ETTC'2003 - SEE

• Test duration is reduced : for instance, in case of SPOT5, a recovery procedure test case consists
in about fifty TC groups (a TC group is a sequence of one to five TC) and several hundreds of
TM parameters to check. Automatic simulation requires less than ten minutes to run such a test
case. With respect to operability tests, running the same test case is much longer : about half a
day and with a larger team.
• Reusability : both operational data (FCPs, TC groups) and testing data (test procedures, test
scripts, produced log-books) are assets which are (re)usable in different contexts :
− Reusability for non-regression testing : upon change of satellite configuration (such as
modification of the on-board software ), test cases can be re-run with low effort.
Furthermore, test logbooks can be automatically compared for testing non regression.
− Reusability for other satellites : Helios2 is the military successor of SPOT5 satellite.
Helios2 shares SPOT5 platform and some payload elements.
− Use for operator training : Operational et testing data together with the automatic validation
technique provide easy and ready to use facilities for operator training.
3 Improve testing coverage :
• Procedure coverage can be more complete because testing takes less time.
• Additional test cases can be introduced.
• Specified/checked TM effects can be more numerous.
• Non regression testing can be conducted systematically when satellite configuration changes.
Use for SPOT5 qualification
Automatic validation was used along SPOT5 qualification and after launch :
1. To start with, many procedures were pre-validated by means of automatic simulation before
conducting operability tests. This initial fine tuning using SINUS off line enabled to save time
because errors early detection enables to avoid re-running operability tests. Errors were found
in TM effect specification. But also errors were detected in TC specification. For instance,
several LVC patches used in different procedures were wrong.
2. Secondly, automatic validation enabled to run more test cases and thus to cover procedure paths
which were not considered during operability tests.
3. In the last months before launch (operational qualification), the focus has been put then on nonregression
testing. This was particularly important in the case of SPOT5 qualification because
three different versions of the on-board software were released during the operational
qualification. And the last version was issued and tested only three weeks before launch. The
automatic simulation technique was intensively used to run non-regression test cases and to
compare produced test log-books automatically. Twenty test cases were defined to be run
automatically, covering about 70% of the procedures used to recover from anomalies. These test
cases were executed for each version of the on-board software. About 10.000 verifications were
performed altogether.
4. After launch, validation activities went on, in particular for payload FDIR FCPs ; they were
neither defined nor validated before, because of lack of time. By then, automatic validation was
systematically used. Concerning these particular FDIR FCPs, the choice has been taken to
differ their validation with the control centre in the loop: operability tests may be conducted
only when a procedure is really needed for a satellite operation, in order to confirm automatic
validation results and more important to train operators just before satellite operation.
7