Flight and ground software architecture tier (models 63–69, 88, 94) with its document set by devin-ai-integration[bot] · Pull Request #23 · Open-MBEE/Tethys

devin-ai-integration · 2026-10-23T08:37:30Z

Summary

The software architecture of the mission, modelled in SysML v2 as the layer below the system tier, integrated from nine work packages (#14–#22, each merged here as a merge commit with the pinned runs re-recorded on the combined tree). Stacked on wp/tool-pin (#13); retarget to develop once #11–#13 are in.

Flight (63 architecture + deployment, 64 dictionary, 65 behaviour, 66 timing/budgets): the fictional Argent Flight Executive — board support, a Kestrel-class time-partitioned executive on a 1 s / 8-minor-frame schedule, core services, and twelve table-driven applications (C&DH, GN&C, SEP, power, thermal, telecom, inspector handling, capture control, autonomy/sequencing, FDIR, mode management, parameters/boot/update) deployed on the two FlightComputers over the fictional AABP-1 bus. One model-derived dictionary (344 commands with a 344-literal Opcode, 51 hazardous; 961 telemetry points; 181 events; 51 packets in 6 APID classes; parameter and FDIR limit tables) generated by the committed scripts/gen-flight-dictionary.py. Eight application state machines, mode-management and FDIR software exhibiting TugModes/FdirSupervisor, a sequencing engine typing the six on-board sequences; the capture controller's no-fire-without-inhibits property holds under -engine check. Rate groups, per-application WCET/period/deadline, latency chains, AABP-1 slot schedule, CPU/memory/bus budgets per mode at the policy's 50 % reserve.

Interfaces (68): TI-020 AABP-1 protocol, TI-021 MLS-2 link profile over CCSDS Space Packets with one rate set per TugMode, TI-022 flight↔Wren relay, TI-023 RIU register maps, a 12-message inter-application catalogue — each rendered as an ICD document. CCSDS and XTCE are the only real standards cited.

Ground (69): the Meridian Operations Suite — command builder validating against the dictionary (hazardous two-step), executable sequence checker that clears the nominal uplink and refuses the FR-001 thrust-during-relay sequence, telemetry decommutation/limits/alarms/trending, flight dynamics, pass planner, archive, anomaly tracker, proximity-operations planner, four simulators typed as the programme's test beds (MeridianOperationsSuite::testBeds :> TethysVerification::testBeds).

Requirements (67): 40 TF- flight and 12 TM- ground rows, each constrained over backbone attributes, derived from TS/TA/TC/TG/FR/GS and satisfyd by a software element; coverage queries show no underived or unsatisfied row and no software part without a row.

Assurance (88): 35 criticality rows (0 unclassified), software hazards linked to 85, the capture/thruster inhibit register covering all 51 hazardous commands with independence constraints, a 13-row software FMECA, a fault tree, an assurance plan with independent V&V for level A, and a 41-row VCRM over unit/integration/FSW-in-the-loop/HIL/flatsat/model-in-the-loop cases — 10 model-in-the-loop cases pass against the pinned runs, 31 are planned and print ? (unbound measured inputs) on purpose. The TF-/TM- rows are verify-linked from the cases that cover them (131 links; TF-010/011/012/023 derive only from budget rows no case verifies and are listed by UnverifiedSoftwareRequirements).

Document set (94, 31 volumes, every section a model query): index, software architecture description, software requirements specification, 12 flight-application and 12 Meridian-component design descriptions, ICD volume, dictionary volume, test plan/VCRM, operations handbook. Whole set renders in 18.5 s / 720 KB; the pinned runs/documents*/ output is the record.

