Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “software risk”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4

Agile Approach to Adding Assurance and Mitigating Overall Mission Risk for Orion Software on EM-1

Human-rated missions like Orion are becoming exceedingly complex in terms of software contribution to achieving mission objectives, and this creates a resource challenge for everyone whose job is to add assurance that the mission is going to fly safely. Orion IV&V has addressed this challenge by providing focused assurance results of critical mission capabilities prioritized by a dynamic assessment of risk level. Prior to this approach, Orion IV&V was evaluating areas of risk in much broader, and more static, terms. Due to the Agile software development cycle that Orion follows, IV&V findings were often reported months out of phase with the developer. As a result of evolving the approach to providing assurance on Orion, IV&V is able to incrementally deliver high-priority assurance data and more impactful issues more in phase with the developer activities, thereby increasing the value of the findings to the project. The agile IV&V approach employed by the Orion IV&V team strives to achieve a cadence of delivery that matches the pace of development. This agile approach provides increased flexibility for the assurance provider to become more efficient in reporting assurance conclusions and issues. This presentation will discuss the principles which drive the design of our approach, results to date, and aspirations for long-term performance.

Assurance↗

System Risk Balancing Profiles: Software Component

The Software QA / V&V guide will be reviewed and updated based on feedback from NASA organizations and others with a vested interest in this area. Hardware, EEE Parts, Reliability, and Systems Safety are a sample of the future guides that will be developed. Cost Estimates, Lessons Learned, Probability of Failure and PACTS (Prevention, Avoidance, Control or Test) are needed to provide a more complete risk management strategy. This approach to risk management is designed to help balance the resources and program content for risk reduction for NASA's changing environment.

Kelly, John C.↗

Modeling and managing risk early in software development

In order to improve the quality of the software development process, we need to be able to build empirical multivariate models based on data collectable early in the software process. These models need to be both useful for prediction and easy to interpret, so that remedial actions may be taken in order to control and optimize the development process. We present an automated modeling technique which can be used as an alternative to regression techniques. We show how it can be used to facilitate the identification and aid the interpretation of the significant trends which characterize 'high risk' components in several Ada systems. Finally, we evaluate the effectiveness of our technique based on a comparison with logistic regression based models.

Briand, Lionel C.↗

Risk considerations for autonomy software

This paper summarizes key findings related to methods for the risk considerations of autonomy software. Existing methods for Verification and Validation (V&V) of autonomy software are summarized and a method for the assurance of autonomy software is suggested and demonstrated on a command execution use case. Risk and reliability are defined in the context of autonomy and an approach for risk assessment of autonomy is presented using an example use case. Key insights regarding areas of uncertainty for autonomy are provided, along with a suggested architecture for the systematic consideration of reliability within the context of a given autonomous planner.

Meshkat, Leila↗

Towards Automated Assessment of Vulnerability Exposures in Security Operations

Current approaches for risk analysis of software vulnerabilities using manual assessment and numeric scoring do not complete fast enough to keep pace with the maintenance work rate to patch and mitigate the vulnerabilities. This paper proposes a new approach to modeling software vulnerability risk in the context of the network environment and firewall configuration. In the approach, vulnerability features are automatically matched up with networking, target asset, and adversary features to determine whether adversaries can exploit a vulnerability. The ability of adversaries to reach a vulnerability is modeled by automatically identifying the network services associated with vulnerabilities through a pipeline of machine learning and natural language processing and automatically analyzing network reachability. Our results show that the pipeline can identify network services accurately. We also find that only a small number of vulnerabilities pose real risks to a system. However, if left unmitigated, adversarial reach to vulnerabilities may extend to nullify the effect of firewall countermeasures.

Huff, Philip↗

NASA Tech Briefs, July 2004

Topics: Optoelectronic Sensor System for Guidance in Docking; Hybrid Piezoelectric/Fiber-Optic Sensor Sheets; Multisensor Arrays for Greater Reliability and Accuracy; Integrated-Optic Oxygen Sensors; Ka-Band Autonomous Formation Flying Sensor; CMOS VLSI Active-Pixel Sensor for Tracking; Lightweight, Self-Deploying Foam Antenna Structures; Electrically Small Microstrip Quarter-Wave Monopole Antennas; A 2-to-28-MHz Phase-Locked Loop; Portable Electromyograph; Open-Source Software for Modeling of Nanoelectronic Devices; Software for Generating Strip Maps from SAR Data; Calibration Software for use with Jurassicprok; Software for Probabilistic Risk Reduction; Software Processes SAR Motion-Measurement Data; Improved Method of Purifying Carbon Nanotubes; Patterned Growth of Carbon Nanotubes or Nanofibers; Lightweight, Rack-Mountable Composite Cold Plate/Shelves; SiC-Based Miniature High-Temperature Cantilever Anemometer; Inlet Housing for a Partial-Admission Turbine; Lightweight Thermoformed Structural Components and Optics; Growing High-Quality InAs Quantum Dots for Infrared Lasers; Selected Papers on Protoplanetary Disks; Module for Oxygenating Water without Generating Bubbles; Coastal Research Imaging Spectrometer; Rapid Switching and Modulation by use of Coupled VCSELs; Laser-Induced-Fluorescence Photogrammetry and Videogrammetry; Laboratory Apparatus Generates Dual-Species Cold Atomic Beam; Laser Ablation of Materials for Propulsion of Spacecraft; Small Active Radiation Monitor; Hybrid Image-Plane/Stereo Manipulation; Partitioning a Gridded Rectangle into Smaller Rectangles; Digital Radar-Signal Processors Implemented in FPGAs; Part 1 of a Computational Study of a Drop-Laden Mixing Layer; and Some Improvements in Signal-Conditioning Circuits.

Source record↗

Risk-Informed Safety Assurance and Probabilistic Assessment of Mission-Critical Software-Intensive Systems

This report validates and documents the detailed features and practical application of the framework for software intensive digital systems risk assessment and risk-informed safety assurance presented in the NASA PRA Procedures Guide for Managers and Practitioner. This framework, called herein the "Context-based Software Risk Model" (CSRM), enables the assessment of the contribution of software and software-intensive digital systems to overall system risk, in a manner which is entirely compatible and integrated with the format of a "standard" Probabilistic Risk Assessment (PRA), as currently documented and applied for NASA missions and applications. The CSRM also provides a risk-informed path and criteria for conducting organized and systematic digital system and software testing so that, within this risk-informed paradigm, the achievement of a quantitatively defined level of safety and mission success assurance may be targeted and demonstrated. The framework is based on the concept of context-dependent software risk scenarios and on the modeling of such scenarios via the use of traditional PRA techniques - i.e., event trees and fault trees - in combination with more advanced modeling devices such as the Dynamic Flowgraph Methodology (DFM) or other dynamic logic-modeling representations. The scenarios can be synthesized and quantified in a conditional logic and probabilistic formulation. The application of the CSRM method documented in this report refers to the MiniAERCam system designed and developed by the NASA Johnson Space Center.

Guarro, Sergio B.↗

Prototype Tool Support for SEI Process and Risk Knowledge

We have developed a prototype of tool support for risk assessment that uses selected components of the Software Engineering Institute (SEI) information, specifically: Capability Maturity Model (CMM) process activities, CMM process goals and the SEI taxonomy of software project risks.

risk management risk assessment SEI CMM software r↗

The Role and Quality of Software Safety in the NASA Constellation Program

In this study, we examine software safety risk in the early design phase of the NASA Constellation spaceflight program. Obtaining an accurate, program-wide picture of software safety risk is difficult across multiple, independently-developing systems. We leverage one source of safety information, hazard analysis, to provide NASA quality assurance managers with information regarding the ongoing state of software safety across the program. The goal of this research is two-fold: 1) to quantify the relative importance of software with respect to system safety; and 2) to quantify the level of risk presented by software in the hazard analysis. We examined 154 hazard reports created during the preliminary design phase of three major flight hardware systems within the Constellation program. To quantify the importance of software, we collected metrics based on the number of software-related causes and controls of hazardous conditions. To quantify the level of risk presented by software, we created a metric scheme to measure the specificity of these software causes. We found that from 49-70% of hazardous conditions in the three systems could be caused by software or software was involved in the prevention of the hazardous condition. We also found that 12-17% of the 2013 hazard causes involved software, and that 23-29% of all causes had a software control. Furthermore, 10-12% of all controls were software-based. There is potential for inaccuracy in these counts, however, as software causes are not consistently scoped, and the presence of software in a cause or control is not always clear. The application of our software specificity metrics also identified risks in the hazard reporting process. In particular, we found a number of traceability risks in the hazard reports may impede verification of software and system safety.

Layman, Lucas↗

Improving Software Engineering on NASA Projects

Software Engineering Initiative: Reduces risk of software failure -Increases mission safety. More predictable software cost estimates and delivery schedules. Smarter buyer of contracted out software. More defects found and removed earlier. Reduces duplication of efforts between projects. Increases ability to meet the challenges of evolving software technology.

