Results for “Design Information Verification” — Page 21

NASA NTRS2020

IV&V Assurance Case Design for Artemis II

As human-rated missions like those in NASA’s Artemis program continue to grow in both size and complexity, and the role of software in achieving mission objectives expands dramatically, NASA’s Independent Verification and Validation (IV&V) Teams face evolving challenges in assuring the safety and performance of the safety- and mission-critical embedded software that is essential to landing astronauts on the surface of the Moon by 2024. Key among these challenges is IV&V’s desire to present a cohesive, integrated assurance statement to its stakeholders that encapsulates and summarizes our assurance positions across the integrated Artemis systems and their combined role in support of a safe and successful flight. In order to meet this challenge, the IV&V Teams have begun a transition to using formal assurance case concepts and documentation in the Goal Structuring Notation (GSN) to build an argument in support of software assurance. IV&V recognizes significant benefits to the logical argumentation structure provided by assurance cases and GSN over our current practices for documenting and managing assurance claims. In order to reap these benefits, IV&V is integrating the use of assurance case concepts with our paradigm of follow-the-risk capability based assurance. Because of this, assurance cases created and used by IV&V are distinct from the sort of assurance case created by a development project or embedded software assurance organization. IV&V’s assurance cases depend much less upon standards and regulations, and more on evidence captured by IV&V regarding the environment, requirements, design, and implementation. IV&V constructs an independent network of claims based on an independent decomposition of arguments. Based upon the risk posture of these claims and their associated software and software artifacts, IV&V then develops and executes engineering analyses and testing, which provide evidence to either support or refute the claim. This emerging risk-informed assurance case methodology is being put into practice as IV&V plans for support of the Artemis II mission, the first flight of the Orion capsule and Space Launch System with astronauts on board.

Gerek Whitman↗

NASA NTRS2020

IV&V Assurance Case Design for Artemis II

As human-rated missions like those in NASA's Artemis program continue to grow in both size and complexity, and the role of software in achieving mission objectives expands dramatically, NASA's Independent Verification and Validation (IV&V) Teams face evolving challenges in assuring the safety and performance of the safety- and mission-critical embedded software that is essential to landing astronauts on the surface of the Moon by 2024. Key among these challenges is IV&V's desire to present a cohesive, integrated assurance statement to its stakeholders that encapsulates and summarizes our assurance positions across the integrated Artemis systems and their combined role in support of a safe and successful flight. In order to meet this challenge, the IV&V Teams have begun a transition to using formal assurance case concepts and documentation in the Goal Structuring Notation (GSN) to build an argument in support of software assurance. IV&V recognizes significant benefits to the logical argumentation structure provided by assurance cases and GSN over our current practices for documenting and managing assurance claims. In order to reap these benefits, IV&V is integrating the use of assurance case concepts with our paradigm of follow-the-risk capability based assurance. Because of this, assurance cases created and used by IV&V are distinct from the sort of assurance case created by a development project or embedded software assurance organization. IV&V's assurance cases depend much less upon standards and regulations, and more on evidence captured by IV&V regarding the environment, requirements, design, and implementation. IV&V constructs an independent network of claims based on an independent decomposition of arguments. Based upon the risk posture of these claims and their associated software and software artifacts, IV&V then develops and executes engineering analyses and testing, which provide evidence to either support or refute the claim. This emerging risk-informed assurance case methodology is being put into practice as IV&V plans for support of the Artemis II mission, the first flight of the Orion capsule and Space Launch System with astronauts on board.

Whitman, Gerek↗

NASA NTRSDate not supplied

From CMS to the U.S. Greenhouse Gas Center – Improved Tracking of Recent Changes in Co 2 and Ch 4 From NASA’s Quasi-Operational Modeling Systems

Reliable, low latency delivery of high quality global flux and concentration information is a growing but still unmet need to advance expanding measurement, monitoring, reporting, and verification efforts that underpin federal climate mitigation strategies. Here we present on progress toward developing space-based greenhouse gas (GHG) monitoring systems that can provide comprehensive information trailing real time by a matter of weeks to a few months. Through support from its Carbon Monitoring System (CMS) program, NASA has developed the capability to assimilate XCO 2 retrievals from the Orbiting Carbon Observatory, 2 (OCO 2 ) into the Goddard Earth Observing System (GEOS) Constituent Data Assimilation System (CoDAS) to create gap-filled, three-dimensional (3D) estimates of CO 2 mixing ratio. When observations are unavailable, concentration fields are further informed by observationally-informed bottom-up flux packages that incorporate remotely sensed fire, nighttime lights, and vegetation observations combined with estimates of atmospheric growth rate based on surface in situ data. The 3D nature of these datasets supports evaluation with independent aircraft data to improve confidence in satellite data, development of new regional modeling approaches, and quantification of the climate impacts of GHGs. The system has recently been expanded to assimilate XCH 4 from ESA’s TROPOspheric Monitoring Instrument (TROPOMI) instrument and is supported by companion efforts to improve delivery of estimates of bottom-up land and ocean fluxes. The quasi-operational GEOS-GHG system is contributing to the recently announced U.S. Greenhouse Gas Center (GHG Center) by delivering information on recent changes in CO 2 and CH 4 emissions and concentrations to support stakeholder and research communities. In this presentation, we provide an overview of the current system configured to support the GHG Center. We highlight examples of how this data contributes to broader NASA initiatives including the Earth Information Center, an innovative virtual and physical exhibit designed to show how NASA data helps the nation combat climate change. We conclude by discussing how innovations in CMS research can address remaining data gaps and modeling challenges to advance operational GHG monitoring in the future.