Verdicts the model gives (not resized)

TF-011 bus reserve fails: the AABP-1 schedule uses 36 of 64 slots in proximity-operations/capture/despin against 32 allowed at the 50 % reserve (coast uses exactly 32 and closes). Decision for the maintainer: lower the inspector-relay or capture-camera stream rate in those modes, or change the SoftwareMarginPolicyRow.
Processor (442 MIPS peak → 530 allocated of 600) and memory (0.26) close; all latency chains close against TA-010/TC-005/TS-015.
Release gate SA-001/SA-002 is open: level-A independent V&V is inProgress until the planned cases are executable.
The power-margin verdict from Pin OpenSysML to develop 5cd37f288 and apply the model follow-ups it unblocks #13 (0.119 < 0.15) is unchanged.

Backbone edits outside 63–69/88/94

04 (software tier/level literals; SystemRequirement::tier becomes default = so the software tier can redefine it), 10/23/30/31/32/50/51/53/54/60/61/62/87/99 (ports, allocation ends, margin-policy software rows, house rules for the new packages — each listed in the package's docs/coverage/WP-SW-*.md). 63: GncApplication, FdirApplication, CaptureControlApplication declare rate = 16.0 [Hz], the rate 66's schedule actually hosts them at (TF-031/TF-039 exposed the 1 Hz / 10 Hz defaults).

Gates

sysml 5cd37f2: strict validate, make pilot-mission, make pilot-all, house rules 80 525 elements / 703 312 checks / 0 violations, make runs, make check all exit 0 on the integrated head. runs/: 209 new, 138 modified (loaded-file/package lines, element-id shifts, the new software verdicts and documents — categorised per package in #14–#22). Pilot cost: pilot-all 2m41 → ~2m52 from the 344-literal enum.

Findings

Eight docs/findings/WP-SW-*.md files (F-S01…S10, F-SW188…SW903), each pinned with a probe under model/probes/; the open OpenSysML items — send via a state-definition port (predates the pin), a redefined nested state's entry action not running, a [*] collection populated only by subsetters reading <undetermined>, 3-end interface collapsed in the allocation matrix, verify of a case with an unbound in printing ?, -graphs panic on FdirSupervisor/TugModes, query arguments binding literals only — are tracked there for the next pin bump.

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/bd8333c05232470c8601104d484dcc58
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/bd8333c05232470c8601104d484dcc58?variant=devin
Requested by: @HuiJun

Layered flight software of Argent (board support, Kestrel-class partitioned executive, nine core services, twelve applications, AABP-1 software bus, five partitions, two images) placed on the prime and redundant flight computers, with SoftwareDeployment allocations from software functions to applications to partitions to computers, queries proving no application or partition is unallocated, and the house rule that every allocation is typed. Co-Authored-By: jason.han <hanhuijun@gmail.com>

…MLS-2, relay and RIU register ICDs Add TethysSoftwareIcds (model/68-software-icds.sysml): the inter-application message catalogue over the AABP-1 software bus with three- and four-ended topic interfaces, the AABP-1 on-board bus protocol ICD (TI-020), the MLS-2 space-link profile over CCSDS Space Packets with a rate set per tug mode (TI-021), the tug-inspector relay profile (TI-022) and the remote interface unit register maps (TI-023), with interface requirements TI-120..TI-123 and their verification cases, tied to the flight software by argentSoftwareIcds. Add TethysSoftwareIcdDocuments (model/68-software-icds-tooling.sysml): one DocumentQueries document per ICD plus the message catalogue, and a filtered element-table view of the message types. Backbone: the InterfaceControl doc in 51 reserves TI-020..TI-029; the 54 register queries read TethysSoftwareIcds beside TethysIcds. Two probes record how both validators treat n-ary interfaces and specialised allocation end redefinitions; coverage and findings are documented, runs re-recorded. Co-Authored-By: jason.han <hanhuijun@gmail.com>

…kets and tables TethysFlightDictionary (model/64-flight-dictionary.sysml, generated by scripts/gen-flight-dictionary.py) carries 344 commands with a 344-literal Opcode enumeration, 961 telemetry points, 181 events, 51 CCSDS packets with a fictional time-code secondary header and Natural field layouts, twelve parameter tables and the FDIR limit table. Dictionary counts and consistency flags in TethysOperations::Dictionary are now bound from it, TG-010 requires them, and four reflective house rules check every command, point, event and packet. The tooling sibling renders the dictionary as a document; probes pin the large-enumeration, packet-layout and large-literal boundaries. Co-Authored-By: jason.han <hanhuijun@gmail.com>

