NASA's Independent Verification and Validation (IV&V) Program and Gateway IV&V Project
No abstract available
Stanton, Bill↗
SEARCH · Engineering Papers
Results for “program verification”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
A Provably Correct Floating-Point Implementation of Well Clear Avionics Concepts
The NASA DAIDALUS library provides formal definitions for Detect-and-Avoid avionics concepts such as when an aircraft is well-clear with respect to the surrounding air traffic, i.e., it does not operate in such proximity to create a collision hazard. While several properties are proven correct for DAIDALUS assuming ideal real number arithmetic, an actual implementation that uses floating-point numbers may behave unexpectedly because of round-off errors and run-time exceptions. This paper presents an experience report on the application of a formal methods toolchain to extract and verify floating-point C code from a real-valued specification of the well-clear module of DAIDALUS. This toolchain comprises the PVS theorem prover, the PRECiSA floating-point analyzer and code generator, and the Frama-C analysis suite. The generated code is automatically instrumented to detect when the control flow of the floating-point program may diverge from the ideal real number specification, and it is annotated with contracts that state the maximum accumulated round-off error. The absence of overflows is also formally verified for the generated code. In order to apply the toolchain to an industrial case study such as DAIDALUS, a formally verified pre-processing of the input specification is performed, which includes a program slicing and several semantic-preserving simplifications.
Program verification↗
Development of a Performance Portable Non-Equilibrium Plasma Fluid Solver on Adaptive Grids
This presentation will describe the numerical techniques, programming paradigms, verification, and performance of a non-equilibrium plasma fluid solver that can effectively utilize current and upcoming central processing and graphics processing unit (CPU+GPU) architectures. Our plasma fluid model solves the conservation equations for self-consistent electrostatic Poisson, electron and heavy species transport, and electron temperature on adaptive Cartesian grids. Our solver is written using performance portable adaptive mesh management library, AMReX (Zhang et al., JOSS, 4 (37) 1370, 2019), and can be built and run on widely available vendor specific GPU architectures (NVIDIA/AMD/Intel). We utilize a non-subcycled second order semi-implicit time-stepping method where all adaptive mesh refinement (AMR) levels are advanced with the same time step. The composite multi-level multigrid solver from within AMReX is used for each of the governing equations that are cast into a Helmholtz equation form. We have also developed a python based chemical mechanism parser framework that uses a similar format as CANTERA (Goodwin et al., Zenodo, 2018) yaml files as input. Our custom parser reads the yaml file and provides C++ files with transport and production rate functions that can be executed on both host (CPU) and device (GPU). We present verification of our solver using method of manufactured solutions that indicate formal second order accuracy with central diffusion and fifth order weighted-essentially-non-oscillatory (WENO) advection scheme. We also verify our solver with published literature on low-pressure capacitive and high-pressure streamer discharges. Our initial performance studies indicate 10X speed-up using 20 NVIDIA GPUs versus 200 CPUs for an atmospheric streamer discharge problem solved on a 512 x 1024 x 512 grid.
graphics processing units↗
Europa Clipper Payload Verification and Validation: Test and Analysis Program Design
NASA’s Europa Clipper mission – which is planned to launch in the mid-2020s – is designed to investigate the habitability of the jovian moon Europa with a state-of-the-art suite of over 10 sensors and instruments. Now past its project critical design review, Europa Clipper is starting the execution of its verification and validation (V&V) program. The payload V&V function in particular is responsible for designing and coordinating a thorough test and analysis program that will confirm the proper functioning and performance of our payload instruments. Given the large number of instruments to manage, we have developed a suite of standardized tests and analyses that are designed to cover all of the common interfaces across instruments, while allowing for flexibility to support the unique needs of individual instruments. This suite of activities, coordinated and/or performed by the payload team, forms the bulk of our payload verification and validation campaign. This paper provides a detailed summary of the full set of V&V activities in that suite, covering the four categories of activities: analysis of lower-level evidence, analysis via simulation, testing in the system testbeds, and testing in assembly, test, and launch operations (ATLO). We will describe the purpose of each activity type, how the activities are developed, and the review process for each type of activity. We then define the complete list of activities written for each instrument and how subtleties specific to certain instruments are managed. The discussion will provide a comprehensive understanding of the activities in the payload V&V purview and how various interfaces with different levels of the project are managed. This paper also describes key metrics the payload team uses to track V&V progress and some insights into the teaming design and division of labor we use to ensure consistency and completeness across the entire payload suite. Finally, the paper will offer a snapshot of the status of the Payload V&V program prior to instrument delivery and offer insights into the upcoming phase of instrument delivery and the start of ATLO.
