nonlinear and cannot be evaluated using a traditional controllability matrix test. More details on the spacecraft attitude dynamics were described previously by the authors in [17,18]. While the system is completely controllable, it is possible for the translational or angular velocity to be so high that it exceeds reasonable capabilities of the actuators.…”

Section: Fig 7 Notional Depiction Of a Variable Safe Relative Velocity That Decreases As The Distance Between Two Spacecraft Decreases Whmentioning

confidence: 99%

“…[C10] Spacecraft actuation strategy should conserve actuator use to prevent wear when possible (H10). As discussed in [18], this constraint is like the acceleration and velocity constraints of [C3] and [C4]. Accelerating uses fuel or can cause excessive wear to actuators like reaction wheels and excessive velocity on internal actuators over an extended period can have the same effect.…”

Section: Fig 7 Notional Depiction Of a Variable Safe Relative Velocity That Decreases As The Distance Between Two Spacecraft Decreases Whmentioning

confidence: 99%

“…However, this guidance focuses on radio frequencies for operation, debris removal, launch safety, spacecraft operations, and general development in a rigorous systems engineering process, and none of these sources provide requirements for design of automatic control systems. Aside from the author's previous work [17][18][19], there is no publicly available literature on spacecraft automatic maneuver system requirements. This is in part due to the often proprietary or classified nature of spacecraft programs.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Risk-Based Formal Requirement Elicitation for Automatic Spacecraft Maneuvering

Hobbs

Collins

Féron

2021

AIAA Scitech 2021 Forum

View full text Add to dashboard Cite

As space continues to become more congested, automated techniques for spacecraft maneuvering become increasingly attractive for tasks such as collision avoidance, rendezvous and proximity operations, and station keeping. This work uses hazard analysis to elicit requirements for an autonomous spacecraft controller. Spacecraft maneuvers today are planned by human operators and conducted days to hours in advance. This represents a risk averse climate that is hesitant to rely on automation. In the absence of regulations governing automated maneuvering, a risk-based approach is a promising technique. First, top-down accidents, hazards, and safety constraints are identified. Second, a functional control model for an automatic collision avoidance system on a spacecraft in the context of a theoretical Space Traffic Management system is constructed using System Theoretic Accident Models and Processes (STAMP). Third, unsafe control actions, scenarios, and mitigating requirements are identified using Systems Theoretic Process Analysis (STPA). These requirements form the foundation for the development of automatic control designs for spacecraft. Finally, the safety constraints are formally specified as high level requirements as a path towards formal analysis of the system.

show abstract

Section: Fig 7 Notional Depiction Of a Variable Safe Relative Velocity That Decreases As The Distance Between Two Spacecraft Decreases Whmentioning

confidence: 99%

Section: Fig 7 Notional Depiction Of a Variable Safe Relative Velocity That Decreases As The Distance Between Two Spacecraft Decreases Whmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Risk-Based Formal Requirement Elicitation for Automatic Spacecraft Maneuvering

Hobbs

Collins

Féron

2021

AIAA Scitech 2021 Forum

View full text Add to dashboard Cite

show abstract

“…In this context of geofencing, runtime monitoring especially utilizing formal methods can play an important role. For example, [22] presents a runtime monitor to check a non-assured control system by comparing its outputs against an assured implementation during operation. In [23], an approach is presented to assess the overall system health using runtime monitoring.…”

Section: Related Workmentioning

confidence: 99%

Geofencing requirements for onboard safe operation monitoring

et al. 2020

View full text Add to dashboard Cite

The new concept for operation of drones, published by EASA in 2015, enables new ways to influence and possibly reduce the necessary safety targets of certain system components without reducing the overall safety of the unmanned aircraft system (UAS). Based on the safety assessment, the specific category enables new aircraft system architectures and mission designs. In this context, this paper analyzes runtime monitoring as a strategy to contain the UAS in its operational volume. To assure predefined properties in flight and thus assure the safety of the operation in progress with a high robustness, a formal methodology for safe operation monitoring is utilized. With this approach, this work targets to link the concept of safe operation monitoring with the upcoming regulations regarding the specific category and the specific operation risk assessment (SORA). One particular aspect of this safe operation monitoring is geofencing, the capability to contain a UAS in a previously restricted area. In the regulatory framework of a specific operation, risk assessment is required and so is the containment of the UAS in its operational volume. The functional and safety requirements for geofencing regarding their impact on the underlying specific operation risk assessment are discussed. To facilitate this discussion, a taxonomy of geofencing characteristics is derived based on a literature survey. Consequently, the geofencing requirements are assessed regarding their robustness and applicability for certification purposes. As a result, by monitoring the integrity of the system at runtime using geofencing as an example, it is investigated if the requirements and thus costs of development and certification process for the remaining components can be reduced.

show abstract

“…The key differences to our approach are our use of a stream-based specification language with direct support for statistics, and that our framework uses a software-based instrumentation approach, which gives access to the internal state of system components. For non-assured control systems, a runtime supervision approach has been described in [9]. A specific approach with a separate, verified hardware system to enforce geo-fencing has been described in [4].…”

Section: Related Workmentioning

confidence: 99%

Stream Runtime Monitoring on UAS

Adolf

Faymonville

Finkbeiner

et al. 2017

Runtime Verification

View full text Add to dashboard Cite

Unmanned Aircraft Systems (UAS) with autonomous decision-making capabilities are of increasing interest for a wide area of applications such as logistics and disaster recovery. In order to ensure the correct behavior of the system and to recognize hazardous situations or system faults, we applied stream runtime monitoring techniques within the DLR ARTIS (Autonomous Research Testbed for Intelligent System) family of unmanned aircraft. We present our experience from specification elicitation, instrumentation, offline log-file analysis, and online monitoring on the flight computer on a test rig. The debugging and health management support through stream runtime monitoring techniques have proven highly beneficial for system design and development. At the same time, the project has identified usability improvements to the specification language, and has influenced the design of the language. 1 input double lat, lon, ug, vg, wg, time_s, time_micros 2 output double time := time_s + time_micros / 1000000.0 3 output double flight_time := time -time#[0,0.0] 4 output double frequency := switch position{ 5 case 0 { 1.0 / ( time[1,0.0] -time ) } 6 default { 1.0 / ( time -time[-1,0.0] ) } } 7 output double freq_sum := freq_sum[-1,0.0] + frequency 8 output double freq_avg := freq_sum / double(position+1) 9 output double freq_max := max( frequency, freq_max[-1,double_min] ) 10 output double freq_min := min( frequency, freq_min[-1,double_max] ) 11 12 output double velocity := sqrt( ug^2.0 + vg^2.0 + wg^2.0 ) 13 const double R := 6373000.0 14 const double pi := 3.1415926535 15 16 output double lon1_rad := lon[-1,0.0] * pi / 180.0 17 output double lon2_rad := lon * pi / 180.0 18 output double lat1_rad := lat[-1,0.0] * pi / 180.0

show abstract

Run-Time Assurance and Formal Methods Analysis Nonlinear System Applied to Nonlinear System Control

Cited by 16 publications

References 20 publications

Risk-Based Formal Requirement Elicitation for Automatic Spacecraft Maneuvering

Risk-Based Formal Requirement Elicitation for Automatic Spacecraft Maneuvering

Geofencing requirements for onboard safe operation monitoring

Stream Runtime Monitoring on UAS

Contact Info

Product

Resources

About