Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “code verification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 577 records · Page 32
All sourcesNASA NTRSDOE OSTI
NASA NTRS2022

KSC Headquarters Building Area SWMU 104 Soil Interim Measure Report for LOC 2D and LOC 2E Kennedy Space Center, Florida

This Interim Measure (IM) Report for Location of Concern (LOC) 2D and LOC 2E summarizes the activities associated with implementation of an IM to address soil and concrete contamination at the Kennedy Space Center (KSC) Headquarters Building Area (KHQA) located at KSC, Florida. KHQA has been designated Solid Waste Management Unit (SWMU) 104 under KSC’s Resource Conservation and Recovery Act Corrective Action Program. The IM consisted of excavating/removing residual polychlorinated biphenyl (PCB) contamination in soil and concrete from two separate areas, LOC 2D and LOC 2E, which were associated with electrical transformer locations. IM activities were conducted in accordance with the Interim Measure Work Plan (IMWP), Revision 1, for KHQA dated June 2018, which was approved by the Florida Department of Environmental Protection in a correspondence letter dated April 2016 and the United States Environmental Protection Agency in a correspondence letter dated August 2018. The objective of the IM was to remove all remaining contaminated media with total PCB concentrations greater than the State of Florida Residential Soil Cleanup Target Level (RSCTL) (0.5 milligrams per kilogram [mg/kg]). This cleanup goal meets unrestrictive re-use conditions in Florida, and is below federal regulations for PCB Bulk Remediation Waste Cleanup of 1 mg/kg for high occupancy, unrestricted use areas, as outlined in 40 Code of Federal Regulations (CFR) 761.61(a). The timeline of the IM was coordinated with demolition of the former KSC Headquarters Building (demolished in 2021) in order to safely remove contaminated media after electrical equipment was de-energized and removed from the site. Excavation activities were conducted between January 10, 2022, and February 8, 2022, and included two waste streams for off-site disposal: (1) PCB-remediation waste greater than or equal to 50 mg/kg, and (2) PCB-remediation waste less than 50 mg/kg. A total of approximately 347 cubic yards (478 tons) of PCB-contaminated soil and concrete was initially removed from the LOC 2D and LOC 2E areas, as defined in the IMWP. An additional 4.35 tons of soil and concrete were removed based on verification sampling, which was conducted until the cleanup goal was achieved. The total area of excavation from both LOC 2D and LOC 2E was approximately 5,186 square feet (0.12 acres), and excavation depths ranged from 0.5 to 4.0 feet below land surface Excavated soils and concrete were stockpiled based on waste stream and subsequently transported and disposed of at Waste Connections of Osceola County, LLC – JED Landfill in St. Cloud, Florida (PCBs less than 50 mg/kg) or the Chemical Waste Management Landfill in Emelle, Alabama (PCBs greater than or equal to 50 mg/kg). Following excavation, clean backfill was brought to the site and provided to the Demolition Contractor to complete backfill and grading in conjunction with their final site restoration activities from building demolition. Post-IM groundwater sampling was conducted in May 2022 at three monitoring wells installed in April 2022 to confirm that PCBs did not leach into groundwater. These wells were installed where the highest PCB concentrations were detected at LOC 2D, LOC 2E, and from the Building Perimeter IM (previously completed in 2020). All PCB results in groundwater were non-detect. Volatile organic compounds were also analyzed based on potential past use of solvents in transformers with PCB-dielectric fluids and the potential release of dielectric fluids containing volatile organic compounds, and all results were non-detect. Based on completion of a successful IM at LOC 2D and LOC 2E, as well as previous remedial actions that have addressed other contamination at KHQA (SWMU 104), No Further Action without controls will be recommended for SWMU 104. NASA will submit separate Site Rehabilitation Completion Order request documentation for SWMU 104 to support an NFA without controls recommendation.

