SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Recent collaborations between JPL’s Integrated Model Centric Engineering (IMCE) initiative and the Europa Clipper project have produced six distinct applications of MBSE. Most, but not all, of these have been successful. Here we describe all of the applications including benefits, challenges, and lessons learned.
Vacuum chamber design to support relevant environment In-Situ research and development.
Explore the source record for details and available documents.
Explore the source record for details and available documents.
In the late 1990s, proof-carrying code was able to produce machine-checkable safety proofs for machine-language programs even though (1) it was impractical to prove correctness properties of source programs and (2) it was impractical to prove correctness of compilers. But now it is practical to prove some correctness properties of source programs, and it is practical to prove correctness of optimizing compilers. We can produce more expressive proof-carrying code, that can guarantee correctness properties for machine code and not just safety. We will construct program logics for source languages, prove them sound w.r.t. the operational semantics of the input language for a proved-correct compiler, and then use these logics as a basis for proving the soundness of static analyses.
The general goal of this project was to improve the practicality of formal methods by combining techniques from model checking and theorem proving. At the time the project was proposed, the model checking and theorem proving communities were applying different tools to similar problems, but there was not much cross-fertilization. This project involved a group from SRI that had substantial experience in the development and application of theorem-proving technology, and a group at Stanford that specialized in model checking techniques. Now, over five years after the proposal was submitted, there are many research groups working on combining theorem-proving and model checking techniques, and much more communication between the model checking and theorem proving research communities. This project contributed significantly to this research trend. The research work under this project covered a variety of topics: new theory and algorithms; prototype tools; verification methodology; and applications to problems in particular domains.
Regression verification techniques are used to prove equivalence of syntactically similar programs. Checking equivalence of large programs, however, can be computationally expensive. Existing regression verification techniques rely on abstraction and decomposition techniques to reduce the computational effort of checking equivalence of the entire program. These techniques are sound but not complete. In this work, we propose a novel approach to improve scalability of regression verification by classifying the program behaviors generated during symbolic execution as either impacted or unimpacted. Our technique uses a combination of static analysis and symbolic execution to generate summaries of impacted program behaviors. The impact summaries are then checked for equivalence using an o-the-shelf decision procedure. We prove that our approach is both sound and complete for sequential programs, with respect to the depth bound of symbolic execution. Our evaluation on a set of sequential C artifacts shows that reducing the size of the summaries can help reduce the cost of software equivalence checking. Various reduction, abstraction, and compositional techniques have been developed to help scale software verification techniques to industrial-sized systems. Although such techniques have greatly increased the size and complexity of systems that can be checked, analysis of large software systems remains costly. Regression analysis techniques, e.g., regression testing [16], regression model checking [22], and regression verification [19], restrict the scope of the analysis by leveraging the differences between program versions. These techniques are based on the idea that if code is checked early in development, then subsequent versions can be checked against a prior (checked) version, leveraging the results of the previous analysis to reduce analysis cost of the current version. Regression verification addresses the problem of proving equivalence of closely related program versions [19]. These techniques compare two programs with a large degree of syntactic similarity to prove that portions of one program version are equivalent to the other. Regression verification can be used for guaranteeing backward compatibility, and for showing behavioral equivalence in programs with syntactic differences, e.g., when a program is refactored to improve its performance, maintainability, or readability. Existing regression verification techniques leverage similarities between program versions by using abstraction and decomposition techniques to improve scalability of the analysis [10, 12, 19]. The abstractions and decomposition in the these techniques, e.g., summaries of unchanged code [12] or semantically equivalent methods [19], compute an over-approximation of the program behaviors. The equivalence checking