Software Systems Division (TEC-SW)
ASSERT
process & toolchain
Maxime Perrotin, ESA
The ASSERT process in a glance
Capture of the
system properties

Modeling phase
Capture of the
hardware architecture

Model transformation
Software Systems Division (TEC-SW)

Feasibility analysis
System real-time
architecture
Run-time
environment

Automatic
code generation
Complete system

Describe the system logical architecture
Software Systems Division (TEC-SW)
Mode
Management
TMTC
AOCS
FDIR
Ground
First, identify all functional blocks…
Done at system level

Describe the system logical architecture
FDIR
AOCS
Attitude
calculation
Error handling
AOCS mode
management
Software Systems Division (TEC-SW)
Activation => CYCLIC
Period => 100 ms
WCET => 25 ms
Language => SCADE6
NON-FUNCTIONAL ATTRIBUTES
Start-param ::= SEQUENCE {
cmd-word T_COMMAND,
mode-flag BOOLEAN
}
T-COMMAND ::= ENUMERATED
{ switch-on, switch-off }
DATA MODEL IN ASN.1
Then connect them together
…describe the messages they exchange
and their non-functional attributes

Describe the system logical architecture
FDIR
AOCS
Mode Manager
safe
Functional view
go_op/
start
fdir
process ABB1
AOCS Calculation
start
Software Systems Division (TEC-SW)
w ait_ABB2
PI1
PI2
RI1
(myData)
idle
status
FBY
stop
idle
op
w ait_ABB2
1 false
Start-param ::= SEQUENCE {
cmd-word T_COMMAND,
mode-flag BOOLEAN
}
T-COMMAND ::= ENUMERATED
{ switch-on, switch-off }
DATA MODEL IN ASN.1
…and let system engineers fill the blocks:
they know what they want!
Keep them away from software issues!

Describe the system deployment
Partition 1
AOCS
>
>
mode
Mode Manager
safe
TC
step
AOCS
go_op/
start
fdir
>
TM
op
>
FDIR
>
Attitude Estimator
start
>
>
Error Detector
mode
mode
mode
Mode Manager
safe
TC
go_op/
start
fdir
TM
op
>
Mode Manager
safe
TC
go_op/
start
fdir
process ABB1
TM
op
>
>
step
Attitude Estimator
start
status
FBY
stop
1 false
status
FBY
stop
AOCS
>
>
idle
w ait_ABB2
1 false
>
alarm
PI1
PI2
RI1
(myData)
idle
fdir
>
>
step
Attitude Estimator
start
status
FBY
stop
1 false
w ait_ABB2
Partition 2
FDIR
>
Error Detector
mode
process ABB1
idle
>
alarm
w ait_ABB2
PI1
PI2
RI1
(myData)
idle
fdir
>
Software Systems Division (TEC-SW)
w ait_ABB2
LEON2
Spacewire,
1553,
CAN Bus…
ERC32
List the hardware (processors, memory, busses)
Group the functions into partitions
and map the partitions to the hardware

Transform and analyze the system
SYSTEM DESCRIPTION
Software Systems Division (TEC-SW)
All attributes and
properties are formally
captured in models
ASSERT Tool
Task 1
Task 3
Task 2
Task 4
Task 1
Task 2
Task 3
Generate a set of software tasks for each processor
Analyze the system and ensure its feasibility
(scheduling, safety, sizing and timing, bus load…)

Generate the software system
process ABB1
start
status
FBY
idle
w ait_ABB2
PI1
PI2
RI1
(myData)
stop
1 false
safe
Software Systems Division (TEC-SW)
go_op/
start
Task 1
op
Task 3
idle
fdir
w ait_ABB2
T-COMMAND ::= ENUMERATED
{ switch-on, switch-off }
Functional code
(C, Ada)
Task 2
Task 4
Task 1
Task 2
Task 3
Functional code Tailored run-time
containers
environment
1 executable per target, ready for download
In practice, how is it implemented?
Software Systems Division (TEC-SW)

