Search NASA⌕ Search

SEARCH · Search NASA

Results for “CERTIFICATION”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 397 records · Page 22
All sourcesNASA NTRSDOE OSTI
NASA NTRS2006

Structural Analysis of the Right Rear Lug of American Airlines Flight 587

A detailed finite element analysis of the right rear lug of the American Airlines Flight 587 - Airbus A300-600R was performed as part of the National Transportation Safety Board s failure investigation of the accident that occurred on November 12, 2001. The loads experienced by the right rear lug are evaluated using global models of the vertical tail, local models near the right rear lug, and a global-local analysis procedure. The right rear lug was analyzed using two modeling approaches. In the first approach, solid-shell type modeling is used, and in the second approach, layered-shell type modeling is used. The solid-shell and the layered-shell modeling approaches were used in progressive failure analyses (PFA) to determine the load, mode, and location of failure in the right rear lug under loading representative of an Airbus certification test conducted in 1985 (the 1985-certification test). Both analyses were in excellent agreement with each other on the predicted failure loads, failure mode, and location of failure. The solid-shell type modeling was then used to analyze both a subcomponent test conducted by Airbus in 2003 (the 2003-subcomponent test) and the accident condition. Excellent agreement was observed between the analyses and the observed failures in both cases. The moment, Mx (moment about the fuselage longitudinal axis), has significant effect on the failure load of the lugs. Higher absolute values of Mx give lower failure loads. The predicted load, mode, and location of the failure of the 1985- certification test, 2003-subcomponent test, and the accident condition are in very good agreement. This agreement suggests that the 1985-certification and 2003-subcomponent tests represent the accident condition accurately. The failure mode of the right rear lug for the 1985-certification test, 2003-subcomponent test, and the accident load case is identified as a cleavage-type failure. For the accident case, the predicted failure load for the right rear lug from the PFA is greater than 1.98 times the limit load of the lugs.

Raju, Ivatury S.↗
NASA NTRS2002

NASA/Navy Benchmarking Exchange (NNBE). Volume 1. Interim Report. Navy Submarine Program Safety Assurance

The NASA/Navy Benchmarking Exchange (NNBE) was undertaken to identify practices and procedures and to share lessons learned in the Navy's submarine and NASA's human space flight programs. The NNBE focus is on safety and mission assurance policies, processes, accountability, and control measures. This report is an interim summary of activity conducted through October 2002, and it coincides with completion of the first phase of a two-phase fact-finding effort.In August 2002, a team was formed, co-chaired by senior representatives from the NASA Office of Safety and Mission Assurance and the NAVSEA 92Q Submarine Safety and Quality Assurance Division. The team closely examined the two elements of submarine safety (SUBSAFE) certification: (1) new design/construction (initial certification) and (2) maintenance and modernization (sustaining certification), with a focus on: (1) Management and Organization, (2) Safety Requirements (technical and administrative), (3) Implementation Processes, (4) Compliance Verification Processes, and (5) Certification Processes.

SUBSAFE PROGRAM↗
NASA NTRS1982

Full power level development of the Space Shuttle main engine

Development of the Space Shuttle main engine for nominal operation at full power level (109 percent rated power) is continuing in parallel with the successful flight testing of the Space Transportation System. Verification of changes made to the rated power level configuration currently being flown on the Orbiter Columbia is in progress and the certification testing of the full power level configuration has begun. The certification test plan includes the accumulation of 10,000 seconds on each of two engines by early 1983. Certification testing includes the simulation of nominal mission duty cycles as well as the two abort thrust profiles: abort to orbit and return to launch site. Several of the certification tests are conducted at 111 percent power to demonstrate additional safety margins. In addition to the flight test and development program results, future plans for life demonstration and engine uprating will be discussed.

