Experimental Evaluation of Verification and Validation Tools on Martian Rover Software

  • Authors:
  • Guillaume Brat;Doron Drusinsky;Dimitra Giannakopoulou;Allen Goldberg;Klaus Havelund;Mike Lowry;Corina Pasareanu;Arnaud Venet;Willem Visser;Rich Washington

  • Affiliations:
  • Kestrel Technology, NASA Ames Research Center, Moffett Field, CA 94035, USA;Time-Rover, 11425 Charsan Ln., Cupertino, CA 95014, USA;RIACS, NASA Ames Research Center, Moffett Field, CA 94035, USA;Kestrel Technology, NASA Ames Research Center, Moffett Field, CA 94035, USA;Kestrel Technology, NASA Ames Research Center, Moffett Field, CA 94035, USA. havelund@email.arc.nasa.gov;NASA Ames Research Center, Moffett Field, CA 94035, USA;Kestrel Technology, NASA Ames Research Center, Moffett Field, CA 94035, USA;Kestrel Technology, NASA Ames Research Center, Moffett Field, CA 94035, USA;RIACS, NASA Ames Research Center, Moffett Field, CA 94035, USA. wvisser@email.arc.nasa.gov;RIACS, NASA Ames Research Center, Moffett Field, CA 94035, USA

  • Venue:
  • Formal Methods in System Design
  • Year:
  • 2004

Quantified Score

Hi-index 0.00

Visualization

Abstract

We report on a study to determine the maturity of different verification and validation technologies (V&V) applied to a representative example of NASA flight software. The study consisted of a controlled experiment where three technologies (static analysis, runtime analysis and model checking) were compared to traditional testing with respect to their ability to find seeded errors in a prototype Mars Rover controller. What makes this study unique is that it is the first (to the best of our knowledge) controlled experiment to compare formal methods based tools to testing on a realistic industrial-size example, where the emphasis was on collecting as much data on the performance of the tools and the participants as possible. The paper includes a description of the Rover code that was analyzed, the tools used, as well as a detailed description of the experimental setup and the results. Due to the complexity of setting up the experiment, our results cannot be generalized, but we believe it can still serve as a valuable point of reference for future studies of this kind. It confirmed our belief that advanced tools can outperform testing when trying to locate concurrency errors. Furthermore, the results of the experiment inspired a novel framework for testing the next generation of the Rover.