Search NASA⌕ Search

SEARCH · Search NASA

Results for “Formal analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 145 records · Page 8
All sourcesNASA NTRSDOE OSTI
NASA NTRS2018

Runtime Verification: From Propositional to First-Order Temporal Logic

Runtime Verification is a branch of formal methods concerned with analysis of execution traces for the purpose of determining the state or general quality of the executing system. The field covers numerous approaches, one of which is specification-based runtime verification, where execution traces are checked against formal specifications. The paper presents syntax, semantics, and monitoring algorithms for respectively propositional and first-order temporal logics. In propositional logics the observed events in the execution trace are represented using atomic propositions, while first-order logic allows universal and existential quantification over data occurring as arguments in events. Monitoring of the first-order case is drastically more challenging than the propositional case, and we present a solution for this problem based on BDDs. We furthermore discuss monitorability of temporal properties by dividing them into different classes representing different degrees of monitorability.

Peled, Doron↗
NASA NTRS2013

Investigating Actuation Force Fight with Asynchronous and Synchronous Redundancy Management Techniques

Within distributed fault-tolerant systems the term force-fight is colloquially used to describe the level of command disagreement present at redundant actuation interfaces. This report details an investigation of force-fight using three distributed system case-study architectures. Each case study architecture is abstracted and formally modeled using the Symbolic Analysis Laboratory (SAL) tool chain from the Stanford Research Institute (SRI). We use the formal SAL models to produce k-induction based proofs of a bounded actuation agreement property. We also present a mathematically derived bound of redundant actuation agreement for sine-wave stimulus. The report documents our experiences and lessons learned developing the formal models and the associated proofs.

Hall, Brendan↗
NASA NTRS2004

Scatter in Carbon/Silicon Carbide (C/SiC) Composites Quantified

Carbon-fiber-reinforced silicon carbide matrix (C/SiC) composites processed by chemical vapor infiltration are candidate materials for aerospace thermal structures. Carbon fibers can retain properties at very high temperatures, but they are known to have poor oxidation resistance in adverse, high-temperature environments. Nevertheless, the combination of CVI-SiC matrix with higher stiffness and oxidation resistance, the interfacial coating, and additional surface-seal coating provides the necessary protection to the carbon fibers, and makes the material viable for high-temperature space applications operating under harsh environments. Furthermore, C/SiC composites, like other ceramic matrix composites (CMCs), exhibit graceful non-catastrophic failure because of various inherent energy dissipating mechanisms. The material exhibits nonlinearity in deformation even at very low stress levels. This is the result of the severe matrix microcracking present in the as processed composite because of large differences between the coefficients of thermal expansion of the fiber and the matrix. Utilization of these advanced composites in next generation space vehicles will require innovative structural configurations, updated materials, and refined analyses. Structural safety issues for these vehicles are in direct competition with performance and cost. One would have to quantify the uncertainties associated with the design using formal probabilistic methods. Specifically four fundamental aspects on which analyses are based-- (1) loading conditions, (2) material behavior, (3) geometrical configurations, and (4) structural connections between the composite components and baseline structure--are stochastic in nature. A direct way to formally account for uncertainties is to develop probabilistic structural analysis methods where all participating variables are described by appropriate probability density functions. The present work, however, focuses on analyzing the stochastic material behavior of these advanced composites using formal probabilistic analysis methods. Often, some of the desirable property characteristics that allow composites to offer advantages over conventional structural materials (like tailoring of composite properties) and the complexity are in fact responsible for their greater statistical variability and the requirements for more characterization tests. Composite properties are anisotropic as well, having different properties in different directions. This means that characterization of a property such as stiffness--which will vary greatly depending on the orientation of the fiber relative to the direction of the testing--must be repeated for several different directions and loading conditions. The fabrication process for composites also introduces statistical variations in properties and geometry. A composite part is produced in a number of steps, each of which introduces statistical variability. The matrix is usually produced from a combination of raw materials; and the fiber, which has its own set of properties, is often coated or surface treated, introducing yet another source of variability.

Murthy, Pappu L. N.↗
NASA NTRS1992

Verifying the interactive convergence clock synchronization algorithm using the Boyer-Moore theorem prover

The application of formal methods to the analysis of computing systems promises to provide higher and higher levels of assurance as the sophistication of our tools and techniques increases. Improvements in tools and techniques come about as we pit the current state of the art against new and challenging problems. A promising area for the application of formal methods is in real-time and distributed computing. Some of the algorithms in this area are both subtle and important. In response to this challenge and as part of an ongoing attempt to verify an implementation of the Interactive Convergence Clock Synchronization Algorithm (ICCSA), we decided to undertake a proof of the correctness of the algorithm using the Boyer-Moore theorem prover. This paper describes our approach to proving the ICCSA using the Boyer-Moore prover.

