Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Software Verification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 793 records · Page 44
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Autonomous Inspection of Geologic Repositories: Current State of the Art and Future Directions

Geological repositories for nuclear waste, including spent nuclear fuel, present a significant challenge for traditional International Atomic Energy Agency (IAEA) safeguards tools due to their inaccessibility and demanding operational conditions. The IAEA has been working closely with Member State organizations currently involved in repository construction and planning, including Euratom, the Finnish and Swedish regulatory authorities, and relevant facility operators. However, the verification challenge remains unsolved, and there persists an out- standing need for tools and approaches that will help the IAEA verify that no nuclear material is diverted from a repository environment. The challenge is also not static. Activities must encompass verification of the design, prior to and during the construction/operation phase, and post backfill. Throughout these various phases, it is imperative that the IAEA maintains a continuity of knowledge (CoK) of all material including information on material inventory and flow. This paper highlights these challenges and outlines how they might be addressed by using remote or autonomous vehicles. Specifically, we discuss the current state of the art in robotic autonomy for known or partially known environment mapping and patrolling, as well as shared autonomy, where humans collaborate with closed loop autonomation to complete tasks. We explore the feasibility of using rovers for these verification tasks, along with the challenges associated with system implementation. Hardware and software suggestions are provided based on the adoption of similar technologies in other comparable areas and ability to close technical gaps. Lastly, human-robotic interactions are considered based on the challenges of the environment of the repository and effective deployment and continued operation of the robot system.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2021

Exploring Explicit Uncertainty for Binary Analysis (EUBA)

Reverse engineering (RE) analysts struggle to address critical questions about the safety of binary code accurately and promptly, and their supporting program analysis tools are simply wrong sometimes. The analysis tools have to approximate in order to provide any information at all, but this means that they introduce uncertainty into their results. And those uncertainties chain from analysis to analysis. We hypothesize that exposing sources, impacts, and control of uncertainty to human binary analysts will allow the analysts to approach their hardest problems with high-powered analytic techniques that they know when to trust. Combining expertise in binary analysis algorithms, human cognition, uncertainty quantification, verification and validation, and visualization, we pursue research that should benefit binary software analysis efforts across the board. We find a strong analogy between RE and exploratory data analysis (EDA); we begin to characterize sources and types of uncertainty found in practice in RE (both in the process and in supporting analyses); we explore a domain-specific focus on uncertainty in pointer analysis, showing that more precise models do help analysts answer small information flow questions faster and more accurately; and we test a general population with domain-general sudoku problems, showing that adding "knobs" to an analysis does not significantly slow down performance. This document describes our explorations in uncertainty in binary analysis.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS1995

Making intelligent systems team players. A guide to developing intelligent monitoring systems

This reference guide for developers of intelligent monitoring systems is based on lessons learned by developers of the DEcision Support SYstem (DESSY), an expert system that monitors Space Shuttle telemetry data in real time. DESSY makes inferences about commands, state transitions, and simple failures. It performs failure detection rather than in-depth failure diagnostics. A listing of rules from DESSY and cue cards from DESSY subsystems are included to give the development community a better understanding of the selected model system. The G-2 programming tool used in developing DESSY provides an object-oriented, rule-based environment, but many of the principles in use here can be applied to any type of monitoring intelligent system. The step-by-step instructions and examples given for each stage of development are in G-2, but can be used with other development tools. This guide first defines the authors' concept of real-time monitoring systems, then tells prospective developers how to determine system requirements, how to build the system through a combined design/development process, and how to solve problems involved in working with real-time data. It explains the relationships among operational prototyping, software evolution, and the user interface. It also explains methods of testing, verification, and validation. It includes suggestions for preparing reference documentation and training users.

