SEARCH · Search NASA

Results for “Formal Verification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8

All sources NASA NTRS DOE OSTI

NASA NTRS2004

Model based verification of the Secure Socket Layer (SSL) Protocol for NASA systems

The National Aeronautics and Space Administration (NASA) has tens of thousands of networked computer systems and applications. Software Security vulnerabilities present risks such as lost or corrupted data, information theft, and unavailability of critical systems. These risks represent potentially enormous costs to NASA. The NASA Code Q research initiative 'Reducing Software Security Risk (RSSR) Trough an Integrated Approach' offers formal verification of information technology (IT), through the creation of a Software Security Assessment Instrument (SSAI), to address software security risks.

software security↗

NASA NTRS2009

Building a Formal Model of a Human-Interactive System: Insights into the Integration of Formal Methods and Human Factors Engineering

Both the human factors engineering (HFE) and formal methods communities are concerned with finding and eliminating problems with safety-critical systems. This work discusses a modeling effort that leveraged methods from both fields to use model checking with HFE practices to perform formal verification of a human-interactive system. Despite the use of a seemingly simple target system, a patient controlled analgesia pump, the initial model proved to be difficult for the model checker to verify in a reasonable amount of time. This resulted in a number of model revisions that affected the HFE architectural, representativeness, and understandability goals of the effort. If formal methods are to meet the needs of the HFE community, additional modeling tools and technological developments are necessary.

Bolton, Matthew L.↗

NASA NTRSDate not supplied

Swarm Mentality: Toward Automatic Swarm State Awareness with Runtime Verification

Cyber-Physical Systems (CPSs) already exhibit impressive performance in all areas of human life, and swarms of CPSs promise to increase their capabilities even further. However, to effectively utilize CPS swarms their complexity of operation has to scale sub-linearly with the number of swarm members. Presenting the swarm to an operator as a single entity almost eliminates the additional per-member overhead entirely. To operate a swarm as one entity, and/or to increase the swarm’s autonomy, the operator and the swarm members need to reason and communicate at the same level of abstraction, i.e. the swarm needs a sense of “self.” Therefore, we require the ability to specify whole swarm properties yet monitor them at the member level. We examine one architecture for achieving this awareness by: 1) Defining a taxonomy for comparing techniques that synthesize this belief-state 2) Propose use of the Runtime Verification formal method to fill this role 3) Present preliminary designs for extending and embedding such a system in the Distributed Spacecraft Autonomy architecture to generate per-member monitors from swarm level specification.

Runtime Verification↗

NASA NTRSDate not supplied

Validation of Image-Based Neural Network Controllersthrough Adaptive Stress Testing

Neural networks have become state-of-the-art for computer vision problems because of their ability to efficiently model complex functions from large amounts of data. While neural networks can be shown to perform well empirically fora variety of tasks, their performance is difficult to guarantee.Neural network verification tools have been developed that can certify robustness with respect to a given input image; however,for neural network systems used in closed-loop controllers,robustness with respect to individual images does not address multi-step properties of the neural network controller and itsenvironment. Furthermore, neural network systems interacting in the physical world and using natural images are operating in a black-box environment, making formal verification in-tractable. This work combines the adaptive stress testing (AST)framework with neural network verification tools to search for the most likely sequence of image disturbances that cause the neural network controlled system to reach a failure. Anautonomous aircraft taxi application is presented, and results show that the AST method finds failures with more likely image disturbances than baseline methods. Further analysis of AST results revealed an explainable cause of the failure, giving insight into the problematic scenarios that should be addressed.

Adaptive Stress Testing, Marabou, Deep Neural Netw↗

NASA NTRS2016

Capturing Safety Requirements to Enable Effective Task Allocation Between Humans and Automaton in Increasingly Autonomous Systems

There is a current drive towards enabling the deployment of increasingly autonomous systems in the National Airspace System (NAS). However, shifting the traditional roles and responsibilities between humans and automation for safety critical tasks must be managed carefully, otherwise the current emergent safety properties of the NAS may be disrupted. In this paper, a verification activity to assess the emergent safety properties of a clearly defined, safety critical, operational scenario that possesses tasks that can be fluidly allocated between human and automated agents is conducted. Task allocation role sets were proposed for a human-automation team performing a contingency maneuver in a reduced crew context. A safety critical contingency procedure (engine out on takeoff) was modeled in the Soar cognitive architecture, then translated into the Hybrid Input Output formalism. Verification activities were then performed to determine whether or not the safety properties held over the increasingly autonomous system. The verification activities lead to the development of several key insights regarding the implicit assumptions on agent capability. It subsequently illustrated the usefulness of task annotations associated with specialized requirements (e.g., communication, timing etc.), and demonstrated the feasibility of this approach.

