Results for “Risk Management Framework” — Page 15

DOE OSTI2020

Enhancement of risk informed validation framework for external hazard scenario

In recent years, the U.S. Nuclear Regulatory Commission (USNRC) and the International Atomic Energy Agency (IAEA) have developed methodologies to assess the vulnerabilities of nuclear plants against site specific extreme hazards. In many cases, advanced simulation tools are being considered to simulate multi-physics, multi-scale phenomena and to evaluate vulnerability of nuclear facilities. The credibility of advanced simulation tools is assessed based on a formal verification, validation, and uncertainty quantification procedure. One of the key limitations in validation is the lack of relevant experimental data at system-level. This limitation leads to a decrease in the confidence of system-level risk predictions. Therefore, a robust validation framework is needed to formalize the confidence in predictive capability of advanced simulation results. Additionally, this study enhances the existing risk informed validation methodology, originally proposed by Kwag et al. [1] and Bodda et al. [2], by developing additional attributes and a new set of validation indicies for a complete and wider applicability of the framework. In this manuscript, the methodology to identify the critical path that leads to the system-level failure is illustrated. The overall validation is checked for completeness and consistency by comparing the critical path for both the system-level simulation and experimental models. The applicability of the code for an intended application is represented in terms of various maturity levels and helps in the process of decision making.

42 ENGINEERING↗

DOE OSTI2026

Noise-aware optimization in nominally identical manufacturing and measuring systems for high-throughput parallel workflows

Device-to-device variability in experimental noise critically impacts reproducibility, especially in automated, high-throughput systems like additive manufacturing farms. While manageable in small labs, such variability can escalate into serious risks at larger scales, such as architectural 3D printing, where noise may cause structural or economic failures. This contribution presents a noise-aware decision-making algorithm that quantifies and models device-specific noise profiles to manage variability adaptively. It uses distributional analysis and pairwise divergence metrics with clustering to choose between single-device and robust multi-device Bayesian optimization strategies. Unlike conventional methods that assume homogeneous devices or enforce generic robustness, the proposed framework explicitly determines whether shared optimization across devices is appropriate based on the degree of inter-device noise heterogeneity. This enables improved performance, reproducibility, and efficiency. An experimental case study involving three nominally identical 3D printers (same brand, model, and close serial numbers) demonstrates reduced redundancy, lower resource usage, and improved reliability, along with improved convergence stability and solution quality through the selection of the appropriate optimization strategy based on the degree of inter-device noise heterogeneity. Overall, this framework establishes a general approach for precision- and resource-aware optimization in scalable, automated experimental platforms, demonstrated here on a representative multi-device 3D printing case study.

Schenk, Christina↗

DOE OSTI2026

SDN-Based Smart Cyber Switching (SCS) for Cyber Restoration of a Digital Substation

In recent years, critical infrastructure and power grids have increasingly been targets of cyber-attacks, causing widespread and extended blackouts. Digital substations are particularly vulnerable to such cyber incursions, jeopardizing grid stability. This paper addresses these risks by proposing a cybersecurity framework that leverages software-defined networking (SDN) to bolster the resilience of substations based on the IEC- 61850 standard. The research introduces a strategy involving smart cyber switching (SCS) for mitigation and concurrent intelligent electronic device (CIED) for restoration, ensuring ongoing operational integrity and cybersecurity within a substation. The SCS framework improves the physical network’s behavior (i.e., leveraging commercial SDN capabilities) by incorporating an adaptive port controller (APC) module for dynamic port management and an intrusion detection system (IDS) to detect and counteract malicious IEC-61850-based sampled value (SV) and generic object-oriented system event (GOOSE) messages within the substation’s communication network. The framework’s effectiveness is validated through comprehensive simulations and a hardware-in-the-loop (HIL) testbed, demonstrating its ability to sustain substation operations during cyber-attacks and significantly improve the overall resilience of the power grid.

