Search NASA⌕ Search

SEARCH · Search NASA

Results for “software vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 181 records · Page 10

Technical Resilience Navigator

The Technical Resilience Navigator (TRN) is a systematic approach to identifying vulnerabilities with energy and water systems, and prioritizing solutions that reduce risk. The ultimate outcome of the TRN is a set of actionable resilience solutions that address the site's most important gaps in resilience and enhance the ability to maintain mission continuity. The TRN is designed to step users through this planning process, providing a framework to: assign roles and responsibilities; collect and document information and data; document key inputs and outputs for each of the TRN modules (Site Level Planning, Baseline Development, Risk Assessment, Solution Development, and Solution Prioritization); document prioritized list of resilience solutions; and track progress through the entire process. Currently "software as a service" at the listed website.

Rotondo, Julia↗

Prioritizing ICS Beachhead Systems for Cyber Vulnerability Testing

Cyber Testing for Resilient Industrial Control Systems™ (CyTRICS™) is the Department of Energy’s (DOE’s) program for cybersecurity vulnerability testing, digital subcomponent enumeration, and forensic assessment. CyTRICS leverages best-in-class test facilities and analytic capabilities at six DOE National Laboratories and strategic partnerships with key stakeholders including technology developers, manufacturers, asset owners and operators, and interagency partners. During the program’s development, CyTRICS established a unique methodology for prioritizing digital components within operational technology (OT) and industrial control systems (ICS) in the Energy Sector Industrial Base (ESIB) for cyber vulnerability testing. The CyTRICS Prioritization Process leverages multiple characteristics of systems, components, and their contextual deployment to calculate a quantification of individual digital components for CyTRICS testing. The initial version of the CyTRICS Prioritization Process was premised largely upon the impact which could result to an industrial control system if the digital component under testing was compromised, either through malicious means, faulty engineering, or other modes. The worldwide compromise of the SolarWinds Orion platform, first reported in December 2020, through malicious interference with the digital patching cycle was a watershed event in cyber supply chain security. The SolarWinds compromised demonstrated the strategic importance of certain types of ubiquitous software, and the ability to generate widespread cybersecurity effects. To address this challenge and as a part of the Department of Energy’s response to the SolarWinds compromise, DOE’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) directed the National Laboratories to evolve the CyTRICS Prioritization Process methodology to encompass additional factors related to the strategic importance of digital components. CESER directed CyTRICS researchers to identify, characterize, and append strategic factors to the CyTRICS Prioritization Process to provide additional weight to these characteristics. National Laboratory expert researchers identified functionality, distribution, and platform characteristics for digital components in ICS and OT that they assessed would be likely targeted in strategic initial-access cyber attack. CyTRICS has termed these factors “ICS Beachhead Systems,” leveraging a definition first advanced by Schneider Electric, which is intended as a blanket term to encompass digital components, products, and systems in OT. This paper describes the ICS Beachhead Systems identified and the rationale for inclusion. As a next step in the research and refinement process, the National Laboratories will validate this initial set of characteristics against digital components evaluated by the CyTRICS program and current implementation of the CyTRICS Prioritization Process. After validation, CyTRICS researchers will then develop a scoring methodology to generate a quantitative score to assess the degree to which a digital component is characterized as an ICS Beachhead System. Finally, the National Laboratories will append this scoring to the existing CyTRICS Prioritization Process algorithm.