Neogi, Natasha A.↗

DOE OSTI2022

Modelica-json: Transforming energy models to digitize the control delivery process

Building simulation models are typically not used to generate the documentation required for bidding and project delivery of commercial building systems, or for their semantic modeling and commissioning. This paper presents a software tool that aids in digitizing the control delivery process, spanning simulation during design to implementation and formal verification during commissioning. The tool can generate from Modelica models digital documentation of control sequences. This digital documentation, along with other project drawings and specifications can be used for project bidding. It can also be used for implementation of control sequences through machineto-machine translation to commercial legacy control products, for which we are currently developing the proposed ASHRAE Standard 231P based on the presented work. Moreover, as-installed control sequences can be formally verified against the design specification, and a semantic model in Brick can be exported to aid in configuration of building analytics and fault detection. The paper presents what we believe is the first translation of a Modelica-implemented control sequence to a native implementation on a commercial control platform, using the webCTRL product line from Automated Logic. The paper also shows how a webCTRL implementation can be formally verified against its Modelica specification. These use cases have all been demonstrated with a prototype implementation that is now being further developed.

Wetter, Michael↗

NASA NTRS2008

From Informal Safety-Critical Requirements to Property-Driven Formal Validation

Most of the efforts in formal methods have historically been devoted to comparing a design against a set of requirements. The validation of the requirements themselves, however, has often been disregarded, and it can be considered a largely open problem, which poses several challenges. The first challenge is given by the fact that requirements are often written in natural language, and may thus contain a high degree of ambiguity. Despite the progresses in Natural Language Processing techniques, the task of understanding a set of requirements cannot be automatized, and must be carried out by domain experts, who are typically not familiar with formal languages. Furthermore, in order to retain a direct connection with the informal requirements, the formalization cannot follow standard model-based approaches. The second challenge lies in the formal validation of requirements. On one hand, it is not even clear which are the correctness criteria or the high-level properties that the requirements must fulfill. On the other hand, the expressivity of the language used in the formalization may go beyond the theoretical and/or practical capacity of state-of-the-art formal verification. In order to solve these issues, we propose a new methodology that comprises of a chain of steps, each supported by a specific tool. The main steps are the following. First, the informal requirements are split into basic fragments, which are classified into categories, and dependency and generalization relationships among them are identified. Second, the fragments are modeled using a visual language such as UML. The UML diagrams are both syntactically restricted (in order to guarantee a formal semantics), and enriched with a highly controlled natural language (to allow for modeling static and temporal constraints). Third, an automatic formal analysis phase iterates over the modeled requirements, by combining several, complementary techniques: checking consistency; verifying whether the requirements entail some desirable properties; verify whether the requirements are consistent with selected scenarios; diagnosing inconsistencies by identifying inconsistent cores; identifying vacuous requirements; constructing multiple explanations by enabling the fault-tree analysis related to particular fault models; verifying whether the specification is realizable.

Cimatti, Alessandro↗

NASA NTRS1991

SEDS1 mission software verification using a signal simulator

The first flight of the Small Expendable Deployer System (SEDS1) is scheduled as the secondary payload of a Delta II in late 1992. The objective of the SEDS1 mission is to collect data to validate the concept of tethered satellite systems and to verify computer simulations used to predict their behavior. A series of tests will be performed to exercise the software modules which make up the Mission Software of the SEDS Data System. These tests will be performed by using a SEDS Signal Simulator to generate signals which will simulate the inputs normally produced by sensors and circuits in the SEDS system. The SEDS Signal Simulator will be used in the debugging and in the formal verification of the SEDS1 Mission Software. The Simulator will not only emulate normal flight conditions but also exercise all modules written to handle anticipated anomalous flight conditions, conditions that would be difficult to reproduce and control with actual SEDS hardware. The simulator will help to expedite software development and to increase the confidence of the users of the Mission Software. With little modification, the Simulator should be useful in the software development of future SEDS flights.