Lee, Dennis↗
Verification of a landing dynamics computer program using Viking Lander data
An investigation was conducted to verify the accuracy of the Landing Dynamics Computer Program (LDCP) used to simulate the landing event of the Viking Lander (VL) on to the Martian surface. This verification was achieved by comparing the analytical data with results from a test program involving a dynamically scaled model of a VL configuration. A secondary objective of this study was to evaluate the sensitivity of the VL to initial rates and orientations, configuration modifications, and footpad friction.
Muraca, R. J.↗
Deductive Evaluation: Formal Code Analysis With Low User Burden
We describe a framework for symbolically evaluating iterative C code using a deductive approach that automatically discovers and proves program properties. Although verification is not performed, the method can infer detailed program behavior. Software engineering work flows could be enhanced by this type of analysis. Floyd-Hoare verification principles are applied to synthesize loop invariants, using a library of iteration-specific deductive knowledge. When needed, theorem proving is interleaved with evaluation and performed on the fly. Evaluation results take the form of inferred expressions and type constraints for values of program variables. An implementation using PVS (Prototype Verification System) is presented along with results for sample C functions.
Di Vito, Ben. L↗
Embedding Differential Dynamic Logic in PVS
Differential dynamic logic (dL) is a formal framework for specifying and reasoning about hybrid systems, i.e., dynamical systems that exhibit both continuous and discrete behaviors. These kinds of systems arise in many safety- and mission-critical applications. This paper presents a formalization of dL in the Prototype Verification System (PVS) that includes the semantics of hybrid programs and dL’s proof calculus. The formalization embeds dL into the PVS logic, resulting in a version of dL whose proof calculus is not only formally verified, but is also available for the verification of hybrid programs within PVS itself. This embedding, called Plaidypvs (Properly Assured Implementation of dL for Hybrid Program Verification and Specification), supports standard dL style proofs, but further leverages the capabilities of PVS to allow reasoning about entire classes of hybrid programs. The embedding also allows the user to import the well-established definitions and mathematical theories available in PVS.
PVS↗
Strainrange partitioning: A tool for characterizing high temperature low cycle fatigue
The basic concepts of strain range partitioning are reviewed and the areas requiring for expanded verification are detailed. A suggested cooperative evaluation program involves the verification of the four basic life relationships (for PP, CC, PC, and CP type inelastic strain ranges) for a variety of materials that are of direct interest to the participating organizations.
Hirschberg, M. H.↗
Development, Verification and Validation of Parallel, Scalable Volume of Fluid CFD Program for Propulsion Applications
There are many instances involving liquid/gas interfaces and their dynamics in the design of liquid engine powered rockets such as the Space Launch System (SLS). Some examples of these applications are: Propellant tank draining and slosh, subcritical condition injector analysis for gas generators, preburners and thrust chambers, water deluge mitigation for launch induced environments and even solid rocket motor liquid slag dynamics. Commercially available CFD programs simulating gas/liquid interfaces using the Volume of Fluid approach are currently limited in their parallel scalability. In 2010 for instance, an internal NASA/MSFC review of three commercial tools revealed that parallel scalability was seriously compromised at 8 cpus and no additional speedup was possible after 32 cpus. Other non-interface CFD applications at the time were demonstrating useful parallel scalability up to 4,096 processors or more. Based on this review, NASA/MSFC initiated an effort to implement a Volume of Fluid implementation within the unstructured mesh, pressure-based algorithm CFD program, Loci-STREAM. After verification was achieved by comparing results to the commercial CFD program CFD-Ace+, and validation by direct comparison with data, Loci-STREAM-VoF is now the production CFD tool for propellant slosh force and slosh damping rate simulations at NASA/MSFC. On these applications, good parallel scalability has been demonstrated for problems sizes of tens of millions of cells and thousands of cpu cores. Ongoing efforts are focused on the application of Loci-STREAM-VoF to predict the transient flow patterns of water on the SLS Mobile Launch Platform in order to support the phasing of water for launch environment mitigation so that vehicle determinantal effects are not realized.