97 MATHEMATICS AND COMPUTING↗

Power Operations of the Mars Exploration Rovers

The rovers of the National Aeronautics and Space Administration’s (NASA) Mars Exploration Rovers (MER) project, Spirit (MER-A) and Opportunity (MER-B), safely landed on the surface of Mars three weeks apart during January 2004. Spirit and Opportunity were built and operated by the Jet Propulsion Laboratory (JPL), which is managed by the California Institute of Technology (Caltech) for NASA. Spirit landed at Gusev Crater, 14.8 degrees south of the equator, and operated continuously on the surface of Mars from January 4, 2004 until last contact from Spirit on March 22, 2010. Opportunity landed at Meridiani Planum, a location 2.5 degrees south of the Martian equator. Opportunity operated continuously on the Martian surface from January 25, 2004 until the last received transmission from Opportunity on June 10, 2018. The goal of the MER project was to determine if Mars ever had a habitable environment, in particular, if it ever had water. During their missions, both Spirit and Opportunity found evidence that liquid water once flowed on the surface of Mars. Both Spirit and Opportunity used a 1.33 m2 triple-junction solar array as their power sources. Based on observations of the original Mars rover, the Sojourner rover of the Mars Pathfinder mission that landed on Mars on July 4, 1997, the expectation was that the Martian dust would rapidly accumulate on the solar arrays of Spirit and Opportunity, and that the rovers would not have enough energy to continue operations after 90 Martian days (sols). Instead, due in part to lower dust accumulation rates than expected and numerous dust cleaning events, the Spirit and Opportunity rovers continued to operate on the Martian surface for over 2000 sols (MER-A) and 5000 sols (MER-B), respectively. During this time, the rovers experienced multiple Martian winters and several dust storms. Because the sources of solar array energy loss were known, the solar array energy output offered a method to scientifically estimate the loading and aeolian removal of dust from the solar arrays each sol. The MER Power operations team called this value that they calculated the solar array Dust Factor (DF). Dust Factor was defined as the fraction of sunlight that penetrates the accumulated dust on the surface of the solar array. A Dust Factor of 1.0 would indicate that the solar array was perfectly clean. A Dust Factor of 0.6 would indicate that only 60% of the available sunlight was able to penetrate the accumulated dust on the solar arrays. The MER Power subsystem operations team used the Multi-Mission Power Analysis Tool (MMPAT) to perform these Dust Factor calculations. The MMPAT software tool modeled the behavior of the solar arrays and the batteries as they interacted with the spacecraft power loads over the mission timeline. MMPAT also had knowledge (through telemetry and user inputs) of telemetered Power subsystem voltages and currents, atmospheric opacity (Tau), rover surface location, rover attitude, the planetary tilt and distance of Mars from the sun based on day of year, the instantaneous elevation of the sun based on time of day, temperatures (internal and external), terrain masking, and shadowing (due to the camera mast and antennas). Once all of the known sources of array energy loss are accounted, the remaining difference between the expected array energy and the actual array energy determines the solar array Dust Factor. The assumptions made while determining the Dust Factor are 1) that the single measured atmospheric opacity value (Tau) is constant over the course of the entire sol, 2) there is no measurable solar cell degradation, 3) there are no shorted strings and therefore, 4) all unexpected solar array energy losses are due to accumulated dust on the solar array. Although it cannot provide an absolute measure of dust loading, the determination of solar array Dust Factor provides a useful way of tracking dust accumulation and aeolian dust removal trends on Martian spacecraft. Any spacecraft on the Martian surface is vulnerable to dust, especially solar-powered spacecraft. The Spirit and Opportunity rovers were operational on the Martian surface for much longer than expected due in part to aeolian removal of dust from their solar arrays. The first few dust removal events were a pleasant surprise to the MER operations teams; however, over time a pattern began to arise. In over three Mars Years on the surface, the Power operations team tracked the solar array Dust Factor at Gusev Crater (location of MER-A) and observed that there were several significant dust removal and deposition events in Mars Year (MY) 27, even in the absence of a large dust storm. In MY 28 at Gusev Crater, the large atmospheric opacity (Tau) increase lagged significant dust removal events. Overall at Gusev Crater, there was a pattern of steady dust accumulation on the solar arrays, with a small number of significant dust cleaning events. At Meridiani Planum, where Opportunity rover operated for over seven Mars Years (late MY 26 to mid MY 34), a clear and consistent pattern of dust movement emerged. Meridiani Planum had a predictable, seasonally dependent pattern of gradual and continuous dust accumulation and removal. In summary, this paper explains the reasons for the development of the solar array Dust Factor and how it was used in mission operations. In particular, this paper describes the MMPAT software package, how it models array energy, including the important assumptions, model inputs and sources of error. And finally, this paper will show how the calculated solar array Dust Factor was used at Gusev Crater and Meridiani Planum to predict dust accumulation rates and weather patterns, and the importance of this generated data set for current and future solar- powered missions to Mars, such as the InSight lander and the planned Mars Sample Return rover.