Pierson, William E.↗

NASA NTRS1990

Improving system reliability through formal analysis and use of checks in software

Software is playing increasingly important roles in avionics systems. It is widely used in navigation and, in some cases, in control loops that maintain aircraft stability. To guarantee the safety of flight systems, the FAA requires that critical components have a probability of failure no greater than 10(exp -9) per hour of flight. Software is being used to diagnose system components for failure. SIFT (Software Implemented Fault Tolerance) was a computer system developed to study the use of software to check for failure and manage processor reconfiguration. To guarantee that software satisfies its specifications, formal verification can be used. With this a program and its specification are viewed as mathematical objects, and a mathematical proof is used to show that the program and its specification are equivalent. In previous research, a theory of checking was developed to offer assistance in analyzing specifications and designing run-time checks. In the theory, checking is considered abstractly in terms of n-ary relations much like those of relational database theory. Within the theory check are categorized, checks on input and checks on results are considered, and formal attention is given to the minimization and logical combination of checks. The focus is upon input checks and the obstacles in checking input to critical systems. A central concern is with a property referred to as independence. The concern is with circumstances under which it is possible to apply isolated, independent checks to separate sensor inputs and be assure that all illegal input will be properly detected. Presently, independence is being investigated and checked in the context of the GCS (Guidance and Control System). The GCS simulator is intended for testing software that implements control laws for landing spacecraft. The large number of inputs and their complex interrelationships provide an exciting context in which to investigate independence and the difficulties of supplying input checks.

Staknis, Mark E.↗

NASA NTRS1990

Knowledge-based system verification and validation

The objective of this task is to develop and evaluate a methodology for verification and validation (V&V) of knowledge-based systems (KBS) for space station applications with high reliability requirements. The approach consists of three interrelated tasks. The first task is to evaluate the effectiveness of various validation methods for space station applications. The second task is to recommend requirements for KBS V&V for Space Station Freedom (SSF). The third task is to recommend modifications to the SSF to support the development of KBS using effectiveness software engineering and validation techniques. To accomplish the first task, three complementary techniques will be evaluated: (1) Sensitivity Analysis (Worchester Polytechnic Institute); (2) Formal Verification of Safety Properties (SRI International); and (3) Consistency and Completeness Checking (Lockheed AI Center). During FY89 and FY90, each contractor will independently demonstrate the user of his technique on the fault detection, isolation, and reconfiguration (FDIR) KBS or the manned maneuvering unit (MMU), a rule-based system implemented in LISP. During FY91, the application of each of the techniques to other knowledge representations and KBS architectures will be addressed. After evaluation of the results of the first task and examination of Space Station Freedom V&V requirements for conventional software, a comprehensive KBS V&V methodology will be developed and documented. Development of highly reliable KBS's cannot be accomplished without effective software engineering methods. Using the results of current in-house research to develop and assess software engineering methods for KBS's as well as assessment of techniques being developed elsewhere, an effective software engineering methodology for space station KBS's will be developed, and modification of the SSF to support these tools and methods will be addressed.

Johnson, Sally C.↗

DOE OSTI2017

Proposed Semi-Analytic Benchmark for Coupled Neutronics/Thermal-Hydraulics Feedback in Multiphysics Simulations

The past decade has seen considerable advancements in multiscale and multiphysics simulations that account for nonlinear effects of feedback between different physical processes within a single calculation. One area of particular interest has been multiphysics simulations that include both neutronics and thermal-hydraulics effects to accurately model the thermal feedback effects present in nuclear reactors. During this time, many groups have successfully modeled thermal feedback effects by coupling a variety of different types of neutron transport and thermal-hydraulic solvers together. However, formal verification and validation of these coupled code systems has proven challenging due to a lack of benchmark problems with well-characterized reference solutions. One approach is to confirm gross energy balance using bulk coolant properties (outlet temperature/enthalpy) for code verification purposes. Alternatively, code-to-code comparisons of results for a predefined reference/challenge problem have been used to establish reasonability of local results (neutron flux, heating, enthalpy rise) for various implementations, for example the VERA Core Physics Progression Problems. While community solutions are valuable for assessing the relative performance and fidelity of different implementations, they are not guaranteed to provide a measure of the absolute accuracy of a given implementation. In fact, these code-to-code comparisons can give a false sense of confidence by masking the effects of errors or approximations that are common to all of the solution methods tested. This is a particular concern when many methods derive from a common approach, such as Picard iteration. To this end, an analytical benchmark would be very valuable for verifying individual coupled physics implementations, as well as for providing a formal assessment of algorithm accuracy and sensitivity to model approximations such as mesh size and number of convergence iterations. However, creation of an analytical benchmark is difficult due to the complex nature of the eigenvalue form of the neutron transport equation (which does not permit a simple analytical solution for non-trivial cases) as well as the variety of different empirical closure relationships used in thermal-hydraulic modeling. In this paper we propose a benchmark for coupled neutronics/thermal-hydraulics simulations. The proposed benchmark overcomes the challenges associated with a multiphysics benchmark problem by using a fixed-source (rather than eigenvalue) formulation of the neutron transport equation and limiting fluid properties to the single-phase regime where the density and temperature of the coolant are related to enthalpy by a known relationship, while still preserving significant nuclear/thermal feedback effects within the simplified problem. The new benchmark is easy to simulate using existing coupled physics implementations, and allows for a direct comparison with a reference solution, as provided in this summary.