Crumbley, Tim↗

Analysis of Retinal Vascular Branching in Human Subjects Undergoing 70-Day Head-Down Tilt by NASAs VESGEN Software

Significant risks for visual impairment were discovered recently in astronauts following spaceflight, especially after long-duration missions. We hypothesize that microgravity-induced fluid shifts result in pathological changes within the retinal vasculature that precede visual and other ocular impairments. We therefore are analyzing retinal vessels in healthy subjects before and after head-down tilt (HDT), a ground-based microgravity analog with NASA's VESsel GENeration Analysis (VESGEN) software. Methods. Spectralis® infrared (IR) fundus images were collected from both eyes of 6 subjects before and after 70 days of bed rest at 6 degree HDT (NASA Campaign 11). For our retrospective study, branching patterns in arterial and venous trees are mapped by VESGEN into vessel branching generations (Gx) that are quantified by parameters such as densities of vessel length (Lv), area (Av), number (Nv) and fractal dimension (Df) as described previously for diabetic retinopathy (IOVS 51(1):498). Results are further assigned by VESGEN into groups of large (G1-3), medium (G4-6) and small (G≥7) vessels. Results. All subjects remained asymptomatic throughout duration of HDT. To date, we have analyzed one IR image from each of the 12 eyes. Interestingly, two groups of the masked study population identified by VESGEN are distinguished by the presence or absence of small veins (G≥7). For example, L≥7 and Av≥7 are 2.7+/-1.3 E-4 px/px2 and 7.2+/-3.6 E-4 px2/px2 in 6 retinas, but 0 in the other 6 retinas. Nonetheless, the space-filling properties of the entire venous trees were remarkably uniform by all parameters, such as Df = 1.56+/-0.02 for 6 retinas with G≥7 and 1.55+/-0.02 for retinas without G≥7. No small arteries (G≥7) were detected. Conclusions. For our preliminary masked analysis, two groups of venous trees with and without small veins (G≥7) were clearly revealed by VESGEN. Upon completing all images and unmasking the subject status of before and after HDT, we will determine whether differences in the presence or absence of small veins are important correlates, and perhaps reliable predictors, of other ocular and physiological adaptations to prolonged head-down tilt and microgravity. Clinical methods for examining adaptive microvascular remodeling in the retina to microgravity space flight are not currently established.

Fractal↗

Security Risks: Management and Mitigation in the Software Life Cycle

A formal approach to managing and mitigating security risks in the software life cycle is requisite to developing software that has a higher degree of assurance that it is free of security defects which pose risk to the computing environment and the organization. Due to its criticality, security should be integrated as a formal approach in the software life cycle. Both a software security checklist and assessment tools should be incorporated into this life cycle process and integrated with a security risk assessment and mitigation tool. The current research at JPL addresses these areas through the development of a Sotfware Security Assessment Instrument (SSAI) and integrating it with a Defect Detection and Prevention (DDP) risk management tool.

securiy↗

Quantitative Measures for Software Independent Verification and Validation

As software is maintained or reused, it undergoes an evolution which tends to increase the overall complexity of the code. To understand the effects of this, we brought in statistics experts and leading researchers in software complexity, reliability, and their interrelationships. These experts' project has resulted in our ability to statistically correlate specific code complexity attributes, in orthogonal domains, to errors found over time in the HAL/S flight software which flies in the Space Shuttle. Although only a prototype-tools experiment, the result of this research appears to be extendable to all other NASA software, given appropriate data similar to that logged for the Shuttle onboard software. Our research has demonstrated that a more complete domain coverage can be mathematically demonstrated with the approach we have applied, thereby ensuring full insight into the cause-and-effects relationship between the complexity of a software system and the fault density of that system. By applying the operational profile we can characterize the dynamic effects of software path complexity under this same approach We now have the ability to measure specific attributes which have been statistically demonstrated to correlate to increased error probability, and to know which actions to take, for each complexity domain. Shuttle software verifiers can now monitor the changes in the software complexity, assess the added or decreased risk of software faults in modified code, and determine necessary corrections. The reports, tool documentation, user's guides, and new approach that have resulted from this research effort represent advances in the state of the art of software quality and reliability assurance. Details describing how to apply this technique to other NASA code are contained in this document.

Lee, Alice↗

Requirement Metrics for Risk Identification

The Software Assurance Technology Center (SATC) is part of the Office of Mission Assurance of the Goddard Space Flight Center (GSFC). The SATC's mission is to assist National Aeronautics and Space Administration (NASA) projects to improve the quality of software which they acquire or develop. The SATC's efforts are currently focused on the development and use of metric methodologies and tools that identify and assess risks associated with software performance and scheduled delivery. This starts at the requirements phase, where the SATC, in conjunction with software projects at GSFC and other NASA centers is working to identify tools and metric methodologies to assist project managers in identifying and mitigating risks. This paper discusses requirement metrics currently being used at NASA in a collaborative effort between the SATC and the Quality Assurance Office at GSFC to utilize the information available through the application of requirements management tools.

Hammer, Theodore↗