SEARCH · Search NASA

Results for “certification coding”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2

All sources NASA NTRS DOE OSTI

NASA NTRS2017

Designing and Developing Web-Based Administrative Tools for Program Management

The task assigned for this internship was to develop a new tool for tracking projects, their subsystems, the leads, backups, and other employees assigned to them, as well as all the relevant information related to the employee (WBS (time charge) codes, time distribution, certifications, and assignments). Currently, this data is tracked manually using a number of different spreadsheets and other tools simultaneously by a number of different people; some of these documents are then merged into one large document. This often leads to inconsistencies and loss in data due to human error. By simplifying the process of tracking this data and aggregating it into a single tool, it is possible to significantly decrease the potential for human error and time spent collecting and checking this information. II. Objective The main objective of this internship is to develop a web-based tool using Ruby on Rails to serve as a method of easily tracking projects, subsystems, and points of contact, along with employees, their assignments, time distribution, certifications, and contact information. Additionally, this tool must be capable of generating a number of different reports based on the data collected. It was important that this tool deliver all of this information using a readable and intuitive interface.

Material↗

NASA NTRS2008

Certifying Auto-Generated Flight Code

Model-based design and automated code generation are being used increasingly at NASA. Many NASA projects now use MathWorks Simulink and Real-Time Workshop for at least some of their modeling and code development. However, there are substantial obstacles to more widespread adoption of code generators in safety-critical domains. Since code generators are typically not qualified, there is no guarantee that their output is correct, and consequently the generated code still needs to be fully tested and certified. Moreover, the regeneration of code can require complete recertification, which offsets many of the advantages of using a generator. Indeed, manual review of autocode can be more challenging than for hand-written code. Since the direct V&V of code generators is too laborious and complicated due to their complex (and often proprietary) nature, we have developed a generator plug-in to support the certification of the auto-generated code. Specifically, the AutoCert tool supports certification by formally verifying that the generated code is free of different safety violations, by constructing an independently verifiable certificate, and by explaining its analysis in a textual form suitable for code reviews. The generated documentation also contains substantial tracing information, allowing users to trace between model, code, documentation, and V&V artifacts. This enables missions to obtain assurance about the safety and reliability of the code without excessive manual V&V effort and, as a consequence, eases the acceptance of code generators in safety-critical contexts. The generation of explicit certificates and textual reports is particularly well-suited to supporting independent V&V. The primary contribution of this approach is the combination of human-friendly documentation with formal analysis. The key technical idea is to exploit the idiomatic nature of auto-generated code in order to automatically infer logical annotations. The annotation inference algorithm itself is generic, and parametrized with respect to a library of coding patterns that depend on the safety policies and the code generator. The patterns characterize the notions of definitions and uses that are specific to the given safety property. For example, for initialization safety, definitions correspond to variable initializations while uses are statements which read a variable, whereas for array bounds safety, definitions are the array declarations, while uses are statements which access an array variable. The inferred annotations are thus highly dependent on the actual program and the properties being proven. The annotations, themselves, need not be trusted, but are crucial to obtain the automatic formal verification of the safety properties without requiring access to the internals of the code generator. The approach has been applied to both in-house and commercial code generators, but is independent of the particular generator used. It is currently being adapted to flight code generated using MathWorks Real-Time Workshop, an automatic code generator that translates from Simulink/Stateflow models into embedded C code.

Denney, Ewen↗

NASA NTRS2011

Natural Language Interface for Safety Certification of Safety-Critical Software

Model-based design and automated code generation are being used increasingly at NASA. The trend is to move beyond simulation and prototyping to actual flight code, particularly in the guidance, navigation, and control domain. However, there are substantial obstacles to more widespread adoption of code generators in such safety-critical domains. Since code generators are typically not qualified, there is no guarantee that their output is correct, and consequently the generated code still needs to be fully tested and certified. The AutoCert generator plug-in supports the certification of automatically generated code by formally verifying that the generated code is free of different safety violations, by constructing an independently verifiable certificate, and by explaining its analysis in a textual form suitable for code reviews.