42 ENGINEERING↗

DOE OSTI2025

AMR-Wind: A Performance-Portable, High-Fidelity Flow Solver for Wind Farm Simulations

We present AMR-Wind, a verified and validated high-fidelity computational-fluid-dynamics code for wind farm flows. AMR-Wind is a block-structured, adaptive-mesh, incompressible-flow solver that enables predictive simulations of the atmospheric boundary layer and wind plants. It is a highly scalable code designed for parallel high-performance computing with a specific focus on performance portability for current and future computing architectures, including graphical processing units (GPUs). In this paper, we detail the governing equations, the numerical methods, and the turbine models. Establishing a foundation for the correctness of the code, we present the results of formal verification and validation. The verification studies, which include a novel actuator line test case, indicate that AMR-Wind is spatially and temporally second-order accurate. The validation studies demonstrate that the key physics capabilities implemented in the code, including actuator disk models, actuator line models, turbulence models, and large eddy simulation (LES) models for atmospheric boundary layers, perform well in comparison to reference data from established computational tools and theory. We conclude with a demonstration simulation of a 12-turbine wind farm operating in a turbulent atmospheric boundary layer, detailing computational performance and realistic wake interactions.

17 WIND ENERGY↗

DOE OSTI2018

Design-order, non-conformal low-Mach fluid algorithms using a hybrid CVFEM/DG approach

Here, a hybrid, design-order sliding mesh algorithm, which uses a control volume finite element method (CVFEM), in conjunction with a discontinuous Galerkin (DG) approach at non-conformal interfaces, is outlined in the context of a low-Mach fluid dynamics equation set. This novel hybrid DG approach is also demonstrated to be compatible with a classic edge-based vertex centered (EBVC) scheme. For the CVFEM, element polynomial, P , promotion is used to extend the low-order P = 1 CVFEM method to higher-order, i.e., P = 2. An equal-order low-Mach pressure-stabilized methodology, with emphasis on the non-conformal interface boundary condition, is presented. A fully implicit matrix solver approach that accounts for the full stencil connectivity across the non-conformal interface is employed. A complete suite of formal verification studies using the method of manufactured solutions (MMS) is performed to verify the order of accuracy of the underlying methodology. The chosen suite of analytical verification cases range from a simple steady diffusion system to a traveling viscous vortex across mixed-order non-conformal interfaces. Results from all verification studies demonstrate either second- or third-order spatial accuracy and, for transient solutions, second-order temporal accuracy.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗

DOE OSTI2021

Modeling fission product diffusion in TRISO fuel particles with BISON

Diffusion of fission products in intact TRISO particles depends on particle geometry, fission product source rates, time, temperature, and temperature-dependent diffusion coefficients. Simulating this diffusion process requires models for source rates and diffusion coefficients, plus computation of the temperature field if not prescribed. In addition, simulation quality depends on discretization of the geometry, appropriate time stepping, and the accuracy of the solution method. In this paper, we explore the simulation of fission product diffusion in TRISO fuel particles using the finite element method via the fuel performance code Bison. Recent material model development has occurred in Bison for each material present in tri-structural isotropic (TRISO) fuel particles: the buffer, inner pyrolytic carbon, silicon carbide, and outer pyrolytic carbon layers, as well as the fuel kernel. Also, new mesh generation and fission product release fraction capabilities have been added. Diffusion capabilities are shown to converge to the correct solution via formal verification tests. A large number of code benchmarking problems are also given, with good results, showing that Bison’s computed release fractions closely match those of other software tools. Finally, a significant validation effort is detailed in which fission product release, measured as part of the AGR-1 capsule experiments, is compared to Bison outputs. Bison outputs compare very well to the experimental data and to PARFUME results.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗

DOE OSTI2017

On the Power of Uncertainties in Microbial System Modeling: No Need To Hide Them Anymore

For decades, microbiologists have considered uncertainties as an undesired side effect of experimental protocols. As a consequence, standard microbial system modeling strives to hide uncertainties for the sake of deterministic understanding. However, recent studies have highlighted greater experimental variability than expected and emphasized uncertainties not as a weakness but as a necessary feature of complex microbial systems. We therefore advocate that biological uncertainties need to be considered foundational facets that must be incorporated in models. Not only will understanding these uncertainties improve our understanding and identification of microbial traits, it will also provide fundamental insights on microbial systems as a whole. Taking into account uncertainties within microbial models calls for new validation techniques. Formal verification already overcomes this shortcoming by proposing modeling frameworks and validation techniques dedicated to probabilistic models. However, further work remains to extract the full potential of such techniques in the context of microbial models. Herein, we demonstrate how statistical model checking can enhance the development of microbial models by building confidence in the estimation of critical parameters and through improved sensitivity analyses.

