Search NASASearch

SEARCH · Search NASA

Results for “runtime verification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

89 records · Page 5

Experimental Evaluation of Verification and Validation Tools on Martian Rover Software

We report on a study to determine the maturity of different verification and validation technologies (V&V) on a representative example of NASA flight software. The study consisted of a controlled experiment where three technologies (static analysis, runtime analysis and model checking) were compared to traditional testing with respect to their ability to find seeded errors in a prototype Mars Rover. What makes this study unique is that it is the first (to the best of our knowledge) to do a controlled experiment to compare formal methods based tools to testing on a realistic industrial-size example where the emphasis was on collecting as much data on the performance of the tools and the participants as possible. The paper includes a description of the Rover code that was analyzed, the tools used as well as a detailed description of the experimental setup and the results. Due to the complexity of setting up the experiment, our results can not be generalized, but we believe it can still serve as a valuable point of reference for future studies of this kind. It did confirm the belief we had that advanced tools can outperform testing when trying to locate concurrency errors. Furthermore the results of the experiment inspired a novel framework for testing the next generation of the Rover.

Brat, Guillaume

Runtime Assurance Protection for Advanced Turbofan Engine Control

This paper describes technical progress made in the application of run time assurance (RTA) methods to turbofan engines with advanced propulsion control algorithms that are employed to improve engine performance. It is assumed that the advanced algorithms cannot be fully certified using current verification and validation approaches and therefore need to be continually monitored by an RTA system that ensures safe operation. However, current turbofan engine control systems utilize engine protection logic for safe combustion dynamics and stable airflow through the engine. It was determined that the engine protection logic should continue to be used to provide system safety and should be considered as a part of the overall RTA system. The additional function that an RTA system provides is to perform diagnostics on anomalous conditions to determine if these conditions are being caused by errors in the advanced controller. If this is the case, the RTA system switches operation to a trusted reversionary controller. Initial studies were performed to demonstrate this benefit. The other focus was to improve the performance of the engine protection logic, which was deemed too conservative and reduced engine performance during transient operations. It was determined that the conservative response was due to poor tuning of one of the controller channels within the protection logic. An automatic tuning algorithm was implemented to optimize the protection logic control gains based on minimizing tracking error. Improved tracking responses were observed with no change to the existing protection logic control architecture.

runtime monitoring

Advanced Software V&V for Civil Aviation and Autonomy

With the advances in high-computing platform (e.g., advanced graphical processing units or multi-core processors), computationally-intensive software techniques such as the ones used in artificial intelligence or formal methods have provided us with an opportunity to further increase safety in the aviation industry. Some of these techniques have facilitated building safety at design time, like in aircraft engines or software verification and validation, and others can introduce safety benefits during operations as long as we adapt our processes. In this talk, I will present how NASA is taking advantage of these new software techniques to build in safety at design time through advanced software verification and validation, which can be applied earlier and earlier in the design life cycle and thus help also reduce the cost of aviation assurance. I will then show how run-time techniques (such as runtime assurance or data analytics) offer us a chance to catch even more complex problems, even in the face of changing and unpredictable environments. These new techniques will be extremely useful as our aviation systems become more complex and more autonomous.

software assurance

Even Higher-Level Synthesis: An Exploration of AI Hardware Accelerators using HLS4ML