Lesley Ott↗

NASA NTRS1994

Simplifying operations with an uplink/downlink integration toolkit

The Operations Engineering Lab (OEL) at JPL has developed a simple, generic toolkit to integrate the uplink/downlink processes, (often called closing the loop), in JPL's Multimission Ground Data System. This toolkit provides capabilities for integrating telemetry verification points with predicted spacecraft commands and ground events in the Mission Sequence Of Events (SOE) document. In the JPL ground data system, the uplink processing functions and the downlink processing functions are separate subsystems that are not well integrated because of the nature of planetary missions with large one-way light times for spacecraft-to-ground communication. Our new closed-loop monitoring tool allows an analyst or mission controller to view and save uplink commands and ground events with their corresponding downlinked telemetry values regardless of the delay in downlink telemetry and without requiring real-time intervention by the user. An SOE document is a time-ordered list of all the planned ground and spacecraft events, including all commands, sequence loads, ground events, significant mission activities, spacecraft status, and resource allocations. The SOE document is generated by expansion and integration of spacecraft sequence files, ground station allocations, navigation files, and other ground event files. This SOE generation process has been automated within the OEL and includes a graphical, object-oriented SOE editor and real-time viewing tool running under X/Motif. The SOE toolkit was used as the framework for the integrated implementation. The SOE is used by flight engineers to coordinate their operations tasks, serving as a predict data set in ground operations and mission control. The closed-loop SOE toolkit allows simple, automated integration of predicted uplink events with correlated telemetry points in a single SOE document for on-screen viewing and archiving. It automatically interfaces with existing real-time or non real-time sources of information, to display actual values from the telemetry data stream. This toolkit was designed to greatly simplify the user's ability to access and view telemetry data, and also provide a means to view this data in the context of the commands and ground events that are used to interpret it. A closed-loop system can prove especially useful in small missions with limited resources requiring automated monitoring tools. This paper will discuss the toolkit implementation, including design trade-offs and future plans for enhancing the automated capabilities.

Murphy, Susan C.↗

NASA NTRSDate not supplied

Structural Dynamics Observations in Space Launch System Green Run Hot Fire Testing

The Space Launch System (SLS) Core Stage (CS) Thrust Vector Control (TVC) system is comprised of eight mechanical feedback Shuttle heritage Type III TVC actuators and four RS-25 engines, each attached to a Shuttle heritage gimbal block/bearing. Two actuators are used to move each engine in two planes perpendicular to one another (i.e., pitch and yaw). The TVC system design leverages hardware from the Space Shuttle program as well as new hardware designed specifically for the Core Stage. The Green Run Hot Fire (GRHF) of the SLS Core Stage provided a flight-like ground test environment for verification of integrated vehicle TVC performance. A TVC model coupled to a vehicle structural dynamic model has been developed previously and incrementally validated in subsystem tests and simulations. Still, some aspects of TVC performance in GRHF were not anticipated. The ensuing investigation demonstrated the need for well-instrumented test environments, various levels of modeling fidelity, test-representative structural models, and caution in reuse of legacy components. This paper is the sixth installment in a seven-paper series surveying the design, engineering, test validation, and flight performance of the Core Stage Thrust Vector Control system. It introduces the salient structural dynamic phenomena uncovered in ambient and hot fire testing. During the Green Run test campaign, a comparison of ambient and hot fire step responses showed a significant change in apparent damping due to the presence of friction, challenging long standing assumptions that friction could be neglected. Additionally, the characteristic response of the engine and thrust structure during GRHF proved to be more complex than anticipated, as evidenced by the available actuator, thrust structure, and engine measurements. While the string-potentiometer based test instrumentation was intended to allow for reconstruction of the engine angles along the two control axes, the geometric placement, location uncertainty, and responses in overlapping frequency spectra revealed additional phenomena requiring further analysis and post-processing. The observations from both modal and frequency response testing during the Green Run ambient and hot fire configurations led to Engine and Core Stage FEM (finite element model) updates. When evidence of unexpected engine motion was found in engine section accelerometer data, the authors pursued additional structural analysis leading to FEM updates associated with the TVC gimbal and thrust structure. Through collaboration between structures, TVC, and flight control disciplines, the test-informed models and root-cause analysis led to confident flight rationale for the first flight of the SLS launch vehicle.