Denney, Ewen↗

NASA NTRS2005

Software Certification for Temporal Properties With Affordable Tool Qualification

It has been recognized that a framework based on proof-carrying code (also called semantic-based software certification in its community) could be used as a candidate software certification process for the avionics industry. To meet this goal, tools in the "trust base" of a proof-carrying code system must be qualified by regulatory authorities. A family of semantic-based software certification approaches is described, each different in expressive power, level of automation and trust base. Of particular interest is the so-called abstraction-carrying code, which can certify temporal properties. When a pure abstraction-carrying code method is used in the context of industrial software certification, the fact that the trust base includes a model checker would incur a high qualification cost. This position paper proposes a hybrid of abstraction-based and proof-based certification methods so that the model checker used by a client can be significantly simplified, thereby leading to lower cost in tool qualification.

Xia, Songtao↗

DOE OSTI2024

Misclassification of causes of death among a small all-autopsied group of former nuclear workers: Death certificates vs. autopsy reports

The U.S. Transuranium and Uranium Registries performs autopsies on each of its deceased Registrants as a part of its mission to follow up occupationally-exposed individuals. This provides a unique opportunity to explore death certificate misclassification errors, and the factors that influence them, among this small population of former nuclear workers. Underlying causes of death from death certificates and autopsy reports were coded using the 10 th revision of the International Classification of Diseases (ICD-10). These codes were then used to quantify misclassification rates among 268 individuals for whom both full autopsy reports and death certificates with legible underlying causes of death were available. When underlying causes of death were compared between death certificates and autopsy reports, death certificates correctly identified the underlying cause of death’s ICD-10 disease chapter in 74.6% of cases. The remaining 25.4% of misclassified cases resulted in over-classification rates that ranged from 1.2% for external causes of mortality to 12.2% for circulatory disease, and under-classification rates that ranged from 7.7% for external causes of mortality to 47.4% for respiratory disease. Neoplasms had generally lower misclassification rates with 4.3% over-classification and 13.3% under-classification. A logistic regression revealed that the odds of a match were 2.8 times higher when clinical history was mentioned on the autopsy report than when it was not. Similarly, the odds of a match were 3.4 times higher when death certificates were completed using autopsy findings than when autopsy findings were not used. This analysis excluded cases where it could not be determined if autopsy findings were used to complete death certificates. The findings of this study are useful to investigate the impact of death certificate misclassification errors on radiation risk estimates and, therefore, improve the reliability of epidemiological studies.

63 RADIATION, THERMAL, AND OTHER ENVIRON. POLLUTAN↗

DOE OSTI2023

Improvements to the Simplified Loads Methodology in IEC 61400-2: November 22, 2021 - November 21, 2022

The "Simplified Loads Model" (SLM) of IEC 61400-2 provides a simple methodology to assess the structural integrity of a small wind turbine (SWT). The SLM is unique to the small wind turbine standard. It was included to allow SWT manufacturers with limited resources to undertake integrity checks at a reasonable cost in time and resources and avoid the expense of detailed aeroelastic simulations. Unfortunately, the SLM has gained the reputation of being overly conservative and this has reduced its value to the SWT community and its use in SWT design and certification. Conservatism in design standards is needed but excessive conservatism is not. The aim of this report is to address the principal areas of excess conservatism and recommend changes to the SLM that preserve its simplicity but reduce the excess. The changes for the ultimate loads are consistent with their treatment in aeroelastic modelling for certification and with related codes for wind loading on structures. The recommendations for a new fatigue design load case are also based on aeroelastic simulations, in this case of five SWTs of varying configurations with rated power from 2.4 to 50 kW. It is also pointed out the design load case for yawed operation omits an important term. The recommended inclusion of this term would make the SLM slightly more conservative for this case.

