Search NASA⌕ Search

SEARCH · Search NASA

Results for “Program verification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 307 records · Page 17

Magnetic cleanliness verification approach on tethered satellite

Magnetic cleanliness testing was performed on the Tethered Satellite as the last step of an articulated verification campaign aimed at demonstrating the capability of the satellite to support its TEMAG (TEthered MAgnetometer) experiment. Tests at unit level and analytical predictions/correlations using a dedicated mathematical model (GANEW program) are also part of the verification activities. Details of the tests are presented, and the results of the verification are described together with recommendations for later programs.

Messidoro, Piero↗

A Verification Framework for Runtime Assurance of Autonomous UAS

Runtime Assurance (RTA) is a design-time architecture for safety-critical systems where an internal monitor acts upon detecting a violation of a property. The simplex architecture is an instance of RTA, where the action taken is to hand control of the overall system to a trusted controller when an untrusted one violates a safety property. Simplex RTA is emerging as a method for allowing AI/ML and other unverified software to be integrated into safety-critical applications like aircraft. To this end, the American Society for Testing and Materials (ASTM) and NASA have each published guidelines on the use of RTA in such systems. In the simplex RTA framework, a system has an advanced controller (AC) and a reversionary controller (RC). The system is allowed to operate with the AC until a runtime monitor detects that some property has been violated and then the RC takes over. Assuming that the sample rate of the monitor will detect improper functioning with enough time for the RC to correct the impending problem, and that the RC is trusted, the system will operate as intended. This use of the simplex RTA framework can allow for the integration of untrusted, but possibly more performant, controllers in a safe way. This paper presents a formalization of a simplex RTA framework in the Prototype Verification System (PVS) theorem prover using an embedding of differential dynamic logic (DDL) called Plaidypvs. A novel feature of this framework is that it can be instantiated at different levels of abstraction. This feature allows for the formal verification of a system with an untrusted black box component, such as an AI/ML controller. This paper does not address the many difficulties in deploying RTA in an industrial-level system. Instead, the focus is on the formal verification of the simplex RTA framework in the language of hybrid programs. Hybrid programs are programs that include both discrete and continuous dynamics and can be used to model complex cyber-physical systems. Plaidypvs is a tool that enables formalization of hybrid programs in the PVS theorem prover. Plaidypvs enables the verification of the general simplex RTA framework and then, by specializing some components of the hybrid program, verifying instances of the framework while treating the untrusted component as a black box. A selection of Unmanned Aircraft Systems (UAS) operations are shown as instances of the general RTA framework in PVS. This offers the benefit of design time verification of relevant safety properties to the system, and it also gives requirements on the sample rate of sensors that determine the time interval in which the ‘switch’ property of the RTA framework is checked.

PVS↗

International Space Station Requirement Verification for Commercial Visiting Vehicles

The COTS program demonstrated NASA could rely on commercial providers for safe, reliable, and cost-effective cargo delivery to ISS. The ISS Program has developed a streamlined process to safely integrate commercial visiting vehicles and ensure requirements are met Levy a minimum requirement set (down from 1000s to 100s) focusing on the ISS interface and safety, reducing the level of NASA oversight/insight and burden on the commercial Partner. Partners provide a detailed verification and validation plan documenting how they will show they've met NASA requirements. NASA conducts process sampling to ensure that the established verification processes is being followed. NASA participates in joint verification events and analysis for requirements that require both parties verify. Verification compliance is approved by NASA and launch readiness certified at mission readiness reviews.

Garguilo, Dan↗

Effectiveness evaluation of STOL transport operations (phase 2)

A computer simulation program which models a commercial short-haul aircraft operating in the civil air system was developed. The purpose of the program is to evaluate the effect of a given aircraft avionics capability on the ability of the aircraft to perform on-time carrier operations. The program outputs consist primarily of those quantities which can be used to determine direct operating costs. These include: (1) schedule reliability or delays, (2) repairs/replacements, (3) fuel consumption, and (4) cancellations. More comprehensive models of the terminal area environment were added and a simulation of an existing airline operation was conducted to obtain a form of model verification. The capability of the program to provide comparative results (sensitivity analysis) was then demonstrated by modifying the aircraft avionics capability for additional computer simulations.