… the base branch Co-Authored-By: jason.han <hanhuijun@gmail.com>

…dictionary Co-Authored-By: jason.han <hanhuijun@gmail.com> # Conflicts: # docs/coverage-matrix.md # runs/allocations-instantiate.txt # runs/allocations-matrix.txt # runs/allocations-queries.txt # runs/allocations-requirement-matrix.txt # runs/analyses-capture.txt # runs/analyses-external-tool.txt # runs/analyses-sweep.txt # runs/analyses-transfer.txt # runs/as-built-individuals.txt # runs/as-built-integration.txt # runs/as-built-satisfy.txt # runs/disposal-requirements.txt # runs/disposal-sequence.txt # runs/disposal-states.txt # runs/document-queries.txt # runs/dynamics-array-sweep.txt # runs/dynamics-standard.txt # runs/dynamics-tables.txt # runs/environment-calcs.txt # runs/fdir-command-loss-expired.txt # runs/fdir-command-loss-modes-safe.txt # runs/fdir-command-loss-recovered.txt # runs/fdir-command-loss-timeline.txt # runs/fdir-earth-impact-abort-hold.txt # runs/fdir-earth-impact-aborted.txt # runs/fdir-earth-impact-nominal-return.txt # runs/fdir-inhibit-chain-check.txt # runs/fdir-inhibit-chain-held.txt # runs/fdir-inhibit-chain-smt.txt # runs/fdir-thruster-modes-safe.txt # runs/fdir-thruster-on-spare.txt # runs/fdir-thruster-ppu-cross-strapped.txt # runs/fdir-thruster-restarting.txt # runs/fdir-thruster-string-lost.txt # runs/house-rules.txt # runs/import-dry-run.txt # runs/import-repl.txt # runs/instantiate-system.txt # runs/list-views.txt # runs/modes-inspector-imaging.txt # runs/modes-inspector-retired.txt # runs/modes-table.txt # runs/modes-tug-dense-target.txt # runs/modes-tug-early-ops.txt # runs/modes-tug-full-flight.txt # runs/modes-tug-proximity-ops.txt # runs/modes-tug-thrust-arc.txt # runs/montecarlo-capture.txt # runs/montecarlo-insertion.txt # runs/montecarlo-missed-thrust.txt # runs/montecarlo-return.txt # runs/notation-readiness.txt # runs/physics-calcs.txt # runs/physics-predicate.txt # runs/probe-F-F01.txt # runs/probe-F-F02.txt # runs/probe-F-F03.txt # runs/probe-F-F06.txt # runs/probe-F-F07.txt # runs/render-all.txt # runs/render-documents-html.txt # runs/render-documents-md.txt # runs/render-mass-budget-csv.txt # runs/render-segment-interfaces-dot.txt # runs/requirements-satisfy.txt # runs/risk-calcs.txt # runs/risk-constraints.txt # runs/risk-instantiate.txt # runs/risk-register-view.txt # runs/safety-calcs.txt # runs/safety-constraints.txt # runs/safety-instantiate.txt # runs/sequence-dense-target.txt # runs/sequence-large-target.txt # runs/sequence-nominal-trace.txt # runs/sequence-nominal.txt # runs/sequence-phase-plan.txt # runs/sequence-schedule.txt # runs/sequence-small-target.txt # runs/sw-deployment-matrix.txt # runs/sw-deployment-queries.txt # runs/sw-fsw-structure.txt # runs/test-campaign.txt # runs/tooling-dro-stability.txt # runs/tooling-dynamics.txt # runs/tooling-montecarlo-continuous.txt # runs/tooling-montecarlo-max.txt # runs/tooling-montecarlo-min.txt # runs/tooling-montecarlo.txt # runs/tpm-margins.txt # runs/trades-sweep.txt # runs/trades.txt # runs/unverified-requirements.txt # runs/validate.txt # runs/variants-calcs.txt # runs/variants-configurations.txt # runs/verification-cases.txt # runs/vv-matrix-l2.txt # runs/vv-report.txt # runs/wpb-budgets-satisfy.txt # runs/wpb-data-daily.txt # runs/wpb-hydrazine-large.txt # runs/wpb-margin-policy.txt # runs/wpb-mass-budget.txt # runs/wpb-pointing-antenna.txt # runs/wpb-power-budget-safe.txt # runs/wpb-radiator-capacity.txt # runs/wpb-reliability.txt # runs/wpb-sep-thrust-aphelion.txt # runs/wpb-thrusting-time-large.txt # runs/wpb-tug-dry-mass-allocated.txt # runs/wpb-tug-dry-mass.txt # runs/wpb-tug-sep-mass.txt # runs/wpb-unit-power-safe.txt # runs/wpb-unit-power-thrusting.txt # runs/wpb-xenon-large.txt # runs/wpc-capture-calcs.txt # runs/wpc-capture-sequence.txt # runs/wpc-envelope-cases.txt # runs/wpc-individuals.txt # runs/wpc-inspector-calcs.txt # runs/wpc-prox-ops-modes.txt # runs/wpc-requirements.txt # runs/wpc-target-cases.txt # runs/wpd-decibels.txt # runs/wpd-flight-rules.txt # runs/wpd-ground-matrix.txt # runs/wpd-icd-matrix.txt # runs/wpd-icd-register-document.txt # runs/wpd-link-margins.txt # runs/wpd-link-satisfy.txt # runs/wpd-operations-satisfy.txt # runs/wpd-operations-timeline.txt # runs/wpd-relay-load.txt # runs/wpd-space-ground-icd-document.txt # runs/wpd-thrust-arc-procedure.txt

