From dcae3c01c7a881d77f546c4b7b64aea96b1e8b2f Mon Sep 17 00:00:00 2001 From: Will Binns Date: Sat, 17 Oct 2026 11:10:08 +0000 Subject: [PATCH 1/2] Flight v0.3.1: OPS-SAT ground tests passed, v0.3.1 outputs and labels, qualification rows MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - OPS-SAT: the overview card and the CLI page say that ESA's software environment test (15 Oct 2026) and TU Graz's FlatSat test on the flight processor (16 Oct 2026) passed, with the measured tick rate at the 5% share (about 45 per second) and a link to the operations note. The run in orbit is next. Source: flight docs/opssat.md and the finance record. - Quickstart and CLI outputs: from a real run of v0.3.1 on an Apple M4. The summary line ends with kat_tests (174 for shrink, 0 for TMR) and the footprint line prints three decimals, as v0.3.0 changed them. The counts are unchanged. - Qualification: as of 17 Oct 2026, flight v0.3.1. The bench row names the known-answer coverage campaign; a row for the F´ requirements and design notes (drafts); hardware-in-the-loop and radiation testing listed as not started, as in the flight repo's qualification note. - Labels: the crate example's output is checked against v0.3.1 (compiled and run, same output); the proof links and their caption point at v0.3.1; the CLI notes name v0.3.0 for the corrupt-fault fix and the stuckbit fault. --- src/pages/concepts/qualification.astro | 29 +++++++++++++++++++--- src/pages/concepts/shrinking-quorum.astro | 2 +- src/pages/core/quorum-cli.astro | 30 +++++++++++++---------- src/pages/core/quorum-crate.astro | 4 +-- src/pages/index.astro | 9 ++++--- 5 files changed, 51 insertions(+), 23 deletions(-) diff --git a/src/pages/concepts/qualification.astro b/src/pages/concepts/qualification.astro index b5fc681..03325f0 100644 --- a/src/pages/concepts/qualification.astro +++ b/src/pages/concepts/qualification.astro @@ -112,8 +112,9 @@ const crumbs = [ Bench - 300 runs per host with injected faults on three general-purpose processors. Not radiation testing, not - target hardware. See Bench. + 300 runs per host with injected faults on three general-purpose processors, and a known-answer test + coverage campaign on the last replica. Not radiation testing, not target hardware. See{' '} + Bench. NPR 7150.2, ECSS-E-ST-40C @@ -125,6 +126,18 @@ const crumbs = [ NPR 7150.2, ECSS-E-ST-40C + + F´ requirements and design notes + + Drafts in the flight repo: numbered requirements with a verification method each, and the design notes. + Not baselined or reviewed by a program. See{' '} + + fprime-requirements.md + + . + + NPR 7150.2, ECSS-E-ST-40C + @@ -140,6 +153,16 @@ const crumbs = [ + + Hardware-in-the-loop testing on target-class processors + Not started + NPR 7150.2, ECSS-E-ST-40C + + + Radiation testing + Not started + Hardware topic, outside the four software standards above + Software classification and criticality Not started @@ -185,7 +208,7 @@ const crumbs = [

- Status as of 11 Oct 2026, flight v0.2.0. The F´ components and the C interface have numbered requirements, + Status as of 17 Oct 2026, flight v0.3.1. The F´ components and the C interface have numbered requirements, each with a verification method, but no trace to mission or standard requirements.

diff --git a/src/pages/concepts/shrinking-quorum.astro b/src/pages/concepts/shrinking-quorum.astro index b9d5436..9fcc357 100644 --- a/src/pages/concepts/shrinking-quorum.astro +++ b/src/pages/concepts/shrinking-quorum.astro @@ -9,7 +9,7 @@ const crumbs = [ { label: 'Concepts', href: '/concepts/shrinking-quorum/' }, { label: 'Shrinking quorum' }, ]; -const proofs = 'https://github.com/mruspace/flight/blob/v0.2.0/quorum/src/lib.rs'; +const proofs = 'https://github.com/mruspace/flight/blob/v0.3.1/quorum/src/lib.rs'; --- corrupt One bit flips in the replica's working memory during its next computation. (In v0.2.0, a corrupt fault - on an odd tick in self-check mode was lost. Fixed after v0.2.0.) + on an odd tick in self-check mode was lost. Fixed in v0.3.0.) @@ -131,7 +131,7 @@ const crumbs = [ stuckbit:I@T/LOC.BIT.V: from tick T, bit BIT of LOC is forced to V (0 or 1), in both self-check runs and in the known-answer test. LOC is in (the input, bits 0 to 63),{' '} block (the 4 KiB working block, bits 0 to 32767), acc (the hash accumulator, 0 - to 63) or out (the result, 0 to 63). Added after v0.2.0. See{' '} + to 63) or out (the result, 0 to 63). Added in v0.3.0. See{' '} known-answer test coverage. @@ -209,15 +209,15 @@ const crumbs = [ prints: 

policy=shrink ticks=20000 seed=1 upset_rate=0.001
-useful=14989 detected=11 wrong=0 halted_at=never alive_at_end=1 stopped=completed last_useful=20000
-footprint: voter_max_rss=1920KiB replica_max_rss=1808KiB cpu=0.48s wall=0.46s
+useful=14989 detected=11 wrong=0 halted_at=never alive_at_end=1 stopped=completed last_useful=20000 kat_tests=174
+footprint: voter_max_rss=1936KiB replica_max_rss=1824KiB cpu=0.429s wall=0.420s
 limits: memory=128MB/process cpu_time=none cpu_share=none max_run=none reply_timeout=2000ms