With the rise of artificial intelligence, the popularization of deep learning, and a constantly evolving industry, the demand for flexible and efficient tools has never been greater. As algorithms grow more complex, their runtime and energy consumption increase exponentially. Customized hardware accelerators, long used for specific mathematical operations, remain essential for managing modern applications' computational and power demands. Hardware accelerators can speed up complex computations by orders of magnitude, but their manual design and verification processes are often challenging and time-consuming. High-Level Synthesis (HLS) provides a solution by transforming high-level algorithm descriptions, typically written in C++ or SystemC, into synthesizable RTL suitable for hardware implementation. This approach reduces development time for RTL engineers while offering flexibility beyond what traditional handwritten RTL can provide. We extended this capability to the machine-learning domain with the open-source framework hls4ml, which allows neural networks trained in Python frameworks like Tensorflow or PyTorch to be synthesized into efficient hardware representations for the traditional FPGA and ASIC flows. This breakthrough addresses the growing need for reduced design turnaround and easy verification of ML hardware accelerators with low latency and power efficiency constraints. During this tutorial, we will demonstrate how Python complements HLS by simplifying the ML design process, bridging the gap between software and hardware development. Attendees will explore how we translate neural networks modeled in Python into fixed-point C++ models suitable for HLS workflows. We will dive into strategies like Value-Range Analysis and Quantization-Aware Training, which optimize these designs for deployment and evaluate their accuracy, power consumption, and energy efficiency. To exemplify these concepts, experts from Fermilab will share their experiences applying this technology to high-energy physics experiments, where real-time, low-latency processing is critical. Over the years, Fermilab engineers have demonstrated how deep neural networks, optimized for hardware using hls4ml, can meet the stringent requirements of trigger systems at the CERN Large Hadron Collider. These systems rely on rapid decision-making to process immense data volumes while retaining only the most relevant events for further analysis. The application of hls4ml has also been extended to innovative technologies like smart pixel arrays. These smart pixels integrate ML inference capabilities directly into sensor devices, enabling localized data processing at the pixel level. This approach drastically reduces the need to transmit raw data to external processing units, significantly decreasing power consumption and latency. By embedding neural networks within the pixel architecture, the smart pixels can identify and prioritize relevant data in real time, providing a highly efficient solution for edge computing in scenarios such as particle detectors and imaging systems. Fermilab's work highlights the potential of hardware-accelerated ML in scenarios where both speed and power efficiency are mission-critical. Through this tutorial, attendees will gain valuable insights into the challenges and solutions of deploying ML in hardware. Understanding how HLS and hls4ml streamline the development of neural network-based hardware accelerators is fundamental for the industry's future. Participants will learn how these technologies are shaping the future of AI and scientific computing.

Di Guglielmo, Giuseppe [Fermilab]

Integrity and security in an Ada runtime environment

A review is provided of the Formal Methods group discussions. It was stated that integrity is not a pure mathematical dual of security. The input data is part of the integrity domain. The group provided a roadmap for research. One item of the roadmap and the final position statement are closely related to the space shuttle and space station. The group's position is to use a safe subset of Ada. Examples of safe sets include the Army Secure Operating System and the Penelope Ada verification tool. It is recommended that a conservative attitude is required when writing Ada code for life and property critical systems.

Bown, Rodney L.

HARD: A performance portable radiation hydrodynamics code based on FleCSI framework

Hydrodynamics And Radiation Diffusion (HARD) is an open-source application for high-performance simulations of compressible hydrodynamics with radiation-diffusion coupling. Built on the FleCSI (Bergen et al., 2021 [1]) (Flexible Computational Science Infrastructure) framework, HARD expresses its computational units as tasks whose execution can be orchestrated by multiple back-end runtimes, including Legion (Bauer et al., 2012 [2]), MPI (Forum, 1994 [3]), and HPX (Kaiser et al., 2020 [4]). Node-level parallelism is handled through Kokkos (Edwards et al., 2014 [5]), providing a single-source, portable code base that runs efficiently on laptops, small homogeneous clusters, and the largest heterogeneous supercomputers currently available. To ensure scientific reliability, HARD includes a regression test suite that automatically reproduces canonical verification problems such as the Sod and LeBlanc shock tubes, and the Sedov blast wave, comparing numerical solutions against known analytical results. The project is distributed under an OSI-approved license, hosted on GitHub, and accompanied by reproducible build scripts and continuous integration workflows. This combination of performance portability, verification infrastructure, and community-focused development makes HARD a sustainable platform for advancing radiation hydrodynamics research across multiple domains.

