Search NASA⌕ Search

SEARCH · Search NASA

Results for “Formal analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 199 records · Page 11

Runtime Verification - 17 Years Later

Runtime verification is the discipline of analyzing program executions using rigorous methods. The discipline covers such topics as specification-based monitoring, where single executions are checked against formal specifications; predictive runtime analysis, where properties about a system are predicted/inferred from single (good) executions; specification mining from execution traces; visualization of execution traces; and to be fully general: computation of any interesting information from execution traces. Finally, runtime verification also includes fault protection, where monitors actively protect a running system against errors. The paper is written as a response to the ‘Test of Time Award’ attributed to the authors for their 2001 paper [45]. The present paper provides a brief overview of what lead to that paper, what has happened since, and some perspectives on the future of the field.

Rosu, Grigore↗

Reliability-Aware Requirements Development for Autonomy Software

Autonomy is the ability of a system to make decisions and take actions in the presence of uncertainty. Validating autonomy, therefore, is a matter of validating that the system makes intelligent decisions even when there might be discrepancies between the observed and the expected state of the world as well as when the possible outcome of each of the possible courses of action is uncertain. During the requirements engineering phase, the functions, including those that are required to be autonomous and their expected behavior are specified. However, in the case of autonomous software system, it is challenging to specify all possible scenarios that the software may encounter. Additionally, since autonomous behaviors cannot always be fully predetermined, it is difficult to reason about their completeness and correctness. While these challenges are also faced with non-autonomous system, they are more prevalent for autonomous system due to their complexity and emergent behavior. Our efforts have been three-fold. On one hand, we have developed a goal-based method for requirements decomposition. We have embedded this approach into a higher-level systems engineering framework and then developed methods for decision and reliability analysis within this framework. And finally, we use simulation analysis to validate the more theoretical methods and provide a feedback mechanism. The decision analysis approach (DA) helps in identifying and mitigating the run-time risks, by bringing to the forefront the uncertainties, decisions, interactions, and other factors that may cause autonomous software to make erroneous decisions. The DA framework is used to quantify, for each decision that the software can make, failure risk due to uncertainties. The information about the key decisions and circumstances that can cause autonomous system to make incorrect decisions are used to generate test scenarios to be run in a simulator to ensure that the system can handle error-prone circumstances. The results or outcomes from decisions, based on the simulated scenarios, can then be leveraged to further gain insight of the assured system. We combine a goal-based approach with simulation analysis to facilitate requirements development for autonomous systems and further provide a method for run-time systems level reliability considerations during the autonomous software development process. The DA and the reliability analysis methods provide a formalism for the consideration of uncertainty in the run time decision-making process for autonomous software. This formalism considers the uncertainty involved in the outcome of different courses of action, in terms of performance and cost, as well as a method to consider the system level reliability implications. System level reliability considerations for autonomous software decision making contribute to the satisfaction of the system level goals over the lifecycle of a given mission. We demonstrate our approach using a hypothetical rover path planning example. The requirements for our rover simulator are based on existing literature about Mars rovers and lessons learned from real world observations at JPL. The specifics of the autonomy design for the Mars rovers, that have not been previously cleared for external release, are not used for our demonstrations.

Lindvall, Mikael↗

From Formal Errors Towards Realistic Uncertainties

Evaluation of uncertainties of geodetic parameter estimates is the problem that is not yet solved in a satisfactory way. A direct evaluation of the uncertainties derived from a least square solution is labeled "formal" and is usually biased, sometimes up to an order of magnitude. Customary, the use of formal errors for scientific analysis is discouraged. We claim that the root of the problem is neglecting off-diagonal elements in the variance-covariance matrix of the noise in the data. A careful reconstruction of the full variance-covariance matrix, including the off-diagonal terms greatly improves realism of uncertainty estimates derived from least squares. We processed the dataset of VLBI group delays and built a prior variance-covariance of the atmosphere-driven noise based on analysis of the output of NASA high-resolution numerical weather models. We found that the uncertainties of parameter estimates derived from this least square solution that uses such variance-covariance matrices become much closer to realistic errors. We consider approaches for implementation of this method in routine data analysis of space geodesy data.

