Abstract Ensuring the correct and safe behavior of a spacecraft is a main objective in space-system design. Since spacecraft consist of highly complex and tightly integrated components developed by large teams of engineers from various different disciplines, this is a challenging task. Increasingly, formal verification methods such as model checking are applied to establish the correctness of safety-critical parts or subsystems. Generally, the often limited scalability of model checking due to the state-space explosion problem hinders the wide-spread adoption of this technique. In this paper, we systematically examine the scalability of model checking for verifying behavioral models that arise within early space-system design phases. For this, we created a representative model for the mode management of a satellite that can be scaled in terms of its size and the complexity of interactions between system components. The model can be transformed into the input languages of various model-checking tools, which enables a comparative study of various model-checking algorithms and also facilitates analyzing the impact of different communication schemes on the scalability. The evaluation shows promising results regarding the applicability of model checking within the spacecraft design process.

Abstract The concept of features provides an elegant way to specify families of systems. Given a base system, features encapsulate additional functionalities that can be activated or deactivated to enhance or restrict the base system’s behaviors. Features can also facilitate the analysis of families of systems by exploiting commonalities of the family members and performing an all-in-one analysis, where all systems of the family are analyzed at once on a single family model instead of one-by-one. Most prominent, the concept of features has been successfully applied to describe and analyze (software) product lines. We present the toolProFeatthat supports the feature-oriented engineering process for stochastic systems by probabilistic model checking. To describe families of stochastic systems,ProFeatextends models for the prominent probabilistic model checkerPrismby feature-oriented concepts, including support for probabilistic product lines with dynamic feature switches, multi-features and feature attributes.ProFeatprovides a compact symbolic representation of the analysis results for each family member obtained byPrismto support, e.g., model repair or refinement during feature-oriented development. By means of several case studies we show howProFeateases family-based quantitative analysis and compare one-by-one and all-in-one analysis approaches.