results of these techniques are sound but not complete-they may characterize programs as not functionally equivalent when, in fact, they are equivalent. In this work we describe a novel approach that leverages the impact of the differences between two programs for scaling regression verification. We partition program behaviors of each version into (a) behaviors impacted by the changes and (b) behaviors not impacted (unimpacted) by the changes. Only the impacted program behaviors are used during equivalence checking. We then prove that checking equivalence of the impacted program behaviors is equivalent to checking equivalence of all program behaviors for a given depth bound. In this work we use symbolic execution to generate the program behaviors and leverage control- and data-dependence information to facilitate the partitioning of program behaviors. The impacted program behaviors are termed as impact summaries. The dependence analyses that facilitate the generation of the impact summaries, we believe, could be used in conjunction with other abstraction and decomposition based approaches, [10, 12], as a complementary reduction technique. An evaluation of our regression verification technique shows that our approach is capable of leveraging similarities between program versions to reduce the size of the queries and the time required to check for logical equivalence. The main contributions of this work are: - A regression verification technique to generate impact summaries that can be checked for functional equivalence using an off-the-shelf decision procedure. - A proof that our approach is sound and complete with respect to the depth bound of symbolic execution. - An implementation of our technique using the LLVMcompiler infrastructure, the klee Symbolic Virtual Machine [4], and a variety of Satisfiability Modulo Theory (SMT) solvers, e.g., STP [7] and Z3 [6]. - An empirical evaluation on a set of C artifacts which shows that the use of impact summaries can reduce the cost of regression verification.
A characterization of the Laplace transform is developed which extends the transform to the Schwartz distributions. The class of distributions includes the impulse functions and other singular functions which occur as solutions to ordinary and partial differential equations. The standard theorems on analyticity, uniqueness, and invertibility of the transform are proved by using the characterization as the definition of the Laplace transform. The definition uses sequences of linear transformations on the space of distributions which extends the Laplace transform to another class of generalized functions, the Mikusinski operators. It is shown that the sequential definition of the transform is equivalent to Schwartz' extension of the ordinary Laplace transform to distributions but, in contrast to Schwartz' definition, does not use the distributional Fourier transform. Several theorems concerning the particular linear transformations used to define the Laplace transforms are proved. All the results proved in one dimension are extended to the n-dimensional case, but proofs are presented only for those situations that require methods different from their one-dimensional analogs.
The method of elementary solutions is employed to solve two coupled integrodifferential equations sufficient for determining temperature-density effects in a linearized BGK model in the kinetic theory of gases. Full-range completeness and orthogonality theorems are proved for the developed normal modes and the infinite-medium Green's function is constructed as an illustration of the full-range formalism. The appropriate homogeneous matrix Riemann problem is discussed, and half-range completeness and orthogonality theorems are proved for a certain subset of the normal modes. The required existence and uniqueness theorems relevant to the H matrix, basic to the half-range analysis, are proved, and an accurate and efficient computational method is discussed. The half-space temperature-slip problem is solved analytically, and a highly accurate value of the temperature-slip coefficient is reported.
Ground effects experiments and large/small-tunnel interference studies were carried out on a model with a 20-inch (50.8 cm) span wing. The wing, which includes a highly deflected knee-blown flap can be fitted with unflapped tips and slats. A low-mounted tailplane can be fitted to the aft fuselage. Three-component balance meaurements, made with a fixed ground equipped with a single boundary-layer blowing slot, were compared with datum, moving-ground results. Good comparisons were obtained up to model blowing momentum coefficients of approximately two, after which the particular floor blowing settings used proved insufficient to prevent floor separation in the vicinity of the model. Skin friction measurements, taken routinely along the floor centerline, proved invaluable during the analysis of results, and their use is recommended as input to determination of floor BLC setting. A careful investigation was made of pitching moments, including tail-on, close-to-ground cases, with favorable results. Drag proved the most sensitive to the change from a moving to the boundary-layer controlled ground.
