Search NASA⌕ Search

SEARCH · Search NASA

Results for “requirement formalization”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5

Certification Concepts for AI/ML Systems

This presentation goes over some of the tools developed at NASA Ames in the Robust Software Engineering group for the assurance and certification of autonomous systems. The research themes presented include improving safety and risk assessment as early as possible in the lifecycle, elicitation and formalization of requirements to facilitate traceability throughout the lifecycle, especially when formal methods are used, algorithms, tools and techniques for the V&V of ML-enabled systems, advanced testing, use of runtime monitoring to ease use of untrusted components, and contribution to draft regulatory standards and assistance in producing and presenting certification evidences.

Autonomy↗

NASA Construction of Facilities Validation Processes - Total Building Commissioning (TBCx)

Key Atributes include: Total Quality Management (TQM) System that looks at all phases of a project. A team process that spans boundaries. A Commissioning Authority to lead the process. Commissioning requirements in contracts. Independent design review to verify compliance with Facility Project Requirements (FPR). Formal written Commissioning Plan with Documented Results. Functional performance testing (FPT) against the requirements document.

Hoover, Jay C.↗

Assessing Requirements Quality through Requirements Coverage

In model-based development, the development effort is centered around a formal description of the proposed software system the model. This model is derived from some high-level requirements describing the expected behavior of the software. For validation and verification purposes, this model can then be subjected to various types of analysis, for example, completeness and consistency analysis [6], model checking [3], theorem proving [1], and test-case generation [4, 7]. This development paradigm is making rapid inroads in certain industries, e.g., automotive, avionics, space applications, and medical technology. This shift towards model-based development naturally leads to changes in the verification and validation (V&V) process. The model validation problem determining that the model accurately captures the customer's high-level requirements has received little attention and the sufficiency of the validation activities has been largely determined through ad-hoc methods. Since the model serves as the central artifact, its correctness with respect to the users needs is absolutely crucial. In our investigation, we attempt to answer the following two questions with respect to validation (1) Are the requirements sufficiently defined for the system? and (2) How well does the model implement the behaviors specified by the requirements? The second question can be addressed using formal verification. Nevertheless, the size and complexity of many industrial systems make formal verification infeasible even if we have a formal model and formalized requirements. Thus, presently, there is no objective way of answering these two questions. To this end, we propose an approach based on testing that, when given a set of formal requirements, explores the relationship between requirements-based structural test-adequacy coverage and model-based structural test-adequacy coverage. The proposed technique uses requirements coverage metrics defined in [9] on formal high-level software requirements and existing model coverage metrics such as the Modified Condition and Decision Coverage (MC/DC) used when testing highly critical software in the avionics industry [8]. Our work is related to Chockler et al. [2], but we base our work on traditional testing techniques as opposed to verification techniques.

Rajan, Ajitha↗

Systems, methods and apparatus for implementation of formal specifications derived from informal requirements

Systems, methods and apparatus are provided through which in some embodiments an informal specification is translated without human intervention into a formal specification. In some embodiments the formal specification is a process-based specification. In some embodiments, the formal specification is translated into a high-level computer programming language which is further compiled into a set of executable computer instructions.

Hinchey, Michael G.↗

Qualification of SAS4A/SASSYS-1 for Sodium-Cooled Fast Reactor Authorization and Licensing (Final CRADA Report)

This project focuses on assessment and qualification of the SAS4A/SASSYS-1 advanced reactor safety analysis code and its capacity to fulfill requirements associated with license/authorization of a sodium-cooled fast reactor (SFR). Specific objectives of this proposal include: development of a formal documentation requirements matrix that complies with a vendor’s NQA-1 program to identify needs for qualification documentation; completion of software methods qualification gap analysis to identify and close gaps in the verification and validation basis of the software; generation of an Acceptance Test Report to confirm compliance with the software requirements specification; and closure of gaps in Software Design Description (SDD) to assist with the eventual generation of a Modeling Licensing Topic Report (LTR).

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

Developing Formal Correctness Properties from Natural Language Requirements

This viewgraph presentation reviews the rationale of the program to transform natural language specifications into formal notation.Specifically, automate generation of Linear Temporal Logic (LTL)correctness properties from natural language temporal specifications. There are several reasons for this approach (1) Model-based techniques becoming more widely accepted, (2) Analytical verification techniques (e.g., model checking, theorem proving) significantly more effective at detecting types of specification design errors (e.g., race conditions, deadlock) than manual inspection, (3) Many requirements still written in natural language, which results in a high learning curve for specification languages, associated tools and increased schedule and budget pressure on projects reduce training opportunities for engineers, and (4) Formulation of correctness properties for system models can be a difficult problem. This has relevance to NASA in that it would simplify development of formal correctness properties, lead to more widespread use of model-based specification, design techniques, assist in earlier identification of defects and reduce residual defect content for space mission software systems. The presentation also discusses: potential applications, accomplishments and/or technological transfer potential and the next steps.

requirements engineering↗

Wood-to-Fuel Demonstration Project for California's Transportation Sector using Autothermal Pyrolysis (Non-Proprietary Summary Process Hazard Assessment)

