1、Lessons Learned Entry: 1023Lesson Info:a71 Lesson Number: 1023a71 Lesson Date: 1997-02-01a71 Submitting Organization: HQa71 Submitted by: David M. LengyelSubject: Computer Software/Configuration Control/Verification and Validation (V&V) Description of Driving Event: Possible Lack of Configuration Co
2、ntrol and Software Verification and ValidationLesson(s) Learned: The use of the Matrix X autocode generator for ISS software can lead to serious problems if the generated code and Matrix X itself are not subjected to effective configuration control or the products are not subjected to unit-level V&V
3、. These problems can be exacerbated if the code generated by Matrix X is modified by hand.Recommendation(s): NASA should ensure that thorough IV&V is conducted on all code produced by Matrix X, including any hand-coded modifications made to it, and that there is adequate configuration control on the
4、 code generated by Matrix X.Evidence of Recurrence Control Effectiveness: NASA agrees with the intent of the recommendation. IV&V will be performed on programs in accordance with the approach explained in our response to item 27a above. NASA is aware of the problems and concerns relating to Matrix X
5、. Software changes that are made after auto-code generation, configuration management difficulties with hand-crafted changes after regeneration, code that appears different after auto-generation because of new variable name assignments, and new releases of the auto-coding tool itself are the princip
6、al areas of concern. These problems and concerns are considered to be inherent to auto-code generation tools. The NASA IV&V Facility in West Virginia will continue to evaluate the use of auto-code generators and the Matrix X generator Provided by IHSNot for ResaleNo reproduction or networking permit
7、ted without license from IHS-,-,-tool specifically in order to better characterize these concerns and develop policies and procedures to better govern the use of auto-generated code. Some potential users of Matrix X have already been working closely with the NASA IV&V Facility on the issue of Matrix
8、 X and auto-code generation in general. The IV&V Facility will review program plans for programs that plan to incorporate an auto-generation tool and will assist in the development of guidelines to minimize the risks.Regarding the Product Group 1 (PG1) use of Matrix X for developing the ISS Control
9、and Data Handling software, NASA concurs with the concern over the con-figuration change control and the verification of the auto-coded software. The configuration control of all auto-coded software should be both at the model level and at the source code level. The prime contractor will be receivin
10、g both the models and the generated source and binary code from the PGs and will regenerate the source and binary code to ensure completeness and accuracy of the delivery.Product Group 1 had problems late last year with unit testing of the flight software produced by Matrix X, but at that time they
11、concluded that it was better to utilize a more modular design. Coincident with this, Product Group 1 also used Matrix X to build unit test drivers without impacting the unit under test. This procedure also includes the capability to test the units on the target hardware. These changes alleviate the
12、NASA IV&V Facilitys original concerns with Matrix X and unit testing. The prime contractor is currently negotiating the wording for the PG1 Software Development Plan to implement these changes.The prime contractor has not yet begun looking at the older Product Group 3 (PG3) Software Development Plan
13、 to determine any additional changes needed. The NASA IV&V Facilitys analysis of PG3s use of Matrix X did not generate any concerns. It should be noted that neither Product Group 2 nor the prime contractor use Matrix X for coding their software.Documents Related to Lesson: N/AMission Directorate(s):
14、 a71 Exploration Systemsa71 Aeronautics ResearchAdditional Key Phrase(s): a71 Aerospace Safety Advisory Panela71 Computersa71 Configuration Managementa71 Policy & Planninga71 Research & DevelopmentProvided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-a71 S
15、afety & Mission Assurancea71 Softwarea71 Test & VerificationAdditional Info: Approval Info: a71 Approval Date: 2001-11-20a71 Approval Name: Bill Loewya71 Approval Organization: QSa71 Approval Phone Number: 202-358-0528Provided by IHSNot for ResaleNo reproduction or networking permitted without license from IHS-,-,-