Young, William D.↗
NASA NTRS2010

Timing of Formal Phase Safety Reviews for Large-Scale Integrated Hazard Analysis

Integrated hazard analysis (IHA) is a process used to identify and control unacceptable risk. As such, it does not occur in a vacuum. IHA approaches must be tailored to fit the system being analyzed. Physical, resource, organizational and temporal constraints on large-scale integrated systems impose additional direct or derived requirements on the IHA. The timing and interaction between engineering and safety organizations can provide either benefits or hindrances to the overall end product. The traditional approach for formal phase safety review timing and content, which generally works well for small- to moderate-scale systems, does not work well for very large-scale integrated systems. This paper proposes a modified approach to timing and content of formal phase safety reviews for IHA. Details of the tailoring process for IHA will describe how to avoid temporary disconnects in major milestone reviews and how to maintain a cohesive end-to-end integration story particularly for systems where the integrator inherently has little to no insight into lower level systems. The proposal has the advantage of allowing the hazard analysis development process to occur as technical data normally matures.

Massie, Michael J.↗
NASA NTRS2011

The Necessity of Functional Analysis for Space Exploration Programs

As NASA moves toward expanded commercial spaceflight within its human exploration capability, there is increased emphasis on how to allocate responsibilities between government and commercial organizations to achieve coordinated program objectives. The practice of program-level functional analysis offers an opportunity for improved understanding of collaborative functions among heterogeneous partners. Functional analysis is contrasted with the physical analysis more commonly done at the program level, and is shown to provide theoretical performance, risk, and safety advantages beneficial to a government-commercial partnership. Performance advantages include faster convergence to acceptable system solutions; discovery of superior solutions with higher commonality, greater simplicity and greater parallelism by substituting functional for physical redundancy to achieve robustness and safety goals; and greater organizational cohesion around program objectives. Risk advantages include avoidance of rework by revelation of some kinds of architectural and contractual mismatches before systems are specified, designed, constructed, or integrated; avoidance of cost and schedule growth by more complete and precise specifications of cost and schedule estimates; and higher likelihood of successful integration on the first try. Safety advantages include effective delineation of must-work and must-not-work functions for integrated hazard analysis, the ability to formally demonstrate completeness of safety analyses, and provably correct logic for certification of flight readiness. The key mechanism for realizing these benefits is the development of an inter-functional architecture at the program level, which reveals relationships between top-level system requirements that would otherwise be invisible using only a physical architecture. This paper describes the advantages and pitfalls of functional analysis as a means of coordinating the actions of large heterogeneous organizations for space exploration programs.

program management↗
NASA NTRS1995

Formal methods demonstration project for space applications

The Space Shuttle program is cooperating in a pilot project to apply formal methods to live requirements analysis activities. As one of the larger ongoing shuttle Change Requests (CR's), the Global Positioning System (GPS) CR involves a significant upgrade to the Shuttle's navigation capability. Shuttles are to be outfitted with GPS receivers and the primary avionics software will be enhanced to accept GPS-provided positions and integrate them into navigation calculations. Prior to implementing the CR, requirements analysts at Loral Space Information Systems, the Shuttle software contractor, must scrutinize the CR to identify and resolve any requirements issues. We describe an ongoing task of the Formal Methods Demonstration Project for Space Applications whose goal is to find an effective way to use formal methods in the GPS CR requirements analysis phase. This phase is currently under way and a small team from NASA Langley, ViGYAN Inc. and Loral is now engaged in this task. Background on the GPS CR is provided and an overview of the hardware/software architecture is presented. We outline the approach being taken to formalize the requirements, only a subset of which is being attempted. The approach features the use of the PVS specification language to model 'principal functions', which are major units of Shuttle software. Conventional state machine techniques form the basis of our approach. Given this background, we present interim results based on a snapshot of work in progress. Samples of requirements specifications rendered in PVS are offered to illustration. We walk through a specification sketch for the principal function known as GPS Receiver State processing. Results to date are summarized and feedback from Loral requirements analysts is highlighted. Preliminary data is shown comparing issues detected by the formal methods team versus those detected using existing requirements analysis methods. We conclude by discussing our plan to complete the remaining activities of this task.

