Search NASA⌕ Search

SEARCH · Search NASA

Results for “model checking”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 217 records · Page 12

From Formal Requirements to Highly Assured Software for Unmanned Aircraft Systems

Operational requirements of safety-critical systems are often written in restricted specification logics. These restricted logics are amenable to automated analysis techniques such as model-checking, but are not rich enough to express complex requirements of unmanned systems. This short paper advocates for the use of expressive logics, such as higher-order logic, to specify the complex operational requirements and safety properties of unmanned systems. These rich logics are less amenable to automation and, hence, require the use of interactive theorem proving techniques. However, these logics support the formal verification of complex requirements such as those involving the physical environment. Moreover, these logics enable validation techniques that increase con dence in the correctness of numerically intensive software. These features result in highly-assured software that may be easier to certify. The feasibility of this approach is illustrated with examples drawn for NASA's unmanned aircraft systems.

Munoz, Cesar↗

Demand access protocol design and validation with SPIN

In order for distributed systems to communicate reliably engineers standardize on communication rules (or protocols). Unforeseen behavior in communication protocols can push faults up to applications resulting in uncontrollable systems and should not be tolerated. However, while most modern protocols undergo extensive testing, rigorous formal methods, such as model checking,are rarely used due to complexity and massive incomputable state spaces.

Seguí, John S.↗

Runtime Verification Logics A Language Design Perspective

Runtime Verification is a light-weight approach to systems verification, where actual executions of a system are processed and analyzed using rigorous techniques. In this paper we shall narrow the term’s definition to represent the commonly studied variant consisting of verifying that a single system execution conforms to a specification written in a formal specification language. Runtime verification (in this sense) can be used for writing test oracles during testing when the system is too complex for full formal verification, or it can be used during deployment of the system as part of a fault protection strategy, where corrective actions may be taken in case the specification is violated. Specification languages for runtime verification appear to differ from for example temporal logics applied in model checking, in part due to the focus on monitoring of events that carry data, and specifically due to the desire to relate data values existing at different time points, resulting in new challenges in both the complexity of the monitoring approach and the expressiveness of languages. Over the recent years, numerous runtime verification specification languages have emerged, each with its different features and levels of expressiveness and usability. This paper presents an overview and a discussion of this design space.

Reger, Giles↗

Psyche Science Planning with the Science Opportunity Analyzer

Psyche is a NASA Discovery mission intent on solving mysteries surrounding early planetary formation. The mission spacecraft will journey to (16) Psyche: a metallic asteroid believed to be the exposed core of an early planetesimal. Despite the unique nature of the target asteroid and the mission’s novel science goals, a significant portion of the project’s science planning needs may be met through the use of legacy tools. In particular, the adoption of the Jet Propulsion Laboratory’s (JPL) Science Opportunity Analyzer (SOA) promises to satisfy mission requirements with minimal development effort. Originally developed as a multi-mission science planning tool, SOA can design and visualize observations, perform geometric flight rule checking, model physical phenomena, and much more. The software has been used by the mission since its proposal phase and is expected to continue providing valuable capabilities throughout operations.

Elkins-Tanton, Linda T.↗

Simplifying Requirements Formalization for Resource-Constrained Mission-Critical Software

Developing critical software requires adherence to rigorous software development practices, such as formal requirement specification and verification. Despite their importance, such practices are often considered as complex and challenging tasks that require a strong formal methods background. In this paper, we present our work on simplifying the formal requirements specification experience for resource-constrained mission critical software through the use of structured natural language. To this end, we connect NASA’s FRET, a formal requirement elicitation and authoring tool with the Shelley model checking framework for MicroPython code. We report our experience on using these tools to specify requirements and analyze code from the NASA Ames PHALANX exploration concept.

PHALANX exploration concept↗

Verifying PLC Programs via Monitors: Extending the Integration of FRET and PLCverif

Verification of Programmable Logic Controller (PLC) programs requires reasoning about propositions qualified in terms of time. CERN’s PLCverif, an open-source tool for the analysis of safety-critical PLC systems, uses Linear Temporal Logic (LTL) for the specification of properties. Until now, PLCverif depended on third-party tools that accept LTL specifications to perform verification. However, our experience with industrial PLC programs shows that, to overcome analysis limitations, a wide range of techniques are needed to successfully verify complex properties. In this paper, we extend PLCverif to enable PLC program verification of pure-past LTL (PLTL) safety properties with assertion-based verification tools. To this end, we take an algorithm from the runtime-monitoring domain, apply it to bounded model checking of PLC programs, and implement it in PLCverif. We extend the integration of NASA’s Formal Requirements Elicitation Tool (FRET) into PLCverif to use PLTL properties generated with FRET. In addition, we leverage the program structure induced by the PLC scan-cycle for a state-space reduction. Finally, we expose the algorithm to a real-world case study of critical systems at CERN.