Richard K. Moore↗

NASA NTRSDate not supplied

Structural Dynamics Observations in Space Launch System Green Run Hot Fire Testing

The Space Launch System (SLS) Core Stage (CS) Thrust Vector Control (TVC) system is comprised of eight mechanical feedback Shuttle heritage Type III TVC actuators and four RS-25 engines, each attached to a Shuttle heritage gimbal block/bearing. Two actuators are used to move each engine in two planes perpendicular to one another (i.e., pitch and yaw). The TVC system design leverages hardware from the Space Shuttle program as well as new hardware designed specifically for the Core Stage. The Green Run Hot Fire (GRHF) of the SLS Core Stage provided a flight-like ground test environment for verification of integrated vehicle TVC performance. A TVC model coupled to a vehicle structural dynamic model has been developed previously and incrementally validated in subsystem tests and simulations. Still, some aspects of TVC performance in GRHF were not anticipated. The ensuing investigation demonstrated the need for well-instrumented test environments, various levels of modeling fidelity, test-representative structural models, and caution in reuse of legacy components. This paper is the sixth installment in a seven-paper series surveying the design, engineering, test validation, and flight performance of the Core Stage Thrust Vector Control system. It introduces the salient structural dynamic phenomena uncovered in ambient and hot fire testing. During the Green Run test campaign, a comparison of ambient and hot fire step responses showed a significant change in apparent damping due to the presence of friction, challenging long standing assumptions that friction could be neglected. Additionally, the characteristic response of the engine and thrust structure during GRHF proved to be more complex than anticipated, as evidenced by the available actuator, thrust structure, and engine measurements. While the string-potentiometer based test instrumentation was intended to allow for reconstruction of the engine angles along the two control axes, the geometric placement, location uncertainty, and responses in overlapping frequency spectra revealed additional phenomena requiring further analysis and post-processing. The observations from both modal and frequency response testing during the Green Run ambient and hot fire configurations led to Engine and Core Stage FEM (finite element model) updates. When evidence of unexpected engine motion was found in engine section accelerometer data, the authors pursued additional structural analysis leading to FEM updates associated with the TVC gimbal and thrust structure. Through collaboration between structures, TVC, and flight control disciplines, the test-informed models and root-cause analysis led to confident flight rationale for the first flight of the SLS launch vehicle.

Richard Moore↗

NASA NTRS2017

Security Vulnerability Profiles of NASA Mission Software: Empirical Analysis of Security Related Bug Reports

NASA develops, runs, and maintains software systems for which security is of vital importance. Therefore, it is becoming an imperative to develop secure systems and extend the current software assurance capabilities to cover information assurance and cybersecurity concerns of NASA missions. The results presented in this report are based on the information provided in the issue tracking systems of one ground mission and one flight mission. The extracted data were used to create three datasets: Ground mission IVV issues, Flight mission IVV issues, and Flight mission Developers issues. In each dataset, we identified the software bugs that are security related and classified them in specific security classes. This information was then used to create the security vulnerability profiles (i.e., to determine how, why, where, and when the security vulnerabilities were introduced) and explore the existence of common trends. The main findings of our work include:- Code related security issues dominated both the Ground and Flight mission IVV security issues, with 95 and 92, respectively. Therefore, enforcing secure coding practices and verification and validation focused on coding errors would be cost effective ways to improve mission's security. (Flight mission Developers issues dataset did not contain data in the Issue Category.)- In both the Ground and Flight mission IVV issues datasets, the majority of security issues (i.e., 91 and 85, respectively) were introduced in the Implementation phase. In most cases, the phase in which the issues were found was the same as the phase in which they were introduced. The most security related issues of the Flight mission Developers issues dataset were found during Code Implementation, Build Integration, and Build Verification; the data on the phase in which these issues were introduced were not available for this dataset.- The location of security related issues, as the location of software issues in general, followed the Pareto principle. Specifically, for all three datasets, from 86 to 88 the security related issues were located in two to four subsystems.- The severity levels of most security issues were moderate, in all three datasets.- Out of 21 primary security classes, five dominated: Exception Management, Memory Access, Other, Risky Values, and Unused Entities. Together, these classes contributed from around 80 to 90 of all security issues in each dataset. This again proves the Pareto principle of uneven distribution of security issues, in this case across CWE classes, and supports the fact that addressing these dominant security classes provides the most cost efficient way to improve missions' security. The findings presented in this report uncovered the security vulnerability profiles and identified the common trends and dominant classes of security issues, which in turn can be used to select the most efficient secure design and coding best practices compiled by the part of the SARP project team associated with the NASA's Johnson Space Center. In addition, these findings provide valuable input to the NASA IVV initiative aimed at identification of the two 25 CWEs of ground and flight missions.

vulnerability↗

DOE OSTI2025

Analysis and optimization of seismic monitoring networks with Bayesian optimal experimental design

SUMMARY Monitoring networks increasingly aim to assimilate data from a large number of diverse sensors covering many sensing modalities. Bayesian optimal experimental design (OED) seeks to identify data, sensor configurations or experiments which can optimally reduce uncertainty and hence increase the performance of a monitoring network. Information theory guides OED by formulating the choice of experiment or sensor placement as an optimization problem that maximizes the expected information gain (EIG) about quantities of interest given prior knowledge and models of expected observation data. Therefore, within the context of seismo-acoustic monitoring, we can use Bayesian OED to configure sensor networks by choosing sensor locations, types and fidelity in order to improve our ability to identify and locate seismic sources. In this work, we develop the framework necessary to use Bayesian OED to optimize a sensor network’s ability to locate seismic events from arrival time data of detected seismic phases at the regional-scale. This framework requires five elements: (i) A likelihood function that describes the distribution of detection and traveltime data from the sensor network, (ii) A prior distribution that describes a priori belief about seismic events, (iii) A Bayesian solver that uses a prior and likelihood to identify the posterior distribution of seismic events given the data, (iv) An algorithm to compute EIG about seismic events over a data set of hypothetical prior events, (v) An optimizer that finds a sensor network which maximizes EIG. Once we have developed this framework, we explore many relevant questions to monitoring such as: how to trade off sensor fidelity and earth model uncertainty; how sensor types, number and locations influence uncertainty; and how prior models and constraints influence sensor placement.