Divito, Ben L.↗
NASA NTRS2002

The Aeronautical Data Link: Taxonomy, Architectural Analysis, and Optimization

The future Communication, Navigation, and Surveillance/Air Traffic Management (CNS/ATM) System will rely on global satellite navigation, and ground-based and satellite based communications via Multi-Protocol Networks (e.g. combined Aeronautical Telecommunications Network (ATN)/Internet Protocol (IP)) to bring about needed improvements in efficiency and safety of operations to meet increasing levels of air traffic. This paper will discuss the development of an approach that completely describes optimal data link architecture configuration and behavior to meet the multiple conflicting objectives of concurrent and different operations functions. The practical application of the approach enables the design and assessment of configurations relative to airspace operations phases. The approach includes a formal taxonomic classification, an architectural analysis methodology, and optimization techniques. The formal taxonomic classification provides a multidimensional correlation of data link performance with data link service, information protocol, spectrum, and technology mode; and to flight operations phase and environment. The architectural analysis methodology assesses the impact of a specific architecture configuration and behavior on the local ATM system performance. Deterministic and stochastic optimization techniques maximize architectural design effectiveness while addressing operational, technology, and policy constraints.

Morris, A. Terry↗
NASA NTRS2016

Microgravity-Induced Physiological Fluid Redistribution: Computational Analysis to Assess Influence of Physiological Parameters

Space flight impacts human physiology in many ways, the most immediate being the marked cephalad (headward) shift of fluid upon introduction into the microgravity environment. This physiological response to microgravity points to the redistribution of blood and interstitial fluid as a major factor in the loss of venous tone and reduction in heart muscle efficiency which impact astronaut performance. In addition, researchers have hypothesized that a reduction in astronaut visual acuity, part of the Visual Impairment and Intracranial Pressure (VIIP) syndrome, is associated with this redistribution of fluid. VIIP arises within several months of beginning space flight and includes a variety of ophthalmic changes including posterior globe flattening, distension of the optic nerve sheath, and kinking of the optic nerve. We utilize a suite of lumped parameter models to simulate microgravity-induced fluid redistribution in the cardiovascular, central nervous and ocular systems to provide initial and boundary data to a 3D finite element simulation of ocular biomechanics in VIIP. Specifically, the lumped parameter cardiovascular model acts as the primary means of establishing how microgravity, and the associated lack of hydrostatic gradient, impacts fluid redistribution. The cardiovascular model consists of 16 compartments, including three cerebrospinal fluid (CSF) compartments, three cranial blood compartments, and 10 thoracic and lower limb blood compartments. To assess the models capability to address variations in physiological parameters, we completed a formal uncertainty and sensitivity analysis that evaluated the relative importance of 42 input parameters required in the model on relative compartment flows and compartment pressures. Utilizing the model in a pulsatile flow configuration, the sensitivity analysis identified the ten parameters that most influenced each compartment pressure. Generally, each compartment responded appropriately to parameter variations associated with itself and adjacent compartments. However, several unexpected interactions between components, such as between the choroid plexus and the lower capillaries, were found, and are due to simplifications in the formulation of the model. The analysis illustrates that highly influential parameters and those that have unique influences within the model formulation must be tightly controlled for successful model application.

gravitational physiology↗
NASA NTRS1978

Using tools for verification, documentation and testing

Methodologies are discussed on four of the major approaches to program upgrading -- namely dynamic testing, symbolic execution, formal verification and static analysis. The different patterns of strengths, weaknesses and applications of these approaches are shown. It is demonstrated that these patterns are in many ways complementary, offering the hope that they can be coordinated and unified into a single comprehensive program testing and verification system capable of performing a diverse and useful variety of error detection, verification and documentation functions.

Osterweil, L. J.↗
NASA NTRS1990

Analysis of spatial pseudodepolarizers in imaging systems

The objective of a number of optical instruments is to measure the intensity accurately without bias as to the incident polarization state. One method to overcome polarization bias in optical systems is the insertion of a spatial pseudodepolarizer. Both the degree of depolarization and image degradation (from the polarization aberrations of the pseudodepolarizer) are analyzed for two depolarizer designs: (1) the Cornu pseudodepolarizer, effective for linearly polarized light, and (2) the dual Babinet compensator pseudodepolarizer, effective for all incident polarization states. The image analysis uses a matrix formalism to describe the polarization dependence of the diffraction patterns and optical transfer function.