Land, Sherry A.↗
NASA NTRS2001

Cost-benefit based assurance planning

We have extended an existing risk management framework with a refined cost-benefit model. Benefits are measured in terms of reduction of risk.

risk requirements tradeoffs design quality assuran↗
NASA NTRS2020

Multibody Based Digital Astronaut Dynamics Simulation

BACKGROUND: This study provides the Software, Robotics, & Simulation Division at the NASA Johnson Space Center with a verification tool for multibody dynamics simulation requiring human motion. The motivation stems from current studies of several Vibration Isolation & Stabilization(VIS)system designs that attenuate the moments and forces which would be transmitted to a spacecraft during an exercise. A multibody dynamics model for a proposed VIS was available previously[1], therefore modeling of the VIS was not needed for this work. The interest here is in creating the multibody dynamics model of an astronaut in motion which may be utilized independently or while attached to a mechanism. An existing simulation [2] that utilizes OpenSim [3,4] and an in-house multibody dynamics package (MBDyn) [5] is used in order to verify the astronaut model. The main advantage this model will have over the existing simulation is that everything will be processed in one tool. METHODS AND RESULTS: Creating the simulation required; estimation of Body Segment Inertial Parameters (BSIP),a multibody model of the human-VIS system, joint acceleration profiles, and input files for MBDyn, which is used for this analysis. The scaling factors provided by Dumas et al. [6] are utilized in estimating the BSIP. Anthropometric data are used for estimating these parameters, the Anthropometric Survey of US Army Personnel (ANSUR II) [7] was the source. The astronaut model consists of 15 bodies, 14 joints and 32 degrees of freedom, with the dynamics topology generated using the center of mass locations and anthropometric data. MBDyn has an option for prescribed joint motion (PJM), which requires joint acceleration data as input. The joint angle data is first obtained from a motion capture system and then processed through code that has been created to generate approximate joint acceleration profiles. The topology tree for the astronaut model begins at the right foot up to the pelvis where there is one branch for going down the left leg and another for the torso. The torso branch leads to branches for the arms and a leaf body for the head/neck segment. For attachment to the VIS, the heel of the right foot is connected to the VIS platform through a fixed joint, resembling a foot restraint. The left foot does not attach to the platform in order to prevent a system with a closed loop. Topology and symmetry of the astronaut model were verified through kinematic analysis. Further verification of the forces and moments transmitted to the VIS were verified against the existing simulation. There was a satisfactory level of agreement when testing a simple motion, for example, rocking back and forth. Full exercise motions are to be tested soon. The main outcome has been a novel application of MBDyn for biomechanics modeling that is now available for dynamic simulations involving human motion. The estimation of BSIP was another useful result of this study, requiring only 15 inputs for generating mass properties of a theoretical astronaut model. Expansion on this work is possible by going through an alternative route in obtaining the joint motion data. Instead of high-tech and often expensive motion capture systems, an individual may watch videos with high focus and at a slow motion for each individual segment in order to determine the initial and final time and angle for that specific degree of freedom. Synthetic trajectories may also be created if there is no video reference available.

F N Matari↗
NASA NTRSDate not supplied

Structural Sizing of a Composite Transonic Truss-Braced Wing

Accurate finite element modeling (FEM) is a vital part of the modern aircraft design process. As aircraft become increasingly complex, the time-consuming nature of detailed FEM approaches comes at a significant cost to program timeline and budget. In an effort produce modeling efforts that are sufficiently accurate and minimally costly, a proposed FEM approach and optimization scheme for a composite aircraft is explored, including a discussion of the manufacturing constraints of a highly tailored composite panel design. A high-fidelity structural model of a transonic truss-braced wing (TTBW) is generated, and the components are sized by structural optimization to satisfy buckling and strength constraints while subjected to critical maneuver loads. The structural modeling approaches and sizing of a TTBW are discussed, including details for FEM approaches, verification of an approximated FEM approach, a sizing optimization using the optimization software LS-OPT, and a manufacturing trial of integrally stiffened composite panels conducted to explore the validity of highly tailored composites as a design consideration. The results of study discussed herein indicate that the proposed FEM approach is suitable for modeling composite-construction aircraft and for use in sizing optimization. Further efforts regarding integrally stiffened composite panels will indicate the suitability of this method for the integration of highly tailored composite panels into the design and optimization process, given the manufacturability of such panels as shown here.