Frontline has prioritized personnel safety, equipment preservation, and environmental protection throughout the design process of the autothermal pyrolysis unit. To facilitate a safe design, Frontline completed an informal hazards and operability (HAZOP) study and a formal HAZOP study, and employ management of change procedures. The result of these safety procedures is a plant that will function in a safe manner with a limited and acceptable amount of risk. Frontline took an approach it used in previous projects to execute a preliminary, internally facilitated hazards and operability (HAZOP) study. While this HAZOP study was performed without any subsequent change tracking, it enables a group of well-trained engineers to consider the safety implications of each part of the plant in a thorough and methodical manner. Frontline chose to bring in a pyrolysis consultant (Daren Daugaard of Burning Oak Energy) to participate in the review. Following the preliminary HAZOP and once the detailed design work was nearing completion, Frontline performed a formal HAZOP with a third-party facilitator, Jason Stittleburg of Novetus Engineering. Although the plant is not subject to process safety management (PSM) requirements, this formal HAZOP was performed in accordance with OSHA regulations deemed reasonable for PSM. Finally, after the formal HAZOP was conducted, Frontline maintained a safe system by implementing and following management of change procedures on each substantial change to the process. Frontline has kept a record of each subsequent change made to the formal HAZOP P&IDs. The process hazard assessment process allowed Frontline to find and correct several unacceptable configurations within the plant.

09 BIOMASS FUELS↗

Developmental problems and their solution for the Space Shuttle main engine alternate liquid oxygen high-pressure turbopump: Anomaly or failure investigation the key

The Space Shuttle main engine (SSME) alternate high-pressure liquid oxygen pump experienced synchronous vibration and ball bearing life problems that were program threatening. The success of the program hinged on the ability to solve these development problems. The design and solutions to these problems are engirded in the lessons learned and experiences from prior programs, technology programs, and the ability to properly conduct failure or anomaly investigations. The failure investigation determines the problem cause and is the basis for recommending design solutions. For a complex problem, a comprehensive solution requires that formal investigation procedures be used, including fault trees, resolution logic, and action items worked through a concurrent engineering-multidiscipline team. The normal tendency to use an intuitive, cut-and-try approach will usually prove to be costly, both in money and time and will reach a less than optimum, poorly understood answer. The SSME alternate high-pressure oxidizer turbopump development has had two complex problems critical to program success: (1) high synchronous vibrations and (2) excessive ball bearing wear. This paper will use these two problems as examples of this formal failure investigation approach. The results of the team's investigation provides insight into the complexity of the turbomachinery technical discipline interacting/sensitivities and the fine balance of competing investigations required to solve problems and guarantee program success. It is very important to the solution process that maximum use be made of the resources that both the contractor and Government can bring to the problem in a supporting and noncompeting way. There is no place for the not-invented-here attitude. The resources include, but are not limited to: (1) specially skilled professionals; (2) supporting technologies; (3) computational codes and capabilities; and (4) test and manufacturing facilities.

Ryan, R.↗

An introduction to requirements capture using PVS: Specification of a simple autopilot

This paper presents an introduction to capturing software requirements in the PVS formal language. The object of study is a simplified digital autopilot that was motivated in part by the mode control panel of NASA Langley's Boeing 737 research aircraft. The paper first presents the requirements for this autopilot in English and then steps the reader through a translation of these requirements into formal mathematics. Along the way deficiencies in the English specification are noted and repaired. Once completed, the formal PVS requirement is analyzed using the PVS theorem prover and shown to maintain an invariant over its state space.

Butler, Ricky W.↗

Commercial Low-Earth Orbit Destination (CLD) Concept of Operations

This concept of operations describes: - High-level Government goals, objectives, and needs for the CLD program, vehicle(s), and missions, - Strategies, policies, and processes for developing, certifying, maintaining, using, and retiring CLDs in the context of Government use, and - Government and CLD partner roles, responsibilities, and interactions during various phases of Government CLD operations. The intent of this document is to describe the overall high-level concept of how the end-to-end CLD service will be used to convey the nature and scope of services the Government intends to procure from the CLD partner. It will provide insight into NASA’s concepts for CLD operations rather than to provide mature, explicit, or complete requirements. It addresses how the concept of operations will be used to meet NASA expectations from an operational perspective to facilitate an understanding of the end-to-end CLD service needs, goals, and objectives (NGOs). Formal CLD requirements and standards are detailed in the NASA Commercial LEO Development Program’s (CLDP) various requirements, interface, process, and standards documents, as well as the contractual Statements of Work (SOW) and Data Requirement Deliverables (DRD). As such, the Concept of Operations can use terms such as “should” or “may” or “expects to” since it is not a contractual requirements document. It exists solely to convey the initial nature and type of services the Government intends to procure and is not, per se, a requirements document.