17 WIND ENERGY↗

NASA NTRS2018

Cardiovascular Disease Outcomes Among the NASA Astronaut Corps

BACKGROUND: Acute effects of spaceflight on the cardiovascular system have been studied extensively, but the combined chronic effects of spaceflight and aging are not well understood. Preparation for and participation in spaceflight activities are associated with changes in the cardiovascular system such as decreased carotid artery distensibility and decreased ventricular mass which may lead to an increased risk of cardiovascular disease. Additionally, astronauts who travel into space multiple times or for longer durations may be at an increased risk across their lifespan. To that end, the purpose of this study was to determine the incidence of common cardiovascular disease (CVD) outcomes among the NASA astronaut corps during their active career and through retirement. METHODS: Cardiovascular disease outcomes were defined as reports of any of the following: myocardial infarction (MI), revascularization procedures (coronary artery bypass graft surgery [CABG] or percutaneous coronary intervention [PCI]), hypertension, stroke or transient ischemic attack [TIA], heart failure, or total CVD (as defined by the AHA - combined outcome of MI, Angina Pectoris, heart failure, stroke, and hypertension). Each outcome was identified individually from review of NASA's Electronic Medical Record (EMR), EKG reports, and death certificates using ICD-9 codes as well as string searches of physician notes of astronaut exams that occurred between 1959 and 2016. RESULTS: Of 338 NASA astronauts selected as of 2016, 9 reported an MI, 12 reported a revascularization procedure, (7 PCI and 5 CABG), 4 reported Angina (without MI), 5 reported heart failure, 9 reported stroke/TIA, and 96 reported hypertension. Total CVD was reported in 105 astronauts. No astronaut who had an MI or revascularization procedure flew a spaceflight mission following the event. All MI, revascularization, and stroke events occurred in male astronauts. When reviewing astronaut ECG reports, abnormal ECG reports were found in only 8% of records (n=430) and mainly among retired astronauts (82%), with marked sinus bradycardia being the reason for the abnormal classification.

Charvat, Jacqueline M.↗

NASA NTRSDate not supplied

Quantification of Numerical Uncertainty via Nonlinear Dynamical Approach

Motivations (Ensure a Higher Level of Confidence in the Predictability & Reliability of Numerical Simulation for Multiscale Complex Nonlinear Fluid Problems) - The last two decades have been an era when computation is ahead of analysis & when very large scale practical computations are increasingly used in poorly understood multiscale complex nonlinear physical problems & non-traditional fields (Especially when computations offer the ONLY way of generating this type of data limited simulations). - At present some of the numerical uncertainties can be explained and minimized by traditional numerical analysis and standard CFD practices. However, such practices, usually based on linearized analysis, MIGHT NOT be sufficient for strongly nonlinear and/or stiff problems. - We need a good understanding of the nonlinear behavior of numerical schemes being used as an integral part of code verification, validation and certification.

HEC↗

NASA NTRS2009

Generating Code Review Documentation for Auto-Generated Mission-Critical Software

Model-based design and automated code generation are increasingly used at NASA to produce actual flight code, particularly in the Guidance, Navigation, and Control domain. However, since code generators are typically not qualified, there is no guarantee that their output is correct, and consequently auto-generated code still needs to be fully tested and certified. We have thus developed AUTOCERT, a generator-independent plug-in that supports the certification of auto-generated code. AUTOCERT takes a set of mission safety requirements, and formally verifies that the autogenerated code satisfies these requirements. It generates a natural language report that explains why and how the code complies with the specified requirements. The report is hyper-linked to both the program and the verification conditions and thus provides a high-level structured argument containing tracing information for use in code reviews.