Chin, Keith B.↗

GPM Mission's Best Practices: PERP

Similar to other missions, the Global Precipitation Measurement (GPM) Core Observatory's Command and Data Handling (C&DH) subsystem is critical for operations of the spacecraft. The onboard C&DH system comprises of two fully redundant boxes - a primary and a cold backup. Within each box, amongst other components, is a Single Board Computer (SBC) that hosts the flight software (FSW) system. In the event of an SBC reset, the Flight Operations Team (FOT) is poised with a lengthy task of restoring the SBC to nominal configuration. Due to the complexity of the C&DH system, this may take many days at a time to complete. The spacecraft's FSW applications are located in Electronically Erasable Programmable Read-Only Memory (EEPROM) and are copied into Random Access Memory (RAM) upon SBC initialization/reset. Each SBC has two banks of EEPROM, with each bank containing a copy of the FSW. Since launch, there have been many configuration changes to tables and applications that have been loaded into just RAM. Unfortunately, these changes are vulnerable to being wiped during a SBC initialization/reset, when the RAM is overwritten by the EEPROM. Although the EEPROM loads the default FSW configurations, the process to command non-default individual table and application changes is very cumbersome and time consuming. This consequentially increases the time until the spacecraft is back into nominal Mission Science Mode (MSM) drastically. The GPM Power-On Reset (POR) Expedited Recovery Process (PERP) Design introduces a method of consolidating commands into a single file load which the SBC can process independently of the ground - decreasing recovery time, the level of TDRS support reliance, and human error. This tested design can be implemented across many other missions that utilize a similar core Flight Executive (cFE) platform; hence providing an easy-to-follow, safe, and efficient process that can be applied across the board.

recovery↗

Supply Chain Risk Management: Data Structuring

Supply chain risk management (SCRM) is an area of research that addresses both logistics concepts to maximize efficiency, reliability, and revenue as well as risk features, such as potential weak points, break points, and vulnerabilities within the supply chain. SCRM is used to find risks introduced at each node in a supply chain and how these risks can impact a company’s products, individuals, customers, and reputation. SCRM is a relatively new field, so standardized processes including data structuring are not fully documented. This paper explains the importance of a standard data structuring methodology and how it can enhance current SCRM efforts. Data ingest, structuring, and analysis are predominantly managed by humans. Automating some of the less complex steps can positively impact SCRM by allowing human analysts to focus on more strategic analyses. Types of data to be collected and structured are collected via publicly available information related to hardware, software, and corporate entities. After the data has been collected, the information is formatted in a specific manner, conforming to a schema, to allow for more effective and efficient ingest for further analysis. This paper outlines data structures used by Pacific Northwest National Laboratory for SCRM research and analysis purposes. These structures have been used for hundreds of analyses and have been successful in developing a common baseline. Data structuring is one of the first steps in data standardization, which will further mature and enhance the SCRM research area.

supply chain risk management, data structuring, re↗

Mars 2020 Entry, Descent, and Landing System Software Implementation

On February 18th, 2021, the Mars 2020 project's Perseverance Rover successfully touched down on the Martian surface after nearly eight years of development. The Mars 2020 Entry, Descent, and Landing (EDL) System largely leveraged heritage from the Mars Science Laboratory (MSL) EDL System while employing targeted technological advancements. The landing process is autonomously directed by a software behavior implemented in the rover's primary flight computer called the EDL Timeline that assumes control of the vehicle six days before atmospheric entry. This paper first walks through the basics of the EDL Timeline mechanics and how the behavior is designed to account for internal system variations and environmental unknowns. It then summarizes the interactions between the EDL timeline and other high-level system behaviors like spacecraft mode transitions and system fault protection, focusing on the complications that arise when passing spacecraft control between executive functions. Although the MSL-inherited EDL System is reliable and capable, targeted updates and a thorough verification and validation program were required for Mars 2020. This paper discusses changes made to close vulnerabilities discovered during both MSL and Mars 2020 development cycles, landing system capability enhancements that were enabling for Mars 2020's mission, and how these updates were integrated with the heritage system. It then describes how both analysis and testing campaigns were utilized to verify and validate all aspects of EDL and system behaviors that run during the six days before landing, as well as the operational workarounds that were needed to address problems found during the development and commissioning process. Finally, this paper imparts lessons learned from Mars 2020 EDL development, implementation, and operations, emphasizing how systems designed to conduct time-critical mission events with low margin of error can be improved in the future.