Leonid Petrov↗

Quantifying Occupant Health and Productivity for Deep Retrofits: Beyond Traditional IEQ Studies

As energy-efficiency standards for both new construction and existing building renovations become more stringent, further reductions become less tractable and more expensive. With increasing interest and rising investment in healthy built environments, integrating energy efficiency with improved occupant experience (i.e., health, comfort, and work performance) offers a new path to drive deep energy retrofits. However, the difficulty in quantifying and verifying health and productivity gains from building upgrades leads to lower valuation of human benefits in practice. Building codes and standards have progressive energy targets but often give minimum requirements to occupant health for factors such as ventilation and thermal comfort. State and federal laws in the United States that govern the energy service performance contract (ESPC) have no clear and consistent guidance on quantifying non-energy benefits and incorporating them into a formal cost-effectiveness analysis. This paper presents a methodology to measure a building’s potential performance improvement regarding occupant health based on existing evidence correlating IEQ to occupant outcomes. Health improvement measures are integrated with a building energy model to identify and measure the impact of holistic improvement strategies. The net present value of these measures is determined based on the investment costs required to attain those improvements, energy savings, and personnel gains. We will discuss results from one pilot building, which showed nearly $50 per square foot 20-year net present value using the integrated approach.

Keene, Kevin M.↗

A methodology for commonality analysis, with applications to selected space station systems

The application of commonality in a system represents an attempt to reduce costs by reducing the number of unique components. A formal method for conducting commonality analysis has not been established. In this dissertation, commonality analysis is characterized as a partitioning problem. The cost impacts of commonality are quantified in an objective function, and the solution is that partition which minimizes this objective function. Clustering techniques are used to approximate a solution, and sufficient conditions are developed which can be used to verify the optimality of the solution. This method for commonality analysis is general in scope. It may be applied to the various types of commonality analysis required in the conceptual, preliminary, and detail design phases of the system development cycle.

Thomas, Lawrence Dale↗

Formal Methods in the Air

This is an overview of some of the successes of the Formal Methods team at NASA Langley. It includes discussion of the development of the Well-Clear definition for uncrewed aircraft and the subsequent creation of the DAIDALUS Detect and Avoid library, followed by discussion of the team's verification of the Compact Position Reporting algorithm, which led to the development of tools for floating-point analysis.

Formal Methods↗

Models of Human-Automation Systems: Initial Analysis of the Boeing 737MAX Design

We describe a formal approach to identifying human factors design vulnerabilities and usability concerns in the context of automated control systems. We present an initial analysis of the design of the B737MAX that has suffered two fatal accidents. We highlight two main design vulnerabilities and one usability concern. Key formal generic properties used to identify these vulnerabilities and usability concerns are defined. These generic properties, and others referenced in the paper, can be applied to the analysis of any human-automation system.

HSI↗

Formal semantics for a subset of VHDL and its use in analysis of the FTPP scoreboard circuit

In the first part of the report, we give a detailed description of an operational semantics for a large subset of VHDL, the VHSIC Hardware Description Language. The semantics is written in the functional language Caliban, similar to Haskell, used by the theorem prover Clio. We also describe a translator from VHDL into Caliban semantics and give some examples of its use. In the second part of the report, we describe our experience in using the VHDL semantics to try to verify a large VHDL design. We were not able to complete the verification due to certain complexities of VHDL which we discuss. We propose a VHDL verification method that addresses the problems we encountered but which builds on the operational semantics described in the first part of the report.

Bickford, Mark↗

KLOKKOS: Automated test generation for performance-portable programs

SAND2024-13830O The KLOKKOS project provides a suite of test generation and validation tools to increase maintainability and portability of Kokkos programs. KLOKKOS, a portmanteau of Klee and Kokkos, is developing an automated test generation for performance-portable programs using Clang/low-level virtual machine (LLVM) and formal methods. KLOKKOS is based on several topics in computer science: the development of symbolic and concolic analysis of LLVM and C++ codes, formal semantics and type theory, C++ templates and language features, LLVM compiler infrastructure, and data parallel primitives. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525

