Software Product Assurance Plan (SPAP)

Software Product Assurance Plan (SPAP)#

Project: Sentinel-2 MSI Reverse L1B→Synthetic L0 Reconstruction (s2_msi_raw_generator, package name deliberately kept) — runs S2B L1B backwards through the exact inverse of the operational L0→L1B radiometric chain to reconstruct L1A→L0plus→Synthetic L0 · DRD: ECSS-Q-ST-80C (SPAP), tailored for a single-CSC, low-criticality E2ES. Process baseline: SDP; review programme: SRevP; risks: risk register.

1. Organization & responsibilities#

Single-developer project: the developer holds the engineering, PA and configuration-control roles. Independence of assurance is achieved by tooling, not by separate personnel: every claim of quality is enforced by an automated gate (CI) or an inspectable artefact (traceability matrix, provenance metadata), never by assertion. This tailoring is recorded in the SDP and accepted as RSK-05 in the risk register.

2. Quality objectives#

  1. Correctness — every realized SRS requirement verified by the cited method (T/A/I/R); on data the Synthetic L0 matches the reference ESA L0 img to ≤~4 DN on the 10/20 m bands, and the L0plus CCSDS-122 codec round-trip decode(L0plus) == L1A is bit-exact.

  2. Reproducibility — seeded, deterministic outputs across processes (REQ-QUAL-004).

  3. Originality — no external-processor source code or names in the deliverable (REQ-QUAL-003).

  4. Minimal footprint — core runtime = numpy (+ zarr); executable in any public CI without credentials (REQ-QUAL-001).

3. Assurance implementation#

3.1 Automated verification gate#

The GitLab CI pipeline (.gitlab-ci.yml) is the blocking PA gate on every merge request:

Job

Stage

Gate

Content

unit-tests

test

blocking

full pytest suite (currently 206 collected: 201 pass, 5 env-gated skips) on python:3.12-slim, JUnit report artifact

pages

docs

blocking

strict Sphinx build -W --keep-going — every docs warning is an error; publishes the site on main

e2e-l1b

test

manual

reverse-chain consistency check: runs the reverse chain-Synthetic L0 forward through the msi-processor (eopf env) and confirms it reproduces the original S2 L1B input to the reverse chain

e2e-s2-l1b

test

manual

reverse-chain E2E driver run: fetch S2 L1B → invert the radiometric reverse chain to L1A → pack L1A into L0plus (CCSDS-122) → decode (bit-exact sub-check) → assemble Synthetic L0 → validate against the reference ESA L0

publish-e2e-s2-l1b

docs

manual

uploads the reverse-chain reconstruction products (Synthetic L0/L1A/L0plus for the S2B L1B input) to the generic package registry (CI job token — no personal credentials)

main accepts only merge requests with a green pipeline (SDP §Process).

3.2 Documentation assurance#

The ECSS document set is part of the deliverable and is built strict (-W): dead references, bad math and malformed tables fail the pipeline. Staleness is controlled by dedicated audit MRs (e.g. MR !35, 29 findings swept across the DRD set).

3.3 Metrics#

  • Test count / pass rate per pipeline (JUnit artifact; current baseline in the SUITR).

  • Requirements closure — realized vs deferred/cancelled, tracked in the traceability matrix (51 requirements at v0.3.0).

  • Quantitative quality bounds — Synthetic L0 reconstruction error vs the reference ESA L0 (≤~4 DN on the 10/20 m bands), calibration/GIPP recovery accuracy, and the L0plus CCSDS-122 codec ratio + bit-exactness: tabulated with verified bound vs typical observed in the V&V report §3.

3.4 Nonconformance handling#

Anomalies found in verification are recorded in the V&V report §Anomalies with disposition (e.g. the doc/test bound discrepancy — closed as documented; the fixture-L1A DN scaling — accepted with rationale). Defects in released behaviour get a CHANGELOG Fixed entry naming the affected requirement (e.g. the hash() reseeding fix, REQ-QUAL-004).

3.5 Supplier & reuse control#

No subcontracted software. Reused third-party components (numpy, zarr, pytest, Sphinx toolchain) are mainstream open-source, listed in the SRF and pinned no tighter than needed (see RSK-06). Standards implemented from public documents only (CCSDS 122.0-B, EOPF PSFD, Sentinel-2 L1 ATBD) — the originality policy excludes any proprietary source.

4. PA milestones#

PA evidence is bundled per release: SRN + CHANGELOG + green pipeline + V&V report update. The qualification-level assessment (document inventory, criteria closure, open items) is the QR report.