Tools and Processes for
Improving the Certiﬁabilityof ROS 2
Michael Jeronimo and Geoffrey Biggs
Open Robotics

www.openrobotics.org

1

(ROS-based) Robots
are everywhere
on EarthRobots are also in spaceMobility
systems

Manipulators
Humanoid
robotswww.openrobotics.org

Roboticlanders
Robotic
spacecraft

4

1970 – joystick
control

2020 – 2M lines of code

Increasing amount of software + cost of software development= demand for reuse
www.openrobotics.org

5The Demand for Reuse
The space community is already moving toward
componentized, reusable, and openframeworks for ﬂight softwareand mission control••••F' (F Prime)
core Flight System (cFS)
Yamcs
OpenMCT

Also using smaller open source projects
in ﬂight•

AprilTag (visual ﬁducial system) used
on Perseverance

www.openrobotics.org
www.openrobotics.org

6

ROS-based robots have already been to space

2014: Robonaut 2
www.openrobotics.org
www.openrobotics.org

2019: Astrobee7NASA VIPER
Prospecting for lunar
resources in permanently
shadowed regions of thelunar south pole

●ROS used in ground softwaresystems●Gazebo simulation used inmission development,
testing, planning, operatortraining, etc.

●

Other open source software○cFS/ROS bridge○Yamcs○OpenMCT●NASA requires software
used in ﬂight missions tobe space qualiﬁed

CONFIDENTIAL - Do not duplicate or distribute without written permission from Open Robotics

What we need: A version of ROS for space applications!
A space-certiﬁable and reusable space robotics framework●

Support certiﬁcation according to ﬂight software standards, like DO-178C and NASA’s NPR7150.2●

Provide artifacts to allow space ﬂight projects to gain a head start on their certiﬁcation effortsThat brings the beneﬁts of ROS to space robotics●Enable rapid development of new robotic capabilities●Facilitate reuse across missions, reducing development effort and costs●Open source software, use open community processes

What is Space ROS?
Space ROS 2022

FoundationTools and Processes

●
●
●
●
●
●
●

● Requirements tools andprocesses for traceability
and analysis● Code analysis tools withSARIF output● Dashboard for issue
navigation, visualization &dispositioning● Development workflow● Quality level(s)● MC/DC testing

BuildsReleases
Continuous Integration
MaintenancePackage subset
Docker images
Embedded target(s)www.openrobotics.org
www.openrobotics.org

Space-SpecificFunctionality● Eventing & Telemetry
Subsystem● C++ PMR allocator● Sample applications fornavigation andmanipulation● Simulation assets1Requirements management in aerospace
More than checklists●

Typically managed using a strict process and proprietary tools○Process is often according to some accepted standard, e.g. DO-178C●

Requirements must be complete - no software without requirements - and highly
detailed●

Multiple levels of requirements - from abstract needs to detailed behaviour timings●

Traceability is essential - source to requirement to implementation and veriﬁcation,and back again●

Requirements ultimately are used to support a certiﬁcation process

www.openrobotics.org
www.openrobotics.org

1Requirements management in open source software
What requirements?

●

Requirements are typically non-existent●

Any requirements that do exist are lightly managed (and easily get out-of-date)●

Heavy processes are shunned to avoid discouraging contributions

www.openrobotics.org
www.openrobotics.org

1

Open requirements for Space ROS
Balance competing forces●

Heavy-weight requirements process using expensive tools
is inappropriate for an open-source project●

Need a process and tool(s) that won’t discouragecontributions○○●

Contributors are unlikely to purchase expensive
requirements management tools
Heavy-weight processes discourage drive-by contributors

Strongprocesses

Open-source

Must strike a balance between aerospace’s need for strong
processes and open-source’s desire forease-of-contributing

www.openrobotics.org
www.openrobotics.org

1Tools for open requirements management
Doorstop●

Simple requirements management tool providing acommand-line-and-text-editor based workﬂow○○○●

Based on YAML ﬁles stored in a versioned repository
○
○
○

●

Add and edit requirements
Trace between requirements
Generate reports
Requirements are stored in a human-readable format
Easy to parse for additional automation tools
Requirements can be written in restricted natural language, e.g. EARS

Open-source○○○

Can be modiﬁed to meet our needs
Freely available to contributors
https://doorstop.readthedocs.io/en/latest/

www.openrobotics.org
www.openrobotics.org

1Tools for open requirements management
FRET●

Graphical tool for creating and managing semi-formal andformal requirements●

Stores requirements in a database, with JSON import/export●

Requirements can be written in “FRETish”, which can containlinear temporal logic expressions●

Automatic model checking of requirements forconsistency and conﬂicts●

Although freely available, the learning curve is
steeper than Doorstop●

Automatic generation of safety monitor(s) fromrequirements expressed FRETishwww.openrobotics.org
www.openrobotics.org

1Management of requirements in Space ROS
Information ﬂows and processes
Review via PR
New requirements

Sync

Detailed (formalised)requirements

Functional
requirements

Traces

Source code
Traceability
report

Test results

Validate

Veriﬁcation(test) reportNon-functionalrequirements

FRET

www.openrobotics.org
www.openrobotics.org

Doorstop(Git repository)

