Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Formal Verification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

The First Tri-Lab Workshop on Formal Verification: Capabilities, Challenges, Research Opportunities, and Exemplars

The First Tri-Lab Workshop on Formal Verification was held in Santa Fe, New Mexico, on December 5th, 2023. This workshop gathered staff from Sandia, Los Alamos, and Lawrence Livermore National Laboratories and NASA’s Jet Propulsion Laboratory. This report summarizes and expands on the presentations given and discussion had at this workshop. In this report, we describe the current capabilities and research needs related to formal methods at the NNSA labs. In particular, we identify medium-term and long-term research gaps in programming languages, formalization efforts of complex systems, embedded systems verification, hardware verification, cybersecurity, formal methods usability, workflows, numerical methods, the use of formal methods for artificial intelligence (and its converse, artificial intelligence for formal methods), and collaboration opportunities and considerations on these topics. We conclude with a small number of exemplar research problems related to these topics.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Formal verification and validation of run-to-completion style state charts using Event-B

State chart notations with ‘run to completion’ semantics are popular with engineers for designing controllers that react to environment events with a sequence of state transitions but lack formal refinement and rigorous verification methods. State chart models are typically used to design complex control systems that respond to environmental triggers with a sequential process. The model is usually constructed at a concrete level and verified and validated using animation techniques relying on human judgement. Event-B, on the other hand, is based on refinement from an initial abstraction and is designed to make formal verification by automatic theorem provers feasible. Abstraction and formal verification provide greater assurance that critical (e.g. safety or security) properties are not violated by the control system. In this paper, we introduce a notion of refinement into a ‘run to completion’ state chart modelling notation and leverage Event-B’s tool support for theorem proving. We describe the difficulties in translating ‘run to completion’ semantics into Event-B refinements and suggest a solution. We illustrate our approach and show how models can be validated at different refinement levels using our scenario checker animation tools. We show how critical invariant properties can be verified by proof despite the reactive nature of the system and how behavioural aspects of the system can be verified by testing the expected reactions using a temporal logic, model checking approach. To verify liveness, we outline a proof that the run to completion is deadlock-free and converges to complete the run.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Software Verification Toolkit (SVT): Survey on Available Software Verification Tools and Future Direction

Writing software is difficult. However, writing complex, well tested and designed, and functionally correct software is incredibly difficult. An entire field of study is devoted to the validation and verification of software to address this problem, and in this paper we analyze the landscape of currently available third party software. We have divided our analyses into three separate subsections with regards to software validation: formal methods, static analysis, and test generation. Formal verification is the most complex method in which to validate software correctness, but also the most thorough as it truly validates the mathematical validity of the source code. Static analysis generally is relegated to abstract syntax tree traversal techniques to find errors related to faulty software such as memory leaks or stack overflow issues. Automatic test generation is similar in implementation to static analysis, but pushes a bit further in verifying the boundedness of function inputs and outputs with regards to annotated or parsed criteria. The crux of this report is to analyze and describe the software tools that implement these techniques to validate and verify software. Pros and cons related to installation, utilization, and capabilities of the frameworks are described, and reproducible examples are provided with a focus on usability. The initial survey concluded that the most interesting tools of note are Z3, Isabelle/HOL, and TLA+ with regards to formal verification; and Infer, Frama-C, and SonarQube with regards to static analysis. With these tools in mind, a final conjecture is provided that describes future avenues of utilizing these tools for developing a verification framework to assist in validating existing software at Sandia National Laboratories.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

MFANS 2024 - Formally Proving Characteristics of Cyber-Physical Systems

Cyber-physical systems (CPS) are engineered systems that rely on the smooth integration of computational algorithms and physical elements. This integration presents new challenges for verifying that systems will behave as expected. The goal of this presentation is to present current challenges and potential solutions for the formal verification of cyber-physical systems. For cyber systems, formal methods refer to systematically rigorous mathematical techniques employed in the specification, development, analysis, and verification of both software and hardware systems. Recent advancements in computer science have yielded sophisticated tools specifically designed to address challenges associated with formal methods in complex systems. These tools leverage various foundational concepts such as logic, formal languages, program semantics, type systems, type theory, and automata theory. A notable achievement in the application of formal methods is the seL4 microkernel, claimed to be the first general-purpose operating-system kernel to be verified. Its proof implies the absence of bugs and guarantees that the kernel meets specifications. For physical systems, dynamic and control theory has a history of using rigorous analytic techniques to prove functional correctness. Lyapunov, optimal, classical, modern, and robust control theories all provide rigorous mathematical methods both to analyze system performance and to design controller that can be guaranteed to meet certain objectives. Recent computational techniques like level set theory and reachability analysis provide assertions that a system's state will avoid unsafe regions. Even though success has been independently achieved for cyber systems and physical systems, the integration of such systems creates new challenges. In particular, there is an obvious discrepancy between finite-state machines and infinite-state systems, resulting in different approaches for modeling and analyzing these system. While it is possible to simulate hybrid systems, this provides only a demonstration of a performance and not proof. For hybrid systems, current formal methods and system analysis approaches typically require a workarounds to work on hybrid systems like CPS. This paper will outline the state of the art and limits of current practice for formally verifying CPS and will identify possible research directions that require attention.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

