A systematic approach is presented to constructing a radiation assurance case using Goal Structuring Notation (GSN) for spacecraft containing COTS parts. The GSN paradigm is applied to an SRAM single-event upset experiment board designed to fly on a CubeSat in January 2017. A custom software language for development of a GSN assurance case is under development at Vanderbilt. Construction of a radiation assurance case without use of hardened parts or extensive radiation testing is discussed

Austin, R.

Evans, J.

Karsai, G.

LaBel, K.

Mahadevan, N.

Reed, R.

Schrimpf, R.

Sierawski, B.

Witulski, A.

NASA Technical Reports Server

1Goal Structuring Notation in a 
Radiation Hardening Assurance Case for 
COTS-Based Spacecraft 
A. Witulski1, R. Austin1, J. Evans2, N. Mahadevan1, 
G. Karsai1, B. Sierawski1, K. LaBel3, R. Reed1, R.Schrimpf1
This work supported under NASA Grant and Cooperative 
Agreement Number NNX15AV48G
1Vanderbilt University   2NASA HQ   3NASA GSFC
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
https://ntrs.nasa.gov/search.jsp?R=20160003584 2019-08-31T03:37:18+00:00Z
Vanderbilt Engineering
2
List of Acronyms
Addr = Address
AMSAT = Radio Amateur Satellite Corporation
CDH = Command and Data Handling (bus and processor) 
COTS = commercial off the shelf
FPF2006/2007/2123 = Fairchild Semiconductor family of load switches
GSN = Goal Structured Notation
I/O = input/output
IUCF = Indiana University Cyclotron Facility
LEO = Low-Earth Orbit
MA = mission assurance
R & M = reliability and maintainability
REM = Radiation Effects Modeling (SRAM circuit board & experiment)
RXTX = Receiver and Transmitter
SEE = Single Event Effect
SELs = Single Event Latchups
SEUs = Single Event Upsets
SRAM = Synchronous Random Access Memory
TID = Total Ionizing Dose
VU Cube Sat = Vanderbilt University CubeSat
WDT = Watchdog Timer
WebGME = Web-based Generic Modeling Environment (software)
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
3
Background: Mission Assurance
• NASA classifies spacecraft missions by criteria: Cost, national 
significance, priority, lifetime, launch constraints
• Class A: High-budget, highly significant,  e.g. space telescope
• Low risk tolerance: Conventional radiation testing, hardened parts, etc.
• (Sub) Class D: Low-budget, limited scope, short lifetime: CubeSat
• Relatively high risk tolerance
• Conventional radiation hardness assurance too expensive
• Majority use of commercial off-the-shelf (COTS) parts
• Still need as much mission assurance as possible 
• Model-Based representations of spacecraft systems can define 
sub-system functionality and interfacing, reliability parameters
• Quantitative evaluation of sub-system interactions
• Entire team works from one virtual model set
• Fault or failures can be propagated from one sub-system to another
• New paradigm for assurance: model-centric, not document-centric
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
4
Graphical Argument
Argument: “A 
connected series 
of claims intended 
to support an 
overall claim.” [1]
[1] GSN Community Standard Version 1 2011 
Assurance Case: “A reasoned and compelling argument, supported 
by a body of evidence, that a system, service or organization will operate as 
intended for a defined application in a defined environment.” [1]
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
5
Goal Structuring Notation (GSN)
GSN is a visual 
representation of a 
hierarchy of claims [1]
University of York U.K. 
Goal=Claim
Strategy=Inference
Solution=Evidence
Context=Background
Justification=Rationale
Assumption=Unsub-
stantiated Claim
[1] GSN Community Standard Version 1 2011 
Colors/Shapes Denote Function
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
6
Benefits of GSN
• Clarifies relationships between claims and makes 
assumptions explicit
• Facilitates connecting mission assurance claims to 
model-based representations of the system
• Document-centric/model-centric mission assurance (MA)
• Eventual goal: connect MA and quantitative models
• Construct graphical assurance case concurrently 
with design allows designers to address MA early
• Radiation Context:
• References radiation test data, hardened part specs
• Relates mitigation strategy to overall Assurance Case
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
7
Vanderbilt Custom GSN Modeling Language
• WebGME: Web-based Generic Modeling Environment
• Developed by Vanderbilt Institute for Software Integrated Systems
• Used to develop modeling framework for Goal Structured Notation 
Support for customizable Domain Specific Modeling Languages 
(DSML)
• Customizable modeling rules (meta-models) specify the syntax and 
semantics of the model
• Model elements may contain hyperlinks to to engineering 
documents and relevant artifacts
• Support for model interpretation
• Model interpreter algorithms traverse models to generate artifacts –
documents, code, inputs for integrating with other software/ utilities/ 
analysis engines
• Provides framework for linking to model-based descriptions of sub-
systems
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
8
WebGME GSN Screenshot
Model
Parts
Panel
Model
Editor
Canvas
Model
Tree
Browser
Attributes
Panel
Link to next GSN 
path fragment
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
9
NASA Reliability & Maintainability Template
Objectives-based 
approach to 
Reliability and 
Maintainability 
General structure 
for top-level goals 
for GSN 
assurance case
[2] Groen, F.J.; Evans, J.W.; Hall, A.J., "A Vision for 
Spaceflight Reliability: NASA's Objectives Based Strategy,” 
RAMS, 2015, 26-29 Jan. 2015
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
10
VU CubeSat SRAM Experiment Test Bed
• VU CubeSat payload architecture
• Space environment radiation 
testbed for TID, SEE
• Successful 8 x 4Mb SRAM 
experiment, launched 2015, 
reports SEUs, resets, power
Image Credit: AMSAT Day
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
11
GSN Demo Case: 28nm Commercial SRAM 
SEU Test in LEO 
• Launch January 2017
• Radiation Effects Modeling (REM) Board
• SEU detection in the SRAM
• Protect data from other SEEs on the board
• Count upsets from SEUs in SRAM, not SELs
• Current monitors for latch up detection
• Monitor separate for SRAM and other components
• High-current on SRAM causes the experiment to 
reset and not count recent upsets
• High-current on the rest of the board causes the 
microcontroller to reset while the SRAM continues to 
hold data
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
12
Block Diagram SRAM SEU Experiment Board
Sub-Class D: Allow latch-up, employ mitigation
Current monitors, watch-dog timer sense SEL
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
13
GSN Assurance REM SEU Experiment Board
• Top Goal states overall 
objective
• Context statements 
give easy access to 
relevant mission docs
• Top-level goals and 
strategies track NASA 
R&M template
To Strategy 2 
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
14
GSN Assurance REM SEU Experiment Board
• Not all branches of GSN 
graph shown
• Assumptions are clearly 
identified
• Argument path 
terminates in Solution
• Validity of assurance 
case determined by 
reading from Solutions to 
top-level goals. 
From Goal 2
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.
Vanderbilt Engineering
15
Summary: Graphical Assurance Case 
Argument in Goal Structuring Notation
• Dependence of argument claims made explicit
• Structure imposes rigor on assurance case
• Surfaces assumptions implicit in text arguments
• Graphical form naturally compatible with model-
based descriptions of systems: SysML, CyPhyML
• Custom GSN modeling language in development
• GSN example demonstrated in design of CubeSat 
SRAM SEU experiment circuit board
• Graphical assurance case helps designers address 
mission assurance concerns during design
To be presented by Arthur F. Witulski at the GOMAC Tech 2016 Government Microcircuits Applications & Critical Technologies Conference, 
Orlando, FL, March 16, 2016.


Goal Structuring Notation in a Radiation Hardening Assurance Case for COTS-Based Spacecraft

Goal Structuring Notation in a Radiation Hardening Assurance Case for COTS-Based Spacecraft

Abstract

Similar works

Full text

Available Versions

NASA Technical Reports Server