Formal Methods for the International Space Station ISS - Correct System Design: Recent Insights and Advances - page 364

To facilitate the setup of new test congurations, a generic architecture is
used for the real-time test sub-system: as sketched above, test specications are
executed by the AML. Communication between abstract machines and the map-
ping from abstract events to concrete data that may be passed to the interface
of the system under test, as well as the abstraction of raw system output data to
abstract events that may be consumed by the abstract machines is performed in
the communication control layer (CCL) of the test engine. The interface module
layer (IFML) connects to the concrete interfaces of the system under test. While
AML and CCL always reside on the same computer called the RT-Tester En-
gine , the IFML may be allocated on specialised hardware, if the system under
test is equipped with non-standard interfaces which cannot be directly interfaced
from the test engine. In this case, test engine and interface modules (IFMs) use
standard interfaces (Ethernet, parallel or serial links) to communicate with each
other.

4.3 FTC Test Conguration

The instantiation of the generic conguration for FTC tests is shown

in Figure 4. The system under test consists of an FTC EQM operating in a
4-lane conguration. The interface to the operational environment consists of 6
MIL busses (4 busses used in bus controller mode, 2 as remote terminals). Each
of the 6 busses has a redundant spare wire and interfaces to a specic FTC lane.
In addition, two auxiliary interfaces are used to support specic fault injections
during testing. For the software layers AVI, FML and ASS, the original flight
software was used. Since no concrete application software layer was available, a
test application software layer (TASL) was developed and installed on top of the
ASS (see Section 4.4 below).
The

RT-Tester

engine consists of a SUN ULTRA SPARC computer with two
300MHz CPUs, running the SOLARIS 2.6 operating system. To connect these
FTC interfaces to the

RT-Tester

system, an IFML comprising the three interface
modules MBSU, BTS, FTC-TE has been used: The MIL Bus Simulation Unit
(MBSU) sends and receives data on the MIL busses, implementing the ISS frame
protocol layer on top of the MIL-STD 1553 protocol. Frames read from the busses
are relayed to the

RT-Tester

engine. Conversely, the test engine sends commands
for test control and frames to be passed on to the corresponding MIL busses to
the MBSU. The Byzantine Traitor Simulator (BTS) provides a fault injection
interface at the cross strapping links between lanes. This is used by

RT-Tester

RT-Tester
to exercise exceptional-behaviour tests on the target system in order to analyse
the correctness of the Byzantine agreement protocol and the voting mechanisms
implemented in the FTC lanes. The FTC Test Equipment (FTC-TE) provides
an interface to stimulate VME interrupt errors, clock errors and to reset a lane
completely.