Finite Element↗
NASA NTRSDate not supplied

Structural Sizing of a Transonic Truss-Braced Wing

Accurate finite element modeling (FEM) is a vital part of the modern aircraft design process. As aircraft become increasingly complex, the time-consuming nature of detailed FEM approaches comes at a significant cost to program timeline and budget. In an effort produce modeling efforts that are sufficiently accurate and minimally costly, a proposed FEM approach and optimization scheme for a composite aircraft is explored, including a discussion of the manufacturing constraints of a highly tailored composite panel design. A high-fidelity structural model of a transonic truss-braced wing (TTBW) is generated, and the components are sized by structural optimization to satisfy buckling and strength constraints while subjected to critical maneuver loads. The structural modeling approaches and sizing of a TTBW are discussed, including details for FEM approaches, verification of an approximated FEM approach, a sizing optimization using the optimization software LS-OPT, and a manufacturing trial of integrally stiffened composite panels conducted to explore the validity of highly tailored composites as a design consideration. The results of study discussed herein indicate that the proposed FEM approach is suitable for modeling composite-construction aircraft and for use in sizing optimization. Further efforts regarding integrally stiffened composite panels will indicate the suitability of this method for the integration of highly tailored composite panels into the design and optimization process, given the manufacturability of such panels as shown here.

Finite Element↗
DOE OSTI2017

Implementation of a pressure correction term in the CTF sub-channel code

CTF [1] is a modernized and improved version of the legacy subchannel code, COBRA-TF [2], that is being jointly developed and maintained by Oak Ridge National Laboratory (ORNL) and North Carolina State University. The code was adopted by ORNL for use in the Consortium for Advanced Simulation of Light Water Reactors (CASL) in 2012 for aiding in addressing CASL challenge problems. Since that time, activities related to CTF have included implementing software quality assurance measures, implementing new features and models, performing validation and verification testing, establishing and supporting a CTF User Group, and developing the code for use in coupled applications [3, 4, 5]. CTF is applicable to single- and two-phase flows in light water reactor geometries at normal and accident operating conditions. The two-phase flow model consists of the six-equation two-phase flow model [6] augmented by equations for the droplet field and also includes appropriate source terms. This work focuses on the numerical stability of the six-equation two-phase flow model and is part of a recent eort to improve CTF capabilities for simulating flows in boiling nuclear reactors (BWRs). As it is of common knowledge among the thermodynamic community, the six-equation two-phase flow model is not strongly hyperbolic, meaning some of its eigenvalues are either not real or not distinct [7]. In a Cauchy sense and for an initial-value problem, strong hyperbolicity was found to be equivalent to well-posedness which ensures uniqueness of the solution in the space-time used. This concept is also of importance when designing high-order numerical methods and also when implementing boundary conditions that rely on real eigenvalues such as Riemann solvers. A tremendous amount of research is available in the literature on how to hyperbolize the six-equation two-phase flow model by adding ad hoc terms to the system of equations often referred to as virtual mass or interfacial pressure correction term. From a mathematical prospective, the main idea driving this approach is to add terms to the phasic momentum equation containing first-order partial derivatives of the unknowns to modify the Jacobian matrix and thus canceling the imaginary part of the eigenvalues.For this work it was chosen to implement a interfacial pressure correction (IPC) term on the same model as what was done for the CATHARE system code [8], that allows to recover a two-pressure formulation. In the following, the six-equation two-phase flow model is recalled along with the IPC term and its influence on the eigenvalues. Then, numerical results and convergence studies are presented for a water-faucet problem [9] at a pressure of 10 bar. Finally, conclusions and future work are addressed.

Delchini, Marco↗
DOE OSTI2020

Autonomous Monitoring of Nuclear Repositories: Current State of the Art and Future Directions

Geological repositories for nuclear waste, including spent nuclear fuel, present a significant challenge for traditional International Atomic Energy Agency (IAEA) safeguards tools due to their inaccessibility and demanding operational conditions. The IAEA has been working closely with Member State organizations currently involved in repository construction and planning, including Euratom, the Finnish and Swedish regulatory authorities, and relevant facility operators. However, the verification challenge remains unsolved, and there persists an out- standing need for tools and approaches that will help the IAEA verify that no nuclear material is diverted from a repository environment. The challenge is also not static. Activities must encompass verification of the design, prior to and during the construction/operation phase, and post backfill. Throughout these various phases, it is imperative that the IAEA maintains a continuity of knowledge (CoK) of all material including information on material inventory and flow. This paper highlights these challenges and outlines how they might be addressed by using remote or autonomous vehicles. Specifically, we discuss the current state of the art in robotic autonomy for known or partially known environment mapping and patrolling, as well as shared autonomy, where humans collaborate with closed-loop autonomation to complete tasks. We explore the feasibility of using rovers for these verification tasks, along with the challenges associated with system implementation. Hardware and software suggestions are provided based on the adoption of similar technologies in other comparable areas and ability to close technical gaps. Lastly, human-robotic interactions are considered based on the challenges of the environment of the repository and effective deployment and continued operation of the robot system.