Johnson, J. R.↗
NASA NTRS1994

On the use of the systems approach to certify advanced aviation technologies

The field of human factors is as varied and diverse as the human subject itself. But one of its most important applications is the facilitation of safety and efficiency in a particular working environment through the implementation of paradigms known about humans and their working relationship with machines and systems. During the period since World War II (which is often viewed as the birth of Human Factors) no area has been the subject of more human factors research than aviation. And in no time during that epoch is the influence of human factors more important, nor more imperative than it is today. As technology driven designs have been finding their way into the national airspace system (NAS), there has been growing concern within the aviation industry itself, the Federal Aviation Administration (FAA), and the general public for a means by which to certify complex systems and the advanced aviation technologies that will be responsible for transporting, directing, and maintaining our airborne travel. While it is widely agreed human factors certification is desirable, the philosophy that will underlie the approach is debatable. There are, in general, two different approaches to certification: (1) the top-down or systems approach; and, (2) the bottom-up or monadical approach. The top-down approach is characterized by the underlying assumption that certification can be best achieved by looking at the system as a whole, understanding its objectives and operating environment, then examining the constituent parts. In an aircraft cockpit, this would be accomplished by first examining what the aircraft is supposed to be (e.g., fighter, general aviation, passenger), identifying its operating environment (IFR, VMC, combat, etc.) and looking at the entire working system which includes the hardware, software, liveware and their interactions; then, evaluative measures can be applied to the subsystems (e.g., individual instruments, CRT displays, controls). The bottom-up approach is founded on the philosophy that the whole can be best served by first examining it constituent elements. This approach would perform the above certification completely antithetically, by looking at the individual parts and certifying good human factors applications to those parts under the basic assumption that the whole is equal to the sum of its parts.

Wise, Mark A.↗
NASA NTRS2002

The Design of a Remotely Operated Shutter (ROS) for Thermal Vacuum Testing

Space-flight hardware is required to meet specific outgassing criteria under vacuum conditions in order to reduce the risk of contaminating sensitive optics and spacecraft components. Under certain circumstances, it is desirable to measure the contamination levels that are being released from all surfaces of the test payload. This certification is often accomplished with a Total Outgassing Measurement (TOM) box. The TOM box has one 103.2 square centimeter (16 square inch) opening and one 4.84 square centimeter (0.75 square inches) opening. The larger opening allows contaminants to easily escape the box during the hardware bakeout phase. The smaller opening provides a limited conductance path for outgassed contaminants during the certification phase. A Thermoelectric Quartz Crystal Microbalance (TQCM) monitors the contamination levels inside the box to provide the total outgassing measurement. During transition from the bakeout phase to the certification phase, the TOM box is reconfigured to close the larger opening. For previous certifications, the vacuum chamber was returned to ambient conditions and the larger conductance port was closed manually. The ROS system eliminates the need to enter the chamber by remotely closing the large TOM box opening. Substantial schedule and cost savings are achieved through the use of this system. The ROS system consists of three main components; a shutter, a motion actuator, and an actuator controller. Each of these components was selected or designed to operate in an extreme-temperature and vacuum environment while providing a high level of reliability. Different types of motion actuators were considered for driving the shutter. Design parameters for the actuator included material properties, force capability, reliability, and cost.

Hale, Kathleen L.↗
NASA NTRS2003

Analysis of Near Simultaneous Jimsphere and AMPS High Resolution Wind Profiles

The high-resolution wind profile of the Automated Meteorological Profiling System (HRAMPS) is the proposed replacement for the Jimsphere measurement system used to support NASA Shuttle launches from the Eastern Test Range (ETR). Samples of twenty-six ETR near simultaneous Jimsphere and HRAMPS wind profiles were obtained for Shuttle program HRAMPS certification studies. Shuttle systems engineering certification is to ensure that spacecraft and launch vehicle systems performance and safety evaluations for each launch (derived from flight simulations with Jimsphere wind profile data bases) retain their validity when HRAMPS profiles are used on day-of-launch (DOL) in trajectory and loads simulations to support the commit-to-launch decision. This paper describes a statistical analysis of the near simultaneous profiles. In principle the differences between a Jimsphere profile and an HRAMPS profile should be attributed to tracking technology (radar versus GPS tracking of a Jimsphere flight element) and the method for derivation of wind vectors from the raw tracking data. In reality, it is not technically feasible to track the same Jimsphere balloon with the two systems. The aluminized Mylar surface of the standard Jimsphere flight element facilitates radar tracking, but it interferes with HRAMPS during simultaneous tracking. Suspending a radar reflector from an HRAMPS flight element (Jimsphere without aluminized coating) does not produce satisfactory Jimsphere profiles because of intermittent radar returns. Thus, differences between the Jimsphere and HRAMPS profiles are also attributed to differences in the trajectories of separate flight elements. Because of small sample size and a test period limited to one winter season, test measurements during extreme high winds aloft could not have been expected and did not occur. It is during the highest winds that the largest differences between Jimsphere and HRAMPS would occur because the distance between flight elements would be larger. Jimsphere radar tracking noise increases as a function of balloon displacement downrange. The Jimsphere data processing compensates for tracking signal/noise degradation by increasing the smoothing interval. The Jimsphere wind profile effective resolution is a function of downrange distance and altitude, whereas the effective resolution of the HRAMPS should be independent of those variables. The procedure used for editing Jimsphere spikes in Shuttle DOL profiles was not implemented for the Jimsphere profile measurements during the AMPS field tests. For this analysis a code was developed that essentially mimics DOL Jimsphere spike editing. Jimsphere profiles have somewhat more noise in the wavelength range less than 200m defined as the noise floor. No differences between Jimsphere and HRAMPS wind profile pairs have been found that would support denial of HRAMPS certification for application in Shuttle DOL applications. The reliability of the HRAMPS system, which is an important certification issue, is not addressed in this study.