58 GEOSCIENCES↗

DOE OSTI2023

Project: Corbomite - Product: ConsoleWorks REACT

TDi Technologies presents ConsoleWorks REACT, an advanced platform designed to tackle the complexities of cyber and operational risk assessment. This comprehensive solution goes beyond asset-focused approaches by considering the impact of both assets and people have on the security and operation of critical infrastructure, specifically targeting preventing gird mis-operation by evaluating real-time human interaction or commands with critical assets. The hypothesis suggests that by integrating the assessment of user commands into the overall risk assessment process, organizations can make more informed decisions, prioritize resources effectively, and respond promptly to potential threats. This hypothesis forms the basis for the development of a proactive and holistic risk management approach that is more comprehensive and context aware than traditional models which only look at assets, patch levels, configuration and threat intel by collecting that information off the network vs directly from the asset, human, and human interaction all in real-time. ConsoleWorks' unique man-in-the-middle architecture is a key feature that sets it apart in the cybersecurity landscape. This architecture enables the real-time observation, enforcement, and commands or interaction risk transparency of user interaction with critical infrastructure to be risk mitigated and audited as they are aggregated with device and human risk factors for a more comprehensive risk threat score across a device or group of devices. This architecture allows ConsoleWorks to act as a secure intermediary between users and critical assets, monitoring all interactions and ensuring that only authorized commands are sent to the asset to be executed. This not only enhances security but also provides a comprehensive audit trail of all user activities, contributing to compliance efforts and facilitating incident investigation and risk management. By integrating this unique architecture with our comprehensive risk assessment methodology, ConsoleWorks REACT provides a powerful solution for managing cyber and operational risks, enabling organizations to maintain a robust security posture and effectively mitigate potential threats. To that end, the primary objective of this project was to research and develop a robust solution that enables the energy industry to mitigate the risks associated with human actions that can compromise the security or operations of assets critical to energy delivery, generation, transmission and operation. ConsoleWorks REACT plays a pivotal role in achieving this goal by leveraging its unique capabilities to monitor and track all user activity. Through its Zero Trust approach, which emphasizes continuous verification, the platform ensures secure access to assets and serves as the centralized human response and notification platform for addressing cyber and operational issues.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2024

HERO CarbonSAFE Phase 2 Project in the Columbia River Basalt Group

The Hermiston, Oregon Basalt CarbonSAFE Phase II project (HERO CarbonSAFE) seeks to accelerate the deployment of commercial carbon dioxide (CO2) storage projects in basaltic rocks. Basalt CO2 storage has several advantages to conventional saline storage reservoirs including 1. The potential for rapid mineralization of CO2, 2. Associated decreases in pressure and CO2 migration risks, 3. Reduced long-term monitoring requirements with respect to plume tracking, 4. Widespread geographic distribution and, 5. Large storage potential due to thickness, porosity, and CO2 interactions with basalt. And for locations such as the Pacific Northwest, Hawaii, Iceland, India and Japan, basalts may offer the only economically feasible option for local CO2 storage. However, there are limited field-scale assessments of CO2 storage in basalt, and current carbon capture utilization and storage (CCUS) permitting and regulatory frameworks were developed for conventional saline reservoirs. HERO CarbonSAFE is designed to address research gaps and uncertainties associated with basalt storage. Specifically, the project will assess the feasibility of CO2 injection in the deep layered basalts, long-term storage (mineralization), practical approaches for large-scale implementation (50+ million metric tons of CO2 over 30 years), lithology-specific risks, and the technoeconomic potential for CO2 storage in basalts. The HERO CarbonSAFE project will assess feasibility of developing a commercial-scale (50+ million metric tons of CO2) geological storage complex within the Columbia River Basalt Group (CRBG), a layered continental flood basalt complex that underlies Calpine’s natural gas-fired Hermiston Power Project (HPP) in Hermiston, OR (Figure 1). Under this 2-year CarbonSAFE Phase II project, the HERO team will conduct a data acquisition campaign that includes drilling a stratigraphic well to a total depth of ~1,500 m into the thick layered basalts proximal to HPP. A comprehensive well logging and hydrologic testing program will be augmented with new core collected from flow zones and sealing units, and comprehensive laboratory testing to help refine the kinetic rates of mineralization. The newly acquired information will be integrated with existing data from regional wells to correlate basalt injection zone properties to develop storage hub/commercial-scale models. Using these models, the project team will evaluate injection scenarios to define the technical and economic potential for storing a minimum of 50 million metric tons of CO2 over a 30-year period, along with a robust sensitivity analysis on key parameters governing reservoir viability for sustainable injection over a commercial project lifetime. Specific technical objectives of HERO are: (1) assessing the reservoir response of a series of stacked layered reservoir flowtop sequences occurring in this area of the CRBG to commercial-scale injection volumes; (2) extending prior efforts by the project team to characterize the deep layered basalts encountered in regional studies, to leverage prior investments by U.S. Department of Energy’s (DOE) Carbon Storage program; (3) leveraging DOE’s mineralization characterization efforts to advance model parametrization for commercial scale injection of CO2 in basalts; (4) conducting risk assessments associated with scaling up to commercial storage hub injection goals, while validating DOE’s National Risk Assessment Partnership (NRAP) tools, to identify potential constraints that would prevent the CRBG from serving as a commercial-scale storage complex; (5) developing mitigation plans to address identified risks; (6) developing a commercial-scale injection and monitoring, verification and accounting (MVA) strategy; (7) utilizing computational models to define and minimize, if possible, the Area of Review (AoR) under Class VI regulations; and (8) developing a robust CO2 management strategy for CRBG that also considers a regional source/sink approach that is responsive to stakeholder needs and industrial demand. Specific institutional objectives are: (1) identifying and developing plans to mitigate the nontechnical challenges associated with the build-out of a commercial-scale storage complex within the CRBG with integrated CO2 sources; (2) implementing the community outreach plan; (3) conducting regulatory research, including a survey of issues related to pore space ownership, MVA and long-term assurance of mineralization-based storage, to support an eventual application for a UIC Class VI permit; (4) advancing the project’s plan for CO2 liability management; and (5) continuing to refine and update the project’s economic model. The final objective is the preparation of a comprehensive Site Characterization Plan that draws upon the technical and institutional feasibility assessments to prepare the project for future commercialization efforts.