Stehura, Aaron↗

Final Technical Report - Rapid Surface Microanalysis using a Low Temperature Plasma

This project focused on improving our current understanding and scientific knowledge in the area of plasma-surface interactions and plasma assisted material synthesis related to advanced microelectronics and nanotechnology. Current challenges include: controlling the interaction of Low Temperature Plasma (LTP) with a single layer of atoms to manufacture integrated circuits, continued miniaturization of integrated circuits, LTP processing of material surfaces and thin films to enable industrial scale fabrication of advanced microelectronics, synthesis of new materials, nanomaterials, nanotubes, and complex materials, Technology developed in this subtopic is of value to either (i) enable scans of surfaces (~1 sq. cm area) using various microscopies (electron, optical, other) at high resolution (micron or sub-micron resolution) rapidly (hours or days rather than years to complete a high-resolution scan of such a large surface area), or (ii) enable scans of surfaces (~1 sq. cm area) using various microscopies (electron, optical, other) at relatively low resolution rapidly, then apply algorithms to select spots for micron-scale imaging. Sputtering occurs when particles of a solid material are ejected from its surface by energetic particles from a plasma. While the degradation of the solid material and the subsequent deposition of the ejected material onto vulnerable surfaces are the usual subjects of sputtering studies, plasma science has yet to be combined with sputtering to create new diagnostics devices and systems. Small changes in the design of the plasma discharge device make it possible to create broad plasma beams for rapid scanning or small plasma beams to obtain the distribution of ejected elements with micron resolution. In the high-resolution use, the ion flux is extracted from the gas-discharge plasma and focused by a spherical emission surface to micron sizes onto the target specimen, providing very local sputtering and local elemental analysis. We call this “self-focusing”. The radiation from the excited and ionized sputtered atoms is recorded by a spectrometer through a window and fiberglass cable and analyzed with standard software packages used for optical glow discharge spectroscopy. Computer simulations of beam formation were used to verify and optimize the designs to be tested. A prototype was designed, constructed, and used to start experiments of beam formation.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗

Analyzing Cyber Security Threats on Cyber-Physical Systems Using Model-Based Systems Engineering

The spectre of cyber attacks on aerospace systems can no longer be ignored given that many of the components and vulnerabilities that have been successfully exploited by the adversary on other infrastructures are the same as those deployed and used within the aerospace environment. An important consideration with respect to the mission/safety critical infrastructure supporting space operations is that an appropriate defensive response to an attack invariably involves the need for high precision and accuracy, because an incorrect response can trigger unacceptable losses involving lives and/or significant financial damage. A highly precise defensive response, considering the typical complexity of aerospace environments, requires a detailed and well-founded understanding of the underlying system where the goal of the defensive response is to preserve critical mission objectives in the presence of adversarial activity. In this paper, a structured approach for modeling aerospace systems is described. The approach includes physical elements, network topology, software applications, system functions, and usage scenarios. We leverage Model-Based Systems Engineering methodology by utilizing the Object Management Group's Systems Modeling Language to represent the system being analyzed and also utilize model transformations to change relevant aspects of the model into specialized analyses. A novel visualization approach is utilized to visualize the entire model as a three-dimensional graph, allowing easier interaction with subject matter experts. The model provides a unifying structure for analyzing the impact of a particular attack or a particular type of attack. Two different example analysis types are demonstrated in this paper: a graph-based propagation analysis based on edge labels, and a graph-based propagation analysis based on node labels.

MBSE↗

Assessing Tsunami Vulnerabilities of Geographies with Shallow Water Equations

Tsunami preparedness is crucial for saving human lives in case of disasters that involve massive water movement. In this work, we develop a framework for visual assessment of tsunami preparedness of geographies. Shallow water equations (also called Saint Venant equations) are a set of hyperbolic partial differential equations that are derived by depth-integrating the Navier-Stokes equations and provide a great abstraction of water masses that have lower depths compared to their free surface area. Our specific contribution in this study is to use Microsoft's XNA Game Studio to import underwater and shore line geographies, create different tsunami scenarios, and visualize the propagation of the waves and their impact on the shore line geography. Most importantly, we utilized the computational power of graphical processing units (GPUs) as HLSL based shader files and delegated all of the heavy computations to the GPU. Finally, we also conducted a validation study, in which we have tested our model against a controlled shallow water experiment. We believe that such a framework with an easy to use interface that is based on readily available software libraries, which are widely available and easily distributable, would encourage not only researchers, but also educators to showcase ideas.

