Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Domain knowledge”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 991 records · Page 55
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

SYSTEMATIC MULTI-INDEX VALIDATIONS OF SIDI ENGINE FLOW FIELD LES COMPUTATIONS USING CRANK ANGLE-RESOLVED PIV MEASUREMENTS

In-cylinder flow fields make significant impacts on the fuel atomization, fuel mixture formation, and combustion process in spark ignition direct injection (SIDI) engines. In recent years, model-based simulation approaches are preferred in regard to investigating the transient in-cylinder flow field characteristics. Most commonly, the simulation models are validated using single representative flow field at a typical crank angle measured by particle image velocimetry (PIV). However, it provides only limited knowledge about the flow field which is highly three-dimensional and of transient nature. In this study, crank angle-resolved Ply measurements are conducted on three distinct planes inside the cylinder to capture the transient process of flow field characteristics which vary with the crank angle. These three planes consist of one tumble plane through the spark plug tip, one tumble plane along two intake ports, and one swirl plane at 30 mm below the cylinder head. Large eddy simulation (LES) is employed for the numerical computations using the CONVERGE codes. On the basis of large datasets for both temporal and spatial domains, a multi-index systematic validation approach is conducted. Crank angle-resolved calculations of global indices and local indices are implemented using the flow fields velocity data obtained from both PIV and LES on select planes. Global indices reveal the trends in similarities of different crank angle degrees and locations, while local indices give the detail comparison results. In summary, with the systematic multi-index validation approach, the crucial crank angle degrees and locations for model verification will be detected. Furthermore, the corresponding critical flow features are analyzed. Practical guideline of flow field validation is proposed.

Crank angle-resolved PIV↗
NASA NTRS2008

Virtual Energetic Particle Observatory (VEPO)

The Virtual Energetic Particle Observatory (VEPO) focuses on improved discovery, access, and usability of heliospheric energetic particle and ancillary data products from selected spacecraft and sub-orbital instruments of the heliophysics data environment. The energy range of interest extends over the full range of particle acceleration from keV energies of suprathermal seed particles to GeV energies of galactic cosmic ray particles. Present spatial coverage is for operational and legacy spacecraft operating from the inner to the outer heliosphere, e.g. from measurements by the two Helios spacecraft to 0.3 AU to the inner heliosheath region now being traversed by the two Voyager spacecraft. This coverage will eventually be extended inward to ten solar radii by the planned NASA solar probe mission and at the same time beyond the heliopause into the outer heliosheath by continued Voyager operations. The geospace fleet of spacecraft providing near-Earth interplanetary measurements, selected magnetospheric spacecraft providing direct measurements of penetrating interplanetary energetic particles, and interplanetary cruise measurements from planetary spacecraft missions further extend VEPO resources to the domain of geospace and planetary interactions. Ground-based (e.g., neutron monitor) and high-altitude suborbital measurements can expand coverage to the highest energies of galactic cosmic rays affected by heliospheric interaction and of solar energetic particles. Science applications include investigation of solar flare and coronal mass ejection events. acceleration and transport of interplanetary particles within the inner heliosphere, cosmic ray interactions with planetary surfaces and atmospheres, sources of suprathermal and anomalous cosmic ray ions in the outer heliosphere, and solar cycle modulation of galactic cosmic rays. Robotic and human exploration, and eventual habitation, of planetary and space environments beyond the Earth require knowledge of radiation hazards informed by VEPO data resources. The VEPO project has completed the first year of work to define science requirements, to document and register selected data products in SPASE format while evolving SPASE for increased applicability to VEPO data, and to support enhanced discovery and access for these products through the evolving data query and middleware system of the Virtual Heliospheric Observatory (VHO). The VEPO team operates as a heliophysics focus group for energetic particle data resources in partnership with VHO and also leverages existing data services of NASA's Space Physics Data Facility. We invite comments from the U.S. and international data provider and user communities on review of the current VEPO/VHO user interface, on directions for future evolution of VEPO and supporting data systems including VHO and SPDF, and on relations to other elements of the heliophysics virtual observatory environment.