58 GEOSCIENCES↗

NASA NTRS2008

Certifying Auto-Generated Flight Code

Model-based design and automated code generation are being used increasingly at NASA. Many NASA projects now use MathWorks Simulink and Real-Time Workshop for at least some of their modeling and code development. However, there are substantial obstacles to more widespread adoption of code generators in safety-critical domains. Since code generators are typically not qualified, there is no guarantee that their output is correct, and consequently the generated code still needs to be fully tested and certified. Moreover, the regeneration of code can require complete recertification, which offsets many of the advantages of using a generator. Indeed, manual review of autocode can be more challenging than for hand-written code. Since the direct V&V of code generators is too laborious and complicated due to their complex (and often proprietary) nature, we have developed a generator plug-in to support the certification of the auto-generated code. Specifically, the AutoCert tool supports certification by formally verifying that the generated code is free of different safety violations, by constructing an independently verifiable certificate, and by explaining its analysis in a textual form suitable for code reviews. The generated documentation also contains substantial tracing information, allowing users to trace between model, code, documentation, and V&V artifacts. This enables missions to obtain assurance about the safety and reliability of the code without excessive manual V&V effort and, as a consequence, eases the acceptance of code generators in safety-critical contexts. The generation of explicit certificates and textual reports is particularly well-suited to supporting independent V&V. The primary contribution of this approach is the combination of human-friendly documentation with formal analysis. The key technical idea is to exploit the idiomatic nature of auto-generated code in order to automatically infer logical annotations. The annotation inference algorithm itself is generic, and parametrized with respect to a library of coding patterns that depend on the safety policies and the code generator. The patterns characterize the notions of definitions and uses that are specific to the given safety property. For example, for initialization safety, definitions correspond to variable initializations while uses are statements which read a variable, whereas for array bounds safety, definitions are the array declarations, while uses are statements which access an array variable. The inferred annotations are thus highly dependent on the actual program and the properties being proven. The annotations, themselves, need not be trusted, but are crucial to obtain the automatic formal verification of the safety properties without requiring access to the internals of the code generator. The approach has been applied to both in-house and commercial code generators, but is independent of the particular generator used. It is currently being adapted to flight code generated using MathWorks Real-Time Workshop, an automatic code generator that translates from Simulink/Stateflow models into embedded C code.

Denney, Ewen↗

DOE OSTI2024

Bayesian Analysis of TRISO Fuel: Quantifying Model Inadequacy, Incorporating Lower-Length-Scale Effects, and Developing Parallel Active Learning Capabilities

