Sector
Space
- Mission intelligence
- Autonomous spacecraft
- In-orbit software
No maintenance window, no rollback, and a light-delay between the fault and the operator.
Spacecraft software is assured under a constraint the ground-based sectors do not share: once it is up, the set of possible interventions collapses. Autonomy is not a convenience in that environment, it is a requirement — and so is being able to state, in advance, exactly what the autonomous behaviour will and will not do.
Radiation-induced upset, thermal cycling and degraded sensing are not edge cases in orbit. They are the operating condition, and they belong inside the declared domain rather than outside it.
What this means for evidence
Bounded autonomous behaviour
Assurance of the envelope within which a system may act, with the envelope itself the object under review.
Long-lived evidence
Export bundles designed to remain verifiable for decades, on a machine that has never contacted the vendor, using a static verifier that outlives the vendor.
Constrained-target conformance
Verifying that the artefact that flew is the artefact that was assessed, by digest, at the deployment boundary.