Package TethysFlightBehaviour (model/65): one state machine per application with modes, exhibited by the application parts of ArgentFlightSoftware; the mode manager exhibits TugModes and dispatches application commands over command links; the FDIR application exhibits FdirSupervisor with its own limit table and relays its requests; the sequencing engine as action definitions; the capture controller realises CaptureSequence with the inhibit chain as its own attributes and asserts NoFireWithoutInhibitsRemoved, checked exhaustively. Backbone: SubsystemConfiguration rows carry application activity and TugModes entry/exit actions name the applications (60); the sequences specialise a new OnBoardSequence (61); FdirSupervisor::limits is a default (62). Runs sw-* pinned with the modes, FDIR and capture event scripts; probes and findings F-S01..F-S10 under docs/findings/WP-SW-3.md. Co-Authored-By: jason.han <hanhuijun@gmail.com>

Co-Authored-By: jason.han <hanhuijun@gmail.com>

…interface control package Co-Authored-By: jason.han <hanhuijun@gmail.com>

Co-Authored-By: jason.han <hanhuijun@gmail.com>

…duled tasks TethysFlightTiming places the Argent flight software on the Kestrel executive: four harmonic rate groups, the slices every partition owns in a minor frame and 22 scheduled tasks with WCET, jitter, deadline and firing frames. Each partition asserts its utilisation fits its share and every minor frame's demand fits its slices. Adds the subsetting probe and the sw-timing-budgets run. Co-Authored-By: jason.han <hanhuijun@gmail.com>

… budgets Add model/66-flight-timing.sysml (TethysFlightTiming): the executive's rate groups and minor-frame schedule, per-application period/WCET/deadline/jitter, end-to-end latency chains asserted against the FDIR detection, FDIR period and safe-configuration requirements, the AABP-1 bus schedule, and processor, memory and bus demand tables per partition and per TugMode closed against a software margin-policy row. The full-schedule bus budget does not close at 50 % reserve (36 of 64 slots) and the model says so. Backbone: software margin rows in 30, FlightComputer load/memory defaults in 31 bound from the timing totals, ProcessorBudget reading the software policy plus BusBudget and LatencyBudget in 32. Probes for duration arithmetic, a thirty- member requirement and a response-time recursion; coverage, findings and the sw-timing-budgets run. Co-Authored-By: jason.han <hanhuijun@gmail.com>