Mcguire, James P., Jr.↗
NASA NTRS2002

Application of Modern Design of Experiments to CARS Thermometry in a Model Scramjet Engine

We have applied formal experiment design and analysis to optimize the measurement of temperature in a supersonic combustor at NASA Langley Research Center. We used the coherent anti-Stokes Raman spectroscopy (CARS) technique to map the temperature distribution in the flowfield downstream of an 1160 K, Mach 2 freestream into which supersonic hydrogen fuel is injected at an angle of 30 degrees. CARS thermometry is inherently a single-point measurement technique; it was used to map thc flow by translating the measurement volume through the flowfield. The method known as "Modern Design of Experiments" (MDOE) was used to estimate the data volume required, design the test matrix, perform the experiment and analyze the resulting data. MDOE allowed us to match the volume of data acquired to the precision requirements of the customer. Furthermore, one aspect of MDOE, known as response surface methodology, allowed us to develop precise maps of the flowfield temperature, allowing interpolation between measurement points. An analytic function in two spatial variables was fit to the data from a single measurement plane. Fitting with a Cosine Series Bivariate Function allowed the mean temperature to be mapped with 95% confidence interval half-widths of +/- 30 Kelvin, comfortably meeting the confidence of +/- 50 Kelvin specified prior to performing the experiments. We estimate that applying MDOE to the present experiment saved a factor of 5 in data volume acquired, compared to experiments executed in the traditional manner. Furthermore, the precision requirements could have been met with less than half the data acquired.

Danehy, P. M.↗
NASA NTRS2003

An Architectural Concept for Intrusion Tolerance in Air Traffic Networks

The goal of an intrusion tolerant network is to continue to provide predictable and reliable communication in the presence of a limited num ber of compromised network components. The behavior of a compromised network component ranges from a node that no longer responds to a nod e that is under the control of a malicious entity that is actively tr ying to cause other nodes to fail. Most current data communication ne tworks do not include support for tolerating unconstrained misbehavio r of components in the network. However, the fault tolerance communit y has developed protocols that provide both predictable and reliable communication in the presence of the worst possible behavior of a limited number of nodes in the system. One may view a malicious entity in a communication network as a node that has failed and is behaving in an arbitrary manner. NASA/Langley Research Center has developed one such fault-tolerant computing platform called SPIDER (Scalable Proces sor-Independent Design for Electromagnetic Resilience). The protocols and interconnection mechanisms of SPIDER may be adapted to large-sca le, distributed communication networks such as would be required for future Air Traffic Management systems. The predictability and reliabi lity guarantees provided by the SPIDER protocols have been formally v erified. This analysis can be readily adapted to similar network stru ctures.

Maddalon, Jeffrey M.↗
NASA NTRS2007

Identification of Human-Induced Changes in Atmospheric Moisture Content

Data from the satellite-based Special Sensor Microwave Imager (SSM/I) show that the total atmospheric moisture content over oceans has increased by 0.41 kg/sq m per decade since 1988. Results from current climate models indicate that water vapor increases of this magnitude cannot be explained by climate noise alone. In a formal detection and attribution analysis using the pooled results from 22 different climate models, the simulated "fingerprint" pattern of anthropogenically caused changes in water vapor is identifiable with high statistical confidence in the SSM/I data. Experiments in which forcing factors are varied individually suggest that this fingerprint "match" is primarily due to human-caused increases in greenhouse gases and not to solar forcing or recovery from the eruption of Mount Pinatubo. Our findings provide preliminary evidence of an emerging anthropogenic signal in the moisture content of earth's atmosphere.

Santer, B.D.↗
NASA NTRS2013

High-Order Entropy Stable Finite Difference Schemes for Nonlinear Conservation Laws: Finite Domains

Developing stable and robust high-order finite difference schemes requires mathematical formalism and appropriate methods of analysis. In this work, nonlinear entropy stability is used to derive provably stable high-order finite difference methods with formal boundary closures for conservation laws. Particular emphasis is placed on the entropy stability of the compressible Navier-Stokes equations. A newly derived entropy stable weighted essentially non-oscillatory finite difference method is used to simulate problems with shocks and a conservative, entropy stable, narrow-stencil finite difference approach is used to approximate viscous terms.