59 BASIC BIOLOGICAL SCIENCES↗

DOE OSTI2026

Fortran mimetic abstraction language (Formal) v0.1.

The Fortran mimetic abstraction language ("Formal") is a domain-specific language (DSL) embedded in Fortran 202Y [1]. Formal provides novel software abstractions for simulating phenomena governed by the partial differential equations (PDEs) of vector and tensor calculus. Such equations model an extremely broad set of physical phenomena, ranging from atmospheric winds to light propagation. Formal's data structures and algorithms mimic in form and behavior continuous functions and operators. Formal supports these mathematical constructs using mimetic discretizations that define a discrete calculus satisfying various tensor calculus theorems, thereby ensuring high-fidelity representations of the physics being modeled. [2] Formal 0.1.0 also lays a foundation for the future use of Fortran 202Y type-safe templates to facilitate the formal verification of tensor contractions in computational physics and artificial intelligence [3]. [1] "Fortran 202Y" is Fortran standard committee's informal designation for the next Fortran revision, which will likely be "Fortran 2028". [2] Corbino, J. and Castillo, J. (2020) Journal of Computational and Applied Mathematics, https://doi.org/10.1016/j.cam.2019.06.042. [3] Haveraaen, M., Järvi, J., & Rouson, D. (2019). Reflecting on Generics for Fortran. https://j3-fortran.org/doc/year/19/19-188.pdf.

Rouson, Damian [Lawrence Berkeley National Laborat↗

DOE OSTI2019

Wind Energy Instrumentation Atlas

The US Department of Energy (DOE) A2e program is focused on developing the next generation of predictive tools to better understand wind plant performance and help industry lower the overall cost of energy. A formal verification and validation process is required to demonstrate improved accuracy of these new models beyond those currently employed. And a critical part of model validation is utilization of a diverse set of accurate observations of atmospheric forcing and wind plant response. A number of existing data sets that will be used for this purpose, as highlighted by Schreck and Maniaci (2017) but A2e researchers also realize that new datasets will be required to meet validation objectives. As such, plans for new experiments based on model validation priorities (NALU validation plan, 2017) are currently being developed. This document is intended to serve as a reference to experimental study planners that describes the capability, accuracy and resolution of existing and developing measurement technologies to observe quantities of interest for wind plant model validation. Such systems can be broken into two major categories: those that measure the flow field and surrounding atmosphere around and within a wind plant and those that measure the turbine response within the wind plant. The A2e validation team will use this catalogue of instrument capability in conjunction with the validation plan, to choose the optimal set of instruments to be deployed, inform instrument placement and operation and estimate the types of validation that may be gathered through new field campaigns. Where existing instrumentation is deficient, the document will also help guide DOE towards potential areas where instrumentation development is required to meet validation objectives and A2e technology development funding may be required. The domain of interest is the wind plant microscale, within and surrounding a single wind plant, typically, tens of kilometers on a side in horizontal directions and to the top of the atmospheric boundary layer (about 1km) in the vertical. Some observations of dominant mesoscale forcing phenomena are required, with the highest resolution measurements occurring in the wind turbine wakes and on the turbines themselves. The simulation tools to be validated are mesoscale driven large-eddy simulations of the atmosphere with full aeroelastic response of individual turbines within the plant. Use cases vary slightly among tool users, but should focus on the primary end customers of the simulations and research insights, which would be turbine manufacturers, wind plant developers and owners. Broadly speaking their interests are maximizing energy output, while maintaining turbine reliability and lifetime.

17 WIND ENERGY↗

DOE OSTI2025

Theorems in Service of Sound Composition, Rapid Modeling and Scalable Analysis

This project extends the state of the art in formal verification modeling with modules and automatically checkable data-sharing patterns such that component modules can retain their assurance case when composed within a larger system. For users, smaller models make reasoning easier and help to ensure they accurately reflect text specifications. For automated methods, smaller models give exponential benefits for verification algorithm execution time.

97 MATHEMATICS AND COMPUTING↗