Adelfang, S. I.↗
NASA NTRS2004

A Generic Software Safety Document Generator

Formal certification is based on the idea that a mathematical proof of some property of a piece of software can be regarded as a certificate of correctness which, in principle, can be subjected to external scrutiny. In practice, however, proofs themselves are unlikely to be of much interest to engineers. Nevertheless, it is possible to use the information obtained from a mathematical analysis of software to produce a detailed textual justification of correctness. In this paper, we describe an approach to generating textual explanations from automatically generated proofs of program safety, where the proofs are of compliance with an explicit safety policy that can be varied. Key to this is tracing proof obligations back to the program, and we describe a tool which implements this to certify code auto-generated by AutoBayes and AutoFilter, program synthesis systems under development at the NASA Ames Research Center. Our approach is a step towards combining formal certification with traditional certification methods.

Denney, Ewen↗
NASA NTRS2004

JDD, Inc. Database

JDD Inc, is a maintenance and custodial contracting company whose mission is to provide their clients in the private and government sectors "quality construction, construction management and cleaning services in the most efficient and cost effective manners, (JDD, Inc. Mission Statement)." This company provides facilities support for Fort Riley in Fo,rt Riley, Kansas and the NASA John H. Glenn Research Center at Lewis Field here in Cleveland, Ohio. JDD, Inc. is owned and operated by James Vaughn, who started as painter at NASA Glenn and has been working here for the past seventeen years. This summer I worked under Devan Anderson, who is the safety manager for JDD Inc. in the Logistics and Technical Information Division at Glenn Research Center The LTID provides all transportation, secretarial, security needs and contract management of these various services for the center. As a safety manager, my mentor provides Occupational Health and Safety Occupation (OSHA) compliance to all JDD, Inc. employees and handles all other issues (Environmental Protection Agency issues, workers compensation, safety and health training) involving to job safety. My summer assignment was not as considered "groundbreaking research" like many other summer interns have done in the past, but it is just as important and beneficial to JDD, Inc. I initially created a database using a Microsoft Excel program to classify and categorize data pertaining to numerous safety training certification courses instructed by our safety manager during the course of the fiscal year. This early portion of the database consisted of only data (training field index, employees who were present at these training courses and who was absent) from the training certification courses. Once I completed this phase of the database, I decided to expand the database and add as many dimensions to it as possible. Throughout the last seven weeks, I have been compiling more data from day to day operations and been adding the information to the database. It now consists of seven different categories of data (carpet cleaning, forms, NASA Event Schedules, training certifications, wall and vent cleaning, work schedules, and miscellaneous) . I also did some field inspecting with the supervisors around the site and was present at all of the training certification courses that have been scheduled since June 2004. My future outlook for the JDD, Inc. database is to have all of company s information from future contract proposals, weekly inventory, to employee timesheets all in this same database.

