Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Pipeline Inspection”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Development of a Testbed for Pipeline Flushing - 20425

Pipelines which carry high-level waste within the DOE complex should be properly flushed in the cases where stationary or moving beds of solid sediment occur, or lines are prone to hydrogen gas buildup. Present guidelines establish a minimum for the amount of water (flush volume) and flush velocity values used for post-transfer flushing operations to achieve satisfactory cleaning of pipelines. However, further studies are needed to find optimal operating velocity modes/values in order to minimizing the flush volume and consequent downstream waste. These efforts are significantly helpful to DOE waste remediation sites by preserving tank storage, preventing additional waste processing, and minimizing dilution and changes in waste chemistry. An experimental test loop was recently developed for study of non-Newtonian slurry flushing at the Florida International University (FIU). This loop was designed to create sediment beds of various materials and bed heights and investigate parameters that effect the efficiency of flushing operations. The objective is to find flush velocity values/modes which lead to satisfactory cleaning of transport lines with a minimum amount of water usage. A 165 ft experimental test loop made of 3-inch carbon steel pipes was constructed and used in initial testing campaigns. This pipe loop was equipped with real-time monitoring instruments to record variation of pressure, density, mass flow rate, and temperature during testing. Post-flush in-situ no-flow evaluations were performed using ultrasonic, endoscopy, and visual inspection. Additional post-flush evaluations were conducted using filtration and density monitoring of residuals within a designated circulations loop. These provisions enable comparison of pipeline cleanness before the start and after termination of flushing operations for efficiency evaluation. This paper presents efforts associated with flushing of kaolin-water mixtures at different concentrations and with various flush volume and flush velocity values/modes. In initial testing, efforts focused on creating repeatable sediment beds inside the pipeline in both fully-flooded (no pre-flush drainage) and gravity-drained (pre-flush drained) systems. Bed characterization (i.e., measurement of sediment height and solids concentration) was conducted to ensure about consistency of initial conditions between tests. Preliminary results for flushing study of 10% vol. kaolin-water mixtures starting from a fully-flooded initial condition showed that flushing with 1-line volume (65 gallons) could remove up to 72 percent of solids from the pipeline. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
NASA NTRS1986

Case histories involving fatigue and fracture mechanics; Proceedings of the Symposium, Charleston, SC, Mar. 21, 22, 1985

Papers are presented on cracking at nozzle corners in the nuclear pressure vessel industry, applied fracture mechanics for assessing defect significance in a crude oil pipeline, failure analysis of a large wind-tunnel compressor blade, analysis of a compressor-wheel failure, and preventing fracture by inspection and analysis. Consideration is also given to the fatigue crack growth predictions of welded aircraft structures containing flaws in the residual stress field, the fatigue and fracture mechanics analysis of a compression loaded aircraft structure, fracture of an aircraft horizontal stabilizer, fatigue life analysis of fuel tank skins under combined loads, and aircraft structural maintenance recommendations based on fracture mechanics analysis. Additional papers discuss an analysis of two metal-forming die failures, an analysis of a failed saw arbor, and the role of fracture mechanics in assessing the effect on fatigue life of design changes in welded fabrications.

Hudson, C. Michael↗
DOE OSTI2023

The DESI Survey Validation: Results from Visual Inspection of Bright Galaxies, Luminous Red Galaxies, and Emission-line Galaxies

The Dark Energy Spectroscopic Instrument (DESI) Survey has obtained a set of spectroscopic measurements of galaxies to validate the final survey design and target selections. To assist in these tasks, we visually inspect DESI spectra of approximately 2500 bright galaxies, 3500 luminous red galaxies (LRGs), and 10,000 emission-line galaxies (ELGs) to obtain robust redshift identifications. We then utilize the visually inspected redshift information to characterize the performance of the DESI operation. Based on the visual inspection (VI) catalogs, our results show that the final survey design yields samples of bright galaxies, LRGs, and ELGs with purity greater than 99%. Moreover, we demonstrate that the precision of the redshift measurements is approximately 10 km s –1 for bright galaxies and ELGs and approximately 40 km s –1 for LRGs. The average redshift accuracy is within 10 km s –1 for the three types of galaxies. The VI process also helps improve the quality of the DESI data by identifying spurious spectral features introduced by the pipeline. Finally, we show examples of unexpected real astronomical objects, such as Ly α emitters and strong lensing candidates, identified by VI. These results demonstrate the importance and utility of visually inspecting data from incoming and upcoming surveys, especially during their early operation phases.

79 ASTRONOMY AND ASTROPHYSICS↗
DOE OSTI2026

Deep Learning and Photogrammetric Reconstruction for Automated Crack Detection and Dimensional Measurement in Mining Operations

Surface crack detection and dimensional measurement at active mining sites present significant safety and operational challenges. Manual inspection methods are labor-intensive, spatially incomplete, and expose personnel to hazardous environments, while existing automated approaches have been developed primarily for concrete civil infrastructure and have not been validated on the complex, variable surfaces characteristic of mining environments. This dissertation presents an automated pipeline that integrates deep learning semantic segmentation with Structure-from-Motion photogrammetry to detect surface cracks and measure their aperture, length, and vertical displacement from standard RGB imagery acquired during routine Uncrewed Aerial Vehicle (UAV) survey operations, without requiring additional sensor hardware or manual measurement. The pipeline combines a U-Net architecture with an EfficientNet-B0 encoder, pretrained on the SDNET2018 concrete crack dataset and fine-tuned on a mining-specific dataset spanning laboratory concrete specimens, coal refuse impoundment embankments, and post-blast limestone quarry benches. Photogrammetric reconstruction is performed using COLMAP Structure-from-Motion and Multi-View Stereo, with crack segmentation masks projected into the reconstructed point cloud to enable three-dimensional vertical displacement measurement through local plane fitting and bimodal surface detection. The pipeline was validated across 36 controlled laboratory specimens at three imaging distances and four vertical displacement levels, achieving aperture measurement RMSE of 0.047 cm and R² of 0.954, and vertical displacement RMSE of 0.140 cm and R² of 0.966, against independent caliper measurements. Field application at a coal refuse impoundment in southwestern Pennsylvania detected 71 crack components across the embankment crest, with a dominant longitudinal crack exhibiting aperture values reaching 28 cm and a 95th percentile vertical displacement of 35.53 cm, consistent in magnitude and spatial distribution with simultaneously acquired LiDAR-derived estimates. Application across four post-blast limestone quarry bench datasets in California successfully characterized blast-induced fracture networks at ground sampling distances ranging from 0.59 to 1.23 cm/pixel, with detected crack geometries physically consistent with observable surface conditions at each site. The results demonstrate that deep learning-based crack detection and photogrammetric measurement can be integrated into routine UAV inspection workflows at mining sites, providing repeatable, scalable, and quantitative crack characterization across surface types, crack scales, and displacement magnitudes not previously addressed in the literature. The pipeline requires no dedicated surveying equipment beyond the UAV platforms already deployed at mine sites for survey and monitoring purposes, supporting practical adoption within existing operational workflows.

Crack detection, Dimensional Measurement↗
DOE OSTI2024

RG-CAT: Detection pipeline and catalogue of radio galaxies in the EMU pilot survey

Abstract We present source detection and catalogue construction pipelines to build the first catalogue of radio galaxies from the 270$\rm deg^2$pilot survey of the Evolutionary Map of the Universe (EMU-PS) conducted with the Australian Square Kilometre Array Pathfinder (ASKAP) telescope. The detection pipeline uses Gal-DINO computer vision networks (Gupta et al. 2024, PASA, 41, e001) to predict the categories of radio morphology and bounding boxes for radio sources, as well as their potential infrared host positions. The Gal-DINO network is trained and evaluated on approximately 5 000 visually inspected radio galaxies and their infrared hosts, encompassing both compact and extended radio morphologies. We find that the Intersection over Union (IoU) for the predicted and ground-truth bounding boxes is larger than 0.5 for 99% of the radio sources, and 98% of predicted host positions are within$3^{\prime \prime}$of the ground-truth infrared host in the evaluation set. The catalogue construction pipeline uses the predictions of the trained network on the radio and infrared image cutouts based on the catalogue of radio components identified using theSelavysource finder algorithm. Confidence scores of the predictions are then used to prioritiseSelavycomponents with higher scores and incorporate them first into the catalogue. This results in identifications for a total of 211 625 radio sources, with 201 211 classified as compact and unresolved. The remaining 10 414 are categorised as extended radio morphologies, including 582 FR-I, 5 602 FR-II, 1 494 FR-x (uncertain whether FR-I or FR-II), 2 375 R (single-peak resolved) radio galaxies, and 361 with peculiar and other rare morphologies. Each source in the catalogue includes a confidence score. We cross-match the radio sources in the catalogue with the infrared and optical catalogues, finding infrared cross-matches for 73% and photometric redshifts for 36% of the radio galaxies. The EMU-PS catalogue and the detection pipelines presented here will be used towards constructing catalogues for the main EMU survey covering the full southern sky.

Astronomy & Astrophysics↗
DOE OSTI2025

Pose Estimation for the Inspecta Project

In this addendum report we take the lessons learned from our initial generic object pose estimation research described in (Smartt, et al., 2025) and apply it to metal cup seals, which are attached to items after an international nuclear safeguards inspection (i.e., metal cup seals may be attached to containers of spent nuclear fuel after an inspector has measured and verified the material). We have also refined our software pipeline and training techniques since the final Inspecta report and will describe that process here. The objective of this task is to allow a robot to acquire images of the engraved seal characters to confirm that the correct seal is attached to the correct container. However, the seal may be attached in any orientation and therefore the robot manipulator arm with a camera needs to align with the normal face of the seal.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2023

Detecting and Characterizing Mg ii Absorption in DESI Survey Validation Quasar Spectra

Abstract We present findings of the detection of Magnesium II (Mg ii , λ = 2796, 2803 Å) absorbers from the early data release of the Dark Energy Spectroscopic Instrument (DESI). DESI is projected to obtain spectroscopy of approximately 3 million quasars (QSOs), of which over 99% are anticipated to be at redshifts greater than z > 0.3, such that DESI would be able to observe an associated or intervening Mg ii absorber illuminated by the background QSO. We have developed an autonomous supplementary spectral pipeline that detects these systems through an initial line-fitting process and then confirms the line properties using a Markov Chain Monte Carlo sampler. Based upon a visual inspection of the resulting systems, we estimate that this sample has a purity greater than 99%. We have also investigated the completeness of our sample in regard to both the signal-to-noise properties of the input spectra and the rest-frame equivalent width ( W 0 ) of the absorber systems. From a parent catalog containing 83,207 quasars, we detect a total of 23,921 Mg ii absorption systems following a series of quality cuts. Extrapolating from this occurrence rate of 28.8% implies a catalog at the completion of the five-year DESI survey that will contain over eight hundred thousand Mg ii absorbers. The cataloging of these systems will enable significant further research because they carry information regarding circumgalactic medium environments, the distribution of intervening galaxies, and the growth of metallicity across the redshift range 0.3 ≤ z < 2.5.

79 ASTRONOMY AND ASTROPHYSICS↗
DOE OSTI2025

Knowledge Transfer Program for International Nuclear Safeguards

Nuclear safeguards were first announced in 1945 by the U.S., Canadian and British governments as a means to exchange scientific information about peaceful uses of atomic energy and prevent the use of nuclear material for weapons. International nuclear safeguards, now under the provision of the International Atomic Energy Agency (IAEA), serves to hold accountable the 140 member countries (States) that have entered into treaties and agreements against the spread of nuclear weapons. Most notably, the IAEA acts as a nuclear materials inspectorate under the global Nuclear Non-Proliferation Treaty, brought about in 1968, that specifies commitments member States make to the world?s non-proliferation regime. The Office of International Nuclear Safeguards (OINS) is part of the National Nuclear Security Administration, a semi-autonomous agency within the U.S. Department of Energy. Within OINS, the Human Capital Development program recognizes the need to build workforce capacity and safeguards expertise. This includes supporting the education and training of younger generations working in international nuclear safeguards. One of the program?s main concerns is core competencies being lost to retirement or attrition and building knowledge retention pipelines from senior to new professionals. One identified core competency is knowledge gained by individuals who have completed IAEA assignments such as missions to member States to conduct safeguards inspections. Such individuals possess unique knowledge, and efforts are being put forth to effectively capture this knowledge within the national laboratories complex. To this end, we report findings from a one-year mentor-mentee knowledge retention program in which an international safeguards subject matter expert imparted knowledge and skills to a willing professional mentee. The knowledge and skills stem from the mentor?s multi-year assignment at the IAEA in Vienna, Austria.

98 - NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL↗
DOE OSTI2022

A Search of the Full Six Years of the Dark Energy Survey for Outer Solar System Objects

We present a search for outer solar system objects in the 6 yr of data from the Dark Energy Survey (DES). The DES covered a contiguous 5000 deg 2 of the southern sky with ≈80,000 3 deg 2 exposures in the grizY filters between 2013 and 2019. This search yielded 812 trans-Neptunian objects (TNOs), one Centaur and one Oort cloud comet, 458 reported here for the first time. We present methodology that builds upon our previous search on the first 4 yr of data. All images were reprocessed with an optimized detection pipeline that leads to an average completeness gain of 0.47 mag per exposure, as well as improved transient catalog production and algorithms for linkage of detections into orbits. All objects were verified by visual inspection and by the “sub-threshold significance,” the signal-to-noise ratio in the stack of images in which its presence is indicated by the orbit, but no detection was reported. This yields a pure catalog complete to r ≈ 23.8 mag and distances 29 < d < 2500 au. The TNOs have minimum (median) of 7 (12) nights’ detections and arcs of 1.1 (4.2) yr, and will have grizY magnitudes available in a further publication. We present software for simulating our observational biases for comparisons of models to our detections. Initial inferences demonstrating the catalog’s statistical power are: the data are inconsistent with the CFEPS-L7 model for the classical Kuiper Belt; the 16 “extreme” TNOs (a > 150 au, q > 30 au) are consistent with the null hypothesis of azimuthal isotropy; and nonresonant TNOs with q > 38 au, a > 50 au show a significant tendency to be sunward of major mean-motion resonances.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2026

Identifying Anomalous DESI Galaxy Spectra with a Variational Autoencoder

The tens of millions of spectra being captured by the Dark Energy Spectroscopic Instrument (DESI) provide tremendous discovery potential. In this work we show how Machine Learning, in particular Variational Autoencoders (VAE), can detect anomalies in a sample of approximately 200,000 DESI spectra comprising galaxies, quasars and stars. We demonstrate that the VAE can compress the dimensionality of a spectrum by a factor of 100, while still retaining enough information to accurately reconstruct spectral features. We then detect anomalous spectra as those with high reconstruction error and those which are isolated in the VAE latent representation. The anomalies identified fall into two categories: spectra with artefacts and spectra with unique physical features. Awareness of the former can help to improve the DESI spectroscopic pipeline; whilst the latter can lead to the identification of new and unusual objects. To further curate the list of outliers, we use the Astronomaly package which employs Active Learning to provide personalised outlier recommendations for visual inspection. In this work we also explore the VAE latent space, finding that different object classes and subclasses are separated despite being unlabelled. We demonstrate the interpretability of this latent space by identifying tracks within it that correspond to various spectral characteristics. For example, we find tracks that correspond to increasing star formation and increase in broad emission lines along the Balmer series. In upcoming work we hope to apply the methods presented here to search for both systematics and astrophysically interesting objects in much larger datasets of DESI spectra.

Nicolaou, C. [University Coll. London] (ORCID:0000↗
DOE OSTI2023

When Spectral Modeling Meets Convolutional Networks: A Method for Discovering Reionization-era Lensed Quasars in Multiband Imaging Data

Over the last two decades, around 300 quasars have been discovered at z ≳ 6, yet only one has been identified as being strongly gravitationally lensed. We explore a new approach—enlarging the permitted spectral parameter space, while introducing a new spatial geometry veto criterion—which is implemented via image-based deep learning. We first apply this approach to a systematic search for reionization-era lensed quasars, using data from the Dark Energy Survey, the Visible and Infrared Survey Telescope for Astronomy Hemisphere Survey, and the Wide-field Infrared Survey Explorer. Our search method consists of two main parts: (i) the preselection of the candidates, based on their spectral energy distributions (SEDs), using catalog-level photometry; and (ii) relative probability calculations of the candidates being a lens or some contaminant, utilizing a convolutional neural network (CNN) classification. The training data sets are constructed by painting deflected point-source lights over actual galaxy images, to generate realistic galaxy–quasar lens models, optimized to find systems with small image separations, i.e., Einstein radii of θ E ≤ 1''. Visual inspection is then performed for sources with CNN scores of P lens > 0.1, which leads us to obtain 36 newly selected lens candidates, which are awaiting spectroscopic confirmation. These findings show that automated SED modeling and deep learning pipelines, supported by modest human input, are a promising route for detecting strong lenses from large catalogs, which can overcome the veto limitations of primarily dropout-based SED selection approaches.

High-redshift galaxies↗
DOE OSTI2023

RTN-055: Study of the Linearity of the CCDs of the Vera C. Rubin Observatory

We show our exploration of sets of PTC data for different detectors of the LSSTCam, and inspect how it deviates from polynomial and exponential fits. We present a tutorial on how to connect to the Rubin Science Platform and access the notebooks and other project files. Then we present the approach taken to work with the LSST Science Pipeline's linearizer algorithm and the results obtained by varying the parameters involved in the different fits that can be used.

79 ASTRONOMY AND ASTROPHYSICS↗
DOE OSTI2020

A secure measurement unit for an inspection system used in nuclear arms-control verification

Verification of arms control treaties may require information barriers to protect sensitive data acquired during the verification process. These information barriers are commonly implemented in software, but must store and operate on data that are vulnerable to attack and tampering. Here, we present a new Secure Measurement Unit based on a modified pipeline SAR ADC architecture. The idea is to move the information barrier back into the digitization process so that prohibited data is never created. A prototype 65nm CMOS Secure Measurement Unit (SMU) was tested using U-235, U-238, Co-60, Cs-137 and Am-241 sources. Here, the prototype accurately digitized allowable signals while being immune to side-channel attacks on signals within preset forbidden regions.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2026

LeWRON: Agentic Analysis of Electroweak Phase Transitions

The electroweak phase transition (EWPT) is a central topic in particle physics and cosmology, connecting collider phenomenology, baryogenesis, and gravitational-wave observatories. Its analysis requires a technically demanding, convention-sensitive, and model-dependent pipeline, from constructing the finite-temperature effective potential to tracking thermal histories, computing bubble nucleation rates, and predicting gravitational-wave spectra. We present LeWRON (Learning ElectroWeak phase tRansitiON), an agentic framework that orchestrates this pipeline starting from an input Lagrangian. LeWRON combines audited toolbox construction with an Explorer module that uses the generated model-specific code for further analysis, including scans and plots. Intermediate analytic outputs are checked by auditor agents and stored as structured artifacts, enabling reproducible human inspection and downstream use through both a command-line interface and a public Python API. The framework supports a reproduction mode, which infers conventions from the literature and reproduces published results, and a discovery mode, which guides users through structured checkpoints for new models. We demonstrate LeWRON across representative beyond-the-Standard-Model scenarios and release the code on GitHub.

Wang, Isaac R. [Fermilab] (ORCID:000000030789218X)↗
DOE OSTI2025

Sim2Real Autonomous Robotic Exploration [Poster]

Autonomous robots offer promising solutions for exploration in environments that are inaccessible or hazardous to humans. Despite this, physical training of such robots is often constrained by safety risks, high cost or limited accessibility. This project presents an end-to-end simulation to reality pipeline leveraging Nvidia Isaac Sim and Boston Dynamics' Spot to enable autonomous navigation in indoor environments. A reinforcement learning policy is first trained using Nvidia Isaac Lab to establish Spot's locomotion pattern. Virtual LiDAR sensors are then integrated to perform SLAM-based navigation using simulated odometry. Finally, the simulated navigation scheme is transferred to a physical Spot robot to inspect and record images of a real-world room by repeating the learnt trajectory. The proposed framework highlights the potential of scalable training in simulation and reliable deployment in physical environments. Future directions include dynamic trajectory generation in unseen and challenging environments and integration of environmental sensing like temperature, radiation or humidity via sensor and material simulation.

97 - MATHEMATICS AND COMPUTING↗
DOE OSTI2026

Vulcan-Forge: Architecture and Design of a Multi-Modal Forensic Analysis Plugin for CALDERA

Forge and VULCAN together describe an open-architecture cybersecurity analysis ecosystem that unifies forensic artifact processing, detection engineering, and vulnerability intelligence within integrated platforms. Forge operates as a plugin for MITRE CALDERA, ingesting diverse evidence formats—including EVTX, PCAP/PCAPNG, CSV, JSON, YAML, XML, binaries, and archives—to construct a unified artifact graph enriched with severity scoring, TLP classification, and audit trails. It provides subsystems for artifact parsing, streaming structured-data visualization, NetworkMiner-based packet inspection, PE/.NET binary analysis, and LLM-assisted triage and rule generation, with outputs validated against CCCS-YARA and pySigma schemas. VULCAN complements this by serving as a cybersecurity analyst platform that integrates a Neo4j knowledge graph, Qdrant vector retrieval, SSVC-based triage, and a local LLM to deliver CVE intelligence and forensic analysis through a multi-source ingest pipeline drawing from NVD, CISA KEV, EPSS, MITRE ATT&CK, and CAPEC. Together, they bridge structured threat intelligence with automated forensic analysis and detection workflows.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2019

Creating Data-Driven Vector Visualizations of Satellite Orbit Tracks Using NASA GIBS and Worldview

NASA Earth Observing System (EOS) currently operates dozens of remote sensing satellites, many of which can be viewed directly in NASA’s open-source Worldview application. Much of this satellite imagery can be viewed in near-real time as it is processed and served by NASA’s Global Imagery Browse Service (GIBS). To better educate users on the time and location of imagery, GIBS serves orbit track specific layers for each satellite. Worldview has historically served these layers as raster images but recent updates have enabled the application to now serve these layers using vector tiles. With the release of Worldview v3.0, orbit track layers can be displayed using mapbox vector tiles (MVT). This visualization format allows users to not only view and change the color of orbit track layers, as they could do previously with rasters, but also inspect individual vector points and filter layers by specific parameters such as time. The data contained within a MVT is further enhanced in Worldview with the combination of a JSON description file served from GIBS used to describe the MVT data. This presentation will provide an overview of the process of consuming orbit track vector tiles and data files from GIBS using a pipeline to configure, build and ultimately display the orbit tracks in Worldview. Furthermore, the presentation aims to describe how others can leverage our open-source code to display and enhance vector layers in their own applications.

Rice, Zachary↗
NASA NTRS2005

Formal Safety Certification of Aerospace Software

In principle, formal methods offer many advantages for aerospace software development: they can help to achieve ultra-high reliability, and they can be used to provide evidence of the reliability claims which can then be subjected to external scrutiny. However, despite years of research and many advances in the underlying formalisms of specification, semantics, and logic, formal methods are not much used in practice. In our opinion this is related to three major shortcomings. First, the application of formal methods is still expensive because they are labor- and knowledge-intensive. Second, they are difficult to scale up to complex systems because they are based on deep mathematical insights about the behavior of the systems (t.e., they rely on the "heroic proof"). Third, the proofs can be difficult to interpret, and typically stand in isolation from the original code. In this paper, we describe a tool for formally demonstrating safety-relevant aspects of aerospace software, which largely circumvents these problems. We focus on safely properties because it has been observed that safety violations such as out-of-bounds memory accesses or use of uninitialized variables constitute the majority of the errors found in the aerospace domain. In our approach, safety means that the program will not violate a set of rules that can range for the simple memory access rules to high-level flight rules. These different safety properties are formalized as different safety policies in Hoare logic, which are then used by a verification condition generator along with the code and logical annotations in order to derive formal safety conditions; these are then proven using an automated theorem prover. Our certification system is currently integrated into a model-based code generation toolset that generates the annotations together with the code. However, this automated formal certification technology is not exclusively constrained to our code generator and could, in principle, also be integrated with other code generators such as RealTime Workshop or even applied to legacy code. Our approach circumvents the historical problems with formal methods by increasing the degree of automation on all levels. The restriction to safety policies (as opposed to arbitrary functional behavior) results in simpler proof problems that can generally be solved by fully automatic theorem proves. An automated linking mechanism between the safety conditions and the code provides some of the traceability mandated by process standards such as DO-178B. An automated explanation mechanism uses semantic markup added by the verification condition generator to produce natural-language explanations of the safety conditions and thus supports their interpretation in relation to the code. It shows an automatically generated certification browser that lets users inspect the (generated) code along with the safety conditions (including textual explanations), and uses hyperlinks to automate tracing between the two levels. Here, the explanations reflect the logical structure of the safety obligation but the mechanism can in principle be customized using different sets of domain concepts. The interface also provides some limited control over the certification process itself. Our long-term goal is a seamless integration of certification, code generation, and manual coding that results in a "certified pipeline" in which specifications are automatically transformed into executable code, together with the supporting artifacts necessary for achieving and demonstrating the high level of assurance needed in the aerospace domain.

Denney, Ewen↗