geologic repository, safeguards, IAEA, Robotics↗
DOE OSTI2017

Implementation of a Pressure Correction Term in the CTF Subchannel Code

CTF is a modernized and improved version of the legacy subchannel code COBRA-TF, being jointly developed and maintained by Oak Ridge National Laboratory (ORNL) and North Carolina State University. The code was adopted by ORNL for use in the Consortium for Advanced Simulation of Light Water Reactors (CASL) in 2012 to help address CASL challenge problems. Since that time, activities related to CTF have included implementing software quality assurance measures, implementing new features and models, performing validation and verification testing, establishing and supporting a CTF user group, and developing the code for use in coupled applications. CTF is applicable to single- and two-phase flows in light water reactor geometries at normal and accident operating conditions. The two-phase flow model consists of the six-equation two-phase flow model augmented by equations for the droplet field, and it also includes appropriate source terms. This work focuses on the numerical stability of the six-equation two-phase flow model and is part of a recent effort to improve CTF capabilities for simulating flows in boiling water reactors (BWRs). The six-equation two-phase flow model is not strongly hyperbolic, meaning that some of its eigenvalues are either not real or not distinct. In a Cauchy sense, and for an initial-value problem, strong hyperbolicity was found to be equivalent to well-posedness, which ensures the uniqueness of the solution in the space-time used. This concept is also of importance when designing high-order numerical methods and also when implementing boundary conditions that rely on real eigenvalues such as Riemann solvers. A tremendous amount of research is available in the literature on how to hyperbolize the six-equation two-phase flow model by adding ad hoc terms to the system of equations. Such terms are often referred to as virtual mass or interfacial pressure correction terms. From a mathematical perspective, this approach adds terms to the phasic momentum equation containing first-order partial derivatives of the unknowns to modify the Jacobian matrix, thus the imaginary part of the eigenvalues. For this work, an interfacial pressure correction (IPC) term on the same model as what was used for the CATHARE system code, is implemented in CTF. This allows for recovery of a two-pressure formulation. In the following, the six-equation two-phase flow model is recalled, along with the IPC term and its influence on the eigenvalues. Then, numerical results and convergence studies are presented for a water-faucet problem at a pressure of 10 bar. Finally, conclusions and future work are addressed.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2024

Toward Polydisperse Flows With MFIX-EXA

In the presence of large size disparities, single-grid neighbor search algorithms lead to inflated neighbor lists that significantly degrade the performance of Lagrangian particle solvers. If Eulerian–Lagrangian (EL) frameworks are to remain performant when simulating realistic systems, improved neighbor detection approaches must be adopted. To this end, we consider the application of a multigrid neighbor search (MGNS) algorithm in the mfix-exa software package, an exascale EL solver built upon the AMReX library. Here, details regarding the implementation and verification of MGNS are provided along with speedup curves for a bidisperse mixing layer. MGNS is shown to yield up to 15$\times$ speedup on CPU and 6$\times$ speedup on GPU for the problems considered here. The mfix-exa software is then validated for a variety of polydisperse flows. Finally, a brief discussion is given for how dynamic MGNS may be completed, with application to spatially varying particle size distributions.

42 ENGINEERING↗
DOE OSTI2015

SU-E-J-16: Automatic Image Contrast Enhancement Based On Automatic Parameter Optimization for Radiation Therapy Setup Verification