Operations↗

Let’s speak FRETish

FRET (https://github.com/NASA-SW-VnV/fret [github.com]) is a framework for the elicitation, formalization and analysis of requirements. FRET allows its user to enter requirements in a structured natural language called FRETish. Requirements written in FRETish are assigned unambiguous semantics. FRET supports its users in understanding this semantics and repairing requirements if applicable, by utilizing a variety of forms for each requirement: natural language description, formal mathematical logics, diagrams, and interactive simulation. FRET exports requirements into forms that can be used by a variety of analysis tools, including state-of-the-art model checkers and runtime monitoring tools. The talk will cover some of the theory behind the framework, present case studies from the aerospace and robotics domains, as well as current work on extending FRET for specifying requirements for software that learns.

FRET↗

Monitoring ICAROUS: From Requirements to Autonomous Flight

The Independent Configurable Architecture for Reliable Operations of Unmanned Systems (ICAROUS) is a software architecture incorporating a set of algorithms to enable autonomous operations of unmanned aircraft applications. This paper provides an overview of Monitoring ICAROUS, a project whose objective is to provide a formal approach to generating runtime monitors for autonomous systems from requirements written in a structured natural language. This approach integrates FRET, a formal requirement elicitation and authoring tool, and Copilot, a runtime verification framework. FRET is used to specify formal requirements in structured natural language. These requirements are translated into temporal logic formulae. Copilot is then used to generate executable runtime monitors from these temporal logic specifications. The generated monitors are directly integrated into ICAROUS to perform runtime verification during flight.

Formal Methods↗

From Requirements to Autonomous Flight: An Overview of the Monitoring ICAROUS Project

The Independent Configurable Architecture for Reliable Operations of Unmanned Systems(ICAROUS) is a software architecture incorporating a set of algorithms to enable autonomous operations of unmanned aircraft applications. This paper provides an overview of Monitoring ICAROUS, a project whose objective is to provide a formal approach to generating runtime monitors for autonomous systems from requirements written in a structured natural language. This approach integrates FRET, a formal requirement elicitation and authoring tool, and Copilot, a runtime verification framework. FRET is used to specify formal requirements in structured natural language. These requirements are translated into temporal logic formulae. Copilot is then used to generate executable runtime monitors from these temporal logic specifications. The generated monitors are directly integrated into ICAROUS to perform runtime verification during flight.

Formal Methods↗

Design verification of SIFT

A SIFT reliable aircraft control computer system, designed to meet the ultrahigh reliability required for safety critical flight control applications by use of processor replications and voting, was constructed for SRI, and delivered to NASA Langley for evaluation in the AIRLAB. To increase confidence in the reliability projections for SIFT, produced by a Markov reliability model, SRI constructed a formal specification, defining the meaning of reliability in the context of flight control. A further series of specifications defined, in increasing detail, the design of SIFT down to pre- and post-conditions on Pascal code procedures. Mechanically checked mathematical proofs were constructed to demonstrate that the more detailed design specifications for SIFT do indeed imply the formal reliability requirement. An additional specification defined some of the assumptions made about SIFT by the Markov model, and further proofs were constructed to show that these assumptions, as expressed by that specification, did indeed follow from the more detailed design specifications for SIFT. This report provides an outline of the methodology used for this hierarchical specification and proof, and describes the various specifications and proofs performed.

Moser, Louise↗

Capturing and Analyzing Requirements with FRET

FRET is an open source tool, developed at NASA Ames, for writing, understanding, formalizing, and analyzing requirements. In practice, requirements are typically written in natural language, which is ambiguous and consequently not amenable to formal analysis. Since formal, mathematical notations are unintuitive, requirements in FRET are entered in a restricted, natural language, called FRETish with precise unambiguous meaning. FRET helps users write FRETish requirements both by providing grammar information and examples during editing, but also through English and diagrammatic explanations to clarify subtle semantic issues. For each requirement, FRET automatically produces formalizations and supports interactive simulation of produced formalizations to ensure that they capture user intentions. Through its analysis portal, FRET connects to analysis tools by exporting verification code. Currently FRET connects to (1) the CoCoSim automated analysis tool for the verification of Simulink and Stateflow models, and (2) the Copilot runtime monitoring tool for the analysis of C programs. FRET also supports the consistency/realizability analysis of requirements for identifying conflicting requirements. In this tutorial, we introduce FRET and learn to speak and analyze FRETish through several examples.

FRET↗

A method of hardware qualification for flight by analyses, similarity and integrated testing

The results are described of a study on four pieces of flight hardware from the Saturn 1U and S-4B stages to determine whether the objectives of the formal qualification tests on that hardware could have been obtained within that program by methods other than performing the qualification tests. These methods include qualification by analyses, similarity and integrated testing, i.e., distribution of the objectives among the other tests in the program. It was found that it is feasible to delete the requirements for formal qualification testing provided that it is accomplished early in the program to allow adequate planning for accomplishing the qualification objectives by other means. Additionally, a scorekeeping system was defined that is simple, straightforward, easy to implement. This scorekeeping system provides complete visibility of equivalent qualification status at any point during the program. A set of groundrules for implementing this study was established as a result of findings on the specific items of hardware studied.

Andriulli, J. B.↗