Aras, Rifat↗

Simulating Alpha Particles Incident on MKID Chips for Quantum Sensitivity Analysis

Superconducting quantum devices, such as microwave kinetic inductance detectors (MKIDs), are highly sensitive instruments used in quantum computing and advanced sensing technologies. However, their extreme sensitivity also makes them vulnerable to background noise from natural sources like radiation. One significant contributor to this noise is alpha particles emitted by 210Po, a radon decay daughter that accumulates on surfaces near the detector. This project investigates how alpha particles emitted from 210Po interact with MKID chips. These particles can deposit energy on the detector surface, disrupting its operation and generating false signals. Understanding the energy and behavior of these particles is crucial for improving the design and reliability of quantum devices. To explore this, we first modeled the decay chain starting from 210Pb to 210Po using differential equations. This allowed us to predict how the activity of alpha-emitting isotopes changes over time, reaching a steady state after about two years. Next, we simulated alpha particle interactions with the MKID chip using the Geant4 software toolkit. We built a detailed computer model of the detector housing, including the copper lid where alpha particles originate, the silicon chip, and a thin aluminum sensor layer. Alpha particles were emitted isotropically from just beneath the copper lid’s surface, mimicking natural decay conditions. The simulation tracked how these particles deposit energy on the chip, generating electron-hole pairs and phonons. The results provide insight into the behavior of the resultant electron-hole pairs and phonons, giving us a clear understanding of the energy deposition distribution on the chip. This work supports efforts to mitigate background noise in superconducting sensors, advancing their use in quantum computing and sensitive physics experiments.

Hall, Matthew [Fermilab; UCLA]↗

Three-Dimensional Venturi Sensor for Measuring Extreme Winds

A three-dimensional (3D) Venturi sensor is being developed as a compact, rugged means of measuring wind vectors having magnitudes of as much as 300 mph (134 m/s). This sensor also incorporates auxiliary sensors for measuring temperature from -40 to +120 F (-40 to +49 C), relative humidity from 0 to 100 percent, and atmospheric pressure from 846 to 1,084 millibar (85 to 108 kPa). Conventional cup-and-vane anemometers are highly susceptible to damage by both high wind forces and debris, due to their moving parts and large profiles. In addition, they exhibit slow recovery times contributing to an inaccurately high average-speed reading. Ultrasonic and hot-wire anemometers overcome some of the disadvantages of the cup and-vane anemometers, but they have other disadvantageous features, including limited dynamic range and susceptibility to errors caused by external acoustic noise and rain. In contrast, the novel 3D Venturi sensor is less vulnerable to wind damage because of its smaller profile and ruggedness. Since the sensor has no moving parts, it provides increased reliability and lower maintenance costs. It has faster response and recovery times to changing wind conditions than traditional systems. In addition, it offers wide dynamic range and is expected to be relatively insensitive to rain and acoustic energy. The Venturi effect in this sensor is achieved by the mirrored double-inflection curve, which is then rotated 360 to create the desired detection surfaces. The curve is optimized to provide a good balance of pressure difference between sensor ports and overall maximum fluid velocity while in the shape. Four posts are used to separate the two shapes, and their size and location were chosen to minimize effects on the pressure measurements. The 3D Venturi sensor has smart software algorithms to map the wind pressure exerted on the surfaces of the design. Using Bernoulli's equation, the speed of the wind is calculated from the differences among the pressure readings at the various ports. The direction of the wind is calculated from the spatial distribution and magnitude of the pressure readings. All of the pressure port sizes and locations have been optimized to minimize measurement errors and to reside in areas demonstrating a stable pressure reading proportional to the velocity range.