TethysGroundSoftware models the ground software as components with ports and interfaces over the Meridian ground segment: command builder validating against the flight dictionary, an executable sequencer and flight-rule checker (clears a nominal sequence, refuses thrust during a relay pass under FR-001 and releases cleared sequences as LoadSequence commands through TI-021), telemetry server with decommutation, limits, alarms and trending, flight dynamics, pass planner producing DailyPassPlan/StationPass at the MLS-2 rate sets, data archive, anomaly tracker, proximity planner, simulators typing the TestBed parts, role use cases and GS-001..GS-004 requirements. Backbone: 50 gains GroundSoftwareComponent slots on the facilities, 53 StationPass/DailyPassPlan gain producedBy, 23 testBeds becomes a TestBedSet. Runs sw-ground-structure and sw-ground-sequencer-check added; all runs re-recorded on the pinned tool. Four runtime findings with probes. Co-Authored-By: jason.han <hanhuijun@gmail.com>

…iming and software budgets)

…n ground software) Co-Authored-By: jason.han <hanhuijun@gmail.com> # Conflicts: # runs/as-built-satisfy.txt # runs/house-rules.txt # runs/requirements-satisfy.txt # runs/validate.txt # runs/wpb-budgets-satisfy.txt

…g + ground software) Co-Authored-By: jason.han <hanhuijun@gmail.com>

…sfaction coverage Add TethysSoftwareRequirements (40 TF- flight rows, 12 TM- ground rows, two tier defs) and its tool-tier companion with the coverage queries and the rendered software requirements document. Every row has a doc with rationale, a measurable require constraint, derivation sources in 21/22/32/53/69 and a satisfying software element in 63/65/66/69; TF-011 (AABP-1 reserve in the full modes) and TF-039 (FDIR application rate vs TC-005) fail visibly. Backbone: RequirementTier::software, VerificationLevel::software, and SystemRequirement::tier written as a default so the software tier can redefine it. Runs re-recorded; probes F-SW503 and F-SW505 added. Co-Authored-By: jason.han <hanhuijun@gmail.com>

…MECA, assurance plan and V&V cases Mission-tier model/88-software-assurance.sysml classifies every flight and Meridian software component against the hazard log, adds the software causes and controls per hazard, a 13-row software FMECA, a software fault tree, the inhibit-independence constraints, the per-level assurance plan with its open release gate (SA-001/SA-002), and 41 verification cases across six test levels; model/88-software-assurance-tooling.sysml renders the classification, coverage, FMECA, VCRM and release-gate queries and documents. Runs re-recorded (22 new sw-assurance-* runs); probes and findings F-SW801/F-SW802. Co-Authored-By: jason.han <hanhuijun@gmail.com>

…equirements tier)

FdirApplication kept the 1 Hz Application default while the Kestrel schedule hosts it (and the GNC and capture-control applications) in the 16 Hz rate group; the software requirement rows read the declared rate, so TF-039 and TF-031 compared against the default. Declare all three at 16 Hz and re-record the runs that read them. Co-Authored-By: jason.han <hanhuijun@gmail.com>

…rance and V&V) Co-Authored-By: jason.han <hanhuijun@gmail.com> # Conflicts: # runs/as-built-satisfy.txt # runs/house-rules.txt # runs/render-documents-html.txt # runs/render-documents-md.txt # runs/requirements-satisfy.txt # runs/validate.txt # runs/wpb-budgets-satisfy.txt # scripts/runs.sh