97 MATHEMATICS AND COMPUTING

CropManage Application for Vineyard Irrigation Decision-Support

CropManage is a free web-application developed by U.C. Cooperative Extension to support evapotranspiration based irrigation scheduling and nutrient management for major specialty crops. Prescribed phenology curves are used to develop daily estimates of canopy cover within a given field, based on days since planting (annual crops) or budbreak (trees, vines). These curves are modulated by a MaxCan parameter representing seasonal maximum canopy cover. Crop development observations can be used to adjust for such factors as weather anomalies or non-standard agronomic practice, as needed. Canopy cover is converted to crop coefficient and combined with reference evapotranspiration to derive daily water consumption. Guidance on crop water requirement is then conveyed to users in terms of system runtime issued on-demand for a given date, largely based on total evapotranspiration since last irrigation event. In this study, CropManage was adapted to vineyards by adding modules accounting for early-season soil moisture depletion and cover crop presence. A crop stress parameter was added to accommodate deficit irrigation practice, allowing the user to specify percentage departure from full water requirement along with start/stop dates. An initial verification exercise was performed on three winegrape vineyards located in California’s Central Coast (2020), North Coast (2020) and Central Valley (2019). Daily crop evapotranspiration was monitored by eddy-covariance fluxtowers. MaxCan was measured by ground and satellite observation. Stress regime was specified by grower practice where available, otherwise stress levels were inferred from applied water records. Mean absolute error and mean bias error of modeled cumulative evapotranspiration were computed with respect to the eddy covariance measurements collected throughout the growing season. Results indicate the modified CropManage water management module performs reasonably well for winegrape. Additional effort is planned to modify the nutrient module for vineyard use.

CropManage

Automata-Based Verification of Temporal Properties on Running Programs

This paper presents an approach to checking a running program against its Linear Temporal Logic (LTL) specifications. LTL is a widely used logic for expressing properties of programs viewed as sets of executions. Our approach consists of translating LTL formulae to finite-state automata, which are used as observers of the program behavior. The translation algorithm we propose modifies standard LTL to Buchi automata conversion techniques to generate automata that check finite program traces. The algorithm has been implemented in a tool, which has been integrated with the generic JPaX framework for runtime analysis of Java programs.

Giannakopoulou, Dimitra

Benchmark for two-dimensional large scale coherent structures in partially magnetized E × B plasmas—community collaboration & lessons learned

Low-temperature plasmas (LTPs) are essential to both fundamental scientific research and critical industrial applications. As in many areas of science, numerical simulations have become a vital tool for uncovering new physical phenomena and guiding technological development. Code benchmarking remains crucial for verifying implementations and evaluating performance. This work continues the Landmark benchmark initiative, a series specifically designed to support the verification of LTP codes. In this study, seventeen simulation codes from a collaborative community of nineteen international institutions modeled a partially magnetized E × B Penning discharge. The emergence of large scale coherent structures, or rotating plasma spokes, endows this configuration with an enormous range of time scales, making it particularly challenging to simulate. The codes showed excellent agreement on the rotation frequency of the spoke as well as key plasma properties, including time-averaged ion density, plasma potential, and electron temperature profiles. Achieving this level of agreement came with challenges, and we share lessons learned on how to conduct future benchmarking campaigns. Comparing code implementations, computational hardware, and simulation runtimes also revealed interesting trends, which are summarized with the aim of guiding future plasma simulation software development.

benchmarking

STARTR: An Open-Source MARVEL model for the NRIC Virtual Test Bed [Poster]