The U.S. Department of Energy (DOE)’s Nuclear Energy Advanced Modeling and Simulation (NEAMS) program aims to develop predictive capabilities by applying computational methods to the analysis and design of advanced reactor and fuel-cycle systems. This program has been providing engineering-scale support for the continued development of BISON, a high-fidelity, high-resolution fuel performance tool. Fuel behavior in nuclear reactors is governed by a complex network of mechanisms that interact with various other physics aspects in the reactor system. Any model developed to represent fuel behavior will likely be idealized, resulting in uncertainties when comparing their predictions against the observed data. In Fiscal Year (FY)-23, we initiated the Uncertainty Quantification (UQ) work by using Bayesian methods to establish a level of model trustworthiness and further improve it, with a particular emphasis on TRI-Structural isOtropic (TRISO) nuclear fuel. This year, we further expanded on that UQ work by investigating an approach to quantifying model inadequacy and accounting for lower-length scale (LLS) effects in TRISO silver (Ag) release modeling. Furthermore, we are implementing parallel active learning capabilities to reduce the computational cost (i.e., required computational resources and elapsed time) of performing UQ. Specifically, we utilized The Kennedy O’Hagan framework for Bayesian uncertainty quantification (KOH) to account for model inadequacy in TRISO Ag release predictions made by BISON. The KOH framework represents an improvement over the standard Bayesian framework used in FY-23. Explicitly accounting for model inadequacy in the Bayesian framework helps establish the level of experimental noise uncertainty in the Advanced Gas Reactor (AGR) data. We compared the inverse UQ results obtained from both the standard Bayesian and KOH frameworks in light of the AGR-2/3/4 data, and also compared the predictive UQ results obtained from these two frameworks in light of the AGR-1 data. Next, we investigated the impact of considering LLS effects in the Ag release simulations. We developed an expanded database of LLS simulated effective diffusivities for Ag, covering a wide range of microstructures and temperatures. Using this database, we developed a framework for incorporating LLS effects into the engineering-scale Ag release UQ. We developed both parametric and non-parametric approaches for bridging the length scales. We then investigated the inverse UQ results in light of the AGR-2/3/4 data and the predictive UQ results in light of the AGR-1 data, and compared the LLS-informed approach and the Arrhenius equation, which does not include microstructure information. Finally, we discussed implementing parallel active learning capabilities in the Multiphysics Object Oriented Simulation Environment (MOOSE)/BISON to reduce the computational cost (i.e., computational resources and elapsed time) of Bayesian UQ. For verification purposes, we first tested these new capabil ities on a species interaction problem. We then demonstrated them on the TRISO Ag release application, showing that parallel active learning capabilities can enhance the accuracy of UQ while also substantially reducing the computational cost in comparison to the reference methods developed in FY-23.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

NASA NTRS2014

Alternative, Green Processes for the Precision Cleaning of Aerospace Hardware

Precision cleaning is necessary to ensure the proper functioning of aerospace hardware, particularly those systems that come in contact with liquid oxygen or hypergolic fuels. Components that have not been cleaned to the appropriate levels may experience problems ranging from impaired performance to catastrophic failure. Traditionally, this has been achieved using various halogenated solvents. However, as information on the toxicological and/or environmental impacts of each came to light, they were subsequently regulated out of use. The solvent currently used in Kennedy Space Center (KSC) precision cleaning operations is Vertrel MCA. Environmental sampling at KSC indicates that continued use of this or similar solvents may lead to high remediation costs that must be borne by the Program for years to come. In response to this problem, the Green Solvents Project seeks to develop state-of-the-art, green technologies designed to meet KSCs precision cleaning needs.Initially, 23 solvents were identified as potential replacements for the current Vertrel MCA-based process. Highly halogenated solvents were deliberately omitted since historical precedents indicate that as the long-term consequences of these solvents become known, they will eventually be regulated out of practical use, often with significant financial burdens for the user. Three solvent-less cleaning processes (plasma, supercritical carbon dioxide, and carbon dioxide snow) were also chosen since they produce essentially no waste stream. Next, experimental and analytical procedures were developed to compare the relative effectiveness of these solvents and technologies to the current KSC standard of Vertrel MCA. Individually numbered Swagelok fittings were used to represent the hardware in the cleaning process. First, the fittings were cleaned using Vertrel MCA in order to determine their true cleaned mass. Next, the fittings were dipped into stock solutions of five commonly encountered contaminants and were weighed again showing typical contaminant deposition levels of approximately 0.00300g per part. They were then cleaned by the solvent or process being tested and then weighed a third time which allowed for the calculation of the cleaning efficiency of the test solvent or process.Based on preliminary experiments, five solvents (ethanol, isopropanol, acetone, ethyl acetate, and tert-butyl acetate) were down selected for further testing. When coupled with ultrasonic agitation, these solvents removed hydrocarbon contaminants as well as Vertrel MCA and showed improved removal of perfluorinated greases. Supercritical carbon dioxide did an excellent job dissolving each of the five contaminants but did a poor job of removing Teflon particles found in the perfluorinated greases. Plasma cleaning efficiency was found to be dependent on which supply gas was used, exposure time, and gas pressure. Under optimized conditions it was found that breathing air, energized to the plasma phase, was able to remove nearly 100% of the contamination.These findings indicate that alternative cleaning methods are indeed able to achieve precision levels of cleanliness. Currently, our team is working with a commercial cleaning company to get independent verification of our results. We are also evaluating the technical and financial aspects of scaling these processes to a size capable of supporting the future cleaning needs of KSC.