The following strategy is suggested for specification and proof: (1) Defer the construction of a formal program specification with respect to I/O assertions unit the correctness of the program with respect to an abstract mathematical model of program intent is demonstrated. (2) Prove that an abstract machine (using infinite precision arithmetic) would compute that object exactly. (3) Prove that the computational sequences of arithmetic operations that occur in the abstract machine must be precisely the same at every step as those occurring on an actual machine (with finite precision arithmetic), executing the same program. (4) Use a Verification Conditions VC-generator that knows about the semantics of arithmetic operations to annotate the program with assertions that bound (or in some circumstances estimate) the difference between the actual machine state variables and the corresponding ones of the abstract machine. Construct the formal program specification by combining the verification conditions into theorems about computational error that can be proved with mechanical assistance.
Regularity estimates up to the boundary for solutions of elliptic systems of finite difference equations were proved. The regularity estimates, obtained for boundary fitted coordinate systems on domains with smooth boundary, involve discrete Sobolev norms and are proved using pseudo-difference operators to treat systems with variable coefficients. The elliptic systems of difference equations and the boundary conditions which are considered are very general in form. The regularity of a regular elliptic system of difference equations was proved equivalent to the nonexistence of eigensolutions. The regularity estimates obtained are analogous to those in the theory of elliptic systems of partial differential equations, and to the results of Gustafsson, Kreiss, and Sundstrom (1972) and others for hyperbolic difference equations.
The Airborne Imaging Spectrometer (AIS) samples a region which is strongly influenced by decreasing solar irradiance at longer wavelengths and strong atmospheric absorptions. Four techniques, the Log Residual, the Least Upper Bound Residual, the Flat Field Correction and calibration using field reflectance measurements were investigated as a means for removing these two features. Of the four techniques field reflectance calibration proved to be superior in terms of noise and normalization. Of the other three techniques, the Log Residual was superior when applied to areas which did not contain one dominant cover type. In heavily vegetated areas, the Log Residual proved to be ineffective. After removing anomalously bright data values, the Least Upper Bound Residual proved to be almost as effective as the Log Residual in sparsely vegetated areas and much more effective in heavily vegetated areas. Of all the techniques, the Flat Field Correction was the noisest.
A nonlinear kinetic equation is constructed and proved to be well-adapted to describe general multidimensional scalar conservation laws. In particular, it is proved to be well-posed uniformly in epsilon - the microscopic scale. It is also shown that the proposed kinetic equation is equipped with a family of kinetic entropy functions - analogous to Boltzmann's microscopic H-function, such that they recover Krushkov-type entropy inequality on the macroscopic scale. Finally, it is proved by both - BV compactness arguments in the one-dimensional case, that the local density of kinetic particles admits a continuum limit, as it converges strongly with epsilon below 0 to the unique entropy solution of the corresponding conservation law.
Pinsker and Ebert (1970) proved that in channels with additive Gaussian noise, feedback at most doubles the capacity. Cover and Pombra (1989) proved that feedback at most adds half a bit per transmission. Following their approach, the author proves that in the limit as signal power approaches either zero (very low SNR) or infinity (very high SNR), feedback does not increase the finite block-length capacity (which for nonstationary Gaussian channels replaces the standard notion of capacity that may not exist). Tighter upper bounds on the capacity are obtained in the process. Specializing these results to stationary channels, the author recovers some of the bounds recently obtained by Ozarow.
