1. Software Engineering Research at NASDA Masafumi Katahira System Analysis & Software Laboratory National Space Development Agency of Japan (NASDA) ISERN2000 Annual Meeting Oct.8-10 @Hawaii

2. What is NASDA? Japanese Space Agency (National Space Development Agency of Japan) Satellite Development Launch Vehicle Development Space Utilization (Space Station etc.) Earth Observation Research & Development (Software Engineering & Methodology Research, and Software IV&V) Safety and Reliability Department (Software Management Requirements, Standard)

3. NASDA Software Engineering Efforts Enforcement of Software Engineering Approaches Education of software engineering Research of Software Engineering (Modeling, Simulation, Verification techniques etc.)  NASDA has been assessed by a Professional Committee. Satellite Software Launch Vehicle Software Space Station Software cooperated with NASA

4. Biodata Bachelor of Electronic Engineering, and M.S. of Computer Science at Florida Tech. Visiting Researcher of Software Engineering Research Lab. (SERL) at MIT Aero & Astro Dep. (Prof. Nancy G. Leveson) [Past Experience] Development of satellite and tracking software for two years. Development of Japanese Module (JEM) Software of the International Space Station for eight years. Especially software product assurance and software safety design. Development of Japanese Launch Vehicle (H-IIA) avionics for a year.

5. My Research Interests  Software Quality, Reliability and Safety methodology Formal Modeling & Specification Language Model Visualization Software Development Process Model Human Computer Interaction Independent Verification and Validation (IV&V) Software related accident model

6. Recent Conference Papers Comprehensive Approaches for Safety-Critical Software, ISTS 2000, May 2000 Preliminary Risk Analysis for Software Independent Verification & Validation, ISACC 2000, Sep. 2000 Identifying Mode Confusion Potential in Software Design, DASC 2000, Oct. 2000

7. Space Station Software Engineering Software SRM&QA requirements  Software Safety Requirements – SSP50038 Software Fault Propagation Model System/Software Hazard Analysis (Backward Analysis)  Software IV&V challenge

8. Software Safety Requirements -SSP50038- Categorized two types of critical functions  Must Work Functions: Fault Tolerant Approach  Must Not Work Functions: Fault Containment Approach or Separate Control Path Approach

9. Software IV&V activity Independent Reviews (Informal and formal) Independent Simulation and Test Formal Specification (SpecTRM-RL) Hazardous Event Model (Decision Table) More than 100 critical problems in JEM software were found.

10. Decision Table (sample) Hazard Title: Depressurization (Must Not Work Function) Hazard Cause: JCP or DIU Software Anomaly Hazard Severity: Catastrophic System States 12345Notes Hazard Condition Relieve Overpressure Command Enabled and sent? NYYYY Module Isolated? (Hatch Closed?) -NYYY Sensor A failed high? (Control Inhibit) --NYYControl Path 1 Sensor B failed high? (Control Inhibit) ---NYControl Path 2 Resulting Actions Control Valve Opened XX Control Valve Closed XXX Isolation Valve Opened X Isolation Valve Closed XXXX No venting XXXX Depressurization - Venting (Hazardous condition) X Number of Faults 01123 Relive Overpressure Command Inhibit: Module Isolated Sensor A Fail Sensor B Fail Hazardous Event: Depressurization

11. Software Engineering Research Lab. Department of Aero & Astro M.I.T.

12. Members Software Engineering Research Laboratory(SERL) Professor Nancy G. Leveson 1 Post-Doctoral 1 Visiting Engineer 15 Graduate Students

13. MIT SERL Research Topics Formal Modeling and Specification language Model Visualization Software Safety Analysis Accident Model Exploring techniques to industries

14. Modeling and Specification Formal Specification Language Intent Specification - SpecTRM-RL Task Analysis and Modeling Task Visualizing Model Language Necessity of Visualized Model