The National Reactor Innovation Center (NRIC) seeks to improve the understanding of microreactor physics in industry and academia through the development of a Microreactor Applications Research Validation and Evaluation (MARVEL) reactor-based model, published on the Virtual Test Bed (VTB). To achieve this goal, the Sodium-cooled Thermal-spectrum Advanced Research Test Reactor (STARTR) model was built using publicly available MARVEL specifications where possible and approximations where applicable, and was optimized for fast runtimes for researchers to receive rapid simulation feedback. STARTR will fill a gap between stakeholder interest and available models, as the first Sodium-cooled Thermal Reactor (STR) hosted on the VTB with baseline performance sanctioned by INL. This project involved the definition of all materials used in the reactor, geometry and all reactor subcomponents, and assertion of tallies and simulation settings within OpenMC 0.13.3. This poster details a small subset of the overall reactor physics testing: the two-dimensional power peaking factors and the flux energy spectrum, as well as plots of the created geometry. Future work includes code-to-code verification between the OpenMC-based model and a separately designed MCNP 6.2-based model.

21 - SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLAN

Dynamic Power Convertor Development for Radioisotope Power Systems at NASA GRC

The Thermal Energy Conversion Branch at NASA Glenn Research Center (GRC) is supporting the development of high-efficiency power convertors in support of Radioisotope Power System (RPS) development. Significant progress was made towards such a system that utilized Stirling conversion machines during the 2001 to 2015 timeframe. Flight development of the Advanced Stirling Radioisotope Generator (ASRG) was cancelled in 2013 by the Department of Energy (DOE) and NASA Headquarters primarily due to budget constraints, and the Advanced Stirling Convertor (ASC) technology contract was subsequently concluded in 2015. A new chapter of technology development has recently been initiated by the NASA RPS Program. This new effort is considering all dynamic power convertor options, such as Stirling and Brayton cycles. Four convertor development contracts supporting this effort were awarded in 2017. The awarded contracts include two free-piston Stirling, one thermoacoustic Stirling, and one turbo-Brayton designs. The technology development contracts each consist of up to three phases: Design, Fabricate, and Test. As of May 2018, all contracts have completed the Design Phase, and each underwent a design review with an independent review board. Two of the contracts have been awarded the Phase 2 option for fabrication. Convertors manifesting from these development efforts will then undergo independent validation and verification at NASA facilities, which will consist of convertor performance and RPS viability demonstrations. Example tests include launch vibration simulation, performance mapping over the environmental temperature range, and static acceleration exposure. In parallel with this renewed development effort, NASA GRC is still demonstrating free-piston Stirling convertor technology using assets from previous projects. The Stirling Research Laboratory (SRL) is still operating 10 convertors from previous development projects. Four of which are flexure-bearing based, and the other six are gas-bearing based. One of the flexure-bearing convertors has accumulated over 110,000 hours of operation, and holds the current maintenance-free heat-engine run-time record. Another flexure-bearing convertor was recently manually shutdown after 105,620 hours of operation, then disassembled and inspected. This inspection produced a wealth of information about the effects of this amount of runtime on the technology's components. One of the engineering unit flexure-bearing convertors recently underwent launch simulation vibration test, a static acceleration exposure up to 20 g, and was then placed on extended operation. Amongst the gas-bearing convertors, the longest running unit has accumulated over 70,000 hours of operation. Four high-fidelity gas-bearing convertors from the ASRG project are still operating continuously, for which the longest runtime has reached 26,000 hours.

Oriti, Salvatore

Dynamic Power Convertor Development for Radioisotope Power Systems at NASA Glenn Research Center