Cooper, John F.↗
DOE OSTI2023

ET-AL: Entropy-targeted active learning for bias mitigation in materials data

Growing materials data and data-driven informatics drastically promote the discovery and design of materials. While there are significant advancements in data-driven models, the quality of data resources is less studied despite its huge impact on model performance. In this work, we focus on data bias arising from uneven coverage of materials families in existing knowledge. Observing different diversities among crystal systems in common materials databases, we propose an information entropy-based metric for measuring this bias. To mitigate the bias, we develop an entropy-targeted active learning (ET-AL) framework, which guides the acquisition of new data to improve the diversity of underrepresented crystal systems. We demonstrate the capability of ET-AL for bias mitigation and the resulting improvement in downstream machine learning models. This approach is broadly applicable to data-driven materials discovery, including autonomous data acquisition and dataset trimming to reduce bias, as well as data-driven informatics in other scientific domains.

36 MATERIALS SCIENCE↗
DOE OSTI2020

Desert truffle genomes reveal their reproductive modes and new insights into plant–fungal interaction and ectendomycorrhizal lifestyle

Desert truffles are edible hypogeous fungi forming ectendomycorrhizal symbiosis with plants of Cistaceae family. Knowledge about the reproductive modes of these fungi and the molecular mechanisms driving the ectendomycorrhizal interaction is lacking. Genomes of the highly appreciated edible desert truffles Terfezia claveryi Chatin and Tirmania nivea Trappe have been sequenced and compared with other Pezizomycetes. Transcriptomes of T. claveryi × Helianthemum almeriense mycorrhiza from well-watered and drought-stressed plants, when intracellular colonizations is promoted, were investigated. We have identified the fungal genes related to sexual reproduction in desert truffles and desert-truffles-specific genomic and secretomic features with respect to other Pezizomycetes, such as the expansion of a large set of gene families with unknown Pfam domains and a number of species or desert-truffle-specific small secreted proteins differentially regulated in symbiosis. A core set of plant genes, including carbohydrate, lipid-metabolism, and defence-related genes, differentially expressed in mycorrhiza under both conditions was found. Our results highlight the singularities of desert truffles with respect to other mycorrhizal fungi while providing a first glimpse on plant and fungal determinants involved in ecto to endo symbiotic switch that occurs in desert truffle under dry conditions.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2021

NNSA/CEA Workflow (Workshop Report)

This report, prepared by the NNSA/CEA Workflows Working Group, briefly summarizes the presentations in the areas of domain specific workflows, end user environments, data management, job and resource management, and infrastructure, and then identifies six broad areas for potential collaboration. A key finding is that users could benefit from greater interoperability, compatibility, and composability of the workflow technologies under development and that point-to-point collaboration opportunities should be identified to explore these aspects.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
DOE OSTI2023

Cryo-EM structures reveal native GABA A receptor assemblies and pharmacology

Type A γ-aminobutyric acid receptors (GABA A Rs) are the principal inhibitory receptors in the brain and the target of a wide range of clinical agents, including anaesthetics, sedatives, hypnotics and antidepressants. However, our understanding of GABA A R pharmacology has been hindered by the vast number of pentameric assemblies that can be derived from 19 different subunits and the lack of structural knowledge of clinically relevant receptors. Here, we isolate native murine GABA A R assemblies containing the widely expressed α1 subunit and elucidate their structures in complex with drugs used to treat insomnia (zolpidem (ZOL) and flurazepam) and postpartum depression (the neurosteroid allopregnanolone (APG)). Using cryo-electron microscopy (cryo-EM) analysis and single-molecule photobleaching experiments, we uncover three major structural populations in the brain: the canonical α1β2γ2 receptor containing two α1 subunits, and two assemblies containing one α1 and either an α2 or α3 subunit, in which the single α1-containing receptors feature a more compact arrangement between the transmembrane and extracellular domains. Interestingly, APG is bound at the transmembrane α/β subunit interface, even when not added to the sample, revealing an important role for endogenous neurosteroids in modulating native GABA A Rs. Together with structurally engaged lipids, neurosteroids produce global conformational changes throughout the receptor that modify the ion channel pore and the binding sites for GABA and insomnia medications. Our data reveal the major α1-containing GABA A R assemblies, bound with endogenous neurosteroid, thus defining a structural landscape from which subtype-specific drugs can be developed.