Aggregates were observed to form very suddenly in a lab-contained dust cloud, transforming (within seconds) an opaque monodispersed cloud into a clear volume containing rapidly-settling, long hair-like aggregates. The implications of such a "phase change" led to a series of experiments progressing from the lab, to KC-135, followed by micro-g flights on USML-1 and USML-2, and now EGM slated for Space Station. We attribute the sudden "collapse" of a cloud to the effect of dipoles. This has significant ramifications for all types of cloud systems, and additionally implicates dipoles in the processes of cohesion and adhesion of granular matter. Notably, there is the inference that like-charged grains need not necessarily repel if they are close enough together: attraction or repulsion depends on intergranular distance (the dipole being more powerful at short range), and the D/M ratio for each grain, where D is the dipole moment and M is the net charge. We discovered that these ideas about dipoles, the likely pervasiveness of them in granular material, the significance of the D/M ratio, and the idea of mixed charges on individual grains resulting from tribological processes --are not universally recognized in electrostatics, granular material studies, and aerosol science, despite some early seminal work in the literature, and despite commercial applications of dipoles in such modern uses as "Krazy Glue", housecleaning dust cloths, and photocopying. The overarching goal of EGM is to empirically prove that (triboelectrically) charged dielectric grains of material have dipole moments that provide an "always attractive" intergranular force as a result of both positive and negative charges residing on the surfaces of individual grains. Microgravity is required for this experiment because sand grains can be suspended as a cloud for protracted periods, the grains are free to rotate to express their electrostatic character, and Coulombic forces are unmasked. Suspended grains will be "interrogated" by applied electrical fields. In one module, grains will be immersed in an inhomogeneous electric field and allowed to be attracted towards or repelled from the central electrode of the module: part of the grain's speed will be a function of its net charge (monopole), part will be a function of the dipole. Observed grain position vs. time will provide a curve that can be deconvolved into the dipole and monopole forces responsible, since both have distinctive radial dependencies. In a second approach, the inhomogeneous field will be alternated at low frequency (e.g., every 5-10 seconds) so that the grains are alternately attracted and repelled from the center of the field. The resulting "zigzag" grain motion will gradually drift inwards, then suddenly change to a unidirectional inward path when a critical radial distance is encountered (a sort of "Coulombic event horizon") at which the dipole strength supersedes the monopole strength --thus proving the presence of a dipole, while also quantifying the D/M ratio. In a second module, an homogeneous electric field eliminates dipole effects (both Coulombic and induced) to provide calibration of the monopole and to more readily evaluate net charge statistical variance. In both modules, the e-fields will be exponentially step-ramped in voltage during the experiment, so that the field "nominalizes" grain speed while spreading the response time --effectively forcing each grain to "wait its turn" to be measured. In addition to rigorously quantifying M, D, and the D/M ratio for many hundreds of grains, the experiment will also observe gross electrometric and RF discharge phenomena associated with grain activity. The parameter space will encompass grain charging levels (via intentional triboelectrification), grain size, cloud density, and material type. Results will prove or disprove the dipole hypothesis. In either case, light will be shed on the role of electrostatic forces in governing granular systems. Knowledge so gained can be applied to natural clouds such as protostellar and protoplanetary dust and debris systems, planetary rings, planetary dust palls and aerosols created by volcanic, impact, aeolian, firestorm, or nuclear winter processes. The data are also directly applicable to adhesion, cohesion, transport, dispersion, and collection of granular materials in industrial, agricultural, pharmaceutical applications, and in fields as diverse as dust contamination of space suits on Mars and crop spraying on Earth.
Mishap investigations provide important information about adverse events and near miss incidents. They are intended to help avoid any recurrence of previous failures. Over time, they can also yield statistical information about incident frequencies that helps to detect patterns of failure and can validate risk assessments. However, the increasing complexity of many safety critical systems is posing new challenges for mishap analysis. Similarly, the recognition that many failures have complex, systemic causes has helped to widen the scope of many mishap investigations. These two factors have combined to pose new challenges for the analysis of adverse events. A new generation of formal and semi-formal techniques have been proposed to help investigators address these problems. We introduce the term mishap logics to collectively describe these notations that might be applied to support the analysis of mishaps. The proponents of these notations have argued that they can be used to formally prove that certain events created the necessary and sufficient causes for a mishap to occur. These proofs can be used to reduce the bias that is often perceived to effect the interpretation of adverse events. Others have argued that one cannot use logic formalisms to prove causes in the same way that one might prove propositions or theorems. Such mechanisms cannot accurately capture the wealth of inductive, deductive and statistical forms of inference that investigators must use in their analysis of adverse events. This paper provides an overview of these mishap logics. It also identifies several additional classes of logic that might also be used to support mishap analysis.