Vertrel MCA↗

NASA NTRS2022

Recommendations on the Use of Commercial-Off-The-Shelf (COTS) Electrical, Electronic, and Electromechanical (EEE) Parts for NASA Missions - Phase II

This assessment had two Phases. Phase I captured NASA Centers’ current practices for commercial-off-the-shelf (COTS) Electrical, Electronic, and Electromechanical (EEE) parts 1 used in spaceflight systems and ground support equipment (available at https://ntrs.nasa.gov/citations/20205011579) [ref. 1]. The Phase II report provides guidance for selecting and using COTS parts in NASA missions. The approaches proposed in this report differ from current agency practices. This top-level executive summary touches on these new approaches for using COTS parts but does not provide the detailed information that is critical in understanding the rationale behind these new approaches. Readers will need to read the entire report to gain full understanding and effectively use the recommendations herein. NASA’s historical approach to selecting and applying parts has been to define certain parts, primarily specific classes of military specification (MIL-SPEC) parts, as “standard”, leaving all others, including COTS parts, as nonstandard. Standard parts typically are used without further testing (“use-as-is”). Nonstandard parts are subjected to initial screening and subsequent lot acceptance testing of representative samples from each procured lot per MIL-SPEC or similar requirements. Decades later, top-tier commercial part manufacturers have evolved significant manufacturing, statistical control, and technological improvements that can now provide parts as reliable or more reliable than MIL-SPEC parts, when used within their datasheet limits. Concurrently, the space science and exploration community’s needs demand technological advances unavailable with MIL-SPEC parts. This ongoing change necessitates using COTS parts for space missions. Properly selected COTS parts in appropriate applications can offer performance and supply availability advantages compared to MIL-SPEC parts. Their utility and demonstrated reliability result from large volumes and automated production and testing processes. However, careful review and a thorough understanding of their specifications (i.e., datasheet limitations) is needed, and verifying that manufacturer specifications and reliability meet space hardware application needs are necessary. This report recommends MIL-SPEC screening and non-radiation-related lot acceptance testing be reduced or eliminated in cases where evidence of sufficient quality and reliability exists for COTS parts. The extent of NASA's insight into COTS manufacturers and the amount and nature of the needed evidence will differ by mission and will likely be driven by a mission's resources and associated risk posture. To facilitate this goal, two new terminologies have been defined and described: “Industry Leading Parts Manufacturer (ILPM)” and “Established COTS parts.” An ILPM is a COTS manufacturer that produces high quality and reliable parts. Some parts produced by ILPMs, defined as Established COTS parts, do not need any additional MIL-SPEC or NASA screening and lot acceptance testing to be used in space applications. This report provides guidance for selecting, procuring, and applying COTS parts and for performing part-, board-, and system-level COTS parts verification. The recommendation to select Established COTS parts from ILPMs will assure those COTS parts will have comparable quality to corresponding MIL-SPEC parts. Selecting, applying, and verifying Established COTS parts from ILPMs requires a holistic team approach, engaging parts engineers, circuit designers, quality, reliability, and systems engineers, procurement specialists, radiation specialists, avionics leads, and program/project managers. A mission-specific approach tailored to a project’s Mission, Environment, Applications and Lifetime (MEAL) [ref. 2] requirements should be developed and approved by program/project managers. Any associated risks should be clearly identified, quantified, mitigated, and/or accepted. Different approaches are recommended according to program/project Risk Classes A, B, C, and D [ref. 3] and human-rated missions [ref. 4]: 1. Recommend Classes A and B and human-rated missions consider a “MIL-SPEC parts- based design” approach. ”MIL-SPEC parts-based design” approach is one in which most parts are MIL-SPEC parts and Established COTS parts from ILPMs are used only when an equivalent MIL-SPEC part does not meet functional or size, weight, and power (SWaP) or performance requirements, or is not available. 2. Recommend Classes D and Sub-D missions consider a “System of COTS” approach. “System of COTS” approach is one which most parts are Established COTS parts from ILPMs. 3. Recommend Class C missions determine which approach is the best for their projects; that is, use either a “MIL-SPEC parts-based design” approach, “System of COTS” approach, or a combined approach utilizing elements of both. This report intends to provide guidance in using COTS parts for NASA missions with risk classifications of A through D and human-rated missions; but it does not address the costs of using COTS parts. Costs of using COTS parts in different NASA mission classes can vary significantly even if the same parts are used in different risk postures, due to differing verification levels needed. The guidance does not distinguish between critical or non-critical systems, and a given project will need to apply the appropriate guidance based on their risk posture. The intended audience of this report are NASA personnel and commercial practitioners who support NASA’s spaceflight missions, including spaceflight program or project managers, parts engineers, parts manufacturers, radiation engineers, avionics engineers, system engineers, circuit design engineers, reliability engineers, safety and mission assurance (SMA) personnel, and parts procurement specialists. The NEPP Program will perform a pathfinder study to explore implementing the guidance in this NESC report. An ILPM verification process is not the same as conventional vendor qualification processes performed according to military standards and specifications. This NESC report intends to provide guidance in utilizing available parts data from ILPM manufacturers for parts assurance assessments needed for NASA missions. The report also captured the current practices from DoD and Federal Aviation Administration (FAA) in Section 10. Note each DoD and FAA report was provided by the corresponding agencies regarding their practices, which are independent from the NESC recommendations in the report.