Formal verification↗

Towards a Compositional SPIN

This paper discusses our initial experience with introducing automated assume-guarantee verification based on learning in the SPIN tool. We believe that compositional verification techniques such as assume-guarantee reasoning could complement the state-reduction techniques that SPIN already supports, thus increasing the size of systems that SPIN can handle. We present a "light-weight" approach to evaluating the benefits of learning-based assume-guarantee reasoning in the context of SPIN: we turn our previous implementation of learning for the LTSA tool into a main program that externally invokes SPIN to provide the model checking-related answers. Despite its performance overheads (which mandate a future implementation within SPIN itself), this approach provides accurate information about the savings in memory. We have experimented with several versions of learning-based assume guarantee reasoning, including a novel heuristic introduced here for generating component assumptions when their environment is unavailable. We illustrate the benefits of learning-based assume-guarantee reasoning in SPIN through the example of a resource arbiter for a spacecraft. Keywords: assume-guarantee reasoning, model checking, learning.

Pasareanu, Corina S.↗

Design of Software for Design of Finite Element for Structural Analysis

The concepts of software engineering which allow a user of the finite element method to describe a model, to collect and to check the model data in a data base as well as to form the matrices required for a finite element calculation are examined. Next the components of the model description are conceived including the mesh tree, the topology, the configuration, the kinematic boundary conditions, the data for each element, and the loads. The possibilities for description and review of the data are considered. The concept of the segments for the modularization of the programs follows the components of the model description. The significance of the mesh tree as a globular guiding structure will be understood in view of the principle of the unity of the model, the mesh tree, and the data base. The user-friendly aspects of the software system will be summarized: the principle of language communication, the data generators, error processing, and data security.

Helfrich, Reinhard↗

Stability of Castering Wheels for Aircraft Landing Gears, Special Report

In many installations of castering rubber-tired wheels there is a tendency for the wheel to oscillate violently about the spindle axis. This phenomenon, popularly called 'shimmy,' has occurred in some airplane tail wheels and has been corrected in two ways: first by the application of friction in the spindles of the tail wheels; and, second, by locking the wheels while taxiing at high speeds. Shimmy is common with the large wheels used as nose wheels in tricycle landing gears and, since it is impossible to lock the wheels, friction in the nose-wheel spindle has been the sole means of correction. Because the nose wheel is larger than the conventional tail wheel and usually carries a greater load, the larger amounts of spindle friction necessary to prevent shimmy are objectionable. the present paper presents a theoretical and experimental study of the problem of the stability of castering wheels for airplane landing gears. On the basis of simplified assumptions induced from experimental observations, a theoretical study has been made of the shimmy of castering wheels. The theory is based on the discovery of a phenomenon called 'kinematic shimmy' and is compared quantitatively with the results of model experiments. Experimental checks, using a model having low-pressure tires, are reported and the applicability of the results to full scale is discussed. Theoretical methods of estimating the spindle viscous damping and spindle solid friction necessary to avoid shimmy - lateral freedom - is introduced.

Kantrowitz, Arthur↗

Quantification of uncertainties in coupled material degradation processes - High temperature, fatigue and creep

This paper describes the development of methodology that provides for quantification of uncertainties in lifetime strength of aerospace materials subjected to a number of diverse effects. A probabilistic material degradation model, in the form of a randomized multifactor interaction equation, has been postulated for lifetime strength degradation of structural components of aerospace propulsion systems. The model includes effects that typically reduce lifetime strength and may include temperature, mechanical fatigue, creep and others. The paper also includes the analysis of experimental data from the open literature for Inconel 718. These data are used to provide an initial check for model validity, as well as for calibration of the model's empirical material constants. The model validity check and calibration is carried out for three effects, namely, high temperature, mechanical fatigue and creep.

Boyce, L.↗

The solar abundance of silver.

Low noise, high resolution spectral scans have been obtained for the resonance lines of silver (3280.7 and 3382.9 A), observed at the center of the solar disk. The data are analyzed by the method of spectral synthesis, wherein we employ a model atmosphere resembling Elste's (1968) model, and checked by limb-darkening observations. The present kinematical model adopts a macroturbulent velocity of 2.2 km/sec and no microturbulence. With this model line profiles can be reproduced without invoking implausibly large collisional damping constants. The silver abundance turns out to be a factor of four under the value found from the Type I carbonaceous chondrites.