Purpose: In RT patient setup 2D images, tissues often cannot be seen well due to the lack of image contrast. Contrast enhancement features provided by image reviewing software, e.g. Mosaiq and ARIA, require manual selection of the image processing filters and parameters thus inefficient and cannot be automated. In this work, we developed a novel method to automatically enhance the 2D RT image contrast to allow automatic verification of patient daily setups as a prerequisite step of automatic patient safety assurance. Methods: The new method is based on contrast limited adaptive histogram equalization (CLAHE) and high-pass filtering algorithms. The most important innovation is to automatically select the optimal parameters by optimizing the image contrast. The image processing procedure includes the following steps: 1) background and noise removal, 2) hi-pass filtering by subtracting the Gaussian smoothed Result, and 3) histogram equalization using CLAHE algorithm. Three parameters were determined through an iterative optimization which was based on the interior-point constrained optimization algorithm: the Gaussian smoothing weighting factor, the CLAHE algorithm block size and clip limiting parameters. The goal of the optimization is to maximize the entropy of the processed Result. Results: A total 42 RT images were processed. The results were visually evaluated by RT physicians and physicists. About 48% of the images processed by the new method were ranked as excellent. In comparison, only 29% and 18% of the images processed by the basic CLAHE algorithm and by the basic window level adjustment process, were ranked as excellent. Conclusion: This new image contrast enhancement method is robust and automatic, and is able to significantly outperform the basic CLAHE algorithm and the manual window-level adjustment process that are currently used in clinical 2D image review software tools.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2016

Verification and Validation of Multisegmented Mooring Capabilities in FAST v8

The quasi-static and dynamic mooring modules of the open-source aero-hydro-servo-elastic wind turbine simulation software, FAST v8, have previously been verified and validated, but only for mooring arrangements consisting of single lines connecting each fairlead and anchor. This paper extends the previous verification and validation efforts to focus on the multisegmented mooring capability of the FAST v8 modules: MAP++, MoorDyn, and the OrcaFlex interface. The OC3-Hywind spar buoy system tested by the DeepCwind consortium at the MARIN ocean basin, which includes a multisegmented bridle layout of the mooring system, was used for the verification and validation activities.

17 WIND ENERGY↗
NASA NTRS2000

Formal Analysis of the Remote Agent Before and After Flight

This paper describes two separate efforts that used the SPIN model checker to verify deep space autonomy flight software. The first effort occurred at the beginning of a spiral development process and found five concurrency errors early in the design cycle that the developers acknowledge would not have been found through testing. This effort required a substantial manual modeling effort involving both abstraction and translation from the prototype LISP code to the PROMELA language used by SPIN. This experience and others led to research to address the gap between formal method tools and the development cycle used by software developers. The Java PathFinder tool which directly translates from Java to PROMELA was developed as part of this research, as well as automatic abstraction tools. In 1999 the flight software flew on a space mission, and a deadlock occurred in a sibling subsystem to the one which was the focus of the first verification effort. A second quick-response "cleanroom" verification effort found the concurrency error in a short amount of time. The error was isomorphic to one of the concurrency errors found during the first verification effort. The paper demonstrates that formal methods tools can find concurrency errors that indeed lead to loss of spacecraft functions, even for the complex software required for autonomy. Second, it describes progress in automatic translation and abstraction that eventually will enable formal methods tools to be inserted directly into the aerospace software development cycle.

Havelund, Klaus↗
NASA NTRS2015

The Use of UML for Software Requirements Expression and Management

It is common practice to write English-language "shall" statements to embody detailed software requirements in aerospace software applications. This paper explores the use of the UML language as a replacement for the English language for this purpose. Among the advantages offered by the Unified Modeling Language (UML) is a high degree of clarity and precision in the expression of domain concepts as well as architecture and design. Can this quality of UML be exploited for the definition of software requirements? While expressing logical behavior, interface characteristics, timeliness constraints, and other constraints on software using UML is commonly done and relatively straight-forward, achieving the additional aspects of the expression and management of software requirements that stakeholders expect, especially traceability, is far less so. These other characteristics, concerned with auditing and quality control, include the ability to trace a requirement to a parent requirement (which may well be an English "shall" statement), to trace a requirement to verification activities or scenarios which verify that requirement, and to trace a requirement to elements of the software design which implement that requirement. UML Use Cases, designed for capturing requirements, have not always been satisfactory. Some applications of them simply use the Use Case model element as a repository for English requirement statements. Other applications of Use Cases, in which Use Cases are incorporated into behavioral diagrams that successfully communicate the behaviors and constraints required of the software, do indeed take advantage of UML's clarity, but not in ways that support the traceability features mentioned above. Our approach uses the Stereotype construct of UML to precisely identify elements of UML constructs, especially behaviors such as State Machines and Activities, as requirements, and also to achieve the necessary mapping capabilities. We describe this approach in the context of a space-based software application currently under development at the Jet Propulsion Laboratory.