West, Jeff↗
Verifying PLC Programs via Monitors: Extending the Integration of FRET and PLCverif
Verification of Programmable Logic Controller (PLC) programs requires reasoning about propositions qualified in terms of time. CERN’s PLCverif, an open-source tool for the analysis of safety-critical PLC systems, uses Linear Temporal Logic (LTL) for the specification of properties. Until now, PLCverif depended on third-party tools that accept LTL specifications to perform verification. However, our experience with industrial PLC programs shows that, to overcome analysis limitations, a wide range of techniques are needed to successfully verify complex properties. In this paper, we extend PLCverif to enable PLC program verification of pure-past LTL (PLTL) safety properties with assertion-based verification tools. To this end, we take an algorithm from the runtime-monitoring domain, apply it to bounded model checking of PLC programs, and implement it in PLCverif. We extend the integration of NASA’s Formal Requirements Elicitation Tool (FRET) into PLCverif to use PLTL properties generated with FRET. In addition, we leverage the program structure induced by the PLC scan-cycle for a state-space reduction. Finally, we expose the algorithm to a real-world case study of critical systems at CERN.
Formal verification↗
Space station ECLSS integration analysis: Simplified General Cluster Systems Model, ECLS System Assessment Program enhancements
The data base verification of the ECLS Systems Assessment Program (ESAP) was documented and changes made to enhance the flexibility of the water recovery subsystem simulations are given. All changes which were made to the data base values are described and the software enhancements performed. The refined model documented herein constitutes the submittal of the General Cluster Systems Model. A source listing of the current version of ESAP is provided in Appendix A.
Ferguson, R. E.↗
Space Telescope performance and verification
The verification philosophy for the Space Telescope (ST) has evolved from years of experience with multispacecraft programs modified by the new factors introduced by the Space Transportation System. At the systems level of test, the ST will undergo joint qualification/acceptance tests with environment simulation using Lockheed's large spacecraft test facilities. These tests continue the process of detecting workmanship defects and module interface incompatibilities. The test program culminates in an 'all up' ST environmental test verification program resulting in a 'ready to launch' ST.
Wright, W. F.↗
Automata-Based Verification of Temporal Properties on Running Programs
This paper presents an approach to checking a running program against its Linear Temporal Logic (LTL) specifications. LTL is a widely used logic for expressing properties of programs viewed as sets of executions. Our approach consists of translating LTL formulae to finite-state automata, which are used as observers of the program behavior. The translation algorithm we propose modifies standard LTL to Buchi automata conversion techniques to generate automata that check finite program traces. The algorithm has been implemented in a tool, which has been integrated with the generic JPaX framework for runtime analysis of Java programs.
Giannakopoulou, Dimitra↗
Man-rated flight software for the F-8 DFBW program
The design, implementation, and verification of the flight control software used in the F-8 DFBW program are discussed. Since the DFBW utilizes an Apollo computer and hardware, the procedures, controls, and basic management techniques employed are based on those developed for the Apollo software system. Program assembly control, simulator configuration control, erasable-memory load generation, change procedures and anomaly reporting are discussed. The primary verification tools are described, as well as the program test plans and their implementation on the various simulators. Failure effects analysis and the creation of special failure generating software for testing purposes are described.
Bairnsfather, R. R.↗
Nuclear Engine System Simulation (NESS) version 2.0
The topics are presented in viewgraph form and include the following; nuclear thermal propulsion (NTP) engine system analysis program development; nuclear thermal propulsion engine analysis capability requirements; team resources used to support NESS development; expanded liquid engine simulations (ELES) computer model; ELES verification examples; NESS program development evolution; past NTP ELES analysis code modifications and verifications; general NTP engine system features modeled by NESS; representative NTP expander, gas generator, and bleed engine system cycles modeled by NESS; NESS program overview; NESS program flow logic; enabler (NERVA type) nuclear thermal rocket engine; prismatic fuel elements and supports; reactor fuel and support element parameters; reactor parameters as a function of thrust level; internal shield sizing; and reactor thermal model.
Pelaccio, Dennis G.↗
Gateway Humanity's First Space Station to Orbit the Moon
Overview of Gateway Program and discussion of Test and Verification approaches used on the Program.
Gateway Verification Validation Test↗
Aspect-Oriented Monitoring of C Programs
The paper presents current work on extending ASPECTC with state machines, resulting in a framework for aspect-oriented monitoring of C programs. Such a framework can be used for testing purposes, or it can be part of a fault protection strategy. The long term goal is to explore the synergy between the fields of runtime verification, focused on program monitoring, and aspect-oriented programming, focused on more general program development issues. The work is inspired by the observation that most work in this direction has been done for JAVA, partly due to the lack of easily accessible extensible compiler frameworks for C. The work is performed using the SILVER extensible attribute grammar compiler framework, in which C has been defined as a host language. Our work consists of extending C with ASPECTC, and subsequently to extend ASPECTC with state machines.
runtime verifications↗