SciDAC↗

Development and Demonstration of an Ada Test Generation System

In this project we have built a prototype system that performs Feasible Path Analysis on Ada programs: given a description of a set of control flow paths through a procedure, and a predicate at a program point feasible path analysis determines if there is input data which causes execution to flow down some path in the collection reaching the point so that tile predicate is true. Feasible path analysis can be applied to program testing, program slicing, array bounds checking, and other forms of anomaly checking. FPA is central to most applications of program analysis. But, because this problem is formally unsolvable, syntactic-based approximations are used in its place. For example, in dead-code analysis the problem is to determine if there are any input values which cause execution to reach a specified program point. Instead an approximation to this problem is computed: determine whether there is a control flow path from the start of the program to the point. This syntactic approximation is efficiently computable and conservative: if there is no such path the program point is clearly unreachable, but if there is such a path, the analysis is inconclusive, and the code is assumed to be live. Such conservative analysis too often yields unsatisfactory results because the approximation is too weak. As another example, consider data flow analysis. A du-pair is a pair of program points such that the first point is a definition of a variable and the second point a use and for which there exists a definition-free path from the definition to the use. The sharper, semantic definition of a du-pair requires that there be a feasible definition-free path from the definition to the use. A compiler using du-pairs for detecting dead variables may miss optimizations by not considering feasibility. Similarly, a program analyzer computing program slices to merge parallel versions may report conflicts where none exist. In the context of software testing, feasibility analysis plays an important role in identifying testing requirements which are infeasible. This is especially true for data flow testing and modified condition/decision coverage. Our system uses in an essential way symbolic analysis and theorem proving technology, and we believe this work represents one of the few successful uses of a theorem prover working in a completely automatic fashion to solve a problem of practical interest. We believe this work anticipates an important trend away from purely syntactic-based methods for program analysis to semantic methods based on symbolic processing and inference technology. Other results demonstrating the practical use of automatic inference is being reported in hardware verification, although there are significant differences between the hardware work and ours. However, what is common and important is that general purpose theorem provers are being integrated with more special-purpose decision procedures to solve problems in analysis and verification. We are pursuina commercial opportunities for this work, and will use and extend the work in other projects we are engaged in. Ultimately we would like to rework the system to analyze C, C++, or Java as a key step toward commercialization.

Source record↗

The mathematical bases for qualitative reasoning

The practices of researchers in many fields who use qualitative reasoning are summarized and explained. The goal is to gain an understanding of the formal assumptions and mechanisms that underlie this kind of analysis. The explanations given are based on standard mathematical formalisms, particularly on ordinal properties, continuous differentiable functions, and the mathematics of nonlinear dynamic systems.

Kalagnanam, Jayant↗

Formal verification of an oral messages algorithm for interactive consistency

The formal specification and verification of an algorithm for Interactive Consistency based on the Oral Messages algorithm for Byzantine Agreement is described. We compare our treatment with that of Bevier and Young, who presented a formal specification and verification for a very similar algorithm. Unlike Bevier and Young, who observed that 'the invariant maintained in the recursive subcases of the algorithm is significantly more complicated than is suggested by the published proof' and who found its formal verification 'a fairly difficult exercise in mechanical theorem proving,' our treatment is very close to the previously published analysis of the algorithm, and our formal specification and verification are straightforward. This example illustrates how delicate choices in the formulation of the problem can have significant impact on the readability of its formal specification and on the tractability of its formal verification.

Rushby, John↗

Bridging the Gap Between Requirements and Model Analysis : Evaluation on Ten Cyber-Physical Challenge Problems

Formal verfication and simulation are powerful tools to validate requirements against complex systems. [Problem] Requirements are developed in early stages of the software lifecycle and are typically written in ambiguous natural language. There is a gap between such requirements and formal notations that can be used by verification tools, and lack of support for proper association of requirements with software artifacts for verification. [Principal idea] We propose to write requirements in an intuitive, structured natural language with formal semantics, and to support formalization and model/code verification as a smooth, well-integrated process. [Contribution] We have developed an end-to-end, open source requirements analysis framework that checks Simulink models against requirements written in structured natural language. Our framework is built in the Formal Requirements Elicitation Tool (fret); we use fret's requirements language named fretish, and formalization of fretish requirements in temporal logics. Our proposed framework contributes the following features: 1) automatic extraction of Simulink model information and association of fretish requirements with target model signals and components; 2) translation of temporal logic formulas into synchronous dataflow cocospec specifications as well as Simulink monitors, to be used by verification tools; we establish correctness of our translation through extensive automated testing; 3) interpretation of counterexamples produced by verification tools back at requirements level. These features support a tight integration and feedback loop between high level requirements and their analysis. We demonstrate our approach on a major case study: the Ten Lockheed Martin Cyber-Physical, aerospace-inspired challenge problems.