Fisher, Travis C.↗
NASA NTRS2012

Semantically-Rigorous Systems Engineering Modeling Using Sysml and OWL

The Systems Modeling Language (SysML) has found wide acceptance as a standard graphical notation for the domain of systems engineering. SysML subsets and extends the Unified Modeling Language (UML) to define conventions for expressing structural, behavioral, and analytical elements, and relationships among them. SysML-enabled modeling tools are available from multiple providers, and have been used for diverse projects in military aerospace, scientific exploration, and civil engineering. The Web Ontology Language (OWL) has found wide acceptance as a standard notation for knowledge representation. OWL-enabled modeling tools are available from multiple providers, as well as auxiliary assets such as reasoners and application programming interface libraries, etc. OWL has been applied to diverse projects in a wide array of fields. While the emphasis in SysML is on notation, SysML inherits (from UML) a semantic foundation that provides for limited reasoning and analysis. UML's partial formalization (FUML), however, does not cover the full semantics of SysML, which is a substantial impediment to developing high confidence in the soundness of any conclusions drawn therefrom. OWL, by contrast, was developed from the beginning on formal logical principles, and consequently provides strong support for verification of consistency and satisfiability, extraction of entailments, conjunctive query answering, etc. This emphasis on formal logic is counterbalanced by the absence of any graphical notation conventions in the OWL standards. Consequently, OWL has had only limited adoption in systems engineering. The complementary strengths and weaknesses of SysML and OWL motivate an interest in combining them in such a way that we can benefit from the attractive graphical notation of SysML and the formal reasoning of OWL. This paper describes an approach to achieving that combination.

Web Ontology Language (OWL)↗
NASA NTRS2018

Runtime Verification - 17 Years Later

Runtime verification is the discipline of analyzing program executions using rigorous methods. The discipline covers such topics as specification-based monitoring, where single executions are checked against formal specifications; predictive runtime analysis, where properties about a system are predicted/inferred from single (good) executions; specification mining from execution traces; visualization of execution traces; and to be fully general: computation of any interesting information from execution traces. Finally, runtime verification also includes fault protection, where monitors actively protect a running system against errors. The paper is written as a response to the ‘Test of Time Award’ attributed to the authors for their 2001 paper [45]. The present paper provides a brief overview of what lead to that paper, what has happened since, and some perspectives on the future of the field.

Rosu, Grigore↗
NASA NTRS2022

Reliability-Aware Requirements Development for Autonomy Software

Autonomy is the ability of a system to make decisions and take actions in the presence of uncertainty. Validating autonomy, therefore, is a matter of validating that the system makes intelligent decisions even when there might be discrepancies between the observed and the expected state of the world as well as when the possible outcome of each of the possible courses of action is uncertain. During the requirements engineering phase, the functions, including those that are required to be autonomous and their expected behavior are specified. However, in the case of autonomous software system, it is challenging to specify all possible scenarios that the software may encounter. Additionally, since autonomous behaviors cannot always be fully predetermined, it is difficult to reason about their completeness and correctness. While these challenges are also faced with non-autonomous system, they are more prevalent for autonomous system due to their complexity and emergent behavior. Our efforts have been three-fold. On one hand, we have developed a goal-based method for requirements decomposition. We have embedded this approach into a higher-level systems engineering framework and then developed methods for decision and reliability analysis within this framework. And finally, we use simulation analysis to validate the more theoretical methods and provide a feedback mechanism. The decision analysis approach (DA) helps in identifying and mitigating the run-time risks, by bringing to the forefront the uncertainties, decisions, interactions, and other factors that may cause autonomous software to make erroneous decisions. The DA framework is used to quantify, for each decision that the software can make, failure risk due to uncertainties. The information about the key decisions and circumstances that can cause autonomous system to make incorrect decisions are used to generate test scenarios to be run in a simulator to ensure that the system can handle error-prone circumstances. The results or outcomes from decisions, based on the simulated scenarios, can then be leveraged to further gain insight of the assured system. We combine a goal-based approach with simulation analysis to facilitate requirements development for autonomous systems and further provide a method for run-time systems level reliability considerations during the autonomous software development process. The DA and the reliability analysis methods provide a formalism for the consideration of uncertainty in the run time decision-making process for autonomous software. This formalism considers the uncertainty involved in the outcome of different courses of action, in terms of performance and cost, as well as a method to consider the system level reliability implications. System level reliability considerations for autonomous software decision making contribute to the satisfaction of the system level goals over the lifecycle of a given mission. We demonstrate our approach using a hypothetical rover path planning example. The requirements for our rover simulator are based on existing literature about Mars rovers and lessons learned from real world observations at JPL. The specifics of the autonomy design for the Mars rovers, that have not been previously cleared for external release, are not used for our demonstrations.

Lindvall, Mikael↗