ROSE Castor

ROSE Castor is a tool enabling automated verification of C++, built off of the ROSE compiler framework and the Why3 framework. Castor defines a verification language for providing specifications of C++ code, letting users perform automated functional formal verification of their C++ code. Castor is designed to target C++17, and supports a subset of the language, including classes, functions, templates, integers and booleans, pointers and references, and single inheritance. Castor currently does not support multiple or virtual inheritance, virtual functions, floating-point, threading, lambda functions, or the C++ STL, though some of these are planned in future updates. Castor ships with an in-house parser for parsing verification conditions.

Lane, PhillipA [Lawrence Livermore National Labora↗
DOE OSTI2024

Demonstration of Model-Based Design for Digital Controller Using Formal Methods

This report describes work originally performed in FY19 that assembled a workflow enabling formal verification of high-consequence digital controllers. The approach builds on an engineering analysis strategy using multiple abstraction levels (Model-Based Design) and performs exhaustive formal analysis of appropriate levels – here, state machines and C code – to assure always/never properties of digital logic that cannot be verified by testing alone. The operation of the workflow is illustrated using example models and code, including expected failures of verification when properties are violated.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Enhancement of risk informed validation framework for external hazard scenario

In recent years, the U.S. Nuclear Regulatory Commission (USNRC) and the International Atomic Energy Agency (IAEA) have developed methodologies to assess the vulnerabilities of nuclear plants against site specific extreme hazards. In many cases, advanced simulation tools are being considered to simulate multi-physics, multi-scale phenomena and to evaluate vulnerability of nuclear facilities. The credibility of advanced simulation tools is assessed based on a formal verification, validation, and uncertainty quantification procedure. One of the key limitations in validation is the lack of relevant experimental data at system-level. This limitation leads to a decrease in the confidence of system-level risk predictions. Therefore, a robust validation framework is needed to formalize the confidence in predictive capability of advanced simulation results. Additionally, this study enhances the existing risk informed validation methodology, originally proposed by Kwag et al. [1] and Bodda et al. [2], by developing additional attributes and a new set of validation indicies for a complete and wider applicability of the framework. In this manuscript, the methodology to identify the critical path that leads to the system-level failure is illustrated. The overall validation is checked for completeness and consistency by comparing the critical path for both the system-level simulation and experimental models. The applicability of the code for an intended application is represented in terms of various maturity levels and helps in the process of decision making.

42 ENGINEERING↗
DOE OSTI2022

Modelica-json: Transforming energy models to digitize the control delivery process

Building simulation models are typically not used to generate the documentation required for bidding and project delivery of commercial building systems, or for their semantic modeling and commissioning. This paper presents a software tool that aids in digitizing the control delivery process, spanning simulation during design to implementation and formal verification during commissioning. The tool can generate from Modelica models digital documentation of control sequences. This digital documentation, along with other project drawings and specifications can be used for project bidding. It can also be used for implementation of control sequences through machineto-machine translation to commercial legacy control products, for which we are currently developing the proposed ASHRAE Standard 231P based on the presented work. Moreover, as-installed control sequences can be formally verified against the design specification, and a semantic model in Brick can be exported to aid in configuration of building analytics and fault detection. The paper presents what we believe is the first translation of a Modelica-implemented control sequence to a native implementation on a commercial control platform, using the webCTRL product line from Automated Logic. The paper also shows how a webCTRL implementation can be formally verified against its Modelica specification. These use cases have all been demonstrated with a prototype implementation that is now being further developed.

Wetter, Michael↗
DOE OSTI2025

AMR-Wind: A Performance-Portable, High-Fidelity Flow Solver for Wind Farm Simulations

We present AMR-Wind, a verified and validated high-fidelity computational-fluid-dynamics code for wind farm flows. AMR-Wind is a block-structured, adaptive-mesh, incompressible-flow solver that enables predictive simulations of the atmospheric boundary layer and wind plants. It is a highly scalable code designed for parallel high-performance computing with a specific focus on performance portability for current and future computing architectures, including graphical processing units (GPUs). In this paper, we detail the governing equations, the numerical methods, and the turbine models. Establishing a foundation for the correctness of the code, we present the results of formal verification and validation. The verification studies, which include a novel actuator line test case, indicate that AMR-Wind is spatially and temporally second-order accurate. The validation studies demonstrate that the key physics capabilities implemented in the code, including actuator disk models, actuator line models, turbulence models, and large eddy simulation (LES) models for atmospheric boundary layers, perform well in comparison to reference data from established computational tools and theory. We conclude with a demonstration simulation of a 12-turbine wind farm operating in a turbulent atmospheric boundary layer, detailing computational performance and realistic wake interactions.