Zysko, Jan A.↗

Automated Generation and Assessment of Autonomous Systems Test Cases

This slide presentation reviews some of the issues concerning verification and validation testing of autonomous spacecraft routinely culminates in the exploration of anomalous or faulted mission-like scenarios using the work involved during the Dawn mission's tests as examples. Prioritizing which scenarios to develop usually comes down to focusing on the most vulnerable areas and ensuring the best return on investment of test time. Rules-of-thumb strategies often come into play, such as injecting applicable anomalies prior to, during, and after system state changes; or, creating cases that ensure good safety-net algorithm coverage. Although experience and judgment in test selection can lead to high levels of confidence about the majority of a system's autonomy, it's likely that important test cases are overlooked. One method to fill in potential test coverage gaps is to automatically generate and execute test cases using algorithms that ensure desirable properties about the coverage. For example, generate cases for all possible fault monitors, and across all state change boundaries. Of course, the scope of coverage is determined by the test environment capabilities, where a faster-than-real-time, high-fidelity, software-only simulation would allow the broadest coverage. Even real-time systems that can be replicated and run in parallel, and that have reliable set-up and operations features provide an excellent resource for automated testing. Making detailed predictions for the outcome of such tests can be difficult, and when algorithmic means are employed to produce hundreds or even thousands of cases, generating predicts individually is impractical, and generating predicts with tools requires executable models of the design and environment that themselves require a complete test program. Therefore, evaluating the results of large number of mission scenario tests poses special challenges. A good approach to address this problem is to automatically score the results based on a range of metrics. Although the specific means of scoring depends highly on the application, the use of formal scoring - metrics has high value in identifying and prioritizing anomalies, and in presenting an overall picture of the state of the test program. In this paper we present a case study based on automatic generation and assessment of faulted test runs for the Dawn mission, and discuss its role in optimizing the allocation of resources for completing the test program.

Testing challenges↗

Towards Real-time Global Assessment of Post-fire Debris Flow Hazard

As the risk of wildfires increases worldwide, burned steeplands are vulnerable to the secondary hazard of widespread sediment mobilization through debris flows. Following an initial burn, sediment and soil previously restrained by vegetation are no longer consolidated, allowing for easy mobilization into channels and along steep hillslopes through runoff. Sufficiently powerful rainfall incorporates entrained material into turbulent flows and serves as the primary trigger for debris flow initiation. There is thus an ongoing need to establish the relationship between rainfall and debris flow initiation based on a variety of spatiotemporal preconditions. Previous work establishes regional and local thresholds to constrain the effect of rainfall in recently burned areas, but no empirical or numerical solution has worldwide application. Building from regionally-based efforts in the U.S., this work considers how remote sensing data can be applied to better approximate the post-fire debris flow hazards worldwide using freely available global datasets and software. Our work assesses the utility of remote sensing resources for analyzing burn characteristics, topography, rainfall intensity/duration, and, thus, debris flow initiation. Early results show that global observations are sufficient to delineate background rainfall rates from storms likely to cause debris flows across a variety of burn severity and topographic conditions. However, the dearth of publicly-available post-fire debris flow inventories globally limit the ability to test how the model framework performs within different climatologic and morphologic areas. This work will present preliminary analysis over the Western United States and demonstrate the feasibility of a global, near-real time model to provide situational awareness of potential hazards within recently burned areas worldwide. Future work will also consider how global or regional precipitation forecasts may increase the lead time for improved early warning of these hazards.

Elijah Orland↗

Fast and fault-tolerant model predictive control of MMCs under selective harmonic elimination

Selective harmonic elimination (SHE) is a suitable pulse-width modulation (PWM) tech-nique for some applications of modular multilevel converters (MMC) with lower numberof semiconductor submodules (SM). However, SHE can make it difficult to control circu-lating currents in the MMC. Moreover, the MMC is vulnerable to SM switch failures thatreduce its output power magnitude and quality. This paper proposes a fault-tolerant modelpredictive control strategy for MMCs operating with SHE (FT SHE-MPC). The effects ofswitch failure on phase voltage waveforms are studied first. Then, a method is proposedto design the FT SHE waveform to preserve its harmonic performance. Next, the pro-posed FT SHE-MPC is designed to increase the capacitor voltages during an SM failure tomaintain the fundamental component of the faulty phase voltage and control the circulat-ing currents, maintaining balance among line voltages and the output power of the MMC.Additionally, the proposed method offers as much as 60% faster FT transition time and asmuch as 36% lower capacitor voltage ripple. The advantages of the proposed method areverified through offline and real-time simulation studies on a three-phase nine-level MMCin PSCAD/EMTDC software and RTDS.