Mavridou, Anastasia↗

Reuse of a Formal Model for Requirements Validation

This paper reports experience from how a project engaged in the process of requirements analysis for evolutionary builds can reuse the formally specified design model produced for a similar, earlier project in the same domain. Two levels of reuse are described here. First, a formally specified generic design model was generated on one project to systematically capture the design commonality in a set of software monitors on board a spacecraft. These monitors periodically check for faults and invoke recovery software when needed. The paper summarizes the use of the design model to validate the software design of the various monitors on that first project. Secondly, the paper describes how the formal design model created for the first project was reused on a second, subsequent project. The model was reused to validate the evolutionary requirements for the second project's software monitors, which were being developed in a series of builds. Some mismatches due to the very different architectures on the two projects suggested changes to make the model more generic. In addition, several advantages to the reuse of the first project's formal model on the second project are reported.

Lutz, Robyn R.↗

2023 Critical Materials Strategy

The global effort to curb carbon emissions is accelerating demand for clean energy technologies and the materials they rely on. Demand for these materials will only continue to grow, especially as some nations aim to achieve net zero emissions by 2050. While some major materials like steel, copper, and aluminum are already powering the fossil fuel economy, others are more minor materials with potential supply risks. These risks could jeopardize the ability to reduce greenhouse gas emissions within the desirable timeframe to avoid significant climate change. In some cases, it may be necessary to take action to improve the resilience of material supply chains and mitigate supply risks. Understanding the importance of individual materials to clean energy and the supply risks associated with them is necessary to identify which materials may serve as potential roadblocks to a clean energy future. The U.S. Department of Energy (DOE) issued a series of 13 supply chain deep dive assessment reports on various energy technologies in 2022 in response to President Biden’s Executive Order on America’s Supply Chains (E.O. 14017). These reports emphasized that supply chain bottlenecks can occur at any stage of the value chain from mining and refining to component and even sub-system manufacturing. The bottlenecks are a combination of factors such as material availability, equipment availability, work force availability and quality, logistics, regulatory framework, and market conditions. These bottlenecks were worsened during the global Covid-19 pandemic. Its lingering impacts have hindered capacity expansion for material supply chains and prevented product lead-time recovery. One approach to reduce supply chain risks for the United States is to have a strong domestic manufacturing sector with a diverse set of producers. Boosting responsible domestic production would require leveraging the latest science not only in material extraction but also in developing substitutes, recycling, reuse, and remanufacturing. This report is an updated analysis of previous Critical Materials Strategy (CMS) reports published by the DOE in 2010, 2011, and 2019 based on national and global priorities, technology advancement, and technology adoption trends. Like the CMS reports, this analysis presents the results of a formal material criticality assessment to identify which materials are critical to the continued deployment of clean energy technologies globally. The analysis in this report leveraged the DOE supply chain deep dive assessments to develop the initial list of materials to evaluate. This DOE Critical Materials Assessment (CMA) is conducted independently of criticality assessments performed by other U.S. government agencies, such as that conducted by the U.S. Geological Survey (USGS). This analysis complements the USGS critical minerals determination in three aspects. First, the DOE assessment is performed from a global perspective, while the USGS analysis focusses on the importance of minerals to the U.S. economy. Second, this report focuses on the importance of materials to clean energy technologies, rather than to the economy in general. Lastly, this study is forward looking to 2035 based on clean energy deployment scenarios, whereas the USGS assessment is retrospective. Materials evaluated in this report that do not appear in the USGS Critical Minerals List include copper, uranium, electrical steel, and SiC. A draft version of this report received ~80 public comments related to supporting data and methodological improvement. Those comments have been incorporated as much as possible where appropriate. Highlights of findings from this 2023 CMA include: Rare earth materials (neodymium, praseodymium, dysprosium, and terbium) used in magnets in electric vehicle (EV) motors and wind turbine generators continue to be critical. While dysprosium (Dy) and terbium (Tb) are both heavy rare earth elements that serve the same function in magnets, the criticality of Tb is slightly lower than that for Dy in the short term due to the widespread use of Dy in high-grade magnets and Tb’s present role as a substitute. Similarly, praseodymium (Pr) is critical in the medium term but only near critical in the short term because it is more substitutable in magnets than neodymium (Nd); Materials used in batteries for EVs and stationary storage are now considered to be critical. While cobalt (Co) was found to be critical in this and previous reports, lithium (Li) becomes critical in the medium term due to its broader use in various battery chemistries and the rampant growth of the EV industry. Natural graphite is a new addition in this assessment and is also found to be critical; Platinum group metals used in hydrogen electrolyzers, such as platinum (Pr) and iridium (Ir), are critical due to an increased focus on hydrogen technologies to achieve net zero carbon emissions, while those used in catalytic converters, such as rhodium (Rh) and palladium (Pd), were screened out due to the decreased importance of catalytic converters in the medium term; Gallium (Ga) continues to be critical due to its use in light-emitting diodes (LEDs). In addition, the use of Ga has increased in magnet manufacturing and in semiconductor in forms such as gallium arsenide (GaAs) or gallium nitride (GaN); Major materials like Aluminum (Al), copper (Cu), nickel (Ni), and silicon (Si) move from noncritical in the short term to near critical in the medium term due to their importance in electrification; Electrical steel is near critical due to its use in transformers for the grid and electric motors in EVs.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