Welp, D. W.↗

Future NTP Development Synergy Leveraged from Current J-2X Engine Development

This paper is a discussion of how the many long-lead development elements required for the realization of a future nuclear thermal propulsion (NTP) system can be effectively leveraged from the ongoing work being conducted on the J-2X engine program for the Constellation Program. Development studies conducted to date for NTP forward planning have identified a number of technical areas that will require advancement to acceptable technology readiness levels (TRLs) before they can be utilized in NTP system development. These include high-temperature, high-area ratio nozzle extension; long-life, low-NPSP. turbomachinery; and low-boiloff propellant management; and a qualified nuclear fuel element. The current J-2X program is working many of these areas that can be leveraged to support NTP development in a highly compatible and synergistic fashion. In addition to supporting technical development, there are other programmatic issues being worked in the J-2X program that can be leveraged by a future NTP development program. These include compliance with recently-evolved space system requirements such as human-rating, fault tolerance and fracture control. These and other similar mandatory system requirements have been adopted by NASA and can result in a significant technical impact beyond elevation of the root technologies required by NTP. Finally, the exploitation of experience, methodologies, and procedures developed by the J-2X program in the areas of verification, qualification, certification, altitude simulation testing, and facility definition will be especially applicable to a future NTP system. The similarities in system mission (in-space propulsion) and operational environment (vacuum, zero-gee) between J-2X and NTP make this highly synergistic. Thus, it can be $hown that the collective benefit of leveraging experience and technologies developed during the J-2X program can result in significant savings in development cost and schedule for NTP.

Ballard, Richard O.↗

Microbial burden prediction model for unmanned planetary spacecraft

The technical development of a computer program for predicting microbial burden on unmanned planetary spacecraft is outlined. The discussion includes the derivation of the basic analytical equations, the selection of a method for handling several random variables, the macrologic of the computer programs and the validation and verification of the model. The prediction model was developed to (1) supplement the biological assays of a spacecraft by simulating the microbial accretion during periods when assays are not taken; (2) minimize the necessity for a large number of microbiological assays; and (3) predict the microbial loading on a lander immediately prior to sterilization and other non-lander equipment prior to launch. It is shown that these purposes not only were achieved but also that the prediction results compare favorably to the estimates derived from the direct assays. The computer program can be applied not only as a prediction instrument but also as a management and control tool. The basic logic of the model is shown to have possible applicability to other sequential flow processes, such as food processing.

Hoffman, A. R.↗

Space Station automated systems testing/verification and the Galileo Orbiter fault protection design/verification

Aspects of Space Station automated systems testing and verification are discussed, taking into account several program requirements. It is found that these requirements lead to a number of issues of uncertainties which require study and resolution during the Space Station definition phase. Most, if not all, of the considered uncertainties have implications for the overall testing and verification strategy adopted by the Space Station Program. A description is given of the Galileo Orbiter fault protection design/verification approach. Attention is given to a mission description, an Orbiter description, the design approach and process, the fault protection design verification approach/process, and problems of 'stress' testing.

Landano, M. R.↗

Shuttle avionics software trials, tribulations and success

The early problems and the solutions developed to provide the required quality software needed to support the space shuttle engine development program are described. The decision to use a programmable digital control system on the space shuttle engine was primarily based upon the need for a flexible control system capable of supporting the total engine mission on a large complex pump fed engine. The mission definition included all control phases from ground checkout through post shutdown propellant dumping. The flexibility of the controller through reprogrammable software allowed the system to respond to the technical challenges and innovation required to develop both the engine and controller hardware. This same flexibility, however, placed a severe strain on the capability of the software development and verification organization. The overall development program required that the software facility accommodate significant growth in both the software requirements and the number of software packages delivered. This challenge was met by reorganization and evolution in the process of developing and verifying software.

Henderson, O. L.↗

Manned spacecraft electrical power systems

A brief history of the development of electrical power systems from the earliest manned space flights illustrates a natural trend toward a growth of electrical power requirements and operational lifetimes with each succeeding space program. A review of the design philosophy and development experience associated with the Space Shuttle Orbiter electrical power system is presented, beginning with the state of technology at the conclusion of the Apollo Program. A discussion of prototype, verification, and qualification hardware is included, and several design improvements following the first Orbiter flight are described. The problems encountered, the scientific and engineering approaches used to meet the technological challenges, and the results obtained are stressed. Major technology barriers and their solutions are discussed, and a brief Orbiter flight experience summary of early Space Shuttle missions is included. A description of projected Space Station power requirements and candidate system concepts which could satisfy these anticipated needs is presented. Significant challenges different from Space Shuttle, innovative concepts and ideas, and station growth considerations are discussed. The Phase B Advanced Development hardware program is summarized and a status of Phase B preliminary tradeoff studies is presented.

Simon, William E.↗

Specification, space station program (modular)

The modular concepts of a long-term manned scientific laboratory in earth orbit using the space shuttle for orbital buildup and logistics delivery are presented. The specifications defining the performance, design and verification requirements for the Modular Space Program are included.

Source record↗

Shuttle avionics software development trials: Tribulations and successes, the backup flight system

The development and verification of the Backup Flight System software (BFS) is discussed. The approach taken for the BFS was to develop a very simple and straightforward software program and then test it in every conceivable manner. The result was a program that contained approximately 12,000 full words including ground checkout and the built in test program for the computer. To perform verification, a series of tests was defined using the actual flight type hardware and simulated flight conditions. Then simulated flights were flown and detailed performance analysis was conducted. The intent of most BFS tests was to demonstrate that a stable flightpath could be obtained after engagement from an anomalous initial condition. The extention of the BFS to meet the requirements of the orbital flight test phase is also described.