The Thermal Energy Conversion Branch at NASA Glenn Research Center (GRC) is supporting the development of high-efficiency power convertors for use in Radioisotope Power Systems (RPS). Significant progress was made towards such a system that utilized Stirling conversion during the 2001 to 2015 timeframe. Flight development of the Advanced Stirling Radioisotope Generator (ASRG) was cancelled in 2013 by the Department of Energy (DOE) and NASA Headquarters primarily due to budget constraints, and the Advanced Stirling Convertor (ASC) technology contract was subsequently concluded in 2015. A new chapter of technology development has recently been initiated by the NASA RPS Program. This effort is considering all dynamic power convertor options, such as Stirling and Brayton cycles. Four convertor development contracts supporting this effort were awarded in 2017. The awarded contracts include two free-piston Stirling, one thermoacoustic Stirling, and one turbo-Brayton designs. The technology development contracts each consist of up to three phases: Design, Fabricate, and Test. As of May 2018, all contracts have completed the Design Phase, and each underwent a design review with an independent review board. Three of the contracts are planned to execute the Phase 2 option for fabrication. Convertors manifesting from these development efforts will then undergo independent validation and verification at NASA facilities, which will consist of convertor performance and RPS viability demonstrations. Example tests include launch vibration simulation, performance mapping over the environmental temperature range, and static acceleration exposure. In parallel with this renewed development effort, NASA GRC is still demonstrating free-piston Stirling convertor technology using assets from previous projects. The Stirling Research Laboratory (SRL) is still operating several convertors from previous development projects which have similarities and relevance to current contract designs. Four of which are flexure-bearing based, and another six are gas-bearing based. One of the flexure-bearing convertors has accumulated over 110,000 hours of operation, and holds the current record for maintenance-free heat-engine run-time. Another flexure-bearing convertor was recently manually shutdown after 105,620 hours of operation, then disassembled and inspected. This inspection produced a wealth of information about the effects of this amount of runtime on the technology's components. One of the engineering unit flexure-bearing convertors recently underwent launch simulation vibration test, a static acceleration exposure up to 20 g, and was then placed on extended operation. Amongst the gas-bearing convertors, the longest running unit has accumulated over 70,000 hours of operation. Four high-fidelity gas-bearing convertors from the ASRG project are still operating continuously, for which the longest runtime has reached 28,000 hours.

Oriti, Salvatore M.

Model Checker for Java Programs

Java Pathfinder (JPF) is a verification and testing environment for Java that integrates model checking, program analysis, and testing. JPF consists of a custom-made Java Virtual Machine (JVM) that interprets bytecode, combined with a search interface to allow the complete behavior of a Java program to be analyzed, including interleavings of concurrent programs. JPF is implemented in Java, and its architecture is highly modular to support rapid prototyping of new features. JPF is an explicit-state model checker, because it enumerates all visited states and, therefore, suffers from the state-explosion problem inherent in analyzing large programs. It is suited to analyzing programs less than 10kLOC, but has been successfully applied to finding errors in concurrent programs up to 100kLOC. When an error is found, a trace from the initial state to the error is produced to guide the debugging. JPF works at the bytecode level, meaning that all of Java can be model-checked. By default, the software checks for all runtime errors (uncaught exceptions), assertions violations (supports Java s assert), and deadlocks. JPF uses garbage collection and symmetry reductions of the heap during model checking to reduce state-explosion, as well as dynamic partial order reductions to lower the number of interleavings analyzed. JPF is capable of symbolic execution of Java programs, including symbolic execution of complex data such as linked lists and trees. JPF is extensible as it allows for the creation of listeners that can subscribe to events during searches. The creation of dedicated code to be executed in place of regular classes is supported and allows users to easily handle native calls and to improve the efficiency of the analysis.

Visser, Willem

Discrete Event Simulation-Based Timeline Validation Using R2U2

The Gateway Vehicle Systems Manager (VSM), the top-level software control system in a distributed, hierarchical Autonomous System Management Architecture is, like most modern spacecraft software control systems, heavily data-driven. For example, schedules (timelines) will be developed on the ground and, due to the high degree of autonomy, contain complex procedures involving conditional branching, variable timing, and resource contention resolution. In order to verify that an uploaded timeline will function correctly, it is necessary to explore the feasible set of possible executions. While it is possible to test a timeline using a mission simulation, the complexity of the system and duration of a timeline limits the number of trials and therefore the test coverage. To address this problem, the VSM team is using a discrete event system model that can rapidly generate from a timeline sets of event sequences using Monte Carlo techniques. To achieve rapid and trustworthy checking of the event sequences, we use an offline version of the runtime model checking tool R2U2. This presentation describes the approach the VSM team is using to implement the discrete event simulation and evaluate event sequences using R2U2. The presentation will discuss: 1. Description of the timelines by VSM in the context of VSM operations 2. Expansion of a timeline into a sequence of atomic events 3. Adjustment, in the Monte Carlo environment, of an event sequence to account for uncertainty, external events, and failures 4. Definition of R2U2 input and mission-time linear temporal logic files 5. Generation and use of R2U2 verdict sequences 6. Lessons learned and future work