59 BASIC BIOLOGICAL SCIENCES↗
DOE OSTI2022

Calcium dissolution in bridgmanite in the Earth’s deep mantle

Accurate knowledge of the mineralogy is essential for understanding the lower mantle, which represents more than half of Earth'svolume. CaSiO 3 perovskite is believed to be the third-most-abundant mineral throughout the lower mantle, following bridgmanite and ferropericlase. Here we experimentally show that the calcium solubility in bridgmanite increases steeply at about 2,300 kelvin and above 40 gigapascals to a level sufficient for a complete dissolution of all CaSiO 3 component in pyrolite into bridgmanite, resulting in the disappearance of CaSiO 3 perovskite at depths greater than about 1,800 kilometres along the geotherm. Hence we propose a change from a two-perovskite domain (TPD; bridgmanite plus CaSiO 3 perovskite) at the shallower lower mantle to a single-perovskite domain (SPD; calcium-rich bridgmanite) at the deeper lower mantle. Iron seems to have a key role in increasing the calcium solubility in bridgmanite. The temperature-driven nature can cause large lateral variations in the depth of the TPD-to-SPD change in response to temperature variations (by more than 500 kilometres). Furthermore, the SPD should have been thicker in the past when the mantle was warmer. Our finding requires revision of the deep-mantle mineralogy models and will have an impact on our understanding of the composition, structure, dynamics and evolution of the region.

58 GEOSCIENCES↗
DOE OSTI2021

Scaling theory of three-dimensional magnetic reconnection spreading

We develop a first-principles scaling theory of the spreading of three-dimensional (3D) magnetic reconnection of finite extent in the out of plane direction. This theory addresses systems with or without an out of plane (guide) magnetic field, and with or without Hall physics. The theory reproduces known spreading speeds and directions with and without guide fields, unifying previous knowledge in a single theory. New results include: (1) Reconnection spreads in a particular direction if an x-line is induced at the interface between reconnecting and non-reconnecting regions, which is controlled by the out of plane gradient of the electric field in the outflow direction. (2) The spreading mechanism for anti-parallel collisionless reconnection is convection, as is known, but for guide field reconnection it is magnetic field bending. We confirm the theory using 3D two-fluid and resistive-magnetohydrodynamics simulations. (3) The theory explains why anti-parallel reconnection in resistive-magnetohydrodynamics does not spread. (4) The simulation domain aspect ratio, associated with the free magnetic energy, influences whether reconnection spreads or convects with a fixed x-line length. (5) We perform a simulation initiating anti-parallel collisionless reconnection with a pressure pulse instead of a magnetic perturbation, finding spreading is unchanged rather than spreading at the magnetosonic speed as previously suggested. The results provide a theoretical framework for understanding spreading beyond systems studied here, and are important for applications including two-ribbon solar flares and reconnection in Earth’s magnetosphere.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2021

The leucine-rich repeats in allelic barley MLA immune receptors define specificity towards sequence-unrelated powdery mildew avirulence effectors with a predicted common RNase-like fold

Nucleotide-binding domain leucine-rich repeat-containing receptors (NLRs) in plants can detect avirulence (AVR) effectors of pathogenic microbes. The Mildew locus a (Mla) NLR gene has been shown to confer resistance against diverse fungal pathogens in cereal crops. In barley, Mla has undergone allelic diversification in the host population and confers isolate-specific immunity against the powdery mildew-causing fungal pathogen Blumeria graminis forma specialis hordei (Bgh). We previously isolated the Bgh effectors AVR A1 , AVR A7 , AVR A9 , AVR A13 , and allelic AVR A10 /AVR A22 , which are recognized by matching MLA1, MLA7, MLA9, MLA13, MLA10 and MLA22, respectively. Here, we extend our knowledge of the Bgh effector repertoire by isolating the AVR A6 effector, which belongs to the family of catalytically inactive RNase-Like Proteins expressed in Haustoria (RALPHs). Using structural prediction, we also identified RNase-like folds in AVR A1 , AVR A7 , AVR A10 /AVR A22 , and AVR A13 , suggesting that allelic MLA recognition specificities could detect structurally related avirulence effectors. To better understand the mechanism underlying the recognition of effectors by MLAs, we deployed chimeric MLA1 and MLA6, as well as chimeric MLA10 and MLA22 receptors in plant co-expression assays, which showed that the recognition specificity for AVR A1 and AVR A6 as well as allelic AVR A10 and AVR A22 is largely determined by the receptors’ C-terminal leucine-rich repeats (LRRs). The design of avirulence effector hybrids allowed us to identify four specific AVR A10 and five specific AVR A22 aa residues that are necessary to confer MLA10- and MLA22-specific recognition, respectively. This suggests that the MLA LRR mediates isolate-specific recognition of structurally related AVR A effectors. Thus, functional diversification of multi-allelic MLA receptors may be driven by a common structural effector scaffold, which could be facilitated by proliferation of the RALPH effector family in the pathogen genome.