Chevers, E. S.↗

Efficient Ada multitasking on a RISC register window architecture

This work addresses the problem of reducing context switch overhead on a processor which supports a large register file - a register file much like that which is part of the Berkeley RISC processors and several other emerging architectures (which are not necessarily reduced instruction set machines in the purest sense). Such a reduction in overhead is particularly desirable in a real-time embedded application, in which task-to-task context switch overhead may result in failure to meet crucial deadlines. A storage management technique by which a context switch may be implemented as cheaply as a procedure call is presented. The essence of this technique is the avoidance of the save/restore of registers on the context switch. This is achieved through analysis of the static source text of an Ada tasking program. Information gained during that analysis directs the optimized storage management strategy for that program at run time. A formal verification of the technique in terms of an operational control model and an evaluation of the technique's performance via simulations driven by synthetic Ada program traces are presented.

Kearns, J. P.↗

The NASA Orbital Debris Engineering Model 3.1: Development, Verification, and Validation

The NASA Orbital Debris Program Office has developed the Orbital Debris Engineering Model (ORDEM) primarily as a tool for spacecraft designers and other users to understand the long-term risk of collisions with orbital debris. The newest version, ORDEM 3.1, incorporates the latest and highest fidelity datasets available to build and validate representative orbital debris populations encompassing low Earth orbit (LEO) to geosynchronous orbit (GEO) altitudes for the years 2016-2050. ORDEM 3.1 models fluxes for object sizes > 10 μm within or transiting LEO and > 10 cm in GEO. The deterministic portion of the populations in ORDEM 3.1 is based on the U.S. Space Surveillance Network (SSN) catalog, which provides coverage down to approximately 10 cm in LEO and 1 m in GEO. Observational datasets from radar, in situ, and optical sources provide a foundation from which the model populations are statistically extrapolated to smaller sizes and orbit regions that are not well-covered by the SSN catalog, yet may pose the greatest threat to operational spacecraft. Objects in LEO ranging from approximately 5 mm to 10 cm are modeled using observational data from ground-based radar, namely the Haystack Ultrawideband Satellite Imaging Radar (HUSIR – formerly known as Haystack). The LEO population smaller than approximately 3 mm in size is characterized based on a reanalysis of in situ data from impacts to the windows and radiators of the U.S. Space Transportation System orbiter vehicle, i.e., the Space Shuttle. Data from impacts on the Hubble Space Telescope are also used to validate the sub-millimeter model populations in LEO. Debris in GEO with sizes ranging from 10 cm to 1 m is modeled using optical measurement data from the Michigan Orbital DEbris Survey Telescope (MODEST). Specific, major debris-producing events, including the Fengyun-1C, Iridium 33, and Cosmos 2251 debris clouds, and unique populations, such as sodium-potassium droplets, have been re-examined and are modeled and added to the ORDEM environment separately. The debris environment greater than 1 mm is forecast using NASA’s LEO-to- GEO ENvironment Debris model (LEGEND). Future explosions of intact objects and collisions involving objects greater than 10 cm are assessed statistically, and the NASA Standard Satellite Breakup Model is used to generate fragments from these events. Fragments smaller than 10 cm are further differentiated based on material density categories, i.e., high-, medium-, and low-density, to better characterize the potential debris risk posed to spacecraft. The future projection of the sub-millimeter environment is computed using a special small-particle degradation model where small particles are created from intact spacecraft and rocket bodies. This work discusses the development, features, and capabilities of the ORDEM 3.1 model; the ne new data analyses used to build the model populations; and sample verification and validation results.

Matney, M.↗

A Tool for Intersecting Context-Free Grammars and Its Applications

This paper describes a tool for intersecting context-free grammars. Since this problem is undecidable the tool follows a refinement-based approach and implements a novel refinement which is complete for regularly separable grammars. We show its effectiveness for safety verification of recursive multi-threaded programs.

Context Free Grammar↗

Model verification of large structural systems

A computer program for the application of parameter identification on the structural dynamic models of space shuttle and other large models with hundreds of degrees of freedom is described. Finite element, dynamic, analytic, and modal models are used to represent the structural system. The interface with math models is such that output from any structural analysis program applied to any structural configuration can be used directly. Processed data from either sine-sweep tests or resonant dwell tests are directly usable. The program uses measured modal data to condition the prior analystic model so as to improve the frequency match between model and test. A Bayesian estimator generates an improved analytical model and a linear estimator is used in an iterative fashion on highly nonlinear equations. Mass and stiffness scaling parameters are generated for an improved finite element model, and the optimum set of parameters is obtained in one step.