Denney, Ewen↗

NASA NTRS2005

Formal Safety Certification of Aerospace Software

In principle, formal methods offer many advantages for aerospace software development: they can help to achieve ultra-high reliability, and they can be used to provide evidence of the reliability claims which can then be subjected to external scrutiny. However, despite years of research and many advances in the underlying formalisms of specification, semantics, and logic, formal methods are not much used in practice. In our opinion this is related to three major shortcomings. First, the application of formal methods is still expensive because they are labor- and knowledge-intensive. Second, they are difficult to scale up to complex systems because they are based on deep mathematical insights about the behavior of the systems (t.e., they rely on the "heroic proof"). Third, the proofs can be difficult to interpret, and typically stand in isolation from the original code. In this paper, we describe a tool for formally demonstrating safety-relevant aspects of aerospace software, which largely circumvents these problems. We focus on safely properties because it has been observed that safety violations such as out-of-bounds memory accesses or use of uninitialized variables constitute the majority of the errors found in the aerospace domain. In our approach, safety means that the program will not violate a set of rules that can range for the simple memory access rules to high-level flight rules. These different safety properties are formalized as different safety policies in Hoare logic, which are then used by a verification condition generator along with the code and logical annotations in order to derive formal safety conditions; these are then proven using an automated theorem prover. Our certification system is currently integrated into a model-based code generation toolset that generates the annotations together with the code. However, this automated formal certification technology is not exclusively constrained to our code generator and could, in principle, also be integrated with other code generators such as RealTime Workshop or even applied to legacy code. Our approach circumvents the historical problems with formal methods by increasing the degree of automation on all levels. The restriction to safety policies (as opposed to arbitrary functional behavior) results in simpler proof problems that can generally be solved by fully automatic theorem proves. An automated linking mechanism between the safety conditions and the code provides some of the traceability mandated by process standards such as DO-178B. An automated explanation mechanism uses semantic markup added by the verification condition generator to produce natural-language explanations of the safety conditions and thus supports their interpretation in relation to the code. It shows an automatically generated certification browser that lets users inspect the (generated) code along with the safety conditions (including textual explanations), and uses hyperlinks to automate tracing between the two levels. Here, the explanations reflect the logical structure of the safety obligation but the mechanism can in principle be customized using different sets of domain concepts. The interface also provides some limited control over the certification process itself. Our long-term goal is a seamless integration of certification, code generation, and manual coding that results in a "certified pipeline" in which specifications are automatically transformed into executable code, together with the supporting artifacts necessary for achieving and demonstrating the high level of assurance needed in the aerospace domain.

Denney, Ewen↗

DOE OSTI2022

Improving Residential Building Simulations Through Large-Scale Empirical Validation

Residential building energy simulations are increasingly used for energy-efficient building design, codes and standards analysis, home certifications and ratings, utility programs, and technology assessments. Various software tools exist to perform residential building simulations, and these tools often use different models, inputs, and assumptions. This leads to inconsistencies that can undermine confidence in the predicted results. Validation of these tools can increase confidence by ensuring their accuracy and consistency. One way to validate simulation tools is through empirical testing, which compares predicted energy usage to measured utility billing data. This paper describes the process of data collection, data standardization, and empirical validation, and illustrates its use with our residential EnergyPlus (R)-based software. The data and process can be extended to other simulation tools and contribute to improving residential building simulations more broadly.

empirical validation↗

NASA NTRS2009

Proof Compression and the Mobius PCC Architecture for Embedded Devices

The EU Mobius project has been concerned with the security of Java applications, and of mobile devices such as smart phones that execute such applications. In this talk, I'll give a brief overview of the results obtained on on-device checking of various security-related program properties. I'll then describe in more detail how the concept of certified abstract interpretation and abstraction-carrying code can be applied to polyhedral-based analysis of Java byte code in order to verify properties pertaining to the usage of resources of a down-loaded application. Particular emphasis has been on finding ways of reducing the size of the certificates that accompany a piece of code.