The system models are captured with a
graphical tool that is targeted to system
engineers.
 The Data View is captured in ASN.1
 Functional blocks can be modeled using any
language: SDL, SCADE, Simulink, Ada, C.
Assert tools generate wrappers. Choose the
best!
 Verification is done using existing, off-theshelves tools (MAST+, Cheddar, AltaRica)
Toolchain elements (1)

Graphical front-end for assert systems
Software Systems Division (TEC-SW)
– “Interface and Deployment view editors”
Toolchain elements (2)
Software Systems Division (TEC-SW)

Automatic “ICD” Generation
Toolchain elements (3)
Software Systems Division (TEC-SW)

ASN.1 Space Certifiable Compiler
– Generation of compact binary encoders and
decoders for ASN.1 modules
– Integrated in the ASSERT tool-chain, can be used
standalone as well
– Targets embedded systems: no dynamic memory
allocation, no system calls
Toolchain elements (4)
Software Systems Division (TEC-SW)

The “virtual machine” (assert VM)
– First version based on the Ada runtime with the
Ravenscar kernel and PolyORB-HI middleware.
– Supported platforms: Leon (gnatforleon), Native
(can run on top of Windows or Linux on Intel
processors – without real-time)
– Supported network: Ethernet (for native platforms),
Spacewire (prototype only, full version within 6
months)
– Ongoing: porting to RTEMS
step by step demonstration
Make the “interface”, “deployment”, and
“data” views
2. Prepare the field to implement the functions:
1.
Software Systems Division (TEC-SW)
 Convert “data view” to target languages
 Generate application skeletons
Implement the functions, generate the code
(don’t modify the generated code!)
4. Generate the glue code and build the
system
5. Run the system
3.
Software Systems Division (TEC-SW)
application skeleton: simulink
application skeleton: SDL
system basic_fv
USE Datamodel;
SIGNAL basictotc (T_TM);
SIGNAL tcommand (T_HLTC_PLUS);
SIGNAL basictocontrol (T_CONTROL_IN);
SIGNAL controldow ntobasic (T_CONTROL_DOWN_OUT);
SIGNAL controluptobasic (T_CONTROL_UP_OUT);
Software Systems Division (TEC-SW)
SIGNAL cyclicactivationimplementation;
procedure aplc_basic_op COMMENT '#c_predef';FPAR
IN thrusters_opening T_THRUSTERS_OPENING,
IN pfs_iw m_arming_relay_status_on T_PFS_IWM_ARMING_RELAY_STATUS_ON,
IN pfs_hltc_red_button_is_on T_PFS_HLTC_RED_BUTTON_IS_ON,
IN msu_id T_MSU_ID,
IN pfs_ew m_msuy_msux_hs T_PFS_EWM_MSU_MSU_HS,
IN ftcp_health_status T_FTCP_HEALTH_STATUS,
IN pfs_ew m_dtg12_msu T_PFS_EWM_DTG12_MSU,
IN hltc T_HLTC,
IN end_boost_is_reached T_END_BOOST_IS_REACHED,
IN sun_is_aimed T_SUN_IS_AIMED,
IN/OUT pfs_ew c_msu_pde_t T_PFS_EWC_MSU_PDE_T,
IN/OUT pde_cmd_a T_PDE_CMD_A,
IN/OUT dpu_cmd T_DPU_CMD,
IN/OUT set_pfs_ew c_msu_dtg_mode_coarse T_ON_OFF_CMD,
IN/OUT hltm T_HLTM,
IN/OUT pfs_ew m_msux_msuy_hs T_PFS_EWM_MSU_MSU_HS,
IN/OUT cam_mode T_CAM_MODE,
IN/OUT controller_to_be_activated T_CONTROLLER_TO_BE_ACTIVATED,
IN/OUT navigation_output T_NAVIGATION_OUTPUT;
EXTERNAL;
procedure mysimulink COMMENT '#c_predef';FPAR
IN my_in T_FOR_SIMULINK_IN,
IN my_in2 T_control_in,
IN/OUT my_out T_FOR_SIMULINK_OUT,
IN/OUT my_out2 T_Control_in;
EXTERNAL;
basic_fv
tcommand,
controldowntobasic,
controluptobasic,
cyclicactivationimplementation
c
basictotc,
basictocontrol
Software Systems Division (TEC-SW)
application skeleton: C