59 BASIC BIOLOGICAL SCIENCES↗
NASA NTRS1987

Quantitative analysis of the reconstruction performance of interpolants

The analysis presented provides a quantitative measure of the reconstruction or interpolation performance of linear, shift-invariant interpolants. The performance criterion is the mean square error of the difference between the sampled and reconstructed functions. The analysis is applicable to reconstruction algorithms used in image processing and to many types of splines used in numerical analysis and computer graphics. When formulated in the frequency domain, the mean square error clearly separates the contribution of the interpolation method from the contribution of the sampled data. The equations provide a rational basis for selecting an optimal interpolant; that is, one which minimizes the mean square error. The analysis has been applied to a selection of frequently used data splines and reconstruction algorithms: parametric cubic and quintic Hermite splines, exponential and nu splines (including the special case of the cubic spline), parametric cubic convolution, Keys' fourth-order cubic, and a cubic with a discontinuous first derivative. The emphasis in this paper is on the image-dependent case in which no a priori knowledge of the frequency spectrum of the sampled function is assumed.

Lansing, Donald L.↗
NASA NTRS2010

The Value of Identifying and Recovering Lost GN&C Lessons Learned: Aeronautical, Spacecraft, and Launch Vehicle Examples

Within the broad aerospace community the importance of identifying, documenting and widely sharing lessons learned during system development, flight test, operational or research programs/projects is broadly acknowledged. Documenting and sharing lessons learned helps managers and engineers to minimize project risk and improve performance of their systems. Often significant lessons learned on a project fail to get captured even though they are well known 'tribal knowledge' amongst the project team members. The physical act of actually writing down and documenting these lessons learned for the next generation of NASA GN&C engineers fails to happen on some projects for various reasons. In this paper we will first review the importance of capturing lessons learned and then will discuss reasons why some lessons are not documented. A simple proven approach called 'Pause and Learn' will be highlighted as a proven low-impact method of organizational learning that could foster the timely capture of critical lessons learned. Lastly some examples of 'lost' GN&C lessons learned from the aeronautics, spacecraft and launch vehicle domains are briefly highlighted. In the context of this paper 'lost' refers to lessons that have not achieved broad visibility within the NASA-wide GN&C CoP because they are either undocumented, masked or poorly documented in the NASA Lessons Learned Information System (LLIS).

Dennehy, Cornelius J.↗
NASA NTRS2020

Credible practice of modeling and simulation in healthcare: ten rules from a multidisciplinary perspective

The complexities of modern biomedicine are rapidly increasing. Thus, modeling and simulation have become increasingly important as a strategy to understand and predict the trajectory of pathophysiology, disease genesis, and disease spread in support of clinical and policy decisions. In such cases, inappropriate or ill-placed trust in the model and simulation outcomes may result in negative outcomes, and hence illustrate the need to formalize the execution and communication of modeling and simulation practices. Although verification and validation have been generally accepted as significant components of a model’s credibility, they cannot be assumed to equate to a holistic credible practice, which includes activities that can impact comprehension and in-depth examination inherent in the devel-opment and reuse of the models. For the past several years, the Committee on Credible Practice of Modeling and Simulation in Healthcare, an interdisciplinary group seeded from a U.S. interagency initiative, has worked to codify best practices. Here, we provide Ten Rules for credible practice of modeling and simulation in healthcare developed from a comparative analysis by the Committee’s multidisciplinary membership, followed by a large stakeholder com-munity survey. These rules establish a unified conceptual framework for modeling and simulation design, implementation, evaluation, dissemination and usage across the modeling and simulation life-cycle. While biomedical science and clinical care domains have somewhat different requirements and expectations for credible practice, our study converged on rules that would be useful across a broad swath of model types. In brief, the rules are: (1) Define context clearly. (2) Use contextually appropriate data. (3) Evaluate within context. (4) List limitations explicitly. (5) Use version control. (6) Document appropriately. (7) Disseminate broadly. (8) Get independent reviews. (9) Test competing imple-mentations. (10) Conform to standards. Although some of these are common sense guidelines, we have found that many are often missed or misconstrued, even by seasoned practitioners. Computational models are already widely used in basic science to generate new biomedical knowledge. As they penetrate clinical care and healthcare policy, contributing to personalized and precision medicine, clinical safety will require established guidelines for the credible practice of modeling and simulation in healthcare.