Commercial-Off-The-Shelf↗

NASA NTRS2010

Gas Flow Detection System

This system provides a portable means to detect gas flow through a thin-walled tube without breaking into the tubing system. The flow detection system was specifically designed to detect flow through two parallel branches of a manifold with only one inlet and outlet, and is a means for verifying a space shuttle program requirement that saves time and reduces the risk of flight hardware damage compared to the current means of requirement verification. The prototype Purge Vent and Drain Window Cavity Conditioning System (PVD WCCS) Flow Detection System consists of a heater and a temperature-sensing thermistor attached to a piece of Velcro to be attached to each branch of a WCCS manifold for the duration of the requirement verification test. The heaters and thermistors are connected to a shielded cable and then to an electronics enclosure, which contains the power supplies, relays, and circuit board to provide power, signal conditioning, and control. The electronics enclosure is then connected to a commercial data acquisition box to provide analog to digital conversion as well as digital control. This data acquisition box is then connected to a commercial laptop running a custom application created using National Instruments LabVIEW. The operation of the PVD WCCS Flow Detection System consists of first attaching a heater/thermistor assembly to each of the two branches of one manifold while there is no flow through the manifold. Next, the software application running on the laptop is used to turn on the heaters and to monitor the manifold branch temperatures. When the system has reached thermal equilibrium, the software application s graphical user interface (GUI) will indicate that the branch temperatures are stable. The operator can then physically open the flow control valve to initiate the test flow of gaseous nitrogen (GN2) through the manifold. Next, the software user interface will be monitored for stable temperature indications when the system is again at thermal equilibrium with the test flow of GN2. The temperature drop of each branch from its "no flow" stable temperature peak to its stable "with flow" temperature will allow the operator to determine whether a minimum level of flow exists. An alternative operation has the operator turning on the software only long enough to record the ambient temperature of the tubing before turning on the heaters and initiating GN2 flow. The stable temperature of the heated tubing with GN2 flow is then compared with the ambient tubing temperature to determine if flow is present in each branch. To help quantify the level of flow in the manifolds, each branch will be bench calibrated to establish its thermal properties using the flow detection system and different flow rates. These calibration values can then be incorporated into the software application to provide more detailed flow rate information.

Moss, Thomas↗

DOE OSTI2025

Root genetics in the field to understand drought adaptation and carbon sequestration (Final Scientific/Technical Report)

For all crop plants, roots play a critical role in growth. Roots anchor the plants, and are the primary site of nutrient and water uptake. Roots are also the main source of C to soil in the form of root tissues and exudates, and thus greatly influence SOM stocks. To perform these functions, primary roots extend into soil, producing a network of branching roots of characteristic form, known as its root system architecture (RSA). RSA varies among species, and among varieties within a species that are adapted to different environments. Root traits are major targets for the second green revolution because of their potential to improve crop productivity, increase drought tolerance and nutrient acquisition, and increase C capture of soil. Improving the quality of roots in maize will be particularly valuable, since this crop is planted on over 92 million acres annually in the US. The future sustainability of agricultural systems relies on their ability to enhance soil organic matter (SOM) storage and reduce GHG emissions, while maintaining or enhancing productivity. This program had two components, Sensors and Models. For the first component, we designed and built a high-throughput phenotyping platform for root pulling of maize plants. This eliminated the physical labor of manually pulling up plants and reduced the number of personnel required down to one. The standardized pulling mechanism allowed recording force curves during the pulling process, providing additional information. We validated that the maximum force for pulling the root system was well-correlated with the root system mass and provided root crowns for further RSA analysis. These root crowns identified significant correlations with 2D root area and root depth, along with 3D root volume, total root length and number of root tips. We then used this system for field-based studies in maize on the genetics of root system architecture and its relation to nitrogen-use efficiency (NUE), including using lines relevant to the Corteva breeding program. Varieties were also evaluated at Corteva sites in the cornbelt and Danforth farm in Missouri, to establish responses across sites. From these studies we have identified genetic loci associated with root traits and created mutant lines for these loci and correlations of root traits with NUE. For the Models component, we worked to incorporate root and soil characteristics into the MEMS 2.0 soil and ecosystem biogeochemical model. Existing soil C models, such as Century, are unable to represent specific root trait interactions with the soil environment and therefore to accurately forecast the potential C sequestration benefits of root breeding under different climatic and soil type conditions. We have developed the MEMS 2.0 ecosystem biogeochemical model to improve quantification of farm-scale soil carbon and greenhouse gas emissions. The new knowledge and large datasets produced by this project will be used to develop and drive an innovative model capable of forecasting the impacts on soil C stocks and nutrient dynamics. An innovation was to use the empirical data from the field studies (in 1, above) to model genetic variation in nitrogen use efficiencies and soil C input. Our work demonstrated that maize root-derived C rapidly replaces existing soil C and after 3 years of continuous maize, up to 20% of soil organic C in the topsoil (0-15cm) and 3% in the subsoil (15-30cm) was contributed by maize. However, this contribution did not entirely represent a net increase. Root C contribution to soil was affected by maize genetics. We have analyzed soils derived from the CSU field trials for C and N stocks, in the different soil physical fractions represented by the MEMS model, using both physical fractionation with elemental analyses, and Fourier transformed infrared spectroscopy. Data will be used to link crop nitrogen use efficiencies with soil C sequestration and provide data to bridge the field trials with the model development, for verification of model predictions. The project had a number of successful outcomes: we have used the new phenotyping platform to identify new genetic loci that can enhance root phenotypes; we have partnered with multiple maize seed companies phenotype varieties in their breeding programs; we have developed the MEMS model that can help inform industry on the potential for carbon sequestration in the agricultural sector, and which is now available at the CSU Soil Carbon Solutions Center for use.

59 BASIC BIOLOGICAL SCIENCES↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek A Whitman↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek Whitman↗