EVA Performance Prediction

Astronaut physical performance capabilities in micro gravity EV A or on planetary surfaces when encumbered by a life support suit and debilitated by a long exposure to micro gravity will be less than unencumbered pre flight capabilities. The big question addressed by human factors engineers is: what can the astronaut be expected to do on EVA or when we arrive at a planetary surface? A second question is: what aids to performance will be needed to enhance the human physical capability? These questions are important for a number of reasons. First it is necessary to carry out accurate planning of human physical demands to ensure that time and energy critical tasks can be carried out with confidence. Second it is important that the crew members (and their ground or planetary base monitors) have a realistic picture of their own capabilities, as excessive fatigue can lead to catastrophic failure. Third it is important to design appropriate equipment to enhance human sensory capabilities, locomotion, materials handling and manipulation. The evidence from physiological research points to musculoskeletal, cardiovascular and neurovestibular degradation during long duration exposure to micro gravity . The evidence from the biomechanics laboratory (and the Neutral Buoyancy Laboratory) points to a reduction in range of motion, strength and stamina when encumbered by a pressurized suit. The evidence from a long history of EVAs is that crewmembers are indeed restricted in their physical capabilities. There is a wealth of evidence in the literature on the causes and effects of degraded human performance in the laboratory, in sports and athletics, in industry and in other physically demanding jobs. One approach to this challenge is through biomechanical and performance modeling. Such models must be based on thorough task analysis, reliable human performance data from controlled studies, and functional extrapolations validated in analog contexts. The task analyses currently carried out for EVA activities are based more on extensive domain experience than any formal analytic structure. Conversely, physical task analysis for industrial and structured evidence from training and EV A contexts. Again on earth there is considerable evidence of human performance degradation due to encumbrance and fatigue. These industrial models generally take the form of a discounting equation. The development of performance estimates for space operations, such as timeline predictions for EVA is generally based on specific input from training activity, for example in the NBL or KC135. uniformed services tasks on earth are much more formalized. Human performance data in the space context has two sources: first there is the micro analysis of performance in structured tasks by the space physiology community and second there is the less structured evidence from training and EV A contexts.

Peacock, Brian↗

Sneak circuit analysis of instrumentation and control systems

The evolvement and implementation is presented of a systematic means for detecting the sneak prone designs of an electrical system which could result in such unplanned modes so that they can be prevented prior to occurrence. Sneak circuit analysis is shown to be a formalized approach based upon topological techniques. The trees employed are produced from manufacturing detail data processed by a computer to orderly completion. The analysis techniques applied on a variety of NASA programs are shown to be particularly applicable to industrial instrumentation and control systems.

Rankin, J. P.↗

Rigid-Mode Limit of the Yokoya Matrix Formalism and the Burov-Lebedev Dispersion Equation

Transverse single-bunch instabilities of space-charge-dominated coasting beams with round and flat transverse geometries are studied using a unified dispersion-relation framework. The analysis combines the Burov-Lebedev formalism, which captures space-charge tune spread, Landau damping, and instability threshold behavior, with Yokoya’s projection method for representing coherent transverse mode structure and its dependence on beam aspect ratio. In the rigid-beam limit, the formulation reduces to a scalar dispersion relation of Burov-Lebedev paper. For non-rigid transverse oscillations, truncation of Yokoya’s Hermite-based expansion yields a finite-dimensional matrix eigenvalue problem in which space-charge and coupling impedance effects enter through Burov-Lebedev–type denominators. This approach provides a consistent basis for comparing rigid and non-rigid instability behavior in round and flat beams and for assessing the role of beam ellipticity in modifying coherent mode structure and stability thresholds.

43 PARTICLE ACCELERATORS↗