Credibility↗
NASA NTRSDate not supplied

Exploring Requirements for Software that Learns: A Research Preview

Context & motivation: The development of software that learns has revolutionized how many systems perform. For the most part, these systems are neither safety- nor mission-critical. However, as technology and aspirations advance, there is an increased desire and need for Machine Learning (ML) software in safety- and mission-critical systems, e.g., driverless cars or autonomous space robotics. Problem: In these domains, reliability is crucial and systems have to undergo much scrutiny in terms of both the developed artefacts and the adopted development process. Central to the development of such systems is the elicitation and definition of software requirements that are used to guide the design and verification process. The addition of software components that learn, and the associated capability for unforeseen behavior, makes defining detailed software requirements especially difficult. Principal ideas/results: In this paper, we identify unique characteristics of software requirements that are specific to ML components. To this end, we collect and examine requirements from both academic and industrial sources. Contribution: To the best of our knowledge, this is the first work that presents real-life, industrial patterns of requirements for ML components. Furthermore, this paper identifies key characteristics and provides a foundation for developing a taxonomy of requirements for software that learns.

Probabilistic requirements↗
DOE OSTI2024

Parameter identification methods for low-order gray box building energy models: A critical review

The body of knowledge on gray box building energy modeling (GBBEM) has been developed over the past few decades and has undergone some important changes recently. Starting with simple methods and simple buildings, the science of GBBEM has grown to encompass complex and more computationally intensive techniques and complex commercial buildings. Numerous works including a recent review have considered model structure and inputs in a nearly systematic way, but no extant work systematically reviews the approaches for GBBEM parameter search initialization and final identification, despite this being arguably the most difficult and impactful part of the modeling process. To this end, we critically review 55 extant works describing advantages, limitations, and domain of applicability of several classes of parameter initialization and optimization techniques specifically for GBBEM. We categorize the classes of methods and analyze the evidence of their applicability for different applications within the field of GBBEM. We find an emerging consensus that initialization of parameter searches for anything other than the simplest building elements is often challenging and sometimes requires a stochastic approach to begin the parameter identification process. After this initial process, faster methods have been used in some cases but often the nature of the problem requires stochastic methods for this portion of the process as well. For less complex systems, more deterministic and efficient methods have been shown to be effective. Finally, we draw conclusions as to the domain of applicability of different classes of initialization and optimization techniques for GBBEEM and offer suggestions for research directions that are likely to prove fruitful.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2024

Partial wrapping of single-stranded DNA by replication protein A and modulation through phosphorylation

Abstract Single-stranded DNA (ssDNA) intermediates which emerge during DNA metabolic processes are shielded by replication protein A (RPA). RPA binds to ssDNA and acts as a gatekeeper to direct the ssDNA towards downstream DNA metabolic pathways with exceptional specificity. Understanding the mechanistic basis for such RPA-dependent functional specificity requires knowledge of the structural conformation of ssDNA when RPA-bound. Previous studies suggested a stretching of ssDNA by RPA. However, structural investigations uncovered a partial wrapping of ssDNA around RPA. Therefore, to reconcile the models, in this study, we measured the end-to-end distances of free ssDNA and RPA–ssDNA complexes using single-molecule FRET and double electron–electron resonance (DEER) spectroscopy and found only a small systematic increase in the end-to-end distance of ssDNA upon RPA binding. This change does not align with a linear stretching model but rather supports partial wrapping of ssDNA around the contour of DNA binding domains of RPA. Furthermore, we reveal how phosphorylation at the key Ser-384 site in the RPA70 subunit provides access to the wrapped ssDNA by remodeling the DNA-binding domains. These findings establish a precise structural model for RPA-bound ssDNA, providing valuable insights into how RPA facilitates the remodeling of ssDNA for subsequent downstream processes.

Biochemistry & Molecular Biology↗
NASA NTRS1990

CLIPS: A tool for corn disease diagnostic system and an aid to neural network for automated knowledge acquisition

This paper describes the building of a corn disease diagnostic expert system using CLIPS, and the development of a neural expert system using the fact representation method of CLIPS for automated knowledge acquisition. The CLIPS corn expert system diagnoses 21 diseases from 52 symptoms and signs with certainty factors. CLIPS has several unique features. It allows the facts in rules to be broken down to object-attribute-value (OAV) triples, allows rule-grouping, and fires rules based on pattern-matching. These features combined with the chained inference engine result to a natural user query system and speedy execution. In order to develop a method for automated knowledge acquisition, an Artificial Neural Expert System (ANES) is developed by a direct mapping from the CLIPS system. The ANES corn expert system uses the same OAV triples in the CLIPS system for its facts. The LHS and RHS facts of the CLIPS rules are mapped into the input and output layers of the ANES, respectively; and the inference engine of the rules is imbedded in the hidden layer. The fact representation by OAC triples gives a natural grouping of the rules. These features allow the ANES system to automate rule-generation, and make it efficient to execute and easy to expand for a large and complex domain.