Ross, J. E.↗

Comprehensive stellar population models and the disentanglement of age and metallicity effects

The construction of detailed models for intermediate and old stellar populations is described. Input parameters include metallicity (-2 less than (Fe/H) less than 0.5), single-burst age (between 1.5 and 17 Gyr), and initial mass function (IMF) exponent. Quantities output include broadband magnitudes, spectral energy distributions, surface brightness fluctuation magnitudes, and a suite of 21 absorption feature indices. The models are checked against a wide variety of available observations. Examinations of model output yield the following conclusions. (1) If the percentage change delta age/delta Z approximately equals 3/2 for two populations, they will appear almost identical in most indices. A few indices break this degeneracy by being either more abundance sensitive (Fe4668, Fe5015, Fe5709, and Fe5782) or more age sensitive (G4300, H beta, and presumably higher order Balmer lines) than usual. (2) Present uncertainties in stellar evolution are of the same magnitude as the effects of IMF and Y in the indices studied. (3) Changes in abundance ratios (like (Mg/Fe)) are predicted to be readily apparent in the spectra of old stellar populations. (4) The I-band flux of a stellar population is predicted to be nearly independent of metallicity and only modestly sensitive to age. The I band is therefore recommended for standard candle work or studies of M/L in galaxies. Other conclusions stem from this work. (1) Intercomparison of models and observations of two TiO indices seem to indicate variation of the (V/Ti) ratio among galaxies, but it is not clear how this observation ties into the standard picture of chemical enrichment. (2) Current estimates of (Fe/H) for the most metal-rich globulars that are based on integrated indices are probably slightly too high. (3) Colors of population models from different authors exhibit a substantial range. At solar metallicity and 13 Gyr, this range corresponds to an age error of roughly +/- 7 Gyr. Model colors from different authors applied in a differential sense have smaller uncertainties. (4) In the present models the dominant error for colors is probably the transformation from stellar atmospheric parameters to stellar colors. (5) Stellar B - V is difficult to model, and current spreads among different authors can reach 0.2 mag. (6) If known defects in the stellar flux library are corrected, the population model colors of this work in passbands redder than U would be accurate to roughly 0.03 mag in an absolute sense. These corrections are not made in the tables of model output.

Worthey, Guy↗

Jet Noise Diagnostics Supporting Statistical Noise Prediction Methods

The primary focus of my presentation is the development of the jet noise prediction code JeNo with most examples coming from the experimental work that drove the theoretical development and validation. JeNo is a statistical jet noise prediction code, based upon the Lilley acoustic analogy. Our approach uses time-average 2-D or 3-D mean and turbulent statistics of the flow as input. The output is source distributions and spectral directivity. NASA has been investing in development of statistical jet noise prediction tools because these seem to fit the middle ground that allows enough flexibility and fidelity for jet noise source diagnostics while having reasonable computational requirements. These tools rely on Reynolds-averaged Navier-Stokes (RANS) computational fluid dynamics (CFD) solutions as input for computing far-field spectral directivity using an acoustic analogy. There are many ways acoustic analogies can be created, each with a series of assumptions and models, many often taken unknowingly. And the resulting prediction can be easily reverse-engineered by altering the models contained within. However, only an approach which is mathematically sound, with assumptions validated and modeled quantities checked against direct measurement will give consistently correct answers. Many quantities are modeled in acoustic analogies precisely because they have been impossible to measure or calculate, making this requirement a difficult task. The NASA team has spent considerable effort identifying all the assumptions and models used to take the Navier-Stokes equations to the point of a statistical calculation via an acoustic analogy very similar to that proposed by Lilley. Assumptions have been identified and experiments have been developed to test these assumptions. In some cases this has resulted in assumptions being changed. Beginning with the CFD used as input to the acoustic analogy, models for turbulence closure used in RANS CFD codes have been explored and compared against measurements of mean and rms velocity statistics over a range of jet speeds and temperatures. Models for flow parameters used in the acoustic analogy, most notably the space-time correlations of velocity, have been compared against direct measurements, and modified to better fit the observed data. These measurements have been extremely challenging for hot, high speed jets, and represent a sizeable investment in instrumentation development. As an intermediate check that the analysis is predicting the physics intended, phased arrays have been employed to measure source distributions for a wide range of jet cases. And finally, careful far-field spectral directivity measurements have been taken for final validation of the prediction code. Examples of each of these experimental efforts will be presented. The main result of these efforts is a noise prediction code, named JeNo, which is in middevelopment. JeNo is able to consistently predict spectral directivity, including aft angle directivity, for subsonic cold jets of most geometries. Current development on JeNo is focused on extending its capability to hot jets, requiring inclusion of a previously neglected second source associated with thermal fluctuations. A secondary result of the intensive experimentation is the archiving of various flow statistics applicable to other acoustic analogies and to development of time-resolved prediction methods. These will be of lasting value as we look ahead at future challenges to the aeroacoustic experimentalist.