PCB↗
NASA NTRS2014

Coupled Fluid-Structure Interaction Analysis of Solid Rocket Motor with Flexible Inhibitors

Flexible inhibitors are generally used in solid rocket motors (SRMs) as a means to control the burning of propellant. Vortices generated by the flow of propellant around the flexible inhibitors have been identified as a driving source of instabilities that can lead to thrust oscillations in launch vehicles. Potential coupling between the SRM thrust oscillations and structural vibration modes is an important risk factor in launch vehicle design. As a means to predict and better understand these phenomena, a multidisciplinary simulation capability that couples the NASA production CFD code, Loci/CHEM, with CFDRC's structural finite element code, CoBi, has been developed. This capability is crucial to the development of NASA's new space launch system (SLS). This paper summarizes the efforts in applying the coupled software to demonstrate and investigate fluid-structure interaction (FSI) phenomena between pressure waves and flexible inhibitors inside reusable solid rocket motors (RSRMs). The features of the fluid and structural solvers are described in detail, and the coupling methodology and interfacial continuity requirements are then presented in a general Eulerian-Lagrangian framework. The simulations presented herein utilize production level CFD with hybrid RANS/LES turbulence modeling and grid resolution in excess of 80 million cells. The fluid domain in the SRM is discretized using a general mixed polyhedral unstructured mesh, while full 3D shell elements are utilized in the structural domain for the flexible inhibitors. Verifications against analytical solutions for a structural model under a steady uniform pressure condition and under dynamic modal analysis show excellent agreement in terms of displacement distribution and eigenmode frequencies. The preliminary coupled results indicate that due to acoustic coupling, the dynamics of one of the more flexible inhibitors shift from its first modal frequency to the first acoustic frequency of the solid rocket motor. This insight could have profound implications for SRM and flexible inhibitor designs for current and future launch vehicles including SLS.

Yang, H. Q.↗
NASA NTRS2016

Fuselage Versus Subcomponent Panel Response Correlation Based on ABAQUS Explicit Progressive Damage Analysis Tools

Analysis performed in this study substantiates the need for high fidelity vehicle level progressive damage analyses (PDA) structural models for use in the verification and validation of proposed sub-scale structural models and to support required full-scale vehicle level testing. PDA results are presented that capture and correlate the responses of sub-scale 3-stringer and 7-stringer panel models and an idealized 8-ft diameter fuselage model, which provides a vehicle level environment for the 7-stringer sub-scale panel model. Two unique skin-stringer attachment assumptions are considered and correlated in the models analyzed: the TIE constraint interface versus the cohesive element (COH3D8) interface. Evaluating different interfaces allows for assessing a range of predicted damage modes, including delamination and crack propagation responses. Damage models considered in this study are the ABAQUS built-in Hashin procedure and the COmplete STress Reduction (COSTR) damage procedure implemented through a VUMAT user subroutine using the ABAQUS/Explicit code.

Gould, Kevin E.↗
NASA NTRS1997

Prediction and Verification of Ductile Crack Growth from Simulated Defects in Strength Overmatched Butt Welds

Defects that develop in welds during the fabrication process are frequently manifested as embedded flaws from lack of fusion or lack of penetration. Fracture analyses of welded structures must be able to assess the effect of such defects on the structural integrity of weldments; however, the transferability of R-curves measured in laboratory specimens to defective structural welds has not been fully examined. In the current study, the fracture behavior of an overmatched butt weld containing a simulated buried, lack-of-penetration defect is studied. A specimen designed to simulate pressure vessel butt welds is considered; namely, a center crack panel specimen, of 1.25 inch by 1.25 inch cross section, loaded in tension. The stress-relieved double-V weld has a yield strength 50% higher than that of the plate material, and displays upper shelf fracture behavior at room temperature. Specimens are precracked, loaded monotonically while load-CMOD measurements are made, then stopped and heat tinted to mark the extent of ductile crack growth. These measurements are compared to predictions made using finite element analysis of the specimens using the fracture mechanics code Warp3D, which models void growth using the Gurson-Tvergaard dilitant plasticity formulation within fixed sized computational cells ahead of the crack front. Calibrating data for the finite element analyses, namely cell size and initial material porosities are obtained by matching computational predictions to experimental results from tests of welded compact tension specimens. The R-curves measured in compact tension specimens are compared to those obtained from multi-specimen weld tests, and conclusions as to the transferability of R-curves is discussed.

Nishioka, Owen S.↗
NASA NTRS2009

Efficient Multidisciplinary Analysis Approach for Conceptual Design of Aircraft with Large Shape Change

The conceptual and preliminary design processes for aircraft with large shape changes are generally difficult and time-consuming, and the processes are often customized for a specific shape change concept to streamline the vehicle design effort. Accordingly, several existing reports show excellent results of assessing a particular shape change concept or perturbations of a concept. The goal of the current effort was to develop a multidisciplinary analysis tool and process that would enable an aircraft designer to assess several very different morphing concepts early in the design phase and yet obtain second-order performance results so that design decisions can be made with better confidence. The approach uses an efficient parametric model formulation that allows automatic model generation for systems undergoing radical shape changes as a function of aerodynamic parameters, geometry parameters, and shape change parameters. In contrast to other more self-contained approaches, the approach utilizes off-the-shelf analysis modules to reduce development time and to make it accessible to many users. Because the analysis is loosely coupled, discipline modules like a multibody code can be easily swapped for other modules with similar capabilities. One of the advantages of this loosely coupled system is the ability to use the medium- to high-fidelity tools early in the design stages when the information can significantly influence and improve overall vehicle design. Data transfer among the analysis modules are based on an accurate and automated general purpose data transfer tool. In general, setup time for the integrated system presented in this paper is 2-4 days for simple shape change concepts and 1-2 weeks for more mechanically complicated concepts. Some of the key elements briefly described in the paper include parametric model development, aerodynamic database generation, multibody analysis, and the required software modules as well as examples for a telescoping wing, a folding wing, and a bat-like wing. The paper also includes the verification of a medium-fidelity aerodynamic tool used for the aerodynamic database generation with a steady and unsteady high-fidelity CFD analysis tool for a folding wing example.

Chwalowski, Pawel↗
NASA NTRS1989

Probabilistic design analysis using Composite Loads Spectra (CLS) coupled with Probabilistic Structural Analysis Methodologies (PSAM)

Composite loads spectra (CLS) were applied to generate probabilistic loads for use in the PSAM nonlinear evaluation of stochastic structures under stress (NESSUS) finite element code. The CLS approach allows for quantifying loads as mean values and distributions around a central value rather than maximum or enveloped values typically used in deterministic analysis. NESSUS uses these loads to determine mean and perturbation responses. These results are probabilistically evaluated with the distributional information from CLS using a fast probabilistic integration (FPI) technique to define response distributions. The main example discussed describes a method of obtaining load descriptions and stress response of the second-stage turbine blade of the Space Shuttle Main Engine (SSME) high-pressure fuel turbopump (HPFTP). Additional information is presented on the on-going analysis of the high pressure oxidizer turbopump discharge duct (HPOTP) where probabilistic dynamic loads have been generated and are in the process of being used for dynamic analysis. Example comparisons of load analysis and engine data are furnished for partial verification and/or justification for the methodology.

Newell, J. F.↗
NASA NTRS2008

Virtual Satellite

Virtual Satellite (VirtualSat) is a computer program that creates an environment that facilitates the development, verification, and validation of flight software for a single spacecraft or for multiple spacecraft flying in formation. In this environment, enhanced functionality and autonomy of navigation, guidance, and control systems of a spacecraft are provided by a virtual satellite that is, a computational model that simulates the dynamic behavior of the spacecraft. Within this environment, it is possible to execute any associated software, the development of which could benefit from knowledge of, and possible interaction (typically, exchange of data) with, the virtual satellite. Examples of associated software include programs for simulating spacecraft power and thermal- management systems. This environment is independent of the flight hardware that will eventually host the flight software, making it possible to develop the software simultaneously with, or even before, the hardware is delivered. Optionally, by use of interfaces included in VirtualSat, hardware can be used instead of simulated. The flight software, coded in the C or C++ programming language, is compilable and loadable into VirtualSat without any special modifications. Thus, VirtualSat can serve as a relatively inexpensive software test-bed for development test, integration, and post-launch maintenance of spacecraft flight software.

Hammrs, Stephan R.↗
NASA NTRS2022

Flight Rule Design, Implementation, Verification, and Validation for the Psyche Mission

NASA Jet Propulsion Lab (JPL)’s upcoming mission Psyche will begin its journey to the asteroid (16) Psyche in late 2022 in an effort to better understand its origins and, in turn, better understand our own. Operating the spacecraft safely will require the dedicated efforts of a small team that understands the spacecraft’s operational constraints, as well as a set of powerful spacecraft models designed to catch command errors that can pose risks to mission success. One of the responsibilities of the operations team is to ensure adherence to a set of Flight Rules written by spacecraft and instrument experts that are designed to mitigate these risks. Psyche’s innovations in Flight Rule design principles and advancements in the tools and processes used to implement and check Flight Rules are discussed. A comparison of Psyche’s approach to Flight Rules to other JPL missions will provide lessons learned for future missions that must perform constraint checking during operations. Flight Rule development faces several major challenges. First, flight rule developers must work with Subject Matter Experts (SME) to write the rules in a way that captures the intent of the constraint in a straightforward, enforceable manner. Second, software implementers must correctly interpret flight rules into code so that it meets the original intent of the SME. Finally, a means must be provided for SMEs to validate flight rule implementations without requiring them to understand the underlying software. Innovative processes intended to efficiently close the loop between stakeholders and software developers are described, such as the use of test-driven development to provide stakeholders with easy-to-review implementations. New guidelines for flight rule writing, designed to address these challenges, are described for future missions to adopt and build upon. Psyche Mission System has a variety of new and heritage tools that improve in the Flight Rule validation and checking process. Psyche developed a powerful, new tool called RandSEQ and made significant improvements to Octopusjam, two valuable tools that aid the development of Flight Rule unit tests. Advancements in the models and processes for performing sequence validation with SEQuence GENerator (SEQGEN), the primary, high-heritage tool used for automated flight rule checks on Psyche, are described. The development of new software and the advancements to existing software put Psyche at the forefront of Flight Rule technology. All missions must perform detailed constraint checking, so a comparison of Psyche’s approach to some of these items to the approaches taken by other missions such as Dawn, M2020, and Europa Clipper is done, specifically to examine SME-developer communication, tools used, and development process. Lessons learned from this comparison will be provided.

Weise, Tim↗
NASA NTRS2012

The Pursuit of K: Reflections on the Current State-of-the-Art in Stress Intensity Factor Solutions for Practical Aerospace Applications

The elastic stress intensity factor (SIF, commonly denoted as K) is the foundation of practical fracture mechanics (FM) analysis for aircraft structures. This single parameter describes the first-order effects of stress magnitude and distribution as well as the geometry of both structure/component and crack. Hence, the calculation of K is often the most significant step in fatigue analysis based on FM. This presentation will provide several reflections on the current state-of-the-art in SIF solution methods used for practical aerospace applications, including a brief historical perspective, descriptions of some recent and ongoing advances, and comments on some remaining challenges. Newman and Raju made significant early contributions to practical structural analysis by developing closed-form SIF equations for surface and corner cracks in simplified geometries, often based on empirical fits of finite element (FE) solutions. Those solutions (and others like them) were sometimes revised as new analyses were conducted or limitations discovered. The foundational solutions have exhibited striking longevity, despite the relatively "coarse" FE models employed many decades ago. However, in recent years, the accumulation of different generations of solutions for the same nominal geometry has led to some confusion (which solution is correct?), and steady increases in computational capabilities have facilitated the discovery of inaccuracies in some (not all!) of the legacy solutions. Some examples of problems and solutions are presented and discussed, including the challenge of maintaining consistency with legacy design applications. As computational power has increased, the prospect of calculating large numbers of SIF solutions for specific complex geometries with advanced numerical methods has grown more attractive. Fawaz and Andersson, for example, have been generating literally millions of new SIF solutions for different combinations of multiple cracks under simplified loading schemes using p-version FE methods. These data are invaluable, but questions remain about their practical use, because the tabular databases of key results needed to support practical life analysis can occupy gigabytes of storage for only a few classes of geometries. The prospect of using such advanced numerical methods to calculate in real time only those K solutions actually needed to support a specific crack growth analysis is also tempting, but the stark reality is that the computational cost is still so high that the approach is not practical except for specific, critical application problems. Some thoughts are offered about alternative paradigms. Compounding approaches are some of the earliest building blocks of SIF development for more complex geometries. These approaches are especially attractive because of their very low computational cost and their conceptual robustness; they are, in some ways, an intriguing contrast and complement to the brute-force numerical methods. In recent years, researchers at NRC-Canada have published remarkable results showing how compounding approaches can be used to generate accurate solutions for very difficult problems. Examples are provided of some successes--and some limitations--using this approach. These closed-form, tabulated numerical, and compounding approaches have typically been used for simple remote loading with simple load paths to the crack. However, many significant cracks occur in complex stress gradient fields. This is a job for weight function (WF) methods, where the arbitrary stress distribution on the crack plane in the corresponding uncracked body (typically determined using FE methods) is used to determine K. Several significant recent advances in WF methods and solutions are highlighted here. Fueled by advanced 3D numerical methods, many new solutions have been generated for classic geometries such as surface and corner cracks with wide ranges of geometrical validity. A new WF formulation has also be developed for part-through cracks considering the arbitrary stress gradients in all directions in the crack plane (so-called bivariant solutions). Basic WF methods have recently been combined with analytical expressions for crack plane stresses to develop a large family of accurate SIF solutions for corner, surface, and through cracks at internal or external notches with very wide ranges of shapes, sizes, acuities, and offsets. Finally, WF solutions are much faster than FE or boundary element solutions, but can still be much slower than simple closed-form solutions, especially for bivariant solutions that can require 2D numerical integration. Novel pre-integration and dynamic tabular methods have been developed that substantially increase the speed of these advanced WF solutions. The practical utility of advanced SIF methods, including both WF and direct numerical methods, is greatly enhanced if the FM life analysis can be directly and efficiently linked with digital models of the actual structure or component (e.g., FE models for stress analysis). Two recent advances of this type will be described. One approach directly interfaces the FM life analysis with the FE model of the uncracked component (including stress results). Through a powerful graphical user interface, simplified FM life models can be constructed (and visualized) directly on the component model, with the computer collecting the geometry and stress gradient information needed for the life calculation. An even more powerful paradigm uses expert logic to automatically build an optimum simple fracture model at any and every desired location in the component model, perform the life calculation, and even generate fatigue crack growth life contour maps, all with minimal user intervention. This paradigm has also been extended to the automatic calculation of fracture risk, considering uncertainty or variability in key input parameters such as initial crack size or location. Another new integrated approach links the engineering life analysis, the component model, and a 3D numerical fracture analysis built with the same component model to generate a table of SIF values at a specific location that can then be employed efficiently to perform the life calculation. Some attention must be given to verification and validation (V&V) issues and challenges: how good are these SIF solutions, how good is good enough, and does anyone believe the life answer? It is important to think critically about the different sources of error or uncertainty and to perform V&V in a hierarchal, building-block manner. Some accuracy issues for SIF solutions, for example, may actually involve independent material behavior issues, such as constraint loss effects for crack fronts near component surfaces, and can be a source of confusion. Recommendations are proposed for improved V&V approaches. This presentation will briefly but critically survey the range of issues and advances mentioned above, with a particular view towards assembling an integrated approach that combines different methods to create practical tools for real-world design and analysis problems. Examples will be selectively drawn from the recent literature, from recent enhancements in the NASGRO and DARWIN computer codes, and from previously unpublished research

CraigMcClung, R.↗
NASA NTRS2008

Automatic Testcase Generation for Flight Software

The TacSat3 project is applying Integrated Systems Health Management (ISHM) technologies to an Air Force spacecraft for operational evaluation in space. The experiment will demonstrate the effectiveness and cost of ISHM and vehicle systems management (VSM) technologies through onboard operation for extended periods. We present two approaches to automatic testcase generation for ISHM: 1) A blackbox approach that views the system as a blackbox, and uses a grammar-based specification of the system's inputs to automatically generate *all* inputs that satisfy the specifications (up to prespecified limits); these inputs are then used to exercise the system. 2) A whitebox approach that performs analysis and testcase generation directly on a representation of the internal behaviour of the system under test. The enabling technologies for both these approaches are model checking and symbolic execution, as implemented in the Ames' Java PathFinder (JPF) tool suite. Model checking is an automated technique for software verification. Unlike simulation and testing which check only some of the system executions and therefore may miss errors, model checking exhaustively explores all possible executions. Symbolic execution evaluates programs with symbolic rather than concrete values and represents variable values as symbolic expressions. We are applying the blackbox approach to generating input scripts for the Spacecraft Command Language (SCL) from Interface and Control Systems. SCL is an embedded interpreter for controlling spacecraft systems. TacSat3 will be using SCL as the controller for its ISHM systems. We translated the SCL grammar into a program that outputs scripts conforming to the grammars. Running JPF on this program generates all legal input scripts up to a prespecified size. Script generation can also be targeted to specific parts of the grammar of interest to the developers. These scripts are then fed to the SCL Executive. ICS's in-house coverage tools will be run to measure code coverage. Because the scripts exercise all parts of the grammar, we expect them to provide high code coverage. This blackbox approach is suitable for systems for which we do not have access to the source code. We are applying whitebox test generation to the Spacecraft Health INference Engine (SHINE) that is part of the ISHM system. In TacSat3, SHINE will execute an on-board knowledge base for fault detection and diagnosis. SHINE converts its knowledge base into optimized C code which runs onboard TacSat3. SHINE can translate its rules into an intermediate representation (Java) suitable for analysis with JPF. JPF will analyze SHINE's Java output using symbolic execution, producing testcases that can provide either complete or directed coverage of the code. Automatically generated test suites can provide full code coverage and be quickly regenerated when code changes. Because our tools analyze executable code, they fully cover the delivered code, not just models of the code. This approach also provides a way to generate tests that exercise specific sections of code under specific preconditions. This capability gives us more focused testing of specific sections of code.

Bushnell, David Henry↗
NASA NTRS2005

Compression-Loaded Composite Panels With Elastic Edge Restraints and Initial Prestress

A parametric study of the effects of test-fixture-induced initial prestress and elastic edge restraints on the prebuckling and buckling responses of a compression-loaded, quasi-isotropic curved panel is presented. The numerical results were obtained by using a geometrically nonlinear finite element analysis code with high-fidelity models. The results presented show that a wide range of prebuckling and buckling behavior can be obtained by varying parameters that represent circumferential loaded-edge restraint and rotational unloaded-edge restraint provided by a test fixture and that represent the mismatch in specimen and test-fixture radii of curvature. For a certain range of parameters, the panels exhibit substantial nonlinear prebuckling deformations that yield buckling loads nearly twice the corresponding buckling load predicted by a traditional linear bifurcation buckling analysis for shallow curved panels. In contrast, the results show another range of parameters exist for which the nonlinear prebuckling deformations either do not exist or are relatively benign, and the panels exhibit buckling loads that are nearly equal to the corresponding linear bifurcation buckling load. Overall, the results should be of particular interest to scientists, engineers, and designers involved in simulating flight-hardware boundary conditions in structural verification and certification tests, involved in validating structural analysis tools, and interested in tailoring buckling performance.

Hilburger, Mark W.↗
NASA NTRS2004

Effects of Elastic Edge Restraints and Initial Prestress on the Buckling Response of Compression-Loaded Composite Panels

A parametric study of the effects of test-fixture-induced initial prestress and elastic edge restraints on the prebuckling and buckling responses of a compression-loaded, quasi-isotropic curved panel is presented. The numerical results were obtained by using a geometrically nonlinear finite element analysis code with high-fidelity models. The results presented show that a wide range of prebuckling and buckling behavior can be obtained by varying parameters that represent circumferential loaded-edge restraint and rotational unloaded-edge restraint provided by a test fixture and that represent the mismatch in specimen and test-fixture radii of curvature. For a certain range of parameters, the panels exhibit substantial nonlinear prebuckling deformations that yield buckling loads nearly twice the corresponding buckling load predicted by a traditional linear bifurcation buckling analysis for shallow curved panels. In contrast, the results show another range of parameters exist for which the nonlinear prebuckling deformations either do not exist or are relatively benign, and the panels exhibit buckling loads that are nearly equal to the corresponding linear bifurcation buckling load. Overall, the results should also be of particular interest to scientists, engineers, and designers involved in simulating flight-hardware boundary conditions in structural verification and certification tests, involved in validating structural analysis tools, and interested in tailoring buckling performance.

Hilburger, Mark W.↗
NASA NTRS2004

Synthesizing Safety Conditions for Code Certification Using Meta-Level Programming

In code certification the code consumer publishes a safety policy and the code producer generates a proof that the produced code is in compliance with the published safety policy. In this paper, a novel viewpoint approach towards an implementational re-use oriented framework for code certification is taken. It adopts ingredients from Necula's approach for proof-carrying code, but in this work safety properties can be analyzed on a higher code level than assembly language instructions. It consists of three parts: (1) The specification language is extended to include generic pre-conditions that shall ensure safety at all states that can be reached during program execution. Actual safety requirements can be expressed by providing domain-specific definitions for the generic predicates which act as interface to the environment. (2) The Floyd-Hoare inductive assertion method is refined to obtain proof rules that allow the derivation of the proof obligations in terms of the generic safety predicates. (3) A meta-interpreter is designed and experimentally implemented that enables automatic synthesis of proof obligations for submitted programs by applying the modified Floyd-Hoare rules. The proof obligations have two separate conjuncts, one for functional correctness and another for the generic safety obligations. Proof of the generic obligations, having provided the actual safety definitions as context, ensures domain-specific safety of program execution in a particular environment and is simpler than full program verification.

Eusterbrock, Jutta↗
NASA NTRS2009

The Integrated Hazard Analysis Integrator

Hazard analysis addresses hazards that arise in the design, development, manufacturing, construction, facilities, transportation, operations and disposal activities associated with hardware, software, maintenance, operations and environments. An integrated hazard is an event or condition that is caused by or controlled by multiple systems, elements, or subsystems. Integrated hazard analysis (IHA) is especially daunting and ambitious for large, complex systems such as NASA s Constellation program which incorporates program, systems and element components that impact others (International Space Station, public, International Partners, etc.). An appropriate IHA should identify all hazards, causes, controls and verifications used to mitigate the risk of catastrophic loss of crew, vehicle and/or mission. Unfortunately, in the current age of increased technology dependence, there is the tendency to sometimes overlook the necessary and sufficient qualifications of the integrator, that is, the person/team that identifies the parts, analyzes the architectural structure, aligns the analysis with the program plan and then communicates/coordinates with large and small components, each contributing necessary hardware, software and/or information to prevent catastrophic loss. As viewed from both Challenger and Columbia accidents, lack of appropriate communication, management errors and lack of resources dedicated to safety were cited as major contributors to these fatalities. From the accident reports, it would appear that the organizational impact of managers, integrators and safety personnel contributes more significantly to mission success and mission failure than purely technological components. If this is so, then organizations who sincerely desire mission success must put as much effort in selecting managers and integrators as they do when designing the hardware, writing the software code and analyzing competitive proposals. This paper will discuss the necessary and sufficient requirements of one of the significant contributors to mission success, the IHA integrator. Discussions will be provided to describe both the mindset required as well as deleterious assumptions/behaviors to avoid when integrating within a large scale system.

Morris, A. Terry↗
NASA NTRS2006

Partial Automation of Requirements Tracing

Requirements Tracing on Target (RETRO) is software for after-the-fact tracing of textual requirements to support independent verification and validation of software. RETRO applies one of three user-selectable information-retrieval techniques: (1) term frequency/inverse document frequency (TF/IDF) vector retrieval, (2) TF/IDF vector retrieval with simple thesaurus, or (3) keyword extraction. One component of RETRO is the graphical user interface (GUI) for use in initiating a requirements-tracing project (a pair of artifacts to be traced to each other, such as a requirements spec and a design spec). Once the artifacts have been specified and the IR technique chosen, another component constructs a representation of the artifact elements and stores it on disk. Next, the IR technique is used to produce a first list of candidate links (potential matches between the two artifact levels). This list, encoded in Extensible Markup Language (XML), is optionally processed by a filtering component designed to make the list somewhat smaller without sacrificing accuracy. Through the GUI, the user examines a number of links and returns decisions (yes, these are links; no, these are not links). Coded in XML, these decisions are provided to a "feedback processor" component that prepares the data for the next application of the IR technique. The feedback reduces the incidence of erroneous candidate links. Unlike related prior software, RETRO does not require the user to assign keywords, and automatically builds a document index.

Hayes, Jane↗
NASA NTRS2018

NOS3: NASA Operational Simulator for Small Satellites

The NASA Operational Simulator for Small Satellites (NOS3) is a suite of open-source software tools to aid in areas such as software development, integration & test (I&T), mission operations/training, verification and validation (V&V), and software systems check-out. NOS3 provides a software development environment, a multi-target build system, operational interface/ground software, dynamics and environment simulations, and software-based hardware models. NOS3 has just recently been open-sourced by NASA and is available for immediate use. It enables the development of flight software (FSW) early in the project life cycle when hardware availability is limited. Small satellite development suffers from extensive lead times on many of the commercial-off-the-shelf (COTS) components as well as limited funding for engineering test units (ETUs). To alleviate the need to provide a hardware test-bed for each developer/tester, NOS3 hardware models are based upon characteristic data or manufacturer's data sheets for each individual component. The NOS3 hardware models' fidelity is such that FSW executes unaware that physical hardware is not present. This allows FSW binaries to be compiled for both the simulation environment and the flight computer without changing the FSW source code. For hardware models that provide data which is dependent upon the environment and spacecraft dynamics, such as a GPS receiver or magnetometer, an open-source tool from NASA GSFC (42 Spacecraft Simulator) is used to provide the necessary data. The underlying infrastructure used to transfer messages between FSW and the hardware models can also be used to monitor, intercept, and inject messages, which has proven to be beneficial for V&V of larger missions such as James Webb Space Telescope (JWST). As hardware is selected and becomes available, drivers can be added to the NOS3 environment to enable hardware-in-the-loop (HWIL) testing. When strict time synchronization is not vital, any number of combinations of hardware components and software-based models can be tested. NOS3 was actively used for FSW development and component testing of the Simulation-to-Flight 1 (STF-1) CubeSat and the Lunar IceCube CubeSat. As NOS3 matures, hardware models have been added for common small satellite components such as GPS receivers, electrical power systems and batteries, and antenna systems.

Suder, Mark↗
NASA NTRS1993

Three-dimensional Navier-Stokes analysis and redesign of an imbedded bellmouth nozzle in a turbine cascade inlet section

Verification of proposed turbopump blading performance will involve evaluation of candidate blades in cascade test facilities. It is necessary to be able to predict the flow fields within these cascades for the results to be applicable to actual engine environments. This work presents the results of a study to predict the flow field for the NASA Lewis Transonic Turbine Blade Cascade Facility, which is similar to those used to evaluate rocket propulsion turbines. A pitchwise nonuniform total pressure distribution was observed at the blade row leading edge plane. A CFD analysis was used to show that the cause of the flow nonuniformity was a pair of vortices that originated in an embedded bellmouth inlet. Further CFD analysis was used to verify that a redesigned inlet section resulted in a flow with acceptable uniformity. A computational analysis was chosen because physical accessibility to the inlet section was limited, and because a computational approach also allows one to examine design changes cheaper and more quickly than an experimental approach would. The PARC code, a general purpose, three-dimensional, Navier-Stokes code with multiblock solution capability, was chosen for the present study. Results are presented detailing the computational requirements needed to accurately predict flows of this nature. Calculations of the original geometry showed total pressure loss regions consistent in strength and in location to experimental measurements. An examination of the results shows that the distortions are caused by a pair of vortices that originate as a result of the interaction of the flow with the imbedded bellmouth. Computations were performed for an inlet geometry which eliminated the imbedded bellmouth by bridging the region between it and the upstream wall. This analysis indicated that eliminating the imbedded bellmouth eliminates the troublesome pair of vortices, resulting in a flow with much greater pitchwise uniformity.

Giel, P. W.↗
NASA NTRS2003

Calibration of TOMS Radiances From Ground Observations

Verification of a stratospheric ozone recovery remains a high priority for environmental research and policy definition. Models predict an ozone recovery at a much lower rate than the measured depletion rate observed to date. Therefore improved precision of the satellite and ground ozone observing systems are required over the long term to verify its recovery. We show that validation of radiances from the ground can be a very effective means for correcting long term drifts of backscatter type satellite measurements and can be used to cross calibrate all BUV instruments in orbit (TOMS, SBUV/2, GOME, SCIAMACHY, OMI, GOME-2, OMPS). This method bypasses the retrieval algorithms used to derive ozone products from both satellite and ground based measurements that are normally used to validate the satellite data. Radiance comparisons employ forward models, but they are inherently more accurate than the retrieval This method employs very accurate comparisons between ground based zenith sicy radiances and satellite nadir radiances and employs two well established capabilities at the Goddard Space Flight Center, 1) the SSBUV calibration facilities and 2) the radiative transfer codes used for the TOMS and SBUV/2 algorithms and their subsequent refinements. The zenith sky observations are made by the SSBUV where its calibration is maintained to a high degree of accuracy and precision. Radiative transfer calculations show that ground based zenith sky and satellite nadir backscatter ultraviolet comparisons can be made very accurately under certain viewing conditions. Initial ground observations taken from Goddard Space Flight Center compared with radiative transfer calculations has indicated the feasibility of this method. The effect of aerosols and varying ozone amounts are considered in the model simulations and the theoretical comparisons. The radiative transfer simulations show that the ground and satellite radiance comparisons can be made with an uncertainty of less than l\% without the knowledge of the amount ozone viewed by either instrument on ground or in space. algorithms.

Bojkov, B. R.↗