Miller, David A., Jr.↗
NASA NTRS2008

Certifying Auto-Generated Flight Code

Model-based design and automated code generation are being used increasingly at NASA. Many NASA projects now use MathWorks Simulink and Real-Time Workshop for at least some of their modeling and code development. However, there are substantial obstacles to more widespread adoption of code generators in safety-critical domains. Since code generators are typically not qualified, there is no guarantee that their output is correct, and consequently the generated code still needs to be fully tested and certified. Moreover, the regeneration of code can require complete recertification, which offsets many of the advantages of using a generator. Indeed, manual review of autocode can be more challenging than for hand-written code. Since the direct V&V of code generators is too laborious and complicated due to their complex (and often proprietary) nature, we have developed a generator plug-in to support the certification of the auto-generated code. Specifically, the AutoCert tool supports certification by formally verifying that the generated code is free of different safety violations, by constructing an independently verifiable certificate, and by explaining its analysis in a textual form suitable for code reviews. The generated documentation also contains substantial tracing information, allowing users to trace between model, code, documentation, and V&V artifacts. This enables missions to obtain assurance about the safety and reliability of the code without excessive manual V&V effort and, as a consequence, eases the acceptance of code generators in safety-critical contexts. The generation of explicit certificates and textual reports is particularly well-suited to supporting independent V&V. The primary contribution of this approach is the combination of human-friendly documentation with formal analysis. The key technical idea is to exploit the idiomatic nature of auto-generated code in order to automatically infer logical annotations. The annotation inference algorithm itself is generic, and parametrized with respect to a library of coding patterns that depend on the safety policies and the code generator. The patterns characterize the notions of definitions and uses that are specific to the given safety property. For example, for initialization safety, definitions correspond to variable initializations while uses are statements which read a variable, whereas for array bounds safety, definitions are the array declarations, while uses are statements which access an array variable. The inferred annotations are thus highly dependent on the actual program and the properties being proven. The annotations, themselves, need not be trusted, but are crucial to obtain the automatic formal verification of the safety properties without requiring access to the internals of the code generator. The approach has been applied to both in-house and commercial code generators, but is independent of the particular generator used. It is currently being adapted to flight code generated using MathWorks Real-Time Workshop, an automatic code generator that translates from Simulink/Stateflow models into embedded C code.

Denney, Ewen↗
NASA NTRS2009

Group Capability Model

The Group Capability Model (GCM) is a software tool that allows an organization, from first line management to senior executive, to monitor and track the health (capability) of various groups in performing their contractual obligations. GCM calculates a Group Capability Index (GCI) by comparing actual head counts, certifications, and/or skills within a group. The model can also be used to simulate the effects of employee usage, training, and attrition on the GCI. A universal tool and common method was required due to the high risk of losing skills necessary to complete the Space Shuttle Program and meet the needs of the Constellation Program. During this transition from one space vehicle to another, the uncertainty among the critical skilled workforce is high and attrition has the potential to be unmanageable. GCM allows managers to establish requirements for their group in the form of head counts, certification requirements, or skills requirements. GCM then calculates a Group Capability Index (GCI), where a score of 1 indicates that the group is at the appropriate level; anything less than 1 indicates a potential for improvement. This shows the health of a group, both currently and over time. GCM accepts as input head count, certification needs, critical needs, competency needs, and competency critical needs. In addition, team members are categorized by years of experience, percentage of contribution, ex-members and their skills, availability, function, and in-work requirements. Outputs are several reports, including actual vs. required head count, actual vs. required certificates, CGI change over time (by month), and more. The program stores historical data for summary and historical reporting, which is done via an Excel spreadsheet that is color-coded to show health statistics at a glance. GCM has provided the Shuttle Ground Processing team with a quantifiable, repeatable approach to assessing and managing the skills in their organization. They now have a common frame of reference across NASA/contractor lines to communicate and mitigate any critical skills concerns.

Olejarski, Michael↗
NASA NTRS2010

Space Shuttle Main Engine Liquid Air Insulation Redesign Lessons Learned

The Space Shuttle Main Engine Liquid Air Insulation redesign was required to prevent the reoccurance of the STS-111 High Pressure Speed Sensor In-Flight Anomaly. The STS-111 In-Flight Anomaly Failure Investigation Team's initial redesign of the High Pressure Fuel Turbopump Pump End Ball Bearing Liquid Air Insulation failed the certification test by producing Liquid Air. The certification test failure indicated not only the High Pressure Fuel Turbopump Liquid Air Insulation, but all other Space Shuttle Main Engine Liquid Air Insulation. This paper will document the original Space Shuttle Main Engine Liquid Air STS-111 In-Flight Anomaly investigation, the heritage Space Shuttle Main Engine Insulation certification testing faults, the techniques and instrumentation used to accurately test the Liquid Air Insulation systems on the Stennis Space Center SSME test stand, the analysis techniques used to identify the Liquid Air Insulation problem areas and the analytical verification of the redesign before entering certification testing, Trade study down selected to three potential design solutions, the results of the development testing which down selected the final Liquid Air Redesign are also documented within this paper.