…uirements + assurance) Co-Authored-By: jason.han <hanhuijun@gmail.com>

…ify links Add TethysSoftwareDocuments (document register, system-case usages that verify the derived TF-/TM- rows) and TethysSoftwareDocumentsTooling (the architecture description, requirements specification, 24 design descriptions, interface control volume, dictionary volume, test plan, operations handbook and index, all rendered from the model). The Meridian test beds subset TethysVerification::testBeds; the software verification case definitions verify the TF-/TM- rows derived from the system rows they verify. Pin one run per document, probes F-SW901..903 and the coverage and findings notes. Co-Authored-By: jason.han <hanhuijun@gmail.com>

…ocument set, shared test beds, software verify links)

devin-ai-integration · 2026-10-23T08:37:35Z

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

Disable automatic comment, CI, and merge conflict monitoring

…t-case period, xenon trend from the propellant book) Co-Authored-By: jason.han <hanhuijun@gmail.com> # Conflicts: # runs/as-built-satisfy.txt # runs/house-rules.txt # runs/requirements-satisfy.txt # runs/wpb-budgets-satisfy.txt # runs/wpd-operations-satisfy.txt

… the flown arcs)

devin-ai-integration Bot and others added 28 commits October 22, 2026 19:26

Merge wp/sw-fsw-architecture into integration/phase-6

183a112

Merge wp/sw-icds into integration/phase-6

62de601

docs(coverage): record the gate cost of the flight dictionary against…

98e0b84

… the base branch Co-Authored-By: jason.han <hanhuijun@gmail.com>

chore(probes): name the scale and timing probes by finding id

be0cbbd

Co-Authored-By: jason.han <hanhuijun@gmail.com>

chore(runs): re-record the runs on the tree merged with the software …

1f6d98b

…interface control package Co-Authored-By: jason.han <hanhuijun@gmail.com>

Merge integration/phase-6 into wp/sw-fsw-behaviour

adbb1cc

Co-Authored-By: jason.han <hanhuijun@gmail.com>

Merge wp/sw-fsw-behaviour into integration/phase-6

0a219c8

Merge wp/sw-dictionary into integration/phase-6

57b6d01

Re-record runs on the combined integration/phase-6 tree

8136813

Merge wp/sw-timing-budgets into integration/phase-6 (WP-SW-4 flight t…

1ddef8f

…iming and software budgets)

Re-record runs on the combined integration/phase-6 tree (flight timin…

7037c66

…g + ground software) Co-Authored-By: jason.han <hanhuijun@gmail.com>

Merge wp/sw-requirements into integration/phase-6 (WP-SW-5 software r…

63f8b4d

…equirements tier)

Re-record runs on the combined integration/phase-6 tree (software req…

df84bdd

…uirements + assurance) Co-Authored-By: jason.han <hanhuijun@gmail.com>

Merge wp/sw-document-set into integration/phase-6 (WP-SW-9 software d…

88cbd30

…ocument set, shared test beds, software verify links)

devin-ai-integration Bot assigned HuiJun Oct 23, 2026

devin-ai-integration Bot requested a review from HuiJun October 23, 2026 08:37

devin-ai-integration Bot mentioned this pull request Oct 23, 2026

Executable flight and ground software generated from the architecture, with its conformance harness (software/) #29

Open

devin-ai-integration Bot added 2 commits October 24, 2026 00:55

Merge wp/tool-pin into integration/phase-6 (xenon trend: allowance on…

1606579

… the flown arcs)

Navigation Menu

Repository navigation

Flight and ground software architecture tier (models 63–69, 88, 94) with its document set - #23

Flight and ground software architecture tier (models 63–69, 88, 94) with its document set#23
devin-ai-integration[bot] wants to merge 30 commits into
wp/tool-pinfrom
integration/phase-6

devin-ai-integration Bot commented Oct 23, 2026

Uh oh!

devin-ai-integration Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

devin-ai-integration Bot commented Oct 23, 2026

Summary

Verdicts the model gives (not resized)

Backbone edits outside 63–69/88/94

Gates

Findings

Uh oh!

devin-ai-integration Bot commented Oct 23, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant