Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Model error”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 577 records · Page 32

Characterization of oceanic post-cold frontal clouds and their model representation. Final report

Low-level clouds are ubiquitous over the oceans, and their impact on the Earth’ radiative budget is important. However, general circulation models (GCMs) that are used to represent our climate and its evolution still experience problems to represent their correct amount and radiative impact. In the extratropical latitudes (~30-60 N/S), cloud properties are strongly modulated by the occurrence of anti-cyclones (high pressure systems) and cyclones (low pressure systems). While deep clouds dominate in cyclones near the center and along the cold and warm fronts, low-level clouds populate the colder regions of the cyclones, and more specifically the region in the wake of the cold fronts, the post-cold frontal region (PCF). The GCMs mentioned above were found to underestimate the amount of these PCF clouds, and this caused errors in their representation of the amount of solar radiation at the surface of the southern hemisphere oceans, causing an excess in absorption and errors in long-term predictions. To better understand which processes are ill-represented in the GCMs to cause such issues, we used ground-based observations from the Eastern North Atlantic (ENA) ARM site and a high resolution regional model (called WRF) to examine the properties of PCF clouds. With the WRF model, we simulated the passage of a cold front at the ENA site using theoretically distinct representations of convection and the physics of the boundary layer. While these physical representations had little impact on the timing, structure and circulation of the cold front, we found a high sensitivity to how the large scale information was fed into the model. Errors rapidly developed if the incoming flow information was injected too far from the site, but 1000 km was found to be an optimal distance between the outer boundary and the ENA site for a realistic cold front passage. With this model, we then conducted a series of experiment where convection and boundary layer schemes were changed, and revealed that 1) the clouds were more sensitive to the convection than boundary layer schemes and 2) the interaction between the two has a large impact. Furthermore, changing the representation of the physics in the model had greater impacts on PCF clouds than changing the initial conditions. As large-scale models increase their spatial resolution, convection will eventually be resolved but it remains that their representation of the physics of the boundary layer will matter for the correct representation of shallow (low-level) clouds. Observations were used to find which large-scale information had a clear relationship with PCF cloud and precipitation properties, in view of helping with GCM parameterizations and evaluation. Both lower troposphere stability and surface forcing were found to be important for PCF clouds that experience more vigorous dynamics than their tropical or subtropical counterparts. For cloud base and top heights, a simple measure of the change in potential temperature between the surface and the 800 hPa was found to be a good predictor. This relationship was found to hold as well when using data from campaigns recently conducted in the southern ocean south of Tasmania. A recent GCM was found to succeed in representing similar relations. For cloud depth, water content, and different characteristics of precipitation both the temperature contrast between the surface and near-air and the near-surface wind speed had a strong relationship. To summarize, through observational constraints and regional model experiments, the project has provided guidance to evaluate GCMs and tools to improve their representation of low-level clouds in the extratropics. It has also highlighted differences in behavior between these clouds and those typically found in the subtropics, thus opening new avenues of research for shallow clouds in general.

54 ENVIRONMENTAL SCIENCES↗

LAF-Net: A Deep Residual and Cross-Attention Framework for Day-Ahead Load Forecasting: Preprint

Accurate day-ahead load forecasting is essential for reliable power system operations and market efficiency. System operators such as the Midcontinent Independent System Operator (MISO) rely on forecasts from multiple vendors, yet combining them effectively remains a persistent challenge due to vendor-specific biases. This paper presents a novel LSTM-Attention Fusion Network with Error Representation (LAF-Net) that enhances day-ahead hourly load forecasting through deep residual learning and multi-modal cross-attention. The proposed model builds a historical error memory from past vendor performance and dynamically queries it with future hour context to generate adaptive, hour-specific trust weights for each vendor. A bounded residual correction further refines forecasts by mitigating systematic and temporally localized errors. Tested on real MISO LBA data with multi-vendor forecasts, LAF-Net consistently outperforms the best vendor baseline across all 38 LBAs, achieving more than a 40% reduction in system-level mean absolute error (MAE) during peak load hours relative to the best vendor baseline.

24 POWER TRANSMISSION AND DISTRIBUTION↗

The Role of Deep Convection and Large-scale Circulation in Driving Model Spread in Low Cloud Feedback and Equilibrium Climate Sensitivity

This project aims to advance the understanding of the processes that drive the large uncertainties in climate change projections, use observations to constrain model physics and reduce the inter-model spread in equilibrium climate sensitivity (ECS). There are three major goals: 1) Characterize the representation of the physical pathways that link deep convection, large-scale circulation and low cloud feedback in CMIP6 model simulations and determine the relative contribution of each pathway to the CMIP6 model spread in low cloud feedback and ECS; 2) Use process-oriented diagnostics and multiple observations to evaluate CMIP6 model performance in capturing the observed cloud-circulation relation and deep convection characteristics including convective transition statistics and the bulk properties of mesoscale convective systems (MCSs). Error decomposition in CMIP6 models will be performed. 3) Conduct E3SM short-range hindcasts following the DOE Cloud-Associated Parameterizations Testbed (CAPT) protocol to pinpoint specific model parameters/processes that are crucial to the representation of deep convection, circulation, clouds and the pathways that connect them. We will modify convective parameters in E3SM and analyze the perturbed physics experiments (PPEs) to isolate model parameters that are critical to the uncertainty of ECS.

54 ENVIRONMENTAL SCIENCES↗

Neural network surrogate models for equations of state

Equation of state (EOS) data provide necessary information for accurate multiphysics modeling, which is necessary for fields such as inertial confinement fusion. Here, we suggest a neural network surrogate model of energy and entropy and use thermodynamic relationships to derive other necessary thermodynamic EOS quantities. We incorporate phase information into the model by training a phase classifier and using phase-specific regression models, which improves the modal prediction accuracy. Our model predicts energy values to 1% relative error and entropy to 3.5% relative error in a log-transformed space. Although sound speed predictions require further improvement, the derived pressure values are accurate within 10% relative error. Our results suggest that neural network models can effectively model EOS for inertial confinement fusion simulation applications.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗

stor4build

The EnergyPlus simulation engine supports modeling and simulation of thermal energy storage (TES) systems in several ways, including using the Python-EMS feature, which extends the operation of the engine with custom code written in Python. Creation of models using this feature can be tedious and error prone, with the connection of the model components to the Python code a particularly troublesome area. The stor4build Python package simplifies this process by modifying an input model to add a selected TES technology (implemented with the Python-EMS feature) and runs the simulation. The package leverages the OpenStudio middleware software development kit to automate this process as much as possible, eliminating potential errors and simplifying usage of EnergyPlus. The package provides objects, functions, and OpenStudio measures that implement the necessary operations to automate the creation of EnergyPlus models that integrate TES technologies with building systems. In addition, two user interfaces are provided: a command line interface and a web application programming interface. The automated process implemented by the package greatly simplifies the modeling and simulation process, allowing for parametric studies to be executed much more efficiently and effectively. The OpenStudio-based workflow is also very flexible and will allow for future additions of new technologies.

DeGraw, JasonWilliam [Oak Ridge National Laborator↗

Long–short-term memory encoder–decoder with regularized hidden dynamics for fault detection in industrial processes

The ability of recurrent neural networks (RNN) to model nonlinear dynamics of high dimensional process data has enabled data-driven RNN-based fault detection algorithms. Previous studies have focused on detecting faults by identifying the discrepancies in data distribution between the faulty and normal data, as reflected in prediction errors generated by RNN models. However, in industrial processes, variations in data distribution can also result from changes in normal control setpoints and compensatory control adjustments in response to disturbances, making it hard to differentiate between normal and faulty conditions. This paper proposes a fault detection method utilizing a long short-term memory (LSTM) encoder–decoder structure with regularized hidden dynamics and reversible instance normalization (RevIN) to compactly represent high-dimensional measurements for effective monitoring. During training, the hidden states of the model are regularized to form a low-dimensional latent space representation of the original multivariate time series data. As a result, the prediction errors of the latent states can be used to monitor the abnormal dynamic variations, while the reconstruction errors of the measured variables are used to monitor the abnormal static variations. Furthermore, the proposed indices can reflect operating conditions, even when the distribution of test data changes, which helps distinguish faults from normal adjustments and disturbances that controllers can settle. Here, data from numerical simulation and the Tennessee Eastman process are used to illustrate the effectiveness of the proposed fault detection method.

42 ENGINEERING↗

Group-theoretic error mitigation enabled by classical shadows and symmetries

Abstract Estimating expectation values is a key subroutine in quantum algorithms. Near-term implementations face two major challenges: a limited number of samples required to learn a large collection of observables, and the accumulation of errors in devices without quantum error correction. To address these challenges simultaneously, we develop a quantum error-mitigation strategy called symmetry-adjusted classical shadows , by adjusting classical-shadow tomography according to how symmetries are corrupted by device errors. As a concrete example, we highlight global U(1) symmetry, which manifests in fermions as particle number and in spins as total magnetization, and illustrate their group-theoretic unification with respective classical-shadow protocols. We establish rigorous sampling bounds under readout errors obeying minimal assumptions, and perform numerical experiments with a more comprehensive model of gate-level errors derived from existing quantum processors. Our results reveal symmetry-adjusted classical shadows as a low-cost strategy to mitigate errors from noisy quantum experiments in the ubiquitous presence of symmetry.

Zhao, Andrew (ORCID:0000000202990277)↗

Machine-Learning Assisted Identification of Accurate Battery Lifetime Models with Uncertainty

Reduced-order battery lifetime models, which consist of algebraic expressions for various aging modes, are widely utilized for extrapolating degradation trends from accelerated aging tests to real-world aging scenarios. Identifying models with high accuracy and low uncertainty is crucial for ensuring that model extrapolations are believable, however, it is difficult to compose expressions that accurately predict multivariate data trends; a review of cycling degradation models from literature reveals a wide variety of functional relationships. Here, a machine-learning assisted model identification method is utilized to fit degradation in a stand-out LFP-Gr aging data set, with uncertainty quantified by bootstrap resampling. The model identified in this work results in approximately half the mean absolute error of a human expert model. Models are validated by converting to a state-equation form and comparing predictions against cells aging under varying loads. Parameter uncertainty is carried forward into an energy storage system simulation to estimate the impact of aging model uncertainty on system lifetime. The new model identification method used here reduces life-prediction uncertainty by more than a factor of three (86% ± 5% relative capacity at 10 years for human-expert model, 88.5% ± 1.5% for machine-learning assisted model), empowering more confident estimates of energy storage system lifetime.

25 ENERGY STORAGE↗

A Comparison of Infectious Disease Forecasting Methods across Locations, Diseases, and Time

Accurate infectious disease forecasting can inform efforts to prevent outbreaks and mitigate adverse impacts. This study compares the performance of statistical, machine learning (ML), and deep learning (DL) approaches in forecasting infectious disease incidences across different countries and time intervals. We forecasted three diverse diseases: campylobacteriosis, typhoid, and Q-fever, using a wide variety of features (n = 46) from public datasets, e.g., landscape, climate, and socioeconomic factors. We compared autoregressive statistical models to two tree-based ML models (extreme gradient boosted trees [XGB] and random forest [RF]) and two DL models (multi-layer perceptron and encoder–decoder model). The disease models were trained on data from seven different countries at the region-level between 2009–2017. Forecasting performance of all models was assessed using mean absolute error, root mean square error, and Poisson deviance across Australia, Israel, and the United States for the months of January through August of 2018. The overall model results were compared across diseases as well as various data splits, including country, regions with highest and lowest cases, and the forecasted months out (i.e., nowcasting, short-term, and long-term forecasting). Overall, the XGB models performed the best for all diseases and, in general, tree-based ML models performed the best when looking at data splits. There were a few instances where the statistical or DL models had minutely smaller error metrics for specific subsets of typhoid, which is a disease with very low case counts. Feature importance per disease was measured by using four tree-based ML models (i.e., XGB and RF with and without region name as a feature). The most important feature groups included previous case counts, region name, population counts and density, mortality causes of neonatal to under 5 years of age, sanitation factors, and elevation. This study demonstrates the power of ML approaches to incorporate a wide range of factors to forecast various diseases, regardless of location, more accurately than traditional statistical approaches.

59 BASIC BIOLOGICAL SCIENCES↗

ISOCS-based Extended In Situ Gamma Spectrometry Services Tool SuperISOCS for Waste Measurements - 20275

Canberra's In Situ Object Counting System (ISOCS) is an established tool used for gamma spectrometry. It allows physical representation of complex geometries and mathematical calculation of the calibration function while avoiding the need for radioisotope standards. ISOCS provides a large range of templates to generate the geometry for most nuclear waste components in nuclear facilities. Nonetheless, there are some complex geometries where the accuracy attainable is limited by the conventional ISOCS templates. An ISOCS-based extended in-situ Gamma Spectrometry service tool has been developed, based on the so-called SuperISOCS (SISOCS) software. This tool was developed to generate the most complex geometries. The principle of geometry construction is based on the composition of 8 different primitive geometries. The primitive object is able to be cut and to change a part of an object. An object is able to overlap to another one to form a more complex object. These functions refine the modelled geometry compared to the real objects and decrease the measurement systematic error because they allow the mathematical model to represent the real-life geometry more faithfully through reducing the approximations and simplifications that need to be made The algorithm of SISOCS is the same as that of standard ISOCS. A set of calculations was done in comparison with MCNP efficiency calculation and SISOCS results. 80 different models were compared between SISOCS and MCNP, with added 30 cases compared between ISOCS and SISOCS. The average differences were less than 2%, for all energy's efficiency calculations. In this paper we illustrate the benefits that this new tool can provide, in terms of improved accuracy for complex realistic geometries, through simulation of some example scenarios. Furthermore, we demonstrate, through SISOCS modelling of the real object data test, the comparison between SISOCS to ISOCS calculations for the same geometry. This paper describes the added functions that are easily employed using SISOCS. Our results show the potential application and benefit of this technique for real waste assay projects and the way to integrate the tool into the waste assay systems. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

Quantifying wildfire drivers and predictability in boreal peatlands using a two-step error-correcting machine learning framework in TeFire v1.0

Abstract. Wildfires are becoming an increasing challenge to the sustainability of boreal peatland (BP) ecosystems and can alter the stability of boreal carbon storage. However, predicting the occurrence of rare and extreme BP fires proves to be challenging, and gaining a quantitative understanding of the factors, both natural and anthropogenic, inducing BP fires remains elusive. Here, we quantified the predictability of BP fires and their primary controlling factors from 1997 to 2015 using a two-step correcting machine learning (ML) framework that combines multiple ML classifiers, regression models, and an error-correcting technique. We found that (1) the adopted oversampling algorithm effectively addressed the unbalanced data and improved the recall rate by 26.88 %–48.62 % when using multiple datasets, and the error-correcting technique tackled the overestimation of fire sizes during fire seasons; (2) nonparametric models outperformed parametric models in predicting fire occurrences, and the random forest machine learning model performed the best, with the area under the receiver operating characteristic curve ranging from 0.83 to 0.93 across multiple fire datasets; and (3) four sets of factor-control simulations consistently indicated the dominant role of temperature, air dryness, and climate extreme (i.e., frost) for boreal peatland fires, overriding the effects of precipitation, wind speed, and human activities. Our findings demonstrate the efficiency and accuracy of ML techniques in predicting rare and extreme fire events and disentangle the primary factors determining BP fires, which are critical for predicting future fire risks under climate change.

54 ENVIRONMENTAL SCIENCES↗

Surrogate modeling for efficiently, accurately and conservatively estimating measures of risk

We present a surrogate modeling framework for conservatively estimating measures of risk from limited realizations of an expensive physical experiment or computational simulation. Risk measures combine objective probabilities with the subjective values of a decision maker to quantify anticipated outcomes. Given a set of samples, we construct a surrogate model that produces estimates of risk measures that are always greater than their empirical approximations obtained from the training data. These surrogate models limit over-confidence in reliability and safety assessments and produce estimates of risk measures that converge much faster to the true value than purely sample-based estimates. We first detail the construction of conservative surrogate models that can be tailored to a stakeholder’s risk preferences and then present an approach, based on stochastic orders, for constructing surrogate models that are conservative with respect to families of risk measures. Our surrogate models include biases that permit them to conservatively estimate the target risk measures. We provide theoretical results that show that these biases decay at the same rate as the L 2 error in the surrogate model. Numerical demonstrations confirm that risk-adapted surrogate models do indeed overestimate the target risk measures while converging at the expected rate.

42 ENGINEERING↗

Correlation-aware binning for small-angle neutron scattering via Gaussian-process inference

Binning in small-angle neutron scattering (SANS) is typically performed empirically, with fixed parameters chosen for convenience rather than statistical optimality. Such practices often fail to balance statistical precision and spatial resolution, leading to inconsistencies across instruments and datasets. Here we establish a correlation-aware framework that determines the optimal bin width from first principles by extending the classical Freedman–Diaconis (FD) rule to account for inter-bin correlations with a Gaussian process. In this formulation, the scattering intensity is treated as a smooth stochastic field whose statistical coherence is described by a covariance matrix. Analytical expressions of errors derived from this model yield closed-form criteria that separate the total deviation into contributions from counting noise, aliasing distortion and curvature-dependent correlation effects. Expressed in reduced variables, the resulting dimensionless error surface reveals a continuous transition from the uncorrelated FD regime to the correlation-dominated limit, providing a unified description of noise suppression and resolution control. Because the formulation depends only on the profile characteristics of scattering intensity I(Q), specifically its average intensity and first- and second-order derivatives, it applies generally to any SANS measurement regardless of sample, instrument or geometry. Experimental validation using small- and ultra-small-angle neutron scattering data confirms the predicted scaling behavior, demonstrating that correlation-aware inference systematically reduces mean-squared error and enables information-efficient reproducible data reduction across materials and instruments.

Tung, Chi-Huan [ORNL] (ORCID:0000000221972074)↗

Godiva-IV Dosimetry Exercise 2022 Preliminary Results

Integral Experiment Request (IER) 538 is part of a series of dose characterization and nuclear accident dosimetry (NAD) exercises performed under the Department of Energy (DOE) Nuclear Criticality Safety Program (NCSP). This is the second NAD exercise using the Godiva-IV critical assembly and the third NAD exercise overall. The participating laboratories provided their own dosimeters that were mounted on the Lawrence Livermore National Laboratory (LLNL) BOttle Manikin ABsorption (BOMAB) phantoms and aluminum plates. The BOMABs and plates were placed at two, three, and four meters away from the center of Godiva. Alongside the NADs, there was a LLNL Passive Neutron Spectrometer (PNS), Atomic Weapons Establishment (AWE) PNS, and Y-12 Sphere present to measure the neutron dose from Godiva. Two irradiations were conducted to test the NAD performance from each laboratory and assesses their performance to the DOE-STD-1098-2017 part 515 criteria. Neutron and gamma doses were measured prior to this exercise. This work presents a model for the neutron and gamma dose respectively to serve as the reference value. A code written in C/C++/ROOT was used to fit the measured neutron and gamma dose with the new models. It was assumed that the neutron and gamma doses are proportional to the change in temperature of Godiva after a burst irradiation. Uncertainties for the reference values were calculated using error propagation of the model’s parameters. Preliminary results (within twenty-four hours) and final results were compared for each laboratory. On average of all the participating laboratories, 32% of neutron doses and 78% of gamma doses were outside the DOE standards. One laboratory did not report their dose readings and were not included in this average. There is a bias for a lower neutron dose and a higher gamma dose based on the distribution of results. In comparison with the past Godiva-IV NAD exercise, there is an improvement in neutron dose readings by 20%.

BOttle Manikin ABsorption (BOMAB)↗

Day-ahead photovoltaic power production forecasting methodology based on machine learning and statistical post-processing

A main challenge towards ensuring large-scale and seamless integration of photovoltaic systems is to improve the accuracy of energy yield forecasts, especially in grid areas of high photovoltaic shares. The scope of this paper is to address this issue by presenting a unified methodology for hourly-averaged day-ahead photovoltaic power forecasts with improved accuracy, based on data-driven machine learning techniques and statistical post-processing. More specifically, the proposed forecasting methodology framework comprised of a data quality stage, data-driven power output machine learning model development (artificial neural networks), weather clustering assessment (K-means clustering), post-processing output optimisation (linear regressive correction method) and the final performance accuracy evaluation. The results showed that the application of linear regression coefficients to the forecasted outputs of the developed day-ahead photovoltaic power production neural network improved the performance accuracy by further correcting solar irradiance forecasting biases. The resulting optimised model provided a mean absolute percentage error of 4.7% when applied to historical system datasets. Finally, the model was validated both, at a hot as well as a cold semi-arid climatic location, and the obtained results demonstrated close agreement by yielding forecasting accuracies of mean absolute percentage error of 4.7% and 6.3%, respectively. Finally, the validation analysis provides evidence that the proposed model exhibits high performance in both forecasting accuracy and stability.

42 ENGINEERING↗

3D Deep Learning Joint Inversion of Active Seismic Full Waveform and Passive Seismic Traveltime Data for Reservoir Imaging and Uncertainty Quantification

Here, we present deep learning (DL) networks for three-dimensional (3D) joint inversion of active seismic full waveform and passive seismic traveltime data to image reservoirs and their properties and quantify imaging uncertainties. Active seismic full-waveform data can provide high-resolution monitoring images but are collected only intermittently because of their high acquisition cost. In contrast, passive seismic data can be gathered at relatively low cost between regular active surveys, although their imaging quality can be compromised by factors such as low signal-to-noise ratios and limited ray coverage of the target. Although these datasets are routinely acquired together at CO 2 storage sites, their combined inversion within a 3D DL framework has not been previously demonstrated. To our knowledge, this is the first study to address this gap, combining the strength of both data types. For efficient data storage and DL training with large 3D seismic datasets, we use a 3D data matrix in which a random number of passive seismic traveltime data are stored as parabolic envelopes using one-hot encoding and a 3D full-waveform data matrix in which multiple shot gathers are summed. Two network architectures are evaluated: a single-encoder U-Net for single-data type inversion and a dual-encoder U-Net for joint inversion of active and passive seismic data. We also evaluate the single-encoder U-Net for joint inversion by concatenating full-waveform data and traveltime data. We propose a systematic approach for selecting an optimal dropout rate that balances regularization during training and Monte Carlo dropout-based uncertainty quantification during prediction by examining the correlation coefficient between standard deviation and prediction error, along with the training misfit, across a range of dropout rates. 3D DL inversion experiments include five different network configurations, with evaluations under ideal, noisy and dropout-enabled conditions. Both model and data uncertainties are assessed, as well as their combined effects. Across all conditions, the networks consistently predict accurate CO 2 saturation models with low prediction errors, such as a structural similarity index of 0.993 and CO 2 difference of 1.1%. Uncertainty estimates show strong spatial correlation with prediction errors, confirming the effectiveness of the proposed dropout selection approach. The results demonstrate that our DL approach, utilizing compact data representations and appropriate uncertainty quantification, yields accurate subsurface images under various inversion conditions and provides valuable insights into the reliability of predictions.