Jensen, Thomas↗

NASA NTRS2023

X-57 Maxwell Airworthiness Validation Plan

This report is a Final Airworthiness Validation Plan (AVP) and describes how an aircraft like X-57 does (and does not) meet current airworthiness standards. The objective of this report is to create an example certification basis, associated means of compliance (MoC), and method of compliance for a distributed electric propulsion airplane under 14 Code of Federal Regulations (CFR) Part 21, “Certification Procedures for Products and Articles,” and its associated relevant sections of 14 CFR for “Airworthiness Standards” of Part 23, “Normal Category Airplanes,” Part 33 “Aircraft Engines,” and Part 35 “Propellers.” The approach to meet the objective is to use NASA’s X-57 Modification (Mod) IV flight demonstrator as an example and categorize its applicability to the regulations and standards according to the following three conditions: 1. Identify, where applicable, that the MoC and methods of compliance can be associated with existing Standard Specifications and Standard Practices of (ASTM) Committee F39 on Aircraft Systems and ASTM Committee F44 on General Aviation Aircraft; 2. If relevant ASTM standards do not exist, identify means and-or methods of compliance from appropriate Federal Aviation Administration (FAA) Advisory Circulars and other sources to use for the X-57 Mod IV vehicle; or 3. If no relevant certification rule, MoC, or method of compliance exists, highlight this omission and provide recommendations.

Herbert W Schlickenmaier↗

NASA NTRS2004

Toward Synthesis, Analysis, and Certification of Security Protocols

Implemented security protocols are basically pieces of software which are used to (a) authenticate the other communication partners, (b) establish a secure communication channel between them (using insecure communication media), and (c) transfer data between the communication partners in such a way that these data only available to the desired receiver, but not to anyone else. Such an implementation usually consists of the following components: the protocol-engine, which controls in which sequence the messages of the protocol are sent over the network, and which controls the assembly/disassembly and processing (e.g., decryption) of the data. the cryptographic routines to actually encrypt or decrypt the data (using given keys), and t,he interface to the operating system and to the application. For a correct working of such a security protocol, all of these components must work flawlessly. Many formal-methods based techniques for the analysis of a security protocols have been developed. They range from using specific logics (e.g.: BAN-logic [4], or higher order logics [12] to model checking [2] approaches. In each approach, the analysis tries to prove that no (or at least not a modeled intruder) can get access to secret data. Otherwise, a scenario illustrating the &tack may be produced. Despite the seeming simplicity of security protocols ("only" a few messages are sent between the protocol partners in order to ensure a secure communication), many flaws have been detected. Unfortunately, even a perfect protocol engine does not guarantee flawless working of a security protocol, as incidents show. Many break-ins and security vulnerabilities are caused by exploiting errors in the implementation of the protocol engine or the underlying operating system. Attacks using buffer-overflows are a very common class of such attacks. Errors in the implementation of exception or error handling can open up additional vulnerabilities. For example, on a website with a log-in screen: multiple tries with invalid passwords caused the expected error message (too many retries). but let the user nevertheless pass. Finally, security can be compromised by silly implementation bugs or design decisions. In a commercial VPN software, all calls to the encryption routines were incidentally replaced by stubs, probably during factory testing. The product worked nicely. and the error (an open VPN) would have gone undetected, if a team member had not inspected the low-level traffic out of curiosity. Also, the use secret proprietary encryption routines can backfire, because such algorithms often exhibit weaknesses which can be exploited easily (see e.g., DVD encoding). Summarizing, there is large number of possibilities to make errors which can compromise the security of a protocol. In today s world with short time-to-market and the use of security protocols in open and hostile networks for safety-critical applications (e.g., power or air-traffic control), such slips could lead to catastrophic situations. Thus, formal methods and automatic reasoning techniques should not be used just for the formal proof of absence of an attack, but they ought to be used to provide an end-to-end tool-supported framework for security software. With such an approach all required artifacts (code, documentation, test cases) , formal analyses, and reliable certification will be generated automatically, given a single, high level specification. By a combination of program synthesis, formal protocol analysis, certification; and proof-carrying code, this goal is within practical reach, since all the important technologies for such an approach actually exist and only need to be assembled in the right way.

Schumann, Johann↗

NASA NTRS1991

Methods for obtaining and reducing experimental droplet impingement data on arbitrary bodies

Experimental water droplet impingement data are used to validate particle trajectory computer codes used in the analysis and certification of aircraft de-icing/anti-icing systems. Water droplet impingement characteristics of aerodynamic surfaces are usually obtained from wind-tunnel dye tracer experiments. This paper presents a dye tracer method for measuring water droplet impingement characteristics on arbitrary geometries and a new data reduction method, based on laser reflectance measurements, for extracting impingement data. Extraction of impingement data has been a very time-consuming process in the past. The new data reduction method developed is at least an order of magnitude more efficient than the method previously used. The accuracy of the method is discussed and results obtained are presented.