17 WIND ENERGY↗
DOE OSTI2021

Modeling fission product diffusion in TRISO fuel particles with BISON

Diffusion of fission products in intact TRISO particles depends on particle geometry, fission product source rates, time, temperature, and temperature-dependent diffusion coefficients. Simulating this diffusion process requires models for source rates and diffusion coefficients, plus computation of the temperature field if not prescribed. In addition, simulation quality depends on discretization of the geometry, appropriate time stepping, and the accuracy of the solution method. In this paper, we explore the simulation of fission product diffusion in TRISO fuel particles using the finite element method via the fuel performance code Bison. Recent material model development has occurred in Bison for each material present in tri-structural isotropic (TRISO) fuel particles: the buffer, inner pyrolytic carbon, silicon carbide, and outer pyrolytic carbon layers, as well as the fuel kernel. Also, new mesh generation and fission product release fraction capabilities have been added. Diffusion capabilities are shown to converge to the correct solution via formal verification tests. A large number of code benchmarking problems are also given, with good results, showing that Bison’s computed release fractions closely match those of other software tools. Finally, a significant validation effort is detailed in which fission product release, measured as part of the AGR-1 capsule experiments, is compared to Bison outputs. Bison outputs compare very well to the experimental data and to PARFUME results.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗
DOE OSTI2026

Fortran mimetic abstraction language (Formal) v0.1.

The Fortran mimetic abstraction language ("Formal") is a domain-specific language (DSL) embedded in Fortran 202Y [1]. Formal provides novel software abstractions for simulating phenomena governed by the partial differential equations (PDEs) of vector and tensor calculus. Such equations model an extremely broad set of physical phenomena, ranging from atmospheric winds to light propagation. Formal's data structures and algorithms mimic in form and behavior continuous functions and operators. Formal supports these mathematical constructs using mimetic discretizations that define a discrete calculus satisfying various tensor calculus theorems, thereby ensuring high-fidelity representations of the physics being modeled. [2] Formal 0.1.0 also lays a foundation for the future use of Fortran 202Y type-safe templates to facilitate the formal verification of tensor contractions in computational physics and artificial intelligence [3]. [1] "Fortran 202Y" is Fortran standard committee's informal designation for the next Fortran revision, which will likely be "Fortran 2028". [2] Corbino, J. and Castillo, J. (2020) Journal of Computational and Applied Mathematics, https://doi.org/10.1016/j.cam.2019.06.042. [3] Haveraaen, M., Järvi, J., & Rouson, D. (2019). Reflecting on Generics for Fortran. https://j3-fortran.org/doc/year/19/19-188.pdf.

Rouson, Damian [Lawrence Berkeley National Laborat↗
DOE OSTI2019

Wind Energy Instrumentation Atlas

The US Department of Energy (DOE) A2e program is focused on developing the next generation of predictive tools to better understand wind plant performance and help industry lower the overall cost of energy. A formal verification and validation process is required to demonstrate improved accuracy of these new models beyond those currently employed. And a critical part of model validation is utilization of a diverse set of accurate observations of atmospheric forcing and wind plant response. A number of existing data sets that will be used for this purpose, as highlighted by Schreck and Maniaci (2017) but A2e researchers also realize that new datasets will be required to meet validation objectives. As such, plans for new experiments based on model validation priorities (NALU validation plan, 2017) are currently being developed. This document is intended to serve as a reference to experimental study planners that describes the capability, accuracy and resolution of existing and developing measurement technologies to observe quantities of interest for wind plant model validation. Such systems can be broken into two major categories: those that measure the flow field and surrounding atmosphere around and within a wind plant and those that measure the turbine response within the wind plant. The A2e validation team will use this catalogue of instrument capability in conjunction with the validation plan, to choose the optimal set of instruments to be deployed, inform instrument placement and operation and estimate the types of validation that may be gathered through new field campaigns. Where existing instrumentation is deficient, the document will also help guide DOE towards potential areas where instrumentation development is required to meet validation objectives and A2e technology development funding may be required. The domain of interest is the wind plant microscale, within and surrounding a single wind plant, typically, tens of kilometers on a side in horizontal directions and to the top of the atmospheric boundary layer (about 1km) in the vertical. Some observations of dominant mesoscale forcing phenomena are required, with the highest resolution measurements occurring in the wind turbine wakes and on the turbines themselves. The simulation tools to be validated are mesoscale driven large-eddy simulations of the atmosphere with full aeroelastic response of individual turbines within the plant. Use cases vary slightly among tool users, but should focus on the primary end customers of the simulations and research insights, which would be turbine manufacturers, wind plant developers and owners. Broadly speaking their interests are maximizing energy output, while maintaining turbine reliability and lifetime.

17 WIND ENERGY↗
DOE OSTI2025

Theorems in Service of Sound Composition, Rapid Modeling and Scalable Analysis

This project extends the state of the art in formal verification modeling with modules and automatically checkable data-sharing patterns such that component modules can retain their assurance case when composed within a larger system. For users, smaller models make reasoning easier and help to ensure they accurately reflect text specifications. For automated methods, smaller models give exponential benefits for verification algorithm execution time.

97 MATHEMATICS AND COMPUTING↗