- flight v0.2.0 on an Apple M4. The footprint line varies by host. + flight v0.3.1 on an Apple M4. The footprint line varies by host.

last_useful is the tick of the last correct result. With a scheduled stuck, hang or corrupt fault, - the output adds a detection: line (also for stuckbit, after v0.2.0): the faults + the output adds a detection: line (also for stuckbit, since v0.3.0): the faults injected, how many the voter caught, and the mean and longest ticks from fault to first reaction. The{' '} bench runs this program over a matrix of faults.

@@ -242,13 +242,17 @@ limits: memory=128MB/process cpu_time=none cpu_share=none max_run=none reply_tim

On OPS-SAT

- For the experiment registered with ESA's OPS-SAT Space Lab for OPS-SAT PRETTY (exp4051, October 2026). Nothing - has run on the satellite yet. opssat/run is the entry point the OPS-SAT runner executes: the - shrinking quorum and fixed TMR one after the other, same seed and fault schedule, all output in a folder for - downlink, finished inside a five-minute window. opssat/package.sh builds the package from a - checksum-verified release binary. opssat/run.sh starts, checks and stops a long run on any Linux - system. Tagged releases ship each static Linux binary (three ARM, one x86_64) with both launchers, the fault - schedules and the operations note. + For the experiment registered with ESA's OPS-SAT Space Lab for OPS-SAT PRETTY (exp4051, October 2026). ESA ran + the v0.3.1 package in its software environment on 15 October 2026, and TU Graz ran it on the PRETTY FlatSat, the + flight processor on the bench, on 16 October 2026. Both runs exited 0, every fault landed on its scheduled tick, + and no result was wrong. On the flight processor at the 5% CPU share the voter made about 45 ticks per second ( + operations note, with the measured + results). Nothing has run on the satellite yet; the run in orbit is next. opssat/run is the entry + point the OPS-SAT runner executes: the shrinking quorum and fixed TMR one after the other, same seed and fault + schedule, all output in a folder for downlink, finished inside a five-minute window.{' '} + opssat/package.sh builds the package from a checksum-verified release binary.{' '} + opssat/run.sh starts, checks and stops a long run on any Linux system. Tagged releases ship each + static Linux binary (three ARM, one x86_64) with both launchers, the fault schedules and the operations note.

diff --git a/src/pages/core/quorum-crate.astro b/src/pages/core/quorum-crate.astro index 374a0f4..2f1a78b 100644 --- a/src/pages/core/quorum-crate.astro +++ b/src/pages/core/quorum-crate.astro @@ -118,7 +118,7 @@ quorum = {'{'} git = "https://github.com/mruspace/flight" {'}'} {'}'}

- Its output, from cargo run against v0.2.0: + Its output, from cargo run against v0.3.1: 

[Single(7), Single(7), Single(9)]: command 7
 [Absent, Single(7), Single(7)]: command 7
@@ -370,7 +370,7 @@ quorum = {'{'} git = "https://github.com/mruspace/flight"
         
       
     
-    
Each proof name links to its source at v0.2.0.

+    
Each proof name links to its source at v0.3.1.

     
Not covered

- flight v0.2.0 on an Apple M4. The counts depend only on the seed. + flight v0.3.1 on an Apple M4. The counts depend only on the seed.

Fixed TMR halts at tick 10000, when the second replica dies. The shrinking quorum keeps running on the last From a52534d75665639565aff329663a76bd64edf519 Mon Sep 17 00:00:00 2001 From: Will Binns Date: Sat, 17 Oct 2026 11:24:00 +0000 Subject: [PATCH 2/2] Qualification: drop the placeholder row for a Rust toolchain qualification plan It read "Rust toolchain qualification plan: TODO" on the public page. The row above it, tool qualification (compiler, Kani, test tools), covers the compiler. --- src/pages/concepts/qualification.astro | 6 ------ 1 file changed, 6 deletions(-) diff --git a/src/pages/concepts/qualification.astro b/src/pages/concepts/qualification.astro index 03325f0..019924f 100644 --- a/src/pages/concepts/qualification.astro +++ b/src/pages/concepts/qualification.astro @@ -183,12 +183,6 @@ const crumbs = [ Not started NPR 7150.2, ECSS-Q-ST-80C - - Rust toolchain qualification plan: TODO - Not started - NPR 7150.2, ECSS-Q-ST-80C - - Coding standard compliance Not started