model-based engineering↗
DOE OSTI2015

SU-E-T-32: A Feasibility Study of Independent Dose Verification for IMAT

Purpose: To assess the feasibility of the independent dose verification (Indp) for intensity modulated arc therapy (IMAT). Methods: An independent dose calculation software program (Simple MU Analysis, Triangle Products, JP) was used in this study, which can compute the radiological path length from the surface to the reference point for each control point using patient’s CT image dataset and the MLC aperture shape was simultaneously modeled in reference to the information of MLC from DICOM-RT plan. Dose calculation was performed using a modified Clarkson method considering MLC transmission and dosimetric leaf gap. In this study, a retrospective analysis was conducted in which IMAT plans from 120 patients of the two sites (prostate / head and neck) from four institutes were retrospectively analyzed to compare the Indp to the TPS using patient CT images. In addition, an ion-chamber measurement was performed to verify the accuracy of the TPS and the Indp in water-equivalent phantom. Results: The agreements between the Indp and the TPS (mean±1SD) were −0.8±2.4% and −1.3±3.8% for the regions of prostate and head and neck, respectively. The measurement comparison showed similar results (−0.8±1.6% and 0.1±4.6% for prostate and head and neck). The variation was larger in the head and neck because the number of the segments was increased that the reference point was under the MLC and the modified Clarkson method cannot consider the smooth falloff of the leaf penumbra. Conclusion: The independent verification program would be practical and effective for secondary check for IMAT with the sufficient accuracy in the measurement and CT-based calculation. The accuracy would be improved if considering the falloff of the leaf penumbra.

60 APPLIED LIFE SCIENCES↗
DOE OSTI2016

SU-F-J-72: A Clinical Usable Integrated Contouring Quality Evaluation Software for Radiotherapy

Purpose: To introduce the Auto Contour Evaluation (ACE) software, which is the clinical usable, user friendly, efficient and all-in-one toolbox for automatically identify common contouring errors in radiotherapy treatment planning using supervised machine learning techniques. Methods: ACE is developed with C# using Microsoft .Net framework and Windows Presentation Foundation (WPF) for elegant GUI design and smooth GUI transition animations through the integration of graphics engines and high dots per inch (DPI) settings on modern high resolution monitors. The industrial standard software design pattern, Model-View-ViewModel (MVVM) pattern, is chosen to be the major architecture of ACE for neat coding structure, deep modularization, easy maintainability and seamless communication with other clinical software. ACE consists of 1) a patient data importing module integrated with clinical patient database server, 2) a 2D DICOM image and RT structure simultaneously displaying module, 3) a 3D RT structure visualization module using Visualization Toolkit or VTK library and 4) a contour evaluation module using supervised pattern recognition algorithms to detect contouring errors and display detection results. ACE relies on supervised learning algorithms to handle all image processing and data processing jobs. Implementations of related algorithms are powered by Accord.Net scientific computing library for better efficiency and effectiveness. Results: ACE can take patient’s CT images and RT structures from commercial treatment planning software via direct user input or from patients’ database. All functionalities including 2D and 3D image visualization and RT contours error detection have been demonstrated with real clinical patient cases. Conclusion: ACE implements supervised learning algorithms and combines image processing and graphical visualization modules for RT contours verification. ACE has great potential for automated radiotherapy contouring quality verification. Structured with MVVM pattern, it is highly maintainable and extensible, and support smooth connections with other clinical software tools.

60 APPLIED LIFE SCIENCES↗
NASA NTRS2006

Emerging technologies for V&V of ISHM software for space exploration

Systems1,2 required to exhibit high operational reliability often rely on some form of fault protection to recognize and respond to faults, preventing faults' escalation to catastrophic failures. Integrated System Health Management (ISHM) extends the functionality of fault protection to both scale to more complex systems (and systems of systems), and to maintain capability rather than just avert catastrophe. Forms of ISHM have been utilized to good effect in the maintenance phase of systems' total lifecycles (often referred to as 'condition-based mainte-nance'), but less so in a 'fault protection' role during actual operations. One of the impediments to such use lies in the challenges of verification, validation and certification of ISHM systems themselves. This paper makes the case that state-of-the-practice V&V and certification techniques will not suffice for emerging forms of ISHM systems; however, a number of maturing software engineering assurance technologies show particular promise for addressing these ISHM V&V challenges.

fault detection, isolation, and recovery↗