42 ENGINEERING↗

Mars 2020 Entry, Descent, and Landing Software Implementation

On February 18th, 2021, the Mars 2020 project's Perseverance Rover successfully touched down on the Martian surface after nearly eight years of development. The Mars 2020 Entry, Descent, and Landing (EDL) System largely leveraged heritage from the Mars Science Laboratory (MSL) EDL System while employing targeted technological advancements. The landing process is autonomously directed by a software behavior implemented in the rover's primary flight computer called the EDL Timeline that assumes control of the vehicle six days before atmospheric entry. In addition to performing the critical function of landing the rover on the Martian surface, the EDL timeline behavior must co-exist in a non-partitioned software and system environment with other high-level functions that accomplish the goals for the rest of the mission. Due to the criticality of EDL, the potential for loss of mission, and a need for complete system autonomy, the standard for how the EDL Timeline interacts with other functions in the system is highly constrained. This paper first walks through the basics of the EDL Timeline mechanics and how the behavior is designed to account for internal system variations and environmental unknowns. It then summarizes the interactions between the EDL timeline and other high-level system behaviors like spacecraft mode transitions and system fault protection, focusing on the complications that arise when passing spacecraft control between executive functions. Although the MSL-inherited EDL System is reliable and capable, targeted updates and a thorough verification and validation program were required for Mars 2020. This paper discusses changes made to close vulnerabilities discovered during both MSL and Mars 2020 development cycles, landing system capability enhancements that were enabling for Mars 2020's mission, and how these updates were integrated with the heritage system. It then describes how both analysis and testing campaigns were utilized to verify and validate all aspects of EDL and system behaviors that run during the six days before landing, as well as the operational workarounds that were needed to address problems found during the development and commissioning process. Finally, this paper imparts lessons learned from Mars 2020 EDL development, implementation, and operations, emphasizing how systems designed to conduct time-critical mission events with low margin of error can be improved in the future.

Stehura, Aaron↗

Developing Land Use Land Cover Maps for the Lower Mekong Basin to Aid Hydrologic Modeling and Basin Planning

This paper discusses research methodology to develop Land Use Land Cover (LULC) mapsfor the Lower Mekong Basin (LMB) for basin planning, using both MODIS and Landsat satellitedata. The 2010 MODIS MOD09 and MYD09 8-day reflectance data was processed into monthlyNDVI maps with the Time Series Product Tool software package and then used to classify regionallycommon forest and agricultural LULC types. Dry season circa 2010 Landsat top of atmosphere reflectance mosaics were classified to map locally common LULC types. Unsupervised ISODATAclustering was used to derive most LULC classifications. MODIS and Landsat classifications werecombined with GIS methods to derive final 250-m LULC maps for Sub-basins (SBs) 1–8 of the LMB.The SB 7 LULC map with 14 classes was assessed for accuracy. This assessment compared randomlocations for sampled types on the SB 7 LULC map to geospatial reference data such as Landsat RGBs,MODIS NDVI phenologic profiles, high resolution satellite data, and Mekong River Commissiondata (e.g., crop calendars). The SB 7 LULC map showed an overall agreement to reference data of~81%. By grouping three deciduous forest classes into one, the overall agreement improved to ~87%.The project enabled updated regional LULC maps that included more detailed agriculture LULCtypes. LULC maps were supplied to project partners to improve use of Soil andWater AssessmentTool for modeling hydrology and water use, plus enhance LMB water and disaster managementin a region vulnerable to flooding, droughts, and anthropogenic change as part of basin planningand assessment.

land use land cover mapping; SWAT hydrologic model↗

Innovative Strategies for Long-Term Monitoring of Complex Groundwater Plumes at DOE’s Legacy Sites (Workshop Report)