Wu, Cathy↗
NASA NTRS1998

Assessment of the 60 Km Rapid Update Cycle (RUC) with Near Real-Time Aircraft Reports

NASA is developing the Center-TBACON Advisory System (CTAS), a set of Air Traffic Management (ATM) Decision Support Tools (DST) to enable controllers to increase airspace capacity and flight efficiency. A crucial component of the CTAS, or any ATM DST, is the computation of the time-of-flight of aircraft along flight path segments which requires accurate knowledge of the wind through which the aircraft are flying. CTAS currently uses wind information from the Rapid Update Cycle (RUC), a numerical prediction model run operationally by the National Weather Service (NWS) National Center for Environmental Prediction (NCEP). There exists near real-time wind observations from commercial aircraft that can be used to increase the accuracy of the RUC wind forecasts via the FAA Integrated Terminal Weather System (ITWS) Terminal Winds (TW) algorithm. This report presents a study based on the application of the ITWS TW algorithm as an improvement to the baseline RUC product. Terminal Winds generally does not support the full Center airspace; the domain of the prototype MIT/LLITWS TW system was increased to cover the Denver Center airspace to support this study. This study has three goals: 1) determine the errors in the baseline 60-kilometer resolution RUC forecast wind fields relative to the needs of en route DSTs such as CTAS; 2) determine the benefit of using the TW algorithm to refine the RUC forecast wind fields with near real-tlme Meteorological Data Collection and Reporting System (MDCRS) aircraft reports, and 3) identify factors that influence wind field errors in order to improve accuracy and estimate errors in real time. The data for this study were collected over a one-year period for the Denver Center airspace and over one miIlion verification observations were used. This study is part of a larger effort funded by NASA which includes the NOAA/FSL.

Cole, R. E.↗
NASA NTRS2005

Formal Safety Certification of Aerospace Software

In principle, formal methods offer many advantages for aerospace software development: they can help to achieve ultra-high reliability, and they can be used to provide evidence of the reliability claims which can then be subjected to external scrutiny. However, despite years of research and many advances in the underlying formalisms of specification, semantics, and logic, formal methods are not much used in practice. In our opinion this is related to three major shortcomings. First, the application of formal methods is still expensive because they are labor- and knowledge-intensive. Second, they are difficult to scale up to complex systems because they are based on deep mathematical insights about the behavior of the systems (t.e., they rely on the "heroic proof"). Third, the proofs can be difficult to interpret, and typically stand in isolation from the original code. In this paper, we describe a tool for formally demonstrating safety-relevant aspects of aerospace software, which largely circumvents these problems. We focus on safely properties because it has been observed that safety violations such as out-of-bounds memory accesses or use of uninitialized variables constitute the majority of the errors found in the aerospace domain. In our approach, safety means that the program will not violate a set of rules that can range for the simple memory access rules to high-level flight rules. These different safety properties are formalized as different safety policies in Hoare logic, which are then used by a verification condition generator along with the code and logical annotations in order to derive formal safety conditions; these are then proven using an automated theorem prover. Our certification system is currently integrated into a model-based code generation toolset that generates the annotations together with the code. However, this automated formal certification technology is not exclusively constrained to our code generator and could, in principle, also be integrated with other code generators such as RealTime Workshop or even applied to legacy code. Our approach circumvents the historical problems with formal methods by increasing the degree of automation on all levels. The restriction to safety policies (as opposed to arbitrary functional behavior) results in simpler proof problems that can generally be solved by fully automatic theorem proves. An automated linking mechanism between the safety conditions and the code provides some of the traceability mandated by process standards such as DO-178B. An automated explanation mechanism uses semantic markup added by the verification condition generator to produce natural-language explanations of the safety conditions and thus supports their interpretation in relation to the code. It shows an automatically generated certification browser that lets users inspect the (generated) code along with the safety conditions (including textual explanations), and uses hyperlinks to automate tracing between the two levels. Here, the explanations reflect the logical structure of the safety obligation but the mechanism can in principle be customized using different sets of domain concepts. The interface also provides some limited control over the certification process itself. Our long-term goal is a seamless integration of certification, code generation, and manual coding that results in a "certified pipeline" in which specifications are automatically transformed into executable code, together with the supporting artifacts necessary for achieving and demonstrating the high level of assurance needed in the aerospace domain.

Denney, Ewen↗