Darrell Gaddy↗
NASA NTRS2011

Safe to Fly: Certifying COTS Hardware for Spaceflight

Providing hardware for the astronauts to use on board the Space Shuttle or International Space Station (ISS) involves a certification process that entails evaluating hardware safety, weighing risks, providing mitigation, and verifying requirements. Upon completion of this certification process, the hardware is deemed safe to fly. This process from start to finish can be completed as quickly as 1 week or can take several years in length depending on the complexity of the hardware and whether the item is a unique custom design. One area of cost and schedule savings that NASA implements is buying Commercial Off the Shelf (COTS) hardware and certifying it for human spaceflight as safe to fly. By utilizing commercial hardware, NASA saves time not having to develop, design and build the hardware from scratch, as well as a timesaving in the certification process. By utilizing COTS hardware, the current detailed certification process can be simplified which results in schedule savings. Cost savings is another important benefit of flying COTS hardware. Procuring COTS hardware for space use can be more economical than custom building the hardware. This paper will investigate the cost savings associated with certifying COTS hardware to NASA s standards rather than performing a custom build.

Fichuk, Jessica L.↗
NASA NTRS2011

International Space Station Payload Operations Integration

The Payload Operations Integrator (POINT) plays an integral part in the Certification of Flight Readiness process for the Mission Operations Laboratory and the Payload Operations Integration Function that supports International Space Station Payload operations. The POINTs operate in support of the POIF Payload Operations Manager to bring together and integrate the Certification of Flight Readiness inputs from various MOL teams through maintaining an open work tracking log. The POINTs create monthly metrics for current and future payloads that the Payload Operations Integration Function supports. With these tools, the POINTs assemble the Certification of Flight Readiness package before a given flight, stating that the Mission Operations Laboratory is prepared to support it. I have prepared metrics for Increment 29/30, maintained the Open Work Tracking Logs for Flights ULF6 (STS-134) and ULF7 (STS-135), and submitted the Mission Operations Laboratory Certification of Flight Readiness package for Flight 44P to the Mission Operations Directorate (MOD/OZ).

Fanske, Elizabeth Anne↗
NASA NTRS2012

SOFIA: Flying the Telescope

The primary focus of this paper is how the flight test team for the Stratospheric Observatory For Infrared Astronomy (SOFIA) re-cast an extensive developmental test program to meet key milestones while simultaneously ensuring safe certification of the airframe and delivery of an operationally relevant platform, ultimately saving the overall program from financial demise. Following a brief introduction to the observatory and what it is designed to do, SOFIAs planned developmental test program is summarized, including analysis and design philosophy, envelope expansion, model validation and airframe certification. How NASA used lessons learned from other aircraft that employed open cavities in flight is explained as well as how and why the chosen design was selected. The approach to aerodynamic analysis, including bare airframe testing, wind tunnel testing, computational fluid dynamics and finite element modeling proved absolutely critical. Despite a solid analytical foundation, many unknowns remained. History provides several examples of disastrous effects on both systems and flight safety if cavity design is not approached properly. For these reasons, an extensive test plan was developed to ensure a safe and thorough build-up for envelope expansion, airframe certification and early science missions. Unfortunately, as is often the case, because of chronic delays in overall program execution, severe schedule and funding pressures were present. If critical milestones were not met, domestic as well as international funding was in serious jeopardy, and the demise of the entire program loomed large. Concentrating on rigorous model validation, the test team challenged certification requirements, increased test efficiency and streamlined engineering analysis. This resulted in the safe reduction of test point count by 72%, meeting all program milestones and a platform that soundly satisfied all operational science requirements. Results from early science missions are shown and a proof of concept mission for which SOFIA was opportunely positioned is showcased. Success on this time-critical mission to observe a rare astronomical event proved the usefulness of an airborne observatory and the value in waiting for the capability provided by SOFIA. Finally, lessons learned in the test program are presented with emphasis on how lessons from previous aircraft and successful test programs were applied to SOFIA. Effective application of these lessons was crucial to the success of the SOFIA flight test program. SOFIA is an international cooperative program between NASA and the German Space Agency, DLR. It is a 2.5 meter (100-inch) telescope mounted in a Boeing 747SP aircraft used for astronomical observations at altitudes above 35,000 feet. SOFIA will accommodate a host of scientific instruments from the international science community and has a planned operational lifespan of more than 20 years.