Um, Evan Schankee [Lawrence Berkeley National Labo↗

Surrogate Modeling For Efficiently Accurately and Conservatively Estimating Measures of Risk

We present a surrogate modeling framework for conservatively estimating measures of risk from limited realizations of an expensive physical experiment or computational simulation. We adopt a probabilistic description of risk that assigns probabilities to consequences associated with an event and use risk measures, which combine objective evidence with the subjective values of decision makers, to quantify anticipated outcomes. Given a set of samples, we construct a surrogate model that produces estimates of risk measures that are always greater than their empirical estimates obtained from the training data. These surrogate models not only limit over-confidence in reliability and safety assessments, but produce estimates of risk measures that converge much faster to the true value than purely sample-based estimates. We first detail the construction of conservative surrogate models that can be tailored to the specific risk preferences of the stakeholder and then present an approach, based upon stochastic orders, for constructing surrogate models that are conservative with respect to families of risk measures. The surrogate models introduce a bias that allows them to conservatively estimate the target risk measures. We provide theoretical results that show that this bias decays at the same rate as the L 2 error in the surrogate model. Our numerical examples confirm that risk-aware surrogate models do indeed over-estimate the target risk measures while converging at the expected rate.

97 MATHEMATICS AND COMPUTING↗

Synthesis of Correct Digital Controller Models from Specifications by Model Transformation (21-0320)

The design of high consequence controllers (in weapons systems, autonomy, etc.) that do what they are supposed to do is a significant challenge. Testing simply does not come close to meeting the requirements for assurance. Today circuit designers at Sandia (and elsewhere) typically capture the core behavior of their components using state models in tools such as STATEFLOW. They then check that their models meet certain requirements (e.g. “The system bus must not deadlock” or “both traffic lights at an intersection must not be green at the same time”) using tools called model checkers. If the model checker returns “yes” then the property is guaranteed to be satisfied by the model. However, there are several drawbacks to this industry practice: (1) there is a lot of detail to get right, this is particularly challenging when there are multiple components requiring complex coordination (2) any errors returned by the model checker have to be traced back through the design and fixed, necessitating rework, (3) there are severe scalability problems with this approach, particularly when dealing with concurrency. All this places high demands on the designers who now face not only an accelerated schedule but also controllers of increasing complexity. This report describes a new and fundamentally different approach to the construction of safety-critical digital controllers. Instead of directly constructing a complete model and then trying to verify it, the designer can start with an initial abstract (think “sketch”) model plus the requirements, from which a correct concrete model is automatically synthesized. There is no need for post-hoc verification of required functional properties. Having tool to carry this out will significantly impact the nation’s ability to ensure the safety of high-consequence digital systems. The approach has been implemented in a prototype tool, along with a suite of examples, including ones that reflect actual problems faced by designers. Our approach operates on a variant of Statecharts developed at Sandia called Qspecs. Statecharts are a widely used formalism for developing concurrent reactive systems, supporting scalability through allowing state models containing composite states, which are the serial or parallel composition of substates which can themselves contain statecharts. Statecharts enable an incremental style of development, in which states are progressively refined to incorporate greater detail in an incremental model of software development. Our approach formulates a set of constraints from the structure of the models and the requirements and propagates these constraints to a fixpoint. The solution to the constraints is an inductive invariant along with guards on the transitions. We also show how our approach extends to implementation refinement, decomposition, composition, and elaboration. We currently handle safety requirements written in LTL (Linear Temporal Logic)

42 ENGINEERING↗