Liu, Chen-Ching (ORCID:0000000289417958)↗

DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In anticipation of improved energy performance and cost savings, cities and building owners are increasingly considering “smart lighting initiatives” that aim to convert their collection of simple luminaires (i.e., lighting fixtures) into an intelligent connected lighting system (CLS) capable of remotely monitoring energy consumption and fault conditions, and possibly implementing adaptive lighting schemes. The U.S. Department of Energy (DOE) has set an national goal of tripling the energy efficiency and demand flexibility of the buildings sector by 2030, relative to 2020 levels 1. It is forecast that connected lighting systems can contribute to that goal by delivering 125 TWh of annual energy savings by 2035 2, equivalent to the annual output of 50 typical (500 MW) power plants. However, these energy savings and the DOE goal are put at significant risk if connected technologies are not adopted due to real or perceived cybersecurity concerns. Connected IoT devices such as these have historically been rife with vulnerabilities which sometimes put security considerations secondary to functionality and operability. What are the cybersecurity threats that will impact these systems, as formerly banal luminaires transition into intelligent connected devices that collect information about themselves, their surrounding environment, and possibly us? In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement. Fifty-seven threats were identified. Among our key findings: (1) 65% (37/57) of the threats did not involve the luminaires, but rather the other components needed to communicate with and manage them; (2) 63% (36/57) of the threats could have been mitigated through manufacturer-implemented defensive techniques or “controls”; and (3) 23% (13/57) of the threats were dependent on the network configuration. Recommendations based on the results of this work are made to key stakeholder groups. Notably, lighting technology developers are advised to address all threats that can be reasonably controlled with baked-in technology solutions (e.g., encryption or authentication controls), and employ some form of secure supply chain management and tracking where other parts (e.g., sensors, microprocessors) of a luminaire must also be built and manufactured with the proper security controls in place. Developers should also review threats involving assets not developed in-house to understand how connectivity with other devices will affect their product during system operation and determine if a compensating control for a defense-in-depth strategy will be needed. Finally, those interested in deploying CLS should compare the differences between cloud and on-premise models to determine which is more suitable for their needs and the abilities of their security team.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2022

Quantifying the effect of multiple load flexibility strategies on commercial building electricity demand and services via surrogate modeling

The expansion of commercial building demand response as a demand-side management resource for the electric grid necessitates new decision support resources for customers seeking to assess the benefit–risk tradeoffs of possible strategies for energy flexible building operations. To address this need, we, in this study, develop surrogate models that predict the impacts of several load flexibility strategies on commercial building electricity demand and indoor temperature, focusing on offices and retail buildings at multiple scales. The surrogate models are fit to a synthetic database generated via whole building simulations, which establish the relationships between the key operational features of a given strategy and potential changes in building demand and temperature across a variety of contexts. The surrogate models are translated to a Bayesian framework to allow straightforward communication of uncertainty and parameter updating given new evidence. We find strong predictive performance across the suite of models, underscoring the usefulness of the approach in guiding decisions about implementing load flexibility strategies under a particular set of operational and environmental conditions.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2023

Toward Reaching a Consensus on the Concept of Power System Resilience: Definitions, Assessment Frameworks, and Metrics

Not Available

24 POWER TRANSMISSION AND DISTRIBUTION↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek A Whitman↗

NASA NTRS2023

Adaptive Independent Verification and Validation (IV&V) Reduces Risk of Software Impacting Safety in Artemis Missions

The National Aeronautics and Space Administration (NASA) is asking more of its human spaceflight programs than ever before through the collective Artemis Missions. The NASA Independent Verification and Validation (IV&V) Program contributes to NASA’s human spaceflight goals by providing IV&V services for NASA’s critical spacecraft and ground software. The IV&V Program is tasked with providing assurance from both individual and integrated mission software perspectives. The Artemis IV&V organization is actively supporting six distinct development efforts: Orion, the Space Launch System (SLS), Exploration Ground Systems (EGS), Mission Control Center (MCC), the Lunar Gateway, and the Human Landing System (HLS), representing a wide diversity of developer organizations, management structures, and development approaches. With much of this extremely complex flight and ground software being essential to human safety both on the ground and in space, Artemis IV&V is likewise challenged to provide more value-added assurance to future Artemis missions within a constrained budget. To meet this challenge, Artemis IV&V employs a variety of novel and evolving “Adaptive IV&V” approaches for planning and executing IV&V analysis to increase both the efficiency and effectiveness of the IV&V Program’s assurance activities, and to address the difficulties imposed by assuring software for a large, highly integrated, multi-mission enterprise managed and executed by physically and organizationally distinct programs. Instilling agile principles like iterative planning cycles, self-organizing teams, and regular retrospectives, into IV&V planning and execution has led to a more rapid turnaround of a minimum viable assurance product and allowed for increased alignment of assurance activities with development progress. Adopting an assurance case methodology has led to greater consistency and clearer communication of assurance design and provided a foundation for long-term maintenance of assurance plans, products, and results across missions. The IV&V-developed Assurance / Safety Case Analytical Network (A-SCAN) framework and tool has enabled the quantification and tracking of system/software risk and confidence. These confidence measures provide a means to repeatedly express the impact of planned and completed assurance work and the remaining residual risk. Applied as part of a “Follow-the-Risk” organizational ethos, this allows consistent rightsizing of analysis rigor and intensity commensurate with the perceived risk of defects, as well as appropriate targeting of the highest risk areas of the software to find safety issues before they can manifest. Finally, the development of the IV&V Advanced Risk Reduction Integrated Software Test and Operations Tri-program Lightweight Environment (ARRISTOTLE), an integrated software-only simulation of Orion, SLS, and EGS systems, has made it possible to independently test integrated pad and flight scenarios and inject faults to observe how the Artemis multi-program, mission software behaves in degraded modes and in response to hazards. These adaptive IV&V investments have enabled Artemis IV&V to become more efficient and effective in IV&V planning and execution and respond more readily to changes in the risk landscape, increasing the breadth and depth of risk reduction possible within the available resources. Residual risk tracking allows IV&V to communicate more effectively with stakeholders, both internal and external at all levels, and inform key decision-making personnel. This evolving assurance design approach provides IV&V surety that work is performed in the highest risk, most value-added areas of the software, to keep our astronauts and ground crews safe and ensure mission success.

Gerek Whitman↗

DOE OSTI2022

An Integrated Framework for Risk Assessment of High Safety Significant Safety-related Digital Instrumentation and Control Systems in Nuclear Power Plants: Methodology and Demonstration

This report documents the activities performed by Idaho National Laboratory (INL) during Fiscal Year (FY) 2022 for the U.S. Department of Energy (DOE) Light Water Reactor Sustainability (LWRS) Program, Risk Informed Systems Analysis (RISA) Pathway, digital instrumentation and control (DI&C) risk assessment project. In FY 2019, the RISA Pathway initiated a project to develop a risk assessment strategy for delivering a technical basis to support effective and secure DI&C technologies for digital upgrades/designs. A framework was proposed for this strategy, which aims to (1) provide a best-estimate, risk-informed capability to quantitatively and accurately estimate the risk impact of plant modernization, considering the introduction of high safety-significant safety-related (HSSSR) DI&C systems, (2) support and supplement existing risk-informed DI&C design guides by providing quantitative risk information and evidence, (3) offer a capability of design architecture evaluation of various DI&C systems, (4) assure the long-term safety and reliability of HSSSR DI&C systems, and (5) reduce uncertainty in costs and support integration of DI&C systems in the plant. To achieve these technical goals, the framework provides a means to address relevant technical issues by: (1) defining a risk-informed analysis process for DI&C upgrade, that integrates hazard analysis, reliability analysis, and consequence analysis, (2) applying risk-informed tools to address common cause failures (CCFs) and quantify corresponding failure probabilities for DI&C technologies, particularly software CCFs, (3) evaluating the impact of digital failures at the component level, system level, and plant level, and (4) providing insights and suggestions on designs to manage the risks, thus to support the development and deployment of advanced DI&C technologies on nuclear power plant (NPPs).

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗

DOE OSTI2026

Poster: Responsible Adoption of Artificial Intelligence (AI) in Electric Grid Operations

The rapid integration of artificial intelligence (AI) in the utility transmission and distribution (T&D) sector is revolutionizing traditional grid management practices. As utilities encounter complexities from evolving consumer behaviors and energy integration, AI becomes a critical solution for enhancing grid monitoring, fault detection, and operational optimization. However, increased reliance on interconnected technologies introduces significant cybersecurity risks, regulatory compliance challenges, and human factors concerns. This study proposes a strategic, responsible and consequence-driven approach to AI implementation, examining the dual nature of AI adoption by highlighting its transformative benefits for utilities and associated risks. It provides utilities with a framework for evaluating AI integration, enabling them to navigate challenges and capitalize on opportunities to achieve greater reliability, efficiency, and resilience in an increasingly complex energy landscape.

24 - POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2024

Overview and Commentary on Applying the Coordinated Vulnerability Disclosure Process to Photovoltaic System Devices

The rapid expansion of photovoltaic (PV) systems, particularly inverters, has introduced new cybersecurity challenges that threaten both local operations as well as the broader electrical grid’s stability. PV inverters, integrated into critical energy infrastructure are potential targets for cyber attacks due to vulnerabilities in firmware, remote access systems, and communication protocols. The Coordinated Vulnerability Disclosure (CVD) process, as defined by the Cybersecurity and Infrastructure Security Agency (CISA), provides a framework for identifying, reporting, and addressing these vulnerabilities in a transparent and collaborative manner. This report outlines the CVD process as it applies to PV systems, detailing the roles of key stakeholders, such as manufacturers, grid operators, and security researchers. The report also highlights specific challenges in managing vulnerabilities for new and legacy PV systems, which includes those introduced by insecure communications and third-party supply chain components. By adhering to the CVD process, the PV industry can mitigate cybersecurity risks, ensure regulatory compliance, and maintain consumer trust, while safeguarding the operational resilience of the energy grid. Ultimately, the effective coordination of vulnerability management is crucial for securing the future of PV systems within the critical electric grid infrastructure landscape.

14 SOLAR ENERGY↗

NASA NTRS2022

Systemic Risk

Systemic risk is the name given to impacts that spread within and across systems and sectors (e.g. ecosystems, health, infrastructure and the food sector) via the movements of people, goods, capital and information within and across boundaries (e.g. regions, countries and continents). The spread of these impacts can lead to potentially existential consequences and system collapse across a range of time horizons. Globalization contributes to systemic risk affecting people worldwide. The impacts of climate change or COVID-19 show how the challenges of addressing systemic risk go beyond conventional risk management and governance. Critical system interdependencies, amplified by underlying vulnerabilities, highlight that there is a growing need to better understand cascading impacts, systemic risks and the possible political (governance) and societal responses. This includes improving our understanding of the root causes of systemic risk, both biophysical and socio-economic, and related information needs. Addressing contemporary challenges in terms of systemic risk requires integrating different systems perspectives and fostering system thinking, while implementing key intergovernmental agendas, such as the Paris Agreement, the Sendai Framework for Disaster Risk Reduction and the Sustainable Development Goals.

systemic risk↗

NASA NTRSDate not supplied

Human Systems Integration (HSI) Framework and Training - Shifting the View of HSI for Better Implementation

The Implementation of Human Systems Integration (HSI) presents challenges within the acquisition community for two reasons. The first is that misconceptions of HSI still exist, with many Program Managers (PMs) and leadership uncertain of the value or where to begin. The second is due to an unbalanced approach to HSI in its own framework. These implementation challenges lead to barriers in the early prevention of mishaps. Understanding HSI practices and how they should be implemented in the Acquisition Product Life Cycle (PLC) has been a challenge across the government, leaving the value of HSI unknown and misunderstood with Program Managers. In the case for many acquisition programs, HSI is not implemented in early design, losing the perspective on human capabilities and limitations, creating impacts on human-centered design. Expectations in human performance are not clearly set and operations are baselined with no margin for changes in technology and processes that will affect system performance. The HSI framework addresses total system performance holistically using collaboration as the primary tool. The goal is to create a system with efficiencies while minimizing risk to the operators, maintainers, and support personnel, as well as any collateral personnel and systems. To accomplish this, HSI should be implemented as part of preemptive measures to minimize potential human error and mishaps during the operation phase. Investigative and assessment tools exist that consider events, issues, and other outside influences of a system that may not fall under the current construct of the HSI domains, leaving gaps in early HSI implementation and affecting the prevention of human errors and mishaps. This presentation will outline what NASA HSI is doing to support Early HSI implementation and Operational Performance shifts that affect human performance.

Anthony T Thomas↗

DOE OSTI2026

Decision Support System

Forest-based value chains involve decisions that begin at the landscape level and extend through processing, product manufacturing, and end-use markets. However, these decisions are often made independently across sectors, with limited visibility into how upstream resource conditions, incentives, and land management choices influence downstream production systems. In forested regions of the United States, wildfire risk, fragmented ownership, and uncertain markets for low-value residues complicate efforts to align extraction, processing, and utilization decisions. Without tools that link these stages, stakeholders may overlook opportunities to improve resource utilization or inadvertently shift impacts elsewhere in the value chain. This repository introduces a decision support system (DSS) that applies a system-impact-analysis approach to forest biomass residues and co-products. The framework integrates forest inventory data, geospatial resource assessments, and economic modeling to evaluate how biomass extraction decisions influence downstream product pathways. By linking regional feedstock avail- ability with market incentives and processing options—such as fuels, wood products, or soil amendments like biochar—the tool allows decision-makers to compare value chain outcomes across multiple utilization strategies.

