Abstract Ensuring the correct and safe behavior of a spacecraft is a main objective in space-system design. Since spacecraft consist of highly complex and tightly integrated components developed by large teams of engineers from various different disciplines, this is a challenging task. Increasingly, formal verification methods such as model checking are applied to establish the correctness of safety-critical parts or subsystems. Generally, the often limited scalability of model checking due to the state-space explosion problem hinders the wide-spread adoption of this technique. In this paper, we systematically examine the scalability of model checking for verifying behavioral models that arise within early space-system design phases. For this, we created a representative model for the mode management of a satellite that can be scaled in terms of its size and the complexity of interactions between system components. The model can be transformed into the input languages of various model-checking tools, which enables a comparative study of various model-checking algorithms and also facilitates analyzing the impact of different communication schemes on the scalability. The evaluation shows promising results regarding the applicability of model checking within the spacecraft design process.

Abstract In model-based systems engineering projects, engineers from multiple domains collaborate by establishing a common system model. Multi-level modeling is a technique that can be used to model the development from abstract ideas to concrete implementations. However, current multi-level modeling approaches are not adequate for processes with multiple modeling phases that might have to be rearranged later. In this paper, we introduce multi-phase modeling that utilizes concepts of multi-level modeling by considering a description of the expected phase ordering per domain. Constraints aware of this context can express that certain elements are only valid in specific phases without having to determine a concrete phase ordering for a particular model. This enables using multi-phase modeling in flexible workflows, adapting to changing requirements and the definition of access rules in domain notation. We show feasibility of this multi-phase modeling by applying it to multiple real-life systems engineering projects of the aerospace domain.