Generate1

Management of requirements in Space ROS
Key points●

Doorstop used for:○○○○

High-level requirements
Non-functional requirements
Requirements traceability management
Artefact generation (e.g. traceability reports)●

FRET used for detailed functional requirements and consistency checks●Requirements stored in Git (single source of truth)○●

Pull requests provide a chance for requirements review

Trace to implementation and tests via Git commit hashes

www.openrobotics.org
www.openrobotics.org

1Static Analysis
Meeting the needs of aerospace with open-source analysers●Increase code quality, provide information supporting veriﬁcation efforts●

Space ROS provides a suite of static analyzers, including IKOS and Cobra from NASA●

Currently adding dynamic analysis: code coverage and MC/DC testing●

The static analysis tools generate SARIF output

●

●

○

Currently, most tools parse the output of the tool

○Tools should eventually support SARIF directly; would allow for more detailed information in SARIF

Filtering pass to remove (some) redundancy○

Currently, removing identical issues○Would like to remove semantic equivalents

The results are made available to the Space ROS Dashboard○

An archive format that contains analyzer output, ﬁltered output, and metadata

www.openrobotics.org
www.openrobotics.org

1

IKOS (Inference Kernel for Open Static Analyzers)
Application of formal methods to support certiﬁcation●DO-178C includes an extension, DO-333, that describes how developers can use staticanalysis in certiﬁcation○○●

IKOS is a static analysis framework, based on the Theory of Abstract Interpretation○○●

DO-333 provides guidance on how formal (mathematical) methods may to produce
veriﬁcation evidence suitable for use in certiﬁcation
DO-333 lists Abstract Interpretation as a suitable methodology
Used to develop static analyses that are both precise and scalable
The framework makes it accessible to a larger class of static analysis developers

References○○

https://jorgenavas.github.io/papers/ikos-sefm14.pdf
https://github.com/NASA-SW-VnV/ikos“... computations can be abstracted and reduced to a generalized set of objects and still exhibit the same critical propertiesof the parent program. By reducing the set of objects through abstraction, IKOS is scalable to large complex computer
programs and presents a sound approach to verification of such programs.”
www.openrobotics.org
www.openrobotics.org

1Cobra (code browser and analyzer)
An extensible, interactive tool for the analysis of C/C++ code●

A static analysis capability that works well for large code bases●Fast analysis of general code patterns, common coding ﬂaws, or coding rule compliance○○●

Can be used in one of three modes○○○●Performs lexical analysis to generate a stream of language-level tokens
Stores the key information of source code in an extremely simple data structure
As an interactive query engine to match patterns with a simple query language
Execute inline Cobra programs that can contain arbitrary branching and iteration over thetoken stream to identify more complex types of patterns
As an infrastructure for building more elaborate standalone checkers that are compiled
separately and linked with the Cobra code that builds the central data structure

References○○

https://software.nasa.gov/software/NPO-50050-1
https://github.com/nimble-code/Cobra

www.openrobotics.org
www.openrobotics.org

2

Cobra (code browser and analyzer)
An extensible, interactive tool for the analysis of C/C++ codewww.openrobotics.org
www.openrobotics.org

2

SARIF (Static Analysis Results Interchange Format)
Uniﬁcation of static analysis results● A JSON-based exchange
format for the output ofstatic analysis tool
● Used by IDEs, code analysis
tools, continuous integration
systems, etc.
● SARIF output by all SpaceROS static analyzers

https://docs.oasis-open.org/sarif/sarif/v2.0/sarif-v2.0.html
www.openrobotics.org
www.openrobotics.org

2

VSCode SARIF plugin
Making static analysis results visible

www.openrobotics.org
www.openrobotics.org

2Extending the VSCode SARIF plugin
Making static analysis results visible● Insight into static analysis, code
coverage, build status, issue
burndown, etc.
● A starting point for the open
source community to extend
and improve● Interface to build, test, using
Earthly (same as CI)● Integrate with external
dispositioning systems● Plugin available on the VSCode
Marketplacewww.openrobotics.org
www.openrobotics.org

2

Ongoing development
Space ROS 2023+

FoundationTools and Processes● Regular releases● Dashboard (continued)● Auditing support,
checklists, reports● Code improvements● Back-porting requirements● Requirements analysis

www.openrobotics.org
www.openrobotics.org

Space-SpecificFunctionality● cFS/ROS 2 bridge● Applications

2

Open processes and artefacts for community-driven validation●We’re integrating open source tools and processes to help improve
software quality○Requirements, code analysis, developer workﬂow, quality levels●

This is done in the context of Space ROS, but could be useful to other domains●

We welcome your contributions and input●

https://github.com/space-ros

www.openrobotics.org
www.openrobotics.org

2Please ﬁll out the ROS and Gazebo User Survey!

www.openrobotics.org

2

IKOS (Inference Kernel for Open Static Analyzers)
The IKOS framework architecture

https://jorgenavas.github.io/papers/ikos-sefm14.pdf

www.openrobotics.org
www.openrobotics.org

2