Lee, L. T.↗

Europa Clipper Payload Verification and Validation: Avionics-Instrument Interface Test Campaign

NASA's Europa Clipper mission will investigate Jupiter's icy moon Europa using a payload suite consisting of nine instruments to address a range of scientific objectives concerning Europa's habitability. As the project proceeds past its Critical Design Review, confidence is being built in the system's ability to achieve mission objectives through the implementation of a rigorous payload verification and validation (V&V) program. As part of this payload V&V program, instrument box-level testing was performed by the payload team to verify select instrument-avionics interface requirements. This testing was performed at JPL using the avionics testbed's Bulk Data Storage Emulator (BDSEM) with visiting instrument Test Models. This paper summarizes the Data Link test campaign involving roughly four days of functional testing per instrument, including planning, testing methods, types of issues found, and the requirement closure process. Detail is also provided on the development, deployment, and validation of a standardized analysis tool used in data reviews. This testing verified requirements related to commanding rates, loss of link, packet format, clock counters, loopback test capability, and SpaceWire jitter and skew margins. Additional risk reduction testing of basic commanding, counter behavior, science data collection and transfer, and interface swapping was also performed. Because the BDSEM venue was not originally designed to be a run for record venue, the process of characterizing venue fidelity and establishing suitability for requirement closure using data collected in this venue will also be addressed.In order to close requirements, an extensible tool was developed to post-process instrument command and telemetry data from their original binary to a human-readable format and give visibility to errors detected within the data, such as packets with Cyclic Redundancy Check errors. This tool, called payload-packet-parser, is a Python 3.9 command line tool built using a variety of open-source Python libraries. Payload-packet-parser was designed to support parsing command and telemetry packets for all Europa Clipper instruments and additional analysis tools were developed for verification of specific information interface requirements. This test campaign, including post-processing using a single parsing and verification toolset, allowed for early interface testing, alleviating testing burdens on instrument teams and buying down risk on the instrument-avionics interface by finding hardware and software issues and idiosyncrasies prior to integration with system test venues. Over twenty issues were discovered across the payload, resulting in software updates and instrument rework well in advance of any system impacts. This paper concludes with an assessment of benefits and costs of this type of testing and lessons learned.

Montanez, Leticia↗

XIPE the X-Ray Imaging Polarimetry Explorer

X-ray polarimetry, sometimes alone, and sometimes coupled to spectral and temporal variability measurements and to imaging, allows a wealth of physical phenomena in astrophysics to be studied. X-ray polarimetry investigates the acceleration process, for example, including those typical of magnetic reconnection in solar flares, but also emission in the strong magnetic fields of neutron stars and white dwarfs. It detects scattering in asymmetric structures such as accretion disks and columns, and in the so-called molecular torus and ionization cones. In addition, it allows fundamental physics in regimes of gravity and of magnetic field intensity not accessible to experiments on the Earth to be probed. Finally, models that describe fundamental interactions (e.g. quantum gravity and the extension of the Standard Model) can be tested. We describe in this paper the X-ray Imaging Polarimetry Explorer (XIPE), proposed in June 2012 to the first ESA call for a small mission with a launch in 2017. The proposal was, unfortunately, not selected. To be compliant with this schedule, we designed the payload mostly with existing items. The XIPE proposal takes advantage of the completed phase A of POLARIX for an ASI small mission program that was cancelled, but is different in many aspects: the detectors, the presence of a solar flare polarimeter and photometer and the use of a light platform derived by a mass production for a cluster of satellites. XIPE is composed of two out of the three existing JET-X telescopes with two Gas Pixel Detectors (GPD) filled with a He-DME mixture at their focus. Two additional GPDs filled with a 3-bar Ar-DME mixture always face the Sun to detect polarization from solar flares. The Minimum Detectable Polarization of a 1 mCrab source reaches 14 in the 210 keV band in 105 s for pointed observations, and 0.6 for an X10 class solar flare in the 1535 keV energy band. The imaging capability is 24 arcsec Half Energy Width (HEW) in a Field of View of 14.7 arcmin 14.7 arcmin. The spectral resolution is 20 at 6 keV and the time resolution is 8 s. The imaging capabilities of the JET-X optics and of the GPD have been demonstrated by a recent calibration campaign at PANTER X-ray test facility of the Max-Planck-Institut fr extraterrestrische Physik (MPE, Germany). XIPE takes advantage of a low-earth equatorial orbit with Malindi as down-link station and of a Mission Operation Center (MOC) at INPE (Brazil). The data policy is organized with a Core Program that comprises three months of Science Verification Phase and 25 of net observing time in the following 2 years. A competitive Guest Observer program covers the remaining 75 of the net observing time.

Astronomy X-ray Polarimetry↗