ETTC'2003 - SEE

7. Validation process
FCP validation follows several steps. Each of them is required in order to enable FCP execution
onboard the satellite:
1. Documentation analysis: FCP specification is derived and checked up on input documents
(satellite operation manual, satellite database, onboard SW specification [LVC]). In particular,
patch definitions are verified on source code (Ada and processor code). Notice that most FCPS
had been pre-validated by satellite contractor Astrium.
2. Automatic validation with SINUS:
The automatic validation technique enables to verify two types of properties :
a) Liveness or fonctionnal properties : they ensure that “something good” occurs. Expected
states are specified by means of TM parameter values. These specifications can be associated
either to TC, FCP steps or test cases for contextual verifications.
b) Safety properties : they ensure that “nothing bad” happens. They consist on ground
monitoring which provide systematic verification of the non-occurrence of predefined unwanted
states (expressions based on TM values) or events. SINUS interprets the same ground
monitoring as CCS does during real time satellite operations.
3. Review process: periodical technical meetings are organised. They are very useful in the terms
of FCPs and test results review. They also contribute to staff training.
4. Satellite Control Center in the loop: Automatic validation is not sufficient to validate because
CCS is not in the loop to transmit TC. When ground control facilities (CCS) are in the loop,
validation is manual: TC are sent from CCS and TM parameters are displayed and checked up
manually on CCS mimics. These tests are more expensive because they involve a larger team.
That is why they are only conducted when other verifications are completed.
8. Limitations and future work
Limitations of procedure automatic validation are presented in relation with possible improvements:
1. Automatic validation technique does not replace operability /system tests because the satellite
control center is not in the loop to transmit TC. This limitation is intrinsic to the approach.
2. For few satellite equipment or sub-systems, SINUS numeric models are not representative. That
is the case for Vegetation which is SPOT5 secondary payload. Vegetation operational
procedures have to be validated using BSSO and its Vegetation model. But for many procedures
(platform ones and most of payload ones) SINUS representativity is sufficient : an important
feedback of SPOT5 qualification is that a processor emulator together with an accurate
calculator simulation model seem equivalent to hardware equipment for FCP validation.
3. Presently SINUS mimics (when running SINUS offline) differ from the ones used in the control
centre. The development of a translator is under progress to generate automatically SINUS
8