Davis, Maggie [Oak Ridge National Laboratory (ORNL↗

DOE OSTI2021

NRAP-Open-IAM Multisegmented Wellbore Reduced-Order Model

Geologic carbon storage is one of the promising strategies to mitigate climate change by reducing the emission of carbon dioxide to the atmosphere. As part of the National Risk Assessment Partnership (NRAP), a systems-level stochastic analysis tool called the open source integrated assessment model, NRAP-Open-IAM, has been developed to estimate and manage the risk of containment loss at a geological carbon sequestration site. NRAP-Open-IAM contains several wellbore leakage model components that estimate the fluid leak rate that may occur through compromised legacy wells due to the increase in pressure resulting from CO 2 injection activities. Coupled to a reservoir component model, these components estimate the leakage of CO 2 and/or brine from a storage reservoir to overlying aquifer layers and the atmosphere through legacy wells. This report presents the theoretical framework and quality testing of the multisegmented wellbore reduced-order model. The model allows for segmenting of the legacy wells passing through the overlying stratigraphy into several intervals to simulate a site’s specific stratigraphic and hydrogeologic properties. For quality assurance, the analytical model is validated against numerical reservoir flow simulations for single and multiple aquifer(s) models. The results indicate that the model accurately predicts the transport of two-phase fluids (brine and injected CO 2 ) through the well over time. A detailed description of the model helps users to understand the model and provides a basis for future improvements.

58 GEOSCIENCES↗

DOE OSTI2022

Toward More Actionable Flood‐Risk Information

Abstract The increasingly urgent need to develop knowledge and practices to manage flood risks drives innovative information design. However, experts often disagree about design practices. As a result, flood‐risk estimates can diverge, leading to different conclusions for decision‐making. Using examples of household‐scale fluvial (riverine) flood‐risk information in the United States, we assess design features and risk communication approaches that may lead to more actionable information for decision‐making. We argue that increased attention to uncertainty characterization and model diagnostics is a critical intermediate step for developing simpler approaches for designing flood‐risk information. Simpler frameworks are desirable because flood risks change over time, and simpler frameworks are less costly to update. Developing frameworks for large spatial domains require collaboration grounded in principles of open science. Finally, systematically evaluating how decision‐makers access and use information can provide new insights to guide risk communication and information design.

54 ENVIRONMENTAL SCIENCES↗

NASA NTRS2021

FRESCO: A Framework for Spacecraft Systems Autonomy

Achieving the science exploration and defense goals of the following decades will require flight systems capable of operations with limited operator contact, system mode changes and retasking based on sensor data, and complex robotic operations. To support these capabilities, increasingly autonomous flight systems are required that can perform dedicated mission functions, e.g. payload targeting and communications, and system-level functions, e.g. planning and goal monitoring. Architecting an autonomous system requires a well-reasoned, self-consistent framework to avoid \textit{ad hoc} design choices that will introduce complexity and risk. The Framework for Robust Execution and Scheduling of Commands On-Board, FRESCO, is the result of lessons learned in developing a software architecture to enable autonomous solar system exploration. FRESCO generalizes this work to offer a modular, software-agnostic approach to developing verifiable architecture for autonomous space systems. FRESCO specifies guiding principles, functions, interfaces, and interactions from which mission-specific autonomous control architectures can be derived. FRESCO is a principled framework relying on explicit, state-based goal definitions, centralized management of state knowledge, clearly separated control boundaries, and hierarchical reasoning. Using components from FRESCO reference architecture, an autonomous decision-making architecture can be designed for spacecraft which can then be mapped to flight software architecture. FRESCO is flexibly defined to enable autonomous control of flight systems built using extensive software and hardware heritage. Finally, FRESCO-derived architectures support a spectrum of operator/spacecraft interactions, ranging from traditional commanding to goal-driven commanding with the ability to change mission goals autonomously. FRESCO has been used in defining the autonomy architectures for the ASTERIA mission and have been demonstrated in laboratory and software simulation for small body rendezvous and in-space servicing missions.

Kolcio, Ksenia↗