Most remaining Department of Energy (DOE) sites will require extended periods of institutional control, especially at complex groundwater sites where attenuation-based strategies have been implemented to facilitate closure. The current practice of monitoring—obtaining and analyzing contaminant concentration in groundwater samples at numerous wells—will account for a large portion of the projected life-cycle at these DOE sites unless a new approach is adopted. State-of-the-art technologies are being developed, including in situ sensors, geophysics, radiation mapping, numerical modeling and AI/ML. These technologies can optimize monitoring strategies in space and time, provide spatially extensive information at vulnerable regions and/or provide more continuous monitoring at lower cost. As part of DOE’s Office of Environmental Management (DOE-EM’s) efforts to advance long-term monitoring systems, an in-person/virtual hybrid workshop was hosted by Savannah River National Laboratory (SRNL) on January 24 and 25, 2023, in Augusta, Georgia. Because DOE-EM’s complex sites will eventually be transferred to DOE’s Office of Legacy Management (DOE-LM), representatives of DOE-LM were important participants in the workshop. The purpose of the workshop was to identify challenges and opportunities for deploying advanced technologies for long-term monitoring at DOE sites. The key questions during the workshop were: 1) the regulatory acceptance of replacing a process that traditionally has used laboratory sampling and analysis of groundwater samples, and 2) the application of this strategy to the southwestern arid sites that include many of the remaining DOE-EM and DOE-LM complex groundwater plumes. Characteristics common to most arid sites present both limitations and opportunities for advanced technologies. DOE-EM has funded a National Laboratory team from SRNL, Lawrence Berkeley National Laboratory (LBNL), and Pacific Northwest National Laboratory (PNNL) to establish the overarching framework of long-term monitoring by systematically combining advanced hardware and software technologies. This project is titled “Advanced Long-Term Environmental Monitoring Systems (ALTEMIS)” and is sponsored by the DOE-EM Technology Development Program. The multi-laboratory team is currently developing and testing innovative monitoring strategies, including the use of in situ groundwater sensors, geophysics, drone/satellite-based remote sensing, reactive transport modeling, and artificial intelligence/machine learning (AI/ML). The project’s demonstration testbed is at the Savannah River Site (SRS) F-Area Seepage Basins, where a well-characterized complex groundwater plume composed of uranium and other radionuclides is in the latter stages of remediation. The workshop included more than 70 participants, presentations, a field visit to F-Area, breakout working groups, and large group discussion. Participants developed recommendations on five topics: in situ sensors, spatially integrative tools, challenges to regulatory acceptance, AI/ML strategies, and transitioning sites to DOE-LM.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Dynamic Transmission Line Switching Amid Wildfire-Prone Weather Under Decision-Dependent Uncertainty

During dry and windy seasons, environmental conditions significantly increase the risk of wildfires, exposing power grids to disruptions caused by transmission line failures. Wildfire propagation exacerbates grid vulnerability, potentially leading to prolonged power outages. To address this challenge, we propose a multistage optimization model that dynamically adjusts transmission grid topology in response to wildfire propagation, aiming to develop an optimal response policy. By accounting for decision-dependent uncertainty, where line survival probabilities depend on usage, we employ distributionally robust optimization to model uncertainty in line survival distributions. We adapt the stochastic nested decomposition algorithm and derive a deterministic upper bound for its finite convergence. To enhance computational efficiency, we exploit the Lagrangian dual problem structure for a faster generation of Lagrangian cuts. Using realistic data from the California transmission grid, we demonstrate the superior performance of dynamic response policies against two-stage alternatives through a comprehensive case study. In addition, after solving the multistage formulation, we construct easy-to-implement policies that significantly reduce computational burden while maintaining good performance in real-time deployment. History: Accepted by Russell Bent, Area Editor for Network Optimization: Algorithms and Applications. Funding: This work was supported by the U.S. Department of Energy, Office of Electricity [Grant DE-AC02-05CH11231]. The work of R. Jiang was supported in part by the U.S. National Science Foundation, Division of Electrical, Communications and Cyber Systems [Grant ECCS-1845980] and the U.S. Air Force Office of Scientific Research [Grant FA9550-23-1-0323]. Supplemental Material: The software that supports the findings of this study is available within the paper and its Supplemental Information ( https://pubsonline.informs.org/doi/suppl/10.1287/ijoc.2025.1210 ) as well as from the IJOC GitHub software repository ( https://github.com/INFORMSJoC/2025.1210 ). The complete IJOC Software and Data Repository is available at https://informsjoc.github.io/ .

Estrada-Garcia, Juan-Alberto↗