Asher, Troy A.↗
NASA NTRS2013

NASA's Commercial Crew Program, the Next Step in U.S. Space Transportation

The Commercial Crew Program (CCP) is leading NASA's efforts to develop the next U.S. capability for crew transportation and rescue services to and from the International Space Station (ISS) by the middecade timeframe. The outcome of this capability is expected to stimulate and expand the U.S. space transportation industry. NASA is relying on its decades of human space flight experience to certify U.S. crewed vehicles to the ISS and is doing so in a two phase certification approach. NASA certification will cover all aspects of a crew transportation system, including: Development, test, evaluation, and verification. Program management and control. Flight readiness certification. Launch, landing, recovery, and mission operations. Sustaining engineering and maintenance/upgrades. To ensure NASA crew safety, NASA certification will validate technical and performance requirements, verify compliance with NASA requirements, validate that the crew transportation system operates in the appropriate environments, and quantify residual risks. The Commercial Crew Program will present progress to date and how it manages safety and reduces risk.

Mango, Edward J., Jr.↗
NASA NTRS2013

NASA's Commercial Crew Program, The Next Step in U.S. Space Transportation

The Commercial Crew Program (CCP) is leading NASA's efforts to develop the next U.S. capability for crew transportation and rescue services to and from the International Space Station (ISS) by the mid-decade timeframe. The outcome of this capability is expected to stimulate and expand the U.S. space transportation industry. NASA is relying on its decades of human space flight experience to certify U.S. crewed vehicles to the ISS and is doing so in a two phase certification approach. NASA Certification will cover all aspects of a crew transportation system, including development, test, evaluation, and verification; program management and control; flight readiness certification; launch, landing, recovery, and mission operations; sustaining engineering and maintenance/upgrades. To ensure NASA crew safety, NASA Certification will validate technical and performance requirements, verify compliance with NASA requirements, validate the crew transportation system operates in appropriate environments, and quantify residual risks.

Mango, Edward J.↗
NASA NTRS2016

Commercial Crew Program and the Safety Technical Review Board

The Commercial Crew Program (CCP) is unique to any other program office at NASA. After the agency suffered devastating budget cuts and the Shuttle Program retired, the U.S. gave up its human spaceflight capabilities. Since 2011 the U.S. has been dependent on Russia to transport American astronauts and cargo to the International Space Station (ISS) and back. NASA adapted and formed CCP, which gives private, domestic, aerospace companies unprecedented reign over America's next ride to space. The program began back in 2010 with 5 companies and is now in the final phase of certification with 2 commercial partners. The Commercial Crew Program is made up of 7 divisions, each working rigorously with the commercial providers to complete the certification phase. One of these 7 divisions is Systems Engineering and Integration (SE&I) which is partly comprised of the Safety Technical Review Board (STRB). The STRB is primarily concerned with mitigating improbable, but catastrophic hazards. It does this by identifying, managing, and tracking these hazards in reports. With the STRB being in SE&I, it significantly contributes to the overall certification of the partners' vehicles. After the partners receive agency certification approval, they will have the capability to provide the U.S. with a reliable, safe, and cost-effective means of human spaceflight and cargo transport to the ISS and back.

crew transportation system↗
NASA NTRS2017

Formal Methods Tool Qualification

Formal methods tools have been shown to be effective at finding defects in safety-critical digital systems including avionics systems. The publication of DO-178C and the accompanying formal methods supplement DO-333 allows applicants to obtain certification credit for the use of formal methods without providing justification for them as an alternative method. This project conducted an extensive study of existing formal methods tools, identifying obstacles to their qualification and proposing mitigations for those obstacles. Further, it interprets the qualification guidance for existing formal methods tools and provides case study examples for open source tools. This project also investigates the feasibility of verifying formal methods tools by generating proof certificates which capture proof of the formal methods tool's claim, which can be checked by an independent, proof certificate checking tool. Finally, the project investigates the feasibility of qualifying this proof certificate checker, in the DO-330 framework, in lieu of qualifying the model checker itself.

Wagner, Lucas G.↗