Verification

Establishing the Assurance Efficacy of Automated Risk Mitigation Strategies

Verification and validation of increasingly autonomous aviation systems is a major challenge. Traditional techniques for the assurance of high-confidence, safety-critical systems are not equipped to handle the complexity, uncertainty, and lack of predictability inherent in non-deterministic systems. Techniques such as run time monitoring, formal methods, and testing and simulation have been applied to some effect, but it is difficult to properly assess the success of such measures. The authors propose the concept of Assurance Efficacy to address this gap. Assurance Efficacy is seen as a parameter, criteria, or perspective by which to evaluate, identify and explore safety risk mitigation strategies and operational assurance architectures. Validation of the utility of this concept through flight testing is a first step in determining its potential role in assessing the overall safety of complex, increasingly autonomous systems that cannot be fully assured in the design phase.

system safety

Experimental Evaluation of Verification and Validation Tools on Martian Rover Software

To achieve its science objectives in deep space exploration, NASA has a need for science platform vehicles to autonomously make control decisions in a time frame that excludes intervention from Earth-based controllers. Round-trip light-time is one significant factor motivating autonomy capability, another factor is the need to reduce ground support operations cost. An unsolved problem potentially impeding the adoption of autonomy capability is the verification and validation of such software systems, which exhibit far more behaviors (and hence distinct execution paths in the software) than is typical in current deepspace platforms. Hence the need for a study to benchmark advanced Verification and Validation (V&V) tools on representative autonomy software. The objective of the study was to access the maturity of different technologies, to provide data indicative of potential synergies between them, and to identify gaps in the technologies with respect to the challenge of autonomy V&V. The study consisted of two parts: first, a set of relatively independent case studies of different tools on the same autonomy code, second a carefully controlled experiment with human participants on a subset of these technologies. This paper describes the second part of the study. Overall, nearly four hundred hours of data on human use of three different advanced V&V tools were accumulated, with a control group that used conventional testing methods. The experiment simulated four independent V&V teams debugging three successive versions of an executive controller for a Martian Rover. Defects were carefully seeded into the three versions based on a profile of defects from CVS logs that occurred in the actual development of the executive controller. The rest of the document is structured a s follows. In section 2 and 3, we respectively describe the tools used in the study and the rover software that was analyzed. In section 4 the methodology for the experiment is described; this includes the code preparation, seeding of defects, participant training and experimental setup. Next we give a qualitative overview of how the experiment went from the point of view of each technology; model checking (section 5), static analysis (section 6), runtime analysis (section 7) and testing (section 8). The find section gives some preliminary quantitative results on how the tools compared.

Brat, Guillaume

Maintaining the Health of Software Monitors

Software health management (SWHM) techniques complement the rigorous verification and validation processes that are applied to safety-critical systems prior to their deployment. These techniques are used to monitor deployed software in its execution environment, serving as the last line of defense against the effects of a critical fault. SWHM monitors use information from the specification and implementation of the monitored software to detect violations, predict possible failures, and help the system recover from faults. Changes to the monitored software, such as adding new functionality or fixing defects, therefore, have the potential to impact the correctness of both the monitored software and the SWHM monitor. In this work, we describe how the results of a software change impact analysis technique, Directed Incremental Symbolic Execution (DiSE), can be applied to monitored software to identify the potential impact of the changes on the SWHM monitor software. The results of DiSE can then be used by other analysis techniques, e.g., testing, debugging, to help preserve and improve the integrity of the SWHM monitor as the monitored software evolves.

Runtime Monitor