Bridges, James E.↗

TEAMS Model Analyzer

The TEAMS model analyzer is a supporting tool developed to work with models created with TEAMS (Testability, Engineering, and Maintenance System), which was developed by QSI. In an effort to reduce the time spent in the manual process that each TEAMS modeler must perform in the preparation of reporting for model reviews, a new tool has been developed as an aid to models developed in TEAMS. The software allows for the viewing, reporting, and checking of TEAMS models that are checked into the TEAMS model database. The software allows the user to selectively model in a hierarchical tree outline view that displays the components, failure modes, and ports. The reporting features allow the user to quickly gather statistics about the model, and generate an input/output report pertaining to all of the components. Rules can be automatically validated against the model, with a report generated containing resulting inconsistencies. In addition to reducing manual effort, this software also provides an automated process framework for the Verification and Validation (V&V) effort that will follow development of these models. The aid of such an automated tool would have a significant impact on the V&V process.

Tijidjian, Raffi P.↗

Influence of Strain-Gage Balance Characteristics on the Precision Error of the Drag Coefficient

Improvements and results of a new method are presented that computes a pre-test estimate of the precision error of the drag coefficient of a wind tunnel model. The error estimate is defined as the part of the drag coefficient's precision error that is primarily associated with the precision error of the angle of attack measurement and physical characteristics of the chosen strain-gage balance. The method indirectly describes the precision error of the angle of attack measurement by using an assumed balance gage output variation of one microV/V. The physical characteristics of the balance, on the other hand, are described by partial derivatives of the axial and normal forces with respect to the strain-gage outputs. These derivatives can directly be obtained from the data reduction matrix of the balance. The precision error estimate itself is calculated by applying a simple explicit equation that uses the model reference area, the dynamic pressure, the angle of attack, the coefficients of the linear terms of the data reduction matrix, and the electrical output variation of one microvolt per volt as input. Precision errors at constant angle of attack may be visualized as contour plots by plotting them, for example, versus the Mach number and the total pressure. Characteristics of NASA's MC60E balance are used in combination with the reference area of a generic wind tunnel model in order to demonstrate that error estimates are independent of both the balance load format and the units chosen for the description of balance loads, model reference area, and the dynamic pressure. Finally, experimental data from a wind tunnel test of the Ames Check Standard Model in the NASA Ames 11-foot Transonic Wind Tunnel illustrates the application of the method to real-world test data.

precision error↗

The upper mantle beneath the Cascade Range: A comparison with the Gulf of California

Seismograms from 22 earthquakes along the northeast Pacific rim recorded in southern California form the data set for investigation of the upper mantle beneath the Cascade Range-Juan de Fuca region, a transitional area encompassing both very young ocean floor and a continental margin. These data consist of 853 seismograms (6 deg delta 42 deg) which produce 1068 travel times and 40 ray parameter estimates. These data are compared directly to another large suite of records representative of structure beneath the Gulf of California, an active spreading center. The spreading center model, GCA, was used as a starting point in WKBJ synthetic seismogram modeling and perturb GCA until the northeast Pacific data are matched. Application of wave field continuation to these two groups of data provides checks on model's consistency with the data as well as an estimate of the resolvability of differences between the two areas. Differences between the models derived from these two data sets are interpretable in terms of lateral structural variation beneath the two regimes.

Walck, M. C.↗

Finite Element Analysis of Magnetic Damping Effects on G-Jitter Induced Fluid Flow

This paper reports some interim results on numerical modeling and analyses of magnetic damping of g-jitter driven fluid flow in microgravity. A finite element model is developed to represent the fluid flow, thermal and solute transport phenomena in a 2-D cavity under g-jitter conditions with and without an applied magnetic field. The numerical model is checked by comparing with analytical solutions obtained for a simple parallel plate channel flow driven by g-jitter in a transverse magnetic field. The model is then applied to study the effect of steady state g-jitter induced oscillation and on the solute redistribution in the liquid that bears direct relevance to the Bridgman-Stockbarger single crystal growth processes. A selection of computed results is presented and the results indicate that an applied magnetic field can effectively damp the velocity caused by g-jitter and help to reduce the time variation of solute redistribution.

Pan, Bo↗