Papadakis, Michael↗

NASA NTRS1999

Software Development Processes Applied to Computational Icing Simulation

The development of computational icing simulation methods is making the transition form the research to common place use in design and certification efforts. As such, standards of code management, design validation, and documentation must be adjusted to accommodate the increased expectations of the user community with respect to accuracy, reliability, capability, and usability. This paper discusses these concepts with regard to current and future icing simulation code development efforts as implemented by the Icing Branch of the NASA Lewis Research Center in collaboration with the NASA Lewis Engineering Design and Analysis Division. With the application of the techniques outlined in this paper, the LEWICE ice accretion code has become a more stable and reliable software product.

Levinson, Laurie H.↗

NASA NTRS2004

New Tool Released for Engine-Airframe Blade-Out Structural Simulations

Researchers at the NASA Glenn Research Center have enhanced a general-purpose finite element code, NASTRAN, for engine-airframe structural simulations during steady-state and transient operating conditions. For steady-state simulations, the code can predict critical operating speeds, natural modes of vibration, and forced response (e.g., cabin noise and component fatigue). The code can be used to perform static analysis to predict engine-airframe response and component stresses due to maneuver loads. For transient response, the simulation code can be used to predict response due to bladeoff events and subsequent engine shutdown and windmilling conditions. In addition, the code can be used as a pretest analysis tool to predict the results of the bladeout test required for FAA certification of new and derivative aircraft engines. Before the present analysis code was developed, all the major aircraft engine and airframe manufacturers in the United States and overseas were performing similar types of analyses to ensure the structural integrity of engine-airframe systems. Although there were many similarities among the analysis procedures, each manufacturer was developing and maintaining its own structural analysis capabilities independently. This situation led to high software development and maintenance costs, complications with manufacturers exchanging models and results, and limitations in predicting the structural response to the desired degree of accuracy. An industry-NASA team was formed to overcome these problems by developing a common analysis tool that would satisfy all the structural analysis needs of the industry and that would be available and supported by a commercial software vendor so that the team members would be relieved of maintenance and development responsibilities. Input from all the team members was used to ensure that everyone's requirements were satisfied and that the best technology was incorporated into the code. Furthermore, because the code would be distributed by a commercial software vendor, it would be more readily available to engine and airframe manufacturers, as well as to nonaircraft companies that did not previously have access to this capability.

Lawrence, Charles↗

DOE OSTI2022

Code of Record: DOE Standard Canister (DOESC)

The United States Department of Energy (DOE) Spent Nuclear Fuel (SNF) Packaging Demonstration seeks to develop and demonstrate the designs, technology, processes, and regulatory framework for packaging DOE SNF for road-ready dry storage (RRDS); and establish the processes that will be used in a future production facility. The Packaging Demonstration will utilize the DOE Standard Canister (DOESC) for packaging select DOE-managed SNF types for interim storage, transportation and disposal as part of RRDS. Placing DOE-managed SNF into RRDS is part of the strategic framework for SNF on the Idaho National Laboratory (INL) site. To comply with DOE, INL and Nuclear Regulatory Commission (NRC) requirements, this Code of Record establishes the American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (BPVC), Section III, Division 3 as the Code that will govern DOESC and internal support structure constructioni, with certain clarifications. This Code of Record establishes a rationale for proceeding without construction certification of the DOESC (i.e., “N-stamping) and the extent to which a Registered Professional Engineer is required for the DOE Spent Fuel Packaging Demonstration. Given the (i) standard industry practice to pursue independent licensure of commercial storage casks and transportation packages by the NRC in lieu of ASME certification and (ii) guidance provided by 10 CFR 830, DOESC construction activities need not be certified (i.e., “stamped”) to the ASME BPVC. However, additional quality assurance requirements will apply as outlined in this Code of Record.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